bitwarden_core/auth/
auth_request.rs

1use bitwarden_crypto::{
2    CryptoError, PrivateKey, PublicKey, PublicKeyEncryptionAlgorithm, SpkiPublicKeyBytes,
3    UnsignedSharedKey, fingerprint, generate_random_alphanumeric,
4};
5#[cfg(feature = "internal")]
6use bitwarden_crypto::{EncString, SymmetricCryptoKey};
7#[cfg(feature = "internal")]
8use bitwarden_encoding::B64;
9use thiserror::Error;
10
11#[cfg(feature = "internal")]
12use crate::client::encryption_settings::EncryptionSettingsError;
13use crate::{Client, key_management::SymmetricKeySlotId};
14
15/// Response for `new_auth_request`.
16#[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
17pub struct AuthRequestResponse {
18    /// Base64 encoded private key
19    /// This key is temporarily passed back and will most likely not be available in the future
20    pub private_key: B64,
21    /// Base64 encoded public key
22    pub public_key: B64,
23    /// Fingerprint of the public key
24    pub fingerprint: String,
25    /// Access code
26    pub access_code: String,
27}
28
29/// Initiate a new auth request.
30///
31/// Generates a private key and access code. The pulic key is uploaded to the server and transmitted
32/// to another device. Where the user confirms the validity by confirming the fingerprint. The user
33/// key is then encrypted using the public key and returned to the initiating device.
34pub(crate) fn new_auth_request(email: &str) -> Result<AuthRequestResponse, CryptoError> {
35    let key = PrivateKey::make(PublicKeyEncryptionAlgorithm::RsaOaepSha1);
36
37    let spki = key.to_public_key().to_der()?;
38
39    let fingerprint = fingerprint(email, &spki)?;
40
41    Ok(AuthRequestResponse {
42        private_key: key.to_der()?.as_ref().into(),
43        public_key: spki.into(),
44        fingerprint,
45        access_code: generate_random_alphanumeric(25),
46    })
47}
48
49/// Decrypt the user key using the private key generated previously.
50#[cfg(feature = "internal")]
51pub(crate) fn auth_request_decrypt_user_key(
52    private_key: B64,
53    user_key: UnsignedSharedKey,
54) -> Result<SymmetricCryptoKey, EncryptionSettingsError> {
55    let key = PrivateKey::from_der(&private_key.as_bytes().into())?;
56    #[expect(deprecated)]
57    let key: SymmetricCryptoKey = user_key.decapsulate_key_unsigned(&key)?;
58    Ok(key)
59}
60
61/// Decrypt the user key using the private key generated previously.
62#[cfg(feature = "internal")]
63pub(crate) fn auth_request_decrypt_master_key(
64    private_key: B64,
65    master_key: UnsignedSharedKey,
66    user_key: EncString,
67) -> Result<SymmetricCryptoKey, EncryptionSettingsError> {
68    use bitwarden_crypto::MasterKey;
69
70    let key = PrivateKey::from_der(&private_key.as_bytes().into())?;
71    #[expect(deprecated)]
72    let master_key: SymmetricCryptoKey = master_key.decapsulate_key_unsigned(&key)?;
73    let master_key = MasterKey::try_from(&master_key)?;
74
75    Ok(master_key.decrypt_user_key(user_key)?)
76}
77
78#[allow(missing_docs)]
79#[derive(Debug, Error)]
80#[cfg_attr(feature = "uniffi", derive(uniffi::Error), uniffi(flat_error))]
81pub enum ApproveAuthRequestError {
82    #[error(transparent)]
83    Crypto(#[from] CryptoError),
84}
85
86/// Approve an auth request.
87///
88/// Encrypts the user key with a public key.
