bitwarden_core/key_management/crypto/

reinit_user_crypto.rs

//! `reinit_user_crypto`: refresh an unlocked user's cryptographic state
//! intended to be used for mobile clients.

#![cfg(any(feature = "uniffi", feature = "wasm"))]

use bitwarden_crypto::SymmetricKeyAlgorithm;
use bitwarden_error::bitwarden_error;
use serde::{Deserialize, Serialize};
use thiserror::Error;
use tracing::{debug, error, info, warn};

#[cfg(feature = "wasm")]
use crate::key_management::wasm_unlock_state::copy_user_key_to_state;
use crate::{
    Client,
    key_management::{
        SymmetricKeySlotId, V2UpgradeToken,
        account_cryptographic_state::WrappedAccountCryptographicState,
    },
};

/// State used to re-initialize an unlocked user's cryptographic state after
/// `accountCryptographicState` and `V2UpgradeToken` are received in a sync.
///
/// This presumes the SDK is already unlocked (has user key in memory).
#[derive(Serialize, Deserialize, Debug)]
#[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
#[bitwarden_ffi::wasm_record]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct ReinitUserCryptoRequest {
    /// The user's account cryptographic state, encrypted under the user key
    pub account_cryptographic_state: WrappedAccountCryptographicState,

    /// The SDK uses the in-store (V1) user key to extract the V2 user key from the token,
    /// then sets the V2 user key as the active user key before decrypting
    /// `account_cryptographic_state`.
    pub upgrade_token: V2UpgradeToken,
}

/// Errors that can occur when re-initializing user cryptography state.
#[derive(Debug, Error)]
#[bitwarden_error(flat)]
pub enum ReinitUserCryptoError {
    /// The SDK is not in an unlocked state, so it cannot re-initialize user crypto.
    #[error("The SDK must be unlocked to re-initialize user crypto")]
    NotUnlocked,
    /// The provided account cryptographic state is not V2. Re-initialization is only supported for
    /// upgrading to V2 encryption.
    #[error(
        "The provided account cryptographic state is not V2. Re-initialization is only supported for upgrading to V2 encryption."
    )]
    InvalidAccountCryptographicState,
    /// The local migrations (pin key and local user data key) that runs as part of the V1->V2
    /// upgrade failed, likely due to missing state or keys that should be present during the
    /// upgrade process. Clients should deconstruct the SDK and initialize a fresh instance to
    /// recover.
    #[error("Unable to run local migrations after user key upgrade")]
    LocalMigrationFailed,
    /// The provided upgrade token was invalid, such as not decrypting properly with the active user
    /// key, or containing unexpected data.
    #[error("Invalid upgrade token")]
    InvalidUpgradeToken,
    /// An error occurred during the cryptographic operations to re-initialize user crypto.
    #[error("Cryptography Initialization error")]
    CryptoInitialization,
    /// The SDK does not have a state bridge registered, which is required to perform V1->V2 local
    /// data migrations.
    #[error("No state bridge registered, re-initialization is not supported")]
    StateBridgeNotRegistered,
}

/// Re-initialize the user's cryptographic state during an unlock session for a V1 -> V2 upgrade.
/// If the user is already V2 this function is a no-op.
///
/// Requires the SDK to be unlocked and the client to have registered a state bridge. Replaces the
/// in-memory account cryptographic state with the provided one, and upgrades the active user key
/// from V1 to V2. Performs local data migrations for the local user data key and pin key.
///
/// Intended for mobile clients with `accountCryptographicState` and `V2UpgradeToken` received in
/// a sync for a V1 -> V2 encryption upgrade. This allows the client to apply the received account
/// cryptographic state and update to reinitialize the SDK without tearing down and recreating the
/// client.
pub(crate) async fn reinit_user_crypto(
    client: &Client,
    req: ReinitUserCryptoRequest,
) -> Result<(), ReinitUserCryptoError> {
    if !matches!(
        req.account_cryptographic_state,
        WrappedAccountCryptographicState::V2 { .. }
    ) {
        return Err(ReinitUserCryptoError::InvalidAccountCryptographicState);
    }

    if !client.internal.state_bridge.is_registered() {
        warn!("No state bridge registered, re-initialization is not supported.");
        return Err(ReinitUserCryptoError::StateBridgeNotRegistered);
    }

