Updated references to use decrypt with feature flag

2026-02-09 21:20:27 +00:00 · 2025-04-09 17:58:31 -04:00
parent 6f3cbd1c62
commit 9f29cefb78
29 changed files with 85 additions and 98 deletions
--- a/apps/browser/src/autofill/background/notification.background.ts
+++ b/apps/browser/src/autofill/background/notification.background.ts
@@ -692,9 +692,7 @@ export default class NotificationBackground {
  private async getDecryptedCipherById(cipherId: string, userId: UserId) {
    const cipher = await this.cipherService.get(cipherId, userId);
    if (cipher != null && cipher.type === CipherType.Login) {
-      return await cipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(cipher, userId),
-      );
+      return await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, userId);
    }
    return null;
  }
--- a/apps/browser/src/autofill/popup/fido2/fido2.component.ts
+++ b/apps/browser/src/autofill/popup/fido2/fido2.component.ts
@@ -216,9 +216,7 @@ export class Fido2Component implements OnInit, OnDestroy {
            this.ciphers = await Promise.all(
              message.cipherIds.map(async (cipherId) => {
                const cipher = await this.cipherService.get(cipherId, activeUserId);
-                return cipher.decrypt(
-                  await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-                );
+                return this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
              }),
            );

@@ -237,9 +235,7 @@ export class Fido2Component implements OnInit, OnDestroy {
            this.ciphers = await Promise.all(
              message.existingCipherIds.map(async (cipherId) => {
                const cipher = await this.cipherService.get(cipherId, activeUserId);
-                return cipher.decrypt(
-                  await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-                );
+                return this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
              }),
            );

--- a/apps/browser/src/vault/popup/components/vault-v2/assign-collections/assign-collections.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/assign-collections/assign-collections.component.ts
@@ -11,7 +11,6 @@ import { CollectionService } from "@bitwarden/admin-console/common";
 import { JslibModule } from "@bitwarden/angular/jslib.module";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { OrganizationId } from "@bitwarden/common/types/guid";
-import { OrgKey, UserKey } from "@bitwarden/common/types/key";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
 import { CipherView } from "@bitwarden/common/vault/models/view/cipher.view";
 import {
@@ -66,11 +65,7 @@ export class AssignCollections {
        route.queryParams.pipe(
          switchMap(async ({ cipherId }) => {
            const cipherDomain = await this.cipherService.get(cipherId, userId);
-            const key: UserKey | OrgKey = await this.cipherService.getKeyForCipherKeyDecryption(
-              cipherDomain,
-              userId,
-            );
-            return cipherDomain.decrypt(key);
+            return await this.cipherService.decryptCipherWithSdkOrLegacy(cipherDomain, userId);
          }),
        ),
      ),
--- a/apps/browser/src/vault/popup/components/vault-v2/attachments/open-attachments/open-attachments.component.spec.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/attachments/open-attachments/open-attachments.component.spec.ts
@@ -81,6 +81,7 @@ describe("OpenAttachmentsComponent", () => {
          useValue: {
            get: getCipher,
            getKeyForCipherKeyDecryption: () => Promise.resolve(null),
+            decryptCipherWithSdkOrLegacy: jest.fn().mockResolvedValue(cipherView),
          },
        },
        {
--- a/apps/browser/src/vault/popup/components/vault-v2/attachments/open-attachments/open-attachments.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/attachments/open-attachments/open-attachments.component.ts
@@ -81,8 +81,9 @@ export class OpenAttachmentsComponent implements OnInit {
      this.accountService.activeAccount$.pipe(map((a) => a?.id)),
    );
    const cipherDomain = await this.cipherService.get(this.cipherId, activeUserId);
-    const cipher = await cipherDomain.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipherDomain, activeUserId),
+    const cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+      cipherDomain,
+      activeUserId,
    );