89pub(crate) fn approve_auth_request(
90    client: &Client,
91    public_key: B64,
92) -> Result<UnsignedSharedKey, ApproveAuthRequestError> {
93    let public_key = PublicKey::from_der(&SpkiPublicKeyBytes::from(&public_key))?;
94
95    let key_store = client.internal.get_key_store();
96    let ctx = key_store.context();
97
98    // FIXME: [PM-18110] This should be removed once the key store can handle public key encryption
99    #[allow(deprecated)]
100    let key = ctx.dangerous_get_symmetric_key(SymmetricKeySlotId::User)?;
101
102    #[expect(deprecated)]
103    Ok(UnsignedSharedKey::encapsulate_key_unsigned(
104        key,
105        &public_key,
106    )?)
107}
108
109#[cfg(test)]
110mod tests {
111    use std::num::NonZeroU32;
112
113    use bitwarden_crypto::{BitwardenLegacyKeyBytes, Kdf, SpkiPublicKeyBytes};
114
115    use super::*;
116    use crate::{
117        UserId,
118        key_management::{
119            MasterPasswordUnlockData, SymmetricKeySlotId,
120            account_cryptographic_state::WrappedAccountCryptographicState,
121            crypto::{AuthRequestMethod, InitUserCryptoMethod, InitUserCryptoRequest},
122        },
123    };
124
125    #[test]
126    fn test_auth_request() {
127        let request = new_auth_request("[email protected]").unwrap();
128
129        let secret = vec![
130            111, 32, 97, 169, 4, 241, 174, 74, 239, 206, 113, 86, 174, 68, 216, 238, 52, 85, 156,
131            27, 134, 149, 54, 55, 91, 147, 45, 130, 131, 237, 51, 31, 191, 106, 155, 14, 160, 82,
132            47, 40, 96, 31, 114, 127, 212, 187, 167, 110, 205, 116, 198, 243, 218, 72, 137, 53,
133            248, 43, 255, 67, 35, 61, 245, 93,
134        ];
135
136        let private_key = PrivateKey::from_der(&request.private_key.as_bytes().into()).unwrap();
137
138        let secret = BitwardenLegacyKeyBytes::from(secret);
139        #[expect(deprecated)]
140        let encrypted = UnsignedSharedKey::encapsulate_key_unsigned(
141            &SymmetricCryptoKey::try_from(&secret).unwrap(),
142            &private_key.to_public_key(),
143        )
144        .unwrap();
145
146        let decrypted = auth_request_decrypt_user_key(request.private_key, encrypted).unwrap();
147
148        assert_eq!(decrypted.to_encoded().to_vec(), secret.to_vec());
149    }
150
151    #[test]
152    fn test_approve() {
