[PM-24683] Add updateKdf function #383

quexten · 2025-08-13T11:14:42Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-24683

📔 Objective

Exposes functionality to update the KDF, with the new masterpassword unlock data, and masterpassword authentication data models. These can be directly passed to the server models.

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Protected functional changes with optionality (feature flags)
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation (Confluence, contributing docs) or informed the documentation
team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed
issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

github-actions · 2025-08-13T11:20:18Z

Checkmarx One – Scan Summary & Details – 7008af26-045d-45d4-9900-07574b70bf73

Great job! No new security vulnerabilities introduced in this pull request

codecov · 2025-08-13T11:29:21Z

Codecov Report

❌ Patch coverage is 89.51965% with 24 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.19%. Comparing base (ecfde52) to head (db8e8b0).

Files with missing lines	Patch %	Lines
crates/bitwarden-uniffi/src/crypto.rs	0.00%	10 Missing ⚠️
...bitwarden-core/src/key_management/crypto_client.rs	0.00%	9 Missing ⚠️
...es/bitwarden-core/src/platform/get_user_api_key.rs	0.00%	3 Missing ⚠️
crates/bitwarden-core/src/auth/login/password.rs	0.00%	1 Missing ⚠️
crates/bitwarden-core/src/key_management/crypto.rs	99.23%	1 Missing ⚠️

Additional details and impacted files

@@                                                   Coverage Diff                                                   @@
##           km/pm-24051-add-master-password-unlock-decryption-options-to-identity-sync-response     #383      +/-   ##
=======================================================================================================================
+ Coverage                                                                                76.01%   76.19%   +0.18%     
=======================================================================================================================
  Files                                                                                      261      261              
  Lines                                                                                    23945    24156     +211     
=======================================================================================================================
+ Hits                                                                                     18201    18406     +205     
- Misses                                                                                    5744     5750       +6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…ns-to-identity-sync-response' into km/update-kdf-sdk

## 🎟️ Tracking https://bitwarden.slack.com/archives/C054ZQSBS49/p1755188403409309 ## 📔 Objective It seems #279 accidentally required wasm in all uniffi builds via `bitwarden-vault` -> `bitwarden-collections` -> `bitwarden-core`. Since it is only required on core, this leads to build issues on anything where an impl is tagged with wasm-bindgen, but uses a struct from a third package - such as `bitwarden-crypto` that does not have the wasm feature enabled. Attempts to fix the build errors of: #383 Note: This flags out a function from the collections client. This has to be fixed by the owning team and updated, this PR just unblocks builds and fixes the imports. ## ⏰ Reminders before review - Contributor guidelines followed - All formatters and local linters executed and passed - Written new unit and / or integration tests where applicable - Protected functional changes with optionality (feature flags) - Used internationalization (i18n) for all UI strings - CI builds passed - Communicated to DevOps any deployment requirements - Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team ## 🦮 Reviewer guidelines  - 👍 (`:+1:`) or similar for great changes - 📝 (`:memo:`) or ℹ️ (`:information_source:`) for notes or general info - ❓ (`:question:`) for questions - 🤔 (`:thinking:`) or 💭 (`:thought_balloon:`) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion - 🎨 (`:art:`) for suggestions / improvements - ❌ (`:x:`) or ⚠️ (`:warning:`) for more significant problems or concerns needing attention - 🌱 (`:seedling:`) or ♻️ (`:recycle:`) for future improvements or indications of technical debt - ⛏ (`:pick:`) for minor or nitpick changes --------- Co-authored-by: Oscar Hinton <[email protected]>

…ns-to-identity-sync-response' into km/update-kdf-sdk

… into km/update-kdf-sdk

Co-authored-by: Daniel García <[email protected]>

… into km/update-kdf-sdk

crates/bitwarden-uniffi/src/crypto.rs

crates/bitwarden-core/src/key_management/crypto_client.rs

quexten · 2025-08-19T11:23:28Z

@dani-garcia Yeah, the valid kdf newtype makes sense. We enforce the same correct values on e.g. keys too with custom types that can only be validly created, so there is no reason not to do that with KDF.

Not adding it to this PR, but I'd definitely also like to see this as a future improvement.

…ns-to-identity-sync-response' into km/update-kdf-sdk

crates/bitwarden-core/src/key_management/crypto_client.rs

crates/bitwarden-uniffi/src/crypto.rs

Hinton · 2025-08-22T15:03:53Z

crates/bitwarden-exporters/Cargo.toml

@@ -20,6 +20,7 @@ uniffi = ["dep:uniffi", "bitwarden-core/uniffi"] # Uniffi bindings
 wasm = [
    "bitwarden-collections/wasm",
    "bitwarden-vault/wasm",
+    "bitwarden-collections/wasm",


Duplicative.

Left over from the upstream changes that were needed to unblock the PR. I've undone the duplicate import now.

Hinton · 2025-08-22T15:04:21Z

crates/bitwarden-uniffi/src/crypto.rs

+    /// re-encrypted with the new password. This returns the new encrypted user key and the new
+    /// password hash but does not update sdk state.
+    ///
+    /// Note: This is deprecated and `make_update_password` should be used instead


question: Why not mark this as deprecated?

This does not seem to play nice with uniffi / clippy, and ends up failing the CI because a warning gets emitted. I tried #[allow(deprecated)] on it, but it did not seem to help.

Hinton · 2025-08-22T15:05:54Z

crates/bitwarden-uniffi/src/crypto.rs

+        &self,
+        password: String,
+        kdf: Kdf,
+    ) -> Result<bitwarden_core::key_management::crypto::UpdateKdfResponse> {


nit: The other functions here uses the shorthand path.

