Merge remote-tracking branch 'origin/main' into ac/strong-typed-guids

libs/admin-console/src/common/collections/abstractions/collection-admin.service.ts

@@ -1,15 +1,20 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { CollectionDetailsResponse } from "@bitwarden/admin-console/common";
+import { UserId } from "@bitwarden/common/types/guid";
 
 import { CollectionAccessSelectionView, CollectionAdminView } from "../models";
 
 export abstract class CollectionAdminService {
-  getAll: (organizationId: string) => Promise<CollectionAdminView[]>;
-  get: (organizationId: string, collectionId: string) => Promise<CollectionAdminView | undefined>;
-  save: (collection: CollectionAdminView) => Promise<CollectionDetailsResponse>;
-  delete: (organizationId: string, collectionId: string) => Promise<void>;
-  bulkAssignAccess: (
+  abstract getAll: (organizationId: string) => Promise<CollectionAdminView[]>;
+  abstract get: (
+    organizationId: string,
+    collectionId: string,
+  ) => Promise<CollectionAdminView | undefined>;
+  abstract save: (
+    collection: CollectionAdminView,
+    userId: UserId,
+  ) => Promise<CollectionDetailsResponse>;
+  abstract delete: (organizationId: string, collectionId: string) => Promise<void>;
+  abstract bulkAssignAccess: (
     organizationId: string,
     collectionIds: string[],
     users: CollectionAccessSelectionView[],

libs/admin-console/src/common/collections/abstractions/collection.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
@@ -9,27 +7,25 @@ import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { CollectionData, Collection, CollectionView } from "../models";
 
 export abstract class CollectionService {
-  encryptedCollections$: Observable<Collection[]>;
-  decryptedCollections$: Observable<CollectionView[]>;
-
-  clearActiveUserCache: () => Promise<void>;
-  encrypt: (model: CollectionView) => Promise<Collection>;
-  decryptedCollectionViews$: (ids: CollectionId[]) => Observable<CollectionView[]>;
+  abstract encryptedCollections$: (userId: UserId) => Observable<Collection[] | null>;
+  abstract decryptedCollections$: (userId: UserId) => Observable<CollectionView[]>;
+  abstract upsert: (collection: CollectionData, userId: UserId) => Promise<any>;
+  abstract replace: (collections: { [id: string]: CollectionData }, userId: UserId) => Promise<any>;
   /**
-   * @deprecated This method will soon be made private
-   * See PM-12375
+   * @deprecated This method will soon be made private, use `decryptedCollections$` instead.
    */
-  decryptMany: (
+  abstract decryptMany$: (
     collections: Collection[],
-    orgKeys?: Record<OrganizationId, OrgKey>,
-  ) => Promise<CollectionView[]>;
-  get: (id: string) => Promise<Collection>;
-  getAll: () => Promise<Collection[]>;
-  getAllDecrypted: () => Promise<CollectionView[]>;
-  getAllNested: (collections?: CollectionView[]) => Promise<TreeNode<CollectionView>[]>;
-  getNested: (id: string) => Promise<TreeNode<CollectionView>>;
-  upsert: (collection: CollectionData | CollectionData[]) => Promise<any>;
-  replace: (collections: { [id: string]: CollectionData }, userId: UserId) => Promise<any>;
-  clear: (userId?: string) => Promise<void>;
-  delete: (id: string | string[]) => Promise<any>;
+    orgKeys: Record<OrganizationId, OrgKey>,
+  ) => Observable<CollectionView[]>;
+  abstract delete: (ids: CollectionId[], userId: UserId) => Promise<any>;
+  abstract encrypt: (model: CollectionView, userId: UserId) => Promise<Collection>;
+  /**
+   * Transforms the input CollectionViews into TreeNodes
+   */
+  abstract getAllNested: (collections: CollectionView[]) => TreeNode<CollectionView>[];
+  /*
+   * Transforms the input CollectionViews into TreeNodes and then returns the Treenode with the specified id
+   */
+  abstract getNested: (collections: CollectionView[], id: string) => TreeNode<CollectionView>;
 }

libs/admin-console/src/common/collections/abstractions/vnext-collection.service.ts

@@ -1,43 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { Observable } from "rxjs";
-
-import { OrganizationId, UserId } from "@bitwarden/common/types/guid";
-import { OrgKey } from "@bitwarden/common/types/key";
-import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
-
-import { CollectionData, Collection, CollectionView } from "../models";
-
-export abstract class vNextCollectionService {
-  encryptedCollections$: (userId: UserId) => Observable<Collection[]>;
-  decryptedCollections$: (userId: UserId) => Observable<CollectionView[]>;
-  upsert: (collection: CollectionData | CollectionData[], userId: UserId) => Promise<any>;
-  replace: (collections: { [id: string]: CollectionData }, userId: UserId) => Promise<any>;
-  /**
-   * Clear decrypted state without affecting encrypted state.
-   * Used for locking the vault.
-   */
-  clearDecryptedState: (userId: UserId) => Promise<void>;
-  /**
-   * Clear decrypted and encrypted state.
-   * Used for logging out.
-   */
-  clear: (userId: UserId) => Promise<void>;
-  delete: (id: string | string[], userId: UserId) => Promise<any>;
-  encrypt: (model: CollectionView) => Promise<Collection>;
-  /**
-   * @deprecated This method will soon be made private, use `decryptedCollections$` instead.
-   */
-  decryptMany: (
-    collections: Collection[],
-    orgKeys?: Record<OrganizationId, OrgKey> | null,
-  ) => Promise<CollectionView[]>;
-  /**
-   * Transforms the input CollectionViews into TreeNodes
-   */
-  getAllNested: (collections: CollectionView[]) => TreeNode<CollectionView>[];
-  /**
-   * Transforms the input CollectionViews into TreeNodes and then returns the Treenode with the specified id
-   */
-  getNested: (collections: CollectionView[], id: string) => TreeNode<CollectionView>;
-}

libs/admin-console/src/common/collections/models/collection.data.ts

@@ -26,7 +26,10 @@ export class CollectionData {
     this.type = response.type;
   }
 
-  static fromJSON(obj: Jsonify<CollectionData>) {
+  static fromJSON(obj: Jsonify<CollectionData | null>): CollectionData | null {
+    if (obj == null) {
+      return null;
+    }
     return Object.assign(new CollectionData(new CollectionDetailsResponse({})), obj);
   }
 }

libs/admin-console/src/common/collections/models/collection.ts

@@ -1,8 +1,10 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
+<<<<<<< HEAD
 import Domain from "@bitwarden/common/platform/models/domain/domain-base";
 import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
+=======
+import Domain, { EncryptableKeys } from "@bitwarden/common/platform/models/domain/domain-base";
+>>>>>>> origin/main
 import { OrgKey } from "@bitwarden/common/types/key";
 
 import { CollectionData } from "./collection.data";
@@ -16,6 +18,7 @@ export const CollectionTypes = {
 export type CollectionType = (typeof CollectionTypes)[keyof typeof CollectionTypes];
 
 export class Collection extends Domain {
+<<<<<<< HEAD
   id: CollectionId;
   organizationId: OrganizationId;
   name: EncString;
@@ -24,8 +27,18 @@ export class Collection extends Domain {
   hidePasswords: boolean;
   manage: boolean;
   type: CollectionType;
+=======
+  id: string | undefined;
+  organizationId: string | undefined;
+  name: EncString | undefined;
+  externalId: string | undefined;
+  readOnly: boolean = false;
+  hidePasswords: boolean = false;
+  manage: boolean = false;
+  type: CollectionType = CollectionTypes.SharedCollection;
+>>>>>>> origin/main
 
-  constructor(obj?: CollectionData) {
+  constructor(obj?: CollectionData | null) {
     super();
     if (obj == null) {
       return;
@@ -52,8 +65,8 @@ export class Collection extends Domain {
     return this.decryptObj<Collection, CollectionView>(
       this,
       new CollectionView(this),
-      ["name"],
-      this.organizationId,
+      ["name"] as EncryptableKeys<Collection, CollectionView>[],
+      this.organizationId ?? null,
       orgKey,
     );
   }

libs/admin-console/src/common/collections/models/collection.view.ts

@@ -11,9 +11,15 @@ import { CollectionAccessDetailsResponse } from "./collection.response";
 export const NestingDelimiter = "/";
 
 export class CollectionView implements View, ITreeNodeObject {
+<<<<<<< HEAD
   id: CollectionId | undefined;
   organizationId: OrganizationId | undefined;
   name: string | undefined;
+=======
+  id: string | undefined;
+  organizationId: string | undefined;
+  name: string = "";
+>>>>>>> origin/main
   externalId: string | undefined;
   // readOnly applies to the items within a collection
   readOnly: boolean = false;

libs/admin-console/src/common/collections/services/collection.state.ts

@@ -0,0 +1,28 @@
+import { Jsonify } from "type-fest";
+
+import {
+  COLLECTION_DISK,
+  COLLECTION_MEMORY,
+  UserKeyDefinition,
+} from "@bitwarden/common/platform/state";
+import { CollectionId } from "@bitwarden/common/types/guid";
+
+import { CollectionData, CollectionView } from "../models";
+
+export const ENCRYPTED_COLLECTION_DATA_KEY = UserKeyDefinition.record<
+  CollectionData | null,
+  CollectionId
+>(COLLECTION_DISK, "collections", {
+  deserializer: (jsonData: Jsonify<CollectionData | null>) => CollectionData.fromJSON(jsonData),
+  clearOn: ["logout"],
+});
+
+export const DECRYPTED_COLLECTION_DATA_KEY = new UserKeyDefinition<CollectionView[] | null>(
+  COLLECTION_MEMORY,
+  "decryptedCollections",
+  {
+    deserializer: (obj: Jsonify<CollectionView[] | null>) =>
+      obj?.map((f) => CollectionView.fromJSON(f)) ?? null,
+    clearOn: ["logout", "lock"],
+  },
+);

libs/admin-console/src/common/collections/services/default-collection-admin.service.ts

@@ -1,9 +1,11 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
+
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { SelectionReadOnlyRequest } from "@bitwarden/common/admin-console/models/request/selection-read-only.request";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
+import { CollectionId, UserId } from "@bitwarden/common/types/guid";
 import { KeyService } from "@bitwarden/key-management";
 
 import { CollectionAdminService, CollectionService } from "../abstractions";
@@ -55,7 +57,7 @@ export class DefaultCollectionAdminService implements CollectionAdminService {
     return view;
   }
 
-  async save(collection: CollectionAdminView): Promise<CollectionDetailsResponse> {
+  async save(collection: CollectionAdminView, userId: UserId): Promise<CollectionDetailsResponse> {
     const request = await this.encrypt(collection);
 
     let response: CollectionDetailsResponse;
@@ -71,9 +73,9 @@ export class DefaultCollectionAdminService implements CollectionAdminService {
     }
 
     if (response.assigned) {
-      await this.collectionService.upsert(new CollectionData(response));
+      await this.collectionService.upsert(new CollectionData(response), userId);
     } else {
-      await this.collectionService.delete(collection.id);
+      await this.collectionService.delete([collection.id as CollectionId], userId);
     }
 
     return response;

libs/admin-console/src/common/collections/services/default-collection.service.spec.ts

@@ -1,10 +1,11 @@
-import { mock } from "jest-mock-extended";
-import { firstValueFrom, of } from "rxjs";
+import { mock, MockProxy } from "jest-mock-extended";
+import { combineLatest, first, firstValueFrom, of, ReplaySubject, takeWhile } from "rxjs";
 
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
+import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { ContainerService } from "@bitwarden/common/platform/services/container.service";
 import {
   FakeStateProvider,
@@ -16,124 +17,382 @@ import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/gu
 import { OrgKey } from "@bitwarden/common/types/key";
 import { KeyService } from "@bitwarden/key-management";
 
-import { CollectionData } from "../models";
+import { CollectionData, CollectionView } from "../models";
 
-import {
-  DefaultCollectionService,
-  ENCRYPTED_COLLECTION_DATA_KEY,
-} from "./default-collection.service";
+import { DECRYPTED_COLLECTION_DATA_KEY, ENCRYPTED_COLLECTION_DATA_KEY } from "./collection.state";
+import { DefaultCollectionService } from "./default-collection.service";
 
 describe("DefaultCollectionService", () => {
+  let keyService: MockProxy<KeyService>;
+  let encryptService: MockProxy<EncryptService>;
+  let i18nService: MockProxy<I18nService>;
+  let stateProvider: FakeStateProvider;
+
+  let userId: UserId;
+
+  let cryptoKeys: ReplaySubject<Record<OrganizationId, OrgKey> | null>;
+
+  let collectionService: DefaultCollectionService;
+
+  beforeEach(() => {
+    userId = Utils.newGuid() as UserId;
+
+    keyService = mock();
+    encryptService = mock();
+    i18nService = mock();
+    stateProvider = new FakeStateProvider(mockAccountServiceWith(userId));
+
+    cryptoKeys = new ReplaySubject(1);
+    keyService.orgKeys$.mockReturnValue(cryptoKeys);
+
+    // Set up mock decryption
+    encryptService.decryptString
+      .calledWith(expect.any(EncString), expect.any(SymmetricCryptoKey))
+      .mockImplementation((encString, key) =>
+        Promise.resolve(encString.data.replace("ENC_", "DEC_")),
+      );
+
+    (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
+
+    // Arrange i18nService so that sorting algorithm doesn't throw
+    i18nService.collator = null;
+
+    collectionService = new DefaultCollectionService(
+      keyService,
+      encryptService,
+      i18nService,
+      stateProvider,
+    );
+  });
+
   afterEach(() => {
     delete (window as any).bitwardenContainerService;
   });
 
   describe("decryptedCollections$", () => {
     it("emits decrypted collections from state", async () => {
-      // Arrange test collections
+      // Arrange test data
       const org1 = Utils.newGuid() as OrganizationId;
-      const org2 = Utils.newGuid() as OrganizationId;
-
+      const orgKey1 = makeSymmetricCryptoKey<OrgKey>(64, 1);
       const collection1 = collectionDataFactory(org1);
+
+      const org2 = Utils.newGuid() as OrganizationId;
+      const orgKey2 = makeSymmetricCryptoKey<OrgKey>(64, 2);
       const collection2 = collectionDataFactory(org2);
 
-      // Arrange state provider
-      const fakeStateProvider = mockStateProvider();
-      await fakeStateProvider.setUserState(ENCRYPTED_COLLECTION_DATA_KEY, {
-        [collection1.id]: collection1,
-        [collection2.id]: collection2,
+      // Arrange dependencies
+      await setEncryptedState([collection1, collection2]);
+      cryptoKeys.next({
+        [org1]: orgKey1,
+        [org2]: orgKey2,
       });
 
-      // Arrange cryptoService - orgKeys and mock decryption
-      const cryptoService = mockCryptoService();
-      cryptoService.orgKeys$.mockReturnValue(
-        of({
-          [org1]: makeSymmetricCryptoKey<OrgKey>(),
-          [org2]: makeSymmetricCryptoKey<OrgKey>(),
-        }),
-      );
+      const result = await firstValueFrom(collectionService.decryptedCollections$(userId));
 
-      const collectionService = new DefaultCollectionService(
-        cryptoService,
-        mock<EncryptService>(),
-        mockI18nService(),
-        fakeStateProvider,
-      );
-
-      const result = await firstValueFrom(collectionService.decryptedCollections$);
+      // Assert emitted values
       expect(result.length).toBe(2);
-      expect(result[0]).toMatchObject({
-        id: collection1.id,
-        name: "DECRYPTED_STRING",
-      });
-      expect(result[1]).toMatchObject({
-        id: collection2.id,
-        name: "DECRYPTED_STRING",
-      });
+      expect(result).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: "DEC_NAME_" + collection1.id,
+        },
+        {
+          id: collection2.id,
+          name: "DEC_NAME_" + collection2.id,
+        },
+      ]);
+
+      // Assert that the correct org keys were used for each encrypted string
+      // This should be replaced with decryptString when the platform PR (https://github.com/bitwarden/clients/pull/14544) is merged
+      expect(encryptService.decryptString).toHaveBeenCalledWith(
+        expect.objectContaining(new EncString(collection1.name)),
+        orgKey1,
+      );
+      expect(encryptService.decryptString).toHaveBeenCalledWith(
+        expect.objectContaining(new EncString(collection2.name)),
+        orgKey2,
+      );
+    });
+
+    it("emits decrypted collections from in-memory state when available", async () => {
+      // Arrange test data
+      const org1 = Utils.newGuid() as OrganizationId;
+      const collection1 = collectionViewDataFactory(org1);
+
+      const org2 = Utils.newGuid() as OrganizationId;
+      const collection2 = collectionViewDataFactory(org2);
+
+      await setDecryptedState([collection1, collection2]);
+
+      const result = await firstValueFrom(collectionService.decryptedCollections$(userId));
+
+      // Assert emitted values
+      expect(result.length).toBe(2);
+      expect(result).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: "DEC_NAME_" + collection1.id,
+        },
+        {
+          id: collection2.id,
+          name: "DEC_NAME_" + collection2.id,
+        },
+      ]);
+
+      // Ensure that the returned data came from the in-memory state, rather than from decryption.
+      expect(encryptService.decryptString).not.toHaveBeenCalled();
     });
 
     it("handles null collection state", async () => {
-      // Arrange test collections
+      // Arrange dependencies
+      await setEncryptedState(null);
+      cryptoKeys.next({});
+
+      const encryptedCollections = await firstValueFrom(
+        collectionService.encryptedCollections$(userId),
+      );
+
+      expect(encryptedCollections).toBe(null);
+    });
+
+    it("handles undefined orgKeys", (done) => {
+      // Arrange test data
       const org1 = Utils.newGuid() as OrganizationId;
+      const collection1 = collectionDataFactory(org1);
+
       const org2 = Utils.newGuid() as OrganizationId;
+      const collection2 = collectionDataFactory(org2);
 
-      // Arrange state provider
-      const fakeStateProvider = mockStateProvider();
-      await fakeStateProvider.setUserState(ENCRYPTED_COLLECTION_DATA_KEY, null);
+      // Emit a non-null value after the first undefined value has propagated
+      // This will cause the collections to emit, calling done()
+      cryptoKeys.pipe(first()).subscribe((val) => {
+        cryptoKeys.next({});
+      });
 
-      // Arrange cryptoService - orgKeys and mock decryption
-      const cryptoService = mockCryptoService();
-      cryptoService.orgKeys$.mockReturnValue(
-        of({
-          [org1]: makeSymmetricCryptoKey<OrgKey>(),
-          [org2]: makeSymmetricCryptoKey<OrgKey>(),
-        }),
-      );
+      collectionService
+        .decryptedCollections$(userId)
+        .pipe(takeWhile((val) => val.length != 2))
+        .subscribe({ complete: () => done() });
 
-      const collectionService = new DefaultCollectionService(
-        cryptoService,
-        mock<EncryptService>(),
-        mockI18nService(),
-        fakeStateProvider,
-      );
+      // Arrange dependencies
+      void setEncryptedState([collection1, collection2]).then(() => {
+        // Act: emit undefined
+        cryptoKeys.next(undefined);
+        keyService.activeUserOrgKeys$ = of(undefined);
+      });
+    });
 
-      const decryptedCollections = await firstValueFrom(collectionService.decryptedCollections$);
-      expect(decryptedCollections.length).toBe(0);
+    it("Decrypts one time for multiple simultaneous callers", async () => {
+      const decryptedMock: CollectionView[] = [{ id: "col1" }] as CollectionView[];
+      const decryptManySpy = jest
+        .spyOn(collectionService, "decryptMany$")
+        .mockReturnValue(of(decryptedMock));
 
-      const encryptedCollections = await firstValueFrom(collectionService.encryptedCollections$);
-      expect(encryptedCollections.length).toBe(0);
+      jest
+        .spyOn(collectionService as any, "encryptedCollections$")
+        .mockReturnValue(of([{ id: "enc1" }]));
+      jest.spyOn(keyService, "orgKeys$").mockReturnValue(of({ key: "fake-key" }));
+
+      // Simulate multiple subscribers
+      const obs1 = collectionService.decryptedCollections$(userId);
+      const obs2 = collectionService.decryptedCollections$(userId);
+      const obs3 = collectionService.decryptedCollections$(userId);
+
+      await firstValueFrom(combineLatest([obs1, obs2, obs3]));
+
+      // Expect decryptMany$ to be called only once
+      expect(decryptManySpy).toHaveBeenCalledTimes(1);
     });
   });
+
+  describe("encryptedCollections$", () => {
+    it("emits encrypted collections from state", async () => {
+      // Arrange test data
+      const collection1 = collectionDataFactory();
+      const collection2 = collectionDataFactory();
+
+      // Arrange dependencies
+      await setEncryptedState([collection1, collection2]);
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+
+      expect(result!.length).toBe(2);
+      expect(result).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: makeEncString("ENC_NAME_" + collection1.id),
+        },
+        {
+          id: collection2.id,
+          name: makeEncString("ENC_NAME_" + collection2.id),
+        },
+      ]);
+    });
+
+    it("handles null collection state", async () => {
+      await setEncryptedState(null);
+
+      const decryptedCollections = await firstValueFrom(
+        collectionService.encryptedCollections$(userId),
+      );
+      expect(decryptedCollections).toBe(null);
+    });
+  });
+
+  describe("upsert", () => {
+    it("upserts to existing collections", async () => {
+      const org1 = Utils.newGuid() as OrganizationId;
+      const orgKey1 = makeSymmetricCryptoKey<OrgKey>(64, 1);
+      const collection1 = collectionDataFactory(org1);
+
+      await setEncryptedState([collection1]);
+      cryptoKeys.next({
+        [collection1.organizationId]: orgKey1,
+      });
+
+      const updatedCollection1 = Object.assign(new CollectionData({} as any), collection1, {
+        name: makeEncString("UPDATED_ENC_NAME_" + collection1.id).encryptedString,
+      });
+
+      await collectionService.upsert(updatedCollection1, userId);
+
+      const encryptedResult = await firstValueFrom(collectionService.encryptedCollections$(userId));
+
+      expect(encryptedResult!.length).toBe(1);
+      expect(encryptedResult).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: makeEncString("UPDATED_ENC_NAME_" + collection1.id),
+        },
+      ]);
+
+      const decryptedResult = await firstValueFrom(collectionService.decryptedCollections$(userId));
+      expect(decryptedResult.length).toBe(1);
+      expect(decryptedResult).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: "UPDATED_DEC_NAME_" + collection1.id,
+        },
+      ]);
+    });
+
+    it("upserts to a null state", async () => {
+      const org1 = Utils.newGuid() as OrganizationId;
+      const orgKey1 = makeSymmetricCryptoKey<OrgKey>(64, 1);
+      const collection1 = collectionDataFactory(org1);
+
+      cryptoKeys.next({
+        [collection1.organizationId]: orgKey1,
+      });
+
+      await setEncryptedState(null);
+
+      await collectionService.upsert(collection1, userId);
+
+      const encryptedResult = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(encryptedResult!.length).toBe(1);
+      expect(encryptedResult).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: makeEncString("ENC_NAME_" + collection1.id),
+        },
+      ]);
+
+      const decryptedResult = await firstValueFrom(collectionService.decryptedCollections$(userId));
+      expect(decryptedResult.length).toBe(1);
+      expect(decryptedResult).toContainPartialObjects([
+        {
+          id: collection1.id,
+          name: "DEC_NAME_" + collection1.id,
+        },
+      ]);
+    });
+  });
+
+  describe("replace", () => {
+    it("replaces all collections", async () => {
+      await setEncryptedState([collectionDataFactory(), collectionDataFactory()]);
+
+      const newCollection3 = collectionDataFactory();
+      await collectionService.replace(
+        {
+          [newCollection3.id]: newCollection3,
+        },
+        userId,
+      );
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(result!.length).toBe(1);
+      expect(result).toContainPartialObjects([
+        {
+          id: newCollection3.id,
+          name: makeEncString("ENC_NAME_" + newCollection3.id),
+        },
+      ]);
+    });
+  });
+
+  describe("delete", () => {
+    it("deletes a collection", async () => {
+      const collection1 = collectionDataFactory();
+      const collection2 = collectionDataFactory();
+      await setEncryptedState([collection1, collection2]);
+
+      await collectionService.delete([collection1.id], userId);
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(result!.length).toEqual(1);
+      expect(result![0]).toMatchObject({ id: collection2.id });
+    });
+
+    it("deletes several collections", async () => {
+      const collection1 = collectionDataFactory();
+      const collection2 = collectionDataFactory();
+      const collection3 = collectionDataFactory();
+      await setEncryptedState([collection1, collection2, collection3]);
+
+      await collectionService.delete([collection1.id, collection3.id], userId);
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(result!.length).toEqual(1);
+      expect(result![0]).toMatchObject({ id: collection2.id });
+    });
+
+    it("handles null collections", async () => {
+      const collection1 = collectionDataFactory();
+      await setEncryptedState(null);
+
+      await collectionService.delete([collection1.id], userId);
+
+      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
+      expect(result!.length).toEqual(0);
+    });
+  });
+
+  const setEncryptedState = (collectionData: CollectionData[] | null) =>
+    stateProvider.setUserState(
+      ENCRYPTED_COLLECTION_DATA_KEY,
+      collectionData == null ? null : Object.fromEntries(collectionData.map((c) => [c.id, c])),
+      userId,
+    );
+
+  const setDecryptedState = (collectionViews: CollectionView[] | null) =>
+    stateProvider.setUserState(DECRYPTED_COLLECTION_DATA_KEY, collectionViews, userId);
 });
 
-const mockI18nService = () => {
-  const i18nService = mock<I18nService>();
-  i18nService.collator = null; // this is a mock only, avoid use of this object
-  return i18nService;
-};
-
-const mockStateProvider = () => {
-  const userId = Utils.newGuid() as UserId;
-  return new FakeStateProvider(mockAccountServiceWith(userId));
-};
-
-const mockCryptoService = () => {
-  const keyService = mock<KeyService>();
-  const encryptService = mock<EncryptService>();
-  encryptService.decryptString
-    .calledWith(expect.any(EncString), expect.anything())
-    .mockResolvedValue("DECRYPTED_STRING");
-
-  (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
-
-  return keyService;
-};
-
-const collectionDataFactory = (orgId: OrganizationId) => {
+const collectionDataFactory = (orgId?: OrganizationId) => {
   const collection = new CollectionData({} as any);
   collection.id = Utils.newGuid() as CollectionId;
-  collection.organizationId = orgId;
-  collection.name = makeEncString("ENC_STRING").encryptedString;
+  collection.organizationId = orgId ?? (Utils.newGuid() as OrganizationId);
+  collection.name = makeEncString("ENC_NAME_" + collection.id).encryptedString ?? "";
 
   return collection;
 };
+
+function collectionViewDataFactory(orgId?: OrganizationId): CollectionView {
+  const collectionView = new CollectionView();
+  collectionView.id = Utils.newGuid() as CollectionId;
+  collectionView.organizationId = orgId ?? (Utils.newGuid() as OrganizationId);
+  collectionView.name = "DEC_NAME_" + collectionView.id;
+  return collectionView;
+}

libs/admin-console/src/common/collections/services/default-collection.service.ts

@@ -1,113 +1,193 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { combineLatest, firstValueFrom, map, Observable, of, shareReplay, switchMap } from "rxjs";
-import { Jsonify } from "type-fest";
+import {
+  combineLatest,
+  delayWhen,
+  filter,
+  firstValueFrom,
+  from,
+  map,
+  NEVER,
+  Observable,
+  of,
+  shareReplay,
+  switchMap,
+} from "rxjs";
 
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
-import {
-  ActiveUserState,
-  COLLECTION_DATA,
-  DeriveDefinition,
-  DerivedState,
-  StateProvider,
-  UserKeyDefinition,
-} from "@bitwarden/common/platform/state";
+import { SingleUserState, StateProvider } from "@bitwarden/common/platform/state";
 import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
 import { OrgKey } from "@bitwarden/common/types/key";
 import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
 import { ServiceUtils } from "@bitwarden/common/vault/service-utils";
 import { KeyService } from "@bitwarden/key-management";
 
-import { CollectionService } from "../abstractions";
+import { CollectionService } from "../abstractions/collection.service";
 import { Collection, CollectionData, CollectionView } from "../models";
 
-export const ENCRYPTED_COLLECTION_DATA_KEY = UserKeyDefinition.record<CollectionData, CollectionId>(
-  COLLECTION_DATA,
-  "collections",
-  {
-    deserializer: (jsonData: Jsonify<CollectionData>) => CollectionData.fromJSON(jsonData),
-    clearOn: ["logout"],
-  },
-);
-
-const DECRYPTED_COLLECTION_DATA_KEY = new DeriveDefinition<
-  [Record<CollectionId, CollectionData>, Record<OrganizationId, OrgKey>],
-  CollectionView[],
-  { collectionService: DefaultCollectionService }
->(COLLECTION_DATA, "decryptedCollections", {
-  deserializer: (obj) => obj.map((collection) => CollectionView.fromJSON(collection)),
-  derive: async ([collections, orgKeys], { collectionService }) => {
-    if (collections == null) {
-      return [];
-    }
-
-    const data = Object.values(collections).map((c) => new Collection(c));
-    return await collectionService.decryptMany(data, orgKeys);
-  },
-});
+import { DECRYPTED_COLLECTION_DATA_KEY, ENCRYPTED_COLLECTION_DATA_KEY } from "./collection.state";
 
 const NestingDelimiter = "/";
 
 export class DefaultCollectionService implements CollectionService {
-  private encryptedCollectionDataState: ActiveUserState<Record<CollectionId, CollectionData>>;
-  encryptedCollections$: Observable<Collection[]>;
-  private decryptedCollectionDataState: DerivedState<CollectionView[]>;
-  decryptedCollections$: Observable<CollectionView[]>;
-
-  decryptedCollectionViews$(ids: CollectionId[]): Observable<CollectionView[]> {
-    return this.decryptedCollections$.pipe(
-      map((collections) => collections.filter((c) => ids.includes(c.id as CollectionId))),
-    );
-  }
-
   constructor(
     private keyService: KeyService,
     private encryptService: EncryptService,
     private i18nService: I18nService,
     protected stateProvider: StateProvider,
-  ) {
-    this.encryptedCollectionDataState = this.stateProvider.getActive(ENCRYPTED_COLLECTION_DATA_KEY);
+  ) {}
 
-    this.encryptedCollections$ = this.encryptedCollectionDataState.state$.pipe(
+  private collectionViewCache = new Map<UserId, Observable<CollectionView[]>>();
+
+  /**
+   * @returns a SingleUserState for encrypted collection data.
+   */
+  private encryptedState(
+    userId: UserId,
+  ): SingleUserState<Record<CollectionId, CollectionData | null>> {
+    return this.stateProvider.getUser(userId, ENCRYPTED_COLLECTION_DATA_KEY);
+  }
+
+  /**
+   * @returns a SingleUserState for decrypted collection data.
+   */
+  private decryptedState(userId: UserId): SingleUserState<CollectionView[] | null> {
+    return this.stateProvider.getUser(userId, DECRYPTED_COLLECTION_DATA_KEY);
+  }
+
+  encryptedCollections$(userId: UserId): Observable<Collection[] | null> {
+    return this.encryptedState(userId).state$.pipe(
       map((collections) => {
         if (collections == null) {
-          return [];
+          return null;
         }
 
         return Object.values(collections).map((c) => new Collection(c));
       }),
     );
+  }
 
-    const encryptedCollectionsWithKeys = this.encryptedCollectionDataState.combinedState$.pipe(
-      switchMap(([userId, collectionData]) =>
-        combineLatest([of(collectionData), this.keyService.orgKeys$(userId)]),
+  decryptedCollections$(userId: UserId): Observable<CollectionView[]> {
+    const cachedResult = this.collectionViewCache.get(userId);
+    if (cachedResult) {
+      return cachedResult;
+    }
+
+    const result$ = this.decryptedState(userId).state$.pipe(
+      switchMap((decryptedState) => {
+        // If decrypted state is already populated, return that
+        if (decryptedState !== null) {
+          return of(decryptedState ?? []);
+        }
+
+        return this.initializeDecryptedState(userId).pipe(switchMap(() => NEVER));
+      }),
+      shareReplay({ bufferSize: 1, refCount: true }),
+    );
+
+    this.collectionViewCache.set(userId, result$);
+    return result$;
+  }
+
+  private initializeDecryptedState(userId: UserId): Observable<CollectionView[]> {
+    return combineLatest([
+      this.encryptedCollections$(userId),
+      this.keyService.orgKeys$(userId).pipe(filter((orgKeys) => !!orgKeys)),
+    ]).pipe(
+      switchMap(([collections, orgKeys]) =>
+        this.decryptMany$(collections, orgKeys).pipe(
+          delayWhen((collections) => this.setDecryptedCollections(collections, userId)),
+        ),
       ),
-      shareReplay({ refCount: false, bufferSize: 1 }),
     );
-
-    this.decryptedCollectionDataState = this.stateProvider.getDerived(
-      encryptedCollectionsWithKeys,
-      DECRYPTED_COLLECTION_DATA_KEY,
-      { collectionService: this },
-    );
-
-    this.decryptedCollections$ = this.decryptedCollectionDataState.state$;
   }
 
-  async clearActiveUserCache(): Promise<void> {
-    await this.decryptedCollectionDataState.forceValue(null);
+  async upsert(toUpdate: CollectionData, userId: UserId): Promise<void> {
+    if (toUpdate == null) {
+      return;
+    }
+    await this.encryptedState(userId).update((collections) => {
+      if (collections == null) {
+        collections = {};
+      }
+      collections[toUpdate.id] = toUpdate;
+
+      return collections;
+    });
+
+    const decryptedCollections = await firstValueFrom(
+      this.keyService.orgKeys$(userId).pipe(
+        switchMap((orgKeys) => {
+          if (!orgKeys) {
+            throw new Error("No key for this collection's organization.");
+          }
+          return this.decryptMany$([new Collection(toUpdate)], orgKeys);
+        }),
+      ),
+    );
+
+    await this.decryptedState(userId).update((collections) => {
+      if (collections == null) {
+        collections = [];
+      }
+
+      if (!decryptedCollections?.length) {
+        return collections;
+      }
+
+      const decryptedCollection = decryptedCollections[0];
+      const existingIndex = collections.findIndex((collection) => collection.id == toUpdate.id);
+      if (existingIndex >= 0) {
+        collections[existingIndex] = decryptedCollection;
+      } else {
+        collections.push(decryptedCollection);
+      }
+
+      return collections;
+    });
   }
 
-  async encrypt(model: CollectionView): Promise<Collection> {
+  async replace(collections: Record<CollectionId, CollectionData>, userId: UserId): Promise<void> {
+    await this.encryptedState(userId).update(() => collections);
+    await this.decryptedState(userId).update(() => null);
+  }
+
+  async delete(ids: CollectionId[], userId: UserId): Promise<any> {
+    await this.encryptedState(userId).update((collections) => {
+      if (collections == null) {
+        collections = {};
+      }
+      ids.forEach((i) => {
+        delete collections[i];
+      });
+      return collections;
+    });
+
+    await this.decryptedState(userId).update((collections) => {
+      if (collections == null) {
+        collections = [];
+      }
+      ids.forEach((i) => {
+        if (collections?.length) {
+          collections = collections.filter((c) => c.id != i) ?? [];
+        }
+      });
+      return collections;
+    });
+  }
+
+  async encrypt(model: CollectionView, userId: UserId): Promise<Collection> {
     if (model.organizationId == null) {
       throw new Error("Collection has no organization id.");
     }
-    const key = await this.keyService.getOrgKey(model.organizationId);
-    if (key == null) {
-      throw new Error("No key for this collection's organization.");
-    }
+
+    const key = await firstValueFrom(
+      this.keyService.orgKeys$(userId).pipe(
+        filter((orgKeys) => !!orgKeys),
+        map((k) => k[model.organizationId as OrganizationId]),
+      ),
+    );
+
     const collection = new Collection();
     collection.id = model.id;
     collection.organizationId = model.organizationId;
@@ -117,58 +197,37 @@ export class DefaultCollectionService implements CollectionService {
     return collection;
   }
 
-  // TODO: this should be private and orgKeys should be required.
+  // TODO: this should be private.
   // See https://bitwarden.atlassian.net/browse/PM-12375
-  async decryptMany(
-    collections: Collection[],
-    orgKeys?: Record<OrganizationId, OrgKey>,
-  ): Promise<CollectionView[]> {
-    if (collections == null || collections.length === 0) {
-      return [];
+  decryptMany$(
+    collections: Collection[] | null,
+    orgKeys: Record<OrganizationId, OrgKey>,
+  ): Observable<CollectionView[]> {
+    if (collections === null || collections.length == 0 || orgKeys === null) {
+      return of([]);
     }
-    const decCollections: CollectionView[] = [];
 
-    orgKeys ??= await firstValueFrom(this.keyService.activeUserOrgKeys$);
+    const decCollections: Observable<CollectionView>[] = [];
 
-    const promises: Promise<any>[] = [];
     collections.forEach((collection) => {
-      promises.push(
-        collection
-          .decrypt(orgKeys[collection.organizationId as OrganizationId])
-          .then((c) => decCollections.push(c)),
+      decCollections.push(
+        from(collection.decrypt(orgKeys[collection.organizationId as OrganizationId])),
       );
     });
-    await Promise.all(promises);
-    return decCollections.sort(Utils.getSortFunction(this.i18nService, "name"));
-  }
 
-  async get(id: string): Promise<Collection> {
-    return (
-      (await firstValueFrom(
-        this.encryptedCollections$.pipe(map((cs) => cs.find((c) => c.id === id))),
-      )) ?? null
+    return combineLatest(decCollections).pipe(
+      map((collections) => collections.sort(Utils.getSortFunction(this.i18nService, "name"))),
     );
   }
 
-  async getAll(): Promise<Collection[]> {
-    return await firstValueFrom(this.encryptedCollections$);
-  }
-
-  async getAllDecrypted(): Promise<CollectionView[]> {
-    return await firstValueFrom(this.decryptedCollections$);
-  }
-
-  async getAllNested(collections: CollectionView[] = null): Promise<TreeNode<CollectionView>[]> {
-    if (collections == null) {
-      collections = await this.getAllDecrypted();
-    }
+  getAllNested(collections: CollectionView[]): TreeNode<CollectionView>[] {
     const nodes: TreeNode<CollectionView>[] = [];
     collections.forEach((c) => {
       const collectionCopy = new CollectionView();
       collectionCopy.id = c.id;
       collectionCopy.organizationId = c.organizationId;
       const parts = c.name != null ? c.name.replace(/^\/+|\/+$/g, "").split(NestingDelimiter) : [];
-      ServiceUtils.nestedTraverse(nodes, 0, parts, collectionCopy, null, NestingDelimiter);
+      ServiceUtils.nestedTraverse(nodes, 0, parts, collectionCopy, undefined, NestingDelimiter);
     });
     return nodes;
   }
@@ -177,58 +236,23 @@ export class DefaultCollectionService implements CollectionService {
    * @deprecated August 30 2022: Moved to new Vault Filter Service
    * Remove when Desktop and Browser are updated
    */
-  async getNested(id: string): Promise<TreeNode<CollectionView>> {
-    const collections = await this.getAllNested();
-    return ServiceUtils.getTreeNodeObjectFromList(collections, id) as TreeNode<CollectionView>;
+  getNested(collections: CollectionView[], id: string): TreeNode<CollectionView> {
+    const nestedCollections = this.getAllNested(collections);
+    return ServiceUtils.getTreeNodeObjectFromList(
+      nestedCollections,
+      id,
+    ) as TreeNode<CollectionView>;
   }
 
-  async upsert(toUpdate: CollectionData | CollectionData[]): Promise<void> {
-    if (toUpdate == null) {
-      return;
-    }
-    await this.encryptedCollectionDataState.update((collections) => {
-      if (collections == null) {
-        collections = {};
-      }
-      if (Array.isArray(toUpdate)) {
-        toUpdate.forEach((c) => {
-          collections[c.id] = c;
-        });
-      } else {
-        collections[toUpdate.id] = toUpdate;
-      }
-      return collections;
-    });
-  }
-
-  async replace(collections: Record<CollectionId, CollectionData>, userId: UserId): Promise<void> {
-    await this.stateProvider
-      .getUser(userId, ENCRYPTED_COLLECTION_DATA_KEY)
-      .update(() => collections);
-  }
-
-  async clear(userId?: UserId): Promise<void> {
-    if (userId == null) {
-      await this.encryptedCollectionDataState.update(() => null);
-      await this.decryptedCollectionDataState.forceValue(null);
-    } else {
-      await this.stateProvider.getUser(userId, ENCRYPTED_COLLECTION_DATA_KEY).update(() => null);
-    }
-  }
-
-  async delete(id: CollectionId | CollectionId[]): Promise<any> {
-    await this.encryptedCollectionDataState.update((collections) => {
-      if (collections == null) {
-        collections = {};
-      }
-      if (typeof id === "string") {
-        delete collections[id];
-      } else {
-        (id as CollectionId[]).forEach((i) => {
-          delete collections[i];
-        });
-      }
-      return collections;
-    });
+  /**
+   * Sets the decrypted collections state for a user.
+   * @param collections the decrypted collections
+   * @param userId the user id
+   */
+  private async setDecryptedCollections(
+    collections: CollectionView[],
+    userId: UserId,
+  ): Promise<void> {
+    await this.stateProvider.setUserState(DECRYPTED_COLLECTION_DATA_KEY, collections, userId);
   }
 }

libs/admin-console/src/common/collections/services/default-vnext-collection.service.spec.ts

