[PM-24683] Add updateKdf function #383

quexten · 2025-08-13T11:14:42Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-24683

📔 Objective

Exposes functionality to update the KDF, with the new masterpassword unlock data, and masterpassword authentication data models. These can be directly passed to the server models.

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Protected functional changes with optionality (feature flags)
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation (Confluence, contributing docs) or informed the documentation
team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed
issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

…tions

github-actions · 2025-08-13T11:20:18Z

Checkmarx One – Scan Summary & Details – 8f09b045-6839-4f9a-8bdf-a4be6cbe4e37

Great job! No new security vulnerabilities introduced in this pull request

codecov · 2025-08-13T11:29:21Z

Codecov Report

❌ Patch coverage is 90.23256% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.91%. Comparing base (8a7175f) to head (198c29c).

Files with missing lines	Patch %	Lines
crates/bitwarden-uniffi/src/crypto.rs	0.00%	10 Missing ⚠️
...bitwarden-core/src/key_management/crypto_client.rs	0.00%	9 Missing ⚠️
crates/bitwarden-core/src/key_management/crypto.rs	99.22%	1 Missing ⚠️
...es/bitwarden-core/src/platform/get_user_api_key.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #383      +/-   ##
==========================================
+ Coverage   76.75%   76.91%   +0.15%     
==========================================
  Files         270      270              
  Lines       25664    25873     +209     
==========================================
+ Hits        19698    19899     +201     
- Misses       5966     5974       +8

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…ption-options-to-identity-sync-response

…r and docs improvements

…ption-options-to-identity-sync-response # Conflicts: # crates/bitwarden-core/src/key_management/mod.rs

…ption-options-to-identity-sync-response

crates/bitwarden-exporters/Cargo.toml

crates/bitwarden-uniffi/src/crypto.rs

crates/bitwarden-core/src/key_management/crypto_client.rs

Co-authored-by: Oscar Hinton <[email protected]>

… into km/update-kdf-sdk

…ns-to-identity-sync-response' into km/update-kdf-sdk

… into km/update-kdf-sdk

The base branch was changed.

sonarqubecloud · 2025-09-04T14:13:38Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dani-garcia

LGTM, just two small non-blocking nits

dani-garcia · 2025-09-04T14:45:18Z

crates/bitwarden-core/src/auth/api/response/identity_user_decryption_options_response.rs

+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, PartialEq)]
+pub struct IdentityUserDecryptionOptionsResponseModel {


Question: Why not use #[serde(rename_all = "camelCase")] rather than renaming the field?

dani-garcia · 2025-09-04T14:50:56Z

crates/bitwarden-core/src/platform/get_user_api_key.rs

@@ -78,7 +78,7 @@ fn build_secret_verification_request(
        let master_password_hash = input
            .master_password
            .as_ref()
-            .map(|p| {
+            .map(|p| -> Result<String, CryptoError> {


Is this need here? We're already typing Ok::<String, CryptoError>( below, seems like the compiler should be able to infer it.

If we keep it we should remove the type hint for Ok.

Hinton

A couple of minor things and we should be good. Only the two API comments are blocking.

Hinton · 2025-09-05T09:30:46Z

crates/bitwarden-uniffi/src/crypto.rs

+    /// re-encrypted with the new password. This returns the new encrypted user key and the new
+    /// password hash but does not update sdk state.
+    ///
+    /// Note: This is deprecated and `make_update_password` should be used instead


Do. we have a task for tracking the removal? And ideally a task to assign to mobile to clean up their implementation?

Hinton · 2025-09-05T09:31:16Z

crates/bitwarden-core/src/platform/get_user_api_key.rs

@@ -78,7 +78,7 @@ fn build_secret_verification_request(
        let master_password_hash = input
            .master_password
            .as_ref()
-            .map(|p| {
+            .map(|p| -> Result<String, CryptoError> {


If we keep it we should remove the type hint for Ok.

Hinton · 2025-09-05T09:33:47Z

crates/bitwarden-core/src/auth/api/response/identity_user_decryption_options_response.rs

+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, PartialEq)]
+pub struct IdentityUserDecryptionOptionsResponseModel {


question: Can we use pub(crate) here? Most API request/responses were updated to only be create public.

Suggested change

pub struct IdentityUserDecryptionOptionsResponseModel {

pub(crate) struct IdentityUserDecryptionOptionsResponseModel {

Hinton · 2025-09-05T09:34:36Z

crates/bitwarden-core/src/auth/api/response/mod.rs

@@ -4,6 +4,7 @@ mod identity_success_response;
 mod identity_token_fail_response;
 mod identity_token_response;
 mod identity_two_factor_response;
+pub(crate) mod identity_user_decryption_options_response;


question: Could we just make this mod and use use below?

