email user whenever they're removed from org because of 2fa policy (#657)

src/Core/MailTemplates/Handlebars/OrganizationUserRemovedForPolicyTwoStep.html.hbs

@@ -0,0 +1,15 @@
+{{#>FullHtmlLayout}}
+<table width="100%" cellpadding="0" cellspacing="0" style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
+    <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
+        <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top" align="left">
+            Your user account has been removed from the <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{OrganizationName}}</b> organization because you do not have two-step login configured. Before you can re-join this organization you need to set up two-step login on your user account.
+        </td>
+    </tr>
+    <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
+        <td class="content-block last" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0; -webkit-text-size-adjust: none;" valign="top" align="left">
+            Learn how to enable two-step login on your user account at
+            <a target="_blank" href="https://help.bitwarden.com/article/setup-two-step-login/" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #3c8dbc; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none; text-decoration: underline;">https://help.bitwarden.com/article/setup-two-step-login/</a>
+        </td>
+    </tr>
+</table>
+{{/FullHtmlLayout}}

src/Core/MailTemplates/Handlebars/OrganizationUserRemovedForPolicyTwoStep.text.hbs

@@ -0,0 +1,7 @@
+{{#>BasicTextLayout}}
+Your user account has been removed from the {{OrganizationName}} organization because you do not have two-step login
+configured. Before you can re-join this organization you need to set up two-step login on your user account.
+
+Learn how to enable two-step login on your user account at
+<https://help.bitwarden.com/article/setup-two-step-login/>
+{{/BasicTextLayout}}

src/Core/Models/Mail/OrganizationUserRemovedForPolicyTwoStepViewModel.cs

@@ -0,0 +1,7 @@
+namespace Bit.Core.Models.Mail
+{
+    public class OrganizationUserRemovedForPolicyTwoStepViewModel : BaseMailModel
+    {
+        public string OrganizationName { get; set; }
+    }
+}

src/Core/Services/IMailService.cs

@@ -19,6 +19,7 @@ namespace Bit.Core.Services
         Task SendOrganizationAcceptedEmailAsync(string organizationName, string userEmail,
             IEnumerable<string> adminEmails);
         Task SendOrganizationConfirmedEmailAsync(string organizationName, string email);
+        Task SendOrganizationUserRemovedForPolicyTwoStepEmailAsync(string organizationName, string email);
         Task SendPasswordlessSignInAsync(string returnUrl, string token, string email);
         Task SendInvoiceUpcomingAsync(string email, decimal amount, DateTime dueDate, List<string> items,
             bool mentionInvoices);

src/Core/Services/Implementations/HandlebarsMailService.cs

@@ -186,6 +186,20 @@ namespace Bit.Core.Services
             await _mailDeliveryService.SendEmailAsync(message);
         }
 
+        public async Task SendOrganizationUserRemovedForPolicyTwoStepEmailAsync(string organizationName, string email)
+        {
+            var message = CreateDefaultMessage($"You have been removed from {organizationName}", email);
+            var model = new OrganizationUserRemovedForPolicyTwoStepViewModel
+            {
+                OrganizationName = CoreHelpers.SanitizeForEmail(organizationName),
+                WebVaultUrl = _globalSettings.BaseServiceUri.VaultWithHash,
+                SiteName = _globalSettings.SiteName
+            };
+            await AddMessageContentAsync(message, "OrganizationUserRemovedForPolicyTwoStep", model);
+            message.Category = "OrganizationUserRemovedForPolicyTwoStep";
+            await _mailDeliveryService.SendEmailAsync(message);
+        }
+
         public async Task SendWelcomeEmailAsync(User user)
         {
             var message = CreateDefaultMessage("Welcome", user.Email);

src/Core/Services/Implementations/PolicyService.cs

@@ -13,17 +13,20 @@ namespace Bit.Core.Services
         private readonly IOrganizationRepository _organizationRepository;
         private readonly IOrganizationUserRepository _organizationUserRepository;
         private readonly IPolicyRepository _policyRepository;
+        private readonly IMailService _mailService;
 
         public PolicyService(
             IEventService eventService,
             IOrganizationRepository organizationRepository,
             IOrganizationUserRepository organizationUserRepository,
-            IPolicyRepository policyRepository)
+            IPolicyRepository policyRepository,
+            IMailService mailService)
         {
             _eventService = eventService;
             _organizationRepository = organizationRepository;
             _organizationUserRepository = organizationUserRepository;
             _policyRepository = policyRepository;
+            _mailService = mailService;
         }
 
         public async Task SaveAsync(Policy policy, IUserService userService, IOrganizationService organizationService,
@@ -52,6 +55,7 @@ namespace Bit.Core.Services
                 {
                     if(currentPolicy.Type == Enums.PolicyType.TwoFactorAuthentication)
                     {
+                        Organization organization = null;
                         var orgUsers = await _organizationUserRepository.GetManyDetailsByOrganizationAsync(
                             policy.OrganizationId);
                         foreach(var orgUser in orgUsers.Where(ou =>
@@ -60,8 +64,14 @@ namespace Bit.Core.Services
                         {
                             if(orgUser.UserId != savingUserId && !await userService.TwoFactorIsEnabledAsync(orgUser))
                             {
+                                if(organization == null)
+                                {
+                                    organization = await _organizationRepository.GetByIdAsync(policy.OrganizationId);
+                                }
                                 await organizationService.DeleteUserAsync(policy.OrganizationId, orgUser.Id,
                                     savingUserId);
+                                await _mailService.SendOrganizationUserRemovedForPolicyTwoStepEmailAsync(
+                                    organization.Name, orgUser.Email);
                             }
                         }
                     }

src/Core/Services/Implementations/UserService.cs

@@ -669,6 +669,9 @@ namespace Bit.Core.Services
                         if(!ownerOrgs.Contains(policy.OrganizationId))
                         {
                             await organizationService.DeleteUserAsync(policy.OrganizationId, user.Id);
+                            var organization = await _organizationRepository.GetByIdAsync(policy.OrganizationId);
+                            await _mailService.SendOrganizationUserRemovedForPolicyTwoStepEmailAsync(
+                                organization.Name, user.Email);
                         }
                     }
                 }

src/Core/Services/NoopImplementations/NoopMailService.cs

@@ -47,6 +47,11 @@ namespace Bit.Core.Services
             return Task.FromResult(0);
         }
 
+        public Task SendOrganizationUserRemovedForPolicyTwoStepEmailAsync(string organizationName, string email)
+        {
+            return Task.FromResult(0);
+        }
+
         public Task SendTwoFactorEmailAsync(string email, string token)
         {
             return Task.FromResult(0);