153        let client = Client::new(None);
154
155        let user_key = "2.Q/2PhzcC7GdeiMHhWguYAQ==|GpqzVdr0go0ug5cZh1n+uixeBC3oC90CIe0hd/HWA/pTRDZ8ane4fmsEIcuc8eMKUt55Y2q/fbNzsYu41YTZzzsJUSeqVjT8/iTQtgnNdpo=|dwI+uyvZ1h/iZ03VQ+/wrGEFYVewBUUl/syYgjsNMbE=".parse().unwrap();
156        let private_key ="2.yN7l00BOlUE0Sb0M//Q53w==|EwKG/BduQRQ33Izqc/ogoBROIoI5dmgrxSo82sgzgAMIBt3A2FZ9vPRMY+GWT85JiqytDitGR3TqwnFUBhKUpRRAq4x7rA6A1arHrFp5Tp1p21O3SfjtvB3quiOKbqWk6ZaU1Np9HwqwAecddFcB0YyBEiRX3VwF2pgpAdiPbSMuvo2qIgyob0CUoC/h4Bz1be7Qa7B0Xw9/fMKkB1LpOm925lzqosyMQM62YpMGkjMsbZz0uPopu32fxzDWSPr+kekNNyLt9InGhTpxLmq1go/pXR2uw5dfpXc5yuta7DB0EGBwnQ8Vl5HPdDooqOTD9I1jE0mRyuBpWTTI3FRnu3JUh3rIyGBJhUmHqGZvw2CKdqHCIrQeQkkEYqOeJRJVdBjhv5KGJifqT3BFRwX/YFJIChAQpebNQKXe/0kPivWokHWwXlDB7S7mBZzhaAPidZvnuIhalE2qmTypDwHy22FyqV58T8MGGMchcASDi/QXI6kcdpJzPXSeU9o+NC68QDlOIrMVxKFeE7w7PvVmAaxEo0YwmuAzzKy9QpdlK0aab/xEi8V4iXj4hGepqAvHkXIQd+r3FNeiLfllkb61p6WTjr5urcmDQMR94/wYoilpG5OlybHdbhsYHvIzYoLrC7fzl630gcO6t4nM24vdB6Ymg9BVpEgKRAxSbE62Tqacxqnz9AcmgItb48NiR/He3n3ydGjPYuKk/ihZMgEwAEZvSlNxYONSbYrIGDtOY+8Nbt6KiH3l06wjZW8tcmFeVlWv+tWotnTY9IqlAfvNVTjtsobqtQnvsiDjdEVtNy/s2ci5TH+NdZluca2OVEr91Wayxh70kpM6ib4UGbfdmGgCo74gtKvKSJU0rTHakQ5L9JlaSDD5FamBRyI0qfL43Ad9qOUZ8DaffDCyuaVyuqk7cz9HwmEmvWU3VQ+5t06n/5kRDXttcw8w+3qClEEdGo1KeENcnXCB32dQe3tDTFpuAIMLqwXs6FhpawfZ5kPYvLPczGWaqftIs/RXJ/EltGc0ugw2dmTLpoQhCqrcKEBDoYVk0LDZKsnzitOGdi9mOWse7Se8798ib1UsHFUjGzISEt6upestxOeupSTOh0v4+AjXbDzRUyogHww3V+Bqg71bkcMxtB+WM+pn1XNbVTyl9NR040nhP7KEf6e9ruXAtmrBC2ah5cFEpLIot77VFZ9ilLuitSz+7T8n1yAh1IEG6xxXxninAZIzi2qGbH69O5RSpOJuJTv17zTLJQIIc781JwQ2TTwTGnx5wZLbffhCasowJKd2EVcyMJyhz6ru0PvXWJ4hUdkARJs3Xu8dus9a86N8Xk6aAPzBDqzYb1vyFIfBxP0oO8xFHgd30Cgmz8UrSE3qeWRrF8ftrI6xQnFjHBGWD/JWSvd6YMcQED0aVuQkuNW9ST/DzQThPzRfPUoiL10yAmV7Ytu4fR3x2sF0Yfi87YhHFuCMpV/DsqxmUizyiJuD938eRcH8hzR/VO53Qo3UIsqOLcyXtTv6THjSlTopQ+JOLOnHm1w8dzYbLN44OG44rRsbihMUQp+wUZ6bsI8rrOnm9WErzkbQFbrfAINdoCiNa6cimYIjvvnMTaFWNymqY1vZxGztQiMiHiHYwTfwHTXrb9j0uPM=|09J28iXv9oWzYtzK2LBT6Yht4IT4MijEkk0fwFdrVQ4=".parse().unwrap();
157        client
158            .internal
159            .initialize_user_crypto_master_password_unlock(
160                "asdfasdfasdf".to_string(),
161                MasterPasswordUnlockData {
162                    kdf: Kdf::PBKDF2 {
163                        iterations: NonZeroU32::new(600_000).unwrap(),