    {
        let mut ctx = client.internal.get_key_store().context_mut();

        if !ctx.has_symmetric_key(SymmetricKeySlotId::User) {
            return Err(ReinitUserCryptoError::NotUnlocked);
        }

        let current_algorithm = ctx
            .get_symmetric_key_algorithm(SymmetricKeySlotId::User)
            .map_err(|_| ReinitUserCryptoError::CryptoInitialization)?;

        let local_v2_user_key_id = match current_algorithm {
            SymmetricKeyAlgorithm::Aes256CbcHmac => {
                info!("V1 user key detected with upgrade token, extracting V2 key");
                req.upgrade_token
                    .unwrap_v2(SymmetricKeySlotId::User, &mut ctx)
                    .map_err(|_| ReinitUserCryptoError::InvalidUpgradeToken)?
            }
            SymmetricKeyAlgorithm::XAes256Gcm => {
                // If the active user key is already V2, then the upgrade token should not be
                // applied. We return here so calling reinit_user_crypto with the
                // same sync payload after a successful V2 upgrade is a no-op.
                debug!("Active user key is already V2, skipping re-initialization.");
                return Ok(());
            }
            SymmetricKeyAlgorithm::XChaCha20Poly1305 | SymmetricKeyAlgorithm::Aes256Gcm => {
                error!(
                    ?current_algorithm,
                    "Unexpected user key algorithm during reinit_user_crypto"
                );
                return Err(ReinitUserCryptoError::CryptoInitialization);
            }
        };

        req.account_cryptographic_state
            .set_to_context(
                &client.internal.security_state,
                local_v2_user_key_id,
                client.internal.get_key_store(),
                ctx,
            )
            .map_err(|e| {
                error!(error = ?e, "Failed to set account cryptographic state to context during reinit_user_crypto");
                ReinitUserCryptoError::CryptoInitialization
            })?;
    }

    client
        .internal
        .state_bridge
        .set_v2_upgrade_token(&req.upgrade_token)
        .await;

    // Without this the client state keeps the V1 key, and the next re-creation of the SDK from
    // state reads it back and runs a second rotation.
    #[cfg(feature = "wasm")]
    copy_user_key_to_state(client).await.map_err(|_| {
        error!("Failed to copy the upgraded user key to state during reinit_user_crypto");
        ReinitUserCryptoError::CryptoInitialization
    })?;

    super::on_unlock_handler(client).await.map_err(|e| {
        error!(error = ?e, "Failure in on_unlock_handler during reinit_user_crypto.");
        ReinitUserCryptoError::LocalMigrationFailed
    })?;

    info!("User crypto re-initialized successfully");
    Ok(())
}

#[cfg(test)]
mod tests {
    use bitwarden_crypto::{EncString, KeyStore, SymmetricCryptoKey, SymmetricKeyAlgorithm};

    use super::*;
    use crate::{
        Client, UserId,
        client::test_accounts::{test_bitwarden_com_account, test_bitwarden_com_account_v2},
        key_management::{
            KeySlotIds, PrivateKeySlotId, SigningKeySlotId, V2UpgradeToken,
            state_bridge::test_support::InMemoryStateBridge,
        },
    };