@@ -1,345 +0,0 @@
-import { mock, MockProxy } from "jest-mock-extended";
-import { first, firstValueFrom, of, ReplaySubject, takeWhile } from "rxjs";
-
-import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
-import { ContainerService } from "@bitwarden/common/platform/services/container.service";
-import {
-  FakeStateProvider,
-  makeEncString,
-  makeSymmetricCryptoKey,
-  mockAccountServiceWith,
-} from "@bitwarden/common/spec";
-import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
-import { OrgKey } from "@bitwarden/common/types/key";
-import { KeyService } from "@bitwarden/key-management";
-
-import { CollectionData } from "../models";
-
-import { DefaultvNextCollectionService } from "./default-vnext-collection.service";
-import { ENCRYPTED_COLLECTION_DATA_KEY } from "./vnext-collection.state";
-
-describe("DefaultvNextCollectionService", () => {
-  let keyService: MockProxy<KeyService>;
-  let encryptService: MockProxy<EncryptService>;
-  let i18nService: MockProxy<I18nService>;
-  let stateProvider: FakeStateProvider;
-
-  let userId: UserId;
-
-  let cryptoKeys: ReplaySubject<Record<OrganizationId, OrgKey> | null>;
-
-  let collectionService: DefaultvNextCollectionService;
-
-  beforeEach(() => {
-    userId = Utils.newGuid() as UserId;
-
-    keyService = mock();
-    encryptService = mock();
-    i18nService = mock();
-    stateProvider = new FakeStateProvider(mockAccountServiceWith(userId));
-
-    cryptoKeys = new ReplaySubject(1);
-    keyService.orgKeys$.mockReturnValue(cryptoKeys);
-
-    // Set up mock decryption
-    encryptService.decryptString
-      .calledWith(expect.any(EncString), expect.any(SymmetricCryptoKey))
-      .mockImplementation((encString, key) =>
-        Promise.resolve(encString.data.replace("ENC_", "DEC_")),
-      );
-
-    (window as any).bitwardenContainerService = new ContainerService(keyService, encryptService);
-
-    // Arrange i18nService so that sorting algorithm doesn't throw
-    i18nService.collator = null;
-
-    collectionService = new DefaultvNextCollectionService(
-      keyService,
-      encryptService,
-      i18nService,
-      stateProvider,
-    );
-  });
-
-  afterEach(() => {
-    delete (window as any).bitwardenContainerService;
-  });
-
-  describe("decryptedCollections$", () => {
-    it("emits decrypted collections from state", async () => {
-      // Arrange test data
-      const org1 = Utils.newGuid() as OrganizationId;
-      const orgKey1 = makeSymmetricCryptoKey<OrgKey>(64, 1);
-      const collection1 = collectionDataFactory(org1);
-
-      const org2 = Utils.newGuid() as OrganizationId;
-      const orgKey2 = makeSymmetricCryptoKey<OrgKey>(64, 2);
-      const collection2 = collectionDataFactory(org2);
-
-      // Arrange dependencies
-      await setEncryptedState([collection1, collection2]);
-      cryptoKeys.next({
-        [org1]: orgKey1,
-        [org2]: orgKey2,
-      });
-
-      const result = await firstValueFrom(collectionService.decryptedCollections$(userId));
-
-      // Assert emitted values
-      expect(result.length).toBe(2);
-      expect(result).toContainPartialObjects([
-        {
-          id: collection1.id,
-          name: "DEC_NAME_" + collection1.id,
-        },
-        {
-          id: collection2.id,
-          name: "DEC_NAME_" + collection2.id,
-        },
-      ]);
-
-      // Assert that the correct org keys were used for each encrypted string
-      // This should be replaced with decryptString when the platform PR (https://github.com/bitwarden/clients/pull/14544) is merged
-      expect(encryptService.decryptString).toHaveBeenCalledWith(
-        expect.objectContaining(new EncString(collection1.name)),
-        orgKey1,
-      );
-      expect(encryptService.decryptString).toHaveBeenCalledWith(
-        expect.objectContaining(new EncString(collection2.name)),
-        orgKey2,
-      );
-    });
-
-    it("handles null collection state", async () => {
-      // Arrange dependencies
-      await setEncryptedState(null);
-      cryptoKeys.next({});
-
-      const encryptedCollections = await firstValueFrom(
-        collectionService.encryptedCollections$(userId),
-      );
-
-      expect(encryptedCollections.length).toBe(0);
-    });
-
-    it("handles undefined orgKeys", (done) => {
-      // Arrange test data
-      const org1 = Utils.newGuid() as OrganizationId;
-      const collection1 = collectionDataFactory(org1);
-
-      const org2 = Utils.newGuid() as OrganizationId;
-      const collection2 = collectionDataFactory(org2);
-
-      // Emit a non-null value after the first undefined value has propagated
-      // This will cause the collections to emit, calling done()
-      cryptoKeys.pipe(first()).subscribe((val) => {
-        cryptoKeys.next({});
-      });
-
-      collectionService
-        .decryptedCollections$(userId)
-        .pipe(takeWhile((val) => val.length != 2))
-        .subscribe({ complete: () => done() });
-
-      // Arrange dependencies
-      void setEncryptedState([collection1, collection2]).then(() => {
-        // Act: emit undefined
-        cryptoKeys.next(undefined);
-        keyService.activeUserOrgKeys$ = of(undefined);
-      });
-    });
-  });
-
-  describe("encryptedCollections$", () => {
-    it("emits encrypted collections from state", async () => {
-      // Arrange test data
-      const collection1 = collectionDataFactory();
-      const collection2 = collectionDataFactory();
-
-      // Arrange dependencies
-      await setEncryptedState([collection1, collection2]);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-
-      expect(result.length).toBe(2);
-      expect(result).toContainPartialObjects([
-        {
-          id: collection1.id,
-          name: makeEncString("ENC_NAME_" + collection1.id),
-        },
-        {
-          id: collection2.id,
-          name: makeEncString("ENC_NAME_" + collection2.id),
-        },
-      ]);
-    });
-
-    it("handles null collection state", async () => {
-      await setEncryptedState(null);
-
-      const decryptedCollections = await firstValueFrom(
-        collectionService.encryptedCollections$(userId),
-      );
-      expect(decryptedCollections.length).toBe(0);
-    });
-  });
-
-  describe("upsert", () => {
-    it("upserts to existing collections", async () => {
-      const collection1 = collectionDataFactory();
-      const collection2 = collectionDataFactory();
-
-      await setEncryptedState([collection1, collection2]);
-
-      const updatedCollection1 = Object.assign(new CollectionData({} as any), collection1, {
-        name: makeEncString("UPDATED_ENC_NAME_" + collection1.id).encryptedString,
-      });
-      const newCollection3 = collectionDataFactory();
-
-      await collectionService.upsert([updatedCollection1, newCollection3], userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toBe(3);
-      expect(result).toContainPartialObjects([
-        {
-          id: collection1.id,
-          name: makeEncString("UPDATED_ENC_NAME_" + collection1.id),
-        },
-        {
-          id: collection2.id,
-          name: makeEncString("ENC_NAME_" + collection2.id),
-        },
-        {
-          id: newCollection3.id,
-          name: makeEncString("ENC_NAME_" + newCollection3.id),
-        },
-      ]);
-    });
-
-    it("upserts to a null state", async () => {
-      const collection1 = collectionDataFactory();
-
-      await setEncryptedState(null);
-
-      await collectionService.upsert(collection1, userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toBe(1);
-      expect(result).toContainPartialObjects([
-        {
-          id: collection1.id,
-          name: makeEncString("ENC_NAME_" + collection1.id),
-        },
-      ]);
-    });
-  });
-
-  describe("replace", () => {
-    it("replaces all collections", async () => {
-      await setEncryptedState([collectionDataFactory(), collectionDataFactory()]);
-
-      const newCollection3 = collectionDataFactory();
-      await collectionService.replace(
-        {
-          [newCollection3.id]: newCollection3,
-        },
-        userId,
-      );
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toBe(1);
-      expect(result).toContainPartialObjects([
-        {
-          id: newCollection3.id,
-          name: makeEncString("ENC_NAME_" + newCollection3.id),
-        },
-      ]);
-    });
-  });
-
-  it("clearDecryptedState", async () => {
-    await setEncryptedState([collectionDataFactory(), collectionDataFactory()]);
-
-    await collectionService.clearDecryptedState(userId);
-
-    // Encrypted state remains
-    const encryptedState = await firstValueFrom(collectionService.encryptedCollections$(userId));
-    expect(encryptedState.length).toEqual(2);
-
-    // Decrypted state is cleared
-    const decryptedState = await firstValueFrom(collectionService.decryptedCollections$(userId));
-    expect(decryptedState.length).toEqual(0);
-  });
-
-  it("clear", async () => {
-    await setEncryptedState([collectionDataFactory(), collectionDataFactory()]);
-    cryptoKeys.next({});
-
-    await collectionService.clear(userId);
-
-    // Encrypted state is cleared
-    const encryptedState = await firstValueFrom(collectionService.encryptedCollections$(userId));
-    expect(encryptedState.length).toEqual(0);
-
-    // Decrypted state is cleared
-    const decryptedState = await firstValueFrom(collectionService.decryptedCollections$(userId));
-    expect(decryptedState.length).toEqual(0);
-  });
-
-  describe("delete", () => {
-    it("deletes a collection", async () => {
-      const collection1 = collectionDataFactory();
-      const collection2 = collectionDataFactory();
-      await setEncryptedState([collection1, collection2]);
-
-      await collectionService.delete(collection1.id, userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toEqual(1);
-      expect(result[0]).toMatchObject({ id: collection2.id });
-    });
-
-    it("deletes several collections", async () => {
-      const collection1 = collectionDataFactory();
-      const collection2 = collectionDataFactory();
-      const collection3 = collectionDataFactory();
-      await setEncryptedState([collection1, collection2, collection3]);
-
-      await collectionService.delete([collection1.id, collection3.id], userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toEqual(1);
-      expect(result[0]).toMatchObject({ id: collection2.id });
-    });
-
-    it("handles null collections", async () => {
-      const collection1 = collectionDataFactory();
-      await setEncryptedState(null);
-
-      await collectionService.delete(collection1.id, userId);
-
-      const result = await firstValueFrom(collectionService.encryptedCollections$(userId));
-      expect(result.length).toEqual(0);
-    });
-  });
-
-  const setEncryptedState = (collectionData: CollectionData[] | null) =>
-    stateProvider.setUserState(
-      ENCRYPTED_COLLECTION_DATA_KEY,
-      collectionData == null ? null : Object.fromEntries(collectionData.map((c) => [c.id, c])),
-      userId,
-    );
-});
-
-const collectionDataFactory = (orgId?: OrganizationId) => {
-  const collection = new CollectionData({} as any);
-  collection.id = Utils.newGuid() as CollectionId;
-  collection.organizationId = orgId ?? (Utils.newGuid() as OrganizationId);
-  collection.name = makeEncString("ENC_NAME_" + collection.id).encryptedString;
-
-  return collection;
-};

libs/admin-console/src/common/collections/services/default-vnext-collection.service.ts

@@ -1,194 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { combineLatest, filter, firstValueFrom, map } from "rxjs";
-
-import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { StateProvider, DerivedState } from "@bitwarden/common/platform/state";
-import { CollectionId, OrganizationId, UserId } from "@bitwarden/common/types/guid";
-import { OrgKey } from "@bitwarden/common/types/key";
-import { TreeNode } from "@bitwarden/common/vault/models/domain/tree-node";
-import { ServiceUtils } from "@bitwarden/common/vault/service-utils";
-import { KeyService } from "@bitwarden/key-management";
-
-import { vNextCollectionService } from "../abstractions/vnext-collection.service";
-import { Collection, CollectionData, CollectionView } from "../models";
-
-import {
-  DECRYPTED_COLLECTION_DATA_KEY,
-  ENCRYPTED_COLLECTION_DATA_KEY,
-} from "./vnext-collection.state";
-
-const NestingDelimiter = "/";
-
-export class DefaultvNextCollectionService implements vNextCollectionService {
-  constructor(
-    private keyService: KeyService,
-    private encryptService: EncryptService,
-    private i18nService: I18nService,
-    protected stateProvider: StateProvider,
-  ) {}
-
-  encryptedCollections$(userId: UserId) {
-    return this.encryptedState(userId).state$.pipe(
-      map((collections) => {
-        if (collections == null) {
-          return [];
-        }
-
-        return Object.values(collections).map((c) => new Collection(c));
-      }),
-    );
-  }
-
-  decryptedCollections$(userId: UserId) {
-    return this.decryptedState(userId).state$.pipe(map((collections) => collections ?? []));
-  }
-
-  async upsert(toUpdate: CollectionData | CollectionData[], userId: UserId): Promise<void> {
-    if (toUpdate == null) {
-      return;
-    }
-    await this.encryptedState(userId).update((collections) => {
-      if (collections == null) {
-        collections = {};
-      }
-      if (Array.isArray(toUpdate)) {
-        toUpdate.forEach((c) => {
-          collections[c.id] = c;
-        });
-      } else {
-        collections[toUpdate.id] = toUpdate;
-      }
-      return collections;
-    });
-  }
-
-  async replace(collections: Record<CollectionId, CollectionData>, userId: UserId): Promise<void> {
-    await this.encryptedState(userId).update(() => collections);
-  }
-
-  async clearDecryptedState(userId: UserId): Promise<void> {
-    if (userId == null) {
-      throw new Error("User ID is required.");
-    }
-
-    await this.decryptedState(userId).forceValue([]);
-  }
-
-  async clear(userId: UserId): Promise<void> {
-    await this.encryptedState(userId).update(() => null);
-    // This will propagate from the encrypted state update, but by doing it explicitly
-    // the promise doesn't resolve until the update is complete.
-    await this.decryptedState(userId).forceValue([]);
-  }
-
-  async delete(id: CollectionId | CollectionId[], userId: UserId): Promise<any> {
-    await this.encryptedState(userId).update((collections) => {
-      if (collections == null) {
-        collections = {};
-      }
-      if (typeof id === "string") {
-        delete collections[id];
-      } else {
-        (id as CollectionId[]).forEach((i) => {
-          delete collections[i];
-        });
-      }
-      return collections;
-    });
-  }
-
-  async encrypt(model: CollectionView): Promise<Collection> {
-    if (model.organizationId == null) {
-      throw new Error("Collection has no organization id.");
-    }
-    const key = await this.keyService.getOrgKey(model.organizationId);
-    if (key == null) {
-      throw new Error("No key for this collection's organization.");
-    }
-    const collection = new Collection();
-    collection.id = model.id;
-    collection.organizationId = model.organizationId;
-    collection.readOnly = model.readOnly;
-    collection.externalId = model.externalId;
-    collection.name = await this.encryptService.encryptString(model.name, key);
-    return collection;
-  }
-
-  // TODO: this should be private and orgKeys should be required.
-  // See https://bitwarden.atlassian.net/browse/PM-12375
-  async decryptMany(
-    collections: Collection[],
-    orgKeys?: Record<OrganizationId, OrgKey> | null,
-  ): Promise<CollectionView[]> {
-    if (collections == null || collections.length === 0) {
-      return [];
-    }
-    const decCollections: CollectionView[] = [];
-
-    orgKeys ??= await firstValueFrom(this.keyService.activeUserOrgKeys$);
-
-    const promises: Promise<any>[] = [];
-    collections.forEach((collection) => {
-      promises.push(
-        collection
-          .decrypt(orgKeys[collection.organizationId as OrganizationId])
-          .then((c) => decCollections.push(c)),
-      );
-    });
-    await Promise.all(promises);
-    return decCollections.sort(Utils.getSortFunction(this.i18nService, "name"));
-  }
-
-  getAllNested(collections: CollectionView[]): TreeNode<CollectionView>[] {
-    const nodes: TreeNode<CollectionView>[] = [];
-    collections.forEach((c) => {
-      const collectionCopy = new CollectionView();
-      collectionCopy.id = c.id;
-      collectionCopy.organizationId = c.organizationId;
-      const parts = c.name != null ? c.name.replace(/^\/+|\/+$/g, "").split(NestingDelimiter) : [];
-      ServiceUtils.nestedTraverse(nodes, 0, parts, collectionCopy, undefined, NestingDelimiter);
-    });
-    return nodes;
-  }
-
-  /**
-   * @deprecated August 30 2022: Moved to new Vault Filter Service
-   * Remove when Desktop and Browser are updated
-   */
-  getNested(collections: CollectionView[], id: string): TreeNode<CollectionView> {
-    const nestedCollections = this.getAllNested(collections);
-    return ServiceUtils.getTreeNodeObjectFromList(
-      nestedCollections,
-      id,
-    ) as TreeNode<CollectionView>;
-  }
-
-  /**
-   * @returns a SingleUserState for encrypted collection data.
-   */
-  private encryptedState(userId: UserId) {
-    return this.stateProvider.getUser(userId, ENCRYPTED_COLLECTION_DATA_KEY);
-  }
-
-  /**
-   * @returns a SingleUserState for decrypted collection data.
-   */
-  private decryptedState(userId: UserId): DerivedState<CollectionView[]> {
-    const encryptedCollectionsWithKeys$ = combineLatest([
-      this.encryptedCollections$(userId),
-      // orgKeys$ can emit null during brief moments on unlock and lock/logout, we want to ignore those intermediate states
-      this.keyService.orgKeys$(userId).pipe(filter((orgKeys) => orgKeys != null)),
-    ]);
-
-    return this.stateProvider.getDerived(
-      encryptedCollectionsWithKeys$,
-      DECRYPTED_COLLECTION_DATA_KEY,
-      {
-        collectionService: this,
-      },
-    );
-  }
-}

libs/admin-console/src/common/collections/services/vnext-collection.state.ts

@@ -1,36 +0,0 @@
-import { Jsonify } from "type-fest";
-
-import {
-  COLLECTION_DATA,
-  DeriveDefinition,
-  UserKeyDefinition,
-} from "@bitwarden/common/platform/state";
-import { CollectionId, OrganizationId } from "@bitwarden/common/types/guid";
-import { OrgKey } from "@bitwarden/common/types/key";
-
-import { vNextCollectionService } from "../abstractions/vnext-collection.service";
-import { Collection, CollectionData, CollectionView } from "../models";
-
-export const ENCRYPTED_COLLECTION_DATA_KEY = UserKeyDefinition.record<CollectionData, CollectionId>(
-  COLLECTION_DATA,
-  "collections",
-  {
-    deserializer: (jsonData: Jsonify<CollectionData>) => CollectionData.fromJSON(jsonData),
-    clearOn: ["logout"],
-  },
-);
-
-export const DECRYPTED_COLLECTION_DATA_KEY = new DeriveDefinition<
-  [Collection[], Record<OrganizationId, OrgKey> | null],
-  CollectionView[],
-  { collectionService: vNextCollectionService }
->(COLLECTION_DATA, "decryptedCollections", {
-  deserializer: (obj) => obj.map((collection) => CollectionView.fromJSON(collection)),
-  derive: async ([collections, orgKeys], { collectionService }) => {
-    if (collections == null) {
-      return [];
-    }
-
-    return await collectionService.decryptMany(collections, orgKeys);
-  },
-});

libs/angular/src/auth/components/change-password.component.ts

@@ -1,232 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { Directive, OnDestroy, OnInit } from "@angular/core";
-import { Subject, firstValueFrom, map, switchMap, takeUntil } from "rxjs";
-
-import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
-import { MasterPasswordPolicyOptions } from "@bitwarden/common/admin-console/models/domain/master-password-policy-options";
-import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { getUserId } from "@bitwarden/common/auth/services/account.service";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
-import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { UserKey, MasterKey } from "@bitwarden/common/types/key";
-import { DialogService, ToastService } from "@bitwarden/components";
-import { KdfConfig, KdfConfigService, KeyService } from "@bitwarden/key-management";
-
-import { PasswordColorText } from "../../tools/password-strength/password-strength.component";
-
-@Directive()
-export class ChangePasswordComponent implements OnInit, OnDestroy {
-  masterPassword: string;
-  masterPasswordRetype: string;
-  formPromise: Promise<any>;
-  enforcedPolicyOptions: MasterPasswordPolicyOptions;
-  passwordStrengthResult: any;
-  color: string;
-  text: string;
-  leakedPassword: boolean;
-  minimumLength = Utils.minimumPasswordLength;
-
-  protected email: string;
-  protected kdfConfig: KdfConfig;
-
-  protected destroy$ = new Subject<void>();
-
-  constructor(
-    protected accountService: AccountService,
-    protected dialogService: DialogService,
-    protected i18nService: I18nService,
-    protected kdfConfigService: KdfConfigService,
-    protected keyService: KeyService,
-    protected masterPasswordService: InternalMasterPasswordServiceAbstraction,
-    protected messagingService: MessagingService,
-    protected platformUtilsService: PlatformUtilsService,
-    protected policyService: PolicyService,
-    protected toastService: ToastService,
-  ) {}
-
-  async ngOnInit() {
-    this.email = await firstValueFrom(
-      this.accountService.activeAccount$.pipe(map((a) => a?.email)),
-    );
-    this.accountService.activeAccount$
-      .pipe(
-        getUserId,
-        switchMap((userId) => this.policyService.masterPasswordPolicyOptions$(userId)),
-        takeUntil(this.destroy$),
-      )
-      .subscribe(
-        (enforcedPasswordPolicyOptions) =>
-          (this.enforcedPolicyOptions ??= enforcedPasswordPolicyOptions),
-      );
-
-    if (this.enforcedPolicyOptions?.minLength) {
-      this.minimumLength = this.enforcedPolicyOptions.minLength;
-    }
-  }
-
-  ngOnDestroy(): void {
-    this.destroy$.next();
-    this.destroy$.complete();
-  }
-
-  async submit() {
-    if (!(await this.strongPassword())) {
-      return;
-    }
-
-    if (!(await this.setupSubmitActions())) {
-      return;
-    }
-
-    const [userId, email] = await firstValueFrom(
-      this.accountService.activeAccount$.pipe(map((a) => [a?.id, a?.email])),
-    );
-
-    if (this.kdfConfig == null) {
-      this.kdfConfig = await this.kdfConfigService.getKdfConfig(userId);
-    }
-
-    // Create new master key
-    const newMasterKey = await this.keyService.makeMasterKey(
-      this.masterPassword,
-      email.trim().toLowerCase(),
-      this.kdfConfig,
-    );
-    const newMasterKeyHash = await this.keyService.hashMasterKey(this.masterPassword, newMasterKey);
-
-    let newProtectedUserKey: [UserKey, EncString] = null;
-    const userKey = await this.keyService.getUserKey();
-    if (userKey == null) {
-      newProtectedUserKey = await this.keyService.makeUserKey(newMasterKey);
-    } else {
-      newProtectedUserKey = await this.keyService.encryptUserKeyWithMasterKey(newMasterKey);
-    }
-
-    await this.performSubmitActions(newMasterKeyHash, newMasterKey, newProtectedUserKey);
-  }
-
-  async setupSubmitActions(): Promise<boolean> {
-    // Override in sub-class
-    // Can be used for additional validation and/or other processes the should occur before changing passwords
-    return true;
-  }
-
-  async performSubmitActions(
-    newMasterKeyHash: string,
-    newMasterKey: MasterKey,
-    newUserKey: [UserKey, EncString],
-  ) {
-    // Override in sub-class
-  }
-
-  async strongPassword(): Promise<boolean> {
-    if (this.masterPassword == null || this.masterPassword === "") {
-      this.toastService.showToast({
-        variant: "error",
-        title: this.i18nService.t("errorOccurred"),
-        message: this.i18nService.t("masterPasswordRequired"),
-      });
-      return false;
-    }
-    if (this.masterPassword.length < this.minimumLength) {
-      this.toastService.showToast({
-        variant: "error",
-        title: this.i18nService.t("errorOccurred"),
-        message: this.i18nService.t("masterPasswordMinimumlength", this.minimumLength),
-      });
-      return false;
-    }
-    if (this.masterPassword !== this.masterPasswordRetype) {
-      this.toastService.showToast({
-        variant: "error",
-        title: this.i18nService.t("errorOccurred"),
-        message: this.i18nService.t("masterPassDoesntMatch"),
-      });
-      return false;
-    }
-
-    const strengthResult = this.passwordStrengthResult;
-
-    if (
-      this.enforcedPolicyOptions != null &&
-      !this.policyService.evaluateMasterPassword(
-        strengthResult.score,
-        this.masterPassword,
-        this.enforcedPolicyOptions,
-      )
-    ) {
-      this.toastService.showToast({
-        variant: "error",
-        title: this.i18nService.t("errorOccurred"),
-        message: this.i18nService.t("masterPasswordPolicyRequirementsNotMet"),
-      });
-      return false;
-    }
-
-    const weakPassword = strengthResult != null && strengthResult.score < 3;
-
-    if (weakPassword && this.leakedPassword) {
-      const result = await this.dialogService.openSimpleDialog({
-        title: { key: "weakAndExposedMasterPassword" },
-        content: { key: "weakAndBreachedMasterPasswordDesc" },
-        type: "warning",
-      });
-
-      if (!result) {
-        return false;
-      }
-    } else {
-      if (weakPassword) {
-        const result = await this.dialogService.openSimpleDialog({
-          title: { key: "weakMasterPassword" },
-          content: { key: "weakMasterPasswordDesc" },
-          type: "warning",
-        });
-
-        if (!result) {
-          return false;
-        }
-      }
-      if (this.leakedPassword) {
-        const result = await this.dialogService.openSimpleDialog({
-          title: { key: "exposedMasterPassword" },
-          content: { key: "exposedMasterPasswordDesc" },
-          type: "warning",
-        });
-
-        if (!result) {
-          return false;
-        }
-      }
-    }
-
-    return true;
-  }
-
-  async logOut() {
-    const confirmed = await this.dialogService.openSimpleDialog({
-      title: { key: "logOut" },
-      content: { key: "logOutConfirmation" },
-      acceptButtonText: { key: "logOut" },
-      type: "warning",
-    });
-
-    if (confirmed) {
-      this.messagingService.send("logout");
-    }
-  }
-
-  getStrengthResult(result: any) {
-    this.passwordStrengthResult = result;
-  }
-
-  getPasswordScoreText(event: PasswordColorText) {
-    this.color = event.color;
-    this.text = event.text;
-  }
-}

libs/angular/src/auth/components/set-password.component.ts

@@ -1,300 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { Directive, OnInit } from "@angular/core";
-import { ActivatedRoute, Router } from "@angular/router";
-import { firstValueFrom, of } from "rxjs";
-import { filter, first, switchMap, tap } from "rxjs/operators";
-
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import {
-  OrganizationUserApiService,
-  OrganizationUserResetPasswordEnrollmentRequest,
-} from "@bitwarden/admin-console/common";
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import { InternalUserDecryptionOptionsServiceAbstraction } from "@bitwarden/auth/common";
-import { OrganizationApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/organization/organization-api.service.abstraction";
-import { PolicyApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/policy/policy-api.service.abstraction";
-import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
-import { MasterPasswordPolicyOptions } from "@bitwarden/common/admin-console/models/domain/master-password-policy-options";
-import { OrganizationAutoEnrollStatusResponse } from "@bitwarden/common/admin-console/models/response/organization-auto-enroll-status.response";
-import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
-import { SsoLoginServiceAbstraction } from "@bitwarden/common/auth/abstractions/sso-login.service.abstraction";
-import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
-import { SetPasswordRequest } from "@bitwarden/common/auth/models/request/set-password.request";
-import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { KeysRequest } from "@bitwarden/common/models/request/keys.request";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
-import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
-import { HashPurpose } from "@bitwarden/common/platform/enums";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { UserId } from "@bitwarden/common/types/guid";
-import { MasterKey, UserKey } from "@bitwarden/common/types/key";
-import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
-import { DialogService, ToastService } from "@bitwarden/components";
-import { DEFAULT_KDF_CONFIG, KdfConfigService, KeyService } from "@bitwarden/key-management";
-
-import { ChangePasswordComponent as BaseChangePasswordComponent } from "./change-password.component";
-
-@Directive()
-export class SetPasswordComponent extends BaseChangePasswordComponent implements OnInit {
-  syncLoading = true;
-  showPassword = false;
-  hint = "";
-  orgSsoIdentifier: string = null;
-  orgId: string;
-  resetPasswordAutoEnroll = false;
-  onSuccessfulChangePassword: () => Promise<void>;
-  successRoute = "vault";
-  activeUserId: UserId;
-
-  forceSetPasswordReason: ForceSetPasswordReason = ForceSetPasswordReason.None;
-  ForceSetPasswordReason = ForceSetPasswordReason;
-
-  constructor(
-    protected accountService: AccountService,
-    protected dialogService: DialogService,
-    protected encryptService: EncryptService,
-    protected i18nService: I18nService,
-    protected kdfConfigService: KdfConfigService,
-    protected keyService: KeyService,
-    protected masterPasswordApiService: MasterPasswordApiService,
-    protected masterPasswordService: InternalMasterPasswordServiceAbstraction,
-    protected messagingService: MessagingService,
-    protected organizationApiService: OrganizationApiServiceAbstraction,
-    protected organizationUserApiService: OrganizationUserApiService,
-    protected platformUtilsService: PlatformUtilsService,
-    protected policyApiService: PolicyApiServiceAbstraction,
-    protected policyService: PolicyService,
-    protected route: ActivatedRoute,
-    protected router: Router,
-    protected ssoLoginService: SsoLoginServiceAbstraction,
-    protected syncService: SyncService,
-    protected toastService: ToastService,
-    protected userDecryptionOptionsService: InternalUserDecryptionOptionsServiceAbstraction,
-  ) {
-    super(
-      accountService,
-      dialogService,
-      i18nService,
-      kdfConfigService,
-      keyService,
-      masterPasswordService,
-      messagingService,
-      platformUtilsService,
-      policyService,
-      toastService,
-    );
-  }
-
-  async ngOnInit() {
-    // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
-    // eslint-disable-next-line @typescript-eslint/no-floating-promises
-    super.ngOnInit();
-
-    await this.syncService.fullSync(true);
-    this.syncLoading = false;
-
-    this.activeUserId = (await firstValueFrom(this.accountService.activeAccount$))?.id;
-
-    this.forceSetPasswordReason = await firstValueFrom(
-      this.masterPasswordService.forceSetPasswordReason$(this.activeUserId),
-    );
-
-    this.route.queryParams
-      .pipe(
-        first(),
-        switchMap((qParams) => {
-          if (qParams.identifier != null) {
-            return of(qParams.identifier);
-          } else {
-            // Try to get orgSsoId from state as fallback
-            // Note: this is primarily for the TDE user w/out MP obtains admin MP reset permission scenario.
-            return this.ssoLoginService.getActiveUserOrganizationSsoIdentifier(this.activeUserId);
-          }
-        }),
-        filter((orgSsoId) => orgSsoId != null),
-        tap((orgSsoId: string) => {
-          this.orgSsoIdentifier = orgSsoId;
-        }),
-        switchMap((orgSsoId: string) => this.organizationApiService.getAutoEnrollStatus(orgSsoId)),
-        tap((orgAutoEnrollStatusResponse: OrganizationAutoEnrollStatusResponse) => {
-          this.orgId = orgAutoEnrollStatusResponse.id;
-          this.resetPasswordAutoEnroll = orgAutoEnrollStatusResponse.resetPasswordEnabled;
-        }),
-        switchMap((orgAutoEnrollStatusResponse: OrganizationAutoEnrollStatusResponse) =>
-          // Must get org id from response to get master password policy options
-          this.policyApiService.getMasterPasswordPolicyOptsForOrgUser(
-            orgAutoEnrollStatusResponse.id,
-          ),
-        ),
-        tap((masterPasswordPolicyOptions: MasterPasswordPolicyOptions) => {
-          this.enforcedPolicyOptions = masterPasswordPolicyOptions;
-        }),
-      )
-      .subscribe({
-        error: () => {
-          this.toastService.showToast({
-            variant: "error",
-            title: null,
-            message: this.i18nService.t("errorOccurred"),
-          });
-        },
-      });
-  }
-
-  async setupSubmitActions() {
-    this.kdfConfig = DEFAULT_KDF_CONFIG;
-    return true;
-  }
-
-  async performSubmitActions(
-    masterPasswordHash: string,
-    masterKey: MasterKey,
-    userKey: [UserKey, EncString],
-  ) {
-    let keysRequest: KeysRequest | null = null;
-    let newKeyPair: [string, EncString] | null = null;
-
-    if (
-      this.forceSetPasswordReason !=
-      ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission
-    ) {
-      // Existing JIT provisioned user in a MP encryption org setting first password
-      // Users in this state will not already have a user asymmetric key pair so must create it for them
-      // We don't want to re-create the user key pair if the user already has one (TDE user case)
-
-      // in case we have a local private key, and are not sure whether it has been posted to the server, we post the local private key instead of generating a new one
-      const existingUserPrivateKey = (await firstValueFrom(
-        this.keyService.userPrivateKey$(this.activeUserId),
-      )) as Uint8Array;
-      const existingUserPublicKey = await firstValueFrom(
-        this.keyService.userPublicKey$(this.activeUserId),
-      );
-      if (existingUserPrivateKey != null && existingUserPublicKey != null) {
-        const existingUserPublicKeyB64 = Utils.fromBufferToB64(existingUserPublicKey);
-        newKeyPair = [
-          existingUserPublicKeyB64,
-          await this.encryptService.wrapDecapsulationKey(existingUserPrivateKey, userKey[0]),
-        ];
-      } else {
-        newKeyPair = await this.keyService.makeKeyPair(userKey[0]);
-      }
-      keysRequest = new KeysRequest(newKeyPair[0], newKeyPair[1].encryptedString);
-    }
-
-    const request = new SetPasswordRequest(
-      masterPasswordHash,
-      userKey[1].encryptedString,
-      this.hint,
-      this.orgSsoIdentifier,
-      keysRequest,
-      this.kdfConfig.kdfType, //always PBKDF2 --> see this.setupSubmitActions
-      this.kdfConfig.iterations,
-    );
-    try {
-      if (this.resetPasswordAutoEnroll) {
-        this.formPromise = this.masterPasswordApiService
-          .setPassword(request)
-          .then(async () => {
-            await this.onSetPasswordSuccess(masterKey, userKey, newKeyPair);
-            return this.organizationApiService.getKeys(this.orgId);
-          })
-          .then(async (response) => {
-            if (response == null) {
-              throw new Error(this.i18nService.t("resetPasswordOrgKeysError"));
-            }
-            const publicKey = Utils.fromB64ToArray(response.publicKey);
-
-            // RSA Encrypt user key with organization public key
-            const userKey = await this.keyService.getUserKey();
-            const encryptedUserKey = await this.encryptService.encapsulateKeyUnsigned(
-              userKey,
-              publicKey,
-            );
-
-            const resetRequest = new OrganizationUserResetPasswordEnrollmentRequest();
-            resetRequest.masterPasswordHash = masterPasswordHash;
-            resetRequest.resetPasswordKey = encryptedUserKey.encryptedString;
-
-            return this.organizationUserApiService.putOrganizationUserResetPasswordEnrollment(
-              this.orgId,
-              this.activeUserId,
-              resetRequest,
-            );
-          });
-      } else {
-        this.formPromise = this.masterPasswordApiService.setPassword(request).then(async () => {
-          await this.onSetPasswordSuccess(masterKey, userKey, newKeyPair);
-        });
-      }
-
-      await this.formPromise;
-
-      if (this.onSuccessfulChangePassword != null) {
-        // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
-        // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        this.onSuccessfulChangePassword();
-      } else {
-        // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
-        // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        this.router.navigate([this.successRoute]);
-      }
-    } catch {
-      this.toastService.showToast({
-        variant: "error",
-        title: null,
-        message: this.i18nService.t("errorOccurred"),
-      });
-    }
-  }
-
-  togglePassword(confirmField: boolean) {
-    this.showPassword = !this.showPassword;
-    document.getElementById(confirmField ? "masterPasswordRetype" : "masterPassword").focus();
-  }
-
-  protected async onSetPasswordSuccess(
-    masterKey: MasterKey,
-    userKey: [UserKey, EncString],
-    keyPair: [string, EncString] | null,
-  ) {
-    // Clear force set password reason to allow navigation back to vault.
-    await this.masterPasswordService.setForceSetPasswordReason(
-      ForceSetPasswordReason.None,
-      this.activeUserId,
-    );
-
-    // User now has a password so update account decryption options in state
-    const userDecryptionOpts = await firstValueFrom(
-      this.userDecryptionOptionsService.userDecryptionOptions$,
-    );
-    userDecryptionOpts.hasMasterPassword = true;
-    await this.userDecryptionOptionsService.setUserDecryptionOptions(userDecryptionOpts);
-    await this.kdfConfigService.setKdfConfig(this.activeUserId, this.kdfConfig);
-    await this.masterPasswordService.setMasterKey(masterKey, this.activeUserId);
-    await this.keyService.setUserKey(userKey[0], this.activeUserId);
-
-    // Set private key only for new JIT provisioned users in MP encryption orgs
-    // Existing TDE users will have private key set on sync or on login
-    if (
-      keyPair !== null &&
-      this.forceSetPasswordReason !=
-        ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission
-    ) {
-      await this.keyService.setPrivateKey(keyPair[1].encryptedString, this.activeUserId);
-    }
-
-    const localMasterKeyHash = await this.keyService.hashMasterKey(
-      this.masterPassword,
-      masterKey,
-      HashPurpose.LocalAuthorization,
-    );
-    await this.masterPasswordService.setMasterKeyHash(localMasterKeyHash, this.activeUserId);
-  }
-}

libs/angular/src/auth/components/update-password.component.ts

@@ -1,141 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { Directive } from "@angular/core";
-import { Router } from "@angular/router";
-import { firstValueFrom } from "rxjs";
-
-import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
-import { MasterPasswordPolicyOptions } from "@bitwarden/common/admin-console/models/domain/master-password-policy-options";
-import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
-import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
-import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
-import { PasswordRequest } from "@bitwarden/common/auth/models/request/password.request";
-import { getUserId } from "@bitwarden/common/auth/services/account.service";
-import { Verification } from "@bitwarden/common/auth/types/verification";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
-import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
-import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
-import { MasterKey, UserKey } from "@bitwarden/common/types/key";
-import { DialogService, ToastService } from "@bitwarden/components";
-import { KdfConfigService, KeyService } from "@bitwarden/key-management";
-
-import { ChangePasswordComponent as BaseChangePasswordComponent } from "./change-password.component";
-
-@Directive()
-export class UpdatePasswordComponent extends BaseChangePasswordComponent {
-  hint: string;
-  key: string;
-  enforcedPolicyOptions: MasterPasswordPolicyOptions;
-  showPassword = false;
-  currentMasterPassword: string;
-
-  onSuccessfulChangePassword: () => Promise<void>;
-
-  constructor(
-    protected router: Router,
-    i18nService: I18nService,
-    platformUtilsService: PlatformUtilsService,
-    policyService: PolicyService,
-    keyService: KeyService,
-    messagingService: MessagingService,
-    private masterPasswordApiService: MasterPasswordApiService,
-    private userVerificationService: UserVerificationService,
-    private logService: LogService,
-    dialogService: DialogService,
-    kdfConfigService: KdfConfigService,
-    masterPasswordService: InternalMasterPasswordServiceAbstraction,
-    accountService: AccountService,
-    toastService: ToastService,
-  ) {
-    super(
-      accountService,
-      dialogService,
-      i18nService,
-      kdfConfigService,
-      keyService,
-      masterPasswordService,
-      messagingService,
-      platformUtilsService,
-      policyService,
-      toastService,
-    );
-  }
-
-  togglePassword(confirmField: boolean) {
-    this.showPassword = !this.showPassword;
-    document.getElementById(confirmField ? "masterPasswordRetype" : "masterPassword").focus();
-  }
-
-  async cancel() {
-    await this.router.navigate(["/vault"]);
-  }
-
-  async setupSubmitActions(): Promise<boolean> {
-    if (this.currentMasterPassword == null || this.currentMasterPassword === "") {
-      this.toastService.showToast({
-        variant: "error",
-        title: this.i18nService.t("errorOccurred"),
-        message: this.i18nService.t("masterPasswordRequired"),
-      });
-      return false;
-    }
-
-    const secret: Verification = {
-      type: VerificationType.MasterPassword,
-      secret: this.currentMasterPassword,
-    };
-    try {
-      await this.userVerificationService.verifyUser(secret);
-    } catch (e) {
-      this.toastService.showToast({
-        variant: "error",
-        title: this.i18nService.t("errorOccurred"),
-        message: e.message,
-      });
-      return false;
-    }
-    const userId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
-    this.kdfConfig = await this.kdfConfigService.getKdfConfig(userId);
-    return true;
-  }
-
-  async performSubmitActions(
-    newMasterKeyHash: string,
-    newMasterKey: MasterKey,
-    newUserKey: [UserKey, EncString],
-  ) {
-    try {
-      // Create Request
-      const request = new PasswordRequest();
-      request.masterPasswordHash = await this.keyService.hashMasterKey(
-        this.currentMasterPassword,
-        await this.keyService.getOrDeriveMasterKey(this.currentMasterPassword),
-      );
-      request.newMasterPasswordHash = newMasterKeyHash;
-      request.key = newUserKey[1].encryptedString;
-
-      // Update user's password
-      await this.masterPasswordApiService.postPassword(request);
-
-      this.toastService.showToast({
-        variant: "success",
-        title: this.i18nService.t("masterPasswordChanged"),
-        message: this.i18nService.t("logBackIn"),
-      });
-
-      if (this.onSuccessfulChangePassword != null) {
-        // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
-        // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        this.onSuccessfulChangePassword();
-      } else {
-        this.messagingService.send("logout");
-      }
-    } catch (e) {
-      this.logService.error(e);
-    }
-  }
-}

libs/angular/src/auth/components/update-temp-password.component.ts

@@ -1,232 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { Directive, OnInit } from "@angular/core";
-import { Router } from "@angular/router";
-import { firstValueFrom, map } from "rxjs";
-
-import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
-import { MasterPasswordPolicyOptions } from "@bitwarden/common/admin-console/models/domain/master-password-policy-options";
-import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
-import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
-import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
-import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
-import { PasswordRequest } from "@bitwarden/common/auth/models/request/password.request";
-import { UpdateTdeOffboardingPasswordRequest } from "@bitwarden/common/auth/models/request/update-tde-offboarding-password.request";
-import { UpdateTempPasswordRequest } from "@bitwarden/common/auth/models/request/update-temp-password.request";
-import { MasterPasswordVerification } from "@bitwarden/common/auth/types/verification";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
-import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
-import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
-import { MasterKey, UserKey } from "@bitwarden/common/types/key";
-import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
-import { DialogService, ToastService } from "@bitwarden/components";
-import { KdfConfigService, KeyService } from "@bitwarden/key-management";
-
-import { ChangePasswordComponent as BaseChangePasswordComponent } from "./change-password.component";
-
-@Directive()
-export class UpdateTempPasswordComponent extends BaseChangePasswordComponent implements OnInit {
-  hint: string;
-  key: string;
-  enforcedPolicyOptions: MasterPasswordPolicyOptions;
-  showPassword = false;
-  reason: ForceSetPasswordReason = ForceSetPasswordReason.None;
-  verification: MasterPasswordVerification = {
-    type: VerificationType.MasterPassword,
-    secret: "",
-  };
-
-  onSuccessfulChangePassword: () => Promise<any>;
-
-  get requireCurrentPassword(): boolean {
-    return this.reason === ForceSetPasswordReason.WeakMasterPassword;
-  }
-
-  constructor(
-    i18nService: I18nService,
-    platformUtilsService: PlatformUtilsService,
-    policyService: PolicyService,
-    keyService: KeyService,
-    messagingService: MessagingService,
-    private masterPasswordApiService: MasterPasswordApiService,
-    private syncService: SyncService,
-    private logService: LogService,
-    private userVerificationService: UserVerificationService,
-    protected router: Router,
-    dialogService: DialogService,
-    kdfConfigService: KdfConfigService,
-    accountService: AccountService,
-    masterPasswordService: InternalMasterPasswordServiceAbstraction,
-    toastService: ToastService,
-  ) {
-    super(
-      accountService,
-      dialogService,
-      i18nService,
-      kdfConfigService,
-      keyService,
-      masterPasswordService,
-      messagingService,
-      platformUtilsService,
-      policyService,
-      toastService,
-    );
-  }
-
-  async ngOnInit() {
-    await this.syncService.fullSync(true);
-
-    const userId = (await firstValueFrom(this.accountService.activeAccount$))?.id;
-    this.reason = await firstValueFrom(this.masterPasswordService.forceSetPasswordReason$(userId));
-
-    // If we somehow end up here without a reason, go back to the home page
-    if (this.reason == ForceSetPasswordReason.None) {
-      // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
-      // eslint-disable-next-line @typescript-eslint/no-floating-promises
-      this.router.navigate(["/"]);
-      return;
-    }
-
-    await super.ngOnInit();
-  }
-
-  get masterPasswordWarningText(): string {
-    if (this.reason == ForceSetPasswordReason.WeakMasterPassword) {
-      return this.i18nService.t("updateWeakMasterPasswordWarning");
-    } else if (this.reason == ForceSetPasswordReason.TdeOffboarding) {
-      return this.i18nService.t("tdeDisabledMasterPasswordRequired");
-    } else {
-      return this.i18nService.t("updateMasterPasswordWarning");
-    }
-  }
-
-  togglePassword(confirmField: boolean) {
-    this.showPassword = !this.showPassword;
-    document.getElementById(confirmField ? "masterPasswordRetype" : "masterPassword").focus();
-  }
-
-  async setupSubmitActions(): Promise<boolean> {
-    const [userId, email] = await firstValueFrom(
-      this.accountService.activeAccount$.pipe(map((a) => [a?.id, a?.email])),
-    );
-    this.email = email;
-    this.kdfConfig = await this.kdfConfigService.getKdfConfig(userId);
-    return true;
-  }
-
-  async submit() {
-    // Validation
-    if (!(await this.strongPassword())) {
-      return;
-    }
-
-    if (!(await this.setupSubmitActions())) {
-      return;
-    }
-
-    try {
-      // Create new key and hash new password
-      const newMasterKey = await this.keyService.makeMasterKey(
-        this.masterPassword,
-        this.email.trim().toLowerCase(),
-        this.kdfConfig,
-      );
-      const newPasswordHash = await this.keyService.hashMasterKey(
-        this.masterPassword,
-        newMasterKey,
-      );
-
-      // Grab user key
-      const userKey = await this.keyService.getUserKey();
-
-      // Encrypt user key with new master key
-      const newProtectedUserKey = await this.keyService.encryptUserKeyWithMasterKey(
-        newMasterKey,
-        userKey,
-      );
-
-      await this.performSubmitActions(newPasswordHash, newMasterKey, newProtectedUserKey);
-    } catch (e) {
-      this.logService.error(e);
-    }
-  }
-
-  async performSubmitActions(
-    masterPasswordHash: string,
-    masterKey: MasterKey,
-    userKey: [UserKey, EncString],
-  ) {
-    try {
-      switch (this.reason) {
-        case ForceSetPasswordReason.AdminForcePasswordReset:
-          this.formPromise = this.updateTempPassword(masterPasswordHash, userKey);
-          break;
-        case ForceSetPasswordReason.WeakMasterPassword:
-          this.formPromise = this.updatePassword(masterPasswordHash, userKey);
-          break;
-        case ForceSetPasswordReason.TdeOffboarding:
-          this.formPromise = this.updateTdeOffboardingPassword(masterPasswordHash, userKey);
-          break;
-      }
-
-      await this.formPromise;
-      this.toastService.showToast({
-        variant: "success",
-        title: null,
-        message: this.i18nService.t("updatedMasterPassword"),
-      });
-
-      const userId = (await firstValueFrom(this.accountService.activeAccount$))?.id;
-      await this.masterPasswordService.setForceSetPasswordReason(
-        ForceSetPasswordReason.None,
-        userId,
-      );
-
-      if (this.onSuccessfulChangePassword != null) {
-        // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.
-        // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        this.onSuccessfulChangePassword();
-      } else {
-        this.messagingService.send("logout");
-      }
-    } catch (e) {
-      this.logService.error(e);
-    }
-  }
-  private async updateTempPassword(masterPasswordHash: string, userKey: [UserKey, EncString]) {
-    const request = new UpdateTempPasswordRequest();
-    request.key = userKey[1].encryptedString;
-    request.newMasterPasswordHash = masterPasswordHash;
-    request.masterPasswordHint = this.hint;
-
-    return this.masterPasswordApiService.putUpdateTempPassword(request);
-  }
-
-  private async updatePassword(newMasterPasswordHash: string, userKey: [UserKey, EncString]) {
-    const request = await this.userVerificationService.buildRequest(
-      this.verification,
-      PasswordRequest,
-    );
-    request.masterPasswordHint = this.hint;
-    request.newMasterPasswordHash = newMasterPasswordHash;
-    request.key = userKey[1].encryptedString;
-
-    return this.masterPasswordApiService.postPassword(request);
-  }
-
-  private async updateTdeOffboardingPassword(
-    masterPasswordHash: string,
-    userKey: [UserKey, EncString],
-  ) {
-    const request = new UpdateTdeOffboardingPasswordRequest();
-    request.key = userKey[1].encryptedString;
-    request.newMasterPasswordHash = masterPasswordHash;
-    request.masterPasswordHint = this.hint;
-
-    return this.masterPasswordApiService.putUpdateTdeOffboardingPassword(request);
-  }
-}

libs/angular/src/auth/guards/auth.guard.spec.ts

@@ -68,10 +68,7 @@ describe("AuthGuard", () => {
           { path: "", component: EmptyComponent },
           { path: "guarded-route", component: EmptyComponent, canActivate: [authGuard] },
           { path: "lock", component: EmptyComponent },
-          { path: "set-password", component: EmptyComponent },
-          { path: "set-password-jit", component: EmptyComponent },
           { path: "set-initial-password", component: EmptyComponent, canActivate: [authGuard] },
-          { path: "update-temp-password", component: EmptyComponent, canActivate: [authGuard] },
           { path: "change-password", component: EmptyComponent },
           { path: "remove-password", component: EmptyComponent, canActivate: [authGuard] },
         ]),
@@ -125,109 +122,58 @@ describe("AuthGuard", () => {
   });
 
   describe("given user is Locked", () => {
-    describe("given the PM16117_SetInitialPasswordRefactor feature flag is ON", () => {
-      it("should redirect to /set-initial-password when the user has ForceSetPasswordReaason.TdeOffboardingUntrustedDevice", async () => {
-        const { router } = setup(
-          AuthenticationStatus.Locked,
-          ForceSetPasswordReason.TdeOffboardingUntrustedDevice,
-          false,
-          FeatureFlag.PM16117_SetInitialPasswordRefactor,
-        );
+    it("should redirect to /set-initial-password when the user has ForceSetPasswordReaason.TdeOffboardingUntrustedDevice", async () => {
+      const { router } = setup(
+        AuthenticationStatus.Locked,
+        ForceSetPasswordReason.TdeOffboardingUntrustedDevice,
+        false,
+      );
 
