[PM-5363] PinService State Providers (#8244)

* move pinKeyEncryptedUserKey

* move pinKeyEncryptedUserKeyEphemeral

* remove comments, move docs

* cleanup

* use UserKeyDefinition

* refactor methods

* add migration

* fix browser dependency

* add tests for migration

* rename to pinService

* move state to PinService

* add PinService dep to CryptoService

* move protectedPin to state provider

* update service deps

* renaming

* move decryptUserKeyWithPin to pinService

* update service injection

* move more methods our of crypto service

* remove CryptoService dep from PinService and update service injection

* remove cryptoService reference

* add method to FakeMasterPasswordService

* fix circular dependency

* fix desktop service injection

* update browser dependencies

* add protectedPin to migrations

* move storePinKey to pinService

* update and clarify documentation

* more jsdoc updates

* update import paths

* refactor isPinLockSet method

* update state definitions

* initialize service before injecting into other services

* initialize service before injecting into other services (bw.ts)

* update clearOn and do additional cleanup

* clarify docs and naming

* assign abstract & private methods, add clarity to decryptAndMigrateOldPinKeyEncryptedMasterKey() method

* derived state (attempt)

* fix typos

* use accountService to get active user email

* use constant userId

* add derived state

* add get and clear for oldPinKeyEncryptedMasterKey

* require userId

* move pinProtected

* add clear methods

* remove pinProtected from account.ts and replace methods

* add methods to create and store pinKeyEncryptedUserKey

* add pinProtected/oldPinKeyEncrypterMasterKey to migration

* update migration tests

* update migration rollback tests

* update to systemService and decryptAndMigrate... method

* remove old test

* increase length of state definition name to meet test requirements

* rename 'TRANSIENT' to 'EPHEMERAL' for consistency

* fix tests for login strategies, vault-export, and fake MP service

* more updates to login-strategy tests

* write new tests for core pinKeyEncrypterUserKey methods and isPinSet

* write new tests for pinProtected and oldPinKeyEncryptedMasterKey methods

* minor test reformatting

* update test for decryptUserKeyWithPin()

* fix bug with oldPinKeyEncryptedMasterKey

* fix tests for vault-timeout-settings.service

* fix bitwarden-password-protected-importer test

* fix login strategy tests and auth-request.service test

* update pinService tests

* fix crypto service tests

* add jsdoc

* fix test file import

* update jsdocs for decryptAndMigrateOldPinKeyEncryptedMasterKey()

* update error messages and jsdocs

* add null checks, move userId retrievals

* update migration tests

* update stateService calls to require userId

* update test for decryptUserKeyWithPin()

* update oldPinKeyEncryptedMasterKey migration tests

* more test updates

* fix factory import

* update tests for isPinSet() and createProtectedPin()

* add test for makePinKey()

* add test for createPinKeyEncryptedUserKey()

* add tests for getPinLockType()

* consolidate userId verification tests

* add tests for storePinKeyEncryptedUserKey()

* fix service dep

* get email based on userId

* use MasterPasswordService instead of internal

* rename protectedPin to userKeyEncryptedPin

* rename to pinKeyEncryptedUserKeyPersistent

* update method params

* fix CryptoService tests

* jsdoc update

* use EncString for userKeyEncryptedPin

* remove comment

* use cryptoFunctionService.compareFast()

* update tests

* cleanup, remove comments

* resolve merge conflict

* fix DI of MasterPasswordService

* more DI fixes

apps/browser/src/auth/background/service-factories/master-password-service.factory.ts

@@ -4,20 +4,35 @@ import {
 } from "@bitwarden/common/auth/abstractions/master-password.service.abstraction";
 import { MasterPasswordService } from "@bitwarden/common/auth/services/master-password/master-password.service";
 
