[Tech debt] Refactor authService and remove LogInHelper (#588)

* Use different strategy classes for different types of login
* General refactor and cleanup of auth logic
* Create subclasses for different types of login credentials
* Create subclasses for different types of tokenRequests
* Create TwoFactorService, move code out of authService
* refactor base CLI commands to use new interface

common/src/abstractions/api.service.ts

@@ -75,7 +75,6 @@ import { SendRequest } from "../models/request/sendRequest";
 import { SetPasswordRequest } from "../models/request/setPasswordRequest";
 import { StorageRequest } from "../models/request/storageRequest";
 import { TaxInfoUpdateRequest } from "../models/request/taxInfoUpdateRequest";
-import { TokenRequest } from "../models/request/tokenRequest";
 import { TwoFactorEmailRequest } from "../models/request/twoFactorEmailRequest";
 import { TwoFactorProviderRequest } from "../models/request/twoFactorProviderRequest";
 import { TwoFactorRecoveryRequest } from "../models/request/twoFactorRecoveryRequest";
@@ -93,6 +92,10 @@ import { VerifyBankRequest } from "../models/request/verifyBankRequest";
 import { VerifyDeleteRecoverRequest } from "../models/request/verifyDeleteRecoverRequest";
 import { VerifyEmailRequest } from "../models/request/verifyEmailRequest";
 
+import { ApiTokenRequest } from "../models/request/identityToken/apiTokenRequest";
+import { PasswordTokenRequest } from "../models/request/identityToken/passwordTokenRequest";
+import { SsoTokenRequest } from "../models/request/identityToken/ssoTokenRequest";
+
 import { ApiKeyResponse } from "../models/response/apiKeyResponse";
 import { AttachmentResponse } from "../models/response/attachmentResponse";
 import { AttachmentUploadDataResponse } from "../models/response/attachmentUploadDataResponse";
@@ -171,7 +174,7 @@ import { SendAccessView } from "../models/view/sendAccessView";
 
 export abstract class ApiService {
   postIdentityToken: (
-    request: TokenRequest
+    request: PasswordTokenRequest | SsoTokenRequest | ApiTokenRequest
   ) => Promise<IdentityTokenResponse | IdentityTwoFactorResponse | IdentityCaptchaResponse>;
   refreshIdentityToken: () => Promise<any>;
 

common/src/abstractions/auth.service.ts

@@ -1,58 +1,21 @@
-import { TwoFactorProviderType } from "../enums/twoFactorProviderType";
-
 import { AuthResult } from "../models/domain/authResult";
+import {
+  ApiLogInCredentials,
+  PasswordLogInCredentials,
+  SsoLogInCredentials,
+} from "../models/domain/logInCredentials";
 import { SymmetricCryptoKey } from "../models/domain/symmetricCryptoKey";
 
-export abstract class AuthService {
-  email: string;
-  masterPasswordHash: string;
-  code: string;
-  codeVerifier: string;
-  ssoRedirectUrl: string;
-  clientId: string;
-  clientSecret: string;
-  twoFactorProvidersData: Map<TwoFactorProviderType, { [key: string]: string }>;
-  selectedTwoFactorProviderType: TwoFactorProviderType;
+import { TokenRequestTwoFactor } from "../models/request/identityToken/tokenRequest";
 
-  logIn: (email: string, masterPassword: string, captchaToken?: string) => Promise<AuthResult>;
-  logInSso: (
-    code: string,
-    codeVerifier: string,
-    redirectUrl: string,
-    orgId: string
-  ) => Promise<AuthResult>;
-  logInApiKey: (clientId: string, clientSecret: string) => Promise<AuthResult>;
-  logInTwoFactor: (
-    twoFactorProvider: TwoFactorProviderType,
-    twoFactorToken: string,
-    remember?: boolean
-  ) => Promise<AuthResult>;
-  logInComplete: (
-    email: string,
-    masterPassword: string,
-    twoFactorProvider: TwoFactorProviderType,
-    twoFactorToken: string,
-    remember?: boolean,
-    captchaToken?: string
-  ) => Promise<AuthResult>;
-  logInSsoComplete: (
-    code: string,
-    codeVerifier: string,
-    redirectUrl: string,
-    twoFactorProvider: TwoFactorProviderType,
-    twoFactorToken: string,
-    remember?: boolean
-  ) => Promise<AuthResult>;
-  logInApiKeyComplete: (
-    clientId: string,
-    clientSecret: string,
-    twoFactorProvider: TwoFactorProviderType,
-    twoFactorToken: string,
-    remember?: boolean
+export abstract class AuthService {
+  masterPasswordHash: string;
+  email: string;
+  logIn: (
+    credentials: ApiLogInCredentials | PasswordLogInCredentials | SsoLogInCredentials
   ) => Promise<AuthResult>;
+  logInTwoFactor: (twoFactor: TokenRequestTwoFactor) => Promise<AuthResult>;
   logOut: (callback: Function) => void;
-  getSupportedTwoFactorProviders: (win: Window) => any[];
-  getDefaultTwoFactorProvider: (webAuthnSupported: boolean) => TwoFactorProviderType;
   makePreloginKey: (masterPassword: string, email: string) => Promise<SymmetricCryptoKey>;
   authingWithApiKey: () => boolean;
   authingWithSso: () => boolean;

common/src/abstractions/keyConnector.service.ts

@@ -1,11 +1,17 @@
 import { Organization } from "../models/domain/organization";
 
+import { IdentityTokenResponse } from "../models/response/identityTokenResponse";
+
 export abstract class KeyConnectorService {
   getAndSetKey: (url?: string) => Promise<void>;
   getManagingOrganization: () => Promise<Organization>;
   getUsesKeyConnector: () => Promise<boolean>;
   migrateUser: () => Promise<void>;
   userNeedsMigration: () => Promise<boolean>;
+  convertNewSsoUserToKeyConnector: (
+    tokenResponse: IdentityTokenResponse,
+    orgId: string
+  ) => Promise<void>;
   setUsesKeyConnector: (enabled: boolean) => Promise<void>;
   setConvertAccountRequired: (status: boolean) => Promise<void>;
   getConvertAccountRequired: () => Promise<boolean>;

common/src/abstractions/token.service.ts

@@ -1,3 +1,5 @@
+import { IdentityTokenResponse } from "../models/response/identityTokenResponse";
+
 export abstract class TokenService {
   setTokens: (
     accessToken: string,
@@ -13,9 +15,9 @@ export abstract class TokenService {
   setClientSecret: (clientSecret: string) => Promise<any>;
   getClientSecret: () => Promise<string>;
   toggleTokens: () => Promise<any>;
-  setTwoFactorToken: (token: string, email: string) => Promise<any>;
-  getTwoFactorToken: (email: string) => Promise<string>;
-  clearTwoFactorToken: (email: string) => Promise<any>;
+  setTwoFactorToken: (tokenResponse: IdentityTokenResponse) => Promise<any>;
+  getTwoFactorToken: () => Promise<string>;
+  clearTwoFactorToken: () => Promise<any>;
   clearToken: (userId?: string) => Promise<any>;
   decodeToken: (token?: string) => any;
   getTokenExpirationDate: () => Promise<Date>;

common/src/abstractions/twoFactor.service.ts

@@ -0,0 +1,24 @@
+import { TwoFactorProviderType } from "../enums/twoFactorProviderType";
+
+import { IdentityTwoFactorResponse } from "../models/response/identityTwoFactorResponse";
+
+export interface TwoFactorProviderDetails {
+  type: TwoFactorProviderType;
+  name: string;
+  description: string;
+  priority: number;
+  sort: number;
+  premium: boolean;
+}
+
+export abstract class TwoFactorService {
+  init: () => void;
+  getSupportedProviders: (win: Window) => TwoFactorProviderDetails[];
+  getDefaultProvider: (webAuthnSupported: boolean) => TwoFactorProviderType;
+  setSelectedProvider: (type: TwoFactorProviderType) => void;
+  clearSelectedProvider: () => void;
+
+  setProviders: (response: IdentityTwoFactorResponse) => void;
+  clearProviders: () => void;
+  getProviders: () => Map<TwoFactorProviderType, { [key: string]: string }>;
+}