-        await router.navigate(["guarded-route"]);
-        expect(router.url).toBe("/set-initial-password");
-      });
+      await router.navigate(["guarded-route"]);
+      expect(router.url).toBe("/set-initial-password");
+    });
 
-      it("should allow navigation to continue to /set-initial-password when the user has ForceSetPasswordReason.TdeOffboardingUntrustedDevice", async () => {
-        const { router } = setup(
-          AuthenticationStatus.Unlocked,
-          ForceSetPasswordReason.TdeOffboardingUntrustedDevice,
-          false,
-          FeatureFlag.PM16117_SetInitialPasswordRefactor,
-        );
+    it("should allow navigation to continue to /set-initial-password when the user has ForceSetPasswordReason.TdeOffboardingUntrustedDevice", async () => {
+      const { router } = setup(
+        AuthenticationStatus.Unlocked,
+        ForceSetPasswordReason.TdeOffboardingUntrustedDevice,
+        false,
+      );
 
-        await router.navigate(["/set-initial-password"]);
-        expect(router.url).toContain("/set-initial-password");
-      });
+      await router.navigate(["/set-initial-password"]);
+      expect(router.url).toContain("/set-initial-password");
     });
   });
 
-  describe("given user is Unlocked", () => {
-    describe("given the PM16117_SetInitialPasswordRefactor feature flag is ON", () => {
-      const tests = [
-        ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission,
-        ForceSetPasswordReason.TdeOffboarding,
-      ];
+  describe("given user is Unlocked and ForceSetPasswordReason requires setting an initial password", () => {
+    const tests = [
+      ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission,
+      ForceSetPasswordReason.TdeOffboarding,
+    ];
 
-      describe("given user attempts to navigate to an auth guarded route", () => {
-        tests.forEach((reason) => {
-          it(`should redirect to /set-initial-password when the user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
-            const { router } = setup(
-              AuthenticationStatus.Unlocked,
-              reason,
-              false,
-              FeatureFlag.PM16117_SetInitialPasswordRefactor,
-            );
+    describe("given user attempts to navigate to an auth guarded route", () => {
+      tests.forEach((reason) => {
+        it(`should redirect to /set-initial-password when the user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
+          const { router } = setup(AuthenticationStatus.Unlocked, reason, false);
 
-            await router.navigate(["guarded-route"]);
-            expect(router.url).toContain("/set-initial-password");
-          });
-        });
-      });
-
-      describe("given user attempts to navigate to /set-initial-password", () => {
-        tests.forEach((reason) => {
-          it(`should allow navigation to continue to /set-initial-password when the user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
-            const { router } = setup(
-              AuthenticationStatus.Unlocked,
-              reason,
-              false,
-              FeatureFlag.PM16117_SetInitialPasswordRefactor,
-            );
-
-            await router.navigate(["/set-initial-password"]);
-            expect(router.url).toContain("/set-initial-password");
-          });
+          await router.navigate(["guarded-route"]);
+          expect(router.url).toContain("/set-initial-password");
         });
       });
     });
 
-    describe("given the PM16117_SetInitialPasswordRefactor feature flag is OFF", () => {
-      const tests = [
-        {
-          reason: ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission,
-          url: "/set-password",
-        },
-        {
-          reason: ForceSetPasswordReason.TdeOffboarding,
-          url: "/update-temp-password",
-        },
-      ];
+    describe("given user attempts to navigate to /set-initial-password", () => {
+      tests.forEach((reason) => {
+        it(`should allow navigation to continue to /set-initial-password when the user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
+          const { router } = setup(AuthenticationStatus.Unlocked, reason, false);
 
-      describe("given user attempts to navigate to an auth guarded route", () => {
-        tests.forEach(({ reason, url }) => {
-          it(`should redirect to ${url} when user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
-            const { router } = setup(AuthenticationStatus.Unlocked, reason);
-
-            await router.navigate(["/guarded-route"]);
-            expect(router.url).toContain(url);
-          });
-        });
-      });
-
-      describe("given user attempts to navigate to the set- or update- password route itself", () => {
-        tests.forEach(({ reason, url }) => {
-          it(`should allow navigation to continue to ${url} when user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
-            const { router } = setup(AuthenticationStatus.Unlocked, reason);
-
-            await router.navigate([url]);
-            expect(router.url).toContain(url);
-          });
+          await router.navigate(["/set-initial-password"]);
+          expect(router.url).toContain("/set-initial-password");
         });
       });
     });
 
-    describe("given the PM16117_ChangeExistingPasswordRefactor feature flag is ON", () => {
+    describe("given user is Unlocked and ForceSetPasswordReason requires changing an existing password", () => {
       const tests = [
         ForceSetPasswordReason.AdminForcePasswordReset,
         ForceSetPasswordReason.WeakMasterPassword,
@@ -236,12 +182,7 @@ describe("AuthGuard", () => {
       describe("given user attempts to navigate to an auth guarded route", () => {
         tests.forEach((reason) => {
           it(`should redirect to /change-password when user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
-            const { router } = setup(
-              AuthenticationStatus.Unlocked,
-              reason,
-              false,
-              FeatureFlag.PM16117_ChangeExistingPasswordRefactor,
-            );
+            const { router } = setup(AuthenticationStatus.Unlocked, reason, false);
 
             await router.navigate(["guarded-route"]);
             expect(router.url).toContain("/change-password");
@@ -256,7 +197,6 @@ describe("AuthGuard", () => {
               AuthenticationStatus.Unlocked,
               ForceSetPasswordReason.AdminForcePasswordReset,
               false,
-              FeatureFlag.PM16117_ChangeExistingPasswordRefactor,
             );
 
             await router.navigate(["/change-password"]);
@@ -265,34 +205,5 @@ describe("AuthGuard", () => {
         });
       });
     });
-
-    describe("given the PM16117_ChangeExistingPasswordRefactor feature flag is OFF", () => {
-      const tests = [
-        ForceSetPasswordReason.AdminForcePasswordReset,
-        ForceSetPasswordReason.WeakMasterPassword,
-      ];
-
-      describe("given user attempts to navigate to an auth guarded route", () => {
-        tests.forEach((reason) => {
-          it(`should redirect to /update-temp-password when user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
-            const { router } = setup(AuthenticationStatus.Unlocked, reason);
-
-            await router.navigate(["guarded-route"]);
-            expect(router.url).toContain("/update-temp-password");
-          });
-        });
-      });
-
-      describe("given user attempts to navigate to /update-temp-password", () => {
-        tests.forEach((reason) => {
-          it(`should allow navigation to continue to /update-temp-password when user has ForceSetPasswordReason.${ForceSetPasswordReason[reason]}`, async () => {
-            const { router } = setup(AuthenticationStatus.Unlocked, reason);
-
-            await router.navigate(["/update-temp-password"]);
-            expect(router.url).toContain("/update-temp-password");
-          });
-        });
-      });
-    });
   });
 });

libs/angular/src/auth/guards/auth.guard.ts

@@ -14,10 +14,8 @@ import { AccountService } from "@bitwarden/common/auth/abstractions/account.serv
 import { AuthService } from "@bitwarden/common/auth/abstractions/auth.service";
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
 import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector.service";
 import { MasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 
 export const authGuard: CanActivateFn = async (
@@ -30,7 +28,6 @@ export const authGuard: CanActivateFn = async (
   const keyConnectorService = inject(KeyConnectorService);
   const accountService = inject(AccountService);
   const masterPasswordService = inject(MasterPasswordServiceAbstraction);
-  const configService = inject(ConfigService);
 
   const authStatus = await authService.getAuthStatus();
 
@@ -44,16 +41,11 @@ export const authGuard: CanActivateFn = async (
     masterPasswordService.forceSetPasswordReason$(userId),
   );
 
-  const isSetInitialPasswordFlagOn = await configService.getFeatureFlag(
-    FeatureFlag.PM16117_SetInitialPasswordRefactor,
-  );
-
   // User JIT provisioned into a master-password-encryption org
   if (
     authStatus === AuthenticationStatus.Locked &&
     forceSetPasswordReason === ForceSetPasswordReason.SsoNewJitProvisionedUser &&
-    !routerState.url.includes("set-initial-password") &&
-    isSetInitialPasswordFlagOn
+    !routerState.url.includes("set-initial-password")
   ) {
     return router.createUrlTree(["/set-initial-password"]);
   }
@@ -62,8 +54,7 @@ export const authGuard: CanActivateFn = async (
   if (
     authStatus === AuthenticationStatus.Locked &&
     forceSetPasswordReason === ForceSetPasswordReason.TdeOffboardingUntrustedDevice &&
-    !routerState.url.includes("set-initial-password") &&
-    isSetInitialPasswordFlagOn
+    !routerState.url.includes("set-initial-password")
   ) {
     return router.createUrlTree(["/set-initial-password"]);
   }
@@ -90,39 +81,28 @@ export const authGuard: CanActivateFn = async (
     return router.createUrlTree(["/remove-password"]);
   }
 
-  // TDE org user has "manage account recovery" permission
+  // Handle cases where a user needs to set a password when they don't already have one:
+  // - TDE org user has been given "manage account recovery" permission
+  // - TDE offboarding on a trusted device, where we have access to their encryption key wrap with their new password
   if (
-    forceSetPasswordReason ===
-      ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission &&
-    !routerState.url.includes("set-password") &&
+    (forceSetPasswordReason ===
+      ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission ||
+      forceSetPasswordReason === ForceSetPasswordReason.TdeOffboarding) &&
     !routerState.url.includes("set-initial-password")
   ) {
-    const route = isSetInitialPasswordFlagOn ? "/set-initial-password" : "/set-password";
+    const route = "/set-initial-password";
     return router.createUrlTree([route]);
   }
 
-  // TDE Offboarding on trusted device
-  if (
-    forceSetPasswordReason === ForceSetPasswordReason.TdeOffboarding &&
-    !routerState.url.includes("update-temp-password") &&
-    !routerState.url.includes("set-initial-password")
-  ) {
-    const route = isSetInitialPasswordFlagOn ? "/set-initial-password" : "/update-temp-password";
-    return router.createUrlTree([route]);
-  }
-
-  const isChangePasswordFlagOn = await configService.getFeatureFlag(
-    FeatureFlag.PM16117_ChangeExistingPasswordRefactor,
-  );
-
-  // Post- Account Recovery or Weak Password on login
+  // Handle cases where a user has a password but needs to set a new one:
+  // - Account recovery
+  // - Weak Password on login
   if (
     (forceSetPasswordReason === ForceSetPasswordReason.AdminForcePasswordReset ||
       forceSetPasswordReason === ForceSetPasswordReason.WeakMasterPassword) &&
-    !routerState.url.includes("update-temp-password") &&
     !routerState.url.includes("change-password")
   ) {
-    const route = isChangePasswordFlagOn ? "/change-password" : "/update-temp-password";
+    const route = "/change-password";
     return router.createUrlTree([route]);
   }
 

libs/angular/src/auth/guards/lock.guard.spec.ts

@@ -26,7 +26,6 @@ import { lockGuard } from "./lock.guard";
 interface SetupParams {
   authStatus: AuthenticationStatus;
   canLock?: boolean;
-  isLegacyUser?: boolean;
   clientType?: ClientType;
   everHadUserKey?: boolean;
   supportsDeviceTrust?: boolean;
@@ -43,7 +42,6 @@ describe("lockGuard", () => {
     vaultTimeoutSettingsService.canLock.mockResolvedValue(setupParams.canLock);
 
     const keyService: MockProxy<KeyService> = mock<KeyService>();
-    keyService.isLegacyUser.mockResolvedValue(setupParams.isLegacyUser);
     keyService.everHadUserKey$.mockReturnValue(of(setupParams.everHadUserKey));
 
     const platformUtilService: MockProxy<PlatformUtilsService> = mock<PlatformUtilsService>();
@@ -155,37 +153,10 @@ describe("lockGuard", () => {
     expect(router.url).toBe("/");
   });
 
-  it("should log user out if they are a legacy user on a desktop client", async () => {
-    const { router, messagingService } = setup({
-      authStatus: AuthenticationStatus.Locked,
-      canLock: true,
-      isLegacyUser: true,
-      clientType: ClientType.Desktop,
-    });
-
-    await router.navigate(["lock"]);
-    expect(router.url).toBe("/");
-    expect(messagingService.send).toHaveBeenCalledWith("logout");
-  });
-
-  it("should log user out if they are a legacy user on a browser extension client", async () => {
-    const { router, messagingService } = setup({
-      authStatus: AuthenticationStatus.Locked,
-      canLock: true,
-      isLegacyUser: true,
-      clientType: ClientType.Browser,
-    });
-
-    await router.navigate(["lock"]);
-    expect(router.url).toBe("/");
-    expect(messagingService.send).toHaveBeenCalledWith("logout");
-  });
-
   it("should allow navigation to the lock route when device trust is supported, the user has a MP, and the user is coming from the login-initiated page", async () => {
     const { router } = setup({
       authStatus: AuthenticationStatus.Locked,
       canLock: true,
-      isLegacyUser: false,
       clientType: ClientType.Web,
       everHadUserKey: false,
       supportsDeviceTrust: true,
@@ -213,7 +184,6 @@ describe("lockGuard", () => {
     const { router } = setup({
       authStatus: AuthenticationStatus.Locked,
       canLock: true,
-      isLegacyUser: false,
       clientType: ClientType.Web,
       everHadUserKey: false,
       supportsDeviceTrust: true,

libs/angular/src/auth/guards/lock.guard.ts

@@ -13,7 +13,6 @@ import { UserVerificationService } from "@bitwarden/common/auth/abstractions/use
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
 import { VaultTimeoutSettingsService } from "@bitwarden/common/key-management/vault-timeout";
-import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { KeyService } from "@bitwarden/key-management";
 
 /**
@@ -31,7 +30,6 @@ export function lockGuard(): CanActivateFn {
     const authService = inject(AuthService);
     const keyService = inject(KeyService);
     const deviceTrustService = inject(DeviceTrustServiceAbstraction);
-    const messagingService = inject(MessagingService);
     const router = inject(Router);
     const userVerificationService = inject(UserVerificationService);
     const vaultTimeoutSettingsService = inject(VaultTimeoutSettingsService);
@@ -56,11 +54,6 @@ export function lockGuard(): CanActivateFn {
       return false;
     }
 
-    if (await keyService.isLegacyUser()) {
-      messagingService.send("logout");
-      return false;
-    }
-
     // User is authN and in locked state.
 
     const tdeEnabled = await firstValueFrom(deviceTrustService.supportsDeviceTrust$);

libs/angular/src/auth/password-management/change-password/change-password.component.ts

@@ -178,6 +178,9 @@ export class ChangePasswordComponent implements OnInit {
 
         // TODO: PM-23515 eventually use the logout service instead of messaging service once it is available without circular dependencies
         this.messagingService.send("logout");
+
+        // Close the popout if we are in a browser extension popout.
+        this.changePasswordService.closeBrowserExtensionPopout?.();
       }
     } catch (error) {
       this.logService.error(error);

libs/angular/src/auth/password-management/change-password/change-password.service.abstraction.ts

@@ -59,4 +59,10 @@ export abstract class ChangePasswordService {
    * - Currently only used on the web change password service.
    */
   clearDeeplinkState?: () => Promise<void>;
+
+  /**
+   * Optional method that closes the browser extension popout if in a popout
+   * If not in a popout, does nothing.
+   */
+  abstract closeBrowserExtensionPopout?(): void;
 }

libs/angular/src/services/jslib-services.module.ts

@@ -22,13 +22,11 @@ import {
   DefaultLoginComponentService,
   DefaultLoginDecryptionOptionsService,
   DefaultRegistrationFinishService,
-  DefaultSetPasswordJitService,
   DefaultTwoFactorAuthComponentService,
   DefaultTwoFactorAuthWebAuthnComponentService,
   LoginComponentService,
   LoginDecryptionOptionsService,
   RegistrationFinishService as RegistrationFinishServiceAbstraction,
-  SetPasswordJitService,
   TwoFactorAuthComponentService,
   TwoFactorAuthWebAuthnComponentService,
 } from "@bitwarden/auth/angular";
@@ -1417,21 +1415,6 @@ const safeProviders: SafeProvider[] = [
     useClass: DefaultOrganizationInviteService,
     deps: [],
   }),
-  safeProvider({
-    provide: SetPasswordJitService,
-    useClass: DefaultSetPasswordJitService,
-    deps: [
-      EncryptService,
-      I18nServiceAbstraction,
-      KdfConfigService,
-      KeyService,
-      MasterPasswordApiServiceAbstraction,
-      InternalMasterPasswordServiceAbstraction,
-      OrganizationApiServiceAbstraction,
-      OrganizationUserApiService,
-      InternalUserDecryptionOptionsServiceAbstraction,
-    ],
-  }),
   safeProvider({
     provide: SetInitialPasswordService,
     useClass: DefaultSetInitialPasswordService,

libs/angular/src/vault/abstractions/deprecated-vault-filter.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.

libs/angular/src/vault/services/custom-nudges-services/empty-vault-nudge.service.ts

@@ -27,7 +27,7 @@ export class EmptyVaultNudgeService extends DefaultSingleNudgeService {
       this.getNudgeStatus$(nudgeType, userId),
       this.cipherService.cipherListViews$(userId),
       this.organizationService.organizations$(userId),
-      this.collectionService.decryptedCollections$,
+      this.collectionService.decryptedCollections$(userId),
     ]).pipe(
       switchMap(([nudgeStatus, ciphers, orgs, collections]) => {
         const vaultHasContents = !(ciphers == null || ciphers.length === 0);

libs/angular/src/vault/services/custom-nudges-services/vault-settings-import-nudge.service.ts

@@ -27,7 +27,7 @@ export class VaultSettingsImportNudgeService extends DefaultSingleNudgeService {
       this.getNudgeStatus$(nudgeType, userId),
       this.cipherService.cipherViews$(userId),
       this.organizationService.organizations$(userId),
-      this.collectionService.decryptedCollections$,
+      this.collectionService.decryptedCollections$(userId),
     ]).pipe(
       switchMap(([nudgeStatus, ciphers, orgs, collections]) => {
         const vaultHasMoreThanOneItem = (ciphers?.length ?? 0) > 1;

libs/angular/src/vault/services/nudges.service.ts

@@ -160,7 +160,6 @@ export class NudgesService {
   hasActiveBadges$(userId: UserId): Observable<boolean> {
     // Add more nudge types here if they have the settings badge feature
     const nudgeTypes = [
-      NudgeType.AccountSecurity,
       NudgeType.EmptyVaultNudge,
       NudgeType.DownloadBitwarden,
       NudgeType.AutofillNudge,

libs/angular/src/vault/vault-filter/services/vault-filter.service.ts

@@ -109,7 +109,12 @@ export class VaultFilterService implements DeprecatedVaultFilterServiceAbstracti
   }
 
   async buildCollections(organizationId?: string): Promise<DynamicTreeNode<CollectionView>> {
-    const storedCollections = await this.collectionService.getAllDecrypted();
+    const storedCollections = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(
+        getUserId,
+        switchMap((userId) => this.collectionService.decryptedCollections$(userId)),
+      ),
+    );
     const orgs = await this.buildOrganizations();
     const defaulCollectionsFlagEnabled = await this.configService.getFeatureFlag(
       FeatureFlag.CreateDefaultLocation,

libs/auth/src/angular/index.ts

@@ -41,11 +41,6 @@ export * from "./registration/registration-env-selector/registration-env-selecto
 export * from "./registration/registration-finish/registration-finish.service";
 export * from "./registration/registration-finish/default-registration-finish.service";
 
-// set password (JIT user)
-export * from "./set-password-jit/set-password-jit.component";
-export * from "./set-password-jit/set-password-jit.service.abstraction";
-export * from "./set-password-jit/default-set-password-jit.service";
-
 // user verification
 export * from "./user-verification/user-verification-dialog.component";
 export * from "./user-verification/user-verification-dialog.types";

libs/auth/src/angular/login-decryption-options/login-decryption-options.component.ts

@@ -249,7 +249,7 @@ export class LoginDecryptionOptionsComponent implements OnInit {
     }
 
     try {
-      const { publicKey, privateKey } = await this.keyService.initAccount();
+      const { publicKey, privateKey } = await this.keyService.initAccount(this.activeAccountId);
       const keysRequest = new KeysRequest(publicKey, privateKey.encryptedString);
       await this.apiService.postAccountKeys(keysRequest);
 

libs/auth/src/angular/login/login.component.ts

@@ -18,7 +18,6 @@ import { Policy } from "@bitwarden/common/admin-console/models/domain/policy";
 import { DevicesApiServiceAbstraction } from "@bitwarden/common/auth/abstractions/devices-api.service.abstraction";
 import { AuthResult } from "@bitwarden/common/auth/models/domain/auth-result";
 import { ClientType, HttpStatusCode } from "@bitwarden/common/enums";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { MasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
@@ -230,29 +229,21 @@ export class LoginComponent implements OnInit, OnDestroy {
       return;
     }
 
-    let credentials: PasswordLoginCredentials;
+    // Try to retrieve any org policies from an org invite now so we can send it to the
+    // login strategies. Since it is optional and we only want to be doing this on the
+    // web we will only send in content in the right context.
+    const orgPoliciesFromInvite = this.loginComponentService.getOrgPoliciesFromOrgInvite
+      ? await this.loginComponentService.getOrgPoliciesFromOrgInvite()
+      : null;
 
-    if (
-      await this.configService.getFeatureFlag(FeatureFlag.PM16117_ChangeExistingPasswordRefactor)
-    ) {
-      // Try to retrieve any org policies from an org invite now so we can send it to the
-      // login strategies. Since it is optional and we only want to be doing this on the
-      // web we will only send in content in the right context.
-      const orgPoliciesFromInvite = this.loginComponentService.getOrgPoliciesFromOrgInvite
-        ? await this.loginComponentService.getOrgPoliciesFromOrgInvite()
-        : null;
+    const orgMasterPasswordPolicyOptions = orgPoliciesFromInvite?.enforcedPasswordPolicyOptions;
 
-      const orgMasterPasswordPolicyOptions = orgPoliciesFromInvite?.enforcedPasswordPolicyOptions;
-
-      credentials = new PasswordLoginCredentials(
-        email,
-        masterPassword,
-        undefined,
-        orgMasterPasswordPolicyOptions,
-      );
-    } else {
-      credentials = new PasswordLoginCredentials(email, masterPassword);
-    }
+    const credentials = new PasswordLoginCredentials(
+      email,
+      masterPassword,
+      undefined,
+      orgMasterPasswordPolicyOptions,
+    );
 
     try {
       const authResult = await this.loginStrategyService.logIn(credentials);
@@ -332,7 +323,7 @@ export class LoginComponent implements OnInit, OnDestroy {
     await this.loginSuccessHandlerService.run(authResult.userId);
 
     // Determine where to send the user next
-    // The AuthGuard will handle routing to update-temp-password based on state
+    // The AuthGuard will handle routing to change-password based on state
 
     // TODO: PM-18269 - evaluate if we can combine this with the
     // password evaluation done in the password login strategy.
@@ -344,7 +335,7 @@ export class LoginComponent implements OnInit, OnDestroy {
 
       if (orgPolicies) {
         // Since we have retrieved the policies, we can go ahead and set them into state for future use
-        // e.g., the update-password page currently only references state for policy data and
+        // e.g., the change-password page currently only references state for policy data and
         // doesn't fallback to pulling them from the server like it should if they are null.
         await this.setPoliciesIntoState(authResult.userId, orgPolicies.policies);
 
@@ -352,13 +343,7 @@ export class LoginComponent implements OnInit, OnDestroy {
           orgPolicies.enforcedPasswordPolicyOptions,
         );
         if (isPasswordChangeRequired) {
-          const changePasswordFeatureFlagOn = await this.configService.getFeatureFlag(
-            FeatureFlag.PM16117_ChangeExistingPasswordRefactor,
-          );
-
-          await this.router.navigate(
-            changePasswordFeatureFlagOn ? ["change-password"] : ["update-password"],
-          );
+          await this.router.navigate(["change-password"]);
           return;
         }
       }

libs/auth/src/angular/new-device-verification/new-device-verification.component.ts

@@ -10,7 +10,6 @@ import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { MasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
@@ -151,25 +150,17 @@ export class NewDeviceVerificationComponent implements OnInit, OnDestroy {
       this.loginSuccessHandlerService.run(authResult.userId);
 
       // TODO: PM-22663 use the new service to handle routing.
+      const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
+
+      const forceSetPasswordReason = await firstValueFrom(
+        this.masterPasswordService.forceSetPasswordReason$(activeUserId),
+      );
+
       if (
-        await this.configService.getFeatureFlag(FeatureFlag.PM16117_ChangeExistingPasswordRefactor)
+        forceSetPasswordReason === ForceSetPasswordReason.WeakMasterPassword ||
+        forceSetPasswordReason === ForceSetPasswordReason.AdminForcePasswordReset
       ) {
-        const activeUserId = await firstValueFrom(
-          this.accountService.activeAccount$.pipe(getUserId),
-        );
-
-        const forceSetPasswordReason = await firstValueFrom(
-          this.masterPasswordService.forceSetPasswordReason$(activeUserId),
-        );
-
-        if (
-          forceSetPasswordReason === ForceSetPasswordReason.WeakMasterPassword ||
-          forceSetPasswordReason === ForceSetPasswordReason.AdminForcePasswordReset
-        ) {
-          await this.router.navigate(["/change-password"]);
-        } else {
-          await this.router.navigate(["/vault"]);
-        }
+        await this.router.navigate(["/change-password"]);
       } else {
         await this.router.navigate(["/vault"]);
       }

libs/auth/src/angular/registration/registration-finish/default-registration-finish.service.ts

@@ -28,10 +28,6 @@ export class DefaultRegistrationFinishService implements RegistrationFinishServi
     return null;
   }
 
-  determineLoginSuccessRoute(): Promise<string> {
-    return Promise.resolve("/vault");
-  }
-
   async finishRegistration(
     email: string,
     passwordInputResult: PasswordInputResult,

libs/auth/src/angular/registration/registration-finish/registration-finish.component.ts

@@ -204,8 +204,7 @@ export class RegistrationFinishComponent implements OnInit, OnDestroy {
 
       await this.loginSuccessHandlerService.run(authenticationResult.userId);
 
-      const successRoute = await this.registrationFinishService.determineLoginSuccessRoute();
-      await this.router.navigate([successRoute]);
+      await this.router.navigate(["/vault"]);
     } catch (e) {
       // If login errors, redirect to login page per product. Don't show error
       this.logService.error("Error logging in after registration: ", e.message);

libs/auth/src/angular/registration/registration-finish/registration-finish.service.ts

@@ -16,11 +16,6 @@ export abstract class RegistrationFinishService {
    */
   abstract getMasterPasswordPolicyOptsFromOrgInvite(): Promise<MasterPasswordPolicyOptions | null>;
 
-  /**
-   * Returns the route the user is redirected to after a successful login.
-   */
-  abstract determineLoginSuccessRoute(): Promise<string>;
-
   /**
    * Finishes the registration process by creating a new user account.
    *

libs/auth/src/angular/set-password-jit/default-set-password-jit.service.spec.ts

@@ -1,241 +0,0 @@
-import { MockProxy, mock } from "jest-mock-extended";
-import { BehaviorSubject, of } from "rxjs";
-
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import { OrganizationUserApiService } from "@bitwarden/admin-console/common";
-import {
-  FakeUserDecryptionOptions as UserDecryptionOptions,
-  InternalUserDecryptionOptionsServiceAbstraction,
-} from "@bitwarden/auth/common";
-import { OrganizationApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/organization/organization-api.service.abstraction";
-import { OrganizationKeysResponse } from "@bitwarden/common/admin-console/models/response/organization-keys.response";
-import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
-import { SetPasswordRequest } from "@bitwarden/common/auth/models/request/set-password.request";
-import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { KeysRequest } from "@bitwarden/common/models/request/keys.request";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
-import { CsprngArray } from "@bitwarden/common/types/csprng";
-import { UserId } from "@bitwarden/common/types/guid";
-import { MasterKey, UserKey } from "@bitwarden/common/types/key";
-import { DEFAULT_KDF_CONFIG, KdfConfigService, KeyService } from "@bitwarden/key-management";
-
-import { PasswordInputResult } from "../input-password/password-input-result";
-
-import { DefaultSetPasswordJitService } from "./default-set-password-jit.service";
-import { SetPasswordCredentials } from "./set-password-jit.service.abstraction";
-
-describe("DefaultSetPasswordJitService", () => {
-  let sut: DefaultSetPasswordJitService;
-
-  let masterPasswordApiService: MockProxy<MasterPasswordApiService>;
-  let keyService: MockProxy<KeyService>;
-  let encryptService: MockProxy<EncryptService>;
-  let i18nService: MockProxy<I18nService>;
-  let kdfConfigService: MockProxy<KdfConfigService>;
-  let masterPasswordService: MockProxy<InternalMasterPasswordServiceAbstraction>;
-  let organizationApiService: MockProxy<OrganizationApiServiceAbstraction>;
-  let organizationUserApiService: MockProxy<OrganizationUserApiService>;
-  let userDecryptionOptionsService: MockProxy<InternalUserDecryptionOptionsServiceAbstraction>;
-
-  beforeEach(() => {
-    masterPasswordApiService = mock<MasterPasswordApiService>();
-    keyService = mock<KeyService>();
-    encryptService = mock<EncryptService>();
-    i18nService = mock<I18nService>();
-    kdfConfigService = mock<KdfConfigService>();
-    masterPasswordService = mock<InternalMasterPasswordServiceAbstraction>();
-    organizationApiService = mock<OrganizationApiServiceAbstraction>();
-    organizationUserApiService = mock<OrganizationUserApiService>();
-    userDecryptionOptionsService = mock<InternalUserDecryptionOptionsServiceAbstraction>();
-
-    sut = new DefaultSetPasswordJitService(
-      encryptService,
-      i18nService,
-      kdfConfigService,
-      keyService,
-      masterPasswordApiService,
-      masterPasswordService,
-      organizationApiService,
-      organizationUserApiService,
-      userDecryptionOptionsService,
-    );
-  });
-
-  it("should instantiate the DefaultSetPasswordJitService", () => {
-    expect(sut).not.toBeFalsy();
-  });
-
-  describe("setPassword", () => {
-    let masterKey: MasterKey;
-    let userKey: UserKey;
-    let userKeyEncString: EncString;
-    let protectedUserKey: [UserKey, EncString];
-    let keyPair: [string, EncString];
-    let keysRequest: KeysRequest;
-    let organizationKeys: OrganizationKeysResponse;
-    let orgPublicKey: Uint8Array;
-
-    let orgSsoIdentifier: string;
-    let orgId: string;
-    let resetPasswordAutoEnroll: boolean;
-    let userId: UserId;
-    let passwordInputResult: PasswordInputResult;
-    let credentials: SetPasswordCredentials;
-
-    let userDecryptionOptionsSubject: BehaviorSubject<UserDecryptionOptions>;
-    let setPasswordRequest: SetPasswordRequest;
-
-    beforeEach(() => {
-      masterKey = new SymmetricCryptoKey(new Uint8Array(64).buffer as CsprngArray) as MasterKey;
-      userKey = new SymmetricCryptoKey(new Uint8Array(64).buffer as CsprngArray) as UserKey;
-      userKeyEncString = new EncString("userKeyEncrypted");
-      protectedUserKey = [userKey, userKeyEncString];
-      keyPair = ["publicKey", new EncString("privateKey")];
-      keysRequest = new KeysRequest(keyPair[0], keyPair[1].encryptedString);
-      organizationKeys = {
-        privateKey: "orgPrivateKey",
-        publicKey: "orgPublicKey",
-      } as OrganizationKeysResponse;
-      orgPublicKey = Utils.fromB64ToArray(organizationKeys.publicKey);
-
-      orgSsoIdentifier = "orgSsoIdentifier";
-      orgId = "orgId";
-      resetPasswordAutoEnroll = false;
-      userId = "userId" as UserId;
-
-      passwordInputResult = {
-        newMasterKey: masterKey,
-        newServerMasterKeyHash: "newServerMasterKeyHash",
-        newLocalMasterKeyHash: "newLocalMasterKeyHash",
-        newPasswordHint: "newPasswordHint",
-        kdfConfig: DEFAULT_KDF_CONFIG,
-        newPassword: "newPassword",
-      };
-
-      credentials = {
-        newMasterKey: passwordInputResult.newMasterKey,
-        newServerMasterKeyHash: passwordInputResult.newServerMasterKeyHash,
-        newLocalMasterKeyHash: passwordInputResult.newLocalMasterKeyHash,
-        newPasswordHint: passwordInputResult.newPasswordHint,
-        kdfConfig: passwordInputResult.kdfConfig,
-        orgSsoIdentifier,
-        orgId,
-        resetPasswordAutoEnroll,
-        userId,
-      };
-
-      userDecryptionOptionsSubject = new BehaviorSubject(null);
-      userDecryptionOptionsService.userDecryptionOptions$ = userDecryptionOptionsSubject;
-
-      setPasswordRequest = new SetPasswordRequest(
-        passwordInputResult.newServerMasterKeyHash,
-        protectedUserKey[1].encryptedString,
-        passwordInputResult.newPasswordHint,
-        orgSsoIdentifier,
-        keysRequest,
-        passwordInputResult.kdfConfig.kdfType,
-        passwordInputResult.kdfConfig.iterations,
-      );
-    });
-
-    function setupSetPasswordMocks(hasUserKey = true) {
-      if (!hasUserKey) {
-        keyService.userKey$.mockReturnValue(of(null));
-        keyService.makeUserKey.mockResolvedValue(protectedUserKey);
-      } else {
-        keyService.userKey$.mockReturnValue(of(userKey));
-        keyService.encryptUserKeyWithMasterKey.mockResolvedValue(protectedUserKey);
-      }
-
-      keyService.makeKeyPair.mockResolvedValue(keyPair);
-
-      masterPasswordApiService.setPassword.mockResolvedValue(undefined);
-      masterPasswordService.setForceSetPasswordReason.mockResolvedValue(undefined);
-
-      userDecryptionOptionsSubject.next(new UserDecryptionOptions({ hasMasterPassword: true }));
-      userDecryptionOptionsService.setUserDecryptionOptions.mockResolvedValue(undefined);
-      kdfConfigService.setKdfConfig.mockResolvedValue(undefined);
-      keyService.setUserKey.mockResolvedValue(undefined);
-
-      keyService.setPrivateKey.mockResolvedValue(undefined);
-
-      masterPasswordService.setMasterKeyHash.mockResolvedValue(undefined);
-    }
-
-    function setupResetPasswordAutoEnrollMocks(organizationKeysExist = true) {
-      if (organizationKeysExist) {
-        organizationApiService.getKeys.mockResolvedValue(organizationKeys);
-      } else {
-        organizationApiService.getKeys.mockResolvedValue(null);
-        return;
-      }
-
-      keyService.userKey$.mockReturnValue(of(userKey));
-      encryptService.encapsulateKeyUnsigned.mockResolvedValue(userKeyEncString);
-
-      organizationUserApiService.putOrganizationUserResetPasswordEnrollment.mockResolvedValue(
-        undefined,
-      );
-    }
-
-    it("should set password successfully (given a user key)", async () => {
-      // Arrange
-      setupSetPasswordMocks();
-
-      // Act
-      await sut.setPassword(credentials);
-
-      // Assert
-      expect(masterPasswordApiService.setPassword).toHaveBeenCalledWith(setPasswordRequest);
-    });
-
-    it("should set password successfully (given no user key)", async () => {
-      // Arrange
-      setupSetPasswordMocks(false);
-
-      // Act
-      await sut.setPassword(credentials);
-
-      // Assert
-      expect(masterPasswordApiService.setPassword).toHaveBeenCalledWith(setPasswordRequest);
-    });
-
-    it("should handle reset password auto enroll", async () => {
-      // Arrange
-      credentials.resetPasswordAutoEnroll = true;
-
-      setupSetPasswordMocks();
-      setupResetPasswordAutoEnrollMocks();
-
-      // Act
-      await sut.setPassword(credentials);
-
-      // Assert
-      expect(masterPasswordApiService.setPassword).toHaveBeenCalledWith(setPasswordRequest);
-      expect(organizationApiService.getKeys).toHaveBeenCalledWith(orgId);
-      expect(encryptService.encapsulateKeyUnsigned).toHaveBeenCalledWith(userKey, orgPublicKey);
-      expect(
-        organizationUserApiService.putOrganizationUserResetPasswordEnrollment,
-      ).toHaveBeenCalled();
-    });
-
-    it("when handling reset password auto enroll, it should throw an error if organization keys are not found", async () => {
-      // Arrange
-      credentials.resetPasswordAutoEnroll = true;
-
-      setupSetPasswordMocks();
-      setupResetPasswordAutoEnrollMocks(false);
-
-      // Act and Assert
-      await expect(sut.setPassword(credentials)).rejects.toThrow();
-      expect(
-        organizationUserApiService.putOrganizationUserResetPasswordEnrollment,
-      ).not.toHaveBeenCalled();
-    });
-  });
-});

libs/auth/src/angular/set-password-jit/default-set-password-jit.service.ts

@@ -1,176 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { firstValueFrom } from "rxjs";
-
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
-// eslint-disable-next-line no-restricted-imports
-import {
-  OrganizationUserApiService,
-  OrganizationUserResetPasswordEnrollmentRequest,
-} from "@bitwarden/admin-console/common";
-import { InternalUserDecryptionOptionsServiceAbstraction } from "@bitwarden/auth/common";
-import { OrganizationApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/organization/organization-api.service.abstraction";
-import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/master-password-api.service.abstraction";
-import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
-import { SetPasswordRequest } from "@bitwarden/common/auth/models/request/set-password.request";
-import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { KeysRequest } from "@bitwarden/common/models/request/keys.request";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
-import { UserId } from "@bitwarden/common/types/guid";
-import { MasterKey, UserKey } from "@bitwarden/common/types/key";
-import { KdfConfigService, KeyService, KdfConfig } from "@bitwarden/key-management";
-
-import {
-  SetPasswordCredentials,
-  SetPasswordJitService,
-} from "./set-password-jit.service.abstraction";
-
-export class DefaultSetPasswordJitService implements SetPasswordJitService {
-  constructor(
-    protected encryptService: EncryptService,
-    protected i18nService: I18nService,
-    protected kdfConfigService: KdfConfigService,
-    protected keyService: KeyService,
-    protected masterPasswordApiService: MasterPasswordApiService,
-    protected masterPasswordService: InternalMasterPasswordServiceAbstraction,
-    protected organizationApiService: OrganizationApiServiceAbstraction,
-    protected organizationUserApiService: OrganizationUserApiService,
-    protected userDecryptionOptionsService: InternalUserDecryptionOptionsServiceAbstraction,
-  ) {}
-
-  async setPassword(credentials: SetPasswordCredentials): Promise<void> {
-    const {
-      newMasterKey,
-      newServerMasterKeyHash,
-      newLocalMasterKeyHash,
-      newPasswordHint,
-      kdfConfig,
-      orgSsoIdentifier,
-      orgId,
-      resetPasswordAutoEnroll,
-      userId,
-    } = credentials;
-
-    for (const [key, value] of Object.entries(credentials)) {
-      if (value == null) {
-        throw new Error(`${key} not found. Could not set password.`);
-      }
-    }
-
-    const protectedUserKey = await this.makeProtectedUserKey(newMasterKey, userId);
-    if (protectedUserKey == null) {
-      throw new Error("protectedUserKey not found. Could not set password.");
-    }
-
-    // Since this is an existing JIT provisioned user in a MP encryption org setting first password,
-    // they will not already have a user asymmetric key pair so we must create it for them.
-    const [keyPair, keysRequest] = await this.makeKeyPairAndRequest(protectedUserKey);
-
-    const request = new SetPasswordRequest(
-      newServerMasterKeyHash,
-      protectedUserKey[1].encryptedString,
-      newPasswordHint,
-      orgSsoIdentifier,
-      keysRequest,
-      kdfConfig.kdfType,
-      kdfConfig.iterations,
-    );
-
-    await this.masterPasswordApiService.setPassword(request);
-
-    // Clear force set password reason to allow navigation back to vault.
-    await this.masterPasswordService.setForceSetPasswordReason(ForceSetPasswordReason.None, userId);
-
-    // User now has a password so update account decryption options in state
-    await this.updateAccountDecryptionProperties(newMasterKey, kdfConfig, protectedUserKey, userId);
-
-    await this.keyService.setPrivateKey(keyPair[1].encryptedString, userId);
-
-    await this.masterPasswordService.setMasterKeyHash(newLocalMasterKeyHash, userId);
-
-    if (resetPasswordAutoEnroll) {
-      await this.handleResetPasswordAutoEnroll(newServerMasterKeyHash, orgId, userId);
-    }
-  }
-
-  private async makeProtectedUserKey(
-    masterKey: MasterKey,
-    userId: UserId,
-  ): Promise<[UserKey, EncString]> {
-    let protectedUserKey: [UserKey, EncString] = null;
-
-    const userKey = await firstValueFrom(this.keyService.userKey$(userId));
-
-    if (userKey == null) {
-      protectedUserKey = await this.keyService.makeUserKey(masterKey);
-    } else {
-      protectedUserKey = await this.keyService.encryptUserKeyWithMasterKey(masterKey);
-    }
-
-    return protectedUserKey;
-  }
-
-  private async makeKeyPairAndRequest(
-    protectedUserKey: [UserKey, EncString],
-  ): Promise<[[string, EncString], KeysRequest]> {
-    const keyPair = await this.keyService.makeKeyPair(protectedUserKey[0]);
-    if (keyPair == null) {
-      throw new Error("keyPair not found. Could not set password.");
-    }
-    const keysRequest = new KeysRequest(keyPair[0], keyPair[1].encryptedString);
-
-    return [keyPair, keysRequest];
-  }
-
-  private async updateAccountDecryptionProperties(
-    masterKey: MasterKey,
-    kdfConfig: KdfConfig,
-    protectedUserKey: [UserKey, EncString],
-    userId: UserId,
-  ) {
-    const userDecryptionOpts = await firstValueFrom(
-      this.userDecryptionOptionsService.userDecryptionOptions$,
-    );
-    userDecryptionOpts.hasMasterPassword = true;
-    await this.userDecryptionOptionsService.setUserDecryptionOptions(userDecryptionOpts);
-    await this.kdfConfigService.setKdfConfig(userId, kdfConfig);
-    await this.masterPasswordService.setMasterKey(masterKey, userId);
-    await this.keyService.setUserKey(protectedUserKey[0], userId);
-  }
-
-  private async handleResetPasswordAutoEnroll(
-    masterKeyHash: string,
-    orgId: string,
-    userId: UserId,
-  ) {
-    const organizationKeys = await this.organizationApiService.getKeys(orgId);
-
-    if (organizationKeys == null) {
-      throw new Error(this.i18nService.t("resetPasswordOrgKeysError"));
-    }
-
-    const publicKey = Utils.fromB64ToArray(organizationKeys.publicKey);
-
-    // RSA Encrypt user key with organization public key
-    const userKey = await firstValueFrom(this.keyService.userKey$(userId));
-
-    if (userKey == null) {
-      throw new Error("userKey not found. Could not handle reset password auto enroll.");
-    }
-
-    const encryptedUserKey = await this.encryptService.encapsulateKeyUnsigned(userKey, publicKey);
-
-    const resetRequest = new OrganizationUserResetPasswordEnrollmentRequest();
-    resetRequest.masterPasswordHash = masterKeyHash;
-    resetRequest.resetPasswordKey = encryptedUserKey.encryptedString;
-
-    await this.organizationUserApiService.putOrganizationUserResetPasswordEnrollment(
-      orgId,
-      userId,
-      resetRequest,
-    );
-  }
-}

libs/auth/src/angular/set-password-jit/set-password-jit.component.html

@@ -1,24 +0,0 @@
-<ng-container *ngIf="syncLoading">
-  <i class="bwi bwi-spinner bwi-spin tw-mr-2" title="{{ 'loading' | i18n }}" aria-hidden="true"></i>
-  {{ "loading" | i18n }}
-</ng-container>
-
-<ng-container *ngIf="!syncLoading">
-  <app-callout
-    type="warning"
-    title="{{ 'resetPasswordPolicyAutoEnroll' | i18n }}"
-    *ngIf="resetPasswordAutoEnroll"
-  >
-    {{ "resetPasswordAutoEnrollInviteWarning" | i18n }}
-  </app-callout>
-
-  <auth-input-password
-    [flow]="inputPasswordFlow"
-    [email]="email"
-    [userId]="userId"
-    [loading]="submitting"
-    [masterPasswordPolicyOptions]="masterPasswordPolicyOptions"
-    [primaryButtonText]="{ key: 'createAccount' }"
-    (onPasswordFormSubmit)="handlePasswordFormSubmit($event)"
-  ></auth-input-password>
-</ng-container>

