[PM-7879, PM-7635] Add server verification for master password to user verification (#9523)

* add MP server verification

* add tests and minor service enhancements

* fix tests

* fix initializations for cli and browser

* fix CLI

* pr feedback

apps/browser/src/background/main.background.ts

@@ -745,7 +745,6 @@ export default class MainBackground {
     this.folderApiService = new FolderApiService(this.folderService, this.apiService);
 
     this.userVerificationService = new UserVerificationService(
-      this.stateService,
       this.cryptoService,
       this.accountService,
       this.masterPasswordService,

apps/cli/src/auth/commands/unlock.command.ts

@@ -1,19 +1,18 @@
 import { firstValueFrom, map } from "rxjs";
 
-import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { OrganizationApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/organization/organization-api.service.abstraction";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { KeyConnectorService } from "@bitwarden/common/auth/abstractions/key-connector.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/auth/abstractions/master-password.service.abstraction";
-import { SecretVerificationRequest } from "@bitwarden/common/auth/models/request/secret-verification.request";
+import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
+import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
+import { MasterPasswordVerification } from "@bitwarden/common/auth/types/verification";
 import { CryptoFunctionService } from "@bitwarden/common/platform/abstractions/crypto-function.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
-import { StateService } from "@bitwarden/common/platform/abstractions/state.service";
-import { HashPurpose } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { ConsoleLogService } from "@bitwarden/common/platform/services/console-log.service";
+import { MasterKey } from "@bitwarden/common/types/key";
 import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
 
 import { ConvertToKeyConnectorCommand } from "../../commands/convert-to-key-connector.command";
@@ -26,16 +25,14 @@ export class UnlockCommand {
     private accountService: AccountService,
     private masterPasswordService: InternalMasterPasswordServiceAbstraction,
     private cryptoService: CryptoService,
-    private stateService: StateService,
+    private userVerificationService: UserVerificationService,
     private cryptoFunctionService: CryptoFunctionService,
-    private apiService: ApiService,
     private logService: ConsoleLogService,
     private keyConnectorService: KeyConnectorService,
     private environmentService: EnvironmentService,
     private syncService: SyncService,
     private organizationApiService: OrganizationApiServiceAbstraction,
     private logout: () => Promise<void>,
-    private kdfConfigService: KdfConfigService,
   ) {}
 
   async run(password: string, cmdOptions: Record<string, any>) {
@@ -52,62 +49,43 @@ export class UnlockCommand {
     const [userId, email] = await firstValueFrom(
       this.accountService.activeAccount$.pipe(map((a) => [a?.id, a?.email])),
     );
-    const kdfConfig = await this.kdfConfigService.getKdfConfig();
-    const masterKey = await this.cryptoService.makeMasterKey(password, email, kdfConfig);
-    const storedMasterKeyHash = await firstValueFrom(
-      this.masterPasswordService.masterKeyHash$(userId),
-    );
 
-    let passwordValid = false;
-    if (masterKey != null) {
-      if (storedMasterKeyHash != null) {
-        passwordValid = await this.cryptoService.compareAndUpdateKeyHash(password, masterKey);
-      } else {
-        const serverKeyHash = await this.cryptoService.hashMasterKey(
-          password,
-          masterKey,
-          HashPurpose.ServerAuthorization,
-        );
-        const request = new SecretVerificationRequest();
-        request.masterPasswordHash = serverKeyHash;
-        try {
-          await this.apiService.postAccountVerifyPassword(request);
-          passwordValid = true;
-          const localKeyHash = await this.cryptoService.hashMasterKey(
-            password,
-            masterKey,
-            HashPurpose.LocalAuthorization,
-          );
-          await this.masterPasswordService.setMasterKeyHash(localKeyHash, userId);
-        } catch {
-          // Ignore
-        }
+    const verification = {
+      type: VerificationType.MasterPassword,
+      secret: password,
+    } as MasterPasswordVerification;
+
+    let masterKey: MasterKey;
+    try {
+      const response = await this.userVerificationService.verifyUserByMasterPassword(
+        verification,
+        userId,
+        email,
+      );
+      masterKey = response.masterKey;
+    } catch (e) {
+      // verification failure throws
+      return Response.error(e.message);
+    }
+
+    const userKey = await this.masterPasswordService.decryptUserKeyWithMasterKey(masterKey);
+    await this.cryptoService.setUserKey(userKey);
+
+    if (await this.keyConnectorService.getConvertAccountRequired()) {
+      const convertToKeyConnectorCommand = new ConvertToKeyConnectorCommand(
+        this.keyConnectorService,
+        this.environmentService,
+        this.syncService,
+        this.organizationApiService,
+        this.logout,
+      );
+      const convertResponse = await convertToKeyConnectorCommand.run();
+      if (!convertResponse.success) {
+        return convertResponse;
       }
     }
 