common/src/misc/logInStrategies/apiLogin.strategy.ts

@@ -0,0 +1,73 @@
+import { LogInStrategy } from "./logIn.strategy";
+
+import { ApiService } from "../../abstractions/api.service";
+import { AppIdService } from "../../abstractions/appId.service";
+import { CryptoService } from "../../abstractions/crypto.service";
+import { EnvironmentService } from "../../abstractions/environment.service";
+import { KeyConnectorService } from "../../abstractions/keyConnector.service";
+import { LogService } from "../../abstractions/log.service";
+import { MessagingService } from "../../abstractions/messaging.service";
+import { PlatformUtilsService } from "../../abstractions/platformUtils.service";
+import { StateService } from "../../abstractions/state.service";
+import { TokenService } from "../../abstractions/token.service";
+import { TwoFactorService } from "../../abstractions/twoFactor.service";
+
+import { ApiTokenRequest } from "../../models/request/identityToken/apiTokenRequest";
+
+import { IdentityTokenResponse } from "../../models/response/identityTokenResponse";
+
+import { ApiLogInCredentials } from "../../models/domain/logInCredentials";
+
+export class ApiLogInStrategy extends LogInStrategy {
+  tokenRequest: ApiTokenRequest;
+
+  constructor(
+    cryptoService: CryptoService,
+    apiService: ApiService,
+    tokenService: TokenService,
+    appIdService: AppIdService,
+    platformUtilsService: PlatformUtilsService,
+    messagingService: MessagingService,
+    logService: LogService,
+    stateService: StateService,
+    twoFactorService: TwoFactorService,
+    private environmentService: EnvironmentService,
+    private keyConnectorService: KeyConnectorService
+  ) {
+    super(
+      cryptoService,
+      apiService,
+      tokenService,
+      appIdService,
+      platformUtilsService,
+      messagingService,
+      logService,
+      stateService,
+      twoFactorService
+    );
+  }
+
+  async onSuccessfulLogin(tokenResponse: IdentityTokenResponse) {
+    if (tokenResponse.apiUseKeyConnector) {
+      const keyConnectorUrl = this.environmentService.getKeyConnectorUrl();
+      await this.keyConnectorService.getAndSetKey(keyConnectorUrl);
+    }
+  }
+
+  async logIn(credentials: ApiLogInCredentials) {
+    this.tokenRequest = new ApiTokenRequest(
+      credentials.clientId,
+      credentials.clientSecret,
+      await this.buildTwoFactor(),
+      await this.buildDeviceRequest()
+    );
+
+    return this.startLogIn();
+  }
+
+  protected async saveAccountInformation(tokenResponse: IdentityTokenResponse) {
+    await super.saveAccountInformation(tokenResponse);
+    await this.stateService.setApiKeyClientId(this.tokenRequest.clientId);
+    await this.stateService.setApiKeyClientSecret(this.tokenRequest.clientSecret);
+  }
+}

common/src/misc/logInStrategies/logIn.strategy.ts

@@ -0,0 +1,177 @@
+import { TwoFactorProviderType } from "../../enums/twoFactorProviderType";
+
+import { Account, AccountProfile, AccountTokens } from "../../models/domain/account";
+import { AuthResult } from "../../models/domain/authResult";
+import {
+  ApiLogInCredentials,
+  PasswordLogInCredentials,
+  SsoLogInCredentials,
+} from "../../models/domain/logInCredentials";
+
+import { DeviceRequest } from "../../models/request/deviceRequest";
+import { ApiTokenRequest } from "../../models/request/identityToken/apiTokenRequest";
+import { PasswordTokenRequest } from "../../models/request/identityToken/passwordTokenRequest";
+import { SsoTokenRequest } from "../../models/request/identityToken/ssoTokenRequest";
+import { TokenRequestTwoFactor } from "../../models/request/identityToken/tokenRequest";
+import { KeysRequest } from "../../models/request/keysRequest";
+
+import { IdentityCaptchaResponse } from "../../models/response/identityCaptchaResponse";
+import { IdentityTokenResponse } from "../../models/response/identityTokenResponse";
+import { IdentityTwoFactorResponse } from "../../models/response/identityTwoFactorResponse";
+
+import { ApiService } from "../../abstractions/api.service";
+import { AppIdService } from "../../abstractions/appId.service";
+import { CryptoService } from "../../abstractions/crypto.service";
+import { LogService } from "../../abstractions/log.service";
+import { MessagingService } from "../../abstractions/messaging.service";
+import { PlatformUtilsService } from "../../abstractions/platformUtils.service";
+import { StateService } from "../../abstractions/state.service";
+import { TokenService } from "../../abstractions/token.service";
+import { TwoFactorService } from "../../abstractions/twoFactor.service";
+
+export abstract class LogInStrategy {
+  protected abstract tokenRequest: ApiTokenRequest | PasswordTokenRequest | SsoTokenRequest;
+
+  constructor(
+    protected cryptoService: CryptoService,
+    protected apiService: ApiService,
+    protected tokenService: TokenService,
+    protected appIdService: AppIdService,
+    protected platformUtilsService: PlatformUtilsService,
+    protected messagingService: MessagingService,
+    protected logService: LogService,
+    protected stateService: StateService,
+    protected twoFactorService: TwoFactorService
+  ) {}
+
+  abstract logIn(
+    credentials: ApiLogInCredentials | PasswordLogInCredentials | SsoLogInCredentials
+  ): Promise<AuthResult>;
+
+  async logInTwoFactor(twoFactor: TokenRequestTwoFactor): Promise<AuthResult> {
+    this.tokenRequest.setTwoFactor(twoFactor);
+    return this.startLogIn();
+  }
+
+  protected async startLogIn(): Promise<AuthResult> {
+    this.twoFactorService.clearSelectedProvider();
+
+    const response = await this.apiService.postIdentityToken(this.tokenRequest);
+
+    if (response instanceof IdentityTwoFactorResponse) {
+      return this.processTwoFactorResponse(response);
+    } else if (response instanceof IdentityCaptchaResponse) {
+      return this.processCaptchaResponse(response);
+    } else if (response instanceof IdentityTokenResponse) {
+      return this.processTokenResponse(response);
+    }
+
+    throw new Error("Invalid response object.");
+  }
+
+  protected onSuccessfulLogin(response: IdentityTokenResponse): Promise<void> {
+    // Implemented in subclass if required
+    return null;
+  }
+
+  protected async buildDeviceRequest() {
+    const appId = await this.appIdService.getAppId();
+    return new DeviceRequest(appId, this.platformUtilsService);
+  }
+
+  protected async buildTwoFactor(userProvidedTwoFactor?: TokenRequestTwoFactor) {
+    if (userProvidedTwoFactor != null) {
+      return userProvidedTwoFactor;
+    }
+
+    const storedTwoFactorToken = await this.tokenService.getTwoFactorToken();
+    if (storedTwoFactorToken != null) {
+      return {
+        token: storedTwoFactorToken,
+        provider: TwoFactorProviderType.Remember,
+        remember: false,
+      };
+    }
+
+    return {
+      token: null,
+      provider: null,
+      remember: false,
+    };
+  }
+
+  protected async saveAccountInformation(tokenResponse: IdentityTokenResponse) {
+    const accountInformation = await this.tokenService.decodeToken(tokenResponse.accessToken);
+    await this.stateService.addAccount(
+      new Account({
+        profile: {
+          ...new AccountProfile(),
+          ...{
+            userId: accountInformation.sub,
+            email: accountInformation.email,
+            hasPremiumPersonally: accountInformation.premium,
+            kdfIterations: tokenResponse.kdfIterations,
+            kdfType: tokenResponse.kdf,
+          },
+        },
+        tokens: {
+          ...new AccountTokens(),
+          ...{
+            accessToken: tokenResponse.accessToken,
+            refreshToken: tokenResponse.refreshToken,
+          },
+        },
+      })
+    );
+  }
+
+  protected async processTokenResponse(response: IdentityTokenResponse): Promise<AuthResult> {
+    const result = new AuthResult();
+    result.resetMasterPassword = response.resetMasterPassword;
+    result.forcePasswordReset = response.forcePasswordReset;
+
+    await this.saveAccountInformation(response);
+
+    if (response.twoFactorToken != null) {
+      await this.tokenService.setTwoFactorToken(response);
+    }
+
+    const newSsoUser = response.key == null;
+    if (!newSsoUser) {
+      await this.cryptoService.setEncKey(response.key);
+      await this.cryptoService.setEncPrivateKey(
+        response.privateKey ?? (await this.createKeyPairForOldAccount())
+      );
+    }
+
+    await this.onSuccessfulLogin(response);
+
+    await this.stateService.setBiometricLocked(false);
+    this.messagingService.send("loggedIn");
+
+    return result;
+  }
+
+  private async processTwoFactorResponse(response: IdentityTwoFactorResponse): Promise<AuthResult> {
+    const result = new AuthResult();
+    result.twoFactorProviders = response.twoFactorProviders2;
+    this.twoFactorService.setProviders(response);
+    return result;
+  }
+
+  private async processCaptchaResponse(response: IdentityCaptchaResponse): Promise<AuthResult> {
+    const result = new AuthResult();
+    result.captchaSiteKey = response.siteKey;
+    return result;
+  }
+
+  private async createKeyPairForOldAccount() {
+    try {
+      const [publicKey, privateKey] = await this.cryptoService.makeKeyPair();
+      await this.apiService.postAccountKeys(new KeysRequest(publicKey, privateKey.encryptedString));
+      return privateKey.encryptedString;
+    } catch (e) {
+      this.logService.error(e);
+    }
+  }
+}