    // v2
    const TEST_VECTOR_USER_KEY_V2_B64: &str = "pQEEAlCxZkKFDpp70P5mWPmOjf3xAzoAARF5BIQDBAUGIFggCFcd6XLISUfLaITyU9yimrYHacdS5XhBayO2663jdSUB";
    const TEST_VECTOR_PRIVATE_KEY_V2: &str = "7.g1gdowE6AAEReQMZARwEULFmQoUOmnvQ/mZY+Y6N/fGhBVgYe16rmgYXX3Orgo6y5U5Z8eb+JHTGfcivWQTR+1rVWtHJhEm8G/AtE78Ud3S8qxZmstUKhC5u9xgPvx2e8Fe8QL80Dv0WoEsy0XEb+5EFd8xDlu7OBuCVv2MaoJ/XzAkbpn9IT1vMCPhvRuaktIWMNrQgJ1jnmqjTGObftA02sHnj938tLRNfilw8ln/PBO2GBZQVzTUYfnc+mBeedGyZAxhSxyUwtFB8h3HC/t9BGtLT/bm83Df8rwTc+rGFL5r+T6vczQ+6hvF6kKpUb37XwgLEDsc+J4UTb+4zHaDcTioOYq6Hki8PrsN9PWL57nkhRMi3fKgfz8GDtY+pjp7D9HYV6OMuveSK9l+h16enJwiFDy6XEx+eth4aHPT5hybnOfTWbkEIhUmPD3K2JKvUUxeL9Z6e1EtSylVitO4Lit485KYaY8VASW4MnAzPOUQVwZ4jowHr5X8g0jVtHiLeUuOwDGcqjO/q6//tkiCwjW/W79jk4eqMtqPbOl0XelYVmM4KZCslPZ+2IYS56g/gl8Q2Oj9UGq7QJCsZvV9rBNa4wS3uC9atoWWRqO2PTWkVTurakkK3Fc9VP2bC1lJaWoWVjYpyJJVZh77ktpD3VrFdrT62+de0iaWUAtAr/1ALToNzoTYu3ihyGb6FZMN//XLTKk8GhZGVCluEDClHnziBxCX7Qg/0HRiU7EjsYGhpFnmG2XkvZQb9Pds8gucTbmbUeVfjXZ/IOLm16G/tdit2VIf80zcsvhgxTYys4Cm12N+62fM3aT5L9lqWvBYOMDksy00/3uLPzWbLFWbKItaC1c+bceGS7UDrLim6Pm/Voo2jXCi6EHpXX2/THrJybRDwqmQi7UVWXR3aPx//q9busEXxRyeu0m4lq2AjhQWhOvfPjpJzNX1hRE9Bu7UKYJhUF6DAsXFFKpob0LoARpcjGLFLcO61yV6He2nQFAa+ULXxhrKbISzqO3Q2xMs2p3jQ4Ctm0T+03w9Y5/Yf1qNKaL6AayA2nf0thYgh+OHNEnnkFwvBnTyB5B32E+/cUy7bb3329Pz7h+ruLo5IhGZM5GiEjF4vOSZmZJZ1t2eR4U7oxX0VTpwFPPBUQ3O7A5C2l0g/pGCFda4QlgR5qRA09kaAd9VBSJbQABGH0zWlXNPAjPQ6M9CxxTv9lM/72RSzTvnJqjQNpWGQjYuTi++EN5QZ37Nmlcw9eSa6X1C97ADndWV46dlFowUUDXiczi+Q0bZmFtpvkRg0TWlicS/cURLIfpG7sGwgqIis5R4haQ+RDB1+4oC0xmncWqy7vMESW6trh+icEL2PybwGPnzdngUqEIw5fG9huX3BmxbJjukSjWWk2CH8AaY2lHRXttzpOhpfP9c1cmrwXXUuHwTFMiKdmdwSqGbgebUP25kB9priXO88Jri3Wb739KRV5M2k6/9AspCwpOqlKN6MZm2vElNI+cXSWMHeX3666p4ALr7Vu7+q7iw4s4cO09MMJWsaiTaZBsVRhdoocsej+091JM/yJ29TVDJEMp2vEiia8HQ4k2bH9W9XCB71cpygRMYTFRDJ3Yjly4MYg7whBQnkeu8IYagCY6UZ60V73qhKRZJKuiV6ZTC+objnMPMmi9Kd05WmYFab8ZDP8s4yhU0WJNXdZGwpX7pnoi0T+g/y94sfZNGs5QuKgNEX";
    const TEST_VECTOR_SIGNED_PUBLIC_KEY_V2: &str = "hFgepAEnAxg8BFAmkP0QgfdMVbIujX55W/yNOgABOH8BoFkBTqNpYWxnb3JpdGhtAG1jb250ZW50Rm9ybWF0AGlwdWJsaWNLZXlZASYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDP/7WM8nUepxoJ0qtM+azxcly+eZ31qUjjZTZcX/gYw1MzkoXWAjqyeFH/bdktq1lEUwegrxkIxKkY2SMtp0CvPnaV1x5O8E6FBSJbKWRlDg181rfEhgm5tc6aR4PJ827IvFVm9xk6Sj091P5DHZDEOsWLZc2jYjtpUV3X38I4gSR7HiYnR4DcwcWkoJ3FhtxMCwYgPz6RVH0vzhLUmm1mgbzH6IH8Pf9DjLTZSxBikVO7S9s9jzhiZbTeeAl3FbNLxfj9Qkj+NoSfms7jGVTlBwvSXgjJs/ktGkT1cR5QcBMpU4bt41+l73MN8pXapCih9Awf1W+RY7imxpYOMFJ3AgMBAAFYQMq/hT4wod2w8xyoM7D86ctuLNX4ZRo+jRHf2sZfaO7QsvonG/ZYuNKF5fq8wpxMRjfoMvnY2TTShbgzLrW8BA4=";
    const TEST_VECTOR_SIGNING_KEY_V2: &str = "7.g1gcowE6AAEReQMYZQRQsWZChQ6ae9D+Zlj5jo398aEFWBj8Gg/gn4tQKWO3nq5e/2p9gkzIrKD829RYT3aEUIDOetEtnFqRuQ3Cz13693WqDnKHM5Buzi6LcTsxo1jphYR7vlE5nYLjCpOCAftPN1oLfs5SCNkwwMENhujpVftfDzciE99aLEJDS9A=";
    const TEST_VECTOR_SECURITY_STATE_V2: &str = "hFgepAEnAxg8BFAmkP0QgfdMVbIujX55W/yNOgABOH8CoFgkomhlbnRpdHlJZFBHOOw2BI9OQoNq+Vl1xZZKZ3ZlcnNpb24CWEAlchbJR0vmRfShG8On7Q2gknjkw4Dd6MYBLiH4u+/CmfQdmjNZdf6kozgW/6NXyKVNu8dAsKsin+xxXkDyVZoG";