libs/auth/src/angular/set-password-jit/set-password-jit.component.ts

@@ -1,135 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { CommonModule } from "@angular/common";
-import { Component, OnInit } from "@angular/core";
-import { ActivatedRoute, Router } from "@angular/router";
-import { firstValueFrom } from "rxjs";
-
-import { JslibModule } from "@bitwarden/angular/jslib.module";
-import { OrganizationApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/organization/organization-api.service.abstraction";
-import { PolicyApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/policy/policy-api.service.abstraction";
-import { MasterPasswordPolicyOptions } from "@bitwarden/common/admin-console/models/domain/master-password-policy-options";
-import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { ValidationService } from "@bitwarden/common/platform/abstractions/validation.service";
-import { UserId } from "@bitwarden/common/types/guid";
-import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
-
-// FIXME: remove `src` and fix import
-// eslint-disable-next-line no-restricted-imports
-import { ToastService } from "../../../../components/src/toast";
-import {
-  InputPasswordComponent,
-  InputPasswordFlow,
-} from "../input-password/input-password.component";
-import { PasswordInputResult } from "../input-password/password-input-result";
-
-import {
-  SetPasswordCredentials,
-  SetPasswordJitService,
-} from "./set-password-jit.service.abstraction";
-
-@Component({
-  selector: "auth-set-password-jit",
-  templateUrl: "set-password-jit.component.html",
-  imports: [CommonModule, InputPasswordComponent, JslibModule],
-})
-export class SetPasswordJitComponent implements OnInit {
-  protected inputPasswordFlow = InputPasswordFlow.SetInitialPasswordAuthedUser;
-  protected email: string;
-  protected masterPasswordPolicyOptions: MasterPasswordPolicyOptions;
-  protected orgId: string;
-  protected orgSsoIdentifier: string;
-  protected resetPasswordAutoEnroll: boolean;
-  protected submitting = false;
-  protected syncLoading = true;
-  protected userId: UserId;
-
-  constructor(
-    private accountService: AccountService,
-    private activatedRoute: ActivatedRoute,
-    private i18nService: I18nService,
-    private organizationApiService: OrganizationApiServiceAbstraction,
-    private policyApiService: PolicyApiServiceAbstraction,
-    private router: Router,
-    private setPasswordJitService: SetPasswordJitService,
-    private syncService: SyncService,
-    private toastService: ToastService,
-    private validationService: ValidationService,
-  ) {}
-
-  async ngOnInit() {
-    const activeAccount = await firstValueFrom(this.accountService.activeAccount$);
-    this.userId = activeAccount?.id;
-    this.email = activeAccount?.email;
-
-    await this.syncService.fullSync(true);
-    this.syncLoading = false;
-
-    await this.handleQueryParams();
-  }
-
-  private async handleQueryParams() {
-    const qParams = await firstValueFrom(this.activatedRoute.queryParams);
-
-    if (qParams.identifier != null) {
-      try {
-        this.orgSsoIdentifier = qParams.identifier;
-
-        const autoEnrollStatus = await this.organizationApiService.getAutoEnrollStatus(
-          this.orgSsoIdentifier,
-        );
-        this.orgId = autoEnrollStatus.id;
-        this.resetPasswordAutoEnroll = autoEnrollStatus.resetPasswordEnabled;
-        this.masterPasswordPolicyOptions =
-          await this.policyApiService.getMasterPasswordPolicyOptsForOrgUser(autoEnrollStatus.id);
-      } catch {
-        this.toastService.showToast({
-          variant: "error",
-          title: null,
-          message: this.i18nService.t("errorOccurred"),
-        });
-      }
-    }
-  }
-
-  protected async handlePasswordFormSubmit(passwordInputResult: PasswordInputResult) {
-    this.submitting = true;
-
-    const credentials: SetPasswordCredentials = {
-      newMasterKey: passwordInputResult.newMasterKey,
-      newServerMasterKeyHash: passwordInputResult.newServerMasterKeyHash,
-      newLocalMasterKeyHash: passwordInputResult.newLocalMasterKeyHash,
-      newPasswordHint: passwordInputResult.newPasswordHint,
-      kdfConfig: passwordInputResult.kdfConfig,
-      orgSsoIdentifier: this.orgSsoIdentifier,
-      orgId: this.orgId,
-      resetPasswordAutoEnroll: this.resetPasswordAutoEnroll,
-      userId: this.userId,
-    };
-
-    try {
-      await this.setPasswordJitService.setPassword(credentials);
-    } catch (e) {
-      this.validationService.showError(e);
-      this.submitting = false;
-      return;
-    }
-
-    this.toastService.showToast({
-      variant: "success",
-      title: null,
-      message: this.i18nService.t("accountSuccessfullyCreated"),
-    });
-
-    this.toastService.showToast({
-      variant: "success",
-      title: null,
-      message: this.i18nService.t("inviteAccepted"),
-    });
-
-    this.submitting = false;
-
-    await this.router.navigate(["vault"]);
-  }
-}

libs/auth/src/angular/set-password-jit/set-password-jit.service.abstraction.ts

@@ -1,35 +0,0 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { UserId } from "@bitwarden/common/types/guid";
-import { MasterKey } from "@bitwarden/common/types/key";
-import { KdfConfig } from "@bitwarden/key-management";
-
-export interface SetPasswordCredentials {
-  newMasterKey: MasterKey;
-  newServerMasterKeyHash: string;
-  newLocalMasterKeyHash: string;
-  newPasswordHint: string;
-  kdfConfig: KdfConfig;
-  orgSsoIdentifier: string;
-  orgId: string;
-  resetPasswordAutoEnroll: boolean;
-  userId: UserId;
-}
-
-/**
- * This service handles setting a password for a "just-in-time" provisioned user.
- *
- * A "just-in-time" (JIT) provisioned user is a user who does not have a registered account at the
- * time they first click "Login with SSO". Once they click "Login with SSO" we register the account on
- * the fly ("just-in-time").
- */
-export abstract class SetPasswordJitService {
-  /**
-   * Sets the password for a JIT provisioned user.
-   *
-   * @param credentials An object of the credentials needed to set the password for a JIT provisioned user
-   * @throws If any property on the `credentials` object is null or undefined, or if a protectedUserKey
-   *         or newKeyPair could not be created.
-   */
-  setPassword: (credentials: SetPasswordCredentials) => Promise<void>;
-}

libs/auth/src/angular/sso/sso.component.ts

@@ -23,12 +23,10 @@ import { AuthResult } from "@bitwarden/common/auth/models/domain/auth-result";
 import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
 import { SsoPreValidateResponse } from "@bitwarden/common/auth/models/response/sso-pre-validate.response";
 import { ClientType, HttpStatusCode } from "@bitwarden/common/enums";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
 import { ListResponse } from "@bitwarden/common/models/response/list.response";
-import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -118,7 +116,6 @@ export class SsoComponent implements OnInit {
     private toastService: ToastService,
     private ssoComponentService: SsoComponentService,
     private loginSuccessHandlerService: LoginSuccessHandlerService,
-    private configService: ConfigService,
   ) {
     environmentService.environment$.pipe(takeUntilDestroyed()).subscribe((env) => {
       this.redirectUri = env.getWebVaultUrl() + "/sso-connector.html";
@@ -534,11 +531,7 @@ export class SsoComponent implements OnInit {
   }
 
   private async handleChangePasswordRequired(orgIdentifier: string) {
-    const isSetInitialPasswordRefactorFlagOn = await this.configService.getFeatureFlag(
-      FeatureFlag.PM16117_SetInitialPasswordRefactor,
-    );
-    const route = isSetInitialPasswordRefactorFlagOn ? "set-initial-password" : "set-password-jit";
-
+    const route = "set-initial-password";
     await this.router.navigate([route], {
       queryParams: {
         identifier: orgIdentifier,

libs/auth/src/angular/two-factor-auth/two-factor-auth.component.spec.ts

@@ -2,7 +2,7 @@ import { Component } from "@angular/core";
 import { ComponentFixture, TestBed } from "@angular/core/testing";
 import { ActivatedRoute, Router, convertToParamMap } from "@angular/router";
 import { mock, MockProxy } from "jest-mock-extended";
-import { BehaviorSubject } from "rxjs";
+import { BehaviorSubject, of } from "rxjs";
 
 import { WINDOW } from "@bitwarden/angular/services/injection-tokens";
 import {
@@ -24,8 +24,10 @@ import { AuthenticationType } from "@bitwarden/common/auth/enums/authentication-
 import { AuthResult } from "@bitwarden/common/auth/models/domain/auth-result";
 import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
 import { TokenTwoFactorRequest } from "@bitwarden/common/auth/models/request/identity-token/token-two-factor.request";
-import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { FakeMasterPasswordService } from "@bitwarden/common/key-management/master-password/services/fake-master-password.service";
+import {
+  InternalMasterPasswordServiceAbstraction,
+  MasterPasswordServiceAbstraction,
+} from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
@@ -66,7 +68,7 @@ describe("TwoFactorAuthComponent", () => {
   let mockLoginEmailService: MockProxy<LoginEmailServiceAbstraction>;
   let mockUserDecryptionOptionsService: MockProxy<UserDecryptionOptionsServiceAbstraction>;
   let mockSsoLoginService: MockProxy<SsoLoginServiceAbstraction>;
-  let mockMasterPasswordService: FakeMasterPasswordService;
+  let mockMasterPasswordService: MockProxy<InternalMasterPasswordServiceAbstraction>;
   let mockAccountService: FakeAccountService;
   let mockDialogService: MockProxy<DialogService>;
   let mockToastService: MockProxy<ToastService>;
@@ -107,7 +109,7 @@ describe("TwoFactorAuthComponent", () => {
     mockUserDecryptionOptionsService = mock<UserDecryptionOptionsServiceAbstraction>();
     mockSsoLoginService = mock<SsoLoginServiceAbstraction>();
     mockAccountService = mockAccountServiceWith(userId);
-    mockMasterPasswordService = new FakeMasterPasswordService();
+    mockMasterPasswordService = mock<InternalMasterPasswordServiceAbstraction>();
     mockDialogService = mock<DialogService>();
     mockToastService = mock<ToastService>();
     mockTwoFactorAuthCompService = mock<TwoFactorAuthComponentService>();
@@ -212,6 +214,7 @@ describe("TwoFactorAuthComponent", () => {
         },
         { provide: AuthService, useValue: mockAuthService },
         { provide: ConfigService, useValue: mockConfigService },
+        { provide: MasterPasswordServiceAbstraction, useValue: mockMasterPasswordService },
       ],
     });
 
@@ -267,54 +270,16 @@ describe("TwoFactorAuthComponent", () => {
             selectedUserDecryptionOptions.next(mockUserDecryptionOpts.noMasterPassword);
           });
 
-          describe("Given the PM16117_SetInitialPasswordRefactor feature flag is ON", () => {
-            it("navigates to the /set-initial-password route when user doesn't have a MP and key connector isn't enabled", async () => {
-              // Arrange
-              mockConfigService.getFeatureFlag.mockResolvedValue(true);
-
-              // Act
-              await component.submit("testToken");
-
-              // Assert
-              expect(mockRouter.navigate).toHaveBeenCalledTimes(1);
-              expect(mockRouter.navigate).toHaveBeenCalledWith(["set-initial-password"], {
-                queryParams: {
-                  identifier: component.orgSsoIdentifier,
-                },
-              });
-            });
-          });
-
-          describe("Given the PM16117_SetInitialPasswordRefactor feature flag is OFF", () => {
-            it("navigates to the /set-password route when user doesn't have a MP and key connector isn't enabled", async () => {
-              // Arrange
-              mockConfigService.getFeatureFlag.mockResolvedValue(false);
-
-              // Act
-              await component.submit("testToken");
-
-              // Assert
-              expect(mockRouter.navigate).toHaveBeenCalledTimes(1);
-              expect(mockRouter.navigate).toHaveBeenCalledWith(["set-password"], {
-                queryParams: {
-                  identifier: component.orgSsoIdentifier,
-                },
-              });
-            });
-          });
-        });
-
-        describe("Given the PM16117_SetInitialPasswordRefactor feature flag is ON", () => {
-          it("does not navigate to the /set-initial-password route when the user has key connector even if user has no master password", async () => {
+          it("navigates to the /set-initial-password route when user doesn't have a MP and key connector isn't enabled", async () => {
+            // Arrange
             mockConfigService.getFeatureFlag.mockResolvedValue(true);
 
-            selectedUserDecryptionOptions.next(
-              mockUserDecryptionOpts.noMasterPasswordWithKeyConnector,
-            );
+            // Act
+            await component.submit("testToken");
 
-            await component.submit(token, remember);
-
-            expect(mockRouter.navigate).not.toHaveBeenCalledWith(["set-initial-password"], {
+            // Assert
+            expect(mockRouter.navigate).toHaveBeenCalledTimes(1);
+            expect(mockRouter.navigate).toHaveBeenCalledWith(["set-initial-password"], {
               queryParams: {
                 identifier: component.orgSsoIdentifier,
               },
@@ -322,21 +287,19 @@ describe("TwoFactorAuthComponent", () => {
           });
         });
 
-        describe("Given the PM16117_SetInitialPasswordRefactor feature flag is OFF", () => {
-          it("does not navigate to the /set-password route when the user has key connector even if user has no master password", async () => {
-            mockConfigService.getFeatureFlag.mockResolvedValue(false);
+        it("does not navigate to the /set-initial-password route when the user has key connector even if user has no master password", async () => {
+          mockConfigService.getFeatureFlag.mockResolvedValue(true);
 
-            selectedUserDecryptionOptions.next(
-              mockUserDecryptionOpts.noMasterPasswordWithKeyConnector,
-            );
+          selectedUserDecryptionOptions.next(
+            mockUserDecryptionOpts.noMasterPasswordWithKeyConnector,
+          );
 
-            await component.submit(token, remember);
+          await component.submit(token, remember);
 
-            expect(mockRouter.navigate).not.toHaveBeenCalledWith(["set-password"], {
-              queryParams: {
-                identifier: component.orgSsoIdentifier,
-              },
-            });
+          expect(mockRouter.navigate).not.toHaveBeenCalledWith(["set-initial-password"], {
+            queryParams: {
+              identifier: component.orgSsoIdentifier,
+            },
           });
         });
       });
@@ -344,6 +307,9 @@ describe("TwoFactorAuthComponent", () => {
       it("navigates to the component's defined success route (vault is default) when the login is successful", async () => {
         mockLoginStrategyService.logInTwoFactor.mockResolvedValue(new AuthResult());
         mockAuthService.activeAccountStatus$ = new BehaviorSubject(AuthenticationStatus.Unlocked);
+        mockMasterPasswordService.forceSetPasswordReason$.mockReturnValue(
+          of(ForceSetPasswordReason.None),
+        );
 
         // Act
         await component.submit("testToken");
@@ -409,7 +375,7 @@ describe("TwoFactorAuthComponent", () => {
             await component.submit(token, remember);
 
             // Assert
-            expect(mockMasterPasswordService.mock.setForceSetPasswordReason).toHaveBeenCalledWith(
+            expect(mockMasterPasswordService.setForceSetPasswordReason).toHaveBeenCalledWith(
               ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission,
               userId,
             );

libs/auth/src/angular/two-factor-auth/two-factor-auth.component.ts

@@ -17,7 +17,6 @@ import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { WINDOW } from "@bitwarden/angular/services/injection-tokens";
 import {
   LoginStrategyServiceAbstraction,
-  LoginEmailServiceAbstraction,
   UserDecryptionOptionsServiceAbstraction,
   TrustedDeviceUserDecryptionOption,
   UserDecryptionOptions,
@@ -32,9 +31,7 @@ import { TwoFactorProviderType } from "@bitwarden/common/auth/enums/two-factor-p
 import { AuthResult } from "@bitwarden/common/auth/models/domain/auth-result";
 import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
 import { TokenTwoFactorRequest } from "@bitwarden/common/auth/models/request/identity-token/token-two-factor.request";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
-import { ConfigService } from "@bitwarden/common/platform/abstractions/config/config.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
@@ -156,7 +153,6 @@ export class TwoFactorAuthComponent implements OnInit, OnDestroy {
     private activatedRoute: ActivatedRoute,
     private logService: LogService,
     private twoFactorService: TwoFactorService,
-    private loginEmailService: LoginEmailServiceAbstraction,
     private userDecryptionOptionsService: UserDecryptionOptionsServiceAbstraction,
     private ssoLoginService: SsoLoginServiceAbstraction,
     private masterPasswordService: InternalMasterPasswordServiceAbstraction,
@@ -171,7 +167,6 @@ export class TwoFactorAuthComponent implements OnInit, OnDestroy {
     private loginSuccessHandlerService: LoginSuccessHandlerService,
     private twoFactorAuthComponentCacheService: TwoFactorAuthComponentCacheService,
     private authService: AuthService,
-    private configService: ConfigService,
   ) {}
 
   async ngOnInit() {
@@ -507,19 +502,15 @@ export class TwoFactorAuthComponent implements OnInit, OnDestroy {
     }
 
     // TODO: PM-22663 use the new service to handle routing.
-    if (
-      await this.configService.getFeatureFlag(FeatureFlag.PM16117_ChangeExistingPasswordRefactor)
-    ) {
-      const forceSetPasswordReason = await firstValueFrom(
-        this.masterPasswordService.forceSetPasswordReason$(userId),
-      );
+    const forceSetPasswordReason = await firstValueFrom(
+      this.masterPasswordService.forceSetPasswordReason$(userId),
+    );
 
-      if (
-        forceSetPasswordReason === ForceSetPasswordReason.WeakMasterPassword ||
-        forceSetPasswordReason === ForceSetPasswordReason.AdminForcePasswordReset
-      ) {
-        return "change-password";
-      }
+    if (
+      forceSetPasswordReason === ForceSetPasswordReason.WeakMasterPassword ||
+      forceSetPasswordReason === ForceSetPasswordReason.AdminForcePasswordReset
+    ) {
+      return "change-password";
     }
 
     return "vault";
@@ -575,11 +566,7 @@ export class TwoFactorAuthComponent implements OnInit, OnDestroy {
   }
 
   private async handleChangePasswordRequired(orgIdentifier: string | undefined) {
-    const isSetInitialPasswordRefactorFlagOn = await this.configService.getFeatureFlag(
-      FeatureFlag.PM16117_SetInitialPasswordRefactor,
-    );
-    const route = isSetInitialPasswordRefactorFlagOn ? "set-initial-password" : "set-password";
-
+    const route = "set-initial-password";
     await this.router.navigate([route], {
       queryParams: {
         identifier: orgIdentifier,

libs/auth/src/common/abstractions/auth-request.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { AdminAuthRequestStorable } from "@bitwarden/common/auth/models/domain/admin-auth-req-storable";
@@ -10,20 +8,20 @@ import { UserKey, MasterKey } from "@bitwarden/common/types/key";
 
 export abstract class AuthRequestServiceAbstraction {
   /** Emits an auth request id when an auth request has been approved. */
-  authRequestPushNotification$: Observable<string>;
+  abstract authRequestPushNotification$: Observable<string>;
 
   /**
    * Emits when a login has been approved by an admin. This emission is specifically for the
    * purpose of notifying the consuming component to display a toast informing the user.
    */
-  adminLoginApproved$: Observable<void>;
+  abstract adminLoginApproved$: Observable<void>;
 
   /**
    * Returns an admin auth request for the given user if it exists.
    * @param userId The user id.
    * @throws If `userId` is not provided.
    */
-  abstract getAdminAuthRequest: (userId: UserId) => Promise<AdminAuthRequestStorable | null>;
+  abstract getAdminAuthRequest(userId: UserId): Promise<AdminAuthRequestStorable | null>;
   /**
    * Sets an admin auth request for the given user.
    * Note: use {@link clearAdminAuthRequest} to clear the request.
@@ -31,16 +29,16 @@ export abstract class AuthRequestServiceAbstraction {
    * @param userId The user id.
    * @throws If `authRequest` or `userId` is not provided.
    */
-  abstract setAdminAuthRequest: (
+  abstract setAdminAuthRequest(
     authRequest: AdminAuthRequestStorable,
     userId: UserId,
-  ) => Promise<void>;
+  ): Promise<void>;
   /**
    * Clears an admin auth request for the given user.
    * @param userId The user id.
    * @throws If `userId` is not provided.
    */
-  abstract clearAdminAuthRequest: (userId: UserId) => Promise<void>;
+  abstract clearAdminAuthRequest(userId: UserId): Promise<void>;
   /**
    * Gets a list of standard pending auth requests for the user.
    * @returns An observable of an array of auth request.
@@ -61,42 +59,42 @@ export abstract class AuthRequestServiceAbstraction {
    * approval was successful.
    * @throws If the auth request is missing an id or key.
    */
-  abstract approveOrDenyAuthRequest: (
+  abstract approveOrDenyAuthRequest(
     approve: boolean,
     authRequest: AuthRequestResponse,
-  ) => Promise<AuthRequestResponse>;
+  ): Promise<AuthRequestResponse>;
   /**
    * Sets the `UserKey` from an auth request. Auth request must have a `UserKey`.
    * @param authReqResponse The auth request.
    * @param authReqPrivateKey The private key corresponding to the public key sent in the auth request.
    * @param userId The ID of the user for whose account we will set the key.
    */
-  abstract setUserKeyAfterDecryptingSharedUserKey: (
+  abstract setUserKeyAfterDecryptingSharedUserKey(
     authReqResponse: AuthRequestResponse,
     authReqPrivateKey: ArrayBuffer,
     userId: UserId,
-  ) => Promise<void>;
+  ): Promise<void>;
   /**
    * Sets the `MasterKey` and `MasterKeyHash` from an auth request. Auth request must have a `MasterKey` and `MasterKeyHash`.
    * @param authReqResponse The auth request.
    * @param authReqPrivateKey The private key corresponding to the public key sent in the auth request.
    * @param userId The ID of the user for whose account we will set the keys.
    */
-  abstract setKeysAfterDecryptingSharedMasterKeyAndHash: (
+  abstract setKeysAfterDecryptingSharedMasterKeyAndHash(
     authReqResponse: AuthRequestResponse,
     authReqPrivateKey: ArrayBuffer,
     userId: UserId,
-  ) => Promise<void>;
+  ): Promise<void>;
   /**
    * Decrypts a `UserKey` from a public key encrypted `UserKey`.
    * @param pubKeyEncryptedUserKey The public key encrypted `UserKey`.
    * @param privateKey The private key corresponding to the public key used to encrypt the `UserKey`.
    * @returns The decrypted `UserKey`.
    */
-  abstract decryptPubKeyEncryptedUserKey: (
+  abstract decryptPubKeyEncryptedUserKey(
     pubKeyEncryptedUserKey: string,
     privateKey: ArrayBuffer,
-  ) => Promise<UserKey>;
+  ): Promise<UserKey>;
   /**
    * Decrypts a `MasterKey` and `MasterKeyHash` from a public key encrypted `MasterKey` and `MasterKeyHash`.
    * @param pubKeyEncryptedMasterKey The public key encrypted `MasterKey`.
@@ -104,18 +102,18 @@ export abstract class AuthRequestServiceAbstraction {
    * @param privateKey The private key corresponding to the public key used to encrypt the `MasterKey` and `MasterKeyHash`.
    * @returns The decrypted `MasterKey` and `MasterKeyHash`.
    */
-  abstract decryptPubKeyEncryptedMasterKeyAndHash: (
+  abstract decryptPubKeyEncryptedMasterKeyAndHash(
     pubKeyEncryptedMasterKey: string,
     pubKeyEncryptedMasterKeyHash: string,
     privateKey: ArrayBuffer,
-  ) => Promise<{ masterKey: MasterKey; masterKeyHash: string }>;
+  ): Promise<{ masterKey: MasterKey; masterKeyHash: string }>;
 
   /**
    * Handles incoming auth request push notifications.
    * @param notification push notification.
    * @remark We should only be receiving approved push notifications to prevent enumeration.
    */
-  abstract sendAuthRequestPushNotification: (notification: AuthRequestPushNotification) => void;
+  abstract sendAuthRequestPushNotification(notification: AuthRequestPushNotification): void;
 
   /**
    * Creates a dash-delimited fingerprint for use in confirming the `AuthRequest` between the requesting and approving device.

libs/auth/src/common/abstractions/login-strategy.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { AuthenticationType } from "@bitwarden/common/auth/enums/authentication-type";
@@ -20,60 +18,60 @@ export abstract class LoginStrategyServiceAbstraction {
    * The current strategy being used to authenticate.
    * Emits null if the session has timed out.
    */
-  currentAuthType$: Observable<AuthenticationType | null>;
+  abstract currentAuthType$: Observable<AuthenticationType | null>;
   /**
    * If the login strategy uses the email address of the user, this
    * will return it. Otherwise, it will return null.
    */
-  getEmail: () => Promise<string | null>;
+  abstract getEmail(): Promise<string | null>;
   /**
    * If the user is logging in with a master password, this will return
    * the master password hash. Otherwise, it will return null.
    */
-  getMasterPasswordHash: () => Promise<string | null>;
+  abstract getMasterPasswordHash(): Promise<string | null>;
   /**
    * If the user is logging in with SSO, this will return
    * the email auth token. Otherwise, it will return null.
    * @see {@link SsoLoginStrategyData.ssoEmail2FaSessionToken}
    */
-  getSsoEmail2FaSessionToken: () => Promise<string | null>;
+  abstract getSsoEmail2FaSessionToken(): Promise<string | null>;
   /**
    * Returns the access code if the user is logging in with an
    * Auth Request. Otherwise, it will return null.
    */
-  getAccessCode: () => Promise<string | null>;
+  abstract getAccessCode(): Promise<string | null>;
   /**
    * Returns the auth request ID if the user is logging in with an
    * Auth Request. Otherwise, it will return null.
    */
-  getAuthRequestId: () => Promise<string | null>;
+  abstract getAuthRequestId(): Promise<string | null>;
   /**
    * Sends a token request to the server using the provided credentials.
    */
-  logIn: (
+  abstract logIn(
     credentials:
       | UserApiLoginCredentials
       | PasswordLoginCredentials
       | SsoLoginCredentials
       | AuthRequestLoginCredentials
       | WebAuthnLoginCredentials,
-  ) => Promise<AuthResult>;
+  ): Promise<AuthResult>;
   /**
    * Sends a token request to the server with the provided two factor token.
    * This uses data stored from {@link LoginStrategyServiceAbstraction.logIn}, so that must be called first.
    * Returns an error if no session data is found.
    */
-  logInTwoFactor: (twoFactor: TokenTwoFactorRequest) => Promise<AuthResult>;
+  abstract logInTwoFactor(twoFactor: TokenTwoFactorRequest): Promise<AuthResult>;
   /**
    * Creates a master key from the provided master password and email.
    */
-  makePreloginKey: (masterPassword: string, email: string) => Promise<MasterKey>;
+  abstract makePreloginKey(masterPassword: string, email: string): Promise<MasterKey>;
   /**
    * Emits true if the authentication session has expired.
    */
-  authenticationSessionTimeout$: Observable<boolean>;
+  abstract get authenticationSessionTimeout$(): Observable<boolean>;
   /**
    * Sends a token request to the server with the provided device verification OTP.
    */
-  logInNewDeviceVerification: (deviceVerificationOtp: string) => Promise<AuthResult>;
+  abstract logInNewDeviceVerification(deviceVerificationOtp: string): Promise<AuthResult>;
 }

libs/auth/src/common/login-strategies/login.strategy.ts

@@ -325,7 +325,7 @@ export abstract class LoginStrategy {
 
   protected async createKeyPairForOldAccount(userId: UserId) {
     try {
-      const userKey = await this.keyService.getUserKeyWithLegacySupport(userId);
+      const userKey = await this.keyService.getUserKey(userId);
       const [publicKey, privateKey] = await this.keyService.makeKeyPair(userKey);
       if (!privateKey.encryptedString) {
         throw new Error("Failed to create encrypted private key");

libs/auth/src/common/login-strategies/password-login.strategy.spec.ts

@@ -12,7 +12,6 @@ import { IdentityTokenResponse } from "@bitwarden/common/auth/models/response/id
 import { IdentityTwoFactorResponse } from "@bitwarden/common/auth/models/response/identity-two-factor.response";
 import { MasterPasswordPolicyResponse } from "@bitwarden/common/auth/models/response/master-password-policy.response";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions/account/billing-account-profile-state.service";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { FakeMasterPasswordService } from "@bitwarden/common/key-management/master-password/services/fake-master-password.service";
 import {
@@ -221,7 +220,10 @@ describe("PasswordLoginStrategy", () => {
 
     await passwordLoginStrategy.logIn(credentials);
 
-    expect(policyService.evaluateMasterPassword).not.toHaveBeenCalled();
+    expect(masterPasswordService.mock.setForceSetPasswordReason).not.toHaveBeenCalledWith(
+      ForceSetPasswordReason.WeakMasterPassword,
+      userId,
+    );
   });
 
   it("does not force the user to update their master password when it meets requirements", async () => {
@@ -230,7 +232,10 @@ describe("PasswordLoginStrategy", () => {
 
     await passwordLoginStrategy.logIn(credentials);
 
-    expect(policyService.evaluateMasterPassword).toHaveBeenCalled();
+    expect(masterPasswordService.mock.setForceSetPasswordReason).not.toHaveBeenCalledWith(
+      ForceSetPasswordReason.WeakMasterPassword,
+      userId,
+    );
   });
 
   it("when given master password policies as part of the login credentials from an org invite, it combines them with the token response policies to evaluate the user's password as weak", async () => {
@@ -242,12 +247,6 @@ describe("PasswordLoginStrategy", () => {
     policyService.evaluateMasterPassword.mockReturnValue(false);
     tokenService.decodeAccessToken.mockResolvedValue({ sub: userId });
 
-    jest
-      .spyOn(configService, "getFeatureFlag")
-      .mockImplementation((flag: FeatureFlag) =>
-        Promise.resolve(flag === FeatureFlag.PM16117_ChangeExistingPasswordRefactor),
-      );
-
     credentials.masterPasswordPoliciesFromOrgInvite = Object.assign(
       new MasterPasswordPolicyOptions(),
       {
@@ -296,9 +295,16 @@ describe("PasswordLoginStrategy", () => {
 
   it("forces the user to update their master password on successful login when it does not meet master password policy requirements", async () => {
     passwordStrengthService.getPasswordStrength.mockReturnValue({ score: 0 } as any);
-    policyService.evaluateMasterPassword.mockReturnValue(false);
     tokenService.decodeAccessToken.mockResolvedValue({ sub: userId });
 
+    const combinedMasterPasswordPolicyOptions = Object.assign(new MasterPasswordPolicyOptions(), {
+      enforceOnLogin: true,
+    });
+    policyService.combineMasterPasswordPolicyOptions.mockReturnValue(
+      combinedMasterPasswordPolicyOptions,
+    );
+    policyService.evaluateMasterPassword.mockReturnValue(false);
+
     await passwordLoginStrategy.logIn(credentials);
 
     expect(policyService.evaluateMasterPassword).toHaveBeenCalled();
@@ -330,9 +336,16 @@ describe("PasswordLoginStrategy", () => {
 
   it("forces the user to update their master password on successful 2FA login when it does not meet master password policy requirements", async () => {
     passwordStrengthService.getPasswordStrength.mockReturnValue({ score: 0 } as any);
-    policyService.evaluateMasterPassword.mockReturnValue(false);
     tokenService.decodeAccessToken.mockResolvedValue({ sub: userId });
 
+    const combinedMasterPasswordPolicyOptions = Object.assign(new MasterPasswordPolicyOptions(), {
+      enforceOnLogin: true,
+    });
+    policyService.combineMasterPasswordPolicyOptions.mockReturnValue(
+      combinedMasterPasswordPolicyOptions,
+    );
+    policyService.evaluateMasterPassword.mockReturnValue(false);
+
     const token2FAResponse = new IdentityTwoFactorResponse({
       TwoFactorProviders: ["0"],
       TwoFactorProviders2: { 0: null },

libs/auth/src/common/login-strategies/password-login.strategy.ts

@@ -12,7 +12,6 @@ import { TokenTwoFactorRequest } from "@bitwarden/common/auth/models/request/ide
 import { IdentityDeviceVerificationResponse } from "@bitwarden/common/auth/models/response/identity-device-verification.response";
 import { IdentityTokenResponse } from "@bitwarden/common/auth/models/response/identity-token.response";
 import { IdentityTwoFactorResponse } from "@bitwarden/common/auth/models/response/identity-two-factor.response";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { HashPurpose } from "@bitwarden/common/platform/enums";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { PasswordStrengthServiceAbstraction } from "@bitwarden/common/tools/password-strength";
@@ -171,35 +170,22 @@ export class PasswordLoginStrategy extends LoginStrategy {
       return;
     }
 
-    // The identity result can contain master password policies for the user's organizations
-    let masterPasswordPolicyOptions: MasterPasswordPolicyOptions | undefined;
+    // The identity result can contain master password policies for the user's organizations.
+    // Get the master password policy options from both the org invite and the identity response.
+    const masterPasswordPolicyOptions = this.policyService.combineMasterPasswordPolicyOptions(
+      credentials.masterPasswordPoliciesFromOrgInvite,
+      this.getMasterPasswordPolicyOptionsFromResponse(identityResponse),
+    );
 
+    // We deliberately do not check enforceOnLogin as existing users who are logging
+    // in after getting an org invite should always be forced to set a password that
+    // meets the org's policy. Org Invite -> Registration also works this way for
+    // new BW users as well.
     if (
-      await this.configService.getFeatureFlag(FeatureFlag.PM16117_ChangeExistingPasswordRefactor)
+      !credentials.masterPasswordPoliciesFromOrgInvite &&
+      !masterPasswordPolicyOptions?.enforceOnLogin
     ) {
-      // Get the master password policy options from both the org invite and the identity response.
-      masterPasswordPolicyOptions = this.policyService.combineMasterPasswordPolicyOptions(
-        credentials.masterPasswordPoliciesFromOrgInvite,
-        this.getMasterPasswordPolicyOptionsFromResponse(identityResponse),
-      );
-
-      // We deliberately do not check enforceOnLogin as existing users who are logging
-      // in after getting an org invite should always be forced to set a password that
-      // meets the org's policy. Org Invite -> Registration also works this way for
-      // new BW users as well.
-      if (
-        !credentials.masterPasswordPoliciesFromOrgInvite &&
-        !masterPasswordPolicyOptions?.enforceOnLogin
-      ) {
-        return;
-      }
-    } else {
-      masterPasswordPolicyOptions =
-        this.getMasterPasswordPolicyOptionsFromResponse(identityResponse);
-
-      if (!masterPasswordPolicyOptions?.enforceOnLogin) {
-        return;
-      }
+      return;
     }
 
     // If there is a policy active, evaluate the supplied password before its no longer in memory

libs/auth/src/common/login-strategies/sso-login.strategy.spec.ts

@@ -10,7 +10,6 @@ import { AuthRequestResponse } from "@bitwarden/common/auth/models/response/auth
 import { IdentityTokenResponse } from "@bitwarden/common/auth/models/response/identity-token.response";
 import { IUserDecryptionOptionsServerResponse } from "@bitwarden/common/auth/models/response/user-decryption-options/user-decryption-options.response";
 import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abstractions/account/billing-account-profile-state.service";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { EncryptService } from "@bitwarden/common/key-management/crypto/abstractions/encrypt.service";
 import { EncryptedString } from "@bitwarden/common/key-management/crypto/models/enc-string";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
@@ -83,6 +82,7 @@ describe("SsoLoginStrategy", () => {
   const ssoCodeVerifier = "SSO_CODE_VERIFIER";
   const ssoRedirectUrl = "SSO_REDIRECT_URL";
   const ssoOrgId = "SSO_ORG_ID";
+  const privateKey = "userKeyEncryptedPrivateKey";
 
   beforeEach(async () => {
     accountService = mockAccountServiceWith(userId);
@@ -114,6 +114,9 @@ describe("SsoLoginStrategy", () => {
     tokenService.decodeAccessToken.mockResolvedValue({
       sub: userId,
     });
+    keyService.userEncryptedPrivateKey$
+      .calledWith(userId)
+      .mockReturnValue(of(privateKey as EncryptedString));
 
     const mockVaultTimeoutAction = VaultTimeoutAction.Lock;
     const mockVaultTimeoutActionBSub = new BehaviorSubject<VaultTimeoutAction>(
@@ -163,6 +166,7 @@ describe("SsoLoginStrategy", () => {
 
   it("sends SSO information to server", async () => {
     apiService.postIdentityToken.mockResolvedValue(identityTokenResponseFactory());
+    keyService.hasUserKey.mockResolvedValue(true);
 
     await ssoLoginStrategy.logIn(credentials);
 
@@ -185,6 +189,7 @@ describe("SsoLoginStrategy", () => {
   it("does not set keys for new SSO user flow", async () => {
     const tokenResponse = identityTokenResponseFactory();
     tokenResponse.key = null;
+    tokenResponse.privateKey = null;
     apiService.postIdentityToken.mockResolvedValue(tokenResponse);
 
     await ssoLoginStrategy.logIn(credentials);
@@ -210,42 +215,28 @@ describe("SsoLoginStrategy", () => {
     );
   });
 
-  describe("given the PM16117_SetInitialPasswordRefactor feature flag is ON", () => {
-    beforeEach(() => {
-      configService.getFeatureFlag.mockImplementation(async (flag) => {
-        if (flag === FeatureFlag.PM16117_SetInitialPasswordRefactor) {
-          return true;
-        }
-        return false;
-      });
-    });
+  describe("given the user does not have the `trustedDeviceOption`, does not have a master password, is not using key connector, does not have a user key, but they DO have a `userKeyEncryptedPrivateKey`", () => {
+    it("should set the forceSetPasswordReason to TdeOffboardingUntrustedDevice", async () => {
+      // Arrange
+      const mockUserDecryptionOptions: IUserDecryptionOptionsServerResponse = {
+        HasMasterPassword: false,
+        TrustedDeviceOption: null,
+        KeyConnectorOption: null,
+      };
+      const tokenResponse = identityTokenResponseFactory(null, mockUserDecryptionOptions);
+      apiService.postIdentityToken.mockResolvedValue(tokenResponse);
 
-    describe("given the user does not have the `trustedDeviceOption`, does not have a master password, is not using key connector, does not have a user key, but they DO have a `userKeyEncryptedPrivateKey`", () => {
-      it("should set the forceSetPasswordReason to TdeOffboardingUntrustedDevice", async () => {
-        // Arrange
-        const mockUserDecryptionOptions: IUserDecryptionOptionsServerResponse = {
-          HasMasterPassword: false,
-          TrustedDeviceOption: null,
-          KeyConnectorOption: null,
-        };
-        const tokenResponse = identityTokenResponseFactory(null, mockUserDecryptionOptions);
-        apiService.postIdentityToken.mockResolvedValue(tokenResponse);
+      keyService.hasUserKey.mockResolvedValue(false);
 
-        keyService.userEncryptedPrivateKey$.mockReturnValue(
-          of("userKeyEncryptedPrivateKey" as EncryptedString),
-        );
-        keyService.hasUserKey.mockResolvedValue(false);
+      // Act
+      await ssoLoginStrategy.logIn(credentials);
 
-        // Act
-        await ssoLoginStrategy.logIn(credentials);
-
-        // Assert
-        expect(masterPasswordService.mock.setForceSetPasswordReason).toHaveBeenCalledTimes(1);
-        expect(masterPasswordService.mock.setForceSetPasswordReason).toHaveBeenCalledWith(
-          ForceSetPasswordReason.TdeOffboardingUntrustedDevice,
-          userId,
-        );
-      });
+      // Assert
+      expect(masterPasswordService.mock.setForceSetPasswordReason).toHaveBeenCalledTimes(1);
+      expect(masterPasswordService.mock.setForceSetPasswordReason).toHaveBeenCalledWith(
+        ForceSetPasswordReason.TdeOffboardingUntrustedDevice,
+        userId,
+      );
     });
   });
 

libs/auth/src/common/login-strategies/sso-login.strategy.ts

@@ -9,7 +9,6 @@ import { SsoTokenRequest } from "@bitwarden/common/auth/models/request/identity-
 import { AuthRequestResponse } from "@bitwarden/common/auth/models/response/auth-request.response";
 import { IdentityTokenResponse } from "@bitwarden/common/auth/models/response/identity-token.response";
 import { HttpStatusCode } from "@bitwarden/common/enums";
-import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
 import { DeviceTrustServiceAbstraction } from "@bitwarden/common/key-management/device-trust/abstractions/device-trust.service.abstraction";
 import { KeyConnectorService } from "@bitwarden/common/key-management/key-connector/abstractions/key-connector.service";
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
@@ -344,38 +343,18 @@ export class SsoLoginStrategy extends LoginStrategy {
     tokenResponse: IdentityTokenResponse,
     userId: UserId,
   ): Promise<void> {
-    const isSetInitialPasswordFlagOn = await this.configService.getFeatureFlag(
-      FeatureFlag.PM16117_SetInitialPasswordRefactor,
-    );
-
-    if (isSetInitialPasswordFlagOn) {
-      if (tokenResponse.hasMasterKeyEncryptedUserKey()) {
-        // User has masterKeyEncryptedUserKey, so set the userKeyEncryptedPrivateKey
-        // Note: new JIT provisioned SSO users will not yet have a user asymmetric key pair
-        // and so we don't want them falling into the createKeyPairForOldAccount flow
-        await this.keyService.setPrivateKey(
-          tokenResponse.privateKey ?? (await this.createKeyPairForOldAccount(userId)),
-          userId,
-        );
-      } else if (tokenResponse.privateKey) {
-        // User doesn't have masterKeyEncryptedUserKey but they do have a userKeyEncryptedPrivateKey
-        // This is just existing TDE users or a TDE offboarder on an untrusted device
-        await this.keyService.setPrivateKey(tokenResponse.privateKey, userId);
-      }
-      // else {
-      //    User could be new JIT provisioned SSO user in either a MP encryption org OR a TDE org.
-      //    In either case, the user doesn't yet have a user asymmetric key pair, a user key, or a master key + master key encrypted user key.
-      // }
-    } else {
-      // A user that does not yet have a masterKeyEncryptedUserKey set is a new SSO user
-      const newSsoUser = tokenResponse.key == null;
-
-      if (!newSsoUser) {
-        await this.keyService.setPrivateKey(
-          tokenResponse.privateKey ?? (await this.createKeyPairForOldAccount(userId)),
-          userId,
-        );
-      }
+    if (tokenResponse.hasMasterKeyEncryptedUserKey()) {
+      // User has masterKeyEncryptedUserKey, so set the userKeyEncryptedPrivateKey
+      // Note: new JIT provisioned SSO users will not yet have a user asymmetric key pair
+      // and so we don't want them falling into the createKeyPairForOldAccount flow
+      await this.keyService.setPrivateKey(
+        tokenResponse.privateKey ?? (await this.createKeyPairForOldAccount(userId)),
+        userId,
+      );
+    } else if (tokenResponse.privateKey) {
+      // User doesn't have masterKeyEncryptedUserKey but they do have a userKeyEncryptedPrivateKey
+      // This is just existing TDE users or a TDE offboarder on an untrusted device
+      await this.keyService.setPrivateKey(tokenResponse.privateKey, userId);
     }
   }
 
@@ -431,30 +410,25 @@ export class SsoLoginStrategy extends LoginStrategy {
     // - UserDecryptionOptions.UsesKeyConnector is undefined. -- they aren't using key connector
     // - UserKey is not set after successful login -- because automatic decryption is not available
     // - userKeyEncryptedPrivateKey is set after successful login -- this is the key differentiator between a TDE org user logging into an untrusted device and MP encryption JIT provisioned user logging in for the first time.
-    const isSetInitialPasswordFlagOn = await this.configService.getFeatureFlag(
-      FeatureFlag.PM16117_SetInitialPasswordRefactor,
+    //     Why is that the case?  Because we set the userKeyEncryptedPrivateKey when we create the userKey, and this is serving as a proxy to tell us that the userKey has been created already (when enrolling in TDE).
+    const hasUserKeyEncryptedPrivateKey = await firstValueFrom(
+      this.keyService.userEncryptedPrivateKey$(userId),
     );
+    const hasUserKey = await this.keyService.hasUserKey(userId);
 
-    if (isSetInitialPasswordFlagOn) {
-      const hasUserKeyEncryptedPrivateKey = await firstValueFrom(
-        this.keyService.userEncryptedPrivateKey$(userId),
+    // TODO: PM-23491 we should explore consolidating this logic into a flag on the server. It could be set when an org is switched from TDE to MP encryption for each org user.
+    if (
+      !userDecryptionOptions.trustedDeviceOption &&
+      !userDecryptionOptions.hasMasterPassword &&
+      !userDecryptionOptions.keyConnectorOption?.keyConnectorUrl &&
+      hasUserKeyEncryptedPrivateKey &&
+      !hasUserKey
+    ) {
+      await this.masterPasswordService.setForceSetPasswordReason(
+        ForceSetPasswordReason.TdeOffboardingUntrustedDevice,
+        userId,
       );
-      const hasUserKey = await this.keyService.hasUserKey(userId);
-
-      // TODO: PM-23491 we should explore consolidating this logic into a flag on the server. It could be set when an org is switched from TDE to MP encryption for each org user.
-      if (
-        !userDecryptionOptions.trustedDeviceOption &&
-        !userDecryptionOptions.hasMasterPassword &&
-        !userDecryptionOptions.keyConnectorOption?.keyConnectorUrl &&
-        hasUserKeyEncryptedPrivateKey &&
-        !hasUserKey
-      ) {
-        await this.masterPasswordService.setForceSetPasswordReason(
-          ForceSetPasswordReason.TdeOffboardingUntrustedDevice,
-          userId,
-        );
-        return true;
-      }
+      return true;
     }
 
     // Check if user has permission to set password but hasn't yet

libs/common/src/abstractions/api.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
 import {
@@ -128,7 +126,7 @@ import { OptionalCipherResponse } from "../vault/models/response/optional-cipher
  * of this decision please read https://contributing.bitwarden.com/architecture/adr/refactor-api-service.
  */
 export abstract class ApiService {
-  send: (
+  abstract send(
     method: "GET" | "POST" | "PUT" | "DELETE" | "PATCH",
     path: string,
     body: any,
@@ -136,196 +134,225 @@ export abstract class ApiService {
     hasResponse: boolean,
     apiUrl?: string | null,
     alterHeaders?: (headers: Headers) => void,
-  ) => Promise<any>;
+  ): Promise<any>;
 
-  postIdentityToken: (
+  abstract postIdentityToken(
     request:
       | PasswordTokenRequest
       | SsoTokenRequest
       | UserApiTokenRequest
       | WebAuthnLoginTokenRequest,
-  ) => Promise<
+  ): Promise<
     IdentityTokenResponse | IdentityTwoFactorResponse | IdentityDeviceVerificationResponse
   >;
-  refreshIdentityToken: () => Promise<any>;
+  abstract refreshIdentityToken(): Promise<any>;
 