    if (!cipher.organizationId) {
--- a/apps/browser/src/vault/popup/components/vault-v2/vault-password-history-v2/vault-password-history-v2.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/vault-password-history-v2/vault-password-history-v2.component.ts
@@ -69,8 +69,6 @@ export class PasswordHistoryV2Component implements OnInit {
    const activeUserId = activeAccount.id as UserId;

    const cipher = await this.cipherService.get(cipherId, activeUserId);
-    this.cipher = await cipher.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-    );
+    this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
  }
 }
--- a/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.spec.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.spec.ts
@@ -77,6 +77,7 @@ describe("ViewV2Component", () => {
    getKeyForCipherKeyDecryption: jest.fn().mockResolvedValue({}),
    deleteWithServer: jest.fn().mockResolvedValue(undefined),
    softDeleteWithServer: jest.fn().mockResolvedValue(undefined),
+    decryptCipherWithSdkOrLegacy: jest.fn().mockResolvedValue(mockCipher),
  };

  beforeEach(async () => {
--- a/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts
+++ b/apps/browser/src/vault/popup/components/vault-v2/view-v2/view-v2.component.ts
@@ -182,9 +182,7 @@ export class ViewV2Component {

  async getCipherData(id: string, userId: UserId) {
    const cipher = await this.cipherService.get(id, userId);
-    return await cipher.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipher, userId),
-    );
+    return await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, userId);
  }

  async editCipher() {
--- a/apps/cli/src/admin-console/commands/share.command.ts
+++ b/apps/cli/src/admin-console/commands/share.command.ts
@@ -59,14 +59,13 @@ export class ShareCommand {
      return Response.badRequest("This item already belongs to an organization.");
    }

-    const cipherView = await cipher.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-    );
+    const cipherView = await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
    try {
      await this.cipherService.shareWithServer(cipherView, organizationId, req, activeUserId);
      const updatedCipher = await this.cipherService.get(cipher.id, activeUserId);
-      const decCipher = await updatedCipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(updatedCipher, activeUserId),
+      const decCipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        updatedCipher,
+        activeUserId,
      );
      const res = new CipherResponse(decCipher);
      return Response.success(res);
--- a/apps/cli/src/commands/edit.command.ts
+++ b/apps/cli/src/commands/edit.command.ts
@@ -90,9 +90,7 @@ export class EditCommand {
      return Response.notFound();
    }

-    let cipherView = await cipher.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-    );
+    let cipherView = await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
    if (cipherView.isDeleted) {
      return Response.badRequest("You may not edit a deleted item. Use the restore command first.");
    }
@@ -100,8 +98,9 @@ export class EditCommand {
    const encCipher = await this.cipherService.encrypt(cipherView, activeUserId);
    try {
      const updatedCipher = await this.cipherService.updateWithServer(encCipher);
-      const decCipher = await updatedCipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(updatedCipher, activeUserId),
+      const decCipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        updatedCipher,
+        activeUserId,
      );
      const res = new CipherResponse(decCipher);
      return Response.success(res);
@@ -132,11 +131,9 @@ export class EditCommand {
        cipher,
        activeUserId,
      );
-      const decCipher = await updatedCipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(
-          updatedCipher,
-          await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId)),
-        ),
+      const decCipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        updatedCipher,
+        activeUserId,
      );
      const res = new CipherResponse(decCipher);
      return Response.success(res);
--- a/apps/cli/src/commands/get.command.ts
+++ b/apps/cli/src/commands/get.command.ts
@@ -116,9 +116,7 @@ export class GetCommand extends DownloadCommand {
    if (Utils.isGuid(id)) {
      const cipher = await this.cipherService.get(id, activeUserId);
      if (cipher != null) {
-        decCipher = await cipher.decrypt(
-          await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-        );
+        decCipher = await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
      }
    } else if (id.trim() !== "") {
      let ciphers = await this.cipherService.getAllDecrypted(activeUserId);
--- a/apps/cli/src/service-container/service-container.ts
+++ b/apps/cli/src/service-container/service-container.ts
@@ -693,6 +693,7 @@ export class ServiceContainer {
      this.configService,
      this.stateProvider,
      this.accountService,
+      this.sdkService,
    );