common/src/misc/logInStrategies/passwordLogin.strategy.ts

@@ -0,0 +1,88 @@
+import { LogInStrategy } from "./logIn.strategy";
+
+import { PasswordTokenRequest } from "../../models/request/identityToken/passwordTokenRequest";
+
+import { ApiService } from "../../abstractions/api.service";
+import { AppIdService } from "../../abstractions/appId.service";
+import { AuthService } from "../../abstractions/auth.service";
+import { CryptoService } from "../../abstractions/crypto.service";
+import { LogService } from "../../abstractions/log.service";
+import { MessagingService } from "../../abstractions/messaging.service";
+import { PlatformUtilsService } from "../../abstractions/platformUtils.service";
+import { StateService } from "../../abstractions/state.service";
+import { TokenService } from "../../abstractions/token.service";
+import { TwoFactorService } from "../../abstractions/twoFactor.service";
+
+import { PasswordLogInCredentials } from "../../models/domain/logInCredentials";
+import { SymmetricCryptoKey } from "../../models/domain/symmetricCryptoKey";
+
+import { HashPurpose } from "../../enums/hashPurpose";
+
+export class PasswordLogInStrategy extends LogInStrategy {
+  get email() {
+    return this.tokenRequest.email;
+  }
+
+  get masterPasswordHash() {
+    return this.tokenRequest.masterPasswordHash;
+  }
+
+  tokenRequest: PasswordTokenRequest;
+
+  private localHashedPassword: string;
+  private key: SymmetricCryptoKey;
+
+  constructor(
+    cryptoService: CryptoService,
+    apiService: ApiService,
+    tokenService: TokenService,
+    appIdService: AppIdService,
+    platformUtilsService: PlatformUtilsService,
+    messagingService: MessagingService,
+    logService: LogService,
+    stateService: StateService,
+    twoFactorService: TwoFactorService,
+    private authService: AuthService
+  ) {
+    super(
+      cryptoService,
+      apiService,
+      tokenService,
+      appIdService,
+      platformUtilsService,
+      messagingService,
+      logService,
+      stateService,
+      twoFactorService
+    );
+  }
+
+  async onSuccessfulLogin() {
+    await this.cryptoService.setKey(this.key);
+    await this.cryptoService.setKeyHash(this.localHashedPassword);
+  }
+
+  async logIn(credentials: PasswordLogInCredentials) {
+    const { email, masterPassword, captchaToken, twoFactor } = credentials;
+
+    this.key = await this.authService.makePreloginKey(masterPassword, email);
+
+    // Hash the password early (before authentication) so we don't persist it in memory in plaintext
+    this.localHashedPassword = await this.cryptoService.hashPassword(
+      masterPassword,
+      this.key,
+      HashPurpose.LocalAuthorization
+    );
+    const hashedPassword = await this.cryptoService.hashPassword(masterPassword, this.key);
+
+    this.tokenRequest = new PasswordTokenRequest(
+      email,
+      hashedPassword,
+      captchaToken,
+      await this.buildTwoFactor(twoFactor),
+      await this.buildDeviceRequest()
+    );
+
+    return this.startLogIn();
+  }
+}

common/src/misc/logInStrategies/ssoLogin.strategy.ts

@@ -0,0 +1,73 @@
+import { LogInStrategy } from "./logIn.strategy";
+
+import { ApiService } from "../../abstractions/api.service";
+import { AppIdService } from "../../abstractions/appId.service";
+import { CryptoService } from "../../abstractions/crypto.service";
+import { KeyConnectorService } from "../../abstractions/keyConnector.service";
+import { LogService } from "../../abstractions/log.service";
+import { MessagingService } from "../../abstractions/messaging.service";
+import { PlatformUtilsService } from "../../abstractions/platformUtils.service";
+import { StateService } from "../../abstractions/state.service";
+import { TokenService } from "../../abstractions/token.service";
+import { TwoFactorService } from "../../abstractions/twoFactor.service";
+
+import { SsoLogInCredentials } from "../../models/domain/logInCredentials";
+
+import { SsoTokenRequest } from "../../models/request/identityToken/ssoTokenRequest";
+
+import { IdentityTokenResponse } from "../../models/response/identityTokenResponse";
+
+export class SsoLogInStrategy extends LogInStrategy {
+  tokenRequest: SsoTokenRequest;
+  orgId: string;
+
+  constructor(
+    cryptoService: CryptoService,
+    apiService: ApiService,
+    tokenService: TokenService,
+    appIdService: AppIdService,
+    platformUtilsService: PlatformUtilsService,
+    messagingService: MessagingService,
+    logService: LogService,
+    stateService: StateService,
+    twoFactorService: TwoFactorService,
+    private keyConnectorService: KeyConnectorService
+  ) {
+    super(
+      cryptoService,
+      apiService,
+      tokenService,
+      appIdService,
+      platformUtilsService,
+      messagingService,
+      logService,
+      stateService,
+      twoFactorService
+    );
+  }
+
+  async onSuccessfulLogin(tokenResponse: IdentityTokenResponse) {
+    const newSsoUser = tokenResponse.key == null;
+
+    if (tokenResponse.keyConnectorUrl != null) {
+      if (!newSsoUser) {
+        await this.keyConnectorService.getAndSetKey(tokenResponse.keyConnectorUrl);
+      } else {
+        await this.keyConnectorService.convertNewSsoUserToKeyConnector(tokenResponse, this.orgId);
+      }
+    }
+  }
+
+  async logIn(credentials: SsoLogInCredentials) {
+    this.orgId = credentials.orgId;
+    this.tokenRequest = new SsoTokenRequest(
+      credentials.code,
+      credentials.codeVerifier,
+      credentials.redirectUrl,
+      await this.buildTwoFactor(credentials.twoFactor),
+      await this.buildDeviceRequest()
+    );
+
+    return this.startLogIn();
+  }
+}

common/src/models/domain/authResult.ts

@@ -1,9 +1,18 @@
 import { TwoFactorProviderType } from "../../enums/twoFactorProviderType";
 
+import { Utils } from "../../misc/utils";
+
 export class AuthResult {
-  twoFactor: boolean = false;
   captchaSiteKey: string = "";
   resetMasterPassword: boolean = false;
   forcePasswordReset: boolean = false;
   twoFactorProviders: Map<TwoFactorProviderType, { [key: string]: string }> = null;
+
+  get requiresCaptcha() {
+    return !Utils.isNullOrWhitespace(this.captchaSiteKey);
+  }
+
+  get requiresTwoFactor() {
+    return this.twoFactorProviders != null;
+  }
 }

common/src/models/domain/logInCredentials.ts

@@ -0,0 +1,24 @@
+import { TokenRequestTwoFactor } from "../request/identityToken/tokenRequest";
+
+export class PasswordLogInCredentials {
+  constructor(
+    public email: string,
+    public masterPassword: string,
+    public captchaToken?: string,
+    public twoFactor?: TokenRequestTwoFactor
+  ) {}
+}
+
+export class SsoLogInCredentials {
+  constructor(
+    public code: string,
+    public codeVerifier: string,
+    public redirectUrl: string,
+    public orgId: string,
+    public twoFactor?: TokenRequestTwoFactor
+  ) {}
+}
+
+export class ApiLogInCredentials {
+  constructor(public clientId: string, public clientSecret: string) {}
+}

common/src/models/request/identityToken/apiTokenRequest.ts

@@ -0,0 +1,24 @@
+import { TokenRequest, TokenRequestTwoFactor } from "./tokenRequest";
+
+import { DeviceRequest } from "../deviceRequest";
+
+export class ApiTokenRequest extends TokenRequest {
+  constructor(
+    public clientId: string,
+    public clientSecret: string,
+    protected twoFactor: TokenRequestTwoFactor,
+    device?: DeviceRequest
+  ) {
+    super(twoFactor, device);
+  }
+
+  toIdentityToken() {
+    const obj = super.toIdentityToken(this.clientId);
+
+    obj.scope = this.clientId.startsWith("organization") ? "api.organization" : "api";
+    obj.grant_type = "client_credentials";
+    obj.client_secret = this.clientSecret;
+
+    return obj;
+  }
+}

common/src/models/request/identityToken/passwordTokenRequest.ts

@@ -0,0 +1,36 @@
+import { TokenRequest, TokenRequestTwoFactor } from "./tokenRequest";
+
+import { CaptchaProtectedRequest } from "../captchaProtectedRequest";
+import { DeviceRequest } from "../deviceRequest";
+
+import { Utils } from "../../../misc/utils";
+
+export class PasswordTokenRequest extends TokenRequest implements CaptchaProtectedRequest {
+  constructor(
+    public email: string,
+    public masterPasswordHash: string,
+    public captchaResponse: string,
+    protected twoFactor: TokenRequestTwoFactor,
+    device?: DeviceRequest
+  ) {
+    super(twoFactor, device);
+  }
+
+  toIdentityToken(clientId: string) {
+    const obj = super.toIdentityToken(clientId);
+
+    obj.grant_type = "password";
+    obj.username = this.email;
+    obj.password = this.masterPasswordHash;
+
+    if (this.captchaResponse != null) {
+      obj.captchaResponse = this.captchaResponse;
+    }
+
+    return obj;
+  }
+
+  alterIdentityTokenHeaders(headers: Headers) {
+    headers.set("Auth-Email", Utils.fromUtf8ToUrlB64(this.email));
+  }
+}

