[PM-27281] Support v2 account encryption on JIT master password signups #6777

mzieniukbw · 2025-12-23T23:34:52Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-27281

📔 Objective

Updated the server API POST /account/set-password to support User Crypto V2 for JIT (Just-In-Time) initial master password registration flow.

This endpoint is used for two SSO user flows.

Master Password decryption. Account keys needs to be set for the user account.
Existing TDE user (registered and account crypto keys initialised) that was granted manage account recovery permission - user will be asked to set master password upon new login. Account keys are already setup. Since there are slightly different requirements on the validation and crypto initialisation logic, i decided to separate this flow into it's separate command.

Other changes:

Moved existing command logic with V1 suffix into SetInitialMasterPasswordCommandV1, will be easier to remove later.
Added UserRepository.UpdateUserDataAsync function for the TDE decryption MP onboarding user flow, since they already have the account keys and only need MP set. Since we already have SetMasterPassword that is used for both flows (MP and TDE decryption) and this function returns a "task" (does not execute against database), it make sense to re-use it. This function is technically a "run multiple tasks in one transaction" orchestrator, which we might want to do going forward anyway for complex database operations, that needs multiple steps done within one transaction and requires minimal changes to the repository.

📸 Screenshots

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Protected functional changes with optionality (feature flags)
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

codecov · 2025-12-23T23:41:19Z

Codecov Report

❌ Patch coverage is 86.11111% with 45 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.00%. Comparing base (484a8e4) to head (38c17f9).
⚠️ Report is 24 commits behind head on main.

Files with missing lines	Patch %	Lines
...frastructure.Dapper/Repositories/UserRepository.cs	0.00%	40 Missing ⚠️
...asterPassword/SetInitialMasterPasswordCommandV1.cs	94.23%	2 Missing and 1 partial ⚠️
...ure.EntityFramework/Repositories/UserRepository.cs	94.59%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6777      +/-   ##
==========================================
+ Coverage   58.83%   59.00%   +0.17%     
==========================================
  Files        1925     1933       +8     
  Lines       85355    85756     +401     
  Branches     7652     7681      +29     
==========================================
+ Hits        50217    50604     +387     
- Misses      33269    33283      +14     
  Partials     1869     1869

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2025-12-23T23:46:00Z

Checkmarx One – Scan Summary & Details – ffb3dbac-de34-4229-9cca-dfb459b670ac

New Issues (5)

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 217	details Method at line 217 of /src/Api/Auth/Controllers/AccountsController.cs gets a parameter from a user request from model. This parameter value flow... Attack Vector
2	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1170	details Method at line 1170 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector
3	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1060	details Method at line 1060 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector
4	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1519	details Method at line 1519 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector
5	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1395	details Method at line 1395 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector

Fixed Issues (3)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CSRF~~	/src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 98
	~~CSRF~~	/src/Api/Auth/Controllers/AccountsController.cs: 211
	~~CSRF~~	/src/Api/Vault/Controllers/CiphersController.cs: 293

src/Core/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommand.cs

src/Infrastructure.Dapper/Repositories/UserRepository.cs

mzieniukbw · 2026-01-01T13:09:40Z

Adding test coverage, turning to draft for now

quexten

I see you moved this to draft; Adding the comments I had so far.

src/Core/Services/IUserService.cs

src/Core/Auth/UserFeatures/UserMasterPassword/Interfaces/ISetInitialMasterPasswordCommandV1.cs

src/Core/Auth/UserFeatures/TdeOnboardingPassword/Interfaces/ITdeOnboardingPasswordCommand.cs

…gnups

mzieniukbw · 2026-01-02T15:04:14Z

Test coverage added, redy to review

mkincaid-bw

Couple minor things.

util/Migrator/DbScripts/2026-01-02_00_User_UpdateMasterPassword.sql

ike-kottlowski

Just a few comments mainly around test coverage and possible improvements therein.

test/Api.IntegrationTest/Controllers/AccountsControllerTest.cs

src/Core/Auth/UserFeatures/TdeOnboardingPassword/Interfaces/ITdeOnboardingPasswordCommand.cs

src/Core/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommandV1.cs

quexten

Very nice work! I don't have much to comment on this / concerns were addressed or are addressed at some point in the future in other work.

mkincaid-bw

LGTM

ike-kottlowski

Excellent test coverage, thank you! Just a non-blocking 🎨 comment.

ike-kottlowski · 2026-01-09T01:57:16Z

src/Core/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommandV1.cs

🎨 : We try to not name things V1/Vn because of the ambiguity that comes with it. I think something akin to SetInitialMasterPasswordWithSymetricKeyEncryptionCommand - really rolls off the tongue 🫠 - is not ambiguous.

The current SetInitialMasterPasswordCommand could be SetInitialMasterPasswordWithCborEncryptionCommand. The usage can be denoted with comments in code pointing to the preferred when creating a password, so developers know which command to prefer.

This is not a blocker, but I think removes ambiguity from the code.

