From 9dd94a27825c83d6355b0b4d6038b36b93b808dc Mon Sep 17 00:00:00 2001
From: Jason Ng <jng@bitwarden.com>
Date: Wed, 21 Jan 2026 17:16:18 -0500
Subject: [PATCH] [PM-30828] added MP reprompt check to unarchive (#18464)

---
 .../archive-cipher-utilities.service.spec.ts       | 14 ++++++++++++++
 .../services/archive-cipher-utilities.service.ts   |  9 ++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/libs/vault/src/services/archive-cipher-utilities.service.spec.ts b/libs/vault/src/services/archive-cipher-utilities.service.spec.ts
index 5df1bff9a56..ea00f482987 100644
--- a/libs/vault/src/services/archive-cipher-utilities.service.spec.ts
+++ b/libs/vault/src/services/archive-cipher-utilities.service.spec.ts
@@ -120,5 +120,19 @@ describe("ArchiveCipherUtilitiesService", () => {
         message: "errorOccurred",
       });
     });
+
+    it("calls password reprompt check when unarchiving", async () => {
+      await service.unarchiveCipher(mockCipher);
+
+      expect(passwordRepromptService.passwordRepromptCheck).toHaveBeenCalledWith(mockCipher);
+    });
+
+    it("returns early when password reprompt fails on unarchive", async () => {
+      passwordRepromptService.passwordRepromptCheck.mockResolvedValue(false);
+
+      await service.unarchiveCipher(mockCipher);
+
+      expect(cipherArchiveService.unarchiveWithServer).not.toHaveBeenCalled();
+    });
   });
 });
diff --git a/libs/vault/src/services/archive-cipher-utilities.service.ts b/libs/vault/src/services/archive-cipher-utilities.service.ts
index 93e752b57dd..b747961a701 100644
--- a/libs/vault/src/services/archive-cipher-utilities.service.ts
+++ b/libs/vault/src/services/archive-cipher-utilities.service.ts
@@ -74,7 +74,14 @@ export class ArchiveCipherUtilitiesService {
    * @param cipher The cipher to unarchive
    * @returns The unarchived cipher on success, or undefined on failure
    */
-  async unarchiveCipher(cipher: CipherView) {
+  async unarchiveCipher(cipher: CipherView, skipReprompt = false) {
+    if (!skipReprompt) {
+      const repromptPassed = await this.passwordRepromptService.passwordRepromptCheck(cipher);
+      if (!repromptPassed) {
+        return;
+      }
+    }
+
     const userId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
     try {
       const cipherResponse = await this.cipherArchiveService.unarchiveWithServer(