    // v1
    const TEST_VECTOR_PRIVATE_KEY_V1: &str = "2.yN7l00BOlUE0Sb0M//Q53w==|EwKG/BduQRQ33Izqc/ogoBROIoI5dmgrxSo82sgzgAMIBt3A2FZ9vPRMY+GWT85JiqytDitGR3TqwnFUBhKUpRRAq4x7rA6A1arHrFp5Tp1p21O3SfjtvB3quiOKbqWk6ZaU1Np9HwqwAecddFcB0YyBEiRX3VwF2pgpAdiPbSMuvo2qIgyob0CUoC/h4Bz1be7Qa7B0Xw9/fMKkB1LpOm925lzqosyMQM62YpMGkjMsbZz0uPopu32fxzDWSPr+kekNNyLt9InGhTpxLmq1go/pXR2uw5dfpXc5yuta7DB0EGBwnQ8Vl5HPdDooqOTD9I1jE0mRyuBpWTTI3FRnu3JUh3rIyGBJhUmHqGZvw2CKdqHCIrQeQkkEYqOeJRJVdBjhv5KGJifqT3BFRwX/YFJIChAQpebNQKXe/0kPivWokHWwXlDB7S7mBZzhaAPidZvnuIhalE2qmTypDwHy22FyqV58T8MGGMchcASDi/QXI6kcdpJzPXSeU9o+NC68QDlOIrMVxKFeE7w7PvVmAaxEo0YwmuAzzKy9QpdlK0aab/xEi8V4iXj4hGepqAvHkXIQd+r3FNeiLfllkb61p6WTjr5urcmDQMR94/wYoilpG5OlybHdbhsYHvIzYoLrC7fzl630gcO6t4nM24vdB6Ymg9BVpEgKRAxSbE62Tqacxqnz9AcmgItb48NiR/He3n3ydGjPYuKk/ihZMgEwAEZvSlNxYONSbYrIGDtOY+8Nbt6KiH3l06wjZW8tcmFeVlWv+tWotnTY9IqlAfvNVTjtsobqtQnvsiDjdEVtNy/s2ci5TH+NdZluca2OVEr91Wayxh70kpM6ib4UGbfdmGgCo74gtKvKSJU0rTHakQ5L9JlaSDD5FamBRyI0qfL43Ad9qOUZ8DaffDCyuaVyuqk7cz9HwmEmvWU3VQ+5t06n/5kRDXttcw8w+3qClEEdGo1KeENcnXCB32dQe3tDTFpuAIMLqwXs6FhpawfZ5kPYvLPczGWaqftIs/RXJ/EltGc0ugw2dmTLpoQhCqrcKEBDoYVk0LDZKsnzitOGdi9mOWse7Se8798ib1UsHFUjGzISEt6upestxOeupSTOh0v4+AjXbDzRUyogHww3V+Bqg71bkcMxtB+WM+pn1XNbVTyl9NR040nhP7KEf6e9ruXAtmrBC2ah5cFEpLIot77VFZ9ilLuitSz+7T8n1yAh1IEG6xxXxninAZIzi2qGbH69O5RSpOJuJTv17zTLJQIIc781JwQ2TTwTGnx5wZLbffhCasowJKd2EVcyMJyhz6ru0PvXWJ4hUdkARJs3Xu8dus9a86N8Xk6aAPzBDqzYb1vyFIfBxP0oO8xFHgd30Cgmz8UrSE3qeWRrF8ftrI6xQnFjHBGWD/JWSvd6YMcQED0aVuQkuNW9ST/DzQThPzRfPUoiL10yAmV7Ytu4fR3x2sF0Yfi87YhHFuCMpV/DsqxmUizyiJuD938eRcH8hzR/VO53Qo3UIsqOLcyXtTv6THjSlTopQ+JOLOnHm1w8dzYbLN44OG44rRsbihMUQp+wUZ6bsI8rrOnm9WErzkbQFbrfAINdoCiNa6cimYIjvvnMTaFWNymqY1vZxGztQiMiHiHYwTfwHTXrb9j0uPM=|09J28iXv9oWzYtzK2LBT6Yht4IT4MijEkk0fwFdrVQ4=";