## 🎟️ Tracking https://bitwarden.atlassian.net/browse/PM-27277 ## 📔 Objective Encryption V2 for SSO JIT master password account registration. Changed the default Kdf for Encryption V2 accounts, which uses Argon2Id with more iOS mobile friendly parameters (less memory, but more iterations). Refactored the Kdf default functions, so we only expose `Kdf::default_pbkdf2` or `Kdf::default_argon2id`. Requires bitwarden/server#6777, for the autogenerated models, which is manually committed in `bitwarden-api-api` crate temporarily, until the server PR is done. Updated WASM build script only to format autogenerated TS files, since the JS file got too big for `npm prettier` to handle and is not necessary for non-TS files. ## 🚨 Breaking Changes None, new functionality. ## ⏰ Reminders before review - Contributor guidelines followed - All formatters and local linters executed and passed - Written new unit and / or integration tests where applicable - Protected functional changes with optionality (feature flags) - Used internationalization (i18n) for all UI strings - CI builds passed - Communicated to DevOps any deployment requirements - Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team ## 🦮 Reviewer guidelines  - 👍 (`:+1:`) or similar for great changes - 📝 (`:memo:`) or ℹ️ (`:information_source:`) for notes or general info - ❓ (`:question:`) for questions - 🤔 (`:thinking:`) or 💭 (`:thought_balloon:`) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion - 🎨 (`:art:`) for suggestions / improvements - ❌ (`:x:`) or ⚠️ (`:warning:`) for more significant problems or concerns needing attention - 🌱 (`:seedling:`) or ♻️ (`:recycle:`) for future improvements or indications of technical debt - ⛏ (`:pick:`) for minor or nitpick changes

mzieniukbw added 3 commits December 22, 2025 17:35

V2 prep, rename existing SSO JIT MP command to V1

c326c11

set initial master password for account registraton V2

91afded

later removel docs

fe1c6ce

TDE MP onboarding split

be70162

quexten reviewed Dec 25, 2025

View reviewed changes

src/Core/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommand.cs Outdated Show resolved Hide resolved

src/Infrastructure.Dapper/Repositories/UserRepository.cs Show resolved Hide resolved

mzieniukbw changed the title ~~[PM-27281] Support v2 account registration on JIT master password signups~~ [PM-27281] Support v2 account encryption on JIT master password signups Dec 28, 2025

mzieniukbw added 2 commits December 28, 2025 13:00

revert separate TDE onboarding controller api

3be17ce

Server side hash of the user master password hash

6ffc418

mzieniukbw requested a review from quexten December 28, 2025 12:11

mzieniukbw marked this pull request as ready for review December 31, 2025 11:45

mzieniukbw requested review from a team as code owners December 31, 2025 11:45

mzieniukbw requested a review from rr-bw December 31, 2025 11:45

use ValidationResult instead for validation errors

8cfc753

mzieniukbw marked this pull request as draft January 1, 2026 13:09

quexten reviewed Jan 1, 2026

View reviewed changes

mzieniukbw added 4 commits January 1, 2026 16:00

unit test coverage

7aa6729

integration test coverage

3363b12

update sql migration script date

ed5c2d9

Merge branch 'main' into km/pm-27281-v2-encryption-on-jit-password-si…

67443a6

…gnups

mzieniukbw marked this pull request as ready for review January 2, 2026 12:54

mzieniukbw marked this pull request as draft January 2, 2026 13:11

mzieniukbw added 4 commits January 2, 2026 14:30

revert validate password change

b56fbfb

better requests validation

a2dd100

explicit error message when org sso identifier invalid

d9bd084

more unit test coverage

f58f500

mzieniukbw marked this pull request as ready for review January 2, 2026 15:03

mzieniukbw requested a review from quexten January 2, 2026 15:04

ike-kottlowski self-requested a review January 2, 2026 20:03

mkincaid-bw requested changes Jan 2, 2026

View reviewed changes

util/Migrator/DbScripts/2026-01-02_00_User_UpdateMasterPassword.sql Outdated Show resolved Hide resolved

util/Migrator/DbScripts/2026-01-02_00_User_UpdateMasterPassword.sql Outdated Show resolved Hide resolved

ike-kottlowski reviewed Jan 3, 2026

View reviewed changes

mzieniukbw added 5 commits January 6, 2026 16:44

renamed onboarding to set, hash naming clarifications

47c77d5

update db sql script, formatting

435ffd4

use raw json as request instead of request models for integration test

51a351b

v1 integration test coverage

beb4129

change of name

38c17f9

mzieniukbw requested review from ike-kottlowski and mkincaid-bw January 6, 2026 20:51

mzieniukbw mentioned this pull request Jan 6, 2026

[PM-27277] Support v2 encryption on JIT Password signups bitwarden/sdk-internal#654

Merged

quexten reviewed Jan 7, 2026

View reviewed changes

src/Core/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommandV1.cs Show resolved Hide resolved

quexten approved these changes Jan 7, 2026

View reviewed changes

mkincaid-bw approved these changes Jan 7, 2026

View reviewed changes

ike-kottlowski approved these changes Jan 9, 2026

View reviewed changes

mzieniukbw merged commit 2e92a53 into main Jan 9, 2026
106 checks passed

mzieniukbw deleted the km/pm-27281-v2-encryption-on-jit-password-signups branch January 9, 2026 08:17

[PM-27281] Support v2 account encryption on JIT master password signups #6777

[PM-27281] Support v2 account encryption on JIT master password signups #6777

Uh oh!

Conversation

mzieniukbw commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎟️ Tracking

📔 Objective

📸 Screenshots

⏰ Reminders before review

🦮 Reviewer guidelines

Uh oh!

codecov bot commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mzieniukbw commented Jan 1, 2026

Uh oh!

quexten left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mzieniukbw commented Jan 2, 2026

Uh oh!

mkincaid-bw left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ike-kottlowski left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

quexten left a comment

Choose a reason for hiding this comment

Uh oh!

mkincaid-bw left a comment

Choose a reason for hiding this comment

Uh oh!

ike-kottlowski left a comment

Choose a reason for hiding this comment

Uh oh!

ike-kottlowski Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

mzieniukbw commented Dec 23, 2025 •

edited

Loading

codecov bot commented Dec 23, 2025 •

edited

Loading

github-actions bot commented Dec 23, 2025 •

edited

Loading