Feat: Add Organization Subscription-Preview Endpoint

[sbrown-livefront]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-39927

📔 Objective

First endpoint on the new Bit.Subscriptions.Organization feature library and first consumer of the shared, Stripe-invoice-preview–driven cart summary. Sources the organization's upcoming-renewal cart totals from an actual Stripe invoice preview instead of reconstructing them from local subscription state.

Adds:

• GetSubscriptionPreviewQuery (Bit.Invoicing) — shared, ISubscriber-generic query ported from GetBitwardenSubscriptionQuery. Resolves tier/cadence (collapsing TeamsStarter → Teams), previews via create_preview(subscription=id), falls back to the subscription overload when there's no upcoming invoice, and maps subscription status → SubscriptionPreview envelope (suspension/grace-period/cancel). Registered in AddInvoicing(). The Organization path is fully wired here; the User/Premium path is stubbed for Task 8.
• GET /organizations/{organizationId:guid}/billing/subscription/preview — new route on the org subscription group, gated behind PM36631_PreviewDrivenCart.
• Authorization via AuthorizeAttribute<OrganizationBillingRequirement> using the IOrganizationRequirement framework (Owner or confirmed provider-user-for-org; excludes Admin/Custom). Lives entirely in the OrganizationAuthorization library — no dependency on the Api project.
• Unit tests for the query, the requirement, and the endpoint handler + group wiring.

[codecov]

Codecov Report

❌ Patch coverage is 82.69231% with 18 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (billing/PM-39925/invoice-preview-projection@72c51a8). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...icePreviews/Queries/GetSubscriptionPreviewQuery.cs	79.51%	13 Missing and 4 partials ⚠️
...ion/OrganizationSubscriptionEndpointsExtensions.cs	80.00%	1 Missing ⚠️

Additional details and impacted files

@@                              Coverage Diff                               @@
##             billing/PM-39925/invoice-preview-projection    #8245   +/-   ##
==============================================================================
  Coverage                                               ?   63.43%           
==============================================================================
  Files                                                  ?     2425           
  Lines                                                  ?   104542           
  Branches                                               ?     9495           
==============================================================================
  Hits                                                   ?    66312           
  Misses                                                 ?    35954           
  Partials                                               ?     2276           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Re-reviewed after the latest push. The duplicate, unprefixed MapUserSubscriptionEndpoints() / MapOrganizationSubscriptionEndpoints() calls have been removed from Startup.cs, so the groups are now mapped exactly once through MapSubscriptionEndpoints with the /organizations/{organizationId:guid}/billing/subscription prefix, and the XML doc on MapOrganizationSubscriptionEndpoints now matches the group-level OrganizationBillingRequirement. Verified the new GetSubscriptionPreviewQuery against the GetBitwardenSubscriptionQuery it ports from (status branches, test_clock expansion for suspension timing, invoice_upcoming_none fallback, resource_missing → null), the group's authorization chain (Policies.Application + AuthorizeAttribute<OrganizationBillingRequirement>, matching the ManageOrganizationBillingRequirement posture already used across OrganizationBillingVNextController), and the Bit.Api.AdminConsole.Authorization → Bit.OrganizationAuthorization namespace move, which is mechanical and consistent across all 16 call sites.

Code Review Details

No new findings.

Previously raised and now addressed:

• ❌ : Duplicate, unprefixed registration of the subscription endpoint groups — fixed in b4e91c6
  • src/Api/Startup.cs
• ♻️ : Method XML doc contradicted the group-level authorization — fixed in dd2eb84
  • src/Libraries/Subscriptions.Organization/OrganizationSubscriptionEndpointsExtensions.cs:17-21

Still open, acknowledged by the author as follow-up work:

• ♻️ : OrganizationBillingRequirement is a verbatim duplicate of ManageOrganizationBillingRequirement; the shared home would be the OrganizationAuthorization library
  • src/Libraries/Subscriptions.Organization/Requirements/OrganizationBillingRequirement.cs:8-18

Notes:

• AddScoped<OrganizationSubscriptionEndpointsHandler>() (rather than TryAdd*) matches the existing endpoint-handler registration pattern in Pam/Utilities/ServiceCollectionExtensions.cs, so it is not flagged.
• The only manifest change is an internal ProjectReference to OrganizationAuthorization in Subscriptions.Organization.csproj; the packages.lock.json diffs are the regenerated project-reference graph. No external package versions changed, so no dependency review applies.