    fn make_mock_upgrade_token() -> V2UpgradeToken {
        let key_store = KeyStore::<KeySlotIds>::default();
        let mut ctx = key_store.context_mut();
        let v1_id = ctx.make_symmetric_key(SymmetricKeyAlgorithm::Aes256CbcHmac);
        let v2_id = ctx.make_symmetric_key(SymmetricKeyAlgorithm::XAes256Gcm);
        V2UpgradeToken::create(v1_id, v2_id, &ctx).unwrap()
    }

    fn register_in_memory_bridge(client: &Client) {
        client
            .km_state_bridge()
            .register_bridge(Box::new(InMemoryStateBridge::default()));
    }

    /// Assert that the client's active user key is XAES-256-GCM and matches `expected_v2_key`.
    fn assert_active_user_key_is_v2(client: &Client, expected_v2_key: &SymmetricCryptoKey) {
        let key_store = client.internal.get_key_store();
        let ctx = key_store.context();
        let algorithm = ctx
            .get_symmetric_key_algorithm(SymmetricKeySlotId::User)
            .unwrap();
        assert_eq!(
            algorithm,
            SymmetricKeyAlgorithm::XAes256Gcm,
            "user-slot algorithm must be XAES-256-GCM after upgrade"
        );

        #[allow(deprecated)]
        let user_key = ctx
            .dangerous_get_symmetric_key(SymmetricKeySlotId::User)
            .unwrap();
        assert_eq!(user_key, expected_v2_key);
    }