-  getProfile: () => Promise<ProfileResponse>;
-  getUserSubscription: () => Promise<SubscriptionResponse>;
-  getTaxInfo: () => Promise<TaxInfoResponse>;
-  putProfile: (request: UpdateProfileRequest) => Promise<ProfileResponse>;
-  putAvatar: (request: UpdateAvatarRequest) => Promise<ProfileResponse>;
-  putTaxInfo: (request: TaxInfoUpdateRequest) => Promise<any>;
-  postPrelogin: (request: PreloginRequest) => Promise<PreloginResponse>;
-  postEmailToken: (request: EmailTokenRequest) => Promise<any>;
-  postEmail: (request: EmailRequest) => Promise<any>;
-  postSetKeyConnectorKey: (request: SetKeyConnectorKeyRequest) => Promise<any>;
-  postSecurityStamp: (request: SecretVerificationRequest) => Promise<any>;
-  getAccountRevisionDate: () => Promise<number>;
-  postPasswordHint: (request: PasswordHintRequest) => Promise<any>;
-  postPremium: (data: FormData) => Promise<PaymentResponse>;
-  postReinstatePremium: () => Promise<any>;
-  postAccountStorage: (request: StorageRequest) => Promise<PaymentResponse>;
-  postAccountPayment: (request: PaymentRequest) => Promise<void>;
-  postAccountLicense: (data: FormData) => Promise<any>;
-  postAccountKeys: (request: KeysRequest) => Promise<any>;
-  postAccountVerifyEmail: () => Promise<any>;
-  postAccountVerifyEmailToken: (request: VerifyEmailRequest) => Promise<any>;
-  postAccountRecoverDelete: (request: DeleteRecoverRequest) => Promise<any>;
-  postAccountRecoverDeleteToken: (request: VerifyDeleteRecoverRequest) => Promise<any>;
-  postAccountKdf: (request: KdfRequest) => Promise<any>;
-  postUserApiKey: (id: string, request: SecretVerificationRequest) => Promise<ApiKeyResponse>;
-  postUserRotateApiKey: (id: string, request: SecretVerificationRequest) => Promise<ApiKeyResponse>;
-  postConvertToKeyConnector: () => Promise<void>;
+  abstract getProfile(): Promise<ProfileResponse>;
+  abstract getUserSubscription(): Promise<SubscriptionResponse>;
+  abstract getTaxInfo(): Promise<TaxInfoResponse>;
+  abstract putProfile(request: UpdateProfileRequest): Promise<ProfileResponse>;
+  abstract putAvatar(request: UpdateAvatarRequest): Promise<ProfileResponse>;
+  abstract putTaxInfo(request: TaxInfoUpdateRequest): Promise<any>;
+  abstract postPrelogin(request: PreloginRequest): Promise<PreloginResponse>;
+  abstract postEmailToken(request: EmailTokenRequest): Promise<any>;
+  abstract postEmail(request: EmailRequest): Promise<any>;
+  abstract postSetKeyConnectorKey(request: SetKeyConnectorKeyRequest): Promise<any>;
+  abstract postSecurityStamp(request: SecretVerificationRequest): Promise<any>;
+  abstract getAccountRevisionDate(): Promise<number>;
+  abstract postPasswordHint(request: PasswordHintRequest): Promise<any>;
+  abstract postPremium(data: FormData): Promise<PaymentResponse>;
+  abstract postReinstatePremium(): Promise<any>;
+  abstract postAccountStorage(request: StorageRequest): Promise<PaymentResponse>;
+  abstract postAccountPayment(request: PaymentRequest): Promise<void>;
+  abstract postAccountLicense(data: FormData): Promise<any>;
+  abstract postAccountKeys(request: KeysRequest): Promise<any>;
+  abstract postAccountVerifyEmail(): Promise<any>;
+  abstract postAccountVerifyEmailToken(request: VerifyEmailRequest): Promise<any>;
+  abstract postAccountRecoverDelete(request: DeleteRecoverRequest): Promise<any>;
+  abstract postAccountRecoverDeleteToken(request: VerifyDeleteRecoverRequest): Promise<any>;
+  abstract postAccountKdf(request: KdfRequest): Promise<any>;
+  abstract postUserApiKey(id: string, request: SecretVerificationRequest): Promise<ApiKeyResponse>;
+  abstract postUserRotateApiKey(
+    id: string,
+    request: SecretVerificationRequest,
+  ): Promise<ApiKeyResponse>;
+  abstract postConvertToKeyConnector(): Promise<void>;
   //passwordless
-  getAuthRequest: (id: string) => Promise<AuthRequestResponse>;
-  putAuthRequest: (id: string, request: PasswordlessAuthRequest) => Promise<AuthRequestResponse>;
-  getAuthRequests: () => Promise<ListResponse<AuthRequestResponse>>;
-  getLastAuthRequest: () => Promise<AuthRequestResponse>;
+  abstract getAuthRequest(id: string): Promise<AuthRequestResponse>;
+  abstract putAuthRequest(
+    id: string,
+    request: PasswordlessAuthRequest,
+  ): Promise<AuthRequestResponse>;
+  abstract getAuthRequests(): Promise<ListResponse<AuthRequestResponse>>;
+  abstract getLastAuthRequest(): Promise<AuthRequestResponse>;
 
-  getUserBillingHistory: () => Promise<BillingHistoryResponse>;
-  getUserBillingPayment: () => Promise<BillingPaymentResponse>;
+  abstract getUserBillingHistory(): Promise<BillingHistoryResponse>;
+  abstract getUserBillingPayment(): Promise<BillingPaymentResponse>;
 
-  getCipher: (id: string) => Promise<CipherResponse>;
-  getFullCipherDetails: (id: string) => Promise<CipherResponse>;
-  getCipherAdmin: (id: string) => Promise<CipherResponse>;
-  getAttachmentData: (
+  abstract getCipher(id: string): Promise<CipherResponse>;
+  abstract getFullCipherDetails(id: string): Promise<CipherResponse>;
+  abstract getCipherAdmin(id: string): Promise<CipherResponse>;
+  abstract getAttachmentData(
     cipherId: string,
     attachmentId: string,
     emergencyAccessId?: string,
-  ) => Promise<AttachmentResponse>;
-  getAttachmentDataAdmin: (cipherId: string, attachmentId: string) => Promise<AttachmentResponse>;
-  getCiphersOrganization: (organizationId: string) => Promise<ListResponse<CipherResponse>>;
-  postCipher: (request: CipherRequest) => Promise<CipherResponse>;
-  postCipherCreate: (request: CipherCreateRequest) => Promise<CipherResponse>;
-  postCipherAdmin: (request: CipherCreateRequest) => Promise<CipherResponse>;
-  putCipher: (id: string, request: CipherRequest) => Promise<CipherResponse>;
-  putPartialCipher: (id: string, request: CipherPartialRequest) => Promise<CipherResponse>;
-  putCipherAdmin: (id: string, request: CipherRequest) => Promise<CipherResponse>;
-  deleteCipher: (id: string) => Promise<any>;
-  deleteCipherAdmin: (id: string) => Promise<any>;
-  deleteManyCiphers: (request: CipherBulkDeleteRequest) => Promise<any>;
-  deleteManyCiphersAdmin: (request: CipherBulkDeleteRequest) => Promise<any>;
-  putMoveCiphers: (request: CipherBulkMoveRequest) => Promise<any>;
-  putShareCipher: (id: string, request: CipherShareRequest) => Promise<CipherResponse>;
-  putShareCiphers: (request: CipherBulkShareRequest) => Promise<ListResponse<CipherResponse>>;
-  putCipherCollections: (
+  ): Promise<AttachmentResponse>;
+  abstract getAttachmentDataAdmin(
+    cipherId: string,
+    attachmentId: string,
+  ): Promise<AttachmentResponse>;
+  abstract getCiphersOrganization(organizationId: string): Promise<ListResponse<CipherResponse>>;
+  abstract postCipher(request: CipherRequest): Promise<CipherResponse>;
+  abstract postCipherCreate(request: CipherCreateRequest): Promise<CipherResponse>;
+  abstract postCipherAdmin(request: CipherCreateRequest): Promise<CipherResponse>;
+  abstract putCipher(id: string, request: CipherRequest): Promise<CipherResponse>;
+  abstract putPartialCipher(id: string, request: CipherPartialRequest): Promise<CipherResponse>;
+  abstract putCipherAdmin(id: string, request: CipherRequest): Promise<CipherResponse>;
+  abstract deleteCipher(id: string): Promise<any>;
+  abstract deleteCipherAdmin(id: string): Promise<any>;
+  abstract deleteManyCiphers(request: CipherBulkDeleteRequest): Promise<any>;
+  abstract deleteManyCiphersAdmin(request: CipherBulkDeleteRequest): Promise<any>;
+  abstract putMoveCiphers(request: CipherBulkMoveRequest): Promise<any>;
+  abstract putShareCipher(id: string, request: CipherShareRequest): Promise<CipherResponse>;
+  abstract putShareCiphers(request: CipherBulkShareRequest): Promise<ListResponse<CipherResponse>>;
+  abstract putCipherCollections(
     id: string,
     request: CipherCollectionsRequest,
-  ) => Promise<OptionalCipherResponse>;
-  putCipherCollectionsAdmin: (id: string, request: CipherCollectionsRequest) => Promise<any>;
-  postPurgeCiphers: (request: SecretVerificationRequest, organizationId?: string) => Promise<any>;
-  putDeleteCipher: (id: string) => Promise<any>;
-  putDeleteCipherAdmin: (id: string) => Promise<any>;
-  putDeleteManyCiphers: (request: CipherBulkDeleteRequest) => Promise<any>;
-  putDeleteManyCiphersAdmin: (request: CipherBulkDeleteRequest) => Promise<any>;
-  putRestoreCipher: (id: string) => Promise<CipherResponse>;
-  putRestoreCipherAdmin: (id: string) => Promise<CipherResponse>;
-  putRestoreManyCiphers: (
+  ): Promise<OptionalCipherResponse>;
+  abstract putCipherCollectionsAdmin(id: string, request: CipherCollectionsRequest): Promise<any>;
+  abstract postPurgeCiphers(
+    request: SecretVerificationRequest,
+    organizationId?: string,
+  ): Promise<any>;
+  abstract putDeleteCipher(id: string): Promise<any>;
+  abstract putDeleteCipherAdmin(id: string): Promise<any>;
+  abstract putDeleteManyCiphers(request: CipherBulkDeleteRequest): Promise<any>;
+  abstract putDeleteManyCiphersAdmin(request: CipherBulkDeleteRequest): Promise<any>;
+  abstract putRestoreCipher(id: string): Promise<CipherResponse>;
+  abstract putRestoreCipherAdmin(id: string): Promise<CipherResponse>;
+  abstract putRestoreManyCiphers(
     request: CipherBulkRestoreRequest,
-  ) => Promise<ListResponse<CipherResponse>>;
-  putRestoreManyCiphersAdmin: (
+  ): Promise<ListResponse<CipherResponse>>;
+  abstract putRestoreManyCiphersAdmin(
     request: CipherBulkRestoreRequest,
-  ) => Promise<ListResponse<CipherResponse>>;
+  ): Promise<ListResponse<CipherResponse>>;
 
-  postCipherAttachment: (
+  abstract postCipherAttachment(
     id: string,
     request: AttachmentRequest,
-  ) => Promise<AttachmentUploadDataResponse>;
-  deleteCipherAttachment: (id: string, attachmentId: string) => Promise<any>;
-  deleteCipherAttachmentAdmin: (id: string, attachmentId: string) => Promise<any>;
-  postShareCipherAttachment: (
+  ): Promise<AttachmentUploadDataResponse>;
+  abstract deleteCipherAttachment(id: string, attachmentId: string): Promise<any>;
+  abstract deleteCipherAttachmentAdmin(id: string, attachmentId: string): Promise<any>;
+  abstract postShareCipherAttachment(
     id: string,
     attachmentId: string,
     data: FormData,
     organizationId: string,
-  ) => Promise<any>;
-  renewAttachmentUploadUrl: (
+  ): Promise<any>;
+  abstract renewAttachmentUploadUrl(
     id: string,
     attachmentId: string,
-  ) => Promise<AttachmentUploadDataResponse>;
-  postAttachmentFile: (id: string, attachmentId: string, data: FormData) => Promise<any>;
+  ): Promise<AttachmentUploadDataResponse>;
+  abstract postAttachmentFile(id: string, attachmentId: string, data: FormData): Promise<any>;
 
-  getUserCollections: () => Promise<ListResponse<CollectionResponse>>;
-  getCollections: (organizationId: string) => Promise<ListResponse<CollectionResponse>>;
-  getCollectionUsers: (organizationId: string, id: string) => Promise<SelectionReadOnlyResponse[]>;
-  getCollectionAccessDetails: (
+  abstract getUserCollections(): Promise<ListResponse<CollectionResponse>>;
+  abstract getCollections(organizationId: string): Promise<ListResponse<CollectionResponse>>;
+  abstract getCollectionUsers(
     organizationId: string,
     id: string,
-  ) => Promise<CollectionAccessDetailsResponse>;
-  getManyCollectionsWithAccessDetails: (
+  ): Promise<SelectionReadOnlyResponse[]>;
+  abstract getCollectionAccessDetails(
+    organizationId: string,
+    id: string,
+  ): Promise<CollectionAccessDetailsResponse>;
+  abstract getManyCollectionsWithAccessDetails(
     orgId: string,
-  ) => Promise<ListResponse<CollectionAccessDetailsResponse>>;
-  postCollection: (
+  ): Promise<ListResponse<CollectionAccessDetailsResponse>>;
+  abstract postCollection(
     organizationId: string,
     request: CollectionRequest,
-  ) => Promise<CollectionDetailsResponse>;
-  putCollection: (
+  ): Promise<CollectionDetailsResponse>;
+  abstract putCollection(
     organizationId: string,
     id: string,
     request: CollectionRequest,
-  ) => Promise<CollectionDetailsResponse>;
-  deleteCollection: (organizationId: string, id: string) => Promise<any>;
-  deleteManyCollections: (organizationId: string, collectionIds: string[]) => Promise<any>;
+  ): Promise<CollectionDetailsResponse>;
+  abstract deleteCollection(organizationId: string, id: string): Promise<any>;
+  abstract deleteManyCollections(organizationId: string, collectionIds: string[]): Promise<any>;
 
-  getGroupUsers: (organizationId: string, id: string) => Promise<string[]>;
-  deleteGroupUser: (organizationId: string, id: string, organizationUserId: string) => Promise<any>;
-
-  getSync: () => Promise<SyncResponse>;
-
-  getSettingsDomains: () => Promise<DomainsResponse>;
-  putSettingsDomains: (request: UpdateDomainsRequest) => Promise<DomainsResponse>;
-
-  getTwoFactorProviders: () => Promise<ListResponse<TwoFactorProviderResponse>>;
-  getTwoFactorOrganizationProviders: (
+  abstract getGroupUsers(organizationId: string, id: string): Promise<string[]>;
+  abstract deleteGroupUser(
     organizationId: string,
-  ) => Promise<ListResponse<TwoFactorProviderResponse>>;
-  getTwoFactorAuthenticator: (
+    id: string,
+    organizationUserId: string,
+  ): Promise<any>;
+
+  abstract getSync(): Promise<SyncResponse>;
+
+  abstract getSettingsDomains(): Promise<DomainsResponse>;
+  abstract putSettingsDomains(request: UpdateDomainsRequest): Promise<DomainsResponse>;
+
+  abstract getTwoFactorProviders(): Promise<ListResponse<TwoFactorProviderResponse>>;
+  abstract getTwoFactorOrganizationProviders(
+    organizationId: string,
+  ): Promise<ListResponse<TwoFactorProviderResponse>>;
+  abstract getTwoFactorAuthenticator(
     request: SecretVerificationRequest,
-  ) => Promise<TwoFactorAuthenticatorResponse>;
-  getTwoFactorEmail: (request: SecretVerificationRequest) => Promise<TwoFactorEmailResponse>;
-  getTwoFactorDuo: (request: SecretVerificationRequest) => Promise<TwoFactorDuoResponse>;
-  getTwoFactorOrganizationDuo: (
+  ): Promise<TwoFactorAuthenticatorResponse>;
+  abstract getTwoFactorEmail(request: SecretVerificationRequest): Promise<TwoFactorEmailResponse>;
+  abstract getTwoFactorDuo(request: SecretVerificationRequest): Promise<TwoFactorDuoResponse>;
+  abstract getTwoFactorOrganizationDuo(
     organizationId: string,
     request: SecretVerificationRequest,
-  ) => Promise<TwoFactorDuoResponse>;
-  getTwoFactorYubiKey: (request: SecretVerificationRequest) => Promise<TwoFactorYubiKeyResponse>;
-  getTwoFactorWebAuthn: (request: SecretVerificationRequest) => Promise<TwoFactorWebAuthnResponse>;
-  getTwoFactorWebAuthnChallenge: (request: SecretVerificationRequest) => Promise<ChallengeResponse>;
-  getTwoFactorRecover: (request: SecretVerificationRequest) => Promise<TwoFactorRecoverResponse>;
-  putTwoFactorAuthenticator: (
+  ): Promise<TwoFactorDuoResponse>;
+  abstract getTwoFactorYubiKey(
+    request: SecretVerificationRequest,
+  ): Promise<TwoFactorYubiKeyResponse>;
+  abstract getTwoFactorWebAuthn(
+    request: SecretVerificationRequest,
+  ): Promise<TwoFactorWebAuthnResponse>;
+  abstract getTwoFactorWebAuthnChallenge(
+    request: SecretVerificationRequest,
+  ): Promise<ChallengeResponse>;
+  abstract getTwoFactorRecover(
+    request: SecretVerificationRequest,
+  ): Promise<TwoFactorRecoverResponse>;
+  abstract putTwoFactorAuthenticator(
     request: UpdateTwoFactorAuthenticatorRequest,
-  ) => Promise<TwoFactorAuthenticatorResponse>;
-  deleteTwoFactorAuthenticator: (
+  ): Promise<TwoFactorAuthenticatorResponse>;
+  abstract deleteTwoFactorAuthenticator(
     request: DisableTwoFactorAuthenticatorRequest,
-  ) => Promise<TwoFactorProviderResponse>;
-  putTwoFactorEmail: (request: UpdateTwoFactorEmailRequest) => Promise<TwoFactorEmailResponse>;
-  putTwoFactorDuo: (request: UpdateTwoFactorDuoRequest) => Promise<TwoFactorDuoResponse>;
-  putTwoFactorOrganizationDuo: (
+  ): Promise<TwoFactorProviderResponse>;
+  abstract putTwoFactorEmail(request: UpdateTwoFactorEmailRequest): Promise<TwoFactorEmailResponse>;
+  abstract putTwoFactorDuo(request: UpdateTwoFactorDuoRequest): Promise<TwoFactorDuoResponse>;
+  abstract putTwoFactorOrganizationDuo(
     organizationId: string,
     request: UpdateTwoFactorDuoRequest,
-  ) => Promise<TwoFactorDuoResponse>;
-  putTwoFactorYubiKey: (
+  ): Promise<TwoFactorDuoResponse>;
+  abstract putTwoFactorYubiKey(
     request: UpdateTwoFactorYubikeyOtpRequest,
-  ) => Promise<TwoFactorYubiKeyResponse>;
-  putTwoFactorWebAuthn: (
+  ): Promise<TwoFactorYubiKeyResponse>;
+  abstract putTwoFactorWebAuthn(
     request: UpdateTwoFactorWebAuthnRequest,
-  ) => Promise<TwoFactorWebAuthnResponse>;
-  deleteTwoFactorWebAuthn: (
+  ): Promise<TwoFactorWebAuthnResponse>;
+  abstract deleteTwoFactorWebAuthn(
     request: UpdateTwoFactorWebAuthnDeleteRequest,
-  ) => Promise<TwoFactorWebAuthnResponse>;
-  putTwoFactorDisable: (request: TwoFactorProviderRequest) => Promise<TwoFactorProviderResponse>;
-  putTwoFactorOrganizationDisable: (
+  ): Promise<TwoFactorWebAuthnResponse>;
+  abstract putTwoFactorDisable(
+    request: TwoFactorProviderRequest,
+  ): Promise<TwoFactorProviderResponse>;
+  abstract putTwoFactorOrganizationDisable(
     organizationId: string,
     request: TwoFactorProviderRequest,
-  ) => Promise<TwoFactorProviderResponse>;
-  postTwoFactorEmailSetup: (request: TwoFactorEmailRequest) => Promise<any>;
-  postTwoFactorEmail: (request: TwoFactorEmailRequest) => Promise<any>;
-  getDeviceVerificationSettings: () => Promise<DeviceVerificationResponse>;
-  putDeviceVerificationSettings: (
+  ): Promise<TwoFactorProviderResponse>;
+  abstract postTwoFactorEmailSetup(request: TwoFactorEmailRequest): Promise<any>;
+  abstract postTwoFactorEmail(request: TwoFactorEmailRequest): Promise<any>;
+  abstract getDeviceVerificationSettings(): Promise<DeviceVerificationResponse>;
+  abstract putDeviceVerificationSettings(
     request: DeviceVerificationRequest,
-  ) => Promise<DeviceVerificationResponse>;
+  ): Promise<DeviceVerificationResponse>;
 
-  getCloudCommunicationsEnabled: () => Promise<boolean>;
+  abstract getCloudCommunicationsEnabled(): Promise<boolean>;
   abstract getOrganizationConnection<TConfig extends OrganizationConnectionConfigApis>(
     id: string,
     type: OrganizationConnectionType,
@@ -340,136 +367,147 @@ export abstract class ApiService {
     configType: { new (response: any): TConfig },
     organizationConnectionId: string,
   ): Promise<OrganizationConnectionResponse<TConfig>>;
-  deleteOrganizationConnection: (id: string) => Promise<void>;
-  getPlans: () => Promise<ListResponse<PlanResponse>>;
+  abstract deleteOrganizationConnection(id: string): Promise<void>;
+  abstract getPlans(): Promise<ListResponse<PlanResponse>>;
 
-  getProviderUsers: (providerId: string) => Promise<ListResponse<ProviderUserUserDetailsResponse>>;
-  getProviderUser: (providerId: string, id: string) => Promise<ProviderUserResponse>;
-  postProviderUserInvite: (providerId: string, request: ProviderUserInviteRequest) => Promise<any>;
-  postProviderUserReinvite: (providerId: string, id: string) => Promise<any>;
-  postManyProviderUserReinvite: (
+  abstract getProviderUsers(
+    providerId: string,
+  ): Promise<ListResponse<ProviderUserUserDetailsResponse>>;
+  abstract getProviderUser(providerId: string, id: string): Promise<ProviderUserResponse>;
+  abstract postProviderUserInvite(
+    providerId: string,
+    request: ProviderUserInviteRequest,
+  ): Promise<any>;
+  abstract postProviderUserReinvite(providerId: string, id: string): Promise<any>;
+  abstract postManyProviderUserReinvite(
     providerId: string,
     request: ProviderUserBulkRequest,
-  ) => Promise<ListResponse<ProviderUserBulkResponse>>;
-  postProviderUserAccept: (
+  ): Promise<ListResponse<ProviderUserBulkResponse>>;
+  abstract postProviderUserAccept(
     providerId: string,
     id: string,
     request: ProviderUserAcceptRequest,
-  ) => Promise<any>;
-  postProviderUserConfirm: (
+  ): Promise<any>;
+  abstract postProviderUserConfirm(
     providerId: string,
     id: string,
     request: ProviderUserConfirmRequest,
-  ) => Promise<any>;
-  postProviderUsersPublicKey: (
+  ): Promise<any>;
+  abstract postProviderUsersPublicKey(
     providerId: string,
     request: ProviderUserBulkRequest,
-  ) => Promise<ListResponse<ProviderUserBulkPublicKeyResponse>>;
-  postProviderUserBulkConfirm: (
+  ): Promise<ListResponse<ProviderUserBulkPublicKeyResponse>>;
+  abstract postProviderUserBulkConfirm(
     providerId: string,
     request: ProviderUserBulkConfirmRequest,
-  ) => Promise<ListResponse<ProviderUserBulkResponse>>;
-  putProviderUser: (
+  ): Promise<ListResponse<ProviderUserBulkResponse>>;
+  abstract putProviderUser(
     providerId: string,
     id: string,
     request: ProviderUserUpdateRequest,
-  ) => Promise<any>;
-  deleteProviderUser: (organizationId: string, id: string) => Promise<any>;
-  deleteManyProviderUsers: (
+  ): Promise<any>;
+  abstract deleteProviderUser(organizationId: string, id: string): Promise<any>;
+  abstract deleteManyProviderUsers(
     providerId: string,
     request: ProviderUserBulkRequest,
-  ) => Promise<ListResponse<ProviderUserBulkResponse>>;
-  getProviderClients: (
+  ): Promise<ListResponse<ProviderUserBulkResponse>>;
+  abstract getProviderClients(
     providerId: string,
-  ) => Promise<ListResponse<ProviderOrganizationOrganizationDetailsResponse>>;
-  postProviderAddOrganization: (
+  ): Promise<ListResponse<ProviderOrganizationOrganizationDetailsResponse>>;
+  abstract postProviderAddOrganization(
     providerId: string,
     request: ProviderAddOrganizationRequest,
-  ) => Promise<any>;
-  postProviderCreateOrganization: (
+  ): Promise<any>;
+  abstract postProviderCreateOrganization(
     providerId: string,
     request: ProviderOrganizationCreateRequest,
-  ) => Promise<ProviderOrganizationResponse>;
-  deleteProviderOrganization: (providerId: string, organizationId: string) => Promise<any>;
+  ): Promise<ProviderOrganizationResponse>;
+  abstract deleteProviderOrganization(providerId: string, organizationId: string): Promise<any>;
 
-  getEvents: (start: string, end: string, token: string) => Promise<ListResponse<EventResponse>>;
-  getEventsCipher: (
+  abstract getEvents(
+    start: string,
+    end: string,
+    token: string,
+  ): Promise<ListResponse<EventResponse>>;
+  abstract getEventsCipher(
     id: string,
     start: string,
     end: string,
     token: string,
-  ) => Promise<ListResponse<EventResponse>>;
-  getEventsOrganization: (
+  ): Promise<ListResponse<EventResponse>>;
+  abstract getEventsOrganization(
     id: string,
     start: string,
     end: string,
     token: string,
-  ) => Promise<ListResponse<EventResponse>>;
-  getEventsOrganizationUser: (
+  ): Promise<ListResponse<EventResponse>>;
+  abstract getEventsOrganizationUser(
     organizationId: string,
     id: string,
     start: string,
     end: string,
     token: string,
-  ) => Promise<ListResponse<EventResponse>>;
-  getEventsProvider: (
+  ): Promise<ListResponse<EventResponse>>;
+  abstract getEventsProvider(
     id: string,
     start: string,
     end: string,
     token: string,
-  ) => Promise<ListResponse<EventResponse>>;
-  getEventsProviderUser: (
+  ): Promise<ListResponse<EventResponse>>;
+  abstract getEventsProviderUser(
     providerId: string,
     id: string,
     start: string,
     end: string,
     token: string,
-  ) => Promise<ListResponse<EventResponse>>;
+  ): Promise<ListResponse<EventResponse>>;
 
   /**
    * Posts events for a user
    * @param request The array of events to upload
    * @param userId The optional user id the events belong to. If no user id is provided the active user id is used.
    */
-  postEventsCollect: (request: EventRequest[], userId?: UserId) => Promise<any>;
+  abstract postEventsCollect(request: EventRequest[], userId?: UserId): Promise<any>;
 
-  deleteSsoUser: (organizationId: string) => Promise<void>;
-  getSsoUserIdentifier: () => Promise<string>;
+  abstract deleteSsoUser(organizationId: string): Promise<void>;
+  abstract getSsoUserIdentifier(): Promise<string>;
 
-  getUserPublicKey: (id: string) => Promise<UserKeyResponse>;
+  abstract getUserPublicKey(id: string): Promise<UserKeyResponse>;
 
-  getHibpBreach: (username: string) => Promise<BreachAccountResponse[]>;
+  abstract getHibpBreach(username: string): Promise<BreachAccountResponse[]>;
 
-  postBitPayInvoice: (request: BitPayInvoiceRequest) => Promise<string>;
-  postSetupPayment: () => Promise<string>;
+  abstract postBitPayInvoice(request: BitPayInvoiceRequest): Promise<string>;
+  abstract postSetupPayment(): Promise<string>;
 
-  getActiveBearerToken: () => Promise<string>;
-  fetch: (request: Request) => Promise<Response>;
-  nativeFetch: (request: Request) => Promise<Response>;
+  abstract getActiveBearerToken(): Promise<string>;
+  abstract fetch(request: Request): Promise<Response>;
+  abstract nativeFetch(request: Request): Promise<Response>;
 
-  preValidateSso: (identifier: string) => Promise<SsoPreValidateResponse>;
+  abstract preValidateSso(identifier: string): Promise<SsoPreValidateResponse>;
 
-  postCreateSponsorship: (
+  abstract postCreateSponsorship(
     sponsorshipOrgId: string,
     request: OrganizationSponsorshipCreateRequest,
-  ) => Promise<void>;
-  getSponsorshipSyncStatus: (
+  ): Promise<void>;
+  abstract getSponsorshipSyncStatus(
     sponsoredOrgId: string,
-  ) => Promise<OrganizationSponsorshipSyncStatusResponse>;
-  deleteRemoveSponsorship: (sponsoringOrgId: string) => Promise<void>;
-  postPreValidateSponsorshipToken: (
+  ): Promise<OrganizationSponsorshipSyncStatusResponse>;
+  abstract deleteRemoveSponsorship(sponsoringOrgId: string): Promise<void>;
+  abstract postPreValidateSponsorshipToken(
     sponsorshipToken: string,
-  ) => Promise<PreValidateSponsorshipResponse>;
-  postRedeemSponsorship: (
+  ): Promise<PreValidateSponsorshipResponse>;
+  abstract postRedeemSponsorship(
     sponsorshipToken: string,
     request: OrganizationSponsorshipRedeemRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  getMasterKeyFromKeyConnector: (keyConnectorUrl: string) => Promise<KeyConnectorUserKeyResponse>;
-  postUserKeyToKeyConnector: (
+  abstract getMasterKeyFromKeyConnector(
+    keyConnectorUrl: string,
+  ): Promise<KeyConnectorUserKeyResponse>;
+  abstract postUserKeyToKeyConnector(
     keyConnectorUrl: string,
     request: KeyConnectorUserKeyRequest,
-  ) => Promise<void>;
-  getKeyConnectorAlive: (keyConnectorUrl: string) => Promise<void>;
-  getOrganizationExport: (organizationId: string) => Promise<OrganizationExportResponse>;
+  ): Promise<void>;
+  abstract getKeyConnectorAlive(keyConnectorUrl: string): Promise<void>;
+  abstract getOrganizationExport(organizationId: string): Promise<OrganizationExportResponse>;
 }

libs/common/src/abstractions/event/event-collection.service.ts

@@ -1,18 +1,16 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { EventType } from "../../enums";
 import { CipherView } from "../../vault/models/view/cipher.view";
 
 export abstract class EventCollectionService {
-  collectMany: (
+  abstract collectMany(
     eventType: EventType,
     ciphers: CipherView[],
     uploadImmediately?: boolean,
-  ) => Promise<any>;
-  collect: (
+  ): Promise<any>;
+  abstract collect(
     eventType: EventType,
     cipherId?: string,
     uploadImmediately?: boolean,
     organizationId?: string,
-  ) => Promise<any>;
+  ): Promise<any>;
 }

libs/common/src/abstractions/event/event-upload.service.ts

@@ -1,7 +1,5 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { UserId } from "../../types/guid";
 
 export abstract class EventUploadService {
-  uploadEvents: (userId?: UserId) => Promise<void>;
+  abstract uploadEvents(userId?: UserId): Promise<void>;
 }

libs/common/src/admin-console/abstractions/organization-domain/org-domain-api.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { ListResponse } from "../../../models/response/list.response";
 import { OrganizationDomainRequest } from "../../services/organization-domain/requests/organization-domain.request";
 
@@ -8,19 +6,19 @@ import { OrganizationDomainResponse } from "./responses/organization-domain.resp
 import { VerifiedOrganizationDomainSsoDetailsResponse } from "./responses/verified-organization-domain-sso-details.response";
 
 export abstract class OrgDomainApiServiceAbstraction {
-  getAllByOrgId: (orgId: string) => Promise<Array<OrganizationDomainResponse>>;
-  getByOrgIdAndOrgDomainId: (
+  abstract getAllByOrgId(orgId: string): Promise<Array<OrganizationDomainResponse>>;
+  abstract getByOrgIdAndOrgDomainId(
     orgId: string,
     orgDomainId: string,
-  ) => Promise<OrganizationDomainResponse>;
-  post: (
+  ): Promise<OrganizationDomainResponse>;
+  abstract post(
     orgId: string,
     orgDomain: OrganizationDomainRequest,
-  ) => Promise<OrganizationDomainResponse>;
-  verify: (orgId: string, orgDomainId: string) => Promise<OrganizationDomainResponse>;
-  delete: (orgId: string, orgDomainId: string) => Promise<any>;
-  getClaimedOrgDomainByEmail: (email: string) => Promise<OrganizationDomainSsoDetailsResponse>;
-  getVerifiedOrgDomainsByEmail: (
+  ): Promise<OrganizationDomainResponse>;
+  abstract verify(orgId: string, orgDomainId: string): Promise<OrganizationDomainResponse>;
+  abstract delete(orgId: string, orgDomainId: string): Promise<any>;
+  abstract getClaimedOrgDomainByEmail(email: string): Promise<OrganizationDomainSsoDetailsResponse>;
+  abstract getVerifiedOrgDomainsByEmail(
     email: string,
-  ) => Promise<ListResponse<VerifiedOrganizationDomainSsoDetailsResponse>>;
+  ): Promise<ListResponse<VerifiedOrganizationDomainSsoDetailsResponse>>;
 }

libs/common/src/admin-console/abstractions/organization-domain/org-domain.service.abstraction.ts

@@ -1,22 +1,20 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { OrganizationDomainResponse } from "./responses/organization-domain.response";
 
 export abstract class OrgDomainServiceAbstraction {
-  orgDomains$: Observable<OrganizationDomainResponse[]>;
+  abstract orgDomains$: Observable<OrganizationDomainResponse[]>;
 
-  get: (orgDomainId: string) => OrganizationDomainResponse;
+  abstract get(orgDomainId: string): OrganizationDomainResponse;
 
-  copyDnsTxt: (dnsTxt: string) => void;
+  abstract copyDnsTxt(dnsTxt: string): void;
 }
 
 // Note: this separate class is designed to hold methods that are not
 // meant to be used in components (e.g., data write methods)
 export abstract class OrgDomainInternalServiceAbstraction extends OrgDomainServiceAbstraction {
-  upsert: (orgDomains: OrganizationDomainResponse[]) => void;
-  replace: (orgDomains: OrganizationDomainResponse[]) => void;
-  clearCache: () => void;
-  delete: (orgDomainIds: string[]) => void;
+  abstract upsert(orgDomains: OrganizationDomainResponse[]): void;
+  abstract replace(orgDomains: OrganizationDomainResponse[]): void;
+  abstract clearCache(): void;
+  abstract delete(orgDomainIds: string[]): void;
 }

libs/common/src/admin-console/abstractions/organization/organization-api.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { OrganizationApiKeyRequest } from "../../../admin-console/models/request/organization-api-key.request";
 import { OrganizationSsoRequest } from "../../../auth/models/request/organization-sso.request";
 import { SecretVerificationRequest } from "../../../auth/models/request/secret-verification.request";
@@ -34,60 +32,66 @@ import { OrganizationKeysResponse } from "../../models/response/organization-key
 import { OrganizationResponse } from "../../models/response/organization.response";
 import { ProfileOrganizationResponse } from "../../models/response/profile-organization.response";
 
-export class OrganizationApiServiceAbstraction {
-  get: (id: string) => Promise<OrganizationResponse>;
-  getBilling: (id: string) => Promise<BillingResponse>;
-  getBillingHistory: (id: string) => Promise<BillingHistoryResponse>;
-  getSubscription: (id: string) => Promise<OrganizationSubscriptionResponse>;
-  getLicense: (id: string, installationId: string) => Promise<unknown>;
-  getAutoEnrollStatus: (identifier: string) => Promise<OrganizationAutoEnrollStatusResponse>;
-  create: (request: OrganizationCreateRequest) => Promise<OrganizationResponse>;
-  createWithoutPayment: (
+export abstract class OrganizationApiServiceAbstraction {
+  abstract get(id: string): Promise<OrganizationResponse>;
+  abstract getBilling(id: string): Promise<BillingResponse>;
+  abstract getBillingHistory(id: string): Promise<BillingHistoryResponse>;
+  abstract getSubscription(id: string): Promise<OrganizationSubscriptionResponse>;
+  abstract getLicense(id: string, installationId: string): Promise<unknown>;
+  abstract getAutoEnrollStatus(identifier: string): Promise<OrganizationAutoEnrollStatusResponse>;
+  abstract create(request: OrganizationCreateRequest): Promise<OrganizationResponse>;
+  abstract createWithoutPayment(
     request: OrganizationNoPaymentMethodCreateRequest,
-  ) => Promise<OrganizationResponse>;
-  createLicense: (data: FormData) => Promise<OrganizationResponse>;
-  save: (id: string, request: OrganizationUpdateRequest) => Promise<OrganizationResponse>;
-  updatePayment: (id: string, request: PaymentRequest) => Promise<void>;
-  upgrade: (id: string, request: OrganizationUpgradeRequest) => Promise<PaymentResponse>;
-  updatePasswordManagerSeats: (
+  ): Promise<OrganizationResponse>;
+  abstract createLicense(data: FormData): Promise<OrganizationResponse>;
+  abstract save(id: string, request: OrganizationUpdateRequest): Promise<OrganizationResponse>;
+  abstract updatePayment(id: string, request: PaymentRequest): Promise<void>;
+  abstract upgrade(id: string, request: OrganizationUpgradeRequest): Promise<PaymentResponse>;
+  abstract updatePasswordManagerSeats(
     id: string,
     request: OrganizationSubscriptionUpdateRequest,
-  ) => Promise<ProfileOrganizationResponse>;
-  updateSecretsManagerSubscription: (
+  ): Promise<ProfileOrganizationResponse>;
+  abstract updateSecretsManagerSubscription(
     id: string,
     request: OrganizationSmSubscriptionUpdateRequest,
-  ) => Promise<ProfileOrganizationResponse>;
-  updateSeats: (id: string, request: SeatRequest) => Promise<PaymentResponse>;
-  updateStorage: (id: string, request: StorageRequest) => Promise<PaymentResponse>;
-  verifyBank: (id: string, request: VerifyBankRequest) => Promise<void>;
-  reinstate: (id: string) => Promise<void>;
-  leave: (id: string) => Promise<void>;
-  delete: (id: string, request: SecretVerificationRequest) => Promise<void>;
-  deleteUsingToken: (
+  ): Promise<ProfileOrganizationResponse>;
+  abstract updateSeats(id: string, request: SeatRequest): Promise<PaymentResponse>;
+  abstract updateStorage(id: string, request: StorageRequest): Promise<PaymentResponse>;
+  abstract verifyBank(id: string, request: VerifyBankRequest): Promise<void>;
+  abstract reinstate(id: string): Promise<void>;
+  abstract leave(id: string): Promise<void>;
+  abstract delete(id: string, request: SecretVerificationRequest): Promise<void>;
+  abstract deleteUsingToken(
     organizationId: string,
     request: OrganizationVerifyDeleteRecoverRequest,
-  ) => Promise<any>;
-  updateLicense: (id: string, data: FormData) => Promise<void>;
-  importDirectory: (organizationId: string, request: ImportDirectoryRequest) => Promise<void>;
-  getOrCreateApiKey: (id: string, request: OrganizationApiKeyRequest) => Promise<ApiKeyResponse>;
-  getApiKeyInformation: (
+  ): Promise<any>;
+  abstract updateLicense(id: string, data: FormData): Promise<void>;
+  abstract importDirectory(organizationId: string, request: ImportDirectoryRequest): Promise<void>;
+  abstract getOrCreateApiKey(
+    id: string,
+    request: OrganizationApiKeyRequest,
+  ): Promise<ApiKeyResponse>;
+  abstract getApiKeyInformation(
     id: string,
     organizationApiKeyType?: OrganizationApiKeyType,
-  ) => Promise<ListResponse<OrganizationApiKeyInformationResponse>>;
-  rotateApiKey: (id: string, request: OrganizationApiKeyRequest) => Promise<ApiKeyResponse>;
-  getTaxInfo: (id: string) => Promise<TaxInfoResponse>;
-  updateTaxInfo: (id: string, request: ExpandedTaxInfoUpdateRequest) => Promise<void>;
-  getKeys: (id: string) => Promise<OrganizationKeysResponse>;
-  updateKeys: (id: string, request: OrganizationKeysRequest) => Promise<OrganizationKeysResponse>;
-  getSso: (id: string) => Promise<OrganizationSsoResponse>;
-  updateSso: (id: string, request: OrganizationSsoRequest) => Promise<OrganizationSsoResponse>;
-  selfHostedSyncLicense: (id: string) => Promise<void>;
-  subscribeToSecretsManager: (
+  ): Promise<ListResponse<OrganizationApiKeyInformationResponse>>;
+  abstract rotateApiKey(id: string, request: OrganizationApiKeyRequest): Promise<ApiKeyResponse>;
+  abstract getTaxInfo(id: string): Promise<TaxInfoResponse>;
+  abstract updateTaxInfo(id: string, request: ExpandedTaxInfoUpdateRequest): Promise<void>;
+  abstract getKeys(id: string): Promise<OrganizationKeysResponse>;
+  abstract updateKeys(
+    id: string,
+    request: OrganizationKeysRequest,
+  ): Promise<OrganizationKeysResponse>;
+  abstract getSso(id: string): Promise<OrganizationSsoResponse>;
+  abstract updateSso(id: string, request: OrganizationSsoRequest): Promise<OrganizationSsoResponse>;
+  abstract selfHostedSyncLicense(id: string): Promise<void>;
+  abstract subscribeToSecretsManager(
     id: string,
     request: SecretsManagerSubscribeRequest,
-  ) => Promise<ProfileOrganizationResponse>;
-  updateCollectionManagement: (
+  ): Promise<ProfileOrganizationResponse>;
+  abstract updateCollectionManagement(
     id: string,
     request: OrganizationCollectionManagementUpdateRequest,
-  ) => Promise<OrganizationResponse>;
+  ): Promise<OrganizationResponse>;
 }

libs/common/src/admin-console/abstractions/organization/organization.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { map, Observable } from "rxjs";
 
 import { UserId } from "../../../types/guid";
@@ -68,20 +66,20 @@ export abstract class OrganizationService {
    * Publishes state for all organizations under the specified user.
    * @returns An observable list of organizations
    */
-  organizations$: (userId: UserId) => Observable<Organization[]>;
+  abstract organizations$(userId: UserId): Observable<Organization[]>;
 
   // @todo Clean these up. Continuing to expand them is not recommended.
   // @see https://bitwarden.atlassian.net/browse/AC-2252
-  memberOrganizations$: (userId: UserId) => Observable<Organization[]>;
+  abstract memberOrganizations$(userId: UserId): Observable<Organization[]>;
   /**
    * Emits true if the user can create or manage a Free Bitwarden Families sponsorship.
    */
-  canManageSponsorships$: (userId: UserId) => Observable<boolean>;
+  abstract canManageSponsorships$(userId: UserId): Observable<boolean>;
   /**
    * Emits true if any of the user's organizations have a Free Bitwarden Families sponsorship available.
    */
-  familySponsorshipAvailable$: (userId: UserId) => Observable<boolean>;
-  hasOrganizations: (userId: UserId) => Observable<boolean>;
+  abstract familySponsorshipAvailable$(userId: UserId): Observable<boolean>;
+  abstract hasOrganizations(userId: UserId): Observable<boolean>;
 }
 
 /**
@@ -96,7 +94,7 @@ export abstract class InternalOrganizationServiceAbstraction extends Organizatio
    * @param organization The organization state being saved.
    * @param userId The userId to replace state for.
    */
-  upsert: (OrganizationData: OrganizationData, userId: UserId) => Promise<void>;
+  abstract upsert(OrganizationData: OrganizationData, userId: UserId): Promise<void>;
 
   /**
    * Replaces state for the entire registered organization list for the specified user.
@@ -107,5 +105,8 @@ export abstract class InternalOrganizationServiceAbstraction extends Organizatio
    * user.
    * @param userId The userId to replace state for.
    */
-  replace: (organizations: { [id: string]: OrganizationData }, userId: UserId) => Promise<void>;
+  abstract replace(
+    organizations: { [id: string]: OrganizationData },
+    userId: UserId,
+  ): Promise<void>;
 }

libs/common/src/admin-console/abstractions/provider.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { UserId } from "../../types/guid";
@@ -7,8 +5,8 @@ import { ProviderData } from "../models/data/provider.data";
 import { Provider } from "../models/domain/provider";
 
 export abstract class ProviderService {
-  get$: (id: string) => Observable<Provider>;
-  get: (id: string) => Promise<Provider>;
-  getAll: () => Promise<Provider[]>;
-  save: (providers: { [id: string]: ProviderData }, userId?: UserId) => Promise<any>;
+  abstract get$(id: string): Observable<Provider>;
+  abstract get(id: string): Promise<Provider>;
+  abstract getAll(): Promise<Provider[]>;
+  abstract save(providers: { [id: string]: ProviderData }, userId?: UserId): Promise<any>;
 }

libs/common/src/admin-console/abstractions/provider/provider-api.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { AddableOrganizationResponse } from "@bitwarden/common/admin-console/models/response/addable-organization.response";
 
 import { ProviderSetupRequest } from "../../models/request/provider/provider-setup.request";
@@ -7,21 +5,23 @@ import { ProviderUpdateRequest } from "../../models/request/provider/provider-up
 import { ProviderVerifyRecoverDeleteRequest } from "../../models/request/provider/provider-verify-recover-delete.request";
 import { ProviderResponse } from "../../models/response/provider/provider.response";
 