    this.folderService = new FolderService(
--- a/apps/cli/src/vault/create.command.ts
+++ b/apps/cli/src/vault/create.command.ts
@@ -93,8 +93,9 @@ export class CreateCommand {
    const cipher = await this.cipherService.encrypt(CipherExport.toView(req), activeUserId);
    try {
      const newCipher = await this.cipherService.createWithServer(cipher);
-      const decCipher = await newCipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(newCipher, activeUserId),
+      const decCipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        newCipher,
+        activeUserId,
      );
      const res = new CipherResponse(decCipher);
      return Response.success(res);
@@ -162,8 +163,9 @@ export class CreateCommand {
        new Uint8Array(fileBuf).buffer,
        activeUserId,
      );
-      const decCipher = await updatedCipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(updatedCipher, activeUserId),
+      const decCipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        updatedCipher,
+        activeUserId,
      );
      return Response.success(new CipherResponse(decCipher));
    } catch (e) {
--- a/apps/desktop/src/autofill/services/desktop-autofill.service.ts
+++ b/apps/desktop/src/autofill/services/desktop-autofill.service.ts
@@ -199,8 +199,9 @@ export class DesktopAutofillService implements OnDestroy {
            return;
          }

-          const decrypted = await cipher.decrypt(
-            await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
+          const decrypted = await this.cipherService.decryptCipherWithSdkOrLegacy(
+            cipher,
+            activeUserId,
          );

          const fido2Credential = decrypted.login.fido2Credentials?.[0];
--- a/apps/desktop/src/services/encrypted-message-handler.service.ts
+++ b/apps/desktop/src/services/encrypted-message-handler.service.ts
@@ -207,8 +207,9 @@ export class EncryptedMessageHandlerService {
        return { status: "failure" };
      }

-      const cipherView = await cipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
+      const cipherView = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        cipher,
+        activeUserId,
      );
      cipherView.name = credentialUpdatePayload.name;
      cipherView.login.password = credentialUpdatePayload.password;
--- a/apps/web/src/app/vault/components/vault-item-dialog/vault-item-dialog.component.ts
+++ b/apps/web/src/app/vault/components/vault-item-dialog/vault-item-dialog.component.ts
@@ -471,8 +471,9 @@ export class VaultItemDialogComponent implements OnInit, OnDestroy {
        activeUserId,
      );

-      const updatedCipherView = await updatedCipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(updatedCipher, activeUserId),
+      const updatedCipherView = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        updatedCipher,
+        activeUserId,
      );

      this.cipherFormComponent.patchCipher((currentCipher) => {
@@ -509,8 +510,9 @@ export class VaultItemDialogComponent implements OnInit, OnDestroy {
      return;
    }
    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
-    return await config.originalCipher.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(config.originalCipher, activeUserId),
+    return await this.cipherService.decryptCipherWithSdkOrLegacy(
+      config.originalCipher,
+      activeUserId,
    );
  }

--- a/libs/angular/src/admin-console/components/collections.component.ts
+++ b/libs/angular/src/admin-console/components/collections.component.ts
@@ -50,8 +50,9 @@ export class CollectionsComponent implements OnInit {
    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
    this.cipherDomain = await this.loadCipher(activeUserId);
    this.collectionIds = this.loadCipherCollections();
-    this.cipher = await this.cipherDomain.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(this.cipherDomain, activeUserId),
+    this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+      this.cipherDomain,
+      activeUserId,
    );
    this.collections = await this.loadCollections();

--- a/libs/angular/src/components/share.component.ts
+++ b/libs/angular/src/components/share.component.ts
@@ -76,9 +76,7 @@ export class ShareComponent implements OnInit, OnDestroy {

