[PM-39455] Organization user v2 upgrade token repository tests

[mzieniukbw]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-39455

📔 Objective

Adds database integration tests for organization user v2 upgrade token added in #8158, that would otherwise be not possible, without #8165 first.

This will be used as a baseline for regression testing of key rotation, which includes both changes from both PRs.

Also adds emergency access key rotation integration tests.

📸 Screenshots

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.71%. Comparing base (6f0ff3d) to head (45a6aa2).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8168      +/-   ##
==========================================
+ Coverage   63.29%   68.71%   +5.41%     
==========================================
  Files        2383     2383              
  Lines      103921   103921              
  Branches     9403     9403              
==========================================
+ Hits        65779    71411    +5632     
+ Misses      35898    30168    -5730     
- Partials     2244     2342      +98     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This is a test-only change adding database integration tests for OrganizationUserRepository.UpdateForKeyRotation (V2 upgrade token persistence, stale-token clearing, and the UserId ownership filter) and EmergencyAccessRepository.UpdateForKeyRotation (key persistence, non-key field immutability, and omitted-grant isolation). It also refactors UserRepositoryTests.RunUpdateUserDataAsync to delegate to the existing DatabaseTransactionActionTestHelper, removing the hand-rolled SqlConnection/transaction block.

I traced each assertion against both the Dapper (OrganizationUser_UpdateDataForKeyRotation stored procedure, SqlBulkCopy temp-table path for emergency access) and EF Core implementations and the expectations hold for all four supported providers. The ownership-filter test is a genuinely valuable regression guard: it verifies a caller cannot write a V2 upgrade token onto a membership they do not own. No security, correctness, or breaking-change concerns found.

Code Review Details

No findings.

Notes considered and intentionally not raised as findings:

• The refactored RunUpdateUserDataAsync now supplies a real connection and transaction on EF providers where it previously passed null. This matches how UpdateUserDataAsync and SetV2AccountCryptographicStateAsync invoke UpdateUserData in production, so it is a coverage improvement rather than a regression.
• The private CreateUserAsync helper duplicates the CreateTestUserAsync extension in AdminConsole/OrganizationTestHelpers.cs, but file-local user factories are an established pattern in this project (e.g. Auth/Repositories/DeviceRepositoryTests.cs).
• _camelCase constant naming matches the private_fields rule in .editorconfig.

[JaredSnider-Bitwarden]

Auth changes are only a test file - approving.