-export class ProviderApiServiceAbstraction {
-  postProviderSetup: (id: string, request: ProviderSetupRequest) => Promise<ProviderResponse>;
-  getProvider: (id: string) => Promise<ProviderResponse>;
-  putProvider: (id: string, request: ProviderUpdateRequest) => Promise<ProviderResponse>;
-  providerRecoverDeleteToken: (
+export abstract class ProviderApiServiceAbstraction {
+  abstract postProviderSetup(id: string, request: ProviderSetupRequest): Promise<ProviderResponse>;
+  abstract getProvider(id: string): Promise<ProviderResponse>;
+  abstract putProvider(id: string, request: ProviderUpdateRequest): Promise<ProviderResponse>;
+  abstract providerRecoverDeleteToken(
     organizationId: string,
     request: ProviderVerifyRecoverDeleteRequest,
-  ) => Promise<any>;
-  deleteProvider: (id: string) => Promise<void>;
-  getProviderAddableOrganizations: (providerId: string) => Promise<AddableOrganizationResponse[]>;
-  addOrganizationToProvider: (
+  ): Promise<any>;
+  abstract deleteProvider(id: string): Promise<void>;
+  abstract getProviderAddableOrganizations(
+    providerId: string,
+  ): Promise<AddableOrganizationResponse[]>;
+  abstract addOrganizationToProvider(
     providerId: string,
     request: {
       key: string;
       organizationId: string;
     },
-  ) => Promise<void>;
+  ): Promise<void>;
 }

libs/common/src/admin-console/services/policy/default-policy.service.ts

@@ -89,8 +89,7 @@ export class DefaultPolicyService implements PolicyService {
     const policies$ = policies ? of(policies) : this.policies$(userId);
     return policies$.pipe(
       map((obsPolicies) => {
-        // TODO: replace with this.combinePoliciesIntoMasterPasswordPolicyOptions(obsPolicies)) once
-        // FeatureFlag.PM16117_ChangeExistingPasswordRefactor is removed.
+        // TODO ([PM-23777]): replace with this.combinePoliciesIntoMasterPasswordPolicyOptions(obsPolicies))
         let enforcedOptions: MasterPasswordPolicyOptions | undefined = undefined;
         const filteredPolicies =
           obsPolicies.filter((p) => p.type === PolicyType.MasterPassword) ?? [];

libs/common/src/auth/abstractions/account.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { UserId } from "../../types/guid";
@@ -35,20 +33,20 @@ export function accountInfoEqual(a: AccountInfo, b: AccountInfo) {
 }
 
 export abstract class AccountService {
-  accounts$: Observable<Record<UserId, AccountInfo>>;
+  abstract accounts$: Observable<Record<UserId, AccountInfo>>;
 
-  activeAccount$: Observable<Account | null>;
+  abstract activeAccount$: Observable<Account | null>;
 
   /**
    * Observable of the last activity time for each account.
    */
-  accountActivity$: Observable<Record<UserId, Date>>;
+  abstract accountActivity$: Observable<Record<UserId, Date>>;
   /** Observable of the new device login verification property for the account. */
-  accountVerifyNewDeviceLogin$: Observable<boolean>;
+  abstract accountVerifyNewDeviceLogin$: Observable<boolean>;
   /** Account list in order of descending recency */
-  sortedUserIds$: Observable<UserId[]>;
+  abstract sortedUserIds$: Observable<UserId[]>;
   /** Next account that is not the current active account */
-  nextUpAccount$: Observable<Account>;
+  abstract nextUpAccount$: Observable<Account>;
   /**
    * Updates the `accounts$` observable with the new account data.
    *

libs/common/src/auth/abstractions/anonymous-hub.service.ts

@@ -1,6 +1,4 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 export abstract class AnonymousHubService {
-  createHubConnection: (token: string) => Promise<void>;
-  stopHubConnection: () => Promise<void>;
+  abstract createHubConnection(token: string): Promise<void>;
+  abstract stopHubConnection(): Promise<void>;
 }

libs/common/src/auth/abstractions/avatar.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { UserId } from "../../types/guid";
@@ -9,7 +7,7 @@ export abstract class AvatarService {
    * An observable monitoring the active user's avatar color.
    * The observable updates when the avatar color changes.
    */
-  avatarColor$: Observable<string | null>;
+  abstract avatarColor$: Observable<string | null>;
   /**
    * Sets the avatar color of the active user
    *

libs/common/src/auth/abstractions/devices-api.service.abstraction.ts

@@ -1,47 +1,45 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { ListResponse } from "../../models/response/list.response";
 import { DeviceResponse } from "../abstractions/devices/responses/device.response";
 import { UpdateDevicesTrustRequest } from "../models/request/update-devices-trust.request";
 import { ProtectedDeviceResponse } from "../models/response/protected-device.response";
 
 export abstract class DevicesApiServiceAbstraction {
-  getKnownDevice: (email: string, deviceIdentifier: string) => Promise<boolean>;
+  abstract getKnownDevice(email: string, deviceIdentifier: string): Promise<boolean>;
 
-  getDeviceByIdentifier: (deviceIdentifier: string) => Promise<DeviceResponse>;
+  abstract getDeviceByIdentifier(deviceIdentifier: string): Promise<DeviceResponse>;
 
-  getDevices: () => Promise<ListResponse<DeviceResponse>>;
+  abstract getDevices(): Promise<ListResponse<DeviceResponse>>;
 
-  updateTrustedDeviceKeys: (
+  abstract updateTrustedDeviceKeys(
     deviceIdentifier: string,
     devicePublicKeyEncryptedUserKey: string,
     userKeyEncryptedDevicePublicKey: string,
     deviceKeyEncryptedDevicePrivateKey: string,
-  ) => Promise<DeviceResponse>;
+  ): Promise<DeviceResponse>;
 
-  updateTrust: (
+  abstract updateTrust(
     updateDevicesTrustRequestModel: UpdateDevicesTrustRequest,
     deviceIdentifier: string,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  getDeviceKeys: (deviceIdentifier: string) => Promise<ProtectedDeviceResponse>;
+  abstract getDeviceKeys(deviceIdentifier: string): Promise<ProtectedDeviceResponse>;
 
   /**
    * Notifies the server that the device has a device key, but didn't receive any associated decryption keys.
    * Note: For debugging purposes only.
    * @param deviceIdentifier - current device identifier
    */
-  postDeviceTrustLoss: (deviceIdentifier: string) => Promise<void>;
+  abstract postDeviceTrustLoss(deviceIdentifier: string): Promise<void>;
 
   /**
    * Deactivates a device
    * @param deviceId - The device ID
    */
-  deactivateDevice: (deviceId: string) => Promise<void>;
+  abstract deactivateDevice(deviceId: string): Promise<void>;
 
   /**
    * Removes trust from a list of devices
    * @param deviceIds - The device IDs to be untrusted
    */
-  untrustDevices: (deviceIds: string[]) => Promise<void>;
+  abstract untrustDevices(deviceIds: string[]): Promise<void>;
 }

libs/common/src/auth/abstractions/token.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { VaultTimeout, VaultTimeoutAction } from "../../key-management/vault-timeout";
@@ -27,20 +25,20 @@ export abstract class TokenService {
    *
    * @returns A promise that resolves with the SetTokensResult containing the tokens that were set.
    */
-  setTokens: (
+  abstract setTokens(
     accessToken: string,
     vaultTimeoutAction: VaultTimeoutAction,
     vaultTimeout: VaultTimeout,
     refreshToken?: string,
     clientIdClientSecret?: [string, string],
-  ) => Promise<SetTokensResult>;
+  ): Promise<SetTokensResult>;
 
   /**
    * Clears the access token, refresh token, API Key Client ID, and API Key Client Secret out of memory, disk, and secure storage if supported.
    * @param userId The optional user id to clear the tokens for; if not provided, the active user id is used.
    * @returns A promise that resolves when the tokens have been cleared.
    */
-  clearTokens: (userId?: UserId) => Promise<void>;
+  abstract clearTokens(userId?: UserId): Promise<void>;
 
   /**
    * Sets the access token in memory or disk based on the given vaultTimeoutAction and vaultTimeout
@@ -51,11 +49,11 @@ export abstract class TokenService {
    * @param vaultTimeout The timeout for the vault.
    * @returns A promise that resolves with the access token that has been set.
    */
-  setAccessToken: (
+  abstract setAccessToken(
     accessToken: string,
     vaultTimeoutAction: VaultTimeoutAction,
     vaultTimeout: VaultTimeout,
-  ) => Promise<string>;
+  ): Promise<string>;
 
   // TODO: revisit having this public clear method approach once the state service is fully deprecated.
   /**
@@ -67,21 +65,21 @@ export abstract class TokenService {
    * pass in the vaultTimeoutAction and vaultTimeout.
    * This avoids a circular dependency between the StateService, TokenService, and VaultTimeoutSettingsService.
    */
-  clearAccessToken: (userId?: UserId) => Promise<void>;
+  abstract clearAccessToken(userId?: UserId): Promise<void>;
 
   /**
    * Gets the access token
    * @param userId - The optional user id to get the access token for; if not provided, the active user is used.
    * @returns A promise that resolves with the access token or null.
    */
-  getAccessToken: (userId?: UserId) => Promise<string | null>;
+  abstract getAccessToken(userId?: UserId): Promise<string | null>;
 
   /**
    * Gets the refresh token.
    * @param userId - The optional user id to get the refresh token for; if not provided, the active user is used.
    * @returns A promise that resolves with the refresh token or null.
    */
-  getRefreshToken: (userId?: UserId) => Promise<string | null>;
+  abstract getRefreshToken(userId?: UserId): Promise<string | null>;
 
   /**
    * Sets the API Key Client ID for the active user id in memory or disk based on the given vaultTimeoutAction and vaultTimeout.
@@ -90,18 +88,18 @@ export abstract class TokenService {
    * @param vaultTimeout The timeout for the vault.
    * @returns A promise that resolves with the API Key Client ID that has been set.
    */
-  setClientId: (
+  abstract setClientId(
     clientId: string,
     vaultTimeoutAction: VaultTimeoutAction,
     vaultTimeout: VaultTimeout,
     userId?: UserId,
-  ) => Promise<string>;
+  ): Promise<string>;
 
   /**
    * Gets the API Key Client ID for the active user.
    * @returns A promise that resolves with the API Key Client ID or undefined
    */
-  getClientId: (userId?: UserId) => Promise<string | undefined>;
+  abstract getClientId(userId?: UserId): Promise<string | undefined>;
 
   /**
    * Sets the API Key Client Secret for the active user id in memory or disk based on the given vaultTimeoutAction and vaultTimeout.
@@ -110,18 +108,18 @@ export abstract class TokenService {
    * @param vaultTimeout The timeout for the vault.
    * @returns A promise that resolves with the client secret that has been set.
    */
-  setClientSecret: (
+  abstract setClientSecret(
     clientSecret: string,
     vaultTimeoutAction: VaultTimeoutAction,
     vaultTimeout: VaultTimeout,
     userId?: UserId,
-  ) => Promise<string>;
+  ): Promise<string>;
 
   /**
    * Gets the API Key Client Secret for the active user.
    * @returns A promise that resolves with the API Key Client Secret or undefined
    */
-  getClientSecret: (userId?: UserId) => Promise<string | undefined>;
+  abstract getClientSecret(userId?: UserId): Promise<string | undefined>;
 
   /**
    * Sets the two factor token for the given email in global state.
@@ -131,21 +129,21 @@ export abstract class TokenService {
    * @param twoFactorToken The two factor token to set.
    * @returns A promise that resolves when the two factor token has been set.
    */
-  setTwoFactorToken: (email: string, twoFactorToken: string) => Promise<void>;
+  abstract setTwoFactorToken(email: string, twoFactorToken: string): Promise<void>;
 
   /**
    * Gets the two factor token for the given email.
    * @param email The email to get the two factor token for.
    * @returns A promise that resolves with the two factor token for the given email or null if it isn't found.
    */
-  getTwoFactorToken: (email: string) => Promise<string | null>;
+  abstract getTwoFactorToken(email: string): Promise<string | null>;
 
   /**
    * Clears the two factor token for the given email out of global state.
    * @param email The email to clear the two factor token for.
    * @returns A promise that resolves when the two factor token has been cleared.
    */
-  clearTwoFactorToken: (email: string) => Promise<void>;
+  abstract clearTwoFactorToken(email: string): Promise<void>;
 
   /**
    * Decodes the access token.
@@ -153,13 +151,13 @@ export abstract class TokenService {
    * If null, the currently active user's token is used.
    * @returns A promise that resolves with the decoded access token.
    */
-  decodeAccessToken: (tokenOrUserId?: string | UserId) => Promise<DecodedAccessToken>;
+  abstract decodeAccessToken(tokenOrUserId?: string | UserId): Promise<DecodedAccessToken>;
 
   /**
    * Gets the expiration date for the access token. Returns if token can't be decoded or has no expiration
    * @returns A promise that resolves with the expiration date for the access token.
    */
-  getTokenExpirationDate: () => Promise<Date | null>;
+  abstract getTokenExpirationDate(): Promise<Date | null>;
 
   /**
    * Calculates the adjusted time in seconds until the access token expires, considering an optional offset.
@@ -170,58 +168,58 @@ export abstract class TokenService {
    * based on the actual expiration.
    * @returns {Promise<number>} Promise resolving to the adjusted seconds remaining.
    */
-  tokenSecondsRemaining: (offsetSeconds?: number) => Promise<number>;
+  abstract tokenSecondsRemaining(offsetSeconds?: number): Promise<number>;
 
   /**
    * Checks if the access token needs to be refreshed.
    * @param {number} [minutes=5] - Optional number of minutes before the access token expires to consider refreshing it.
    * @returns A promise that resolves with a boolean indicating if the access token needs to be refreshed.
    */
-  tokenNeedsRefresh: (minutes?: number) => Promise<boolean>;
+  abstract tokenNeedsRefresh(minutes?: number): Promise<boolean>;
 
   /**
    * Gets the user id for the active user from the access token.
    * @returns A promise that resolves with the user id for the active user.
    * @deprecated Use AccountService.activeAccount$ instead.
    */
-  getUserId: () => Promise<UserId>;
+  abstract getUserId(): Promise<UserId>;
 
   /**
    * Gets the email for the active user from the access token.
    * @returns A promise that resolves with the email for the active user.
    * @deprecated Use AccountService.activeAccount$ instead.
    */
-  getEmail: () => Promise<string>;
+  abstract getEmail(): Promise<string>;
 
   /**
    * Gets the email verified status for the active user from the access token.
    * @returns A promise that resolves with the email verified status for the active user.
    */
-  getEmailVerified: () => Promise<boolean>;
+  abstract getEmailVerified(): Promise<boolean>;
 
   /**
    * Gets the name for the active user from the access token.
    * @returns A promise that resolves with the name for the active user.
    * @deprecated Use AccountService.activeAccount$ instead.
    */
-  getName: () => Promise<string>;
+  abstract getName(): Promise<string>;
 
   /**
    * Gets the issuer for the active user from the access token.
    * @returns A promise that resolves with the issuer for the active user.
    */
-  getIssuer: () => Promise<string>;
+  abstract getIssuer(): Promise<string>;
 
   /**
    * Gets whether or not the user authenticated via an external mechanism.
    * @param userId The optional user id to check for external authN status; if not provided, the active user is used.
    * @returns A promise that resolves with a boolean representing the user's external authN status.
    */
-  getIsExternal: (userId: UserId) => Promise<boolean>;
+  abstract getIsExternal(userId: UserId): Promise<boolean>;
 
   /** Gets the active or passed in user's security stamp */
-  getSecurityStamp: (userId?: UserId) => Promise<string | null>;
+  abstract getSecurityStamp(userId?: UserId): Promise<string | null>;
 
   /** Sets the security stamp for the active or passed in user */
-  setSecurityStamp: (securityStamp: string, userId?: UserId) => Promise<void>;
+  abstract setSecurityStamp(securityStamp: string, userId?: UserId): Promise<void>;
 }

libs/common/src/auth/abstractions/user-verification/user-verification-api.service.abstraction.ts

@@ -1,13 +1,11 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { SecretVerificationRequest } from "../../models/request/secret-verification.request";
 import { VerifyOTPRequest } from "../../models/request/verify-otp.request";
 import { MasterPasswordPolicyResponse } from "../../models/response/master-password-policy.response";
 
 export abstract class UserVerificationApiServiceAbstraction {
-  postAccountVerifyOTP: (request: VerifyOTPRequest) => Promise<void>;
-  postAccountRequestOTP: () => Promise<void>;
-  postAccountVerifyPassword: (
+  abstract postAccountVerifyOTP(request: VerifyOTPRequest): Promise<void>;
+  abstract postAccountRequestOTP(): Promise<void>;
+  abstract postAccountVerifyPassword(
     request: SecretVerificationRequest,
-  ) => Promise<MasterPasswordPolicyResponse>;
+  ): Promise<MasterPasswordPolicyResponse>;
 }

libs/common/src/auth/abstractions/user-verification/user-verification.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { UserId } from "../../../types/guid";
 import { SecretVerificationRequest } from "../../models/request/secret-verification.request";
 import { UserVerificationOptions } from "../../types/user-verification-options";
@@ -16,9 +14,9 @@ export abstract class UserVerificationService {
    * @param verificationType Type of verification to restrict the options to
    * @returns Available verification options for the user
    */
-  getAvailableVerificationOptions: (
+  abstract getAvailableVerificationOptions(
     verificationType: keyof UserVerificationOptions,
-  ) => Promise<UserVerificationOptions>;
+  ): Promise<UserVerificationOptions>;
   /**
    * Create a new request model to be used for server-side verification
    * @param verification User-supplied verification data (Master Password or OTP)
@@ -26,11 +24,11 @@ export abstract class UserVerificationService {
    * @param alreadyHashed Whether the master password is already hashed
    * @throws Error if the verification data is invalid
    */
-  buildRequest: <T extends SecretVerificationRequest>(
+  abstract buildRequest<T extends SecretVerificationRequest>(
     verification: Verification,
     requestClass?: new () => T,
     alreadyHashed?: boolean,
-  ) => Promise<T>;
+  ): Promise<T>;
   /**
    * Verifies the user using the provided verification data.
    * PIN or biometrics are verified client-side.
@@ -39,11 +37,11 @@ export abstract class UserVerificationService {
    * @param verification User-supplied verification data (OTP, MP, PIN, or biometrics)
    * @throws Error if the verification data is invalid or the verification fails
    */
-  verifyUser: (verification: Verification) => Promise<boolean>;
+  abstract verifyUser(verification: Verification): Promise<boolean>;
   /**
    * Request a one-time password (OTP) to be sent to the user's email
    */
-  requestOTP: () => Promise<void>;
+  abstract requestOTP(): Promise<void>;
   /**
    * Check if user has master password or can only use passwordless technologies to log in
    * Note: This only checks the server, not the local state
@@ -51,13 +49,13 @@ export abstract class UserVerificationService {
    * @returns True if the user has a master password
    * @deprecated Use UserDecryptionOptionsService.hasMasterPassword$ instead
    */
-  hasMasterPassword: (userId?: string) => Promise<boolean>;
+  abstract hasMasterPassword(userId?: string): Promise<boolean>;
   /**
    * Check if the user has a master password and has used it during their current session
    * @param userId The user id to check. If not provided, the current user id used
    * @returns True if the user has a master password and has used it in the current session
    */
-  hasMasterPasswordAndMasterKeyHash: (userId?: string) => Promise<boolean>;
+  abstract hasMasterPasswordAndMasterKeyHash(userId?: string): Promise<boolean>;
   /**
    * Verifies the user using the provided master password.
    * Attempts to verify client-side first, then server-side if necessary.
@@ -68,9 +66,9 @@ export abstract class UserVerificationService {
    * @throws Error if the master password is invalid
    * @returns An object containing the master key, and master password policy options if verified on server.
    */
-  verifyUserByMasterPassword: (
+  abstract verifyUserByMasterPassword(
     verification: MasterPasswordVerification,
     userId: UserId,
     email: string,
-  ) => Promise<MasterPasswordVerificationResponse>;
+  ): Promise<MasterPasswordVerificationResponse>;
 }

libs/common/src/auth/abstractions/webauthn/webauthn-login-api.service.abstraction.ts

@@ -1,7 +1,5 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { CredentialAssertionOptionsResponse } from "../../services/webauthn-login/response/credential-assertion-options.response";
 
-export class WebAuthnLoginApiServiceAbstraction {
-  getCredentialAssertionOptions: () => Promise<CredentialAssertionOptionsResponse>;
+export abstract class WebAuthnLoginApiServiceAbstraction {
+  abstract getCredentialAssertionOptions(): Promise<CredentialAssertionOptionsResponse>;
 }

libs/common/src/auth/abstractions/webauthn/webauthn-login-prf-key.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { PrfKey } from "../../../types/key";
 
 /**
@@ -9,11 +7,11 @@ export abstract class WebAuthnLoginPrfKeyServiceAbstraction {
   /**
    * Get the salt used to generate the PRF-output used when logging in with WebAuthn.
    */
-  getLoginWithPrfSalt: () => Promise<ArrayBuffer>;
+  abstract getLoginWithPrfSalt(): Promise<ArrayBuffer>;
 
   /**
    * Create a symmetric key from the PRF-output by stretching it.
    * This should be used as `ExternalKey` with `RotateableKeySet`.
    */
-  createSymmetricKeyFromPrf: (prf: ArrayBuffer) => Promise<PrfKey>;
+  abstract createSymmetricKeyFromPrf(prf: ArrayBuffer): Promise<PrfKey>;
 }

libs/common/src/auth/abstractions/webauthn/webauthn-login.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { AuthResult } from "../../models/domain/auth-result";
 import { WebAuthnLoginCredentialAssertionOptionsView } from "../../models/view/webauthn-login/webauthn-login-credential-assertion-options.view";
 import { WebAuthnLoginCredentialAssertionView } from "../../models/view/webauthn-login/webauthn-login-credential-assertion.view";
@@ -14,7 +12,7 @@ export abstract class WebAuthnLoginServiceAbstraction {
    * (whether FIDO2 user verification is required, the relying party id, timeout duration for the process to complete, etc.)
    * for the authenticator.
    */
-  getCredentialAssertionOptions: () => Promise<WebAuthnLoginCredentialAssertionOptionsView>;
+  abstract getCredentialAssertionOptions(): Promise<WebAuthnLoginCredentialAssertionOptionsView>;
 
   /**
    * Asserts the credential. This involves user interaction with the authenticator
@@ -27,9 +25,9 @@ export abstract class WebAuthnLoginServiceAbstraction {
    * @returns {WebAuthnLoginCredentialAssertionView} The assertion obtained from the authenticator.
    * If the assertion is not successfully obtained, it returns undefined.
    */
-  assertCredential: (
+  abstract assertCredential(
     credentialAssertionOptions: WebAuthnLoginCredentialAssertionOptionsView,
-  ) => Promise<WebAuthnLoginCredentialAssertionView | undefined>;
+  ): Promise<WebAuthnLoginCredentialAssertionView | undefined>;
 
   /**
    * Logs the user in using the assertion obtained from the authenticator.
@@ -39,5 +37,5 @@ export abstract class WebAuthnLoginServiceAbstraction {
    * @param {WebAuthnLoginCredentialAssertionView} assertion - The assertion obtained from the authenticator
    * that needs to be validated for login.
    */
-  logIn: (assertion: WebAuthnLoginCredentialAssertionView) => Promise<AuthResult>;
+  abstract logIn(assertion: WebAuthnLoginCredentialAssertionView): Promise<AuthResult>;
 }

libs/common/src/billing/abstractions/account/account-billing-api.service.abstraction.ts

@@ -1,11 +1,12 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import {
   BillingInvoiceResponse,
   BillingTransactionResponse,
 } from "../../models/response/billing.response";
 
-export class AccountBillingApiServiceAbstraction {
-  getBillingInvoices: (status?: string, startAfter?: string) => Promise<BillingInvoiceResponse[]>;
-  getBillingTransactions: (startAfter?: string) => Promise<BillingTransactionResponse[]>;
+export abstract class AccountBillingApiServiceAbstraction {
+  abstract getBillingInvoices(
+    status?: string,
+    startAfter?: string,
+  ): Promise<BillingInvoiceResponse[]>;
+  abstract getBillingTransactions(startAfter?: string): Promise<BillingTransactionResponse[]>;
 }

libs/common/src/billing/abstractions/account/billing-account-profile-state.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { UserId } from "../../../types/guid";

libs/common/src/billing/abstractions/billing-api.service.abstraction.ts

@@ -1,6 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-
 import { TaxInfoResponse } from "@bitwarden/common/billing/models/response/tax-info.response";
 
 import { OrganizationCreateRequest } from "../../admin-console/models/request/organization-create.request";
@@ -20,78 +17,78 @@ import { PaymentMethodResponse } from "../models/response/payment-method.respons
 import { ProviderSubscriptionResponse } from "../models/response/provider-subscription-response";
 
 export abstract class BillingApiServiceAbstraction {
-  cancelOrganizationSubscription: (
+  abstract cancelOrganizationSubscription(
     organizationId: string,
     request: SubscriptionCancellationRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  cancelPremiumUserSubscription: (request: SubscriptionCancellationRequest) => Promise<void>;
+  abstract cancelPremiumUserSubscription(request: SubscriptionCancellationRequest): Promise<void>;
 
-  createProviderClientOrganization: (
+  abstract createProviderClientOrganization(
     providerId: string,
     request: CreateClientOrganizationRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  createSetupIntent: (paymentMethodType: PaymentMethodType) => Promise<string>;
+  abstract createSetupIntent(paymentMethodType: PaymentMethodType): Promise<string>;
 
-  getOrganizationBillingMetadata: (
+  abstract getOrganizationBillingMetadata(
     organizationId: string,
-  ) => Promise<OrganizationBillingMetadataResponse>;
+  ): Promise<OrganizationBillingMetadataResponse>;
 
-  getOrganizationPaymentMethod: (organizationId: string) => Promise<PaymentMethodResponse>;
+  abstract getOrganizationPaymentMethod(organizationId: string): Promise<PaymentMethodResponse>;
 
-  getPlans: () => Promise<ListResponse<PlanResponse>>;
+  abstract getPlans(): Promise<ListResponse<PlanResponse>>;
 
-  getProviderClientInvoiceReport: (providerId: string, invoiceId: string) => Promise<string>;
+  abstract getProviderClientInvoiceReport(providerId: string, invoiceId: string): Promise<string>;
 
-  getProviderClientOrganizations: (
+  abstract getProviderClientOrganizations(
     providerId: string,
-  ) => Promise<ListResponse<ProviderOrganizationOrganizationDetailsResponse>>;
+  ): Promise<ListResponse<ProviderOrganizationOrganizationDetailsResponse>>;
 
-  getProviderInvoices: (providerId: string) => Promise<InvoicesResponse>;
+  abstract getProviderInvoices(providerId: string): Promise<InvoicesResponse>;
 
-  getProviderSubscription: (providerId: string) => Promise<ProviderSubscriptionResponse>;
+  abstract getProviderSubscription(providerId: string): Promise<ProviderSubscriptionResponse>;
 
-  getProviderTaxInformation: (providerId: string) => Promise<TaxInfoResponse>;
+  abstract getProviderTaxInformation(providerId: string): Promise<TaxInfoResponse>;
 
-  updateOrganizationPaymentMethod: (
+  abstract updateOrganizationPaymentMethod(
     organizationId: string,
     request: UpdatePaymentMethodRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  updateOrganizationTaxInformation: (
+  abstract updateOrganizationTaxInformation(
     organizationId: string,
     request: ExpandedTaxInfoUpdateRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  updateProviderClientOrganization: (
+  abstract updateProviderClientOrganization(
     providerId: string,
     organizationId: string,
     request: UpdateClientOrganizationRequest,
-  ) => Promise<any>;
+  ): Promise<any>;
 
-  updateProviderPaymentMethod: (
+  abstract updateProviderPaymentMethod(
     providerId: string,
     request: UpdatePaymentMethodRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  updateProviderTaxInformation: (
+  abstract updateProviderTaxInformation(
     providerId: string,
     request: ExpandedTaxInfoUpdateRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  verifyOrganizationBankAccount: (
+  abstract verifyOrganizationBankAccount(
     organizationId: string,
     request: VerifyBankAccountRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  verifyProviderBankAccount: (
+  abstract verifyProviderBankAccount(
     providerId: string,
     request: VerifyBankAccountRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 
-  restartSubscription: (
+  abstract restartSubscription(
     organizationId: string,
     request: OrganizationCreateRequest,
-  ) => Promise<void>;
+  ): Promise<void>;
 }

libs/common/src/billing/abstractions/organization-billing.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
@@ -49,20 +47,22 @@ export type SubscriptionInformation = {
 };
 
 export abstract class OrganizationBillingServiceAbstraction {
-  getPaymentSource: (organizationId: string) => Promise<PaymentSourceResponse>;
+  abstract getPaymentSource(organizationId: string): Promise<PaymentSourceResponse>;
 
-  purchaseSubscription: (subscription: SubscriptionInformation) => Promise<OrganizationResponse>;
-
-  purchaseSubscriptionNoPaymentMethod: (
+  abstract purchaseSubscription(
     subscription: SubscriptionInformation,
-  ) => Promise<OrganizationResponse>;
+  ): Promise<OrganizationResponse>;
 
-  startFree: (subscription: SubscriptionInformation) => Promise<OrganizationResponse>;
+  abstract purchaseSubscriptionNoPaymentMethod(
+    subscription: SubscriptionInformation,
+  ): Promise<OrganizationResponse>;
 
-  restartSubscription: (
+  abstract startFree(subscription: SubscriptionInformation): Promise<OrganizationResponse>;
+
+  abstract restartSubscription(
     organizationId: string,
     subscription: SubscriptionInformation,
-  ) => Promise<void>;
+  ): Promise<void>;
 
   /**
    * Determines if breadcrumbing policies is enabled for the organizations meeting certain criteria.

libs/common/src/billing/abstractions/organizations/organization-billing-api.service.abstraction.ts

@@ -1,3 +1,4 @@
+import { ChangePlanFrequencyRequest } from "@bitwarden/common/billing/models/request/change-plan-frequency.request";
 import { OrganizationWarningsResponse } from "@bitwarden/common/billing/models/response/organization-warnings.response";
 
 import {
@@ -28,4 +29,9 @@ export abstract class OrganizationBillingApiServiceAbstraction {
       organizationKey: string;
     },
   ) => Promise<string>;
+
+  abstract changeSubscriptionFrequency: (
+    organizationId: string,
+    request: ChangePlanFrequencyRequest,
+  ) => Promise<void>;
 }

libs/common/src/billing/models/request/change-plan-frequency.request.ts

@@ -0,0 +1,9 @@
+import { PlanType } from "../../enums";
+
+export class ChangePlanFrequencyRequest {
+  newPlanType: PlanType;
+
+  constructor(newPlanType?: PlanType) {
+    this.newPlanType = newPlanType!;
+  }
+}

libs/common/src/billing/services/organization/organization-billing-api.service.ts

@@ -1,3 +1,4 @@
+import { ChangePlanFrequencyRequest } from "@bitwarden/common/billing/models/request/change-plan-frequency.request";
 import { OrganizationWarningsResponse } from "@bitwarden/common/billing/models/response/organization-warnings.response";
 
 import { ApiService } from "../../../abstractions/api.service";
@@ -83,4 +84,17 @@ export class OrganizationBillingApiService implements OrganizationBillingApiServ
 
     return response as string;
   }
+
+  async changeSubscriptionFrequency(
+    organizationId: string,
+    request: ChangePlanFrequencyRequest,
+  ): Promise<void> {
+    return await this.apiService.send(
+      "POST",
+      "/organizations/" + organizationId + "/billing/change-frequency",
+      request,
+      true,
+      false,
+    );
+  }
 }

libs/common/src/enums/feature-flag.enum.ts

@@ -14,8 +14,6 @@ export enum FeatureFlag {
   CreateDefaultLocation = "pm-19467-create-default-location",
 
   /* Auth */
-  PM16117_SetInitialPasswordRefactor = "pm-16117-set-initial-password-refactor",
-  PM16117_ChangeExistingPasswordRefactor = "pm-16117-change-existing-password-refactor",
   PM14938_BrowserExtensionLoginApproval = "pm-14938-browser-extension-login-approvals",
 
   /* Autofill */
@@ -35,9 +33,6 @@ export enum FeatureFlag {
   AllowTrialLengthZero = "pm-20322-allow-trial-length-0",
   PM21881_ManagePaymentDetailsOutsideCheckout = "pm-21881-manage-payment-details-outside-checkout",
 
-  /* Data Insights and Reporting */
-  EnableRiskInsightsNotifications = "enable-risk-insights-notifications",
-
   /* Key Management */
   PrivateKeyRegeneration = "pm-12241-private-key-regeneration",
   PM4154_BulkEncryptionService = "PM-4154-bulk-encryption-service",
@@ -49,11 +44,15 @@ export enum FeatureFlag {
   /* Tools */
   DesktopSendUIRefresh = "desktop-send-ui-refresh",
 
+  /* DIRT */
+  EventBasedOrganizationIntegrations = "event-based-organization-integrations",
+
   /* Vault */
   PM8851_BrowserOnboardingNudge = "pm-8851-browser-onboarding-nudge",
   PM9111ExtensionPersistAddEditForm = "pm-9111-extension-persist-add-edit-form",
   PM19941MigrateCipherDomainToSdk = "pm-19941-migrate-cipher-domain-to-sdk",
   PM22134SdkCipherListView = "pm-22134-sdk-cipher-list-view",
+  PM22136_SdkCipherEncryption = "pm-22136-sdk-cipher-encryption",
   CipherKeyEncryption = "cipher-key-encryption",
   EndUserNotifications = "pm-10609-end-user-notifications",
   RemoveCardItemTypePolicy = "pm-16442-remove-card-item-type-policy",
@@ -88,12 +87,12 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.MacOsNativeCredentialSync]: FALSE,
   [FeatureFlag.WindowsDesktopAutotype]: FALSE,
 
-  /* Data Insights and Reporting */
-  [FeatureFlag.EnableRiskInsightsNotifications]: FALSE,
-
   /* Tools */
   [FeatureFlag.DesktopSendUIRefresh]: FALSE,
 
+  /* DIRT */
+  [FeatureFlag.EventBasedOrganizationIntegrations]: FALSE,
+
   /* Vault */
   [FeatureFlag.PM8851_BrowserOnboardingNudge]: FALSE,
   [FeatureFlag.PM9111ExtensionPersistAddEditForm]: FALSE,
@@ -103,10 +102,9 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.RemoveCardItemTypePolicy]: FALSE,
   [FeatureFlag.PM22134SdkCipherListView]: FALSE,
   [FeatureFlag.PM19315EndUserActivationMvp]: FALSE,
+  [FeatureFlag.PM22136_SdkCipherEncryption]: FALSE,
 
   /* Auth */
-  [FeatureFlag.PM16117_SetInitialPasswordRefactor]: FALSE,
-  [FeatureFlag.PM16117_ChangeExistingPasswordRefactor]: FALSE,
   [FeatureFlag.PM14938_BrowserExtensionLoginApproval]: FALSE,
 
   /* Billing */

libs/common/src/key-management/crypto/abstractions/crypto-function.service.ts

@@ -41,7 +41,6 @@ export abstract class CryptoFunctionService {
     algorithm: "sha1" | "sha256" | "sha512",
   ): Promise<Uint8Array | string>;
   abstract compareFast(a: Uint8Array | string, b: Uint8Array | string): Promise<boolean>;
-  abstract aesEncrypt(data: Uint8Array, iv: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
   abstract aesDecryptFastParameters(
     data: string,
     iv: string,

libs/common/src/key-management/crypto/abstractions/encrypt.service.ts

@@ -7,20 +7,6 @@ import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-cr
 import { EncString } from "../models/enc-string";
 
 export abstract class EncryptService {
-  /**
-   * @deprecated
-   * Encrypts a string or Uint8Array to an EncString
-   * @param plainValue - The value to encrypt
-   * @param key - The key to encrypt the value with
-   */
-  abstract encrypt(plainValue: string | Uint8Array, key: SymmetricCryptoKey): Promise<EncString>;
-  /**
-   * @deprecated
-   * Encrypts a value to a Uint8Array
-   * @param plainValue - The value to encrypt
-   * @param key - The key to encrypt the value with
-   */
-  abstract encryptToBytes(plainValue: Uint8Array, key: SymmetricCryptoKey): Promise<EncArrayBuffer>;
   /**
    * @deprecated
    * Decrypts an EncString to a string

libs/common/src/key-management/crypto/models/enc-string.ts

@@ -153,6 +153,10 @@ export class EncString implements Encrypted {
     return EXPECTED_NUM_PARTS_BY_ENCRYPTION_TYPE[encType] === encPieces.length;
   }
 
+  /**
+   * @deprecated - This function is deprecated. Use EncryptService.decryptString instead.
+   * @returns - The decrypted string, or `[error: cannot decrypt]` if decryption fails.
+   */
   async decrypt(
     orgId: string | null,
     key: SymmetricCryptoKey | null = null,

libs/common/src/key-management/crypto/services/bulk-encrypt.service.impementation.spec.ts

@@ -1,170 +0,0 @@
-import { mock, MockProxy } from "jest-mock-extended";
-import * as rxjs from "rxjs";
-
-import { ServerConfig } from "../../../platform/abstractions/config/server-config";
-import { LogService } from "../../../platform/abstractions/log.service";
-import { Decryptable } from "../../../platform/interfaces/decryptable.interface";
-import { InitializerMetadata } from "../../../platform/interfaces/initializer-metadata.interface";
-import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-crypto-key";
-import { CryptoFunctionService } from "../abstractions/crypto-function.service";
-import { buildSetConfigMessage } from "../types/worker-command.type";
-
-import { BulkEncryptServiceImplementation } from "./bulk-encrypt.service.implementation";
-
-describe("BulkEncryptServiceImplementation", () => {
-  const cryptoFunctionService = mock<CryptoFunctionService>();
-  const logService = mock<LogService>();
-
-  let sut: BulkEncryptServiceImplementation;
-
-  beforeEach(() => {
-    sut = new BulkEncryptServiceImplementation(cryptoFunctionService, logService);
-  });
-
-  afterEach(() => {
-    jest.resetAllMocks();
-  });
-
-  describe("decryptItems", () => {
-    const key = mock<SymmetricCryptoKey>();
-    const serverConfig = mock<ServerConfig>();
-    const mockWorker = mock<Worker>();
-    let globalWindow: any;
-
-    beforeEach(() => {
-      globalWindow = global.window;
-
-      // Mock creating a worker.
-      global.Worker = jest.fn().mockImplementation(() => mockWorker);
-      global.URL = jest.fn().mockImplementation(() => "url") as unknown as typeof URL;
-      global.URL.createObjectURL = jest.fn().mockReturnValue("blob:url");
-      global.URL.revokeObjectURL = jest.fn();
-      global.URL.canParse = jest.fn().mockReturnValue(true);
-
-      // Mock the workers returned response.
-      const mockMessageEvent = {
-        id: "mock-guid",
-        data: ["decrypted1", "decrypted2"],
-      };
-      const mockMessageEvent$ = rxjs.from([mockMessageEvent]);
-      jest.spyOn(rxjs, "fromEvent").mockReturnValue(mockMessageEvent$);
-    });
-
-    afterEach(() => {
-      global.window = globalWindow;
-    });
-
-    it("throws error if key is null", async () => {
-      const nullKey = null as unknown as SymmetricCryptoKey;
-      await expect(sut.decryptItems([], nullKey)).rejects.toThrow("No encryption key provided.");
-    });
-
-    it("returns an empty array when items is null", async () => {
-      const result = await sut.decryptItems(null as any, key);
-      expect(result).toEqual([]);
-    });
-
-    it("returns an empty array when items is empty", async () => {
-      const result = await sut.decryptItems([], key);
-      expect(result).toEqual([]);
-    });
-
-    it("decrypts items sequentially when window is undefined", async () => {
-      // Make global window undefined.
-      delete (global as any).window;
-
-      const mockItems = [createMockDecryptable("item1"), createMockDecryptable("item2")];
-
-      const result = await sut.decryptItems(mockItems, key);
-
-      expect(logService.info).toHaveBeenCalledWith(
-        "Window not available in BulkEncryptService, decrypting sequentially",
-      );
-      expect(result).toEqual(["item1", "item2"]);
-      expect(mockItems[0].decrypt).toHaveBeenCalledWith(key);
-      expect(mockItems[1].decrypt).toHaveBeenCalledWith(key);
-    });
-
-    it("uses workers for decryption when window is available", async () => {
-      const mockDecryptedItems = ["decrypted1", "decrypted2"];
-      jest
-        .spyOn<any, any>(sut, "getDecryptedItemsFromWorkers")
-        .mockResolvedValue(mockDecryptedItems);
-
-      const mockItems = [createMockDecryptable("item1"), createMockDecryptable("item2")];
-
-      const result = await sut.decryptItems(mockItems, key);
-
-      expect(sut["getDecryptedItemsFromWorkers"]).toHaveBeenCalledWith(mockItems, key);
-      expect(result).toEqual(mockDecryptedItems);
-    });
-
-    it("creates new worker when none exist", async () => {
-      (sut as any).currentServerConfig = undefined;
-      const mockItems = [createMockDecryptable("item1"), createMockDecryptable("item2")];
-
-      await sut.decryptItems(mockItems, key);
-
-      expect(global.Worker).toHaveBeenCalled();
-      expect(mockWorker.postMessage).toHaveBeenCalledTimes(1);
-      expect(mockWorker.postMessage).not.toHaveBeenCalledWith(
-        buildSetConfigMessage({ newConfig: serverConfig }),
-      );
-    });
-
-    it("sends a SetConfigMessage to the new worker when there is a current server config", async () => {
-      (sut as any).currentServerConfig = serverConfig;
-      const mockItems = [createMockDecryptable("item1"), createMockDecryptable("item2")];
-
-      await sut.decryptItems(mockItems, key);
-
-      expect(global.Worker).toHaveBeenCalled();
-      expect(mockWorker.postMessage).toHaveBeenCalledTimes(2);
-      expect(mockWorker.postMessage).toHaveBeenCalledWith(
-        buildSetConfigMessage({ newConfig: serverConfig }),
-      );
-    });
-
-    it("does not create worker if one exists", async () => {
-      (sut as any).currentServerConfig = serverConfig;
-      (sut as any).workers = [mockWorker];
-      const mockItems = [createMockDecryptable("item1"), createMockDecryptable("item2")];
-
-      await sut.decryptItems(mockItems, key);
-
-      expect(global.Worker).not.toHaveBeenCalled();
-      expect(mockWorker.postMessage).toHaveBeenCalledTimes(1);
-      expect(mockWorker.postMessage).not.toHaveBeenCalledWith(
-        buildSetConfigMessage({ newConfig: serverConfig }),
-      );
-    });
-  });
-
-  describe("onServerConfigChange", () => {
-    it("updates internal currentServerConfig to new config", () => {
-      const newConfig = mock<ServerConfig>();
-
-      sut.onServerConfigChange(newConfig);
-
-      expect((sut as any).currentServerConfig).toBe(newConfig);
-    });
-
-    it("does send a SetConfigMessage to workers when there is a worker", () => {
-      const newConfig = mock<ServerConfig>();
-      const mockWorker = mock<Worker>();
-      (sut as any).workers = [mockWorker];
-
-      sut.onServerConfigChange(newConfig);
-
-      expect(mockWorker.postMessage).toHaveBeenCalledWith(buildSetConfigMessage({ newConfig }));
-    });
-  });
-});
-
-function createMockDecryptable<T extends InitializerMetadata>(
-  returnValue: any,
-): MockProxy<Decryptable<T>> {
-  const mockDecryptable = mock<Decryptable<T>>();
-  mockDecryptable.decrypt.mockResolvedValue(returnValue);
-  return mockDecryptable;
-}

libs/common/src/key-management/crypto/services/bulk-encrypt.service.implementation.ts

@@ -1,38 +1,19 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { firstValueFrom, fromEvent, filter, map, takeUntil, defaultIfEmpty, Subject } from "rxjs";
-import { Jsonify } from "type-fest";
-
 import { BulkEncryptService } from "@bitwarden/common/key-management/crypto/abstractions/bulk-encrypt.service";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { Decryptable } from "@bitwarden/common/platform/interfaces/decryptable.interface";
 import { InitializerMetadata } from "@bitwarden/common/platform/interfaces/initializer-metadata.interface";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
-import { getClassInitializer } from "@bitwarden/common/platform/services/cryptography/get-class-initializer";
 
-import {
-  DefaultFeatureFlagValue,
-  FeatureFlag,
-  getFeatureFlagValue,
-} from "../../../enums/feature-flag.enum";
+import { DefaultFeatureFlagValue, FeatureFlag } from "../../../enums/feature-flag.enum";
 import { ServerConfig } from "../../../platform/abstractions/config/server-config";
-import { buildDecryptMessage, buildSetConfigMessage } from "../types/worker-command.type";
-
-// TTL (time to live) is not strictly required but avoids tying up memory resources if inactive
-const workerTTL = 60000; // 1 minute
-const maxWorkers = 8;
-const minNumberOfItemsForMultithreading = 400;
 
+/**
+ * @deprecated Will be deleted in an immediate subsequent PR
+ */
 export class BulkEncryptServiceImplementation implements BulkEncryptService {
-  private workers: Worker[] = [];
-  private timeout: any;
-  private currentServerConfig: ServerConfig | undefined = undefined;
   protected useSDKForDecryption: boolean = DefaultFeatureFlagValue[FeatureFlag.UseSDKForDecryption];
 
-  private clear$ = new Subject<void>();
-
   constructor(
     protected cryptoFunctionService: CryptoFunctionService,
     protected logService: LogService,
@@ -54,139 +35,12 @@ export class BulkEncryptServiceImplementation implements BulkEncryptService {
       return [];
     }
 