    /// V2 wrapped state from the test vectors. Wrapped under the V2 test user
    /// key, so it only decrypts cleanly when paired with that key.
    fn test_vector_v2_account_state() -> WrappedAccountCryptographicState {
        WrappedAccountCryptographicState::V2 {
            private_key: TEST_VECTOR_PRIVATE_KEY_V2.parse().unwrap(),
            signing_key: TEST_VECTOR_SIGNING_KEY_V2.parse().unwrap(),
            security_state: TEST_VECTOR_SECURITY_STATE_V2.parse().unwrap(),
            signed_public_key: TEST_VECTOR_SIGNED_PUBLIC_KEY_V2.parse().unwrap(),
        }
    }

    fn test_vector_v1_account_state() -> WrappedAccountCryptographicState {
        WrappedAccountCryptographicState::V1 {
            private_key: TEST_VECTOR_PRIVATE_KEY_V1.parse().unwrap(),
        }
    }

    #[tokio::test]
    async fn reinit_user_crypto_returns_not_unlocked_when_locked() {
        let client = Client::new_test(None);
        register_in_memory_bridge(&client);

        let result = reinit_user_crypto(
            &client,
            ReinitUserCryptoRequest {
                account_cryptographic_state: test_vector_v2_account_state(),
                upgrade_token: make_mock_upgrade_token(),
            },
        )
        .await;

        assert!(
            matches!(result, Err(ReinitUserCryptoError::NotUnlocked)),
            "reinit on a locked SDK must return NotUnlocked, got {result:?}"
        );
    }

    #[tokio::test]
    async fn reinit_user_crypto_is_noop_when_active_user_is_already_v2() {
        let client = Client::init_test_account(test_bitwarden_com_account_v2()).await;
        register_in_memory_bridge(&client);

        let result = reinit_user_crypto(
            &client,
            ReinitUserCryptoRequest {
                account_cryptographic_state: test_vector_v2_account_state(),
                upgrade_token: make_mock_upgrade_token(),
            },
        )
        .await;

        assert!(
            result.is_ok(),
            "reinit on an already-V2 user must be a no-op and return Ok, got {result:?}"
        );

        let expected_v2_key =
            SymmetricCryptoKey::try_from(TEST_VECTOR_USER_KEY_V2_B64.to_string()).unwrap();
        assert_active_user_key_is_v2(&client, &expected_v2_key);

        let upgrade_token = client.internal.state_bridge.get_v2_upgrade_token().await;
        assert!(
            upgrade_token.is_none(),
            "reinit on an already-V2 user must not set the upgrade token"
        );
    }

    #[tokio::test]
    async fn reinit_user_crypto_upgrades_v1_to_v2_with_token() {
        let client = Client::init_test_account(test_bitwarden_com_account()).await;
        register_in_memory_bridge(&client);

        // Build a V2 user key, install it into a temporary local slot, and
        // create an upgrade token linking the active V1 user key to it.
        let expected_v2_key =
            SymmetricCryptoKey::try_from(TEST_VECTOR_USER_KEY_V2_B64.to_string()).unwrap();
        let upgrade_token = {
            let mut ctx = client.internal.get_key_store().context_mut();
            let v2_key_id = ctx.add_local_symmetric_key(expected_v2_key.clone());
            V2UpgradeToken::create(SymmetricKeySlotId::User, v2_key_id, &ctx).unwrap()
        };

        reinit_user_crypto(
            &client,
            ReinitUserCryptoRequest {
                account_cryptographic_state: test_vector_v2_account_state(),
                upgrade_token: upgrade_token.clone(),
            },
        )
        .await
        .expect("V1→V2 reinit with a valid upgrade token should succeed");

        assert_active_user_key_is_v2(&client, &expected_v2_key);

        assert_eq!(
            client.internal.get_security_version(),
            2,
            "security version must reflect the V2 state"
        );