+import {
+  encryptServiceFactory,
+  EncryptServiceInitOptions,
+} from "../../../platform/background/service-factories/encrypt-service.factory";
 import {
   CachedServices,
   factory,
   FactoryOptions,
 } from "../../../platform/background/service-factories/factory-options";
+import {
+  keyGenerationServiceFactory,
+  KeyGenerationServiceInitOptions,
+} from "../../../platform/background/service-factories/key-generation-service.factory";
 import {
   stateProviderFactory,
   StateProviderInitOptions,
 } from "../../../platform/background/service-factories/state-provider.factory";
+import {
+  stateServiceFactory,
+  StateServiceInitOptions,
+} from "../../../platform/background/service-factories/state-service.factory";
 
 type MasterPasswordServiceFactoryOptions = FactoryOptions;
 
 export type MasterPasswordServiceInitOptions = MasterPasswordServiceFactoryOptions &
-  StateProviderInitOptions;
+  StateProviderInitOptions &
+  StateServiceInitOptions &
+  KeyGenerationServiceInitOptions &
+  EncryptServiceInitOptions;
 
 export function internalMasterPasswordServiceFactory(
   cache: { masterPasswordService?: InternalMasterPasswordServiceAbstraction } & CachedServices,
@@ -27,7 +42,13 @@ export function internalMasterPasswordServiceFactory(
     cache,
     "masterPasswordService",
     opts,
-    async () => new MasterPasswordService(await stateProviderFactory(cache, opts)),
+    async () =>
+      new MasterPasswordService(
+        await stateProviderFactory(cache, opts),
+        await stateServiceFactory(cache, opts),
+        await keyGenerationServiceFactory(cache, opts),
+        await encryptServiceFactory(cache, opts),
+      ),
   );
 }
 

apps/browser/src/auth/background/service-factories/pin-crypto-service.factory.ts

@@ -1,53 +0,0 @@
-import { PinCryptoServiceAbstraction, PinCryptoService } from "@bitwarden/auth/common";
-
-import {
-  VaultTimeoutSettingsServiceInitOptions,
-  vaultTimeoutSettingsServiceFactory,
-} from "../../../background/service-factories/vault-timeout-settings-service.factory";
-import {
-  CryptoServiceInitOptions,
-  cryptoServiceFactory,
-} from "../../../platform/background/service-factories/crypto-service.factory";
-import {
-  FactoryOptions,
-  CachedServices,
-  factory,
-} from "../../../platform/background/service-factories/factory-options";
-import {
-  LogServiceInitOptions,
-  logServiceFactory,
-} from "../../../platform/background/service-factories/log-service.factory";
-import {
-  StateServiceInitOptions,
-  stateServiceFactory,
-} from "../../../platform/background/service-factories/state-service.factory";
-
-import { KdfConfigServiceInitOptions, kdfConfigServiceFactory } from "./kdf-config-service.factory";
-
-type PinCryptoServiceFactoryOptions = FactoryOptions;
-
-export type PinCryptoServiceInitOptions = PinCryptoServiceFactoryOptions &
-  StateServiceInitOptions &
-  CryptoServiceInitOptions &
-  VaultTimeoutSettingsServiceInitOptions &
-  LogServiceInitOptions &
-  KdfConfigServiceInitOptions;
-
-export function pinCryptoServiceFactory(
-  cache: { pinCryptoService?: PinCryptoServiceAbstraction } & CachedServices,
-  opts: PinCryptoServiceInitOptions,
-): Promise<PinCryptoServiceAbstraction> {
-  return factory(
-    cache,
-    "pinCryptoService",
-    opts,
-    async () =>
-      new PinCryptoService(
-        await stateServiceFactory(cache, opts),
-        await cryptoServiceFactory(cache, opts),
-        await vaultTimeoutSettingsServiceFactory(cache, opts),
-        await logServiceFactory(cache, opts),
-        await kdfConfigServiceFactory(cache, opts),
-      ),
-  );
-}