-    if (typeof window === "undefined" || this.useSDKForDecryption) {
-      this.logService.info("Window not available in BulkEncryptService, decrypting sequentially");
-      const results = [];
-      for (let i = 0; i < items.length; i++) {
-        results.push(await items[i].decrypt(key));
-      }
-      return results;
-    }
-
-    const decryptedItems = await this.getDecryptedItemsFromWorkers(items, key);
-    return decryptedItems;
-  }
-
-  onServerConfigChange(newConfig: ServerConfig): void {
-    this.currentServerConfig = newConfig;
-    this.useSDKForDecryption = getFeatureFlagValue(newConfig, FeatureFlag.UseSDKForDecryption);
-    this.updateWorkerServerConfigs(newConfig);
-  }
-
-  /**
-   * Sends items to a set of web workers to decrypt them. This utilizes multiple workers to decrypt items
-   * faster without interrupting other operations (e.g. updating UI).
-   */
-  private async getDecryptedItemsFromWorkers<T extends InitializerMetadata>(
-    items: Decryptable<T>[],
-    key: SymmetricCryptoKey,
-  ): Promise<T[]> {
-    if (items == null || items.length < 1) {
-      return [];
-    }
-
-    this.clearTimeout();
-
-    const hardwareConcurrency = navigator.hardwareConcurrency || 1;
-    let numberOfWorkers = Math.min(hardwareConcurrency, maxWorkers);
-    if (items.length < minNumberOfItemsForMultithreading) {
-      numberOfWorkers = 1;
-    }
-
-    this.logService.info(
-      `Starting decryption using multithreading with ${numberOfWorkers} workers for ${items.length} items`,
-    );
-
-    if (this.workers.length == 0) {
-      for (let i = 0; i < numberOfWorkers; i++) {
-        this.workers.push(
-          new Worker(
-            new URL(
-              /* webpackChunkName: 'encrypt-worker' */
-              "@bitwarden/common/key-management/crypto/services/encrypt.worker.ts",
-              import.meta.url,
-            ),
-          ),
-        );
-      }
-      if (this.currentServerConfig != undefined) {
-        this.updateWorkerServerConfigs(this.currentServerConfig);
-      }
-    }
-
-    const itemsPerWorker = Math.floor(items.length / this.workers.length);
     const results = [];
-
-    for (const [i, worker] of this.workers.entries()) {
-      const start = i * itemsPerWorker;
-      const end = start + itemsPerWorker;
-      const itemsForWorker = items.slice(start, end);
-
-      // push the remaining items to the last worker
-      if (i == this.workers.length - 1) {
-        itemsForWorker.push(...items.slice(end));
-      }
-
-      const id = Utils.newGuid();
-      const request = buildDecryptMessage({
-        id,
-        items: itemsForWorker,
-        key: key,
-      });
-
-      worker.postMessage(request);
-      results.push(
-        firstValueFrom(
-          fromEvent(worker, "message").pipe(
-            filter((response: MessageEvent) => response.data?.id === id),
-            map((response) => JSON.parse(response.data.items)),
-            map((items) =>
-              items.map((jsonItem: Jsonify<T>) => {
-                const initializer = getClassInitializer<T>(jsonItem.initializerKey);
-                return initializer(jsonItem);
-              }),
-            ),
-            takeUntil(this.clear$),
-            defaultIfEmpty([]),
-          ),
-        ),
-      );
+    for (let i = 0; i < items.length; i++) {
+      results.push(await items[i].decrypt(key));
     }
-
-    const decryptedItems = (await Promise.all(results)).flat();
-    this.logService.info(
-      `Finished decrypting ${decryptedItems.length} items using ${numberOfWorkers} workers`,
-    );
-
-    this.restartTimeout();
-
-    return decryptedItems;
+    return results;
   }
 
-  private updateWorkerServerConfigs(newConfig: ServerConfig) {
-    this.workers.forEach((worker) => {
-      const request = buildSetConfigMessage({ newConfig });
-      worker.postMessage(request);
-    });
-  }
-
-  private clear() {
-    this.clear$.next();
-    for (const worker of this.workers) {
-      worker.terminate();
-    }
-    this.workers = [];
-    this.clearTimeout();
-  }
-
-  private restartTimeout() {
-    this.clearTimeout();
-    this.timeout = setTimeout(() => this.clear(), workerTTL);
-  }
-
-  private clearTimeout() {
-    if (this.timeout != null) {
-      clearTimeout(this.timeout);
-    }
-  }
+  onServerConfigChange(newConfig: ServerConfig): void {}
 }

libs/common/src/key-management/crypto/services/encrypt.service.implementation.ts

@@ -3,36 +3,20 @@
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
-import {
-  EncryptionType,
-  encryptionTypeToString as encryptionTypeName,
-} from "@bitwarden/common/platform/enums";
+import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
+import { EncryptionType } from "@bitwarden/common/platform/enums";
 import { Decryptable } from "@bitwarden/common/platform/interfaces/decryptable.interface";
 import { Encrypted } from "@bitwarden/common/platform/interfaces/encrypted";
 import { InitializerMetadata } from "@bitwarden/common/platform/interfaces/initializer-metadata.interface";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { EncArrayBuffer } from "@bitwarden/common/platform/models/domain/enc-array-buffer";
-import { EncryptedObject } from "@bitwarden/common/platform/models/domain/encrypted-object";
-import {
-  Aes256CbcHmacKey,
-  Aes256CbcKey,
-  SymmetricCryptoKey,
-} from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
+import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { PureCrypto } from "@bitwarden/sdk-internal";
 
-import {
-  DefaultFeatureFlagValue,
-  FeatureFlag,
-  getFeatureFlagValue,
-} from "../../../enums/feature-flag.enum";
 import { ServerConfig } from "../../../platform/abstractions/config/server-config";
-import { SdkLoadService } from "../../../platform/abstractions/sdk/sdk-load.service";
 import { EncryptService } from "../abstractions/encrypt.service";
 
 export class EncryptServiceImplementation implements EncryptService {
-  protected useSDKForDecryption: boolean = DefaultFeatureFlagValue[FeatureFlag.UseSDKForDecryption];
-  private blockType0: boolean = DefaultFeatureFlagValue[FeatureFlag.PM17987_BlockType0];
-
   constructor(
     protected cryptoFunctionService: CryptoFunctionService,
     protected logService: LogService,
@@ -41,27 +25,40 @@ export class EncryptServiceImplementation implements EncryptService {
 
   // Proxy functions; Their implementation are temporary before moving at this level to the SDK
   async encryptString(plainValue: string, key: SymmetricCryptoKey): Promise<EncString> {
-    return this.encrypt(plainValue, key);
+    if (plainValue == null) {
+      this.logService.warning(
+        "[EncryptService] WARNING: encryptString called with null value. Returning null, but this behavior is deprecated and will be removed.",
+      );
+      return null;
+    }
+
+    await SdkLoadService.Ready;
+    return new EncString(PureCrypto.symmetric_encrypt_string(plainValue, key.toEncoded()));
   }
 
   async encryptBytes(plainValue: Uint8Array, key: SymmetricCryptoKey): Promise<EncString> {
-    return this.encrypt(plainValue, key);
+    await SdkLoadService.Ready;
+    return new EncString(PureCrypto.symmetric_encrypt_bytes(plainValue, key.toEncoded()));
   }
 
   async encryptFileData(plainValue: Uint8Array, key: SymmetricCryptoKey): Promise<EncArrayBuffer> {
-    return this.encryptToBytes(plainValue, key);
+    await SdkLoadService.Ready;
+    return new EncArrayBuffer(PureCrypto.symmetric_encrypt_filedata(plainValue, key.toEncoded()));
   }
 
   async decryptString(encString: EncString, key: SymmetricCryptoKey): Promise<string> {
-    return this.decryptToUtf8(encString, key);
+    await SdkLoadService.Ready;
+    return PureCrypto.symmetric_decrypt_string(encString.encryptedString, key.toEncoded());
   }
 
   async decryptBytes(encString: EncString, key: SymmetricCryptoKey): Promise<Uint8Array> {
-    return this.decryptToBytes(encString, key);
+    await SdkLoadService.Ready;
+    return PureCrypto.symmetric_decrypt_bytes(encString.encryptedString, key.toEncoded());
   }
 
   async decryptFileData(encBuffer: EncArrayBuffer, key: SymmetricCryptoKey): Promise<Uint8Array> {
-    return this.decryptToBytes(encBuffer, key);
+    await SdkLoadService.Ready;
+    return PureCrypto.symmetric_decrypt_filedata(encBuffer.buffer, key.toEncoded());
   }
 
   async wrapDecapsulationKey(
@@ -76,7 +73,10 @@ export class EncryptServiceImplementation implements EncryptService {
       throw new Error("No wrappingKey provided for wrapping.");
     }
 
-    return await this.encryptUint8Array(decapsulationKeyPkcs8, wrappingKey);
+    await SdkLoadService.Ready;
+    return new EncString(
+      PureCrypto.wrap_decapsulation_key(decapsulationKeyPkcs8, wrappingKey.toEncoded()),
+    );
   }
 
   async wrapEncapsulationKey(
@@ -91,7 +91,10 @@ export class EncryptServiceImplementation implements EncryptService {
       throw new Error("No wrappingKey provided for wrapping.");
     }
 
-    return await this.encryptUint8Array(encapsulationKeySpki, wrappingKey);
+    await SdkLoadService.Ready;
+    return new EncString(
+      PureCrypto.wrap_encapsulation_key(encapsulationKeySpki, wrappingKey.toEncoded()),
+    );
   }
 
   async wrapSymmetricKey(
@@ -106,26 +109,61 @@ export class EncryptServiceImplementation implements EncryptService {
       throw new Error("No wrappingKey provided for wrapping.");
     }
 
-    return await this.encryptUint8Array(keyToBeWrapped.toEncoded(), wrappingKey);
+    await SdkLoadService.Ready;
+    return new EncString(
+      PureCrypto.wrap_symmetric_key(keyToBeWrapped.toEncoded(), wrappingKey.toEncoded()),
+    );
   }
 
   async unwrapDecapsulationKey(
     wrappedDecapsulationKey: EncString,
     wrappingKey: SymmetricCryptoKey,
   ): Promise<Uint8Array> {
-    return this.decryptBytes(wrappedDecapsulationKey, wrappingKey);
+    if (wrappedDecapsulationKey == null) {
+      throw new Error("No wrappedDecapsulationKey provided for unwrapping.");
+    }
+    if (wrappingKey == null) {
+      throw new Error("No wrappingKey provided for unwrapping.");
+    }
+
+    await SdkLoadService.Ready;
+    return PureCrypto.unwrap_decapsulation_key(
+      wrappedDecapsulationKey.encryptedString,
+      wrappingKey.toEncoded(),
+    );
   }
   async unwrapEncapsulationKey(
     wrappedEncapsulationKey: EncString,
     wrappingKey: SymmetricCryptoKey,
   ): Promise<Uint8Array> {
-    return this.decryptBytes(wrappedEncapsulationKey, wrappingKey);
+    if (wrappedEncapsulationKey == null) {
+      throw new Error("No wrappedEncapsulationKey provided for unwrapping.");
+    }
+    if (wrappingKey == null) {
+      throw new Error("No wrappingKey provided for unwrapping.");
+    }
+
+    await SdkLoadService.Ready;
+    return PureCrypto.unwrap_encapsulation_key(
+      wrappedEncapsulationKey.encryptedString,
+      wrappingKey.toEncoded(),
+    );
   }
   async unwrapSymmetricKey(
     keyToBeUnwrapped: EncString,
     wrappingKey: SymmetricCryptoKey,
   ): Promise<SymmetricCryptoKey> {
-    return new SymmetricCryptoKey(await this.decryptBytes(keyToBeUnwrapped, wrappingKey));
+    if (keyToBeUnwrapped == null) {
+      throw new Error("No keyToBeUnwrapped provided for unwrapping.");
+    }
+    if (wrappingKey == null) {
+      throw new Error("No wrappingKey provided for unwrapping.");
+    }
+
+    await SdkLoadService.Ready;
+    return new SymmetricCryptoKey(
+      PureCrypto.unwrap_symmetric_key(keyToBeUnwrapped.encryptedString, wrappingKey.toEncoded()),
+    );
   }
 
   async hash(value: string | Uint8Array, algorithm: "sha1" | "sha256" | "sha512"): Promise<string> {
@@ -134,261 +172,33 @@ export class EncryptServiceImplementation implements EncryptService {
   }
 
   // Handle updating private properties to turn on/off feature flags.
-  onServerConfigChange(newConfig: ServerConfig): void {
-    const oldFlagValue = this.useSDKForDecryption;
-    this.useSDKForDecryption = getFeatureFlagValue(newConfig, FeatureFlag.UseSDKForDecryption);
-    this.logService.debug(
-      "[EncryptService] Updated sdk decryption flag",
-      oldFlagValue,
-      this.useSDKForDecryption,
-    );
-    this.blockType0 = getFeatureFlagValue(newConfig, FeatureFlag.PM17987_BlockType0);
-  }
-
-  async encrypt(plainValue: string | Uint8Array, key: SymmetricCryptoKey): Promise<EncString> {
-    if (key == null) {
-      throw new Error("No encryption key provided.");
-    }
-
-    if (this.blockType0) {
-      if (key.inner().type === EncryptionType.AesCbc256_B64) {
-        throw new Error("Type 0 encryption is not supported.");
-      }
-    }
-
-    if (plainValue == null) {
-      return Promise.resolve(null);
-    }
-
-    if (typeof plainValue === "string") {
-      return this.encryptUint8Array(Utils.fromUtf8ToArray(plainValue), key);
-    } else {
-      return this.encryptUint8Array(plainValue, key);
-    }
-  }
-
-  private async encryptUint8Array(
-    plainValue: Uint8Array,
-    key: SymmetricCryptoKey,
-  ): Promise<EncString> {
-    if (key == null) {
-      throw new Error("No encryption key provided.");
-    }
-
-    if (this.blockType0) {
-      if (key.inner().type === EncryptionType.AesCbc256_B64) {
-        throw new Error("Type 0 encryption is not supported.");
-      }
-    }
-
-    if (plainValue == null) {
-      return Promise.resolve(null);
-    }
-
-    const innerKey = key.inner();
-    if (innerKey.type === EncryptionType.AesCbc256_HmacSha256_B64) {
-      const encObj = await this.aesEncrypt(plainValue, innerKey);
-      const iv = Utils.fromBufferToB64(encObj.iv);
-      const data = Utils.fromBufferToB64(encObj.data);
-      const mac = Utils.fromBufferToB64(encObj.mac);
-      return new EncString(innerKey.type, data, iv, mac);
-    } else if (innerKey.type === EncryptionType.AesCbc256_B64) {
-      const encObj = await this.aesEncryptLegacy(plainValue, innerKey);
-      const iv = Utils.fromBufferToB64(encObj.iv);
-      const data = Utils.fromBufferToB64(encObj.data);
-      return new EncString(innerKey.type, data, iv);
-    }
-  }
-
-  async encryptToBytes(plainValue: Uint8Array, key: SymmetricCryptoKey): Promise<EncArrayBuffer> {
-    if (key == null) {
-      throw new Error("No encryption key provided.");
-    }
-
-    if (this.blockType0) {
-      if (key.inner().type === EncryptionType.AesCbc256_B64) {
-        throw new Error("Type 0 encryption is not supported.");
-      }
-    }
-
-    const innerKey = key.inner();
-    if (innerKey.type === EncryptionType.AesCbc256_HmacSha256_B64) {
-      const encValue = await this.aesEncrypt(plainValue, innerKey);
-      const macLen = encValue.mac.length;
-      const encBytes = new Uint8Array(
-        1 + encValue.iv.byteLength + macLen + encValue.data.byteLength,
-      );
-      encBytes.set([innerKey.type]);
-      encBytes.set(new Uint8Array(encValue.iv), 1);
-      encBytes.set(new Uint8Array(encValue.mac), 1 + encValue.iv.byteLength);
-      encBytes.set(new Uint8Array(encValue.data), 1 + encValue.iv.byteLength + macLen);
-      return new EncArrayBuffer(encBytes);
-    } else if (innerKey.type === EncryptionType.AesCbc256_B64) {
-      const encValue = await this.aesEncryptLegacy(plainValue, innerKey);
-      const encBytes = new Uint8Array(1 + encValue.iv.byteLength + encValue.data.byteLength);
-      encBytes.set([innerKey.type]);
-      encBytes.set(new Uint8Array(encValue.iv), 1);
-      encBytes.set(new Uint8Array(encValue.data), 1 + encValue.iv.byteLength);
-      return new EncArrayBuffer(encBytes);
-    }
-  }
+  onServerConfigChange(newConfig: ServerConfig): void {}
 
   async decryptToUtf8(
     encString: EncString,
     key: SymmetricCryptoKey,
-    decryptContext: string = "no context",
+    _decryptContext: string = "no context",
   ): Promise<string> {
-    if (this.useSDKForDecryption) {
-      this.logService.debug("decrypting with SDK");
-      if (encString == null || encString.encryptedString == null) {
-        throw new Error("encString is null or undefined");
-      }
-      await SdkLoadService.Ready;
-      return PureCrypto.symmetric_decrypt(encString.encryptedString, key.toEncoded());
-    }
-    this.logService.debug("decrypting with javascript");
-
-    if (key == null) {
-      throw new Error("No key provided for decryption.");
-    }
-
-    const innerKey = key.inner();
-    if (encString.encryptionType !== innerKey.type) {
-      this.logDecryptError(
-        "Key encryption type does not match payload encryption type",
-        innerKey.type,
-        encString.encryptionType,
-        decryptContext,
-      );
-      return null;
-    }
-
-    if (innerKey.type === EncryptionType.AesCbc256_HmacSha256_B64) {
-      const fastParams = this.cryptoFunctionService.aesDecryptFastParameters(
-        encString.data,
-        encString.iv,
-        encString.mac,
-        key,
-      );
-
-      const computedMac = await this.cryptoFunctionService.hmacFast(
-        fastParams.macData,
-        fastParams.macKey,
-        "sha256",
-      );
-      const macsEqual = await this.cryptoFunctionService.compareFast(fastParams.mac, computedMac);
-      if (!macsEqual) {
-        this.logMacFailed(
-          "decryptToUtf8 MAC comparison failed. Key or payload has changed.",
-          innerKey.type,
-          encString.encryptionType,
-          decryptContext,
-        );
-        return null;
-      }
-      return await this.cryptoFunctionService.aesDecryptFast({
-        mode: "cbc",
-        parameters: fastParams,
-      });
-    } else if (innerKey.type === EncryptionType.AesCbc256_B64) {
-      const fastParams = this.cryptoFunctionService.aesDecryptFastParameters(
-        encString.data,
-        encString.iv,
-        undefined,
-        key,
-      );
-      return await this.cryptoFunctionService.aesDecryptFast({
-        mode: "cbc",
-        parameters: fastParams,
-      });
-    } else {
-      throw new Error(`Unsupported encryption type`);
-    }
+    await SdkLoadService.Ready;
+    return PureCrypto.symmetric_decrypt(encString.encryptedString, key.toEncoded());
   }
 
   async decryptToBytes(
     encThing: Encrypted,
     key: SymmetricCryptoKey,
-    decryptContext: string = "no context",
+    _decryptContext: string = "no context",
   ): Promise<Uint8Array | null> {
-    if (this.useSDKForDecryption) {
-      this.logService.debug("[EncryptService] Decrypting bytes with SDK");
-      if (
-        encThing.encryptionType == null ||
-        encThing.ivBytes == null ||
-        encThing.dataBytes == null
-      ) {
-        throw new Error("Cannot decrypt, missing type, IV, or data bytes.");
-      }
-      const buffer = EncArrayBuffer.fromParts(
-        encThing.encryptionType,
-        encThing.ivBytes,
-        encThing.dataBytes,
-        encThing.macBytes,
-      ).buffer;
-      await SdkLoadService.Ready;
-      return PureCrypto.symmetric_decrypt_array_buffer(buffer, key.toEncoded());
-    }
-    this.logService.debug("[EncryptService] Decrypting bytes with javascript");
-
-    if (key == null) {
-      throw new Error("No encryption key provided.");
-    }
-
-    if (encThing == null) {
-      throw new Error("Nothing provided for decryption.");
-    }
-
-    const inner = key.inner();
-    if (encThing.encryptionType !== inner.type) {
-      this.logDecryptError(
-        "Encryption key type mismatch",
-        inner.type,
-        encThing.encryptionType,
-        decryptContext,
-      );
-      return null;
-    }
-
-    if (inner.type === EncryptionType.AesCbc256_HmacSha256_B64) {
-      if (encThing.macBytes == null) {
-        this.logDecryptError("Mac missing", inner.type, encThing.encryptionType, decryptContext);
-        return null;
-      }
-
-      const macData = new Uint8Array(encThing.ivBytes.byteLength + encThing.dataBytes.byteLength);
-      macData.set(new Uint8Array(encThing.ivBytes), 0);
-      macData.set(new Uint8Array(encThing.dataBytes), encThing.ivBytes.byteLength);
-      const computedMac = await this.cryptoFunctionService.hmac(
-        macData,
-        inner.authenticationKey,
-        "sha256",
-      );
-      const macsMatch = await this.cryptoFunctionService.compare(encThing.macBytes, computedMac);
-      if (!macsMatch) {
-        this.logMacFailed(
-          "MAC comparison failed. Key or payload has changed.",
-          inner.type,
-          encThing.encryptionType,
-          decryptContext,
-        );
-        return null;
-      }
-
-      return await this.cryptoFunctionService.aesDecrypt(
-        encThing.dataBytes,
-        encThing.ivBytes,
-        inner.encryptionKey,
-        "cbc",
-      );
-    } else if (inner.type === EncryptionType.AesCbc256_B64) {
-      return await this.cryptoFunctionService.aesDecrypt(
-        encThing.dataBytes,
-        encThing.ivBytes,
-        inner.encryptionKey,
-        "cbc",
-      );
+    if (encThing.encryptionType == null || encThing.ivBytes == null || encThing.dataBytes == null) {
+      throw new Error("Cannot decrypt, missing type, IV, or data bytes.");
     }
+    const buffer = EncArrayBuffer.fromParts(
+      encThing.encryptionType,
+      encThing.ivBytes,
+      encThing.dataBytes,
+      encThing.macBytes,
+    ).buffer;
+    await SdkLoadService.Ready;
+    return PureCrypto.symmetric_decrypt_array_buffer(buffer, key.toEncoded());
   }
 
   async encapsulateKeyUnsigned(
@@ -398,14 +208,31 @@ export class EncryptServiceImplementation implements EncryptService {
     if (sharedKey == null) {
       throw new Error("No sharedKey provided for encapsulation");
     }
-    return await this.rsaEncrypt(sharedKey.toEncoded(), encapsulationKey);
+    if (encapsulationKey == null) {
+      throw new Error("No encapsulationKey provided for encapsulation");
+    }
+    await SdkLoadService.Ready;
+    return new EncString(
+      PureCrypto.encapsulate_key_unsigned(sharedKey.toEncoded(), encapsulationKey),
+    );
   }
 
   async decapsulateKeyUnsigned(
     encryptedSharedKey: EncString,
     decapsulationKey: Uint8Array,
   ): Promise<SymmetricCryptoKey> {
-    const keyBytes = await this.rsaDecrypt(encryptedSharedKey, decapsulationKey);
+    if (encryptedSharedKey == null) {
+      throw new Error("No encryptedSharedKey provided for decapsulation");
+    }
+    if (decapsulationKey == null) {
+      throw new Error("No decapsulationKey provided for decapsulation");
+    }
+
+    const keyBytes = PureCrypto.decapsulate_key_unsigned(
+      encryptedSharedKey.encryptedString,
+      decapsulationKey,
+    );
+    await SdkLoadService.Ready;
     return new SymmetricCryptoKey(keyBytes);
   }
 
@@ -428,51 +255,6 @@ export class EncryptServiceImplementation implements EncryptService {
     return results;
   }
 
-  private async aesEncrypt(data: Uint8Array, key: Aes256CbcHmacKey): Promise<EncryptedObject> {
-    const obj = new EncryptedObject();
-    obj.iv = await this.cryptoFunctionService.randomBytes(16);
-    obj.data = await this.cryptoFunctionService.aesEncrypt(data, obj.iv, key.encryptionKey);
-
-    const macData = new Uint8Array(obj.iv.byteLength + obj.data.byteLength);
-    macData.set(new Uint8Array(obj.iv), 0);
-    macData.set(new Uint8Array(obj.data), obj.iv.byteLength);
-    obj.mac = await this.cryptoFunctionService.hmac(macData, key.authenticationKey, "sha256");
-
-    return obj;
-  }
-
-  /**
-   * @deprecated Removed once AesCbc256_B64 support is removed
-   */
-  private async aesEncryptLegacy(data: Uint8Array, key: Aes256CbcKey): Promise<EncryptedObject> {
-    const obj = new EncryptedObject();
-    obj.iv = await this.cryptoFunctionService.randomBytes(16);
-    obj.data = await this.cryptoFunctionService.aesEncrypt(data, obj.iv, key.encryptionKey);
-    return obj;
-  }
-
-  private logDecryptError(
-    msg: string,
-    keyEncType: EncryptionType,
-    dataEncType: EncryptionType,
-    decryptContext: string,
-  ) {
-    this.logService.error(
-      `[Encrypt service] ${msg} Key type ${encryptionTypeName(keyEncType)} Payload type ${encryptionTypeName(dataEncType)} Decrypt context: ${decryptContext}`,
-    );
-  }
-
-  private logMacFailed(
-    msg: string,
-    keyEncType: EncryptionType,
-    dataEncType: EncryptionType,
-    decryptContext: string,
-  ) {
-    if (this.logMacFailures) {
-      this.logDecryptError(msg, keyEncType, dataEncType, decryptContext);
-    }
-  }
-
   async rsaEncrypt(data: Uint8Array, publicKey: Uint8Array): Promise<EncString> {
     if (data == null) {
       throw new Error("No data provided for encryption.");

libs/common/src/key-management/crypto/services/encrypt.service.spec.ts

@@ -3,20 +3,14 @@ import { mockReset, mock } from "jest-mock-extended";
 import { CryptoFunctionService } from "@bitwarden/common/key-management/crypto/abstractions/crypto-function.service";
 import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { SdkLoadService } from "@bitwarden/common/platform/abstractions/sdk/sdk-load.service";
 import { EncryptionType } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { EncArrayBuffer } from "@bitwarden/common/platform/models/domain/enc-array-buffer";
-import {
-  Aes256CbcHmacKey,
-  SymmetricCryptoKey,
-} from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
-import { CsprngArray } from "@bitwarden/common/types/csprng";
+import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
 import { PureCrypto } from "@bitwarden/sdk-internal";
 
 import { makeStaticByteArray } from "../../../../spec";
-import { DefaultFeatureFlagValue, FeatureFlag } from "../../../enums/feature-flag.enum";
-import { ServerConfig } from "../../../platform/abstractions/config/server-config";
-import { SdkLoadService } from "../../../platform/abstractions/sdk/sdk-load.service";
 
 import { EncryptServiceImplementation } from "./encrypt.service.implementation";
 
@@ -26,24 +20,50 @@ describe("EncryptService", () => {
 
   let encryptService: EncryptServiceImplementation;
 
+  const testEncBuffer = EncArrayBuffer.fromParts(
+    EncryptionType.AesCbc256_HmacSha256_B64,
+    new Uint8Array(16),
+    new Uint8Array(32),
+    new Uint8Array(32),
+  );
+
   beforeEach(() => {
     mockReset(cryptoFunctionService);
     mockReset(logService);
 
+    jest.spyOn(PureCrypto, "symmetric_decrypt_array_buffer").mockReturnValue(new Uint8Array(1));
+    jest.spyOn(PureCrypto, "symmetric_decrypt").mockReturnValue("decrypted_string");
+
+    jest.spyOn(PureCrypto, "symmetric_decrypt_filedata").mockReturnValue(new Uint8Array(1));
+    jest.spyOn(PureCrypto, "symmetric_encrypt_filedata").mockReturnValue(testEncBuffer.buffer);
+    jest.spyOn(PureCrypto, "symmetric_decrypt_string").mockReturnValue("decrypted_string");
+    jest.spyOn(PureCrypto, "symmetric_encrypt_string").mockReturnValue("encrypted_string");
+    jest.spyOn(PureCrypto, "symmetric_decrypt_bytes").mockReturnValue(new Uint8Array(3));
+    jest.spyOn(PureCrypto, "symmetric_encrypt_bytes").mockReturnValue("encrypted_bytes");
+
+    jest.spyOn(PureCrypto, "wrap_decapsulation_key").mockReturnValue("wrapped_decapsulation_key");
+    jest.spyOn(PureCrypto, "wrap_encapsulation_key").mockReturnValue("wrapped_encapsulation_key");
+    jest.spyOn(PureCrypto, "wrap_symmetric_key").mockReturnValue("wrapped_symmetric_key");
+    jest.spyOn(PureCrypto, "unwrap_decapsulation_key").mockReturnValue(new Uint8Array(4));
+    jest.spyOn(PureCrypto, "unwrap_encapsulation_key").mockReturnValue(new Uint8Array(5));
+    jest.spyOn(PureCrypto, "unwrap_symmetric_key").mockReturnValue(new Uint8Array(64));
+
+    jest.spyOn(PureCrypto, "decapsulate_key_unsigned").mockReturnValue(new Uint8Array(64));
+    jest.spyOn(PureCrypto, "encapsulate_key_unsigned").mockReturnValue("encapsulated_key_unsigned");
+    (SdkLoadService as any).Ready = jest.fn().mockResolvedValue(true);
+
     encryptService = new EncryptServiceImplementation(cryptoFunctionService, logService, true);
   });
 
   describe("wrapSymmetricKey", () => {
-    it("roundtrip encrypts and decrypts a symmetric key", async () => {
-      cryptoFunctionService.aesEncrypt.mockResolvedValue(makeStaticByteArray(64, 0));
-      cryptoFunctionService.randomBytes.mockResolvedValue(makeStaticByteArray(16) as CsprngArray);
-      cryptoFunctionService.hmac.mockResolvedValue(makeStaticByteArray(32));
-
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
       const wrappingKey = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = await encryptService.wrapSymmetricKey(key, wrappingKey);
-      expect(encString.encryptionType).toEqual(EncryptionType.AesCbc256_HmacSha256_B64);
-      expect(encString.data).toEqual(Utils.fromBufferToB64(makeStaticByteArray(64, 0)));
+      await encryptService.wrapSymmetricKey(key, wrappingKey);
+      expect(PureCrypto.wrap_symmetric_key).toHaveBeenCalledWith(
+        key.toEncoded(),
+        wrappingKey.toEncoded(),
+      );
     });
     it("fails if key toBeWrapped is null", async () => {
       const wrappingKey = new SymmetricCryptoKey(makeStaticByteArray(64));
@@ -57,33 +77,17 @@ describe("EncryptService", () => {
         "No wrappingKey provided for wrapping.",
       );
     });
-    it("fails if type 0 key is provided with flag turned on", async () => {
-      (encryptService as any).blockType0 = true;
-      const mock32Key = mock<SymmetricCryptoKey>();
-      mock32Key.inner.mockReturnValue({
-        type: 0,
-        encryptionKey: makeStaticByteArray(32),
-      });
-
-      await expect(encryptService.wrapSymmetricKey(mock32Key, mock32Key)).rejects.toThrow(
-        "Type 0 encryption is not supported.",
-      );
-    });
   });
 
   describe("wrapDecapsulationKey", () => {
-    it("roundtrip encrypts and decrypts a decapsulation key", async () => {
-      cryptoFunctionService.aesEncrypt.mockResolvedValue(makeStaticByteArray(64, 0));
-      cryptoFunctionService.randomBytes.mockResolvedValue(makeStaticByteArray(16) as CsprngArray);
-      cryptoFunctionService.hmac.mockResolvedValue(makeStaticByteArray(32));
-
+    it("is a proxy to PureCrypto", async () => {
+      const decapsulationKey = makeStaticByteArray(10);
       const wrappingKey = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = await encryptService.wrapDecapsulationKey(
-        makeStaticByteArray(64),
-        wrappingKey,
+      await encryptService.wrapDecapsulationKey(decapsulationKey, wrappingKey);
+      expect(PureCrypto.wrap_decapsulation_key).toHaveBeenCalledWith(
+        decapsulationKey,
+        wrappingKey.toEncoded(),
       );
-      expect(encString.encryptionType).toEqual(EncryptionType.AesCbc256_HmacSha256_B64);
-      expect(encString.data).toEqual(Utils.fromBufferToB64(makeStaticByteArray(64, 0)));
     });
     it("fails if decapsulation key is null", async () => {
       const wrappingKey = new SymmetricCryptoKey(makeStaticByteArray(64));
@@ -97,33 +101,17 @@ describe("EncryptService", () => {
         "No wrappingKey provided for wrapping.",
       );
     });
-    it("throws if type 0 key is provided with flag turned on", async () => {
-      (encryptService as any).blockType0 = true;
-      const mock32Key = mock<SymmetricCryptoKey>();
-      mock32Key.inner.mockReturnValue({
-        type: 0,
-        encryptionKey: makeStaticByteArray(32),
-      });
-
-      await expect(
-        encryptService.wrapDecapsulationKey(new Uint8Array(200), mock32Key),
-      ).rejects.toThrow("Type 0 encryption is not supported.");
-    });
   });
 
   describe("wrapEncapsulationKey", () => {
-    it("roundtrip encrypts and decrypts an encapsulationKey key", async () => {
-      cryptoFunctionService.aesEncrypt.mockResolvedValue(makeStaticByteArray(64, 0));
-      cryptoFunctionService.randomBytes.mockResolvedValue(makeStaticByteArray(16) as CsprngArray);
-      cryptoFunctionService.hmac.mockResolvedValue(makeStaticByteArray(32));
-
+    it("is a proxy to PureCrypto", async () => {
+      const encapsulationKey = makeStaticByteArray(10);
       const wrappingKey = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = await encryptService.wrapEncapsulationKey(
-        makeStaticByteArray(64),
-        wrappingKey,
+      await encryptService.wrapEncapsulationKey(encapsulationKey, wrappingKey);
+      expect(PureCrypto.wrap_encapsulation_key).toHaveBeenCalledWith(
+        encapsulationKey,
+        wrappingKey.toEncoded(),
       );
-      expect(encString.encryptionType).toEqual(EncryptionType.AesCbc256_HmacSha256_B64);
-      expect(encString.data).toEqual(Utils.fromBufferToB64(makeStaticByteArray(64, 0)));
     });
     it("fails if encapsulation key is null", async () => {
       const wrappingKey = new SymmetricCryptoKey(makeStaticByteArray(64));
@@ -137,535 +125,152 @@ describe("EncryptService", () => {
         "No wrappingKey provided for wrapping.",
       );
     });
-    it("throws if type 0 key is provided with flag turned on", async () => {
-      (encryptService as any).blockType0 = true;
-      const mock32Key = mock<SymmetricCryptoKey>();
-      mock32Key.inner.mockReturnValue({
-        type: 0,
-        encryptionKey: makeStaticByteArray(32),
-      });
-
-      await expect(
-        encryptService.wrapEncapsulationKey(new Uint8Array(200), mock32Key),
-      ).rejects.toThrow("Type 0 encryption is not supported.");
-    });
-  });
-
-  describe("onServerConfigChange", () => {
-    const newConfig = mock<ServerConfig>();
-
-    afterEach(() => {
-      jest.resetAllMocks();
-    });
-
-    it("updates internal flag with default value when not present in config", () => {
-      encryptService.onServerConfigChange(newConfig);
-
-      expect((encryptService as any).blockType0).toBe(
-        DefaultFeatureFlagValue[FeatureFlag.PM17987_BlockType0],
-      );
-    });
-
-    test.each([true, false])("updates internal flag with value in config", (expectedValue) => {
-      newConfig.featureStates = { [FeatureFlag.PM17987_BlockType0]: expectedValue };
-
-      encryptService.onServerConfigChange(newConfig);
-
-      expect((encryptService as any).blockType0).toBe(expectedValue);
-    });
-  });
-
-  describe("encrypt", () => {
-    it("throws if no key is provided", () => {
-      return expect(encryptService.encrypt(null, null)).rejects.toThrow(
-        "No encryption key provided.",
-      );
-    });
-
-    it("throws if type 0 key is provided with flag turned on", async () => {
-      (encryptService as any).blockType0 = true;
-      const key = new SymmetricCryptoKey(makeStaticByteArray(32));
-      const mock32Key = mock<SymmetricCryptoKey>();
-      mock32Key.inner.mockReturnValue({
-        type: 0,
-        encryptionKey: makeStaticByteArray(32),
-      });
-
-      await expect(encryptService.encrypt(null!, key)).rejects.toThrow(
-        "Type 0 encryption is not supported.",
-      );
-      await expect(encryptService.encrypt(null!, mock32Key)).rejects.toThrow(
-        "Type 0 encryption is not supported.",
-      );
-
-      const plainValue = "data";
-      await expect(encryptService.encrypt(plainValue, key)).rejects.toThrow(
-        "Type 0 encryption is not supported.",
-      );
-      await expect(encryptService.encrypt(plainValue, mock32Key)).rejects.toThrow(
-        "Type 0 encryption is not supported.",
-      );
-    });
-
-    it("returns null if no data is provided with valid key", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const actual = await encryptService.encrypt(null, key);
-      expect(actual).toBeNull();
-    });
-
-    it("creates an EncString for Aes256Cbc", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(32));
-      const plainValue = "data";
-      cryptoFunctionService.aesEncrypt.mockResolvedValue(makeStaticByteArray(4, 100));
-      cryptoFunctionService.randomBytes.mockResolvedValue(makeStaticByteArray(16) as CsprngArray);
-      const result = await encryptService.encrypt(plainValue, key);
-      expect(cryptoFunctionService.aesEncrypt).toHaveBeenCalledWith(
-        Utils.fromByteStringToArray(plainValue),
-        makeStaticByteArray(16),
-        makeStaticByteArray(32),
-      );
-      expect(cryptoFunctionService.hmac).not.toHaveBeenCalled();
-
-      expect(Utils.fromB64ToArray(result.data).length).toEqual(4);
-      expect(Utils.fromB64ToArray(result.iv).length).toEqual(16);
-    });
-
-    it("creates an EncString for Aes256Cbc_HmacSha256_B64", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const plainValue = "data";
-      cryptoFunctionService.hmac.mockResolvedValue(makeStaticByteArray(32));
-      cryptoFunctionService.aesEncrypt.mockResolvedValue(makeStaticByteArray(4, 100));
-      cryptoFunctionService.randomBytes.mockResolvedValue(makeStaticByteArray(16) as CsprngArray);
-      const result = await encryptService.encrypt(plainValue, key);
-      expect(cryptoFunctionService.aesEncrypt).toHaveBeenCalledWith(
-        Utils.fromByteStringToArray(plainValue),
-        makeStaticByteArray(16),
-        makeStaticByteArray(32),
-      );
-
-      const macData = new Uint8Array(16 + 4);
-      macData.set(makeStaticByteArray(16));
-      macData.set(makeStaticByteArray(4, 100), 16);
-      expect(cryptoFunctionService.hmac).toHaveBeenCalledWith(
-        macData,
-        makeStaticByteArray(32, 32),
-        "sha256",
-      );
-
-      expect(Utils.fromB64ToArray(result.data).length).toEqual(4);
-      expect(Utils.fromB64ToArray(result.iv).length).toEqual(16);
-      expect(Utils.fromB64ToArray(result.mac).length).toEqual(32);
-    });
-  });
-
-  describe("encryptToBytes", () => {
-    const plainValue = makeStaticByteArray(16, 1);
-
-    it("throws if no key is provided", () => {
-      return expect(encryptService.encryptToBytes(plainValue, null)).rejects.toThrow(
-        "No encryption key",
-      );
-    });
-
-    it("throws if type 0 key provided with flag turned on", async () => {
-      (encryptService as any).blockType0 = true;
-      const key = new SymmetricCryptoKey(makeStaticByteArray(32));
-      const mock32Key = mock<SymmetricCryptoKey>();
-      mock32Key.inner.mockReturnValue({
-        type: 0,
-        encryptionKey: makeStaticByteArray(32),
-      });
-
-      await expect(encryptService.encryptToBytes(plainValue, key)).rejects.toThrow(
-        "Type 0 encryption is not supported.",
-      );
-
-      await expect(encryptService.encryptToBytes(plainValue, mock32Key)).rejects.toThrow(
-        "Type 0 encryption is not supported.",
-      );
-    });
-
-    it("encrypts data with provided Aes256Cbc key and returns correct encbuffer", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(32, 0));
-      const iv = makeStaticByteArray(16, 80);
-      const cipherText = makeStaticByteArray(20, 150);
-      cryptoFunctionService.randomBytes.mockResolvedValue(iv as CsprngArray);
-      cryptoFunctionService.aesEncrypt.mockResolvedValue(cipherText);
-
-      const actual = await encryptService.encryptToBytes(plainValue, key);
-      const expectedBytes = new Uint8Array(1 + iv.byteLength + cipherText.byteLength);
-      expectedBytes.set([EncryptionType.AesCbc256_B64]);
-      expectedBytes.set(iv, 1);
-      expectedBytes.set(cipherText, 1 + iv.byteLength);
-
-      expect(actual.buffer).toEqualBuffer(expectedBytes);
-    });
-
-    it("encrypts data with provided Aes256Cbc_HmacSha256 key and returns correct encbuffer", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64, 0));
-      const iv = makeStaticByteArray(16, 80);
-      const mac = makeStaticByteArray(32, 100);
-      const cipherText = makeStaticByteArray(20, 150);
-      cryptoFunctionService.randomBytes.mockResolvedValue(iv as CsprngArray);
-      cryptoFunctionService.aesEncrypt.mockResolvedValue(cipherText);
-      cryptoFunctionService.hmac.mockResolvedValue(mac);
-
-      const actual = await encryptService.encryptToBytes(plainValue, key);
-      const expectedBytes = new Uint8Array(
-        1 + iv.byteLength + mac.byteLength + cipherText.byteLength,
-      );
-      expectedBytes.set([EncryptionType.AesCbc256_HmacSha256_B64]);
-      expectedBytes.set(iv, 1);
-      expectedBytes.set(mac, 1 + iv.byteLength);
-      expectedBytes.set(cipherText, 1 + iv.byteLength + mac.byteLength);
-
-      expect(actual.buffer).toEqualBuffer(expectedBytes);
-    });
-  });
-
-  describe("decryptToBytes", () => {
-    const encType = EncryptionType.AesCbc256_HmacSha256_B64;
-    const key = new SymmetricCryptoKey(makeStaticByteArray(64, 100));
-    const computedMac = new Uint8Array(1);
-    const encBuffer = new EncArrayBuffer(makeStaticByteArray(60, encType));
-
-    beforeEach(() => {
-      cryptoFunctionService.hmac.mockResolvedValue(computedMac);
-    });
-
-    it("throws if no key is provided", () => {
-      return expect(encryptService.decryptToBytes(encBuffer, null)).rejects.toThrow(
-        "No encryption key",
-      );
-    });
-
-    it("throws if no encrypted value is provided", () => {
-      return expect(encryptService.decryptToBytes(null, key)).rejects.toThrow(
-        "Nothing provided for decryption",
-      );
-    });
-
-    it("calls PureCrypto when useSDKForDecryption is true", async () => {
-      (encryptService as any).useSDKForDecryption = true;
-      const decryptedBytes = makeStaticByteArray(10, 200);
-      Object.defineProperty(SdkLoadService, "Ready", {
-        value: Promise.resolve(),
-        configurable: true,
-      });
-      jest.spyOn(PureCrypto, "symmetric_decrypt_array_buffer").mockReturnValue(decryptedBytes);
-
-      const actual = await encryptService.decryptToBytes(encBuffer, key);
-
-      expect(PureCrypto.symmetric_decrypt_array_buffer).toHaveBeenCalledWith(
-        encBuffer.buffer,
-        key.toEncoded(),
-      );
-      expect(actual).toEqualBuffer(decryptedBytes);
-    });
-
-    it("decrypts data with provided key for Aes256CbcHmac", async () => {
-      const decryptedBytes = makeStaticByteArray(10, 200);
-
-      cryptoFunctionService.hmac.mockResolvedValue(makeStaticByteArray(1));
-      cryptoFunctionService.compare.mockResolvedValue(true);
-      cryptoFunctionService.aesDecrypt.mockResolvedValueOnce(decryptedBytes);
-
-      const actual = await encryptService.decryptToBytes(encBuffer, key);
-
-      expect(cryptoFunctionService.aesDecrypt).toBeCalledWith(
-        expect.toEqualBuffer(encBuffer.dataBytes),
-        expect.toEqualBuffer(encBuffer.ivBytes),
-        expect.toEqualBuffer(key.inner().encryptionKey),
-        "cbc",
-      );
-
-      expect(actual).toEqualBuffer(decryptedBytes);
-    });
-
-    it("decrypts data with provided key for Aes256Cbc", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(32, 0));
-      const encBuffer = new EncArrayBuffer(makeStaticByteArray(60, EncryptionType.AesCbc256_B64));
-      const decryptedBytes = makeStaticByteArray(10, 200);
-
-      cryptoFunctionService.hmac.mockResolvedValue(makeStaticByteArray(1));
-      cryptoFunctionService.compare.mockResolvedValue(true);
-      cryptoFunctionService.aesDecrypt.mockResolvedValueOnce(decryptedBytes);
-
-      const actual = await encryptService.decryptToBytes(encBuffer, key);
-
-      expect(cryptoFunctionService.aesDecrypt).toBeCalledWith(
-        expect.toEqualBuffer(encBuffer.dataBytes),
-        expect.toEqualBuffer(encBuffer.ivBytes),
-        expect.toEqualBuffer(key.inner().encryptionKey),
-        "cbc",
-      );
-
-      expect(actual).toEqualBuffer(decryptedBytes);
-    });
-
-    it("compares macs using CryptoFunctionService", async () => {
-      const expectedMacData = new Uint8Array(
-        encBuffer.ivBytes.byteLength + encBuffer.dataBytes.byteLength,
-      );
-      expectedMacData.set(new Uint8Array(encBuffer.ivBytes));
-      expectedMacData.set(new Uint8Array(encBuffer.dataBytes), encBuffer.ivBytes.byteLength);
-
-      await encryptService.decryptToBytes(encBuffer, key);
-
-      expect(cryptoFunctionService.hmac).toBeCalledWith(
-        expect.toEqualBuffer(expectedMacData),
-        (key.inner() as Aes256CbcHmacKey).authenticationKey,
-        "sha256",
-      );
-
-      expect(cryptoFunctionService.compare).toBeCalledWith(
-        expect.toEqualBuffer(encBuffer.macBytes),
-        expect.toEqualBuffer(computedMac),
-      );
-    });
-
-    it("returns null if macs don't match", async () => {
-      cryptoFunctionService.compare.mockResolvedValue(false);
-
-      const actual = await encryptService.decryptToBytes(encBuffer, key);
-      expect(cryptoFunctionService.compare).toHaveBeenCalled();
-      expect(cryptoFunctionService.aesDecrypt).not.toHaveBeenCalled();
-      expect(actual).toBeNull();
-    });
-
-    it("returns null if mac could not be calculated", async () => {
-      cryptoFunctionService.hmac.mockResolvedValue(null);
-
-      const actual = await encryptService.decryptToBytes(encBuffer, key);
-      expect(cryptoFunctionService.hmac).toHaveBeenCalled();
-      expect(cryptoFunctionService.aesDecrypt).not.toHaveBeenCalled();
-      expect(actual).toBeNull();
-    });
-
-    it("returns null if key is Aes256Cbc but encbuffer is Aes256Cbc_HmacSha256", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(32, 0));
-      cryptoFunctionService.compare.mockResolvedValue(true);
-
-      const actual = await encryptService.decryptToBytes(encBuffer, key);
-
-      expect(actual).toBeNull();
-      expect(cryptoFunctionService.aesDecrypt).not.toHaveBeenCalled();
-    });
-
-    it("returns null if key is Aes256Cbc_HmacSha256 but encbuffer is Aes256Cbc", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64, 0));
-      cryptoFunctionService.compare.mockResolvedValue(true);
-      const buffer = new EncArrayBuffer(makeStaticByteArray(200, EncryptionType.AesCbc256_B64));
-      const actual = await encryptService.decryptToBytes(buffer, key);
-
-      expect(actual).toBeNull();
-      expect(cryptoFunctionService.aesDecrypt).not.toHaveBeenCalled();
-    });
-  });
-
-  describe("decryptToUtf8", () => {
-    it("throws if no key is provided", () => {
-      return expect(encryptService.decryptToUtf8(null, null)).rejects.toThrow(
-        "No key provided for decryption.",
-      );
-    });
-
-    it("calls PureCrypto when useSDKForDecryption is true", async () => {
-      (encryptService as any).useSDKForDecryption = true;
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64, 0));
-      const encString = new EncString(EncryptionType.AesCbc256_HmacSha256_B64, "data", "iv", "mac");
-      Object.defineProperty(SdkLoadService, "Ready", {
-        value: Promise.resolve(),
-        configurable: true,
-      });
-      jest.spyOn(PureCrypto, "symmetric_decrypt").mockReturnValue("data");
-
-      const actual = await encryptService.decryptToUtf8(encString, key);
-
-      expect(actual).toEqual("data");
-      expect(PureCrypto.symmetric_decrypt).toHaveBeenCalledWith(
-        encString.encryptedString,
-        key.toEncoded(),
-      );
-    });
-
-    it("decrypts data with provided key for AesCbc256_HmacSha256", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64, 0));
-      const encString = new EncString(EncryptionType.AesCbc256_HmacSha256_B64, "data", "iv", "mac");
-      cryptoFunctionService.aesDecryptFastParameters.mockReturnValue({
-        macData: makeStaticByteArray(32, 0),
-        macKey: makeStaticByteArray(32, 0),
-        mac: makeStaticByteArray(32, 0),
-      } as any);
-      cryptoFunctionService.hmacFast.mockResolvedValue(makeStaticByteArray(32, 0));
-      cryptoFunctionService.compareFast.mockResolvedValue(true);
-      cryptoFunctionService.aesDecryptFast.mockResolvedValue("data");
-
-      const actual = await encryptService.decryptToUtf8(encString, key);
-      expect(actual).toEqual("data");
-      expect(cryptoFunctionService.compareFast).toHaveBeenCalledWith(
-        makeStaticByteArray(32, 0),
-        makeStaticByteArray(32, 0),
-      );
-    });
-
-    it("decrypts data with provided key for AesCbc256", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(32, 0));
-      const encString = new EncString(EncryptionType.AesCbc256_B64, "data");
-      cryptoFunctionService.aesDecryptFastParameters.mockReturnValue({
-        macData: makeStaticByteArray(32, 0),
-        macKey: makeStaticByteArray(32, 0),
-        mac: makeStaticByteArray(32, 0),
-      } as any);
-      cryptoFunctionService.hmacFast.mockResolvedValue(makeStaticByteArray(32, 0));
-      cryptoFunctionService.compareFast.mockResolvedValue(true);
-      cryptoFunctionService.aesDecryptFast.mockResolvedValue("data");
-
-      const actual = await encryptService.decryptToUtf8(encString, key);
-      expect(actual).toEqual("data");
-      expect(cryptoFunctionService.compareFast).not.toHaveBeenCalled();
-    });
-
-    it("returns null if key is AesCbc256_HMAC but encstring is AesCbc256", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64, 0));
-      const encString = new EncString(EncryptionType.AesCbc256_B64, "data");
-
-      const actual = await encryptService.decryptToUtf8(encString, key);
-      expect(actual).toBeNull();
-      expect(logService.error).toHaveBeenCalled();
-    });
-
-    it("returns null if key is AesCbc256 but encstring is AesCbc256_HMAC", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(32, 0));
-      const encString = new EncString(EncryptionType.AesCbc256_HmacSha256_B64, "data", "iv", "mac");
-
-      const actual = await encryptService.decryptToUtf8(encString, key);
-      expect(actual).toBeNull();
-      expect(logService.error).toHaveBeenCalled();
-    });
-
-    it("returns null if macs don't match", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64, 0));
-      const encString = new EncString(EncryptionType.AesCbc256_HmacSha256_B64, "data", "iv", "mac");
-      cryptoFunctionService.aesDecryptFastParameters.mockReturnValue({
-        macData: makeStaticByteArray(32, 0),
-        macKey: makeStaticByteArray(32, 0),
-        mac: makeStaticByteArray(32, 0),
-      } as any);
-      cryptoFunctionService.hmacFast.mockResolvedValue(makeStaticByteArray(32, 0));
-      cryptoFunctionService.compareFast.mockResolvedValue(false);
-      cryptoFunctionService.aesDecryptFast.mockResolvedValue("data");
-
-      const actual = await encryptService.decryptToUtf8(encString, key);
-      expect(actual).toBeNull();
-    });
-  });
-
-  describe("decryptToUtf8", () => {
-    it("throws if no key is provided", () => {
-      return expect(encryptService.decryptToUtf8(null, null)).rejects.toThrow(
-        "No key provided for decryption.",
-      );
-    });
-    it("returns null if key is mac key but encstring has no mac", async () => {
-      const key = new SymmetricCryptoKey(makeStaticByteArray(64, 0));
-      const encString = new EncString(EncryptionType.AesCbc256_B64, "data");
-
-      const actual = await encryptService.decryptToUtf8(encString, key);
-      expect(actual).toBeNull();
-      expect(logService.error).toHaveBeenCalled();
-    });
   });
 