common/src/models/request/identityToken/ssoTokenRequest.ts

@@ -0,0 +1,26 @@
+import { TokenRequest, TokenRequestTwoFactor } from "./tokenRequest";
+
+import { DeviceRequest } from "../deviceRequest";
+
+export class SsoTokenRequest extends TokenRequest {
+  constructor(
+    public code: string,
+    public codeVerifier: string,
+    public redirectUri: string,
+    protected twoFactor: TokenRequestTwoFactor,
+    device?: DeviceRequest
+  ) {
+    super(twoFactor, device);
+  }
+
+  toIdentityToken(clientId: string) {
+    const obj = super.toIdentityToken(clientId);
+
+    obj.grant_type = "authorization_code";
+    obj.code = this.code;
+    obj.code_verifier = this.codeVerifier;
+    obj.redirect_uri = this.redirectUri;
+
+    return obj;
+  }
+}

common/src/models/request/identityToken/tokenRequest.ts

@@ -0,0 +1,48 @@
+import { TwoFactorProviderType } from "../../../enums/twoFactorProviderType";
+
+import { DeviceRequest } from "../deviceRequest";
+
+export interface TokenRequestTwoFactor {
+  provider: TwoFactorProviderType;
+  token: string;
+  remember: boolean;
+}
+
+export abstract class TokenRequest {
+  protected device?: DeviceRequest;
+
+  constructor(protected twoFactor: TokenRequestTwoFactor, device?: DeviceRequest) {
+    this.device = device != null ? device : null;
+  }
+
+  alterIdentityTokenHeaders(headers: Headers) {
+    // Implemented in subclass if required
+  }
+
+  setTwoFactor(twoFactor: TokenRequestTwoFactor) {
+    this.twoFactor = twoFactor;
+  }
+
+  protected toIdentityToken(clientId: string) {
+    const obj: any = {
+      scope: "api offline_access",
+      client_id: clientId,
+    };
+
+    if (this.device) {
+      obj.deviceType = this.device.type;
+      obj.deviceIdentifier = this.device.identifier;
+      obj.deviceName = this.device.name;
+      // no push tokens for browser apps yet
+      // obj.devicePushToken = this.device.pushToken;
+    }
+
+    if (this.twoFactor.token && this.twoFactor.provider != null) {
+      obj.twoFactorToken = this.twoFactor.token;
+      obj.twoFactorProvider = this.twoFactor.provider;
+      obj.twoFactorRemember = this.twoFactor.remember ? "1" : "0";
+    }
+
+    return obj;
+  }
+}

common/src/models/request/tokenRequest.ts

@@ -1,91 +0,0 @@
-import { TwoFactorProviderType } from "../../enums/twoFactorProviderType";
-
-import { CaptchaProtectedRequest } from "./captchaProtectedRequest";
-import { DeviceRequest } from "./deviceRequest";
-
-import { Utils } from "../../misc/utils";
-
-export class TokenRequest implements CaptchaProtectedRequest {
-  email: string;
-  masterPasswordHash: string;
-  code: string;
-  codeVerifier: string;
-  redirectUri: string;
-  clientId: string;
-  clientSecret: string;
-  device?: DeviceRequest;
-
-  constructor(
-    credentials: string[],
-    codes: string[],
-    clientIdClientSecret: string[],
-    public provider: TwoFactorProviderType,
-    public token: string,
-    public remember: boolean,
-    public captchaResponse: string,
-    device?: DeviceRequest
-  ) {
-    if (credentials != null && credentials.length > 1) {
-      this.email = credentials[0];
-      this.masterPasswordHash = credentials[1];
-    } else if (codes != null && codes.length > 2) {
-      this.code = codes[0];
-      this.codeVerifier = codes[1];
-      this.redirectUri = codes[2];
-    } else if (clientIdClientSecret != null && clientIdClientSecret.length > 1) {
-      this.clientId = clientIdClientSecret[0];
-      this.clientSecret = clientIdClientSecret[1];
-    }
-    this.device = device != null ? device : null;
-  }
-
-  toIdentityToken(clientId: string) {
-    const obj: any = {
-      scope: "api offline_access",
-      client_id: clientId,
-    };
-
-    if (this.clientSecret != null) {
-      obj.scope = clientId.startsWith("organization") ? "api.organization" : "api";
-      obj.grant_type = "client_credentials";
-      obj.client_secret = this.clientSecret;
-    } else if (this.masterPasswordHash != null && this.email != null) {
-      obj.grant_type = "password";
-      obj.username = this.email;
-      obj.password = this.masterPasswordHash;
-    } else if (this.code != null && this.codeVerifier != null && this.redirectUri != null) {
-      obj.grant_type = "authorization_code";
-      obj.code = this.code;
-      obj.code_verifier = this.codeVerifier;
-      obj.redirect_uri = this.redirectUri;
-    } else {
-      throw new Error("must provide credentials or codes");
-    }
-
-    if (this.device) {
-      obj.deviceType = this.device.type;
-      obj.deviceIdentifier = this.device.identifier;
-      obj.deviceName = this.device.name;
-      // no push tokens for browser apps yet
-      // obj.devicePushToken = this.device.pushToken;
-    }
-
-    if (this.token && this.provider != null) {
-      obj.twoFactorToken = this.token;
-      obj.twoFactorProvider = this.provider;
-      obj.twoFactorRemember = this.remember ? "1" : "0";
-    }
-
-    if (this.captchaResponse != null) {
-      obj.captchaResponse = this.captchaResponse;
-    }
-
-    return obj;
-  }
-
-  alterIdentityTokenHeaders(headers: Headers) {
-    if (this.clientSecret == null && this.masterPasswordHash != null && this.email != null) {
-      headers.set("Auth-Email", Utils.fromUtf8ToUrlB64(this.email));
-    }
-  }
-}

common/src/services/api.service.ts

@@ -28,6 +28,9 @@ import { EventRequest } from "../models/request/eventRequest";
 import { FolderRequest } from "../models/request/folderRequest";
 import { GroupRequest } from "../models/request/groupRequest";
 import { IapCheckRequest } from "../models/request/iapCheckRequest";
+import { ApiTokenRequest } from "../models/request/identityToken/apiTokenRequest";
+import { PasswordTokenRequest } from "../models/request/identityToken/passwordTokenRequest";
+import { SsoTokenRequest } from "../models/request/identityToken/ssoTokenRequest";
 import { ImportCiphersRequest } from "../models/request/importCiphersRequest";
 import { ImportDirectoryRequest } from "../models/request/importDirectoryRequest";
 import { ImportOrganizationCiphersRequest } from "../models/request/importOrganizationCiphersRequest";
@@ -76,7 +79,6 @@ import { SendRequest } from "../models/request/sendRequest";
 import { SetPasswordRequest } from "../models/request/setPasswordRequest";
 import { StorageRequest } from "../models/request/storageRequest";
 import { TaxInfoUpdateRequest } from "../models/request/taxInfoUpdateRequest";
-import { TokenRequest } from "../models/request/tokenRequest";
 import { TwoFactorEmailRequest } from "../models/request/twoFactorEmailRequest";
 import { TwoFactorProviderRequest } from "../models/request/twoFactorProviderRequest";
 import { TwoFactorRecoveryRequest } from "../models/request/twoFactorRecoveryRequest";
@@ -208,7 +210,7 @@ export class ApiService implements ApiServiceAbstraction {
   // Auth APIs
 
   async postIdentityToken(
-    request: TokenRequest
+    request: ApiTokenRequest | PasswordTokenRequest | SsoTokenRequest
   ): Promise<IdentityTokenResponse | IdentityTwoFactorResponse | IdentityCaptchaResponse> {
     const headers = new Headers({
       "Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
@@ -219,11 +221,15 @@ export class ApiService implements ApiServiceAbstraction {
       headers.set("User-Agent", this.customUserAgent);
     }
     request.alterIdentityTokenHeaders(headers);
+
+    const identityToken =
+      request instanceof ApiTokenRequest
+        ? request.toIdentityToken()
+        : request.toIdentityToken(this.platformUtilsService.identityClientId);
+
     const response = await this.fetch(
       new Request(this.environmentService.getIdentityUrl() + "/connect/token", {
-        body: this.qsStringify(
-          request.toIdentityToken(request.clientId ?? this.platformUtilsService.identityClientId)
-        ),
+        body: this.qsStringify(identityToken),
         credentials: this.getCredentials(),
         cache: "no-store",
         headers: headers,
@@ -244,7 +250,7 @@ export class ApiService implements ApiServiceAbstraction {
         responseJson.TwoFactorProviders2 &&
         Object.keys(responseJson.TwoFactorProviders2).length
       ) {
-        await this.tokenService.clearTwoFactorToken(request.email);
+        await this.tokenService.clearTwoFactorToken();
         return new IdentityTwoFactorResponse(responseJson);
       } else if (
         response.status === 400 &&

common/src/services/auth.service.ts

@@ -1,332 +1,125 @@
-import { HashPurpose } from "../enums/hashPurpose";
 import { KdfType } from "../enums/kdfType";
-import { TwoFactorProviderType } from "../enums/twoFactorProviderType";
 
-import {
-  Account,
-  AccountData,
-  AccountKeys,
-  AccountProfile,
-  AccountTokens,
-} from "../models/domain/account";
+import { ApiLogInStrategy } from "../misc/logInStrategies/apiLogin.strategy";
+import { PasswordLogInStrategy } from "../misc/logInStrategies/passwordLogin.strategy";
+import { SsoLogInStrategy } from "../misc/logInStrategies/ssoLogin.strategy";
 import { AuthResult } from "../models/domain/authResult";
+import {
+  ApiLogInCredentials,
+  PasswordLogInCredentials,
+  SsoLogInCredentials,
+} from "../models/domain/logInCredentials";
 import { SymmetricCryptoKey } from "../models/domain/symmetricCryptoKey";
 
-import { SetKeyConnectorKeyRequest } from "../models/request/account/setKeyConnectorKeyRequest";
-import { DeviceRequest } from "../models/request/deviceRequest";
-import { KeyConnectorUserKeyRequest } from "../models/request/keyConnectorUserKeyRequest";
-import { KeysRequest } from "../models/request/keysRequest";
 import { PreloginRequest } from "../models/request/preloginRequest";
-import { TokenRequest } from "../models/request/tokenRequest";
 
-import { IdentityTokenResponse } from "../models/response/identityTokenResponse";
-import { IdentityTwoFactorResponse } from "../models/response/identityTwoFactorResponse";
+import { TokenRequestTwoFactor } from "../models/request/identityToken/tokenRequest";
 
 import { ApiService } from "../abstractions/api.service";
 import { AppIdService } from "../abstractions/appId.service";
 import { AuthService as AuthServiceAbstraction } from "../abstractions/auth.service";
 import { CryptoService } from "../abstractions/crypto.service";
-import { CryptoFunctionService } from "../abstractions/cryptoFunction.service";
 import { EnvironmentService } from "../abstractions/environment.service";
-import { I18nService } from "../abstractions/i18n.service";
 import { KeyConnectorService } from "../abstractions/keyConnector.service";
 import { LogService } from "../abstractions/log.service";
 import { MessagingService } from "../abstractions/messaging.service";
 import { PlatformUtilsService } from "../abstractions/platformUtils.service";
 import { StateService } from "../abstractions/state.service";
 import { TokenService } from "../abstractions/token.service";
-import { VaultTimeoutService } from "../abstractions/vaultTimeout.service";
-
-import { Utils } from "../misc/utils";
-
-export const TwoFactorProviders = {
-  [TwoFactorProviderType.Authenticator]: {
-    type: TwoFactorProviderType.Authenticator,
-    name: null as string,
-    description: null as string,
-    priority: 1,
-    sort: 1,
-    premium: false,
-  },
-  [TwoFactorProviderType.Yubikey]: {
-    type: TwoFactorProviderType.Yubikey,
-    name: null as string,
-    description: null as string,
-    priority: 3,
-    sort: 2,
-    premium: true,
-  },
-  [TwoFactorProviderType.Duo]: {
-    type: TwoFactorProviderType.Duo,
-    name: "Duo",
-    description: null as string,
-    priority: 2,
-    sort: 3,
-    premium: true,
-  },
-  [TwoFactorProviderType.OrganizationDuo]: {
-    type: TwoFactorProviderType.OrganizationDuo,
-    name: "Duo (Organization)",
-    description: null as string,
-    priority: 10,
-    sort: 4,
-    premium: false,
-  },
-  [TwoFactorProviderType.Email]: {
-    type: TwoFactorProviderType.Email,
-    name: null as string,
-    description: null as string,
-    priority: 0,
-    sort: 6,
-    premium: false,
-  },
-  [TwoFactorProviderType.WebAuthn]: {
-    type: TwoFactorProviderType.WebAuthn,
-    name: null as string,
-    description: null as string,
-    priority: 4,
-    sort: 5,
-    premium: true,
-  },
-};
+import { TwoFactorService } from "../abstractions/twoFactor.service";
 
 export class AuthService implements AuthServiceAbstraction {
-  email: string;
-  masterPasswordHash: string;
-  localMasterPasswordHash: string;
-  code: string;
-  codeVerifier: string;
-  ssoRedirectUrl: string;
-  clientId: string;
-  clientSecret: string;
-  twoFactorProvidersData: Map<TwoFactorProviderType, { [key: string]: string }>;
-  selectedTwoFactorProviderType: TwoFactorProviderType = null;
-  captchaToken: string;
+  get email(): string {
+    return this.logInStrategy instanceof PasswordLogInStrategy ? this.logInStrategy.email : null;
+  }
 
-  private key: SymmetricCryptoKey;
+  get masterPasswordHash(): string {
+    return this.logInStrategy instanceof PasswordLogInStrategy
+      ? this.logInStrategy.masterPasswordHash
+      : null;
+  }
+
+  private logInStrategy: ApiLogInStrategy | PasswordLogInStrategy | SsoLogInStrategy;
 
   constructor(
-    private cryptoService: CryptoService,
+    protected cryptoService: CryptoService,
     protected apiService: ApiService,
     protected tokenService: TokenService,
     protected appIdService: AppIdService,
-    private i18nService: I18nService,
     protected platformUtilsService: PlatformUtilsService,
-    private messagingService: MessagingService,
-    private vaultTimeoutService: VaultTimeoutService,
-    private logService: LogService,
-    protected cryptoFunctionService: CryptoFunctionService,
-    private keyConnectorService: KeyConnectorService,
+    protected messagingService: MessagingService,
+    protected logService: LogService,
+    protected keyConnectorService: KeyConnectorService,
     protected environmentService: EnvironmentService,
     protected stateService: StateService,
-    private setCryptoKeys = true
+    protected twoFactorService: TwoFactorService
   ) {}
 
-  init() {
-    TwoFactorProviders[TwoFactorProviderType.Email].name = this.i18nService.t("emailTitle");
-    TwoFactorProviders[TwoFactorProviderType.Email].description = this.i18nService.t("emailDesc");
-
-    TwoFactorProviders[TwoFactorProviderType.Authenticator].name =
-      this.i18nService.t("authenticatorAppTitle");
-    TwoFactorProviders[TwoFactorProviderType.Authenticator].description =
-      this.i18nService.t("authenticatorAppDesc");
-
-    TwoFactorProviders[TwoFactorProviderType.Duo].description = this.i18nService.t("duoDesc");
-
-    TwoFactorProviders[TwoFactorProviderType.OrganizationDuo].name =
-      "Duo (" + this.i18nService.t("organization") + ")";
-    TwoFactorProviders[TwoFactorProviderType.OrganizationDuo].description =
-      this.i18nService.t("duoOrganizationDesc");
-
-    TwoFactorProviders[TwoFactorProviderType.WebAuthn].name = this.i18nService.t("webAuthnTitle");
-    TwoFactorProviders[TwoFactorProviderType.WebAuthn].description =
-      this.i18nService.t("webAuthnDesc");
-
-    TwoFactorProviders[TwoFactorProviderType.Yubikey].name = this.i18nService.t("yubiKeyTitle");
-    TwoFactorProviders[TwoFactorProviderType.Yubikey].description =
-      this.i18nService.t("yubiKeyDesc");
-  }
-
-  async logIn(email: string, masterPassword: string, captchaToken?: string): Promise<AuthResult> {
-    this.selectedTwoFactorProviderType = null;
-    const key = await this.makePreloginKey(masterPassword, email);
-    const hashedPassword = await this.cryptoService.hashPassword(masterPassword, key);
-    const localHashedPassword = await this.cryptoService.hashPassword(
-      masterPassword,
-      key,
-      HashPurpose.LocalAuthorization
-    );
-    return await this.logInHelper(
-      email,
-      hashedPassword,
-      localHashedPassword,
-      null,
-      null,
-      null,
-      null,
-      null,
-      key,
-      null,
-      null,
-      null,
-      captchaToken,
-      null
-    );
-  }
-
-  async logInSso(
-    code: string,
-    codeVerifier: string,
-    redirectUrl: string,
-    orgId: string
+  async logIn(
+    credentials: ApiLogInCredentials | PasswordLogInCredentials | SsoLogInCredentials
   ): Promise<AuthResult> {
-    this.selectedTwoFactorProviderType = null;
-    return await this.logInHelper(
-      null,
-      null,
-      null,
-      code,
-      codeVerifier,
-      redirectUrl,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      orgId
-    );
+    this.clearState();
+
+    let result: AuthResult;
+    let strategy: ApiLogInStrategy | PasswordLogInStrategy | SsoLogInStrategy;
+
+    if (credentials instanceof PasswordLogInCredentials) {
+      strategy = new PasswordLogInStrategy(
+        this.cryptoService,
+        this.apiService,
+        this.tokenService,
+        this.appIdService,
+        this.platformUtilsService,
+        this.messagingService,
+        this.logService,
+        this.stateService,
+        this.twoFactorService,
+        this
+      );
+      result = await strategy.logIn(credentials);
+    } else if (credentials instanceof SsoLogInCredentials) {
+      strategy = new SsoLogInStrategy(
+        this.cryptoService,
+        this.apiService,
+        this.tokenService,
+        this.appIdService,
+        this.platformUtilsService,
+        this.messagingService,
+        this.logService,
+        this.stateService,
+        this.twoFactorService,
+        this.keyConnectorService
+      );
+      result = await strategy.logIn(credentials);
+    } else if (credentials instanceof ApiLogInCredentials) {
+      strategy = new ApiLogInStrategy(
+        this.cryptoService,
+        this.apiService,
+        this.tokenService,
+        this.appIdService,
+        this.platformUtilsService,
+        this.messagingService,
+        this.logService,
+        this.stateService,
+        this.twoFactorService,
+        this.environmentService,
+        this.keyConnectorService
+      );
+      result = await strategy.logIn(credentials);
+    }
+
+    if (result?.requiresTwoFactor) {
+      this.saveState(strategy);
+    }
+    return result;
   }
 
-  async logInApiKey(clientId: string, clientSecret: string): Promise<AuthResult> {
-    this.selectedTwoFactorProviderType = null;
-    return await this.logInHelper(
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      clientId,
-      clientSecret,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null
-    );
-  }
-
-  async logInTwoFactor(
-    twoFactorProvider: TwoFactorProviderType,
-    twoFactorToken: string,
-    remember?: boolean
-  ): Promise<AuthResult> {
-    return await this.logInHelper(
-      this.email,
-      this.masterPasswordHash,
-      this.localMasterPasswordHash,
-      this.code,
-      this.codeVerifier,
-      this.ssoRedirectUrl,
-      this.clientId,
-      this.clientSecret,
-      this.key,
-      twoFactorProvider,
-      twoFactorToken,
-      remember,
-      this.captchaToken,
-      null
-    );
-  }
-
-  async logInComplete(
-    email: string,
-    masterPassword: string,
-    twoFactorProvider: TwoFactorProviderType,
-    twoFactorToken: string,
-    remember?: boolean,
-    captchaToken?: string
-  ): Promise<AuthResult> {
-    this.selectedTwoFactorProviderType = null;
-    const key = await this.makePreloginKey(masterPassword, email);
-    const hashedPassword = await this.cryptoService.hashPassword(masterPassword, key);
-    const localHashedPassword = await this.cryptoService.hashPassword(
-      masterPassword,
-      key,
-      HashPurpose.LocalAuthorization
-    );
-    return await this.logInHelper(
-      email,
-      hashedPassword,
-      localHashedPassword,
-      null,
-      null,
-      null,
-      null,
-      null,
-      key,
-      twoFactorProvider,
-      twoFactorToken,
-      remember,
-      captchaToken,
-      null
-    );
-  }
-
-  async logInSsoComplete(
-    code: string,
-    codeVerifier: string,
-    redirectUrl: string,
-    twoFactorProvider: TwoFactorProviderType,
-    twoFactorToken: string,
-    remember?: boolean
-  ): Promise<AuthResult> {
-    this.selectedTwoFactorProviderType = null;
-    return await this.logInHelper(
-      null,
-      null,
-      null,
-      code,
-      codeVerifier,
-      redirectUrl,
-      null,
-      null,
-      null,
-      twoFactorProvider,
-      twoFactorToken,
-      remember,
-      null,
-      null
-    );
-  }
-
-  async logInApiKeyComplete(
-    clientId: string,
-    clientSecret: string,
-    twoFactorProvider: TwoFactorProviderType,
-    twoFactorToken: string,
-    remember?: boolean
-  ): Promise<AuthResult> {
-    this.selectedTwoFactorProviderType = null;
-    return await this.logInHelper(
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      clientId,
-      clientSecret,
-      null,
-      twoFactorProvider,
-      twoFactorToken,
-      remember,
-      null,
-      null
-    );
+  async logInTwoFactor(twoFactor: TokenRequestTwoFactor): Promise<AuthResult> {
+    try {
+      return await this.logInStrategy.logInTwoFactor(twoFactor);
+    } finally {
+      this.clearState();
+    }
   }
 
   logOut(callback: Function) {
@@ -334,75 +127,16 @@ export class AuthService implements AuthServiceAbstraction {
     this.messagingService.send("loggedOut");
   }
 
-  getSupportedTwoFactorProviders(win: Window): any[] {
-    const providers: any[] = [];
-    if (this.twoFactorProvidersData == null) {
-      return providers;
-    }
-
-    if (
-      this.twoFactorProvidersData.has(TwoFactorProviderType.OrganizationDuo) &&
-      this.platformUtilsService.supportsDuo()
-    ) {
-      providers.push(TwoFactorProviders[TwoFactorProviderType.OrganizationDuo]);
-    }
-
-    if (this.twoFactorProvidersData.has(TwoFactorProviderType.Authenticator)) {
-      providers.push(TwoFactorProviders[TwoFactorProviderType.Authenticator]);
-    }
-
-    if (this.twoFactorProvidersData.has(TwoFactorProviderType.Yubikey)) {
-      providers.push(TwoFactorProviders[TwoFactorProviderType.Yubikey]);
-    }
-
-    if (
-      this.twoFactorProvidersData.has(TwoFactorProviderType.Duo) &&
-      this.platformUtilsService.supportsDuo()
-    ) {
-      providers.push(TwoFactorProviders[TwoFactorProviderType.Duo]);
-    }
-
-    if (
-      this.twoFactorProvidersData.has(TwoFactorProviderType.WebAuthn) &&
-      this.platformUtilsService.supportsWebAuthn(win)
-    ) {
-      providers.push(TwoFactorProviders[TwoFactorProviderType.WebAuthn]);
-    }
-
-    if (this.twoFactorProvidersData.has(TwoFactorProviderType.Email)) {
-      providers.push(TwoFactorProviders[TwoFactorProviderType.Email]);
-    }
-
-    return providers;
+  authingWithApiKey(): boolean {
+    return this.logInStrategy instanceof ApiLogInStrategy;
   }
 
-  getDefaultTwoFactorProvider(webAuthnSupported: boolean): TwoFactorProviderType {
-    if (this.twoFactorProvidersData == null) {
-      return null;
-    }
+  authingWithSso(): boolean {
+    return this.logInStrategy instanceof SsoLogInStrategy;
+  }
 
-    if (
-      this.selectedTwoFactorProviderType != null &&
-      this.twoFactorProvidersData.has(this.selectedTwoFactorProviderType)
-    ) {
-      return this.selectedTwoFactorProviderType;
-    }
-
-    let providerType: TwoFactorProviderType = null;
-    let providerPriority = -1;
-    this.twoFactorProvidersData.forEach((_value, type) => {
-      const provider = (TwoFactorProviders as any)[type];
-      if (provider != null && provider.priority > providerPriority) {
-        if (type === TwoFactorProviderType.WebAuthn && !webAuthnSupported) {
-          return;
-        }
-
-        providerType = type;
-        providerPriority = provider.priority;
-      }
-    });
-
-    return providerType;
+  authingWithPassword(): boolean {
+    return this.logInStrategy instanceof PasswordLogInStrategy;
   }
 
   async makePreloginKey(masterPassword: string, email: string): Promise<SymmetricCryptoKey> {
@@ -423,249 +157,11 @@ export class AuthService implements AuthServiceAbstraction {
     return this.cryptoService.makeKey(masterPassword, email, kdf, kdfIterations);
   }
 
-  authingWithApiKey(): boolean {
-    return this.clientId != null && this.clientSecret != null;
+  private saveState(strategy: ApiLogInStrategy | PasswordLogInStrategy | SsoLogInStrategy) {
+    this.logInStrategy = strategy;
   }
 