-    if (passwordValid) {
-      await this.masterPasswordService.setMasterKey(masterKey, userId);
-      const userKey = await this.masterPasswordService.decryptUserKeyWithMasterKey(masterKey);
-      await this.cryptoService.setUserKey(userKey);
-
-      if (await this.keyConnectorService.getConvertAccountRequired()) {
-        const convertToKeyConnectorCommand = new ConvertToKeyConnectorCommand(
-          this.keyConnectorService,
-          this.environmentService,
-          this.syncService,
-          this.organizationApiService,
-          this.logout,
-        );
-        const convertResponse = await convertToKeyConnectorCommand.run();
-        if (!convertResponse.success) {
-          return convertResponse;
-        }
-      }
-
-      return this.successResponse();
-    } else {
-      return Response.error("Invalid master password.");
-    }
+    return this.successResponse();
   }
 
   private async setNewSessionKey() {

apps/cli/src/base-program.ts

@@ -140,16 +140,14 @@ export abstract class BaseProgram {
           this.serviceContainer.accountService,
           this.serviceContainer.masterPasswordService,
           this.serviceContainer.cryptoService,
-          this.serviceContainer.stateService,
+          this.serviceContainer.userVerificationService,
           this.serviceContainer.cryptoFunctionService,
-          this.serviceContainer.apiService,
           this.serviceContainer.logService,
           this.serviceContainer.keyConnectorService,
           this.serviceContainer.environmentService,
           this.serviceContainer.syncService,
           this.serviceContainer.organizationApiService,
           this.serviceContainer.logout,
-          this.serviceContainer.kdfConfigService,
         );
         const response = await command.run(null, null);
         if (!response.success) {

apps/cli/src/oss-serve-configurator.ts

@@ -120,16 +120,14 @@ export class OssServeConfigurator {
       this.serviceContainer.accountService,
       this.serviceContainer.masterPasswordService,
       this.serviceContainer.cryptoService,
-      this.serviceContainer.stateService,
+      this.serviceContainer.userVerificationService,
       this.serviceContainer.cryptoFunctionService,
-      this.serviceContainer.apiService,
       this.serviceContainer.logService,
       this.serviceContainer.keyConnectorService,
       this.serviceContainer.environmentService,
       this.serviceContainer.syncService,
       this.serviceContainer.organizationApiService,
       async () => await this.serviceContainer.logout(),
-      this.serviceContainer.kdfConfigService,
     );
 
     this.sendCreateCommand = new SendCreateCommand(

apps/cli/src/program.ts

@@ -270,16 +270,14 @@ export class Program extends BaseProgram {
             this.serviceContainer.accountService,
             this.serviceContainer.masterPasswordService,
             this.serviceContainer.cryptoService,
-            this.serviceContainer.stateService,
+            this.serviceContainer.userVerificationService,
             this.serviceContainer.cryptoFunctionService,
-            this.serviceContainer.apiService,
             this.serviceContainer.logService,
             this.serviceContainer.keyConnectorService,
             this.serviceContainer.environmentService,
             this.serviceContainer.syncService,
             this.serviceContainer.organizationApiService,
             async () => await this.serviceContainer.logout(),
-            this.serviceContainer.kdfConfigService,
           );
           const response = await command.run(password, cmd);
           this.processResponse(response);

apps/cli/src/service-container.ts

@@ -613,7 +613,6 @@ export class ServiceContainer {
       await this.cryptoService.clearStoredUserKey(KeySuffixOptions.Auto);
 
     this.userVerificationService = new UserVerificationService(
-      this.stateService,
       this.cryptoService,
       this.accountService,
       this.masterPasswordService,