[PM-40209] Add PAM access claim and ManageAccessRules permission

[Hinton]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-40209

📔 Objective

The identity/authorization spine for PAM, mirroring the Secrets Manager shape throughout: an accesspam claim beside accesssecretsmanager, and the one PAM custom permission, ManageAccessRules. Holding AccessPam is the access grant — there is no separate "can access PAM items" permission; ManageAccessRules only gates Access Rule authorship.

Consumption is left to the IOrganizationRequirement pattern (ADR-0022) in PM-40211, so this only touches claim emission and the claims-parsing path the requirement handler reads.

Worth flagging for review:

• CurrentContext is untouched — no AccessPam(orgId)/ManageAccessRules(orgId) helpers, no changes to its hand-rolled claims parsers. That's the legacy path requirements replace.
• PamAccess is deliberately not in UserIdentityClaimTypes. It's an authorization claim, so it must be rebuilt from the database on every issuance rather than carried across a refresh.
• Two additions beyond the ticket's scope. ApiResources declares Claims.PamAccess where SecretsManagerAccess already sits (not load-bearing, but keeps the declared resource claims honest). The public API's hand-rolled PermissionsModel gains ManageAccessRules, because ToData() rebuilds the whole object and would otherwise silently clear it on PUT /public/members/{id}; ToData_RoundTripsEveryPermission guards that mirror against future drift.
• Known gap: OrganizationService.ValidateCustomPermissionsGrant enumerates permissions against ICurrentContext, so it doesn't cover ManageAccessRules — a Custom member with ManageUsers could grant it without holding it. The newer OrganizationUserValidationService uses ClaimsMap and is covered. Closing the legacy path needs the CurrentContext helpers this story excludes.

Depends on PM-40208 (the OrganizationUser.AccessPam column), already merged.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the PAM identity/authorization spine: the accesspam claim emission in CoreHelpers.BuildIdentityClaims, the ManageAccessRules custom permission, and the claims-parsing path in OrganizationClaimsExtensions. Traced the claim end-to-end — CurrentContextOrganization gates AccessPam on AccessPam && UsePam && Enabled (mirroring Secrets Manager), ProfileService rebuilds claims from the database on every issuance, and PamAccess is correctly excluded from the UserIdentityClaimTypes allowlist so it cannot survive a refresh. Verified ManageAccessRules reaches every hand-rolled mirror that would otherwise drop it (Permissions.ClaimsMap, public PermissionsModel, OrganizationClaimsExtensions), and that OrganizationUserValidationService.ValidateCustomPermissionsGrant picks it up automatically via ClaimsMap on DB-sourced OrganizationUser actors. No findings met the confidence threshold for an inline comment.

Code Review Details

No findings.

Notes considered and intentionally not raised as findings:

• The OrganizationService.ValidateCustomPermissionsGrant gap (legacy ICurrentContext enumeration does not cover ManageAccessRules) and the untouched CurrentContext.SetOrganizationPermissionsFromClaims parser are both explicitly documented in the PR description with rationale and follow-up scope. Both fail closed today since nothing consumes ManageAccessRules until PM-40211.
• PermissionsModelTests.ToData_RoundTripsEveryPermission is a good guard against the silent-clear class of bug on PUT /public/members/{id}; it will catch future drift automatically.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.06%. Comparing base (73ed2f6) to head (76f8d09).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8160       +/-   ##
===========================================
+ Coverage   15.10%   63.06%   +47.95%     
===========================================
  Files        1417     2315      +898     
  Lines       61422   100530    +39108     
  Branches     4901     9045     +4144     
===========================================
+ Hits         9279    63395    +54116     
+ Misses      51978    34945    -17033     
- Partials      165     2190     +2025     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.