[PM-35394] MasterPasswordService Admin Console Integration#7629
Conversation
…ayload signature.
…a payload signature.
…unlock data inputs.
… request payload variants.
🤖 Bitwarden Claude Code ReviewOverall Assessment: APPROVE This PR extends the AdminConsole account-recovery flow to accept the new Code Review DetailsNo new findings. Verified during this pass:
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## auth/pm-35393/master-password-service-auth-integration #7629 +/- ##
==========================================================================================
+ Coverage 59.87% 59.90% +0.02%
==========================================================================================
Files 2124 2124
Lines 93469 93566 +97
Branches 8307 8326 +19
==========================================================================================
+ Hits 55965 56048 +83
- Misses 35527 35535 +8
- Partials 1977 1983 +6 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
enmande
changed the title
BTreston
left a comment
BTreston
left a comment
There was a problem hiding this comment.
LGTM, non blocking comments. I'll have another look when its ready for main
| IMasterPasswordService masterPasswordService, | ||
| TimeProvider timeProvider) : IAdminRecoverAccountCommand | ||
| { | ||
| public async Task<IdentityResult> RecoverAccountAsync(Guid orgId, |
There was a problem hiding this comment.
⛏️ Can we also [Obsolete] this?
| @@ -21,4 +22,20 @@ public interface IAdminRecoverAccountCommand | |||
| /// <exception cref="NotFoundException">When the user does not exist.</exception> | |||
| Task<IdentityResult> RecoverAccountAsync(Guid orgId, OrganizationUser organizationUser, | |||
2 participants
🎟️ Tracking
PM-35394
📔 Objective
Extend the AdminConsole account-recovery flow to accept the new master password payload shape (UnlockData + AuthenticationData) alongside the existing (NewMasterPasswordHash + Key), wiring the new path through the centralized
MasterPasswordService.PrepareSetInitialOrUpdateExistingMasterPasswordAsynctier (source).Per-request availability of an acceptable payload loadout (hash + key, or authenticationdata + unlockdata) is boundary-enforced at the request-model layer; both the v1 and v2 command paths handle either variant, and
OrganizationUsersController.PutRecoverAccountdispatches accordingly so clients that have not yet upgraded continue to work while the in-flight updates roll out.Part of the PM-33011 story-of-stories to route all password set/change/rotate flows through
MasterPasswordService. Depends on PM-35393.📓 This is currently stacked on #7575 which is in QA.
📸 Screenshots
Admin Account Recovery (password only) with reset-two-factor-account-recovery 🎏
ℹ️ This illustrates flow pathing when the
pm-15489-reset-two-factor-account-recoveryflag is on.zed is a just-provisioned user in a TDE encryption org.
Admin enmande recovers zed's account.
PM-35394__tde-takeover-admin-reset-two-factor-on.mov
Admin Account Recovery (2FA only) with reset-two-factor-account-recovery 🎏
ℹ️ This illustrates flow pathing when the
pm-15489-reset-two-factor-account-recoveryflag is on.zed is an organization user with 2FA (authenticator).
Admin enmande recovers zed's 2FA.
PM-35394__recover-2fa-only.mov
Admin Account Recovery (Master Password + 2FA) with reset-two-factor-account-recovery 🎏
ℹ️ This illustrates flow pathing when the
pm-15489-reset-two-factor-account-recoveryflag is on.zed is a user in a TDE encryption org with 2FA (authenticator).
Admin enmande recovers zed's account with Master Password + 2FA.
PM-35394__recover-password-and-2fa.mov
Admin Account Recovery
ℹ️ This illustrates flow pathing when the
pm-15489-reset-two-factor-account-recoveryflag is off.zed is a just-provisioned user in a TDE encryption org.
Admin enmande recovers zed's account.
PM-35394__tde-recover-admin-reset-two-factor-off.mov