…uthenticated clients to get an enabled MP org policy if it exists for the purposes of enforcing those policy requirements when setting a password.

…UserService.setPasswordAsync into new SetInitialMasterPasswordCommand (2) Refactor SetInitialMasterPasswordCommand to only accept post SSO users who are in the invited state

(3) Add TODOs for more cleanup work and more commands

…erPasswordCommand

… method

…izationService.cs AcceptUserAsync method so while I was in here I converted the AcceptUserAsync methods into a new AcceptOrgUserCommand.cs and turned the private method which accepted an existing org user public for use in the SetInitialMasterPasswordCommand

…d-get-mp-policy-endpoint

# Conflicts:
#	src/Api/Controllers/OrganizationUsersController.cs
#	src/Core/Services/IOrganizationService.cs
#	src/Core/Services/Implementations/OrganizationService.cs

…UserCommand

…y for this command

…improve readability / clarity

…gId to retrieve orgUser with _organizationUserRepository.GetByOrganizationAsync which gets a single user instead of a collection

…n later

… to provide public static GetTokenLifeTime() method for testing (2) Add missed tests to SsoEmail2faSessionTokenable in preparation for building tests for new OrgUserInviteTokenable.cs

… tests as I've handled that separately in a new PR (#3270) for newly created task PM-3925

…cy-endpoint' into auth/pm-3275/tde-add-get-mp-policy-endpoint

…inguish between the Valid property and the TokenIsValid method.

…viteTokenableTests.cs

…o use new OrgUserInviteTokenable instead of manual creation of a token

…ore easily readable names.

… to add new token validation while maintaining backwards compatibility for 1 release.

…t is used

…orTokenFactory<OrgUserInviteTokenable> for new tokenable

…set its token lifetime to the _globalSettings.OrganizationInviteExpirationHours value. Creating a factory seemed the most straightforward way to encapsulate the desired creation logic. Unsure if in the correct location in ServiceCollectionExtensions.cs but will figure that out later.

…tionServiceTests.cs

…t suite completed.

…ganizationServiceTests as no longer needed to reference (2) Add summary for SetupCommonAcceptOrgUserMocks (3) Get AcceptOrgUserByToken_OldToken_AcceptsUserAndVerifiesEmail passing

…'s the right thing to do + enables test substitution

…serByToken_NewToken_AcceptsUserAndVerifiesEmail (2) Create and use SetupCommonAcceptOrgUserByTokenMocks() (3) Create generic FakeDataProtectorTokenFactory for tokenable testing

…sEmail test passing (2) Move FakeDataProtectorTokenFactory to own file

…gUserByTokenAsync

…cy-endpoint' into auth/pm-3275/tde-add-get-mp-policy-endpoint

…h_ThrowsBadRequest test

…ctor happy path assertions into helper function AssertValidAcceptedOrgUser to reduce code duplication

…sts for AcceptOrgUserByOrgIdAsync

…red when declaring singleton service in ServiceCollectionExtensions.cs

…r orgs without a MP policy, policy comes back as null and we should return notFound in that case.

…erPasswordPolicy(...) endpoint.

…roperly flag endpoint as deprecated

…eResponseModel.cs primarily for sync so that we can condition client side if TDE user obtains elevated permissions

…cy-endpoint' into auth/pm-3275/tde-add-get-mp-policy-endpoint

…short circuiting to only run old token validation if new token validation fails.

…entralize validation logic to avoid repetition (2) Add new token validation method so we can avoid having to pass in a full org user (and hitting the db to do so)

…ciesController.cs (existing user clicks invite link in email and goes to log in) and UserService.cs (user clicks invite link in email and registers for a new acct). Added tech debt item for cleaning up backwards compatibility in future.

…cy-endpoint' into auth/pm-3275/tde-add-get-mp-policy-endpoint

…PasswordRequestModel to allow null keys for the case where we have a TDE user who obtains elevated permissions - they already have a user public and user encrypted private key saved in the db. (2) AccountsControllerTests.cs - test PostSetPasswordAsync scenarios to ensure changes will work as expected.

…Refactor GetProfile to use variables to improve clarity and simplify debugging.

…cy-endpoint' into auth/pm-3275/tde-add-get-mp-policy-endpoint

…t as private instead of protected.

…s up from own line.

…ry variable

… expected outcome statement to test name

…s - (1) Rename orgIdentifier --> OrgSsoIdentifier for clarity (2) Update SetInitialMasterPasswordAsync to not allow null orgSsoId with explicit message saying this vs letting null org trigger invalid organization (3) Add test to cover this new scenario.

…ementation to interface to better respect standards and the fact that the interface is the more seen piece of code.

…UserByTokenAsync -> AcceptOrgUserByEmailTokenAsync + replace generic name token with emailToken

…cy-endpoint' into auth/pm-3275/tde-add-get-mp-policy-endpoint

… in error messages for consistency.

…t formatting of constructor for improved readability.

…esetPasswordPermission per PR feedback to remove unnecessary var.

… TODO

…dUser param to be guid instead of string.

…item info.

…e from tokenable instead of magic string.

…ProfileResponseModel.organizations array has org objects which have permissions which have the ManageResetPassword permission. So, I have the information that I need clientside already to determine if the user has the ManageResetPassword in any org.

…cy-endpoint' into auth/pm-3275/tde-add-get-mp-policy-endpoint