apps/browser/src/auth/background/service-factories/pin-service.factory.ts

@@ -0,0 +1,74 @@
+import { PinServiceAbstraction, PinService } from "@bitwarden/auth/common";
+
+import {
+  CryptoFunctionServiceInitOptions,
+  cryptoFunctionServiceFactory,
+} from "../../../platform/background/service-factories/crypto-function-service.factory";
+import {
+  EncryptServiceInitOptions,
+  encryptServiceFactory,
+} from "../../../platform/background/service-factories/encrypt-service.factory";
+import {
+  FactoryOptions,
+  CachedServices,
+  factory,
+} from "../../../platform/background/service-factories/factory-options";
+import {
+  KeyGenerationServiceInitOptions,
+  keyGenerationServiceFactory,
+} from "../../../platform/background/service-factories/key-generation-service.factory";
+import {
+  LogServiceInitOptions,
+  logServiceFactory,
+} from "../../../platform/background/service-factories/log-service.factory";
+import {
+  StateProviderInitOptions,
+  stateProviderFactory,
+} from "../../../platform/background/service-factories/state-provider.factory";
+import {
+  StateServiceInitOptions,
+  stateServiceFactory,
+} from "../../../platform/background/service-factories/state-service.factory";
+
+import { AccountServiceInitOptions, accountServiceFactory } from "./account-service.factory";
+import { KdfConfigServiceInitOptions, kdfConfigServiceFactory } from "./kdf-config-service.factory";
+import {
+  MasterPasswordServiceInitOptions,
+  masterPasswordServiceFactory,
+} from "./master-password-service.factory";
+
+type PinServiceFactoryOptions = FactoryOptions;
+
+export type PinServiceInitOptions = PinServiceFactoryOptions &
+  AccountServiceInitOptions &
+  CryptoFunctionServiceInitOptions &
+  EncryptServiceInitOptions &
+  KdfConfigServiceInitOptions &
+  KeyGenerationServiceInitOptions &
+  LogServiceInitOptions &
+  MasterPasswordServiceInitOptions &
+  StateProviderInitOptions &
+  StateServiceInitOptions;
+
+export function pinServiceFactory(
+  cache: { pinService?: PinServiceAbstraction } & CachedServices,
+  opts: PinServiceInitOptions,
+): Promise<PinServiceAbstraction> {
+  return factory(
+    cache,
+    "pinService",
+    opts,
+    async () =>
+      new PinService(
+        await accountServiceFactory(cache, opts),
+        await cryptoFunctionServiceFactory(cache, opts),
+        await encryptServiceFactory(cache, opts),
+        await kdfConfigServiceFactory(cache, opts),
+        await keyGenerationServiceFactory(cache, opts),
+        await logServiceFactory(cache, opts),
+        await masterPasswordServiceFactory(cache, opts),
+        await stateProviderFactory(cache, opts),
+        await stateServiceFactory(cache, opts),
+      ),
+  );
+}

apps/browser/src/auth/background/service-factories/user-verification-service.factory.ts

@@ -37,7 +37,7 @@ import {
   internalMasterPasswordServiceFactory,
   MasterPasswordServiceInitOptions,
 } from "./master-password-service.factory";
-import { PinCryptoServiceInitOptions, pinCryptoServiceFactory } from "./pin-crypto-service.factory";
+import { PinServiceInitOptions, pinServiceFactory } from "./pin-service.factory";
 import {
   userDecryptionOptionsServiceFactory,
   UserDecryptionOptionsServiceInitOptions,
@@ -57,7 +57,7 @@ export type UserVerificationServiceInitOptions = UserVerificationServiceFactoryO
   I18nServiceInitOptions &
   UserVerificationApiServiceInitOptions &
   UserDecryptionOptionsServiceInitOptions &
-  PinCryptoServiceInitOptions &
+  PinServiceInitOptions &
   LogServiceInitOptions &
   VaultTimeoutSettingsServiceInitOptions &
   PlatformUtilsServiceInitOptions &
@@ -80,7 +80,7 @@ export function userVerificationServiceFactory(
         await i18nServiceFactory(cache, opts),
         await userVerificationApiServiceFactory(cache, opts),
         await userDecryptionOptionsServiceFactory(cache, opts),
-        await pinCryptoServiceFactory(cache, opts),
+        await pinServiceFactory(cache, opts),
         await logServiceFactory(cache, opts),
         await vaultTimeoutSettingsServiceFactory(cache, opts),
         await platformUtilsServiceFactory(cache, opts),