        {
            let key_store = client.internal.get_key_store();
            let ctx = key_store.context();
            assert!(
                ctx.has_signing_key(SigningKeySlotId::UserSigningKey),
                "user signing key must be set after V1→V2 upgrade"
            );
            assert!(
                ctx.has_private_key(PrivateKeySlotId::UserPrivateKey),
                "user private key must be set after V1→V2 upgrade"
            );
        }

        let stored_token = client
            .internal
            .state_bridge
            .get_v2_upgrade_token()
            .await
            .expect("the upgrade token must be set on the state bridge after reinit");
        assert_eq!(
            stored_token.wrapped_user_key_1,
            upgrade_token.wrapped_user_key_1
        );
        assert_eq!(
            stored_token.wrapped_user_key_2,
            upgrade_token.wrapped_user_key_2
        );
    }

    #[tokio::test]
    async fn reinit_user_crypto_called_twice_with_same_payload_is_noop() {
        let client = Client::init_test_account(test_bitwarden_com_account()).await;
        register_in_memory_bridge(&client);

        let expected_v2_key =
            SymmetricCryptoKey::try_from(TEST_VECTOR_USER_KEY_V2_B64.to_string()).unwrap();
        let upgrade_token = {
            let mut ctx = client.internal.get_key_store().context_mut();
            let v2_key_id = ctx.add_local_symmetric_key(expected_v2_key.clone());
            V2UpgradeToken::create(SymmetricKeySlotId::User, v2_key_id, &ctx).unwrap()
        };

        let request = || ReinitUserCryptoRequest {
            account_cryptographic_state: test_vector_v2_account_state(),
            upgrade_token: upgrade_token.clone(),
        };

        // First call performs the V1→V2 upgrade.
        reinit_user_crypto(&client, request())
            .await
            .expect("V1→V2 reinit with a valid upgrade token should succeed");
        assert_active_user_key_is_v2(&client, &expected_v2_key);

        // Second call with the same payload is a no-op: the active user key is
        // already V2, so the token is never re-applied.
        reinit_user_crypto(&client, request())
            .await
            .expect("re-applying the same upgrade after success should be a no-op");
        assert_active_user_key_is_v2(&client, &expected_v2_key);
    }

    #[tokio::test]
    async fn reinit_user_crypto_invalid_upgrade_token_returns_error() {
        let client = Client::init_test_account(test_bitwarden_com_account()).await;
        register_in_memory_bridge(&client);

        // Token built with a different V1 key — unwrapping with the client's
        // V1 key will fail.
        let mismatched_token = make_mock_upgrade_token();

        let result = reinit_user_crypto(
            &client,
            ReinitUserCryptoRequest {
                account_cryptographic_state: test_vector_v2_account_state(),
                upgrade_token: mismatched_token,
            },
        )
        .await;

        assert!(
            matches!(result, Err(ReinitUserCryptoError::InvalidUpgradeToken)),
            "mismatched upgrade token must return InvalidUpgradeToken, got {result:?}"
        );
    }

    #[tokio::test]
    async fn reinit_user_crypto_returns_crypto_initialization_on_key_mismatch() {
        let client = Client::init_test_account(test_bitwarden_com_account()).await;
        register_in_memory_bridge(&client);

        // Build an upgrade token whose V2 target is a fresh random key (not the
        // test-vector key). `unwrap_v2` only checks internal token consistency,
        // so it succeeds, but the resolved V2 key cannot decrypt the
        // test-vector account state.
        let upgrade_token = {
            let mut ctx = client.internal.get_key_store().context_mut();
            let v2_key_id = ctx.make_symmetric_key(SymmetricKeyAlgorithm::XAes256Gcm);
            V2UpgradeToken::create(SymmetricKeySlotId::User, v2_key_id, &ctx).unwrap()
        };

        let result = reinit_user_crypto(
            &client,
            ReinitUserCryptoRequest {
                account_cryptographic_state: test_vector_v2_account_state(),
                upgrade_token,
            },
        )
        .await;

        assert!(
            matches!(result, Err(ReinitUserCryptoError::CryptoInitialization)),
            "a V2 key that cannot decrypt the account state must return CryptoInitialization, got {result:?}"
        );