mzieniukbw and others added 21 commits August 4, 2025 23:40

Adds MasterPasswordUnlock into identity's response user decryption op…

44773f7

…tions

Adds MasterPasswordUnlock KDF change handling in sync

0712878

simplification

8ca20a8

clippy fix

28a8423

formatting

b089ea0

no handling, just response parsing

0d35393

test coverage

a08179d

wasm

b3647f2

wasm unit test coverage

36d3136

wasm unit test coverage

7c8664d

Added UserDecryption data, response model with handling

9c7d50d

autogenerated wasm responses, UserDecryption struct, use of TryFrom

70ad9d3

failing unit test

110f4db

lint

ff86adf

lint

fa253a3

KdfType enum duplicate

4a95dc5

revert identity crate wasm, since there it's not used right now

cd37e31

docs

3bf880f

formatting

93a3d0c

Add update SDK functionality

fa1b16b

Add test

af83c57

quexten changed the title ~~Add updateKdf function~~ [PM-24683] Add updateKdf function Aug 13, 2025

Cleanup

e780d69

mzieniukbw added 5 commits August 13, 2025 17:10

Merge branch 'main' into km/pm-24051-add-master-password-unlock-decry…

f0c4f2a

…ption-options-to-identity-sync-response

revert user decryption response parsing in wasm

3e6a46a

fixed unit test

7c34725

revert wasm dependencies

042678c

bring back wasm and uniffi bindings to MasterPasswordUnlockData, erro…

9676069

…r and docs improvements

Fix formatting

6cdb29b

mzieniukbw previously approved these changes Aug 19, 2025

View reviewed changes

dani-garcia previously approved these changes Aug 19, 2025

View reviewed changes

mzieniukbw added 3 commits August 19, 2025 17:10

missing kdf fields treated as missing field error

77c2d68

Merge branch 'main' into km/pm-24051-add-master-password-unlock-decry…

a487fff

…ption-options-to-identity-sync-response # Conflicts: # crates/bitwarden-core/src/key_management/mod.rs

Merge branch 'main' into km/pm-24051-add-master-password-unlock-decry…

ecfde52

…ption-options-to-identity-sync-response

Hinton reviewed Aug 22, 2025

View reviewed changes

quexten and others added 10 commits August 22, 2025 18:09

Undo duplicate import

8d5c8c4

Update crates/bitwarden-core/src/key_management/crypto_client.rs

d5a7180

Co-authored-by: Oscar Hinton <[email protected]>

Remove long-path import

285132a

Mark as deprecated

aec1105

Remove unused function

16f73ce

Merge branch 'km/update-kdf-sdk' of github.com:bitwarden/sdk-internal…

47da2c9

… into km/update-kdf-sdk

Merge branch 'km/pm-24051-add-master-password-unlock-decryption-optio…

0b99b78

…ns-to-identity-sync-response' into km/update-kdf-sdk

Fix clippy errors

77a142e

Undo deprecation changes

c703c10

Merge branch 'km/update-kdf-sdk' of github.com:bitwarden/sdk-internal…

db8e8b0

… into km/update-kdf-sdk

matt-livefront mentioned this pull request Aug 22, 2025

[PM-23277] Force KDF updates if below minimums bitwarden/ios#1880

Draft

Base automatically changed from km/pm-24051-add-master-password-unlock-decryption-options-to-identity-sync-response to main September 3, 2025 14:32

quexten and others added 3 commits September 3, 2025 17:55

Merge branch 'main' into km/update-kdf-sdk

139d2b1

Resolve conflicts

a0ede96

Merge branch 'main' into km/update-kdf-sdk

198c29c

quexten requested review from mzieniukbw, dani-garcia and Hinton September 4, 2025 14:07

dani-garcia approved these changes Sep 4, 2025

View reviewed changes

Hinton reviewed Sep 5, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[PM-24683] Add updateKdf function #383

[PM-24683] Add updateKdf function #383

Uh oh!

quexten commented Aug 13, 2025

Uh oh!

github-actions bot commented Aug 13, 2025 •

edited

Loading

Uh oh!

codecov bot commented Aug 13, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Sep 4, 2025

Uh oh!

dani-garcia left a comment

Uh oh!

dani-garcia Sep 4, 2025

Uh oh!

dani-garcia Sep 4, 2025

Uh oh!

Hinton Sep 5, 2025

Uh oh!

Hinton left a comment •

edited

Loading

Uh oh!

Hinton Sep 5, 2025

Uh oh!

Hinton Sep 5, 2025

Uh oh!

Hinton Sep 5, 2025

Uh oh!

Hinton Sep 5, 2025

Uh oh!

Uh oh!

	pub struct IdentityUserDecryptionOptionsResponseModel {
	pub(crate) struct IdentityUserDecryptionOptionsResponseModel {

[PM-24683] Add updateKdf function #383

Are you sure you want to change the base?

[PM-24683] Add updateKdf function #383

Uh oh!

Conversation

quexten commented Aug 13, 2025

🎟️ Tracking

📔 Objective

⏰ Reminders before review

🦮 Reviewer guidelines

Uh oh!

github-actions bot commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Great job! No new security vulnerabilities introduced in this pull request

Uh oh!

codecov bot commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Sep 4, 2025

Quality Gate passed

Uh oh!

dani-garcia left a comment

Choose a reason for hiding this comment

Uh oh!

dani-garcia Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

dani-garcia Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

Hinton Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

Hinton left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Hinton Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

Hinton Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

Hinton Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

Hinton Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Aug 13, 2025 •

edited

Loading

codecov bot commented Aug 13, 2025 •

edited

Loading

Hinton left a comment •

edited

Loading