Suggested change

) -> Result<bitwarden_core::key_management::crypto::UpdateKdfResponse> {

) -> Result<UpdateKdfResponse> {

Cleaned up!

crates/bitwarden-core/src/key_management/crypto_client.rs

Hinton · 2025-08-22T15:10:02Z

crates/bitwarden-core/src/key_management/crypto_client.rs

+    /// re-encrypted with the new password. This returns the new encrypted user key and the new
+    /// password hash but does not update sdk state.
+    ///
+    /// Note: This is deprecated and `make_update_password` should be used instead


question: Can we just remove this function here? Or is it actively used in web?

Co-authored-by: Oscar Hinton <[email protected]>

… into km/update-kdf-sdk

…ns-to-identity-sync-response' into km/update-kdf-sdk

… into km/update-kdf-sdk

sonarqubecloud · 2025-08-22T16:38:40Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

quexten added 2 commits August 13, 2025 13:08

Add update SDK functionality

fa1b16b

Add test

af83c57

quexten changed the title ~~Add updateKdf function~~ [PM-24683] Add updateKdf function Aug 13, 2025

Cleanup

e780d69

quexten and others added 8 commits August 14, 2025 14:41

Fix clippy issues

bcc183a

Fix build

6398e13

Merge branch 'km/pm-24051-add-master-password-unlock-decryption-optio…

e816975

…ns-to-identity-sync-response' into km/update-kdf-sdk

Fix build

21c72e0

Clean-up errors

3dc3577

Fix formatting

367f9f0

Replace String with str

3d9b257

Fix wasm being imported on UNIFFI builds

69ed59c

quexten mentioned this pull request Aug 14, 2025

[no ticket] Fix wasm being imported on UNIFFI builds #385

Merged

quexten added 4 commits August 14, 2025 18:24

Feature-flag wasm-only code and fix import

866912b

Merge branch 'fix-wasm-import' into km/update-kdf-sdk

08d10fe

Fix clippy issues

0aba54b

Fix clippy issue

4e41a29

quexten and others added 3 commits August 15, 2025 18:52

Merge branch 'km/pm-24051-add-master-password-unlock-decryption-optio…

c908173

…ns-to-identity-sync-response' into km/update-kdf-sdk

Expose update kdf in uniffi

9f2c473

Merge branch 'km/update-kdf-sdk' of github.com:bitwarden/sdk-internal…

ed3be99

… into km/update-kdf-sdk

quexten marked this pull request as ready for review August 18, 2025 09:31

quexten requested review from a team as code owners August 18, 2025 09:31

quexten requested review from dani-garcia and removed request for a team August 18, 2025 09:31

quexten and others added 3 commits August 19, 2025 08:46

Update crates/bitwarden-core/src/key_management/crypto.rs

b4d89e2

Co-authored-by: Daniel García <[email protected]>

Rename to make_update

aeaeff5

Merge branch 'km/update-kdf-sdk' of github.com:bitwarden/sdk-internal…

7cf85b4

… into km/update-kdf-sdk

mzieniukbw reviewed Aug 19, 2025

View reviewed changes

quexten added 4 commits August 19, 2025 13:05

Update comments

1a3dd14

Rename error variant

55cc2b7

Rename error variant

dd5dd3e

Fix build

20b5a06

quexten and others added 2 commits August 19, 2025 13:24

Merge branch 'km/pm-24051-add-master-password-unlock-decryption-optio…

18e7913

…ns-to-identity-sync-response' into km/update-kdf-sdk

Undo duplicate upstream change

5cf50d2

quexten removed request for a team and shane-melton August 19, 2025 11:25

mzieniukbw requested changes Aug 19, 2025

View reviewed changes

Fix formatting

6cdb29b

mzieniukbw approved these changes Aug 19, 2025

View reviewed changes

dani-garcia approved these changes Aug 19, 2025

View reviewed changes

Hinton reviewed Aug 22, 2025

View reviewed changes

quexten and others added 10 commits August 22, 2025 18:09

Undo duplicate import

8d5c8c4

Update crates/bitwarden-core/src/key_management/crypto_client.rs

d5a7180

Co-authored-by: Oscar Hinton <[email protected]>

Remove long-path import

285132a

Mark as deprecated

aec1105

Remove unused function

16f73ce

Merge branch 'km/update-kdf-sdk' of github.com:bitwarden/sdk-internal…

47da2c9

… into km/update-kdf-sdk

Merge branch 'km/pm-24051-add-master-password-unlock-decryption-optio…

0b99b78

…ns-to-identity-sync-response' into km/update-kdf-sdk

Fix clippy errors

77a142e

Undo deprecation changes

c703c10

Merge branch 'km/update-kdf-sdk' of github.com:bitwarden/sdk-internal…

db8e8b0

… into km/update-kdf-sdk

matt-livefront mentioned this pull request Aug 22, 2025

[PM-23277] Force KDF updates if below minimums bitwarden/ios#1880

Draft

	) -> Result<bitwarden_core::key_management::crypto::UpdateKdfResponse> {
	) -> Result<UpdateKdfResponse> {

[PM-24683] Add updateKdf function #383

Are you sure you want to change the base?

[PM-24683] Add updateKdf function #383

Uh oh!

Conversation

quexten commented Aug 13, 2025

🎟️ Tracking

📔 Objective

⏰ Reminders before review

🦮 Reviewer guidelines

Uh oh!

github-actions bot commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Great job! No new security vulnerabilities introduced in this pull request

Uh oh!

codecov bot commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

quexten commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Aug 22, 2025

Quality Gate passed

Uh oh!

Uh oh!

github-actions bot commented Aug 13, 2025 •

edited

Loading

codecov bot commented Aug 13, 2025 •

edited

Loading

quexten commented Aug 19, 2025 •

edited

Loading