-  authingWithSso(): boolean {
-    return this.code != null && this.codeVerifier != null && this.ssoRedirectUrl != null;
-  }
-
-  authingWithPassword(): boolean {
-    return this.email != null && this.masterPasswordHash != null;
-  }
-
-  private async logInHelper(
-    email: string,
-    hashedPassword: string,
-    localHashedPassword: string,
-    code: string,
-    codeVerifier: string,
-    redirectUrl: string,
-    clientId: string,
-    clientSecret: string,
-    key: SymmetricCryptoKey,
-    twoFactorProvider?: TwoFactorProviderType,
-    twoFactorToken?: string,
-    remember?: boolean,
-    captchaToken?: string,
-    orgId?: string
-  ): Promise<AuthResult> {
-    const storedTwoFactorToken = await this.tokenService.getTwoFactorToken(email);
-    const appId = await this.appIdService.getAppId();
-    const deviceRequest = new DeviceRequest(appId, this.platformUtilsService);
-
-    let emailPassword: string[] = [];
-    let codeCodeVerifier: string[] = [];
-    let clientIdClientSecret: [string, string] = [null, null];
-
-    if (email != null && hashedPassword != null) {
-      emailPassword = [email, hashedPassword];
-    } else {
-      emailPassword = null;
-    }
-    if (code != null && codeVerifier != null && redirectUrl != null) {
-      codeCodeVerifier = [code, codeVerifier, redirectUrl];
-    } else {
-      codeCodeVerifier = null;
-    }
-    if (clientId != null && clientSecret != null) {
-      clientIdClientSecret = [clientId, clientSecret];
-    } else {
-      clientIdClientSecret = null;
-    }
-
-    let request: TokenRequest;
-    if (twoFactorToken != null && twoFactorProvider != null) {
-      request = new TokenRequest(
-        emailPassword,
-        codeCodeVerifier,
-        clientIdClientSecret,
-        twoFactorProvider,
-        twoFactorToken,
-        remember,
-        captchaToken,
-        deviceRequest
-      );
-    } else if (storedTwoFactorToken != null) {
-      request = new TokenRequest(
-        emailPassword,
-        codeCodeVerifier,
-        clientIdClientSecret,
-        TwoFactorProviderType.Remember,
-        storedTwoFactorToken,
-        false,
-        captchaToken,
-        deviceRequest
-      );
-    } else {
-      request = new TokenRequest(
-        emailPassword,
-        codeCodeVerifier,
-        clientIdClientSecret,
-        null,
-        null,
-        false,
-        captchaToken,
-        deviceRequest
-      );
-    }
-
-    const response = await this.apiService.postIdentityToken(request);
-
-    this.clearState();
-    const result = new AuthResult();
-    result.captchaSiteKey = (response as any).siteKey;
-    if (!!result.captchaSiteKey) {
-      return result;
-    }
-    result.twoFactor = !!(response as any).twoFactorProviders2;
-
-    if (result.twoFactor) {
-      // two factor required
-      this.email = email;
-      this.masterPasswordHash = hashedPassword;
-      this.localMasterPasswordHash = localHashedPassword;
-      this.code = code;
-      this.codeVerifier = codeVerifier;
-      this.ssoRedirectUrl = redirectUrl;
-      this.clientId = clientId;
-      this.clientSecret = clientSecret;
-      this.key = this.setCryptoKeys ? key : null;
-      const twoFactorResponse = response as IdentityTwoFactorResponse;
-      this.twoFactorProvidersData = twoFactorResponse.twoFactorProviders2;
-      result.twoFactorProviders = twoFactorResponse.twoFactorProviders2;
-      this.captchaToken = twoFactorResponse.captchaToken;
-      return result;
-    }
-
-    const tokenResponse = response as IdentityTokenResponse;
-    result.resetMasterPassword = tokenResponse.resetMasterPassword;
-    result.forcePasswordReset = tokenResponse.forcePasswordReset;
-
-    const accountInformation = await this.tokenService.decodeToken(tokenResponse.accessToken);
-    await this.stateService.addAccount(
-      new Account({
-        profile: {
-          ...new AccountProfile(),
-          ...{
-            userId: accountInformation.sub,
-            email: accountInformation.email,
-            apiKeyClientId: clientId,
-            hasPremiumPersonally: accountInformation.premium,
-            kdfIterations: tokenResponse.kdfIterations,
-            kdfType: tokenResponse.kdf,
-          },
-        },
-        keys: {
-          ...new AccountKeys(),
-          ...{
-            apiKeyClientSecret: clientSecret,
-          },
-        },
-        tokens: {
-          ...new AccountTokens(),
-          ...{
-            accessToken: tokenResponse.accessToken,
-            refreshToken: tokenResponse.refreshToken,
-          },
-        },
-      })
-    );
-
-    if (tokenResponse.twoFactorToken != null) {
-      await this.tokenService.setTwoFactorToken(tokenResponse.twoFactorToken, email);
-    }
-
-    if (this.setCryptoKeys) {
-      if (key != null) {
-        await this.cryptoService.setKey(key);
-      }
-      if (localHashedPassword != null) {
-        await this.cryptoService.setKeyHash(localHashedPassword);
-      }
-
-      // Skip this step during SSO new user flow. No key is returned from server.
-      if (code == null || tokenResponse.key != null) {
-        if (tokenResponse.keyConnectorUrl != null) {
-          await this.keyConnectorService.getAndSetKey(tokenResponse.keyConnectorUrl);
-        } else if (tokenResponse.apiUseKeyConnector) {
-          const keyConnectorUrl = this.environmentService.getKeyConnectorUrl();
-          await this.keyConnectorService.getAndSetKey(keyConnectorUrl);
-        }
-
-        await this.cryptoService.setEncKey(tokenResponse.key);
-
-        // User doesn't have a key pair yet (old account), let's generate one for them
-        if (tokenResponse.privateKey == null) {
-          try {
-            const keyPair = await this.cryptoService.makeKeyPair();
-            await this.apiService.postAccountKeys(
-              new KeysRequest(keyPair[0], keyPair[1].encryptedString)
-            );
-            tokenResponse.privateKey = keyPair[1].encryptedString;
-          } catch (e) {
-            this.logService.error(e);
-          }
-        }
-
-        await this.cryptoService.setEncPrivateKey(tokenResponse.privateKey);
-      } else if (tokenResponse.keyConnectorUrl != null) {
-        const password = await this.cryptoFunctionService.randomBytes(64);
-
-        const k = await this.cryptoService.makeKey(
-          Utils.fromBufferToB64(password),
-          await this.tokenService.getEmail(),
-          tokenResponse.kdf,
-          tokenResponse.kdfIterations
-        );
-        const keyConnectorRequest = new KeyConnectorUserKeyRequest(k.encKeyB64);
-        await this.cryptoService.setKey(k);
-
-        const encKey = await this.cryptoService.makeEncKey(k);
-        await this.cryptoService.setEncKey(encKey[1].encryptedString);
-
-        const [pubKey, privKey] = await this.cryptoService.makeKeyPair();
-
-        try {
-          await this.apiService.postUserKeyToKeyConnector(
-            tokenResponse.keyConnectorUrl,
-            keyConnectorRequest
-          );
-        } catch (e) {
-          throw new Error("Unable to reach key connector");
-        }
-
-        const keys = new KeysRequest(pubKey, privKey.encryptedString);
-        const setPasswordRequest = new SetKeyConnectorKeyRequest(
-          encKey[1].encryptedString,
-          tokenResponse.kdf,
-          tokenResponse.kdfIterations,
-          orgId,
-          keys
-        );
-        await this.apiService.postSetKeyConnectorKey(setPasswordRequest);
-      }
-    }
-
-    if (this.vaultTimeoutService != null) {
-      await this.stateService.setBiometricLocked(false);
-    }
-    this.messagingService.send("loggedIn");
-    return result;
-  }
-
-  private clearState(): void {
-    this.key = null;
-    this.email = null;
-    this.masterPasswordHash = null;
-    this.localMasterPasswordHash = null;
-    this.code = null;
-    this.codeVerifier = null;
-    this.ssoRedirectUrl = null;
-    this.clientId = null;
-    this.clientSecret = null;
-    this.twoFactorProvidersData = null;
-    this.selectedTwoFactorProviderType = null;
+  private clearState() {
+    this.logInStrategy = null;
   }
 }

common/src/services/keyConnector.service.ts

@@ -1,5 +1,6 @@
 import { ApiService } from "../abstractions/api.service";
 import { CryptoService } from "../abstractions/crypto.service";
+import { CryptoFunctionService } from "../abstractions/cryptoFunction.service";
 import { KeyConnectorService as KeyConnectorServiceAbstraction } from "../abstractions/keyConnector.service";
 import { LogService } from "../abstractions/log.service";
 import { OrganizationService } from "../abstractions/organization.service";
@@ -12,7 +13,11 @@ import { Utils } from "../misc/utils";
 
 import { SymmetricCryptoKey } from "../models/domain/symmetricCryptoKey";
 
+import { SetKeyConnectorKeyRequest } from "../models/request/account/setKeyConnectorKeyRequest";
 import { KeyConnectorUserKeyRequest } from "../models/request/keyConnectorUserKeyRequest";
+import { KeysRequest } from "../models/request/keysRequest";
+
+import { IdentityTokenResponse } from "../models/response/identityTokenResponse";
 
 export class KeyConnectorService implements KeyConnectorServiceAbstraction {
   constructor(
@@ -21,7 +26,8 @@ export class KeyConnectorService implements KeyConnectorServiceAbstraction {
     private apiService: ApiService,
     private tokenService: TokenService,
     private logService: LogService,
-    private organizationService: OrganizationService
+    private organizationService: OrganizationService,
+    private cryptoFunctionService: CryptoFunctionService
   ) {}
 
   setUsesKeyConnector(usesKeyConnector: boolean) {
@@ -80,6 +86,41 @@ export class KeyConnectorService implements KeyConnectorServiceAbstraction {
     );
   }
 
