[PM-5735] Create kdf Service (#8715)

* key connector migration initial * migrator complete * fix dependencies * finalized tests * fix deps and sync main * clean up definition file * fixing tests * fixed tests * fixing CLI, Browser, Desktop builds * fixed factory options * reverting exports * implemented UserKeyDefinition clearOn * Initial Kdf Service Changes * rename and account setting kdfconfig * fixing tests and renaming migration * fixed DI ordering for browser * rename and fix DI * Clean up Migrations * fixing migrations * begin data structure changes for kdf config * Make KDF more type safe; co-author: jlf0dev * fixing tests * Fixed CLI login and comments * set now accepts userId and test updates --------- Co-authored-by: Jake Fink <jfink@bitwarden.com>
2025-12-06 00:13:28 +00:00 · 2024-04-25 11:26:01 -07:00
parent dba910d0b9
commit 1e4158fd87
82 changed files with 896 additions and 361 deletions
--- a/libs/tools/export/vault-export/vault-export-core/src/services/base-vault-export.service.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/base-vault-export.service.ts
@@ -1,7 +1,7 @@
+import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { KdfConfig } from "@bitwarden/common/auth/models/domain/kdf-config";
 import { CryptoFunctionService } from "@bitwarden/common/platform/abstractions/crypto-function.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
-import { StateService } from "@bitwarden/common/platform/abstractions/state.service";
 import { KdfType } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { CipherType } from "@bitwarden/common/vault/enums";
@@ -12,15 +12,14 @@ export class BaseVaultExportService {
  constructor(
    protected cryptoService: CryptoService,
    private cryptoFunctionService: CryptoFunctionService,
-    private stateService: StateService,
+    private kdfConfigService: KdfConfigService,
  ) {}

  protected async buildPasswordExport(clearText: string, password: string): Promise<string> {
-    const kdfType: KdfType = await this.stateService.getKdfType();
-    const kdfConfig: KdfConfig = await this.stateService.getKdfConfig();
+    const kdfConfig: KdfConfig = await this.kdfConfigService.getKdfConfig();

    const salt = Utils.fromBufferToB64(await this.cryptoFunctionService.randomBytes(16));
-    const key = await this.cryptoService.makePinKey(password, salt, kdfType, kdfConfig);
+    const key = await this.cryptoService.makePinKey(password, salt, kdfConfig);

    const encKeyValidation = await this.cryptoService.encrypt(Utils.newGuid(), key);
    const encText = await this.cryptoService.encrypt(clearText, key);
@@ -29,14 +28,17 @@ export class BaseVaultExportService {
      encrypted: true,
      passwordProtected: true,
      salt: salt,
-      kdfType: kdfType,
+      kdfType: kdfConfig.kdfType,
      kdfIterations: kdfConfig.iterations,
-      kdfMemory: kdfConfig.memory,
-      kdfParallelism: kdfConfig.parallelism,
      encKeyValidation_DO_NOT_EDIT: encKeyValidation.encryptedString,
      data: encText.encryptedString,
    };

+    if (kdfConfig.kdfType === KdfType.Argon2id) {
+      jsonDoc.kdfMemory = kdfConfig.memory;
+      jsonDoc.kdfParallelism = kdfConfig.parallelism;
+    }
+
    return JSON.stringify(jsonDoc, null, "  ");
  }

--- a/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.spec.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.spec.ts
@@ -1,13 +1,12 @@
 import { mock, MockProxy } from "jest-mock-extended";

-import { KdfConfig } from "@bitwarden/common/auth/models/domain/kdf-config";
+import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { CipherWithIdExport } from "@bitwarden/common/models/export/cipher-with-ids.export";
 import { CryptoFunctionService } from "@bitwarden/common/platform/abstractions/crypto-function.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
-import { KdfType, PBKDF2_ITERATIONS } from "@bitwarden/common/platform/enums";
+import { DEFAULT_KDF_CONFIG, KdfType, PBKDF2_ITERATIONS } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { EncryptedString, EncString } from "@bitwarden/common/platform/models/domain/enc-string";
-import { StateService } from "@bitwarden/common/platform/services/state.service";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { CipherType } from "@bitwarden/common/vault/enums";
@@ -110,10 +109,10 @@ function expectEqualCiphers(ciphers: CipherView[] | Cipher[], jsonResult: string
  expect(actual).toEqual(JSON.stringify(items));
 }

-function expectEqualFolderViews(folderviews: FolderView[] | Folder[], jsonResult: string) {
+function expectEqualFolderViews(folderViews: FolderView[] | Folder[], jsonResult: string) {
  const actual = JSON.stringify(JSON.parse(jsonResult).folders);
  const folders: FolderResponse[] = [];
-  folderviews.forEach((c) => {
+  folderViews.forEach((c) => {
    const folder = new FolderResponse();
    folder.id = c.id;
    folder.name = c.name.toString();
@@ -144,19 +143,18 @@ describe("VaultExportService", () => {
  let cipherService: MockProxy<CipherService>;
  let folderService: MockProxy<FolderService>;
  let cryptoService: MockProxy<CryptoService>;
-  let stateService: MockProxy<StateService>;
+  let kdfConfigService: MockProxy<KdfConfigService>;

  beforeEach(() => {
    cryptoFunctionService = mock<CryptoFunctionService>();
    cipherService = mock<CipherService>();
    folderService = mock<FolderService>();
    cryptoService = mock<CryptoService>();
-    stateService = mock<StateService>();
+    kdfConfigService = mock<KdfConfigService>();

    folderService.getAllDecryptedFromState.mockResolvedValue(UserFolderViews);
    folderService.getAllFromState.mockResolvedValue(UserFolders);
-    stateService.getKdfType.mockResolvedValue(KdfType.PBKDF2_SHA256);
-    stateService.getKdfConfig.mockResolvedValue(new KdfConfig(PBKDF2_ITERATIONS.defaultValue));
+    kdfConfigService.getKdfConfig.mockResolvedValue(DEFAULT_KDF_CONFIG);
    cryptoService.encrypt.mockResolvedValue(new EncString("encrypted"));

    exportService = new IndividualVaultExportService(
@@ -164,7 +162,7 @@ describe("VaultExportService", () => {
      cipherService,
      cryptoService,
      cryptoFunctionService,
-      stateService,
+      kdfConfigService,
    );
  });