   describe("encryptString", () => {
-    it("is a proxy to encrypt", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
       const plainValue = "data";
-      encryptService.encrypt = jest.fn();
-      await encryptService.encryptString(plainValue, key);
-      expect(encryptService.encrypt).toHaveBeenCalledWith(plainValue, key);
+      const result = await encryptService.encryptString(plainValue, key);
+      expect(result).toEqual(new EncString("encrypted_string"));
+      expect(PureCrypto.symmetric_encrypt_string).toHaveBeenCalledWith(plainValue, key.toEncoded());
     });
   });
 
   describe("encryptBytes", () => {
-    it("is a proxy to encrypt", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
       const plainValue = makeStaticByteArray(16, 1);
-      encryptService.encrypt = jest.fn();
-      await encryptService.encryptBytes(plainValue, key);
-      expect(encryptService.encrypt).toHaveBeenCalledWith(plainValue, key);
+      const result = await encryptService.encryptBytes(plainValue, key);
+      expect(result).toEqual(new EncString("encrypted_bytes"));
+      expect(PureCrypto.symmetric_encrypt_bytes).toHaveBeenCalledWith(plainValue, key.toEncoded());
     });
   });
 
   describe("encryptFileData", () => {
-    it("is a proxy to encryptToBytes", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
       const plainValue = makeStaticByteArray(16, 1);
-      encryptService.encryptToBytes = jest.fn();
-      await encryptService.encryptFileData(plainValue, key);
-      expect(encryptService.encryptToBytes).toHaveBeenCalledWith(plainValue, key);
+      const result = await encryptService.encryptFileData(plainValue, key);
+      expect(result).toEqual(testEncBuffer);
+      expect(PureCrypto.symmetric_encrypt_filedata).toHaveBeenCalledWith(
+        plainValue,
+        key.toEncoded(),
+      );
     });
   });
 
   describe("decryptString", () => {
-    it("is a proxy to decryptToUtf8", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = new EncString(EncryptionType.AesCbc256_B64, "data");
-      encryptService.decryptToUtf8 = jest.fn();
-      await encryptService.decryptString(encString, key);
-      expect(encryptService.decryptToUtf8).toHaveBeenCalledWith(encString, key);
+      const encString = new EncString("encrypted_string");
+      const result = await encryptService.decryptString(encString, key);
+      expect(result).toEqual("decrypted_string");
+      expect(PureCrypto.symmetric_decrypt_string).toHaveBeenCalledWith(
+        encString.encryptedString,
+        key.toEncoded(),
+      );
     });
   });
 
   describe("decryptBytes", () => {
-    it("is a proxy to decryptToBytes", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = new EncString(EncryptionType.AesCbc256_B64, "data");
-      encryptService.decryptToBytes = jest.fn();
-      await encryptService.decryptBytes(encString, key);
-      expect(encryptService.decryptToBytes).toHaveBeenCalledWith(encString, key);
+      const encString = new EncString("encrypted_bytes");
+      const result = await encryptService.decryptBytes(encString, key);
+      expect(result).toEqual(new Uint8Array(3));
+      expect(PureCrypto.symmetric_decrypt_bytes).toHaveBeenCalledWith(
+        encString.encryptedString,
+        key.toEncoded(),
+      );
     });
   });
 
   describe("decryptFileData", () => {
-    it("is a proxy to decrypt", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = new EncArrayBuffer(makeStaticByteArray(60, EncryptionType.AesCbc256_B64));
-      encryptService.decryptToBytes = jest.fn();
-      await encryptService.decryptFileData(encString, key);
-      expect(encryptService.decryptToBytes).toHaveBeenCalledWith(encString, key);
+      const encString = new EncArrayBuffer(testEncBuffer.buffer);
+      const result = await encryptService.decryptFileData(encString, key);
+      expect(result).toEqual(new Uint8Array(1));
+      expect(PureCrypto.symmetric_decrypt_filedata).toHaveBeenCalledWith(
+        encString.buffer,
+        key.toEncoded(),
+      );
     });
   });
 
   describe("unwrapDecapsulationKey", () => {
-    it("is a proxy to decryptBytes", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = new EncString(EncryptionType.AesCbc256_B64, "data");
-      encryptService.decryptBytes = jest.fn();
-      await encryptService.unwrapDecapsulationKey(encString, key);
-      expect(encryptService.decryptBytes).toHaveBeenCalledWith(encString, key);
+      const encString = new EncString("wrapped_decapsulation_key");
+      const result = await encryptService.unwrapDecapsulationKey(encString, key);
+      expect(result).toEqual(new Uint8Array(4));
+      expect(PureCrypto.unwrap_decapsulation_key).toHaveBeenCalledWith(
+        encString.encryptedString,
+        key.toEncoded(),
+      );
+    });
+    it("throws if wrappedDecapsulationKey is null", () => {
+      const key = new SymmetricCryptoKey(makeStaticByteArray(64));
+      return expect(encryptService.unwrapDecapsulationKey(null, key)).rejects.toThrow(
+        "No wrappedDecapsulationKey provided for unwrapping.",
+      );
+    });
+    it("throws if wrappingKey is null", () => {
+      const encString = new EncString("wrapped_decapsulation_key");
+      return expect(encryptService.unwrapDecapsulationKey(encString, null)).rejects.toThrow(
+        "No wrappingKey provided for unwrapping.",
+      );
     });
   });
 
   describe("unwrapEncapsulationKey", () => {
-    it("is a proxy to decryptBytes", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = new EncString(EncryptionType.AesCbc256_B64, "data");
-      encryptService.decryptBytes = jest.fn();
-      await encryptService.unwrapEncapsulationKey(encString, key);
-      expect(encryptService.decryptBytes).toHaveBeenCalledWith(encString, key);
+      const encString = new EncString("wrapped_encapsulation_key");
+      const result = await encryptService.unwrapEncapsulationKey(encString, key);
+      expect(result).toEqual(new Uint8Array(5));
+      expect(PureCrypto.unwrap_encapsulation_key).toHaveBeenCalledWith(
+        encString.encryptedString,
+        key.toEncoded(),
+      );
+    });
+    it("throws if wrappedEncapsulationKey is null", () => {
+      const key = new SymmetricCryptoKey(makeStaticByteArray(64));
+      return expect(encryptService.unwrapEncapsulationKey(null, key)).rejects.toThrow(
+        "No wrappedEncapsulationKey provided for unwrapping.",
+      );
+    });
+    it("throws if wrappingKey is null", () => {
+      const encString = new EncString("wrapped_encapsulation_key");
+      return expect(encryptService.unwrapEncapsulationKey(encString, null)).rejects.toThrow(
+        "No wrappingKey provided for unwrapping.",
+      );
     });
   });
 
   describe("unwrapSymmetricKey", () => {
-    it("is a proxy to decryptBytes", async () => {
+    it("is a proxy to PureCrypto", async () => {
       const key = new SymmetricCryptoKey(makeStaticByteArray(64));
-      const encString = new EncString(EncryptionType.AesCbc256_B64, "data");
-      const jestFn = jest.fn();
-      jestFn.mockResolvedValue(new Uint8Array(64));
-      encryptService.decryptBytes = jestFn;
-      await encryptService.unwrapSymmetricKey(encString, key);
-      expect(encryptService.decryptBytes).toHaveBeenCalledWith(encString, key);
+      const encString = new EncString("wrapped_symmetric_key");
+      const result = await encryptService.unwrapSymmetricKey(encString, key);
+      expect(result).toEqual(new SymmetricCryptoKey(new Uint8Array(64)));
+      expect(PureCrypto.unwrap_symmetric_key).toHaveBeenCalledWith(
+        encString.encryptedString,
+        key.toEncoded(),
+      );
+    });
+    it("throws if keyToBeUnwrapped is null", () => {
+      const key = new SymmetricCryptoKey(makeStaticByteArray(64));
+      return expect(encryptService.unwrapSymmetricKey(null, key)).rejects.toThrow(
+        "No keyToBeUnwrapped provided for unwrapping.",
+      );
+    });
+    it("throws if wrappingKey is null", () => {
+      const encString = new EncString("wrapped_symmetric_key");
+      return expect(encryptService.unwrapSymmetricKey(encString, null)).rejects.toThrow(
+        "No wrappingKey provided for unwrapping.",
+      );
     });
   });
 
@@ -690,23 +295,13 @@ describe("EncryptService", () => {
 
       it("throws if no public key is provided", () => {
         return expect(encryptService.encapsulateKeyUnsigned(testKey, null)).rejects.toThrow(
-          "No public key",
+          "No encapsulationKey provided for encapsulation",
         );
       });
 
       it("encrypts data with provided key", async () => {
-        cryptoFunctionService.rsaEncrypt.mockResolvedValue(encryptedData);
-
         const actual = await encryptService.encapsulateKeyUnsigned(testKey, publicKey);
-
-        expect(cryptoFunctionService.rsaEncrypt).toBeCalledWith(
-          expect.toEqualBuffer(testKey.toEncoded()),
-          expect.toEqualBuffer(publicKey),
-          "sha1",
-        );
-
-        expect(actual).toEqual(encString);
-        expect(actual.dataBytes).toEqualBuffer(encryptedData);
+        expect(actual).toEqual(new EncString("encapsulated_key_unsigned"));
       });
 
       it("throws if no data was provided", () => {
@@ -719,39 +314,19 @@ describe("EncryptService", () => {
     describe("decapsulateKeyUnsigned", () => {
       it("throws if no data is provided", () => {
         return expect(encryptService.decapsulateKeyUnsigned(null, privateKey)).rejects.toThrow(
-          "No data",
+          "No encryptedSharedKey provided for decapsulation",
         );
       });
 
       it("throws if no private key is provided", () => {
         return expect(encryptService.decapsulateKeyUnsigned(encString, null)).rejects.toThrow(
-          "No private key",
+          "No decapsulationKey provided for decapsulation",
         );
       });
 
-      it.each([EncryptionType.AesCbc256_B64, EncryptionType.AesCbc256_HmacSha256_B64])(
-        "throws if encryption type is %s",
-        async (encType) => {
-          encString.encryptionType = encType;
-
-          await expect(
-            encryptService.decapsulateKeyUnsigned(encString, privateKey),
-          ).rejects.toThrow("Invalid encryption type");
-        },
-      );
-
       it("decrypts data with provided key", async () => {
-        cryptoFunctionService.rsaDecrypt.mockResolvedValue(data);
-
         const actual = await encryptService.decapsulateKeyUnsigned(makeEncString(data), privateKey);
-
-        expect(cryptoFunctionService.rsaDecrypt).toBeCalledWith(
-          expect.toEqualBuffer(data),
-          expect.toEqualBuffer(privateKey),
-          "sha1",
-        );
-
-        expect(actual.toEncoded()).toEqualBuffer(data);
+        expect(actual.toEncoded()).toEqualBuffer(new Uint8Array(64));
       });
     });
   });

libs/common/src/key-management/crypto/services/fallback-bulk-encrypt.service.spec.ts

@@ -1,97 +0,0 @@
-import { mock } from "jest-mock-extended";
-
-import { ServerConfig } from "../../../platform/abstractions/config/server-config";
-import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-crypto-key";
-import { BulkEncryptService } from "../abstractions/bulk-encrypt.service";
-import { EncryptService } from "../abstractions/encrypt.service";
-
-import { FallbackBulkEncryptService } from "./fallback-bulk-encrypt.service";
-
-describe("FallbackBulkEncryptService", () => {
-  const encryptService = mock<EncryptService>();
-  const featureFlagEncryptService = mock<BulkEncryptService>();
-  const serverConfig = mock<ServerConfig>();
-
-  let sut: FallbackBulkEncryptService;
-
-  beforeEach(() => {
-    sut = new FallbackBulkEncryptService(encryptService);
-  });
-
-  afterEach(() => {
-    jest.resetAllMocks();
-  });
-
-  describe("decryptItems", () => {
-    const key = mock<SymmetricCryptoKey>();
-    const mockItems = [{ id: "guid", name: "encryptedValue" }] as any[];
-    const mockDecryptedItems = [{ id: "guid", name: "decryptedValue" }] as any[];
-
-    it("calls decryptItems on featureFlagEncryptService when it is set", async () => {
-      featureFlagEncryptService.decryptItems.mockResolvedValue(mockDecryptedItems);
-      await sut.setFeatureFlagEncryptService(featureFlagEncryptService);
-
-      const result = await sut.decryptItems(mockItems, key);
-
-      expect(featureFlagEncryptService.decryptItems).toHaveBeenCalledWith(mockItems, key);
-      expect(encryptService.decryptItems).not.toHaveBeenCalled();
-      expect(result).toEqual(mockDecryptedItems);
-    });
-
-    it("calls decryptItems on encryptService when featureFlagEncryptService is not set", async () => {
-      encryptService.decryptItems.mockResolvedValue(mockDecryptedItems);
-
-      const result = await sut.decryptItems(mockItems, key);
-
-      expect(encryptService.decryptItems).toHaveBeenCalledWith(mockItems, key);
-      expect(result).toEqual(mockDecryptedItems);
-    });
-  });
-
-  describe("setFeatureFlagEncryptService", () => {
-    it("sets the featureFlagEncryptService property", async () => {
-      await sut.setFeatureFlagEncryptService(featureFlagEncryptService);
-
-      expect((sut as any).featureFlagEncryptService).toBe(featureFlagEncryptService);
-    });
-
-    it("does not call onServerConfigChange when currentServerConfig is undefined", async () => {
-      await sut.setFeatureFlagEncryptService(featureFlagEncryptService);
-
-      expect(featureFlagEncryptService.onServerConfigChange).not.toHaveBeenCalled();
-      expect((sut as any).featureFlagEncryptService).toBe(featureFlagEncryptService);
-    });
-
-    it("calls onServerConfigChange with currentServerConfig when it is defined", async () => {
-      sut.onServerConfigChange(serverConfig);
-
-      await sut.setFeatureFlagEncryptService(featureFlagEncryptService);
-
-      expect(featureFlagEncryptService.onServerConfigChange).toHaveBeenCalledWith(serverConfig);
-      expect((sut as any).featureFlagEncryptService).toBe(featureFlagEncryptService);
-    });
-  });
-
-  describe("onServerConfigChange", () => {
-    it("updates internal currentServerConfig to new config", async () => {
-      sut.onServerConfigChange(serverConfig);
-
-      expect((sut as any).currentServerConfig).toBe(serverConfig);
-    });
-
-    it("calls onServerConfigChange on featureFlagEncryptService when it is set", async () => {
-      await sut.setFeatureFlagEncryptService(featureFlagEncryptService);
-
-      sut.onServerConfigChange(serverConfig);
-
-      expect(featureFlagEncryptService.onServerConfigChange).toHaveBeenCalledWith(serverConfig);
-      expect(encryptService.onServerConfigChange).not.toHaveBeenCalled();
-    });
-
-    it("calls onServerConfigChange on encryptService when featureFlagEncryptService is not set", () => {
-      sut.onServerConfigChange(serverConfig);
-
-      expect(encryptService.onServerConfigChange).toHaveBeenCalledWith(serverConfig);
-    });
-  });
-});

libs/common/src/key-management/crypto/services/fallback-bulk-encrypt.service.ts

@@ -9,7 +9,7 @@ import { ServerConfig } from "../../../platform/abstractions/config/server-confi
 import { EncryptService } from "../abstractions/encrypt.service";
 
 /**
- * @deprecated For the feature flag from PM-4154, remove once feature is rolled out
+ * @deprecated Will be deleted in an immediate subsequent PR
  */
 export class FallbackBulkEncryptService implements BulkEncryptService {
   private featureFlagEncryptService: BulkEncryptService;
@@ -25,22 +25,10 @@ export class FallbackBulkEncryptService implements BulkEncryptService {
     items: Decryptable<T>[],
     key: SymmetricCryptoKey,
   ): Promise<T[]> {
-    if (this.featureFlagEncryptService != null) {
-      return await this.featureFlagEncryptService.decryptItems(items, key);
-    } else {
-      return await this.encryptService.decryptItems(items, key);
-    }
+    return await this.encryptService.decryptItems(items, key);
   }
 
-  async setFeatureFlagEncryptService(featureFlagEncryptService: BulkEncryptService) {
-    if (this.currentServerConfig !== undefined) {
-      featureFlagEncryptService.onServerConfigChange(this.currentServerConfig);
-    }
-    this.featureFlagEncryptService = featureFlagEncryptService;
-  }
+  async setFeatureFlagEncryptService(featureFlagEncryptService: BulkEncryptService) {}
 
-  onServerConfigChange(newConfig: ServerConfig): void {
-    this.currentServerConfig = newConfig;
-    (this.featureFlagEncryptService ?? this.encryptService).onServerConfigChange(newConfig);
-  }
+  onServerConfigChange(newConfig: ServerConfig): void {}
 }

libs/common/src/key-management/crypto/services/multithread-encrypt.service.implementation.spec.ts

@@ -1,123 +0,0 @@
-import { mock } from "jest-mock-extended";
-import * as rxjs from "rxjs";
-
-import { ServerConfig } from "../../../platform/abstractions/config/server-config";
-import { LogService } from "../../../platform/abstractions/log.service";
-import { Decryptable } from "../../../platform/interfaces/decryptable.interface";
-import { SymmetricCryptoKey } from "../../../platform/models/domain/symmetric-crypto-key";
-import { CryptoFunctionService } from "../abstractions/crypto-function.service";
-import { buildSetConfigMessage } from "../types/worker-command.type";
-
-import { EncryptServiceImplementation } from "./encrypt.service.implementation";
-import { MultithreadEncryptServiceImplementation } from "./multithread-encrypt.service.implementation";
-
-describe("MultithreadEncryptServiceImplementation", () => {
-  const cryptoFunctionService = mock<CryptoFunctionService>();
-  const logService = mock<LogService>();
-  const serverConfig = mock<ServerConfig>();
-
-  let sut: MultithreadEncryptServiceImplementation;
-
-  beforeEach(() => {
-    sut = new MultithreadEncryptServiceImplementation(cryptoFunctionService, logService, true);
-  });
-
-  afterEach(() => {
-    jest.resetAllMocks();
-  });
-
-  describe("decryptItems", () => {
-    const key = mock<SymmetricCryptoKey>();
-    const mockWorker = mock<Worker>();
-
-    beforeEach(() => {
-      // Mock creating a worker.
-      global.Worker = jest.fn().mockImplementation(() => mockWorker);
-      global.URL = jest.fn().mockImplementation(() => "url") as unknown as typeof URL;
-      global.URL.createObjectURL = jest.fn().mockReturnValue("blob:url");
-      global.URL.revokeObjectURL = jest.fn();
-      global.URL.canParse = jest.fn().mockReturnValue(true);
-
-      // Mock the workers returned response.
-      const mockMessageEvent = {
-        id: "mock-guid",
-        data: ["decrypted1", "decrypted2"],
-      };
-      const mockMessageEvent$ = rxjs.from([mockMessageEvent]);
-      jest.spyOn(rxjs, "fromEvent").mockReturnValue(mockMessageEvent$);
-    });
-
-    it("returns empty array if items is null", async () => {
-      const items = null as unknown as Decryptable<any>[];
-      const result = await sut.decryptItems(items, key);
-      expect(result).toEqual([]);
-    });
-
-    it("returns empty array if items is empty", async () => {
-      const result = await sut.decryptItems([], key);
-      expect(result).toEqual([]);
-    });
-
-    it("creates worker if none exists", async () => {
-      // Make sure currentServerConfig is undefined so a SetConfigMessage is not sent.
-      (sut as any).currentServerConfig = undefined;
-
-      await sut.decryptItems([mock<Decryptable<any>>(), mock<Decryptable<any>>()], key);
-
-      expect(global.Worker).toHaveBeenCalled();
-      expect(mockWorker.postMessage).toHaveBeenCalledTimes(1);
-      expect(mockWorker.postMessage).not.toHaveBeenCalledWith(
-        buildSetConfigMessage({ newConfig: serverConfig }),
-      );
-    });
-
-    it("sends a SetConfigMessage to the new worker when there is a current server config", async () => {
-      // Populate currentServerConfig so a SetConfigMessage is sent.
-      (sut as any).currentServerConfig = serverConfig;
-
-      await sut.decryptItems([mock<Decryptable<any>>(), mock<Decryptable<any>>()], key);
-
-      expect(global.Worker).toHaveBeenCalled();
-      expect(mockWorker.postMessage).toHaveBeenCalledTimes(2);
-      expect(mockWorker.postMessage).toHaveBeenCalledWith(
-        buildSetConfigMessage({ newConfig: serverConfig }),
-      );
-    });
-
-    it("does not create worker if one exists", async () => {
-      (sut as any).currentServerConfig = serverConfig;
-      (sut as any).worker = mockWorker;
-
-      await sut.decryptItems([mock<Decryptable<any>>(), mock<Decryptable<any>>()], key);
-
-      expect(global.Worker).not.toHaveBeenCalled();
-      expect(mockWorker.postMessage).toHaveBeenCalledTimes(1);
-      expect(mockWorker.postMessage).not.toHaveBeenCalledWith(
-        buildSetConfigMessage({ newConfig: serverConfig }),
-      );
-    });
-  });
-
-  describe("onServerConfigChange", () => {
-    it("updates internal currentServerConfig to new config and calls super", () => {
-      const superSpy = jest.spyOn(EncryptServiceImplementation.prototype, "onServerConfigChange");
-
-      sut.onServerConfigChange(serverConfig);
-
-      expect(superSpy).toHaveBeenCalledWith(serverConfig);
-      expect((sut as any).currentServerConfig).toBe(serverConfig);
-    });
-
-    it("sends config update to worker if worker exists", () => {
-      const mockWorker = mock<Worker>();
-      (sut as any).worker = mockWorker;
-
-      sut.onServerConfigChange(serverConfig);
-
-      expect(mockWorker.postMessage).toHaveBeenCalledTimes(1);
-      expect(mockWorker.postMessage).toHaveBeenCalledWith(
-        buildSetConfigMessage({ newConfig: serverConfig }),
-      );
-    });
-  });
-});

libs/common/src/key-management/crypto/services/multithread-encrypt.service.implementation.ts

@@ -1,31 +1,16 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
-import { defaultIfEmpty, filter, firstValueFrom, fromEvent, map, Subject, takeUntil } from "rxjs";
-import { Jsonify } from "type-fest";
-
 import { Decryptable } from "@bitwarden/common/platform/interfaces/decryptable.interface";
 import { InitializerMetadata } from "@bitwarden/common/platform/interfaces/initializer-metadata.interface";
-import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { SymmetricCryptoKey } from "@bitwarden/common/platform/models/domain/symmetric-crypto-key";
-import { getClassInitializer } from "@bitwarden/common/platform/services/cryptography/get-class-initializer";
 
 import { ServerConfig } from "../../../platform/abstractions/config/server-config";
-import { buildDecryptMessage, buildSetConfigMessage } from "../types/worker-command.type";
 
 import { EncryptServiceImplementation } from "./encrypt.service.implementation";
 
-// TTL (time to live) is not strictly required but avoids tying up memory resources if inactive
-const workerTTL = 3 * 60000; // 3 minutes
-
 /**
- * @deprecated Replaced by BulkEncryptionService (PM-4154)
+ * @deprecated Will be deleted in an immediate subsequent PR
  */
 export class MultithreadEncryptServiceImplementation extends EncryptServiceImplementation {
-  private worker: Worker;
-  private timeout: any;
-  private currentServerConfig: ServerConfig | undefined = undefined;
-
-  private clear$ = new Subject<void>();
+  protected useSDKForDecryption: boolean = true;
 
   /**
    * Sends items to a web worker to decrypt them.
@@ -35,84 +20,8 @@ export class MultithreadEncryptServiceImplementation extends EncryptServiceImple
     items: Decryptable<T>[],
     key: SymmetricCryptoKey,
   ): Promise<T[]> {
-    if (items == null || items.length < 1) {
-      return [];
-    }
-
-    if (this.useSDKForDecryption) {
-      return await super.decryptItems(items, key);
-    }
-
-    this.logService.info("Starting decryption using multithreading");
-
-    if (this.worker == null) {
-      this.worker = new Worker(
-        new URL(
-          /* webpackChunkName: 'encrypt-worker' */
-          "@bitwarden/common/key-management/crypto/services/encrypt.worker.ts",
-          import.meta.url,
-        ),
-      );
-      if (this.currentServerConfig !== undefined) {
-        this.updateWorkerServerConfig(this.currentServerConfig);
-      }
-    }
-
-    this.restartTimeout();
-
-    const id = Utils.newGuid();
-    const request = buildDecryptMessage({
-      id,
-      items: items,
-      key: key,
-    });
-
-    this.worker.postMessage(request);
-
-    return await firstValueFrom(
-      fromEvent(this.worker, "message").pipe(
-        filter((response: MessageEvent) => response.data?.id === id),
-        map((response) => JSON.parse(response.data.items)),
-        map((items) =>
-          items.map((jsonItem: Jsonify<T>) => {
-            const initializer = getClassInitializer<T>(jsonItem.initializerKey);
-            return initializer(jsonItem);
-          }),
-        ),
-        takeUntil(this.clear$),
-        defaultIfEmpty([]),
-      ),
-    );
+    return await super.decryptItems(items, key);
   }
 
-  override onServerConfigChange(newConfig: ServerConfig): void {
-    this.currentServerConfig = newConfig;
-    super.onServerConfigChange(newConfig);
-    this.updateWorkerServerConfig(newConfig);
-  }
-
-  private updateWorkerServerConfig(newConfig: ServerConfig) {
-    if (this.worker != null) {
-      const request = buildSetConfigMessage({ newConfig });
-      this.worker.postMessage(request);
-    }
-  }
-
-  private clear() {
-    this.clear$.next();
-    this.worker?.terminate();
-    this.worker = null;
-    this.clearTimeout();
-  }
-
-  private restartTimeout() {
-    this.clearTimeout();
-    this.timeout = setTimeout(() => this.clear(), workerTTL);
-  }
-
-  private clearTimeout() {
-    if (this.timeout != null) {
-      clearTimeout(this.timeout);
-    }
-  }
+  override onServerConfigChange(newConfig: ServerConfig): void {}
 }

libs/common/src/key-management/crypto/services/web-crypto-function.service.spec.ts

@@ -233,48 +233,6 @@ describe("WebCrypto Function Service", () => {
     });
   });
 
-  describe("aesEncrypt CBC mode", () => {
-    it("should successfully encrypt data", async () => {
-      const cryptoFunctionService = getWebCryptoFunctionService();
-      const iv = makeStaticByteArray(16);
-      const key = makeStaticByteArray(32);
-      const data = Utils.fromUtf8ToArray("EncryptMe!");
-      const encValue = await cryptoFunctionService.aesEncrypt(data, iv, key);
-      expect(Utils.fromBufferToB64(encValue)).toBe("ByUF8vhyX4ddU9gcooznwA==");
-    });
-
-    it("should successfully encrypt and then decrypt data fast", async () => {
-      const cryptoFunctionService = getWebCryptoFunctionService();
-      const iv = makeStaticByteArray(16);
-      const key = makeStaticByteArray(32);
-      const value = "EncryptMe!";
-      const data = Utils.fromUtf8ToArray(value);
-      const encValue = await cryptoFunctionService.aesEncrypt(data, iv, key);
-      const encData = Utils.fromBufferToB64(encValue);
-      const b64Iv = Utils.fromBufferToB64(iv);
-      const symKey = new SymmetricCryptoKey(key);
-      const parameters = cryptoFunctionService.aesDecryptFastParameters(
-        encData,
-        b64Iv,
-        null,
-        symKey,
-      );
-      const decValue = await cryptoFunctionService.aesDecryptFast({ mode: "cbc", parameters });
-      expect(decValue).toBe(value);
-    });
-
-    it("should successfully encrypt and then decrypt data", async () => {
-      const cryptoFunctionService = getWebCryptoFunctionService();
-      const iv = makeStaticByteArray(16);
-      const key = makeStaticByteArray(32);
-      const value = "EncryptMe!";
-      const data = Utils.fromUtf8ToArray(value);
-      const encValue = new Uint8Array(await cryptoFunctionService.aesEncrypt(data, iv, key));
-      const decValue = await cryptoFunctionService.aesDecrypt(encValue, iv, key, "cbc");
-      expect(Utils.fromBufferToUtf8(decValue)).toBe(value);
-    });
-  });
-
   describe("aesDecryptFast CBC mode", () => {
     it("should successfully decrypt data", async () => {
       const cryptoFunctionService = getWebCryptoFunctionService();

libs/common/src/key-management/crypto/services/web-crypto-function.service.ts

@@ -204,14 +204,6 @@ export class WebCryptoFunctionService implements CryptoFunctionService {
     return equals;
   }
 
-  async aesEncrypt(data: Uint8Array, iv: Uint8Array, key: Uint8Array): Promise<Uint8Array> {
-    const impKey = await this.subtle.importKey("raw", key, { name: "AES-CBC" } as any, false, [
-      "encrypt",
-    ]);
-    const buffer = await this.subtle.encrypt({ name: "AES-CBC", iv: iv }, impKey, data);
-    return new Uint8Array(buffer);
-  }
-
   aesDecryptFastParameters(
     data: string,
     iv: string,

libs/common/src/key-management/device-trust/abstractions/device-trust.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { OtherDeviceKeysUpdateRequest } from "@bitwarden/common/auth/models/request/update-devices-trust.request";
@@ -15,51 +13,51 @@ export abstract class DeviceTrustServiceAbstraction {
    * by Platform
    * @description Checks if the device trust feature is supported for the active user.
    */
-  supportsDeviceTrust$: Observable<boolean>;
+  abstract supportsDeviceTrust$: Observable<boolean>;
 
   /**
    * Emits when a device has been trusted. This emission is specifically for the purpose of notifying
    * the consuming component to display a toast informing the user the device has been trusted.
    */
-  deviceTrusted$: Observable<void>;
+  abstract deviceTrusted$: Observable<void>;
 
   /**
    * @description Checks if the device trust feature is supported for the given user.
    */
-  supportsDeviceTrustByUserId$: (userId: UserId) => Observable<boolean>;
+  abstract supportsDeviceTrustByUserId$(userId: UserId): Observable<boolean>;
 
   /**
    * @description Retrieves the users choice to trust the device which can only happen after decryption
    * Note: this value should only be used once and then reset
    */
-  getShouldTrustDevice: (userId: UserId) => Promise<boolean | null>;
-  setShouldTrustDevice: (userId: UserId, value: boolean) => Promise<void>;
+  abstract getShouldTrustDevice(userId: UserId): Promise<boolean | null>;
+  abstract setShouldTrustDevice(userId: UserId, value: boolean): Promise<void>;
 
-  trustDeviceIfRequired: (userId: UserId) => Promise<void>;
+  abstract trustDeviceIfRequired(userId: UserId): Promise<void>;
 
-  trustDevice: (userId: UserId) => Promise<DeviceResponse>;
+  abstract trustDevice(userId: UserId): Promise<DeviceResponse>;
 
   /** Retrieves the device key if it exists from state or secure storage if supported for the active user. */
-  getDeviceKey: (userId: UserId) => Promise<DeviceKey | null>;
-  decryptUserKeyWithDeviceKey: (
+  abstract getDeviceKey(userId: UserId): Promise<DeviceKey | null>;
+  abstract decryptUserKeyWithDeviceKey(
     userId: UserId,
     encryptedDevicePrivateKey: EncString,
     encryptedUserKey: EncString,
     deviceKey: DeviceKey,
-  ) => Promise<UserKey | null>;
-  rotateDevicesTrust: (
+  ): Promise<UserKey | null>;
+  abstract rotateDevicesTrust(
     userId: UserId,
     newUserKey: UserKey,
     masterPasswordHash: string,
-  ) => Promise<void>;
+  ): Promise<void>;
   /**
    * Notifies the server that the device has a device key, but didn't receive any associated decryption keys.
    * Note: For debugging purposes only.
    */
-  recordDeviceTrustLoss: () => Promise<void>;
-  getRotatedData: (
+  abstract recordDeviceTrustLoss(): Promise<void>;
+  abstract getRotatedData(
     oldUserKey: UserKey,
     newUserKey: UserKey,
     userId: UserId,
-  ) => Promise<OtherDeviceKeysUpdateRequest[]>;
+  ): Promise<OtherDeviceKeysUpdateRequest[]>;
 }

libs/common/src/key-management/vault-timeout/abstractions/vault-timeout-settings.service.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable } from "rxjs";
 
 import { UserId } from "../../../types/guid";
@@ -13,11 +11,11 @@ export abstract class VaultTimeoutSettingsService {
    * @param vaultTimeoutAction The vault timeout action
    * @param userId The user id to set the data for.
    */
-  setVaultTimeoutOptions: (
+  abstract setVaultTimeoutOptions(
     userId: UserId,
     vaultTimeout: VaultTimeout,
     vaultTimeoutAction: VaultTimeoutAction,
-  ) => Promise<void>;
+  ): Promise<void>;
 
   /**
    * Get the available vault timeout actions for the current user
@@ -25,13 +23,13 @@ export abstract class VaultTimeoutSettingsService {
    * **NOTE:** This observable is not yet connected to the state service, so it will not update when the state changes
    * @param userId The user id to check. If not provided, the current user is used
    */
-  availableVaultTimeoutActions$: (userId?: string) => Observable<VaultTimeoutAction[]>;
+  abstract availableVaultTimeoutActions$(userId?: string): Observable<VaultTimeoutAction[]>;
 
   /**
    * Evaluates the user's available vault timeout actions and returns a boolean representing
    * if the user can lock or not
    */
-  canLock: (userId: string) => Promise<boolean>;
+  abstract canLock(userId: string): Promise<boolean>;
 
   /**
    * Gets the vault timeout action for the given user id. The returned value is
@@ -41,7 +39,7 @@ export abstract class VaultTimeoutSettingsService {
    * A new action will be emitted if the current state changes or if the user's policy changes and the new policy affects the action.
    * @param userId - the user id to get the vault timeout action for
    */
-  getVaultTimeoutActionByUserId$: (userId: string) => Observable<VaultTimeoutAction>;
+  abstract getVaultTimeoutActionByUserId$(userId: string): Observable<VaultTimeoutAction>;
 
   /**
    * Get the vault timeout for the given user id. The returned value is calculated based on the current state
@@ -50,14 +48,14 @@ export abstract class VaultTimeoutSettingsService {
    * A new timeout will be emitted if the current state changes or if the user's policy changes and the new policy affects the timeout.
    * @param userId The user id to get the vault timeout for
    */
-  getVaultTimeoutByUserId$: (userId: string) => Observable<VaultTimeout>;
+  abstract getVaultTimeoutByUserId$(userId: string): Observable<VaultTimeout>;
 
   /**
    * Has the user enabled unlock with Biometric.
    * @param userId The user id to check. If not provided, the current user is used
    * @returns boolean true if biometric lock is set
    */
-  isBiometricLockSet: (userId?: string) => Promise<boolean>;
+  abstract isBiometricLockSet(userId?: string): Promise<boolean>;
 
-  clear: (userId: UserId) => Promise<void>;
+  abstract clear(userId: UserId): Promise<void>;
 }

libs/common/src/key-management/vault-timeout/abstractions/vault-timeout.service.ts

@@ -1,7 +1,5 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 export abstract class VaultTimeoutService {
-  checkVaultTimeout: () => Promise<void>;
-  lock: (userId?: string) => Promise<void>;
-  logOut: (userId?: string) => Promise<void>;
+  abstract checkVaultTimeout(): Promise<void>;
+  abstract lock(userId?: string): Promise<void>;
+  abstract logOut(userId?: string): Promise<void>;
 }

libs/common/src/key-management/vault-timeout/services/vault-timeout.service.ts

@@ -143,10 +143,6 @@ export class VaultTimeoutService implements VaultTimeoutServiceAbstraction {
       ),
     );
 
-    if (userId == null || userId === currentUserId) {
-      await this.collectionService.clearActiveUserCache();
-    }
-
     await this.searchService.clearIndex(lockingUserId);
 
     await this.folderService.clearDecryptedFolderState(lockingUserId);

libs/common/src/models/export/cipher.export.ts

@@ -56,6 +56,7 @@ export class CipherExport {
     view.notes = req.notes;
     view.favorite = req.favorite;
     view.reprompt = req.reprompt ?? CipherRepromptType.None;
+    view.key = req.key != null ? new EncString(req.key) : null;
 
     if (req.fields != null) {
       view.fields = req.fields.map((f) => FieldExport.toView(f));
@@ -83,9 +84,9 @@ export class CipherExport {
       view.passwordHistory = req.passwordHistory.map((ph) => PasswordHistoryExport.toView(ph));
     }
 
-    view.creationDate = req.creationDate;
-    view.revisionDate = req.revisionDate;
-    view.deletedDate = req.deletedDate;
+    view.creationDate = req.creationDate ? new Date(req.creationDate) : null;
+    view.revisionDate = req.revisionDate ? new Date(req.revisionDate) : null;
+    view.deletedDate = req.deletedDate ? new Date(req.deletedDate) : null;
     return view;
   }
 

libs/common/src/models/export/password-history.export.ts

@@ -16,7 +16,7 @@ export class PasswordHistoryExport {
 
   static toView(req: PasswordHistoryExport, view = new PasswordHistoryView()) {
     view.password = req.password;
-    view.lastUsedDate = req.lastUsedDate;
+    view.lastUsedDate = req.lastUsedDate ? new Date(req.lastUsedDate) : null;
     return view;
   }
 

libs/common/src/platform/abstractions/fido2/fido2-active-request-manager.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Observable, Subject } from "rxjs";
 
 import { Fido2CredentialView } from "../../../vault/models/view/fido2-credential.view";
@@ -25,13 +23,13 @@ export interface ActiveRequest {
 export type RequestCollection = Readonly<{ [tabId: number]: ActiveRequest }>;
 
 export abstract class Fido2ActiveRequestManager {
-  getActiveRequest$: (tabId: number) => Observable<ActiveRequest | undefined>;
-  getActiveRequest: (tabId: number) => ActiveRequest | undefined;
-  newActiveRequest: (
+  abstract getActiveRequest$(tabId: number): Observable<ActiveRequest | undefined>;
+  abstract getActiveRequest(tabId: number): ActiveRequest | undefined;
+  abstract newActiveRequest(
     tabId: number,
     credentials: Fido2CredentialView[],
     abortController: AbortController,
-  ) => Promise<RequestResult>;
-  removeActiveRequest: (tabId: number) => void;
-  removeAllActiveRequests: () => void;
+  ): Promise<RequestResult>;
+  abstract removeActiveRequest(tabId: number): void;
+  abstract removeAllActiveRequests(): void;
 }

libs/common/src/platform/abstractions/fido2/fido2-authenticator.service.abstraction.ts

@@ -1,5 +1,3 @@
-// FIXME: Update this file to be type safe and remove this and next line
-// @ts-strict-ignore
 import { Fido2CredentialView } from "../../../vault/models/view/fido2-credential.view";
 
 /**
@@ -17,11 +15,11 @@ export abstract class Fido2AuthenticatorService<ParentWindowReference> {
    * @param abortController An AbortController that can be used to abort the operation.
    * @returns A promise that resolves with the new credential and an attestation signature.
    **/
-  makeCredential: (
+  abstract makeCredential(
     params: Fido2AuthenticatorMakeCredentialsParams,
     window: ParentWindowReference,
     abortController?: AbortController,
-  ) => Promise<Fido2AuthenticatorMakeCredentialResult>;
+  ): Promise<Fido2AuthenticatorMakeCredentialResult>;
 
   /**
    * Generate an assertion using an existing credential as describe in:
@@ -31,11 +29,11 @@ export abstract class Fido2AuthenticatorService<ParentWindowReference> {
    * @param abortController An AbortController that can be used to abort the operation.
    * @returns A promise that resolves with the asserted credential and an assertion signature.
    */
-  getAssertion: (
+  abstract getAssertion(
     params: Fido2AuthenticatorGetAssertionParams,
     window: ParentWindowReference,
     abortController?: AbortController,
-  ) => Promise<Fido2AuthenticatorGetAssertionResult>;
+  ): Promise<Fido2AuthenticatorGetAssertionResult>;
 
   /**
    * Discover credentials for a given Relying Party
@@ -43,7 +41,7 @@ export abstract class Fido2AuthenticatorService<ParentWindowReference> {
    * @param rpId The Relying Party's ID
    * @returns A promise that resolves with an array of discoverable credentials
    */
-  silentCredentialDiscovery: (rpId: string) => Promise<Fido2CredentialView[]>;
+  abstract silentCredentialDiscovery(rpId: string): Promise<Fido2CredentialView[]>;
 }
 
 // FIXME: update to use a const object instead of a typescript enum