    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
    const cipherDomain = await this.cipherService.get(this.cipherId, activeUserId);
-    this.cipher = await cipherDomain.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipherDomain, activeUserId),
-    );
+    this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(cipherDomain, activeUserId);
  }

  filterCollections() {
@@ -105,8 +103,9 @@ export class ShareComponent implements OnInit, OnDestroy {

    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
    const cipherDomain = await this.cipherService.get(this.cipherId, activeUserId);
-    const cipherView = await cipherDomain.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipherDomain, activeUserId),
+    const cipherView = await this.cipherService.decryptCipherWithSdkOrLegacy(
+      cipherDomain,
+      activeUserId,
    );
    const orgs = await firstValueFrom(this.organizations$);
    const orgName =
--- a/libs/angular/src/services/jslib-services.module.ts
+++ b/libs/angular/src/services/jslib-services.module.ts
@@ -509,6 +509,7 @@ const safeProviders: SafeProvider[] = [
      stateProvider: StateProvider,
      accountService: AccountServiceAbstraction,
      sdkService: SdkService,
+      cipherEncryptionService: CipherEncryptionService,
    ) =>
      new CipherService(
        keyService,
@@ -525,6 +526,7 @@ const safeProviders: SafeProvider[] = [
        stateProvider,
        accountService,
        sdkService,
+        cipherEncryptionService,
      ),
    deps: [
      KeyService,
@@ -541,6 +543,7 @@ const safeProviders: SafeProvider[] = [
      StateProvider,
      AccountServiceAbstraction,
      SdkService,
+      CipherEncryptionService,
    ],
  }),
  safeProvider({
--- a/libs/angular/src/vault/components/add-edit.component.ts
+++ b/libs/angular/src/vault/components/add-edit.component.ts
@@ -269,9 +269,7 @@ export class AddEditComponent implements OnInit, OnDestroy {
    if (this.cipher == null) {
      if (this.editMode) {
        const cipher = await this.loadCipher(activeUserId);
-        this.cipher = await cipher.decrypt(
-          await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-        );
+        this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);

        // Adjust Cipher Name if Cloning
        if (this.cloneMode) {
--- a/libs/angular/src/vault/components/attachments.component.ts
+++ b/libs/angular/src/vault/components/attachments.component.ts
@@ -88,8 +88,9 @@ export class AttachmentsComponent implements OnInit {
      const activeUserId = await firstValueFrom(getUserId(this.accountService.activeAccount$));
      this.formPromise = this.saveCipherAttachment(files[0], activeUserId);
      this.cipherDomain = await this.formPromise;
-      this.cipher = await this.cipherDomain.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(this.cipherDomain, activeUserId),
+      this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        this.cipherDomain,
+        activeUserId,
      );
      this.toastService.showToast({
        variant: "success",
@@ -130,9 +131,7 @@ export class AttachmentsComponent implements OnInit {
      const updatedCipher = await this.deletePromises[attachment.id];

      const cipher = new Cipher(updatedCipher);
-      this.cipher = await cipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-      );
+      this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);

      this.toastService.showToast({
        variant: "success",
@@ -228,8 +227,9 @@ export class AttachmentsComponent implements OnInit {
  protected async init() {
    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
    this.cipherDomain = await this.loadCipher(activeUserId);
-    this.cipher = await this.cipherDomain.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(this.cipherDomain, activeUserId),
+    this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+      this.cipherDomain,
+      activeUserId,
    );

    const canAccessPremium = await firstValueFrom(
@@ -292,8 +292,9 @@ export class AttachmentsComponent implements OnInit {
            activeUserId,
            admin,
          );
-          this.cipher = await this.cipherDomain.decrypt(
-            await this.cipherService.getKeyForCipherKeyDecryption(this.cipherDomain, activeUserId),
+          this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+            this.cipherDomain,
+            activeUserId,
          );

