[PM-40523] feat: Add endpoint to return organization private key to admins

[r-tome]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-40523

📔 Objective

Adds GET /organizations/{orgId}/private-key, letting admin-level users (owners, admins, providers, and the "Manage Users" custom permission) fetch an organization's encrypted private key.

This supports KM's fix for the account-recovery-enrollment vulnerability (PM-40307): when an admin generates an invite link, the client needs to derive the org's public-key fingerprint from a source that can't be silently swapped by a malicious server. Fetching the encrypted (tamper-evident) private key and deriving the public key/fingerprint from it client-side achieves that, instead of trusting a bare public key fetched directly from the server.

Access is gated by [Authorize<ManageUsersRequirement>], matching the ticket's explicit authorization spec. This deliberately widens access for the "Manage Users" custom permission (previously only "Manage account recovery" could read the org private key) — a known, intentional expansion discussed in PM-40523. Also gated behind the GenerateInviteLink feature flag, matching the rest of this epic's admin-side invite-link endpoints.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the new GET /organizations/{orgId}/private-key endpoint, its OrganizationPrivateKeyResponseModel, and the accompanying controller tests. The endpoint returns the organization's asymmetric private key encrypted with the org symmetric key (Protected Data), which preserves the zero-knowledge invariant — the server never sees plaintext key material. Access is correctly gated by both the GenerateInviteLink feature flag and [Authorize<ManageUsersRequirement>], and the {orgId} route parameter name is exactly what the requirement handler resolves via GetOrganizationId(). The intentional widening to the "Manage Users" custom permission is documented in the PR and tracked in PM-40523.

Code Review Details

No blocking findings. The change mirrors the existing sibling GetPublicKey endpoint and reuses the same encrypted Organization.PrivateKey field already exposed by OrganizationKeysResponseModel. The controller null-checks the organization and throws NotFoundException, and the response model is null-safe with a defensive ArgumentNullException guard. Tests cover both the found and not-found paths; authorization is enforced declaratively and validated by the shared requirement-handler tests.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.47%. Comparing base (6f0b248) to head (3d397a5).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...ganizations/OrganizationPrivateKeyResponseModel.cs	62.50%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8006   +/-   ##
=======================================
  Coverage   62.46%   62.47%           
=======================================
  Files        2297     2298    +1     
  Lines       99981    99996   +15     
  Branches     9020     9022    +2     
=======================================
+ Hits        62456    62468   +12     
- Misses      35346    35348    +2     
- Partials     2179     2180    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.