apps/browser/src/auth/popup/components/set-pin.component.html

@@ -12,8 +12,16 @@
         <input class="tw-font-mono" bitInput type="password" formControlName="pin" />
         <button type="button" bitIconButton bitSuffix bitPasswordInputToggle></button>
       </bit-form-field>
-      <label class="tw-flex tw-items-start tw-gap-2" *ngIf="showMasterPassOnRestart">
-        <input class="tw-mt-1" type="checkbox" bitCheckbox formControlName="masterPassOnRestart" />
+      <label
+        class="tw-flex tw-items-start tw-gap-2"
+        *ngIf="showMasterPasswordOnClientRestartOption"
+      >
+        <input
+          class="tw-mt-1"
+          type="checkbox"
+          bitCheckbox
+          formControlName="requireMasterPasswordOnClientRestart"
+        />
         <span>{{ "lockWithMasterPassOnRestart" | i18n }}</span>
       </label>
     </div>

apps/browser/src/auth/popup/lock.component.ts

@@ -3,7 +3,7 @@ import { Router } from "@angular/router";
 import { firstValueFrom } from "rxjs";
 
 import { LockComponent as BaseLockComponent } from "@bitwarden/angular/auth/components/lock.component";
-import { PinCryptoServiceAbstraction } from "@bitwarden/auth/common";
+import { PinServiceAbstraction } from "@bitwarden/auth/common";
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { VaultTimeoutSettingsService } from "@bitwarden/common/abstractions/vault-timeout/vault-timeout-settings.service";
 import { VaultTimeoutService } from "@bitwarden/common/abstractions/vault-timeout/vault-timeout.service";
@@ -63,7 +63,7 @@ export class LockComponent extends BaseLockComponent {
     dialogService: DialogService,
     deviceTrustService: DeviceTrustServiceAbstraction,
     userVerificationService: UserVerificationService,
-    pinCryptoService: PinCryptoServiceAbstraction,
+    pinService: PinServiceAbstraction,
     private routerService: BrowserRouterService,
     biometricStateService: BiometricStateService,
     accountService: AccountService,
@@ -89,7 +89,7 @@ export class LockComponent extends BaseLockComponent {
       dialogService,
       deviceTrustService,
       userVerificationService,
-      pinCryptoService,
+      pinService,
       biometricStateService,
       accountService,
       authService,

apps/browser/src/auth/popup/settings/account-security.component.ts

@@ -16,6 +16,7 @@ import {
 } from "rxjs";
 
 import { FingerprintDialogComponent } from "@bitwarden/auth/angular";
+import { PinServiceAbstraction } from "@bitwarden/auth/common";
 import { VaultTimeoutSettingsService } from "@bitwarden/common/abstractions/vault-timeout/vault-timeout-settings.service";
 import { VaultTimeoutService } from "@bitwarden/common/abstractions/vault-timeout/vault-timeout.service";
 import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
@@ -71,6 +72,7 @@ export class AccountSecurityComponent implements OnInit {
 
   constructor(
     private accountService: AccountService,
+    private pinService: PinServiceAbstraction,
     private policyService: PolicyService,
     private formBuilder: FormBuilder,
     private platformUtilsService: PlatformUtilsService,
@@ -131,7 +133,6 @@ export class AccountSecurityComponent implements OnInit {
     if (timeout === -2 && !showOnLocked) {
       timeout = -1;
     }
-    const pinStatus = await this.vaultTimeoutSettingsService.isPinLockSet();
 
     this.form.controls.vaultTimeout.valueChanges
       .pipe(
@@ -153,12 +154,14 @@ export class AccountSecurityComponent implements OnInit {
       )
       .subscribe();
 