          // 3. Delete old
--- a/libs/angular/src/vault/components/password-history.component.ts
+++ b/libs/angular/src/vault/components/password-history.component.ts
@@ -42,9 +42,7 @@ export class PasswordHistoryComponent implements OnInit {
  protected async init() {
    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
    const cipher = await this.cipherService.get(this.cipherId, activeUserId);
-    const decCipher = await cipher.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-    );
+    const decCipher = await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
    this.history = decCipher.passwordHistory == null ? [] : decCipher.passwordHistory;
  }
 }
--- a/libs/common/src/platform/services/fido2/fido2-authenticator.service.spec.ts
+++ b/libs/common/src/platform/services/fido2/fido2-authenticator.service.spec.ts
@@ -152,6 +152,7 @@ describe("FidoAuthenticatorService", () => {
          id === excludedCipher.id ? ({ decrypt: () => excludedCipher } as any) : undefined,
        );
        cipherService.getAllDecrypted.mockResolvedValue([excludedCipher]);
+        cipherService.decryptCipherWithSdkOrLegacy.mockResolvedValue(excludedCipher);
      });

      /**
@@ -220,6 +221,7 @@ describe("FidoAuthenticatorService", () => {
          id === existingCipher.id ? ({ decrypt: () => existingCipher } as any) : undefined,
        );
        cipherService.getAllDecrypted.mockResolvedValue([existingCipher]);
+        cipherService.decryptCipherWithSdkOrLegacy.mockResolvedValue(existingCipher);
      });

      /**
@@ -306,6 +308,11 @@ describe("FidoAuthenticatorService", () => {
        const encryptedCipher = { ...existingCipher, reprompt: CipherRepromptType.Password };
        cipherService.get.mockResolvedValue(encryptedCipher as unknown as Cipher);

+        cipherService.decryptCipherWithSdkOrLegacy.mockResolvedValue({
+          ...existingCipher,
+          reprompt: CipherRepromptType.Password,
+        } as unknown as CipherView);
+
        const result = async () => await authenticator.makeCredential(params, windowReference);

        await expect(result).rejects.toThrowError(Fido2AuthenticatorErrorCode.Unknown);
@@ -347,6 +354,7 @@ describe("FidoAuthenticatorService", () => {
          cipherId === cipher.id ? ({ decrypt: () => cipher } as any) : undefined,
        );
        cipherService.getAllDecrypted.mockResolvedValue([await cipher]);
+        cipherService.decryptCipherWithSdkOrLegacy.mockResolvedValue(cipher);
        cipherService.encrypt.mockImplementation(async (cipher) => {
          cipher.login.fido2Credentials[0].credentialId = credentialId; // Replace id for testability
          return {} as any;
--- a/libs/common/src/platform/services/fido2/fido2-authenticator.service.ts
+++ b/libs/common/src/platform/services/fido2/fido2-authenticator.service.ts
@@ -151,9 +151,7 @@ export class Fido2AuthenticatorService<ParentWindowReference>
        );
        const encrypted = await this.cipherService.get(cipherId, activeUserId);

-        cipher = await encrypted.decrypt(
-          await this.cipherService.getKeyForCipherKeyDecryption(encrypted, activeUserId),
-        );
+        cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(encrypted, activeUserId);