        // `set_to_context` resolves the V2 key into a local slot and fails
        // before it ever rewrites the User slot, so the original V1 user key is
        // left intact. The active session remains usable on failure.
        let key_store = client.internal.get_key_store();
        let ctx = key_store.context();
        assert!(
            ctx.has_symmetric_key(SymmetricKeySlotId::User),
            "the original V1 user key must remain in the User slot on failure"
        );
        assert_eq!(
            ctx.get_symmetric_key_algorithm(SymmetricKeySlotId::User)
                .unwrap(),
            SymmetricKeyAlgorithm::Aes256CbcHmac,
            "the User slot must still hold the original V1 key on failure"
        );
    }

    #[tokio::test]
    async fn reinit_user_crypto_returns_invalid_account_state_on_v1_request() {
        let client = Client::init_test_account(test_bitwarden_com_account()).await;

        let result = reinit_user_crypto(
            &client,
            ReinitUserCryptoRequest {
                account_cryptographic_state: test_vector_v1_account_state(),
                upgrade_token: make_mock_upgrade_token(),
            },
        )
        .await;

        assert!(
            matches!(
                result,
                Err(ReinitUserCryptoError::InvalidAccountCryptographicState)
            ),
            "a V1 account state must return InvalidAccountState, got {result:?}"
        );
    }

    #[tokio::test]
    async fn reinit_user_crypto_returns_state_bridge_not_registered_when_no_bridge() {
        let client = Client::init_test_account(test_bitwarden_com_account()).await;

        let result = reinit_user_crypto(
            &client,
            ReinitUserCryptoRequest {
                account_cryptographic_state: test_vector_v2_account_state(),
                upgrade_token: make_mock_upgrade_token(),
            },
        )
        .await;

        assert!(
            matches!(result, Err(ReinitUserCryptoError::StateBridgeNotRegistered)),
            "reinit without a registered state bridge must return StateBridgeNotRegistered, got {result:?}"
        );
    }

    #[tokio::test]
    async fn reinit_user_crypto_v1_v2_upgrade_rewraps_local_user_data_key() {
        use crate::key_management::LocalUserDataKeyState;

        // Bootstrap a V1 client to materialize a V1-wrapped LocalUserDataKey state.
        let client = Client::init_test_account(test_bitwarden_com_account()).await;
        let user_id = UserId::new(uuid::uuid!("060000fb-0922-4dd3-b170-6e15cb5df8c8"));
        register_in_memory_bridge(&client);

        // The V1 init plants a V1-wrapped local user data key in state.
        let v1_user_data_key = client
            .platform()
            .state()
            .get::<LocalUserDataKeyState>()
            .unwrap()
            .get(user_id)
            .await
            .unwrap()
            .expect("V1 init should plant a LocalUserDataKey state");
        assert!(
            matches!(
                v1_user_data_key.wrapped_key,
                EncString::Aes256Cbc_HmacSha256_B64 { .. }
            ),
            "initial local user data key should be V1-wrapped"
        );

        let v2_key = SymmetricCryptoKey::try_from(TEST_VECTOR_USER_KEY_V2_B64.to_string()).unwrap();
        let upgrade_token = {
            let mut ctx = client.internal.get_key_store().context_mut();
            let v2_key_id = ctx.add_local_symmetric_key(v2_key.clone());
            V2UpgradeToken::create(SymmetricKeySlotId::User, v2_key_id, &ctx).unwrap()
        };

        reinit_user_crypto(
            &client,
            ReinitUserCryptoRequest {
                account_cryptographic_state: test_vector_v2_account_state(),
                upgrade_token,
            },
        )
        .await
        .expect("V1→V2 reinit with a valid upgrade token should succeed");

        // The persisted wrapped local user data key must now be sealed with the V2 user key.
        let rewrapped_state = client
            .platform()
            .state()
            .get::<LocalUserDataKeyState>()
            .unwrap()
            .get(user_id)
            .await
            .unwrap()
            .expect("LocalUserDataKey state must remain present");
        assert!(
            matches!(
                rewrapped_state.wrapped_key,
                EncString::Cose_Encrypt0_B64 { .. }
            ),
            "rewrapped key should be sealed with the V2 user key"
        );
        assert_ne!(rewrapped_state.wrapped_key, v1_user_data_key.wrapped_key);
    }
}