+    const userId = (await firstValueFrom(this.accountService.activeAccount$))?.id;
+
     const initialValues = {
       vaultTimeout: timeout,
       vaultTimeoutAction: await firstValueFrom(
         this.vaultTimeoutSettingsService.vaultTimeoutAction$(),
       ),
-      pin: pinStatus !== "DISABLED",
+      pin: await this.pinService.isPinSet(userId),
       biometric: await this.vaultTimeoutSettingsService.isBiometricLockSet(),
       enableAutoBiometricsPrompt: await firstValueFrom(
         this.biometricStateService.promptAutomatically$,

apps/browser/src/background/main.background.ts

@@ -1,8 +1,8 @@
 import { Subject, filter, firstValueFrom, map, merge, timeout } from "rxjs";
 
 import {
-  PinCryptoServiceAbstraction,
-  PinCryptoService,
+  PinServiceAbstraction,
+  PinService,
   InternalUserDecryptionOptionsServiceAbstraction,
   UserDecryptionOptionsService,
   AuthRequestServiceAbstraction,
@@ -318,7 +318,7 @@ export default class MainBackground {
   authRequestService: AuthRequestServiceAbstraction;
   accountService: AccountServiceAbstraction;
   globalStateProvider: GlobalStateProvider;
-  pinCryptoService: PinCryptoServiceAbstraction;
+  pinService: PinServiceAbstraction;
   singleUserStateProvider: SingleUserStateProvider;
   activeUserStateProvider: ActiveUserStateProvider;
   derivedStateProvider: DerivedStateProvider;
@@ -542,13 +542,31 @@ export default class MainBackground {
 
     const themeStateService = new DefaultThemeStateService(this.globalStateProvider);
 
-    this.masterPasswordService = new MasterPasswordService(this.stateProvider);
+    this.masterPasswordService = new MasterPasswordService(
+      this.stateProvider,
+      this.stateService,
+      this.keyGenerationService,
+      this.encryptService,
+    );
 
     this.i18nService = new I18nService(BrowserApi.getUILanguage(), this.globalStateProvider);
 
     this.kdfConfigService = new KdfConfigService(this.stateProvider);
 
+    this.pinService = new PinService(
+      this.accountService,
+      this.cryptoFunctionService,
+      this.encryptService,
+      this.kdfConfigService,
+      this.keyGenerationService,
+      this.logService,
+      this.masterPasswordService,
+      this.stateProvider,
+      this.stateService,
+    );
+
     this.cryptoService = new BrowserCryptoService(
+      this.pinService,
       this.masterPasswordService,
       this.keyGenerationService,
       this.cryptoFunctionService,
@@ -693,6 +711,8 @@ export default class MainBackground {
     this.folderApiService = new FolderApiService(this.folderService, this.apiService);
 
     this.vaultTimeoutSettingsService = new VaultTimeoutSettingsService(
+      this.accountService,
+      this.pinService,
       this.userDecryptionOptionsService,
       this.cryptoService,
       this.tokenService,
@@ -701,14 +721,6 @@ export default class MainBackground {
       this.biometricStateService,
     );
 
-    this.pinCryptoService = new PinCryptoService(
-      this.stateService,
-      this.cryptoService,
-      this.vaultTimeoutSettingsService,
-      this.logService,
-      this.kdfConfigService,
-    );
-
     this.userVerificationService = new UserVerificationService(
       this.stateService,
       this.cryptoService,
@@ -717,7 +729,7 @@ export default class MainBackground {
       this.i18nService,
       this.userVerificationApiService,
       this.userDecryptionOptionsService,
-      this.pinCryptoService,
+      this.pinService,
       this.logService,
       this.vaultTimeoutSettingsService,
       this.platformUtilsService,
@@ -839,11 +851,13 @@ export default class MainBackground {
       this.i18nService,
       this.collectionService,
       this.cryptoService,
+      this.pinService,
     );
 
     this.individualVaultExportService = new IndividualVaultExportService(
       this.folderService,
       this.cipherService,
+      this.pinService,
       this.cryptoService,
       this.cryptoFunctionService,
       this.kdfConfigService,
@@ -852,6 +866,7 @@ export default class MainBackground {
     this.organizationVaultExportService = new OrganizationVaultExportService(
       this.cipherService,
       this.apiService,
+      this.pinService,
       this.cryptoService,
       this.cryptoFunctionService,
       this.collectionService,
@@ -902,6 +917,7 @@ export default class MainBackground {
     };
 
     this.systemService = new SystemService(
+      this.pinService,
       this.messagingService,
       this.platformUtilsService,
       systemUtilsServiceReloadCallback,

apps/browser/src/background/nativeMessaging.background.ts

@@ -356,7 +356,7 @@ export class NativeMessagingBackground {
               const masterKey = new SymmetricCryptoKey(
                 Utils.fromB64ToArray(message.keyB64),
               ) as MasterKey;
-              const userKey = await this.cryptoService.decryptUserKeyWithMasterKey(
+              const userKey = await this.masterPasswordService.decryptUserKeyWithMasterKey(
                 masterKey,
                 encUserKey,
               );

apps/browser/src/background/service-factories/vault-timeout-settings-service.factory.ts

@@ -5,6 +5,14 @@ import {
   policyServiceFactory,
   PolicyServiceInitOptions,
 } from "../../admin-console/background/service-factories/policy-service.factory";
+import {
+  accountServiceFactory,
+  AccountServiceInitOptions,
+} from "../../auth/background/service-factories/account-service.factory";
+import {
+  pinServiceFactory,
+  PinServiceInitOptions,
+} from "../../auth/background/service-factories/pin-service.factory";
 import {
   tokenServiceFactory,
   TokenServiceInitOptions,
@@ -34,6 +42,8 @@ import {
 type VaultTimeoutSettingsServiceFactoryOptions = FactoryOptions;
 
 export type VaultTimeoutSettingsServiceInitOptions = VaultTimeoutSettingsServiceFactoryOptions &
+  AccountServiceInitOptions &
+  PinServiceInitOptions &
   UserDecryptionOptionsServiceInitOptions &
   CryptoServiceInitOptions &
   TokenServiceInitOptions &
@@ -51,6 +61,8 @@ export function vaultTimeoutSettingsServiceFactory(
     opts,
     async () =>
       new VaultTimeoutSettingsService(
+        await accountServiceFactory(cache, opts),
+        await pinServiceFactory(cache, opts),
         await userDecryptionOptionsServiceFactory(cache, opts),
         await cryptoServiceFactory(cache, opts),
         await tokenServiceFactory(cache, opts),

apps/browser/src/platform/background/service-factories/crypto-service.factory.ts

@@ -12,6 +12,10 @@ import {
   internalMasterPasswordServiceFactory,
   MasterPasswordServiceInitOptions,
 } from "../../../auth/background/service-factories/master-password-service.factory";
+import {
+  PinServiceInitOptions,
+  pinServiceFactory,
+} from "../../../auth/background/service-factories/pin-service.factory";
 import {
   StateServiceInitOptions,
   stateServiceFactory,
@@ -45,6 +49,7 @@ import { StateProviderInitOptions, stateProviderFactory } from "./state-provider
 type CryptoServiceFactoryOptions = FactoryOptions;
 
 export type CryptoServiceInitOptions = CryptoServiceFactoryOptions &
+  PinServiceInitOptions &
   MasterPasswordServiceInitOptions &
   KeyGenerationServiceInitOptions &
   CryptoFunctionServiceInitOptions &
@@ -67,6 +72,7 @@ export function cryptoServiceFactory(
     opts,
     async () =>
       new BrowserCryptoService(
+        await pinServiceFactory(cache, opts),
         await internalMasterPasswordServiceFactory(cache, opts),
         await keyGenerationServiceFactory(cache, opts),
         await cryptoFunctionServiceFactory(cache, opts),

apps/browser/src/platform/services/browser-crypto.service.ts

@@ -1,5 +1,6 @@
 import { firstValueFrom } from "rxjs";
 