164                    },
165                    master_key_wrapped_user_key: user_key,
166                    salt: "[email protected]".to_string(),
167                    contained_key_id: None,
168                },
169                WrappedAccountCryptographicState::V1 { private_key },
170                &None,
171            )
172            .unwrap();
173
174        let public_key: B64 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvyLRDUwXB4BfQ507D4meFPmwn5zwy3IqTPJO4plrrhnclWahXa240BzyFW9gHgYu+Jrgms5xBfRTBMcEsqqNm7+JpB6C1B6yvnik0DpJgWQw1rwvy4SUYidpR/AWbQi47n/hvnmzI/sQxGddVfvWu1iTKOlf5blbKYAXnUE5DZBGnrWfacNXwRRdtP06tFB0LwDgw+91CeLSJ9py6dm1qX5JIxoO8StJOQl65goLCdrTWlox+0Jh4xFUfCkb+s3px+OhSCzJbvG/hlrSRcUz5GnwlCEyF3v5lfUtV96MJD+78d8pmH6CfFAp2wxKRAbGdk+JccJYO6y6oIXd3Fm7twIDAQAB".parse().unwrap();
175
176        // Verify fingerprint
177        let pubkey = SpkiPublicKeyBytes::from(&public_key);
178        let fingerprint = fingerprint("[email protected]", &pubkey).unwrap();
179        assert_eq!(fingerprint, "childless-unfair-prowler-dropbox-designate");
180
181        approve_auth_request(&client, public_key).unwrap();
182    }
183
184    #[tokio::test]
185    async fn test_decrypt_user_key() {
186        let private_key = "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCzLtEUdxfcLxDj84yaGFsVF5hZ8Hjlb08NMQDy1RnBma06I3ZESshLYzVz4r/gegMn9OOltfV/Yxlyvida8oW6qdlfJ7AVz6Oa8pV7BiL40C7b76+oqraQpyYw2HChANB1AhXL9SqWngKmLZwjA7qiCrmcc0kZHeOb4KnKtp9iVvPVs+8veFvKgYO4ba2AAOHKFdR0W55/agXfAy+fWUAkC8mc9ikyJdQWaPV6OZvC2XFkOseBQm9Rynudh3BQpoWiL6w620efe7t5k+02/EyOFJL9f/XEEjM/+Yo0t3LAfkuhHGeKiRST59Xc9hTEmyJTeVXROtz+0fjqOp3xkaObAgMBAAECggEACs4xhnO0HaZhh1/iH7zORMIRXKeyxP2LQiTR8xwN5JJ9wRWmGAR9VasS7EZFTDidIGVME2u/h4s5EqXnhxfO+0gGksVvgNXJ/qw87E8K2216g6ZNo6vSGA7H1GH2voWwejJ4/k/cJug6dz2S402rRAKh2Wong1arYHSkVlQp3diiMa5FHAOSE+Cy09O2ZsaF9IXQYUtlW6AVXFrBEPYH2kvkaPXchh8VETMijo6tbvoKLnUHe+wTaDMls7hy8exjtVyI59r3DNzjy1lNGaGb5QSnFMXR+eHhPZc844Wv02MxC15zKABADrl58gpJyjTl6XpDdHCYGsmGpVGH3X9TQQKBgQDz/9beFjzq59ve6rGwn+EtnQfSsyYT+jr7GN8lNEXb3YOFXBgPhfFIcHRh2R00Vm9w2ApfAx2cd8xm2I6HuvQ1Os7g26LWazvuWY0Qzb+KaCLQTEGH1RnTq6CCG+BTRq/a3J8M4t38GV5TWlzv8wr9U4dl6FR4efjb65HXs1GQ4QKBgQC7/uHfrOTEHrLeIeqEuSl0vWNqEotFKdKLV6xpOvNuxDGbgW4/r/zaxDqt0YBOXmRbQYSEhmO3oy9J6XfE1SUln0gbavZeW0HESCAmUIC88bDnspUwS9RxauqT5aF8ODKN/bNCWCnBM1xyonPOs1oT1nyparJVdQoG//Y7vkB3+wKBgBqLqPq8fKAp3XfhHLfUjREDVoiLyQa/YI9U42IOz9LdxKNLo6p8rgVthpvmnRDGnpUuS+KOWjhdqDVANjF6G3t3DG7WNl8Rh5Gk2H4NhFswfSkgQrjebFLlBy9gjQVCWXt8KSmjvPbiY6q52Aaa8IUjA0YJAregvXxfopxO+/7BAoGARicvEtDp7WWnSc1OPoj6N14VIxgYcI7SyrzE0d/1x3ffKzB5e7qomNpxKzvqrVP8DzG7ydh8jaKPmv1MfF8tpYRy3AhmN3/GYwCnPqT75YYrhcrWcVdax5gmQVqHkFtIQkRSCIftzPLlpMGKha/YBV8c1fvC4LD0NPh/Ynv0gtECgYEAyOZg95/kte0jpgUEgwuMrzkhY/AaUJULFuR5MkyvReEbtSBQwV5tx60+T95PHNiFooWWVXiLMsAgyI2IbkxVR1Pzdri3gWK5CTfqb7kLuaj/B7SGvBa2Sxo478KS5K8tBBBWkITqo+wLC0mn3uZi1dyMWO1zopTA+KtEGF2dtGQ=".parse()
187        .unwrap();
188
189        let enc_user_key = "4.dxbd5OMwi/Avy7DQxvLV+Z7kDJgHBtg/jAbgYNO7QU0Zii4rLFNco2lS5aS9z42LTZHc2p5HYwn2ZwkZNfHsQ6//d5q40MDgGYJMKBXOZP62ZHhct1XsvYBmtcUtIOm5j2HSjt2pjEuGAc1LbyGIWRJJQ3Lp1ULbL2m71I+P23GF36JyOM8SUWvpvxE/3+qqVhRFPG2VqMCYa2kLLxwVfUmpV+KKjX1TXsrq6pfJIwHNwHw4h7MSfD8xTy2bx4MiBt638Z9Vt1pGsSQkh9RgPvCbnhuCpZQloUgJ8ByLVEcrlKx3yaaxiQXvte+ZhuOI7rGdjmoVoOzisooje4JgYw==".parse().unwrap();
190        let dec = auth_request_decrypt_user_key(private_key, enc_user_key).unwrap();
191
192        assert_eq!(
193            &dec.to_encoded().to_vec(),
194            &[
195                201, 37, 234, 213, 21, 75, 40, 70, 149, 213, 234, 16, 19, 251, 162, 245, 161, 74,
196                34, 245, 211, 151, 211, 192, 95, 10, 117, 50, 88, 223, 23, 157
197            ]
198        );
199    }
200
201    #[tokio::test]
202    async fn test_decrypt_master_key() {
203        let private_key = "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCzLtEUdxfcLxDj84yaGFsVF5hZ8Hjlb08NMQDy1RnBma06I3ZESshLYzVz4r/gegMn9OOltfV/Yxlyvida8oW6qdlfJ7AVz6Oa8pV7BiL40C7b76+oqraQpyYw2HChANB1AhXL9SqWngKmLZwjA7qiCrmcc0kZHeOb4KnKtp9iVvPVs+8veFvKgYO4ba2AAOHKFdR0W55/agXfAy+fWUAkC8mc9ikyJdQWaPV6OZvC2XFkOseBQm9Rynudh3BQpoWiL6w620efe7t5k+02/EyOFJL9f/XEEjM/+Yo0t3LAfkuhHGeKiRST59Xc9hTEmyJTeVXROtz+0fjqOp3xkaObAgMBAAECggEACs4xhnO0HaZhh1/iH7zORMIRXKeyxP2LQiTR8xwN5JJ9wRWmGAR9VasS7EZFTDidIGVME2u/h4s5EqXnhxfO+0gGksVvgNXJ/qw87E8K2216g6ZNo6vSGA7H1GH2voWwejJ4/k/cJug6dz2S402rRAKh2Wong1arYHSkVlQp3diiMa5FHAOSE+Cy09O2ZsaF9IXQYUtlW6AVXFrBEPYH2kvkaPXchh8VETMijo6tbvoKLnUHe+wTaDMls7hy8exjtVyI59r3DNzjy1lNGaGb5QSnFMXR+eHhPZc844Wv02MxC15zKABADrl58gpJyjTl6XpDdHCYGsmGpVGH3X9TQQKBgQDz/9beFjzq59ve6rGwn+EtnQfSsyYT+jr7GN8lNEXb3YOFXBgPhfFIcHRh2R00Vm9w2ApfAx2cd8xm2I6HuvQ1Os7g26LWazvuWY0Qzb+KaCLQTEGH1RnTq6CCG+BTRq/a3J8M4t38GV5TWlzv8wr9U4dl6FR4efjb65HXs1GQ4QKBgQC7/uHfrOTEHrLeIeqEuSl0vWNqEotFKdKLV6xpOvNuxDGbgW4/r/zaxDqt0YBOXmRbQYSEhmO3oy9J6XfE1SUln0gbavZeW0HESCAmUIC88bDnspUwS9RxauqT5aF8ODKN/bNCWCnBM1xyonPOs1oT1nyparJVdQoG//Y7vkB3+wKBgBqLqPq8fKAp3XfhHLfUjREDVoiLyQa/YI9U42IOz9LdxKNLo6p8rgVthpvmnRDGnpUuS+KOWjhdqDVANjF6G3t3DG7WNl8Rh5Gk2H4NhFswfSkgQrjebFLlBy9gjQVCWXt8KSmjvPbiY6q52Aaa8IUjA0YJAregvXxfopxO+/7BAoGARicvEtDp7WWnSc1OPoj6N14VIxgYcI7SyrzE0d/1x3ffKzB5e7qomNpxKzvqrVP8DzG7ydh8jaKPmv1MfF8tpYRy3AhmN3/GYwCnPqT75YYrhcrWcVdax5gmQVqHkFtIQkRSCIftzPLlpMGKha/YBV8c1fvC4LD0NPh/Ynv0gtECgYEAyOZg95/kte0jpgUEgwuMrzkhY/AaUJULFuR5MkyvReEbtSBQwV5tx60+T95PHNiFooWWVXiLMsAgyI2IbkxVR1Pzdri3gWK5CTfqb7kLuaj/B7SGvBa2Sxo478KS5K8tBBBWkITqo+wLC0mn3uZi1dyMWO1zopTA+KtEGF2dtGQ=".parse().unwrap();
204
205        let enc_master_key = "4.dxbd5OMwi/Avy7DQxvLV+Z7kDJgHBtg/jAbgYNO7QU0Zii4rLFNco2lS5aS9z42LTZHc2p5HYwn2ZwkZNfHsQ6//d5q40MDgGYJMKBXOZP62ZHhct1XsvYBmtcUtIOm5j2HSjt2pjEuGAc1LbyGIWRJJQ3Lp1ULbL2m71I+P23GF36JyOM8SUWvpvxE/3+qqVhRFPG2VqMCYa2kLLxwVfUmpV+KKjX1TXsrq6pfJIwHNwHw4h7MSfD8xTy2bx4MiBt638Z9Vt1pGsSQkh9RgPvCbnhuCpZQloUgJ8ByLVEcrlKx3yaaxiQXvte+ZhuOI7rGdjmoVoOzisooje4JgYw==".parse().unwrap();
206        let enc_user_key = "2.Q/2PhzcC7GdeiMHhWguYAQ==|GpqzVdr0go0ug5cZh1n+uixeBC3oC90CIe0hd/HWA/pTRDZ8ane4fmsEIcuc8eMKUt55Y2q/fbNzsYu41YTZzzsJUSeqVjT8/iTQtgnNdpo=|dwI+uyvZ1h/iZ03VQ+/wrGEFYVewBUUl/syYgjsNMbE=".parse().unwrap();
207        let dec =
208            auth_request_decrypt_master_key(private_key, enc_master_key, enc_user_key).unwrap();
209
210        assert_eq!(
211            &dec.to_encoded().to_vec(),
212            &[
213                109, 128, 172, 147, 206, 123, 134, 95, 16, 36, 155, 113, 201, 18, 186, 230, 216,
214                212, 173, 188, 74, 11, 134, 131, 137, 242, 105, 178, 105, 126, 52, 139, 248, 91,
215                215, 21, 128, 91, 226, 222, 165, 67, 251, 34, 83, 81, 77, 147, 225, 76, 13, 41,
216                102, 45, 183, 218, 106, 89, 254, 208, 251, 101, 130, 10,
217            ]
218        );
219    }
220
221    #[tokio::test]
222    async fn test_device_login() {
223        let kdf = Kdf::PBKDF2 {
224            iterations: NonZeroU32::new(600_000).unwrap(),
225        };
226        let email = "[email protected]";
227
228        let user_key = "2.Q/2PhzcC7GdeiMHhWguYAQ==|GpqzVdr0go0ug5cZh1n+uixeBC3oC90CIe0hd/HWA/pTRDZ8ane4fmsEIcuc8eMKUt55Y2q/fbNzsYu41YTZzzsJUSeqVjT8/iTQtgnNdpo=|dwI+uyvZ1h/iZ03VQ+/wrGEFYVewBUUl/syYgjsNMbE=".parse().unwrap();