--- a/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/individual-vault-export.service.ts
@@ -1,9 +1,9 @@
 import * as papa from "papaparse";

+import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { CipherWithIdExport, FolderWithIdExport } from "@bitwarden/common/models/export";
 import { CryptoFunctionService } from "@bitwarden/common/platform/abstractions/crypto-function.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
-import { StateService } from "@bitwarden/common/platform/abstractions/state.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
@@ -32,9 +32,9 @@ export class IndividualVaultExportService
    private cipherService: CipherService,
    cryptoService: CryptoService,
    cryptoFunctionService: CryptoFunctionService,
-    stateService: StateService,
+    kdfConfigService: KdfConfigService,
  ) {
-    super(cryptoService, cryptoFunctionService, stateService);
+    super(cryptoService, cryptoFunctionService, kdfConfigService);
  }

  async getExport(format: ExportFormat = "csv"): Promise<string> {
--- a/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
@@ -1,10 +1,10 @@
 import * as papa from "papaparse";

 import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { CipherWithIdExport, CollectionWithIdExport } from "@bitwarden/common/models/export";
 import { CryptoFunctionService } from "@bitwarden/common/platform/abstractions/crypto-function.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
-import { StateService } from "@bitwarden/common/platform/abstractions/state.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { CollectionService } from "@bitwarden/common/vault/abstractions/collection.service";
@@ -36,10 +36,10 @@ export class OrganizationVaultExportService
    private apiService: ApiService,
    cryptoService: CryptoService,
    cryptoFunctionService: CryptoFunctionService,
-    stateService: StateService,
    private collectionService: CollectionService,
+    kdfConfigService: KdfConfigService,
  ) {
-    super(cryptoService, cryptoFunctionService, stateService);
+    super(cryptoService, cryptoFunctionService, kdfConfigService);
  }

  async getPasswordProtectedExport(
--- a/libs/tools/export/vault-export/vault-export-core/src/services/vault-export.service.spec.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/vault-export.service.spec.ts
@@ -1,13 +1,12 @@
 import { mock, MockProxy } from "jest-mock-extended";

-import { KdfConfig } from "@bitwarden/common/auth/models/domain/kdf-config";
+import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { CipherWithIdExport } from "@bitwarden/common/models/export/cipher-with-ids.export";
 import { CryptoFunctionService } from "@bitwarden/common/platform/abstractions/crypto-function.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
-import { KdfType, PBKDF2_ITERATIONS } from "@bitwarden/common/platform/enums";
+import { DEFAULT_KDF_CONFIG, KdfType, PBKDF2_ITERATIONS } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { EncryptedString, EncString } from "@bitwarden/common/platform/models/domain/enc-string";
-import { StateService } from "@bitwarden/common/platform/services/state.service";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { FolderService } from "@bitwarden/common/vault/abstractions/folder/folder.service.abstraction";
 import { CipherType } from "@bitwarden/common/vault/enums";
@@ -110,10 +109,10 @@ function expectEqualCiphers(ciphers: CipherView[] | Cipher[], jsonResult: string
  expect(actual).toEqual(JSON.stringify(items));
 }

-function expectEqualFolderViews(folderviews: FolderView[] | Folder[], jsonResult: string) {
+function expectEqualFolderViews(folderViews: FolderView[] | Folder[], jsonResult: string) {
  const actual = JSON.stringify(JSON.parse(jsonResult).folders);
  const folders: FolderResponse[] = [];
-  folderviews.forEach((c) => {
+  folderViews.forEach((c) => {
    const folder = new FolderResponse();
    folder.id = c.id;
    folder.name = c.name.toString();
@@ -144,19 +143,18 @@ describe("VaultExportService", () => {
  let cipherService: MockProxy<CipherService>;
  let folderService: MockProxy<FolderService>;
  let cryptoService: MockProxy<CryptoService>;
-  let stateService: MockProxy<StateService>;
+  let kdfConfigService: MockProxy<KdfConfigService>;

  beforeEach(() => {
    cryptoFunctionService = mock<CryptoFunctionService>();
    cipherService = mock<CipherService>();
    folderService = mock<FolderService>();
    cryptoService = mock<CryptoService>();
-    stateService = mock<StateService>();
+    kdfConfigService = mock<KdfConfigService>();

    folderService.getAllDecryptedFromState.mockResolvedValue(UserFolderViews);
    folderService.getAllFromState.mockResolvedValue(UserFolders);
-    stateService.getKdfType.mockResolvedValue(KdfType.PBKDF2_SHA256);
-    stateService.getKdfConfig.mockResolvedValue(new KdfConfig(PBKDF2_ITERATIONS.defaultValue));
+    kdfConfigService.getKdfConfig.mockResolvedValue(DEFAULT_KDF_CONFIG);
    cryptoService.encrypt.mockResolvedValue(new EncString("encrypted"));

    exportService = new IndividualVaultExportService(
@@ -164,7 +162,7 @@ describe("VaultExportService", () => {
      cipherService,
      cryptoService,
      cryptoFunctionService,
-      stateService,
+      kdfConfigService,
    );
  });