+import { PinServiceAbstraction } from "@bitwarden/auth/common";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
 import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/auth/abstractions/master-password.service.abstraction";
@@ -19,6 +20,7 @@ import { UserKey } from "@bitwarden/common/types/key";
 
 export class BrowserCryptoService extends CryptoService {
   constructor(
+    pinService: PinServiceAbstraction,
     masterPasswordService: InternalMasterPasswordServiceAbstraction,
     keyGenerationService: KeyGenerationService,
     cryptoFunctionService: CryptoFunctionService,
@@ -32,6 +34,7 @@ export class BrowserCryptoService extends CryptoService {
     kdfConfigService: KdfConfigService,
   ) {
     super(
+      pinService,
       masterPasswordService,
       keyGenerationService,
       cryptoFunctionService,

apps/browser/src/popup/services/services.module.ts

@@ -16,7 +16,7 @@ import {
   CLIENT_TYPE,
 } from "@bitwarden/angular/services/injection-tokens";
 import { JslibServicesModule } from "@bitwarden/angular/services/jslib-services.module";
-import { AuthRequestServiceAbstraction } from "@bitwarden/auth/common";
+import { AuthRequestServiceAbstraction, PinServiceAbstraction } from "@bitwarden/auth/common";
 import { EventCollectionService as EventCollectionServiceAbstraction } from "@bitwarden/common/abstractions/event/event-collection.service";
 import { NotificationsService } from "@bitwarden/common/abstractions/notifications.service";
 import { VaultTimeoutSettingsService } from "@bitwarden/common/abstractions/vault-timeout/vault-timeout-settings.service";
@@ -209,6 +209,7 @@ const safeProviders: SafeProvider[] = [
   safeProvider({
     provide: CryptoService,
     useFactory: (
+      pinService: PinServiceAbstraction,
       masterPasswordService: InternalMasterPasswordServiceAbstraction,
       keyGenerationService: KeyGenerationService,
       cryptoFunctionService: CryptoFunctionService,
@@ -222,6 +223,7 @@ const safeProviders: SafeProvider[] = [
       kdfConfigService: KdfConfigService,
     ) => {
       const cryptoService = new BrowserCryptoService(
+        pinService,
         masterPasswordService,
         keyGenerationService,
         cryptoFunctionService,
@@ -238,6 +240,7 @@ const safeProviders: SafeProvider[] = [
       return cryptoService;
     },
     deps: [
+      PinServiceAbstraction,
       InternalMasterPasswordServiceAbstraction,
       KeyGenerationService,
       CryptoFunctionService,

apps/browser/src/tools/background/service_factories/import-service.factory.ts

@@ -1,5 +1,9 @@
 import { ImportService, ImportServiceAbstraction } from "@bitwarden/importer/core";
 
+import {
+  pinServiceFactory,
+  PinServiceInitOptions,
+} from "../../../auth/background/service-factories/pin-service.factory";
 import {
   cryptoServiceFactory,
   CryptoServiceInitOptions,
@@ -36,7 +40,8 @@ export type ImportServiceInitOptions = ImportServiceFactoryOptions &
   ImportApiServiceInitOptions &
   I18nServiceInitOptions &
   CollectionServiceInitOptions &
-  CryptoServiceInitOptions;
+  CryptoServiceInitOptions &
+  PinServiceInitOptions;
 
 export function importServiceFactory(
   cache: {
@@ -56,6 +61,7 @@ export function importServiceFactory(
         await i18nServiceFactory(cache, opts),
         await collectionServiceFactory(cache, opts),
         await cryptoServiceFactory(cache, opts),
+        await pinServiceFactory(cache, opts),
       ),
   );
 }