229        let private_key: EncString = "2.yN7l00BOlUE0Sb0M//Q53w==|EwKG/BduQRQ33Izqc/ogoBROIoI5dmgrxSo82sgzgAMIBt3A2FZ9vPRMY+GWT85JiqytDitGR3TqwnFUBhKUpRRAq4x7rA6A1arHrFp5Tp1p21O3SfjtvB3quiOKbqWk6ZaU1Np9HwqwAecddFcB0YyBEiRX3VwF2pgpAdiPbSMuvo2qIgyob0CUoC/h4Bz1be7Qa7B0Xw9/fMKkB1LpOm925lzqosyMQM62YpMGkjMsbZz0uPopu32fxzDWSPr+kekNNyLt9InGhTpxLmq1go/pXR2uw5dfpXc5yuta7DB0EGBwnQ8Vl5HPdDooqOTD9I1jE0mRyuBpWTTI3FRnu3JUh3rIyGBJhUmHqGZvw2CKdqHCIrQeQkkEYqOeJRJVdBjhv5KGJifqT3BFRwX/YFJIChAQpebNQKXe/0kPivWokHWwXlDB7S7mBZzhaAPidZvnuIhalE2qmTypDwHy22FyqV58T8MGGMchcASDi/QXI6kcdpJzPXSeU9o+NC68QDlOIrMVxKFeE7w7PvVmAaxEo0YwmuAzzKy9QpdlK0aab/xEi8V4iXj4hGepqAvHkXIQd+r3FNeiLfllkb61p6WTjr5urcmDQMR94/wYoilpG5OlybHdbhsYHvIzYoLrC7fzl630gcO6t4nM24vdB6Ymg9BVpEgKRAxSbE62Tqacxqnz9AcmgItb48NiR/He3n3ydGjPYuKk/ihZMgEwAEZvSlNxYONSbYrIGDtOY+8Nbt6KiH3l06wjZW8tcmFeVlWv+tWotnTY9IqlAfvNVTjtsobqtQnvsiDjdEVtNy/s2ci5TH+NdZluca2OVEr91Wayxh70kpM6ib4UGbfdmGgCo74gtKvKSJU0rTHakQ5L9JlaSDD5FamBRyI0qfL43Ad9qOUZ8DaffDCyuaVyuqk7cz9HwmEmvWU3VQ+5t06n/5kRDXttcw8w+3qClEEdGo1KeENcnXCB32dQe3tDTFpuAIMLqwXs6FhpawfZ5kPYvLPczGWaqftIs/RXJ/EltGc0ugw2dmTLpoQhCqrcKEBDoYVk0LDZKsnzitOGdi9mOWse7Se8798ib1UsHFUjGzISEt6upestxOeupSTOh0v4+AjXbDzRUyogHww3V+Bqg71bkcMxtB+WM+pn1XNbVTyl9NR040nhP7KEf6e9ruXAtmrBC2ah5cFEpLIot77VFZ9ilLuitSz+7T8n1yAh1IEG6xxXxninAZIzi2qGbH69O5RSpOJuJTv17zTLJQIIc781JwQ2TTwTGnx5wZLbffhCasowJKd2EVcyMJyhz6ru0PvXWJ4hUdkARJs3Xu8dus9a86N8Xk6aAPzBDqzYb1vyFIfBxP0oO8xFHgd30Cgmz8UrSE3qeWRrF8ftrI6xQnFjHBGWD/JWSvd6YMcQED0aVuQkuNW9ST/DzQThPzRfPUoiL10yAmV7Ytu4fR3x2sF0Yfi87YhHFuCMpV/DsqxmUizyiJuD938eRcH8hzR/VO53Qo3UIsqOLcyXtTv6THjSlTopQ+JOLOnHm1w8dzYbLN44OG44rRsbihMUQp+wUZ6bsI8rrOnm9WErzkbQFbrfAINdoCiNa6cimYIjvvnMTaFWNymqY1vZxGztQiMiHiHYwTfwHTXrb9j0uPM=|09J28iXv9oWzYtzK2LBT6Yht4IT4MijEkk0fwFdrVQ4=".parse().unwrap();
230
231        // Initialize an existing client which is unlocked
232        let existing_device = Client::new(None);
233        existing_device
234            .internal
235            .initialize_user_crypto_master_password_unlock(
236                "asdfasdfasdf".to_string(),
237                MasterPasswordUnlockData {
238                    kdf: kdf.clone(),
239                    master_key_wrapped_user_key: user_key,
240                    salt: email.to_string(),
241                    contained_key_id: None,