+  async convertNewSsoUserToKeyConnector(tokenResponse: IdentityTokenResponse, orgId: string) {
+    const { kdf, kdfIterations, keyConnectorUrl } = tokenResponse;
+    const password = await this.cryptoFunctionService.randomBytes(64);
+
+    const k = await this.cryptoService.makeKey(
+      Utils.fromBufferToB64(password),
+      await this.tokenService.getEmail(),
+      kdf,
+      kdfIterations
+    );
+    const keyConnectorRequest = new KeyConnectorUserKeyRequest(k.encKeyB64);
+    await this.cryptoService.setKey(k);
+
+    const encKey = await this.cryptoService.makeEncKey(k);
+    await this.cryptoService.setEncKey(encKey[1].encryptedString);
+
+    const [pubKey, privKey] = await this.cryptoService.makeKeyPair();
+
+    try {
+      await this.apiService.postUserKeyToKeyConnector(keyConnectorUrl, keyConnectorRequest);
+    } catch (e) {
+      throw new Error("Unable to reach key connector");
+    }
+
+    const keys = new KeysRequest(pubKey, privKey.encryptedString);
+    const setPasswordRequest = new SetKeyConnectorKeyRequest(
+      encKey[1].encryptedString,
+      kdf,
+      kdfIterations,
+      orgId,
+      keys
+    );
+    await this.apiService.postSetKeyConnectorKey(setPasswordRequest);
+  }
+
   async setConvertAccountRequired(status: boolean) {
     await this.stateService.setConvertAccountToKeyConnector(status);
   }

common/src/services/token.service.ts

@@ -3,6 +3,8 @@ import { TokenService as TokenServiceAbstraction } from "../abstractions/token.s
 
 import { Utils } from "../misc/utils";
 
+import { IdentityTokenResponse } from "../models/response/identityTokenResponse";
+
 export class TokenService implements TokenServiceAbstraction {
   constructor(private stateService: StateService) {}
 
@@ -79,8 +81,8 @@ export class TokenService implements TokenServiceAbstraction {
     await this.setClientSecret(clientSecret);
   }
 
-  async setTwoFactorToken(token: string): Promise<any> {
-    return await this.stateService.setTwoFactorToken(token);
+  async setTwoFactorToken(tokenResponse: IdentityTokenResponse): Promise<any> {
+    return await this.stateService.setTwoFactorToken(tokenResponse.twoFactorToken);
   }
 
   async getTwoFactorToken(): Promise<string> {

common/src/services/twoFactor.service.ts

@@ -0,0 +1,188 @@
+import { I18nService } from "../abstractions/i18n.service";
+import { PlatformUtilsService } from "../abstractions/platformUtils.service";
+import {
+  TwoFactorProviderDetails,
+  TwoFactorService as TwoFactorServiceAbstraction,
+} from "../abstractions/twoFactor.service";
+
+import { TwoFactorProviderType } from "../enums/twoFactorProviderType";
+
+import { IdentityTwoFactorResponse } from "../models/response/identityTwoFactorResponse";
+
+export const TwoFactorProviders: Partial<Record<TwoFactorProviderType, TwoFactorProviderDetails>> =
+  {
+    [TwoFactorProviderType.Authenticator]: {
+      type: TwoFactorProviderType.Authenticator,
+      name: null as string,
+      description: null as string,
+      priority: 1,
+      sort: 1,
+      premium: false,
+    },
+    [TwoFactorProviderType.Yubikey]: {
+      type: TwoFactorProviderType.Yubikey,
+      name: null as string,
+      description: null as string,
+      priority: 3,
+      sort: 2,
+      premium: true,
+    },
+    [TwoFactorProviderType.Duo]: {
+      type: TwoFactorProviderType.Duo,
+      name: "Duo",
+      description: null as string,
+      priority: 2,
+      sort: 3,
+      premium: true,
+    },
+    [TwoFactorProviderType.OrganizationDuo]: {
+      type: TwoFactorProviderType.OrganizationDuo,
+      name: "Duo (Organization)",
+      description: null as string,
+      priority: 10,
+      sort: 4,
+      premium: false,
+    },
+    [TwoFactorProviderType.Email]: {
+      type: TwoFactorProviderType.Email,
+      name: null as string,
+      description: null as string,
+      priority: 0,
+      sort: 6,
+      premium: false,
+    },
+    [TwoFactorProviderType.WebAuthn]: {
+      type: TwoFactorProviderType.WebAuthn,
+      name: null as string,
+      description: null as string,
+      priority: 4,
+      sort: 5,
+      premium: true,
+    },
+  };
+
+export class TwoFactorService implements TwoFactorServiceAbstraction {
+  private twoFactorProvidersData: Map<TwoFactorProviderType, { [key: string]: string }>;
+  private selectedTwoFactorProviderType: TwoFactorProviderType = null;
+
+  constructor(
+    private i18nService: I18nService,
+    private platformUtilsService: PlatformUtilsService
+  ) {}
+
+  init() {
+    TwoFactorProviders[TwoFactorProviderType.Email].name = this.i18nService.t("emailTitle");
+    TwoFactorProviders[TwoFactorProviderType.Email].description = this.i18nService.t("emailDesc");
+
+    TwoFactorProviders[TwoFactorProviderType.Authenticator].name =
+      this.i18nService.t("authenticatorAppTitle");
+    TwoFactorProviders[TwoFactorProviderType.Authenticator].description =
+      this.i18nService.t("authenticatorAppDesc");
+
+    TwoFactorProviders[TwoFactorProviderType.Duo].description = this.i18nService.t("duoDesc");
+
+    TwoFactorProviders[TwoFactorProviderType.OrganizationDuo].name =
+      "Duo (" + this.i18nService.t("organization") + ")";
+    TwoFactorProviders[TwoFactorProviderType.OrganizationDuo].description =
+      this.i18nService.t("duoOrganizationDesc");
+
+    TwoFactorProviders[TwoFactorProviderType.WebAuthn].name = this.i18nService.t("webAuthnTitle");
+    TwoFactorProviders[TwoFactorProviderType.WebAuthn].description =
+      this.i18nService.t("webAuthnDesc");
+
+    TwoFactorProviders[TwoFactorProviderType.Yubikey].name = this.i18nService.t("yubiKeyTitle");
+    TwoFactorProviders[TwoFactorProviderType.Yubikey].description =
+      this.i18nService.t("yubiKeyDesc");
+  }
+
+  getSupportedProviders(win: Window): TwoFactorProviderDetails[] {
+    const providers: any[] = [];
+    if (this.twoFactorProvidersData == null) {
+      return providers;
+    }
+
+    if (
+      this.twoFactorProvidersData.has(TwoFactorProviderType.OrganizationDuo) &&
+      this.platformUtilsService.supportsDuo()
+    ) {
+      providers.push(TwoFactorProviders[TwoFactorProviderType.OrganizationDuo]);
+    }
+
+    if (this.twoFactorProvidersData.has(TwoFactorProviderType.Authenticator)) {
+      providers.push(TwoFactorProviders[TwoFactorProviderType.Authenticator]);
+    }
+
+    if (this.twoFactorProvidersData.has(TwoFactorProviderType.Yubikey)) {
+      providers.push(TwoFactorProviders[TwoFactorProviderType.Yubikey]);
+    }
+
+    if (
+      this.twoFactorProvidersData.has(TwoFactorProviderType.Duo) &&
+      this.platformUtilsService.supportsDuo()
+    ) {
+      providers.push(TwoFactorProviders[TwoFactorProviderType.Duo]);
+    }
+
+    if (
+      this.twoFactorProvidersData.has(TwoFactorProviderType.WebAuthn) &&
+      this.platformUtilsService.supportsWebAuthn(win)
+    ) {
+      providers.push(TwoFactorProviders[TwoFactorProviderType.WebAuthn]);
+    }
+
+    if (this.twoFactorProvidersData.has(TwoFactorProviderType.Email)) {
+      providers.push(TwoFactorProviders[TwoFactorProviderType.Email]);
+    }
+
+    return providers;
+  }
+
+  getDefaultProvider(webAuthnSupported: boolean): TwoFactorProviderType {
+    if (this.twoFactorProvidersData == null) {
+      return null;
+    }
+
+    if (
+      this.selectedTwoFactorProviderType != null &&
+      this.twoFactorProvidersData.has(this.selectedTwoFactorProviderType)
+    ) {
+      return this.selectedTwoFactorProviderType;
+    }
+
+    let providerType: TwoFactorProviderType = null;
+    let providerPriority = -1;
+    this.twoFactorProvidersData.forEach((_value, type) => {
+      const provider = (TwoFactorProviders as any)[type];
+      if (provider != null && provider.priority > providerPriority) {
+        if (type === TwoFactorProviderType.WebAuthn && !webAuthnSupported) {
+          return;
+        }
+
+        providerType = type;
+        providerPriority = provider.priority;
+      }
+    });
+
+    return providerType;
+  }
+
+  setSelectedProvider(type: TwoFactorProviderType) {
+    this.selectedTwoFactorProviderType = type;
+  }
+
+  clearSelectedProvider() {
+    this.selectedTwoFactorProviderType = null;
+  }
+
+  setProviders(response: IdentityTwoFactorResponse) {
+    this.twoFactorProvidersData = response.twoFactorProviders2;
+  }
+
+  clearProviders() {
+    this.twoFactorProvidersData = null;
+  }
+
+  getProviders() {
+    return this.twoFactorProvidersData;
+  }
+}