        if (
          !userVerified &&
--- a/libs/importer/src/importers/bitwarden/bitwarden-json-importer.ts
+++ b/libs/importer/src/importers/bitwarden/bitwarden-json-importer.ts
@@ -118,9 +118,7 @@ export class BitwardenJsonImporter extends BaseImporter implements Importer {
      const activeUserId = await firstValueFrom(
        this.accountService.activeAccount$.pipe(map((a) => a?.id)),
      );
-      const view = await cipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-      );
+      const view = await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
      this.cleanupCipher(view);
      this.result.ciphers.push(view);
    }
--- a/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
+++ b/libs/tools/export/vault-export/vault-export-core/src/services/org-vault-export.service.ts
@@ -154,8 +154,7 @@ export class OrganizationVaultExportService
                const cipher = new Cipher(new CipherData(c));
                exportPromises.push(
                  this.cipherService
-                    .getKeyForCipherKeyDecryption(cipher, activeUserId)
-                    .then((key) => cipher.decrypt(key))
+                    .decryptCipherWithSdkOrLegacy(cipher, activeUserId)
                    .then((decCipher) => {
                      decCiphers.push(decCipher);
                    }),
--- a/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.spec.ts
+++ b/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.spec.ts
@@ -70,6 +70,7 @@ describe("CipherAttachmentsComponent", () => {
            get: cipherServiceGet,
            saveAttachmentWithServer,
            getKeyForCipherKeyDecryption: () => Promise.resolve(null),
+            decryptCipherWithSdkOrLegacy: jest.fn().mockResolvedValue(cipherView),
          },
        },
        {
--- a/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.ts
+++ b/libs/vault/src/cipher-form/components/attachments/cipher-attachments.component.ts
@@ -121,8 +121,9 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
  async ngOnInit(): Promise<void> {
    this.activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
    this.cipherDomain = await this.cipherService.get(this.cipherId, this.activeUserId);
-    this.cipher = await this.cipherDomain.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(this.cipherDomain, this.activeUserId),
+    this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+      this.cipherDomain,
+      this.activeUserId,
    );

    // Update the initial state of the submit button
@@ -193,8 +194,9 @@ export class CipherAttachmentsComponent implements OnInit, AfterViewInit {
      );

      // re-decrypt the cipher to update the attachments
-      this.cipher = await this.cipherDomain.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(this.cipherDomain, this.activeUserId),
+      this.cipher = await this.cipherService.decryptCipherWithSdkOrLegacy(
+        this.cipherDomain,
+        this.activeUserId,
      );

      // Reset reactive form and input element
--- a/libs/vault/src/cipher-form/services/default-cipher-form.service.ts
+++ b/libs/vault/src/cipher-form/services/default-cipher-form.service.ts
@@ -3,7 +3,6 @@
 import { inject, Injectable } from "@angular/core";
 import { firstValueFrom } from "rxjs";

-import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { getUserId } from "@bitwarden/common/auth/services/account.service";
 import { CipherService } from "@bitwarden/common/vault/abstractions/cipher.service";
@@ -21,13 +20,10 @@ function isSetEqual(a: Set<string>, b: Set<string>) {
 export class DefaultCipherFormService implements CipherFormService {
  private cipherService: CipherService = inject(CipherService);
  private accountService: AccountService = inject(AccountService);
-  private apiService: ApiService = inject(ApiService);

  async decryptCipher(cipher: Cipher): Promise<CipherView> {
    const activeUserId = await firstValueFrom(this.accountService.activeAccount$.pipe(getUserId));
-    return await cipher.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(cipher, activeUserId),
-    );
+    return await this.cipherService.decryptCipherWithSdkOrLegacy(cipher, activeUserId);
  }

  async saveCipher(cipher: CipherView, config: CipherFormConfig): Promise<CipherView> {
@@ -46,9 +42,7 @@ export class DefaultCipherFormService implements CipherFormService {
    // Creating a new cipher
    if (cipher.id == null) {
      savedCipher = await this.cipherService.createWithServer(encryptedCipher, config.admin);
-      return await savedCipher.decrypt(
-        await this.cipherService.getKeyForCipherKeyDecryption(savedCipher, activeUserId),
-      );
+      return await this.cipherService.decryptCipherWithSdkOrLegacy(savedCipher, activeUserId);
    }

    if (config.originalCipher == null) {
@@ -100,8 +94,6 @@ export class DefaultCipherFormService implements CipherFormService {
      return null;
    }

-    return await savedCipher.decrypt(
-      await this.cipherService.getKeyForCipherKeyDecryption(savedCipher, activeUserId),
-    );
+    return await this.cipherService.decryptCipherWithSdkOrLegacy(savedCipher, activeUserId);
  }
 }