Email the lease holder when an operator revokes their access

[maxkpower]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-42817

📔 Objective

Emails a lease holder when an operator revokes their active access. The push already re-locks their client; this tells them why.

• Sent only when AccessLeaseAction.Revoked. A holder ending their own lease (Cancelled) receives nothing: mailing someone about their own action is what trains people to ignore the channel.
• Says "revoked", matching pamStatusRevoked and pamAuditKindLeaseRevoked in the web vault. The product reserves "ended" for the holder's own action.
• States that the access cannot be resumed and that regaining it needs a new request.
• The revocation reason is not included and stays on the request.

This is a courtesy, not a control: the lease is already dead server side before the mail is composed.

Top of a four PR stack on pam/uat. Sits on the decision notification PR.

📸 Screenshots

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the new LeaseRevokedMailNotifier and its interface, the RevokeAccessLeaseCommand wiring and DI registration, the AccessLeaseRevokedView model, the MJML/Handlebars templates, and both test suites. The notifier mirrors the reviewed RequesterMailNotifier line for line — same FeatureFlagKeys.Pam pre-guard ahead of the organization read, same null-organization warning, same swallow-and-log boundary — so a mail outage cannot fail a revocation that is already written, and RevokeAccessLeaseCommand remains the only path that ends a lease early. Zero-knowledge boundaries hold: the body carries only the organization name and the scheduled end, the revocation reason and cipher stay on the request, the org name is HTML-escaped in the rendered template with only Url triple-braced, and the failure logs carry ids only. The AccessLeaseAction.Revoked gate correctly excludes Cancelled and None, TryAddScoped follows ADR 0026, and the embedded-resource name derived from the view's namespace matches the committed .hbs files, which the Core.Test render specs exercise.

Code Review Details

No blocking findings.

PR Metadata Assessment

• ❓ QUESTION: The Screenshots section is empty for a new customer-facing email — a rendered preview of AccessLeaseRevokedView would let reviewers check the copy and layout.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.39%. Comparing base (145f87b) to head (f81d164).

Additional details and impacted files

@@                          Coverage Diff                          @@
##           pam/PM-42817/mail-request-decided    #8292      +/-   ##
=====================================================================
+ Coverage                              64.37%   64.39%   +0.02%     
=====================================================================
  Files                                   2587     2589       +2     
  Lines                                 111304   111358      +54     
  Branches                                9937     9940       +3     
=====================================================================
+ Hits                                   71654    71712      +58     
- Misses                                 37273    37274       +1     
+ Partials                                2377     2372       -5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.