242                },
243                WrappedAccountCryptographicState::V1 {
244                    private_key: private_key.clone(),
245                },
246                &None,
247            )
248            .unwrap();
249
250        // Initialize a new device which will request to be logged in
251        let new_device = Client::new_test(None);
252
253        // Initialize an auth request, and approve it on the existing device
254        let auth_req = new_auth_request(email).unwrap();
255        let approved_req = approve_auth_request(&existing_device, auth_req.public_key).unwrap();
256
257        // Unlock the vault using the approved request
258        new_device
259            .crypto()
260            .initialize_user_crypto(InitUserCryptoRequest {
261                user_id: Some(UserId::new_v4()),
262                kdf_params: kdf,
263                email: email.to_owned(),
264                account_cryptographic_state: WrappedAccountCryptographicState::V1 { private_key },
265                method: InitUserCryptoMethod::AuthRequest {
266                    request_private_key: auth_req.private_key,
267                    method: AuthRequestMethod::UserKey {
268                        protected_user_key: approved_req,
269                    },
270                },
271                upgrade_token: None,
272            })
273            .await
274            .unwrap();
275
276        // We can validate that the vault is unlocked correctly by confirming the user key is the
277        // same
278
279        let existing_key = {
280            let key_store = existing_device.internal.get_key_store();
281            let ctx = key_store.context();
282            #[allow(deprecated)]
283            ctx.dangerous_get_symmetric_key(SymmetricKeySlotId::User)
284                .unwrap()
285                .to_base64()
286        };
287
288        let new_key = {
289            let key_store = new_device.internal.get_key_store();
290            let ctx = key_store.context();
291            #[allow(deprecated)]
292            ctx.dangerous_get_symmetric_key(SymmetricKeySlotId::User)
293                .unwrap()
294                .to_base64()
295        };
296
297        assert_eq!(existing_key, new_key);
298    }
299}
bitwarden_core/auth/auth_request.rs

bitwarden_core/auth/
auth_request.rs
