[PM-33061] Tax Id Should Be Added When Upgrading to Teams or Enterprise

[sbrown-livefront]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-33061

📔 Objective

Adds tax id during the upgrade from a Premium account to an Organization account. The changes ensure that tax IDs are attached to customers including special handling for Spanish NIFs.

Billing Address & Tax ID Handling

• The BillingAddress property in UpgradePremiumToOrganizationRequest and related tests was updated to use the more detailed CheckoutBillingAddressRequest type, enabling support for tax IDs.

Stripe Tax Logic

• When upgrading, the system now sets the Stripe customer’s TaxExempt status to Reverse if the billing country is not the US, or None if it is, and adds the provided tax ID to Stripe for accurate tax calculation.
• Special handling was added for Spanish NIFs

Note: Related to bitwarden/clients#19347 changes (This should be merged first if not at the same time).

📸 Screenshots

Screen.Recording.2026-03-03.at.2.03.01.PM.mov

Screen.Recording.2026-03-03.at.2.00.50.PM.mov

[github-actions]

Checkmarx One – Scan Summary & Details – 9c7ca881-d2e9-4818-ac89-e7f6400399e8

---

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Path_Traversal	/src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs: 56	details Method at line 56 of /src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs gets dynamic data from the model element. This ... Attack Vector
2		CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 291	details Method at line 291 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow... Attack Vector

---

Fixed Issues (3)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 146
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 531
	CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 105

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.07%. Comparing base (d86b7fa) to head (7b8bd46).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7131      +/-   ##
==========================================
+ Coverage   57.06%   57.07%   +0.01%     
==========================================
  Files        2028     2028              
  Lines       88774    88794      +20     
  Branches     7913     7914       +1     
==========================================
+ Hits        50656    50683      +27     
+ Misses      36287    36280       -7     
  Partials     1831     1831              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[amorask-bitwarden]

Looks great - thank you.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud