Merge branch 'main' into ps/extension-refresh

libs/admin-console/src/common/collections/abstractions/collection-admin.service.ts

@@ -0,0 +1,16 @@
+import { CollectionDetailsResponse } from "@bitwarden/common/vault/models/response/collection.response";
+
+import { CollectionAccessSelectionView, CollectionAdminView } from "../models";
+
+export abstract class CollectionAdminService {
+  getAll: (organizationId: string) => Promise<CollectionAdminView[]>;
+  get: (organizationId: string, collectionId: string) => Promise<CollectionAdminView | undefined>;
+  save: (collection: CollectionAdminView) => Promise<CollectionDetailsResponse>;
+  delete: (organizationId: string, collectionId: string) => Promise<void>;
+  bulkAssignAccess: (
+    organizationId: string,
+    collectionIds: string[],
+    users: CollectionAccessSelectionView[],
+    groups: CollectionAccessSelectionView[],
+  ) => Promise<void>;
+}

libs/admin-console/src/common/collections/abstractions/index.ts

@@ -0,0 +1 @@
+export * from "./collection-admin.service";

libs/admin-console/src/common/collections/index.ts

@@ -0,0 +1,3 @@
+export * from "./abstractions";
+export * from "./models";
+export * from "./services";

libs/admin-console/src/common/collections/models/bulk-collection-access.request.ts

@@ -0,0 +1,7 @@
+import { SelectionReadOnlyRequest } from "@bitwarden/common/admin-console/models/request/selection-read-only.request";
+
+export class BulkCollectionAccessRequest {
+  collectionIds: string[];
+  users: SelectionReadOnlyRequest[];
+  groups: SelectionReadOnlyRequest[];
+}

libs/admin-console/src/common/collections/models/collection-access-selection.view.ts

@@ -0,0 +1,28 @@
+import { View } from "@bitwarden/common/models/view/view";
+
+interface SelectionResponseLike {
+  id: string;
+  readOnly: boolean;
+  hidePasswords: boolean;
+  manage: boolean;
+}
+
+export class CollectionAccessSelectionView extends View {
+  readonly id: string;
+  readonly readOnly: boolean;
+  readonly hidePasswords: boolean;
+  readonly manage: boolean;
+
+  constructor(response?: SelectionResponseLike) {
+    super();
+
+    if (!response) {
+      return;
+    }
+
+    this.id = response.id;
+    this.readOnly = response.readOnly;
+    this.hidePasswords = response.hidePasswords;
+    this.manage = response.manage;
+  }
+}

libs/admin-console/src/common/collections/models/collection-admin.view.ts

@@ -0,0 +1,97 @@
+import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { CollectionAccessDetailsResponse } from "@bitwarden/common/src/vault/models/response/collection.response";
+import { CollectionView } from "@bitwarden/common/vault/models/view/collection.view";
+
+import { CollectionAccessSelectionView } from "../models";
+
+export const Unassigned = "unassigned";
+
+export class CollectionAdminView extends CollectionView {
+  groups: CollectionAccessSelectionView[] = [];
+  users: CollectionAccessSelectionView[] = [];
+
+  /**
+   * Flag indicating the collection has no active user or group assigned to it with CanManage permissions
+   * In this case, the collection can be managed by admins/owners or custom users with appropriate permissions
+   */
+  unmanaged: boolean;
+
+  /**
+   * Flag indicating the user has been explicitly assigned to this Collection
+   */
+  assigned: boolean;
+
+  constructor(response?: CollectionAccessDetailsResponse) {
+    super(response);
+
+    if (!response) {
+      return;
+    }
+
+    this.groups = response.groups
+      ? response.groups.map((g) => new CollectionAccessSelectionView(g))
+      : [];
+
+    this.users = response.users
+      ? response.users.map((g) => new CollectionAccessSelectionView(g))
+      : [];
+
+    this.assigned = response.assigned;
+  }
+
+  /**
+   * Returns true if the user can edit a collection (including user and group access) from the Admin Console.
+   */
+  override canEdit(org: Organization): boolean {
+    return (
+      org?.canEditAnyCollection ||
+      (this.unmanaged && org?.canEditUnmanagedCollections) ||
+      super.canEdit(org)
+    );
+  }
+
+  /**
+   * Returns true if the user can delete a collection from the Admin Console.
+   */
+  override canDelete(org: Organization): boolean {
+    return org?.canDeleteAnyCollection || super.canDelete(org);
+  }
+
+  /**
+   * Whether the user can modify user access to this collection
+   */
+  canEditUserAccess(org: Organization): boolean {
+    return (
+      (org.permissions.manageUsers && org.allowAdminAccessToAllCollectionItems) || this.canEdit(org)
+    );
+  }
+
+  /**
+   * Whether the user can modify group access to this collection
+   */
+  canEditGroupAccess(org: Organization): boolean {
+    return (
+      (org.permissions.manageGroups && org.allowAdminAccessToAllCollectionItems) ||
+      this.canEdit(org)
+    );
+  }
+
+  /**
+   * Returns true if the user can view collection info and access in a read-only state from the Admin Console
+   */
+  override canViewCollectionInfo(org: Organization | undefined): boolean {
+    if (this.isUnassignedCollection) {
+      return false;
+    }
+
+    return this.manage || org?.isAdmin || org?.permissions.editAnyCollection;
+  }
+
+  /**
+   * True if this collection represents the pseudo "Unassigned" collection
+   * This is different from the "unmanaged" flag, which indicates that no users or groups have access to the collection
+   */
+  get isUnassignedCollection() {
+    return this.id === Unassigned;
+  }
+}

libs/admin-console/src/common/collections/models/index.ts

@@ -0,0 +1,3 @@
+export * from "./bulk-collection-access.request";
+export * from "./collection-access-selection.view";
+export * from "./collection-admin.view";

libs/admin-console/src/common/collections/services/default-collection-admin.service.ts

@@ -0,0 +1,169 @@
+import { ApiService } from "@bitwarden/common/abstractions/api.service";
+import { SelectionReadOnlyRequest } from "@bitwarden/common/admin-console/models/request/selection-read-only.request";
+import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
+import { EncString } from "@bitwarden/common/platform/models/domain/enc-string";
+import { CollectionService } from "@bitwarden/common/vault/abstractions/collection.service";
+import { CollectionData } from "@bitwarden/common/vault/models/data/collection.data";
+import { CollectionRequest } from "@bitwarden/common/vault/models/request/collection.request";
+import {
+  CollectionAccessDetailsResponse,
+  CollectionDetailsResponse,
+  CollectionResponse,
+} from "@bitwarden/common/vault/models/response/collection.response";
+
+import { CollectionAdminService } from "../abstractions";
+import {
+  BulkCollectionAccessRequest,
+  CollectionAccessSelectionView,
+  CollectionAdminView,
+} from "../models";
+
+export class DefaultCollectionAdminService implements CollectionAdminService {
+  constructor(
+    private apiService: ApiService,
+    private cryptoService: CryptoService,
+    private encryptService: EncryptService,
+    private collectionService: CollectionService,
+  ) {}
+
+  async getAll(organizationId: string): Promise<CollectionAdminView[]> {
+    const collectionResponse =
+      await this.apiService.getManyCollectionsWithAccessDetails(organizationId);
+
+    if (collectionResponse?.data == null || collectionResponse.data.length === 0) {
+      return [];
+    }
+
+    return await this.decryptMany(organizationId, collectionResponse.data);
+  }
+
+  async get(
+    organizationId: string,
+    collectionId: string,
+  ): Promise<CollectionAdminView | undefined> {
+    const collectionResponse = await this.apiService.getCollectionAccessDetails(
+      organizationId,
+      collectionId,
+    );
+
+    if (collectionResponse == null) {
+      return undefined;
+    }
+
+    const [view] = await this.decryptMany(organizationId, [collectionResponse]);
+
+    return view;
+  }
+
+  async save(collection: CollectionAdminView): Promise<CollectionDetailsResponse> {
+    const request = await this.encrypt(collection);
+
+    let response: CollectionDetailsResponse;
+    if (collection.id == null) {
+      response = await this.apiService.postCollection(collection.organizationId, request);
+      collection.id = response.id;
+    } else {
+      response = await this.apiService.putCollection(
+        collection.organizationId,
+        collection.id,
+        request,
+      );
+    }
+
+    if (response.assigned) {
+      await this.collectionService.upsert(new CollectionData(response));
+    } else {
+      await this.collectionService.delete(collection.id);
+    }
+
+    return response;
+  }
+
+  async delete(organizationId: string, collectionId: string): Promise<void> {
+    await this.apiService.deleteCollection(organizationId, collectionId);
+  }
+
+  async bulkAssignAccess(
+    organizationId: string,
+    collectionIds: string[],
+    users: CollectionAccessSelectionView[],
+    groups: CollectionAccessSelectionView[],
+  ): Promise<void> {
+    const request = new BulkCollectionAccessRequest();
+    request.collectionIds = collectionIds;
+    request.users = users.map(
+      (u) => new SelectionReadOnlyRequest(u.id, u.readOnly, u.hidePasswords, u.manage),
+    );
+    request.groups = groups.map(
+      (g) => new SelectionReadOnlyRequest(g.id, g.readOnly, g.hidePasswords, g.manage),
+    );
+
+    await this.apiService.send(
+      "POST",
+      `/organizations/${organizationId}/collections/bulk-access`,
+      request,
+      true,
+      false,
+    );
+  }
+
+  private async decryptMany(
+    organizationId: string,
+    collections: CollectionResponse[] | CollectionAccessDetailsResponse[],
+  ): Promise<CollectionAdminView[]> {
+    const orgKey = await this.cryptoService.getOrgKey(organizationId);
+
+    const promises = collections.map(async (c) => {
+      const view = new CollectionAdminView();
+      view.id = c.id;
+      view.name = await this.encryptService.decryptToUtf8(new EncString(c.name), orgKey);
+      view.externalId = c.externalId;
+      view.organizationId = c.organizationId;
+
+      if (isCollectionAccessDetailsResponse(c)) {
+        view.groups = c.groups;
+        view.users = c.users;
+        view.assigned = c.assigned;
+        view.readOnly = c.readOnly;
+        view.hidePasswords = c.hidePasswords;
+        view.manage = c.manage;
+        view.unmanaged = c.unmanaged;
+      }
+
+      return view;
+    });
+
+    return await Promise.all(promises);
+  }
+
+  private async encrypt(model: CollectionAdminView): Promise<CollectionRequest> {
+    if (model.organizationId == null) {
+      throw new Error("Collection has no organization id.");
+    }
+    const key = await this.cryptoService.getOrgKey(model.organizationId);
+    if (key == null) {
+      throw new Error("No key for this collection's organization.");
+    }
+    const collection = new CollectionRequest();
+    collection.externalId = model.externalId;
+    collection.name = (await this.encryptService.encrypt(model.name, key)).encryptedString;
+    collection.groups = model.groups.map(
+      (group) =>
+        new SelectionReadOnlyRequest(group.id, group.readOnly, group.hidePasswords, group.manage),
+    );
+    collection.users = model.users.map(
+      (user) =>
+        new SelectionReadOnlyRequest(user.id, user.readOnly, user.hidePasswords, user.manage),
+    );
+    return collection;
+  }
+}
+
+function isCollectionAccessDetailsResponse(
+  response: CollectionResponse | CollectionAccessDetailsResponse,
+): response is CollectionAccessDetailsResponse {
+  const anyResponse = response as any;
+
+  return anyResponse?.groups instanceof Array && anyResponse?.users instanceof Array;
+}

libs/admin-console/src/common/collections/services/index.ts

@@ -0,0 +1 @@
+export * from "./default-collection-admin.service";

libs/admin-console/src/common/index.ts

@@ -1 +1,2 @@
 export * from "./organization-user";
+export * from "./collections";

libs/angular/src/auth/components/login.component.ts

@@ -1,6 +1,6 @@
 import { Directive, ElementRef, NgZone, OnDestroy, OnInit, ViewChild } from "@angular/core";
 import { FormBuilder, Validators } from "@angular/forms";
-import { ActivatedRoute, Router } from "@angular/router";
+import { ActivatedRoute, NavigationSkipped, Router } from "@angular/router";
 import { Subject, firstValueFrom, of } from "rxjs";
 import { switchMap, take, takeUntil } from "rxjs/operators";
 
@@ -121,6 +121,14 @@ export class LoginComponent extends CaptchaProtectedComponent implements OnInit,
       )
       .subscribe();
 
+    // If the user navigates to /login from /login, reset the validatedEmail flag
+    // This should bring the user back to the login screen with the email field
+    this.router.events.pipe(takeUntil(this.destroy$)).subscribe((event) => {
+      if (event instanceof NavigationSkipped && event.url === "/login") {
+        this.validatedEmail = false;
+      }
+    });
+
     // Backup check to handle unknown case where activatedRoute is not available
     // This shouldn't happen under normal circumstances
     if (!this.route) {

libs/angular/src/auth/guards/auth.guard.ts

@@ -38,6 +38,8 @@ export const authGuard: CanActivateFn = async (
     if (routerState != null) {
       messagingService.send("lockedUrl", { url: routerState.url });
     }
+    // TODO PM-9674: when extension refresh is finished, remove promptBiometric
+    // as it has been integrated into the component as a default feature.
     return router.createUrlTree(["lock"], { queryParams: { promptBiometric: true } });
   }
 

libs/auth/src/angular/anon-layout/anon-layout.component.html

@@ -9,7 +9,9 @@
     'tw-min-h-[calc(100vh-54px)]': clientType === 'desktop',
   }"
 >
-  <bit-icon *ngIf="!hideLogo" [icon]="logo" class="tw-w-[128px] [&>*]:tw-align-top"></bit-icon>
+  <a *ngIf="!hideLogo" [routerLink]="['/']" class="tw-w-[128px] [&>*]:tw-align-top">
+    <bit-icon [icon]="logo"></bit-icon>
+  </a>
 
   <div class="tw-text-center">
     <div class="tw-mx-auto tw-max-w-28 sm:tw-max-w-32">

libs/auth/src/angular/anon-layout/anon-layout.component.ts

@@ -1,5 +1,6 @@
 import { CommonModule } from "@angular/common";
 import { Component, Input, OnChanges, OnInit, SimpleChanges } from "@angular/core";
+import { RouterModule } from "@angular/router";
 import { firstValueFrom } from "rxjs";
 
 import { ClientType } from "@bitwarden/common/enums";
@@ -15,7 +16,7 @@ import { BitwardenLogo, BitwardenShield } from "../icons";
   standalone: true,
   selector: "auth-anon-layout",
   templateUrl: "./anon-layout.component.html",
-  imports: [IconModule, CommonModule, TypographyModule, SharedModule],
+  imports: [IconModule, CommonModule, TypographyModule, SharedModule, RouterModule],
 })
 export class AnonLayoutComponent implements OnInit, OnChanges {
   @Input() title: string;

libs/auth/src/angular/index.ts

@@ -43,5 +43,9 @@ export * from "./registration/registration-env-selector/registration-env-selecto
 export * from "./registration/registration-finish/registration-finish.service";
 export * from "./registration/registration-finish/default-registration-finish.service";
 
+// lock
+export * from "./lock/lock.component";
+export * from "./lock/lock-component.service";
+
 // vault timeout
 export * from "./vault-timeout-input/vault-timeout-input.component";

libs/auth/src/angular/lock/lock-component.service.ts

@@ -0,0 +1,48 @@
+import { Observable } from "rxjs";
+
+import { UserId } from "@bitwarden/common/types/guid";
+
+export enum BiometricsDisableReason {
+  NotSupportedOnOperatingSystem = "NotSupportedOnOperatingSystem",
+  EncryptedKeysUnavailable = "BiometricsEncryptedKeysUnavailable",
+  SystemBiometricsUnavailable = "SystemBiometricsUnavailable",
+}
+
+// ex: type UnlockOptionValue = "masterPassword" | "pin" | "biometrics"
+export type UnlockOptionValue = (typeof UnlockOption)[keyof typeof UnlockOption];
+
+export const UnlockOption = Object.freeze({
+  MasterPassword: "masterPassword",
+  Pin: "pin",
+  Biometrics: "biometrics",
+}) satisfies { [Prop in keyof UnlockOptions as Capitalize<Prop>]: Prop };
+
+export type UnlockOptions = {
+  masterPassword: {
+    enabled: boolean;
+  };
+  pin: {
+    enabled: boolean;
+  };
+  biometrics: {
+    enabled: boolean;
+    disableReason: BiometricsDisableReason | null;
+  };
+};
+
+/**
+ * The LockComponentService is a service which allows the single libs/auth LockComponent to delegate all
+ * client specific functionality to client specific services implementations of LockComponentService.
+ */
+export abstract class LockComponentService {
+  // Extension
+  abstract getBiometricsError(error: any): string | null;
+  abstract getPreviousUrl(): string | null;
+
+  // Desktop only
+  abstract isWindowVisible(): Promise<boolean>;
+  abstract getBiometricsUnlockBtnText(): string;
+
+  // Multi client
+  abstract getAvailableUnlockOptions$(userId: UserId): Observable<UnlockOptions>;
+}

libs/auth/src/angular/lock/lock.component.html

@@ -0,0 +1,191 @@
+<ng-template #loading>
+  <div class="tw-flex tw-items-center tw-justify-center" *ngIf="loading">
+    <i class="bwi bwi-spinner bwi-spin bwi-3x" aria-hidden="true"></i>
+  </div>
+</ng-template>
+
+<ng-container *ngIf="unlockOptions; else loading">
+  <!-- Biometrics Unlock -->
+  <ng-container
+    *ngIf="unlockOptions.biometrics.enabled && activeUnlockOption === UnlockOption.Biometrics"
+  >
+    <button
+      type="button"
+      bitButton
+      buttonType="primary"
+      class="tw-mb-3"
+      [disabled]="unlockingViaBiometrics"
+      [loading]="unlockingViaBiometrics"
+      block
+      (click)="unlockViaBiometrics()"
+    >
+      <span> {{ biometricUnlockBtnText | i18n }}</span>
+    </button>
+
+    <div class="tw-flex tw-flex-col tw-space-y-3">
+      <p class="tw-text-center tw-mb-0">{{ "or" | i18n }}</p>
+
+      <ng-container *ngIf="unlockOptions.pin.enabled">
+        <button
+          type="button"
+          bitButton
+          buttonType="secondary"
+          block
+          (click)="activeUnlockOption = UnlockOption.Pin"
+        >
+          {{ "unlockWithPin" | i18n }}
+        </button>
+      </ng-container>
+
+      <ng-container *ngIf="unlockOptions.masterPassword.enabled">
+        <button
+          type="button"
+          bitButton
+          buttonType="secondary"
+          block
+          (click)="activeUnlockOption = UnlockOption.MasterPassword"
+        >
+          {{ "unlockWithMasterPassword" | i18n }}
+        </button>
+      </ng-container>
+
+      <button type="button" bitButton block (click)="logOut()">
+        {{ "logOut" | i18n }}
+      </button>
+    </div>
+  </ng-container>
+
+  <!-- PIN Unlock -->
+  <ng-container *ngIf="unlockOptions.pin.enabled && activeUnlockOption === UnlockOption.Pin">
+    <form [bitSubmit]="submit" [formGroup]="formGroup">
+      <bit-form-field>
+        <bit-label>{{ "pin" | i18n }}</bit-label>
+        <input
+          type="password"
+          formControlName="pin"
+          bitInput
+          appAutofocus
+          name="pin"
+          class="tw-font-mono"
+          required
+          appInputVerbatim
+        />
+        <button
+          type="button"
+          bitIconButton
+          bitSuffix
+          bitPasswordInputToggle
+          [(toggled)]="showPassword"
+        ></button>
+      </bit-form-field>
+
+      <div class="tw-flex tw-flex-col tw-space-y-3">
+        <button type="submit" bitButton bitFormButton buttonType="primary" block>
+          {{ "unlock" | i18n }}
+        </button>
+
+        <p class="tw-text-center">{{ "or" | i18n }}</p>
+
+        <ng-container *ngIf="unlockOptions.biometrics.enabled">
+          <button
+            type="button"
+            bitButton
+            bitFormButton
+            buttonType="secondary"
+            block
+            (click)="activeUnlockOption = UnlockOption.Biometrics"
+          >
+            <span> {{ biometricUnlockBtnText | i18n }}</span>
+          </button>
+        </ng-container>
+
+        <ng-container *ngIf="unlockOptions.masterPassword.enabled">
+          <button
+            type="button"
+            bitButton
+            bitFormButton
+            buttonType="secondary"
+            block
+            (click)="activeUnlockOption = UnlockOption.MasterPassword"
+          >
+            {{ "unlockWithMasterPassword" | i18n }}
+          </button>
+        </ng-container>
+
+        <button type="button" bitButton bitFormButton block (click)="logOut()">
+          {{ "logOut" | i18n }}
+        </button>
+      </div>
+    </form>
+  </ng-container>
+
+  <!-- MP Unlock -->
+  <ng-container
+    *ngIf="
+      unlockOptions.masterPassword.enabled && activeUnlockOption === UnlockOption.MasterPassword
+    "
+  >
+    <form [bitSubmit]="submit" [formGroup]="formGroup">
+      <bit-form-field>
+        <bit-label>{{ "masterPass" | i18n }}</bit-label>
+        <input
+          type="password"
+          formControlName="masterPassword"
+          bitInput
+          appAutofocus
+          name="masterPassword"
+          class="tw-font-mono"
+          required
+          appInputVerbatim
+        />
+        <button
+          type="button"
+          bitIconButton
+          bitSuffix
+          bitPasswordInputToggle
+          [(toggled)]="showPassword"
+        ></button>
+
+        <!-- [attr.aria-pressed]="showPassword" -->
+      </bit-form-field>
+
+      <div class="tw-flex tw-flex-col tw-space-y-3">
+        <button type="submit" bitButton bitFormButton buttonType="primary" block>
+          {{ "unlock" | i18n }}
+        </button>
+
+        <p class="tw-text-center">{{ "or" | i18n }}</p>
+
+        <ng-container *ngIf="unlockOptions.biometrics.enabled">
+          <button
+            type="button"
+            bitButton
+            bitFormButton
+            buttonType="secondary"
+            block
+            (click)="activeUnlockOption = UnlockOption.Biometrics"
+          >
+            <span> {{ biometricUnlockBtnText | i18n }}</span>
+          </button>
+        </ng-container>
+
+        <ng-container *ngIf="unlockOptions.pin.enabled">
+          <button
+            type="button"
+            bitButton
+            bitFormButton
+            buttonType="secondary"
+            block
+            (click)="activeUnlockOption = UnlockOption.Pin"
+          >
+            {{ "unlockWithPin" | i18n }}
+          </button>
+        </ng-container>
+
+        <button type="button" bitButton bitFormButton block (click)="logOut()">
+          {{ "logOut" | i18n }}
+        </button>
+      </div>
+    </form>
+  </ng-container>
+</ng-container>

libs/auth/src/angular/lock/lock.component.ts

@@ -0,0 +1,638 @@
+import { CommonModule } from "@angular/common";
+import { Component, NgZone, OnDestroy, OnInit } from "@angular/core";
+import { FormBuilder, FormGroup, ReactiveFormsModule, Validators } from "@angular/forms";
+import { Router } from "@angular/router";
+import { BehaviorSubject, firstValueFrom, Subject, switchMap, take, takeUntil } from "rxjs";
+
+import { JslibModule } from "@bitwarden/angular/jslib.module";
+import { InternalPolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
+import { MasterPasswordPolicyOptions } from "@bitwarden/common/admin-console/models/domain/master-password-policy-options";
+import { AccountInfo, AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { DeviceTrustServiceAbstraction } from "@bitwarden/common/auth/abstractions/device-trust.service.abstraction";
+import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/auth/abstractions/master-password.service.abstraction";
+import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
+import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
+import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
+import {
+  MasterPasswordVerification,
+  MasterPasswordVerificationResponse,
+} from "@bitwarden/common/auth/types/verification";
+import { ClientType } from "@bitwarden/common/enums";
+import { BroadcasterService } from "@bitwarden/common/platform/abstractions/broadcaster.service";
+import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
+import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
+import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
+import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
+import { KeySuffixOptions } from "@bitwarden/common/platform/enums";
+import { SyncService } from "@bitwarden/common/platform/sync";
+import { PasswordStrengthServiceAbstraction } from "@bitwarden/common/tools/password-strength";
+import { UserId } from "@bitwarden/common/types/guid";
+import { UserKey } from "@bitwarden/common/types/key";
+import {
+  AsyncActionsModule,
+  ButtonModule,
+  DialogService,
+  FormFieldModule,
+  IconButtonModule,
+  ToastService,
+} from "@bitwarden/components";
+import { BiometricStateService } from "@bitwarden/key-management";
+
+import { PinServiceAbstraction } from "../../common/abstractions";
+import { AnonLayoutWrapperDataService } from "../anon-layout/anon-layout-wrapper-data.service";
+
+import {
+  UnlockOption,
+  LockComponentService,
+  UnlockOptions,
+  UnlockOptionValue,
+} from "./lock-component.service";
+
+const BroadcasterSubscriptionId = "LockComponent";
+
+const clientTypeToSuccessRouteRecord: Partial<Record<ClientType, string>> = {
+  [ClientType.Web]: "vault",
+  [ClientType.Desktop]: "vault",
+  [ClientType.Browser]: "/tabs/current",
+};
+
+@Component({
+  selector: "bit-lock",
+  templateUrl: "lock.component.html",
+  standalone: true,
+  imports: [
+    CommonModule,
+    JslibModule,
+    ReactiveFormsModule,
+    ButtonModule,
+    FormFieldModule,
+    AsyncActionsModule,
+    IconButtonModule,
+  ],
+})
+export class LockV2Component implements OnInit, OnDestroy {
+  private destroy$ = new Subject<void>();
+
+  activeAccount: { id: UserId | undefined } & AccountInfo;
+
+  clientType: ClientType;
+  ClientType = ClientType;
+
+  unlockOptions: UnlockOptions = null;
+
+  UnlockOption = UnlockOption;
+
+  private _activeUnlockOptionBSubject: BehaviorSubject<UnlockOptionValue> =
+    new BehaviorSubject<UnlockOptionValue>(null);
+
+  activeUnlockOption$ = this._activeUnlockOptionBSubject.asObservable();
+
+  set activeUnlockOption(value: UnlockOptionValue) {
+    this._activeUnlockOptionBSubject.next(value);
+  }
+
+  get activeUnlockOption(): UnlockOptionValue {
+    return this._activeUnlockOptionBSubject.value;
+  }
+
+  private invalidPinAttempts = 0;
+
+  biometricUnlockBtnText: string;
+
+  // masterPassword = "";
+  showPassword = false;
+  private enforcedMasterPasswordOptions: MasterPasswordPolicyOptions = undefined;
+
+  forcePasswordResetRoute = "update-temp-password";
+
+  formGroup: FormGroup;
+
+  // Desktop properties:
+  private deferFocus: boolean = null;
+  private biometricAsked = false;
+
+  // Browser extension properties:
+  private isInitialLockScreen = (window as any).previousPopupUrl == null;
+
+  defaultUnlockOptionSetForUser = false;
+
+  unlockingViaBiometrics = false;
+
+  constructor(
+    private accountService: AccountService,
+    private pinService: PinServiceAbstraction,
+    private userVerificationService: UserVerificationService,
+    private cryptoService: CryptoService,
+    private platformUtilsService: PlatformUtilsService,
+    private router: Router,
+    private dialogService: DialogService,
+    private messagingService: MessagingService,
+    private biometricStateService: BiometricStateService,
+    private ngZone: NgZone,
+    private i18nService: I18nService,
+    private masterPasswordService: InternalMasterPasswordServiceAbstraction,
+    private logService: LogService,
+    private deviceTrustService: DeviceTrustServiceAbstraction,
+    private syncService: SyncService,
+    private policyService: InternalPolicyService,
+    private passwordStrengthService: PasswordStrengthServiceAbstraction,
+    private formBuilder: FormBuilder,
+    private toastService: ToastService,
+
+    private lockComponentService: LockComponentService,
+    private anonLayoutWrapperDataService: AnonLayoutWrapperDataService,
+
+    // desktop deps
+    private broadcasterService: BroadcasterService,
+  ) {}
+
+  async ngOnInit() {
+    this.listenForActiveUnlockOptionChanges();
+
+    // Listen for active account changes
+    this.listenForActiveAccountChanges();
+
+    // Identify client
+    this.clientType = this.platformUtilsService.getClientType();
+
+    if (this.clientType === "desktop") {
+      await this.desktopOnInit();
+    }
+  }
+
+  // Base component methods
+  private listenForActiveUnlockOptionChanges() {
+    this.activeUnlockOption$
+      .pipe(takeUntil(this.destroy$))
+      .subscribe((activeUnlockOption: UnlockOptionValue) => {
+        if (activeUnlockOption === UnlockOption.Pin) {
+          this.buildPinForm();
+        } else if (activeUnlockOption === UnlockOption.MasterPassword) {
+          this.buildMasterPasswordForm();
+        }
+      });
+  }
+
+  private buildMasterPasswordForm() {
+    this.formGroup = this.formBuilder.group(
+      {
+        masterPassword: ["", [Validators.required]],
+      },
+      { updateOn: "submit" },
+    );
+  }
+
+  private buildPinForm() {
+    this.formGroup = this.formBuilder.group(
+      {
+        pin: ["", [Validators.required]],
+      },
+      { updateOn: "submit" },
+    );
+  }
+
+  private listenForActiveAccountChanges() {
+    this.accountService.activeAccount$
+      .pipe(
+        switchMap((account) => {
+          return this.handleActiveAccountChange(account);
+        }),
+        takeUntil(this.destroy$),
+      )
+      .subscribe();
+  }
+
+  private async handleActiveAccountChange(activeAccount: { id: UserId | undefined } & AccountInfo) {
+    this.activeAccount = activeAccount;
+
+    this.resetDataOnActiveAccountChange();
+
+    this.setEmailAsPageSubtitle(activeAccount.email);
+
+    this.unlockOptions = await firstValueFrom(
+      this.lockComponentService.getAvailableUnlockOptions$(activeAccount.id),
+    );
+
+    this.setDefaultActiveUnlockOption(this.unlockOptions);
+
+    if (this.unlockOptions.biometrics.enabled) {
+      await this.handleBiometricsUnlockEnabled();
+    }
+  }
+
+  private resetDataOnActiveAccountChange() {
+    this.defaultUnlockOptionSetForUser = false;
+    this.unlockOptions = null;
+    this.activeUnlockOption = null;
+    this.formGroup = null; // new form group will be created based on new active unlock option
+
+    // Desktop properties:
+    this.biometricAsked = false;
+  }
+
+  private setEmailAsPageSubtitle(email: string) {
+    this.anonLayoutWrapperDataService.setAnonLayoutWrapperData({
+      pageSubtitle: {
+        subtitle: email,
+        translate: false,
+      },
+    });
+  }
+
+  private setDefaultActiveUnlockOption(unlockOptions: UnlockOptions) {
+    // Priorities should be Biometrics > Pin > Master Password for speed
+    if (unlockOptions.biometrics.enabled) {
+      this.activeUnlockOption = UnlockOption.Biometrics;
+    } else if (unlockOptions.pin.enabled) {
+      this.activeUnlockOption = UnlockOption.Pin;
+    } else if (unlockOptions.masterPassword.enabled) {
+      this.activeUnlockOption = UnlockOption.MasterPassword;
+    }
+  }
+
+  private async handleBiometricsUnlockEnabled() {
+    this.biometricUnlockBtnText = this.lockComponentService.getBiometricsUnlockBtnText();
+
+    const autoPromptBiometrics = await firstValueFrom(
+      this.biometricStateService.promptAutomatically$,
+    );
+
+    // TODO: PM-12546 - we need to make our biometric autoprompt experience consistent between the
+    // desktop and extension.
+    if (this.clientType === "desktop") {
+      if (autoPromptBiometrics) {
+        await this.desktopAutoPromptBiometrics();
+      }
+    }
+
+    if (this.clientType === "browser") {
+      if (
+        this.unlockOptions.biometrics.enabled &&
+        autoPromptBiometrics &&
+        this.isInitialLockScreen // only autoprompt biometrics on initial lock screen
+      ) {
+        await this.unlockViaBiometrics();
+      }
+    }
+  }
+
+  // Note: this submit method is only used for unlock methods that require a form and user input.
+  // For biometrics unlock, the method is called directly.
+  submit = async (): Promise<void> => {
+    if (this.activeUnlockOption === UnlockOption.Pin) {
+      return await this.unlockViaPin();
+    }
+
+    await this.unlockViaMasterPassword();
+  };
+
+  async logOut() {
+    const confirmed = await this.dialogService.openSimpleDialog({
+      title: { key: "logOut" },
+      content: { key: "logOutConfirmation" },
+      acceptButtonText: { key: "logOut" },
+      type: "warning",
+    });
+
+    if (confirmed) {
+      this.messagingService.send("logout", { userId: this.activeAccount.id });
+    }
+  }
+
+  async unlockViaBiometrics(): Promise<void> {
+    this.unlockingViaBiometrics = true;
+
+    if (!this.unlockOptions.biometrics.enabled) {
+      this.unlockingViaBiometrics = false;
+      return;
+    }
+
+    try {
+      await this.biometricStateService.setUserPromptCancelled();
+      const userKey = await this.cryptoService.getUserKeyFromStorage(
+        KeySuffixOptions.Biometric,
+        this.activeAccount.id,
+      );
+
+      // If user cancels biometric prompt, userKey is undefined.
+      if (userKey) {
+        await this.setUserKeyAndContinue(userKey, false);
+      }
+
+      this.unlockingViaBiometrics = false;
+    } catch (e) {
+      // Cancelling is a valid action.
+      if (e?.message === "canceled") {
+        this.unlockingViaBiometrics = false;
+        return;
+      }
+
+      let biometricTranslatedErrorDesc;
+
+      if (this.clientType === "browser") {
+        const biometricErrorDescTranslationKey = this.lockComponentService.getBiometricsError(e);
+
+        if (biometricErrorDescTranslationKey) {
+          biometricTranslatedErrorDesc = this.i18nService.t(biometricErrorDescTranslationKey);
+        }
+      }
+
+      // if no translation key found, show generic error message
+      if (!biometricTranslatedErrorDesc) {
+        biometricTranslatedErrorDesc = this.i18nService.t("unexpectedError");
+      }
+
+      const confirmed = await this.dialogService.openSimpleDialog({
+        title: { key: "error" },
+        content: biometricTranslatedErrorDesc,
+        acceptButtonText: { key: "tryAgain" },
+        type: "danger",
+      });
+
+      if (confirmed) {
+        // try again
+        await this.unlockViaBiometrics();
+      }
+
+      this.unlockingViaBiometrics = false;
+    }
+  }
+
+  togglePassword() {
+    this.showPassword = !this.showPassword;
+    const input = document.getElementById(
+      this.unlockOptions.pin.enabled ? "pin" : "masterPassword",
+    );
+    if (this.ngZone.isStable) {
+      input.focus();
+    } else {
+      // eslint-disable-next-line rxjs-angular/prefer-takeuntil
+      this.ngZone.onStable.pipe(take(1)).subscribe(() => input.focus());
+    }
+  }
+
+  private validatePin(): boolean {
+    if (this.formGroup.invalid) {
+      this.toastService.showToast({
+        variant: "error",
+        title: this.i18nService.t("errorOccurred"),
+        message: this.i18nService.t("pinRequired"),
+      });
+      return false;
+    }
+
+    return true;
+  }
+
+  private async unlockViaPin() {
+    if (!this.validatePin()) {
+      return;
+    }
+
+    const pin = this.formGroup.controls.pin.value;
+
+    const MAX_INVALID_PIN_ENTRY_ATTEMPTS = 5;
+
+    try {
+      const userKey = await this.pinService.decryptUserKeyWithPin(pin, this.activeAccount.id);
+
+      if (userKey) {
+        await this.setUserKeyAndContinue(userKey);
+        return; // successfully unlocked
+      }
+
+      // Failure state: invalid PIN or failed decryption
+      this.invalidPinAttempts++;
+
+      // Log user out if they have entered an invalid PIN too many times
+      if (this.invalidPinAttempts >= MAX_INVALID_PIN_ENTRY_ATTEMPTS) {
+        this.toastService.showToast({
+          variant: "error",
+          title: null,
+          message: this.i18nService.t("tooManyInvalidPinEntryAttemptsLoggingOut"),
+        });
+        this.messagingService.send("logout");
+        return;
+      }
+
+      this.toastService.showToast({
+        variant: "error",
+        title: this.i18nService.t("errorOccurred"),
+        message: this.i18nService.t("invalidPin"),
+      });
+    } catch {
+      this.toastService.showToast({
+        variant: "error",
+        title: this.i18nService.t("errorOccurred"),
+        message: this.i18nService.t("unexpectedError"),
+      });
+    }
+  }
+
+  private validateMasterPassword(): boolean {
+    if (this.formGroup.invalid) {
+      this.toastService.showToast({
+        variant: "error",
+        title: this.i18nService.t("errorOccurred"),
+        message: this.i18nService.t("masterPasswordRequired"),
+      });
+      return false;
+    }
+
+    return true;
+  }
+
+  private async unlockViaMasterPassword() {
+    if (!this.validateMasterPassword()) {
+      return;
+    }
+
+    const masterPassword = this.formGroup.controls.masterPassword.value;
+
+    const verification = {
+      type: VerificationType.MasterPassword,
+      secret: masterPassword,
+    } as MasterPasswordVerification;
+
+    let passwordValid = false;
+    let masterPasswordVerificationResponse: MasterPasswordVerificationResponse;
+    try {
+      masterPasswordVerificationResponse =
+        await this.userVerificationService.verifyUserByMasterPassword(
+          verification,
+          this.activeAccount.id,
+          this.activeAccount.email,
+        );
+
+      this.enforcedMasterPasswordOptions = MasterPasswordPolicyOptions.fromResponse(
+        masterPasswordVerificationResponse.policyOptions,
+      );
+      passwordValid = true;
+    } catch (e) {
+      this.logService.error(e);
+    }
+
+    if (!passwordValid) {
+      this.toastService.showToast({
+        variant: "error",
+        title: this.i18nService.t("errorOccurred"),
+        message: this.i18nService.t("invalidMasterPassword"),
+      });
+      return;
+    }
+
+    const userKey = await this.masterPasswordService.decryptUserKeyWithMasterKey(
+      masterPasswordVerificationResponse.masterKey,
+    );
+    await this.setUserKeyAndContinue(userKey, true);
+  }
+
+  private async setUserKeyAndContinue(key: UserKey, evaluatePasswordAfterUnlock = false) {
+    await this.cryptoService.setUserKey(key, this.activeAccount.id);
+
+    // Now that we have a decrypted user key in memory, we can check if we
+    // need to establish trust on the current device
+    await this.deviceTrustService.trustDeviceIfRequired(this.activeAccount.id);
+
+    await this.doContinue(evaluatePasswordAfterUnlock);
+  }
+
+  private async doContinue(evaluatePasswordAfterUnlock: boolean) {
+    await this.biometricStateService.resetUserPromptCancelled();
+    this.messagingService.send("unlocked");
+
+    if (evaluatePasswordAfterUnlock) {
+      try {
+        // If we do not have any saved policies, attempt to load them from the service
+        if (this.enforcedMasterPasswordOptions == undefined) {
+          this.enforcedMasterPasswordOptions = await firstValueFrom(
+            this.policyService.masterPasswordPolicyOptions$(),
+          );
+        }
+
+        if (this.requirePasswordChange()) {
+          const userId = (await firstValueFrom(this.accountService.activeAccount$))?.id;
+          await this.masterPasswordService.setForceSetPasswordReason(
+            ForceSetPasswordReason.WeakMasterPassword,
+            userId,
+          );
+          await this.router.navigate([this.forcePasswordResetRoute]);
+          return;
+        }
+      } catch (e) {
+        // Do not prevent unlock if there is an error evaluating policies
+        this.logService.error(e);
+      }
+    }
+
+    // Vault can be de-synced since notifications get ignored while locked. Need to check whether sync is required using the sync service.
+    await this.syncService.fullSync(false);
+
+    if (this.clientType === "browser") {
+      const previousUrl = this.lockComponentService.getPreviousUrl();
+      if (previousUrl) {
+        await this.router.navigateByUrl(previousUrl);
+      }
+    }
+
+    // determine success route based on client type
+    const successRoute = clientTypeToSuccessRouteRecord[this.clientType];
+    await this.router.navigate([successRoute]);
+  }
+
+  /**
+   * Checks if the master password meets the enforced policy requirements
+   * If not, returns false
+   */
+  private requirePasswordChange(): boolean {
+    if (
+      this.enforcedMasterPasswordOptions == undefined ||
+      !this.enforcedMasterPasswordOptions.enforceOnLogin
+    ) {
+      return false;
+    }
+
+    const masterPassword = this.formGroup.controls.masterPassword.value;
+
+    const passwordStrength = this.passwordStrengthService.getPasswordStrength(
+      masterPassword,
+      this.activeAccount.email,
+    )?.score;
+
+    return !this.policyService.evaluateMasterPassword(
+      passwordStrength,
+      masterPassword,
+      this.enforcedMasterPasswordOptions,
+    );
+  }
+
+  // -----------------------------------------------------------------------------------------------
+  // Desktop methods:
+  // -----------------------------------------------------------------------------------------------
+
+  async desktopOnInit() {
+    // TODO: move this into a WindowService and subscribe to messages via MessageListener service.
+    this.broadcasterService.subscribe(BroadcasterSubscriptionId, async (message: any) => {
+      this.ngZone.run(() => {
+        switch (message.command) {
+          case "windowHidden":
+            this.onWindowHidden();
+            break;
+          case "windowIsFocused":
+            if (this.deferFocus === null) {
+              this.deferFocus = !message.windowIsFocused;
+              if (!this.deferFocus) {
+                this.focusInput();
+              }
+            } else if (this.deferFocus && message.windowIsFocused) {
+              this.focusInput();
+              this.deferFocus = false;
+            }
+            break;
+          default:
+        }
+      });
+    });
+    this.messagingService.send("getWindowIsFocused");
+  }
+
+  private async desktopAutoPromptBiometrics() {
+    if (!this.unlockOptions?.biometrics?.enabled || this.biometricAsked) {
+      return;
+    }
+
+    // prevent the biometric prompt from showing if the user has already cancelled it
+    if (await firstValueFrom(this.biometricStateService.promptCancelled$)) {
+      return;
+    }
+
+    const windowVisible = await this.lockComponentService.isWindowVisible();
+
+    if (windowVisible) {
+      this.biometricAsked = true;
+      await this.unlockViaBiometrics();
+    }
+  }
+
+  onWindowHidden() {
+    this.showPassword = false;
+  }
+
+  private focusInput() {
+    if (this.unlockOptions) {
+      document.getElementById(this.unlockOptions.pin.enabled ? "pin" : "masterPassword")?.focus();
+    }
+  }
+
+  // -----------------------------------------------------------------------------------------------
+
+  ngOnDestroy() {
+    this.destroy$.next();
+    this.destroy$.complete();
+
+    if (this.clientType === "desktop") {
+      this.broadcasterService.unsubscribe(BroadcasterSubscriptionId);
+    }
+  }
+}

libs/common/src/enums/feature-flag.enum.ts

@@ -9,7 +9,6 @@ export enum FeatureFlag {
   GeneratorToolsModernization = "generator-tools-modernization",
   EnableConsolidatedBilling = "enable-consolidated-billing",
   AC1795_UpdatedSubscriptionStatusSection = "AC-1795_updated-subscription-status-section",
-  EnableDeleteProvider = "AC-1218-delete-provider",
   ExtensionRefresh = "extension-refresh",
   PersistPopupView = "persist-popup-view",
   PM4154_BulkEncryptionService = "PM-4154-bulk-encryption-service",
@@ -54,7 +53,6 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.GeneratorToolsModernization]: FALSE,
   [FeatureFlag.EnableConsolidatedBilling]: FALSE,
   [FeatureFlag.AC1795_UpdatedSubscriptionStatusSection]: FALSE,
-  [FeatureFlag.EnableDeleteProvider]: FALSE,
   [FeatureFlag.ExtensionRefresh]: FALSE,
   [FeatureFlag.PersistPopupView]: FALSE,
   [FeatureFlag.PM4154_BulkEncryptionService]: FALSE,

libs/common/src/tools/send/services/send-api.service.abstraction.ts

@@ -36,5 +36,5 @@ export abstract class SendApiService {
   renewSendFileUploadUrl: (sendId: string, fileId: string) => Promise<SendFileUploadDataResponse>;
   removePassword: (id: string) => Promise<any>;
   delete: (id: string) => Promise<any>;
-  save: (sendData: [Send, EncArrayBuffer]) => Promise<any>;
+  save: (sendData: [Send, EncArrayBuffer]) => Promise<Send>;
 }

libs/common/src/tools/send/services/send-api.service.ts

@@ -135,11 +135,12 @@ export class SendApiService implements SendApiServiceAbstraction {
     return this.apiService.send("DELETE", "/sends/" + id, null, true, false);
   }
 
-  async save(sendData: [Send, EncArrayBuffer]): Promise<any> {
+  async save(sendData: [Send, EncArrayBuffer]): Promise<Send> {
     const response = await this.upload(sendData);
 
     const data = new SendData(response);
     await this.sendService.upsert(data);
+    return new Send(data);
   }
 
   async delete(id: string): Promise<any> {

libs/tools/send/send-ui/src/send-form/components/options/send-options.component.html

@@ -35,6 +35,7 @@
         bitIconButton="bwi-clone"
         bitSuffix
         [appA11yTitle]="'copyPassword' | i18n"
+        [disabled]="!sendOptionsForm.get('password').value"
         [valueLabel]="'password' | i18n"
         [appCopyClick]="sendOptionsForm.get('password').value"
         showToast

libs/tools/send/send-ui/src/send-form/components/send-form.component.ts

@@ -85,9 +85,14 @@ export class SendFormComponent implements AfterViewInit, OnInit, OnChanges, Send
   submitBtn?: ButtonComponent;
 
   /**
-   * Event emitted when the send is saved successfully.
+   * Event emitted when the send is created successfully.
    */
-  @Output() sendSaved = new EventEmitter<SendView>();
+  @Output() onSendCreated = new EventEmitter<SendView>();
+
+  /**
+   * Event emitted when the send is updated successfully.
+   */
+  @Output() onSendUpdated = new EventEmitter<SendView>();
 
   /**
    * The original send being edited or cloned. Null for add mode.
@@ -200,22 +205,26 @@ export class SendFormComponent implements AfterViewInit, OnInit, OnChanges, Send
       return;
     }
 
+    const sendView = await this.addEditFormService.saveSend(
+      this.updatedSendView,
+      this.file,
+      this.config,
+    );
+
+    if (this.config.mode === "add") {
+      this.onSendCreated.emit(sendView);
+      return;
+    }
+
     if (Utils.isNullOrWhitespace(this.updatedSendView.password)) {
       this.updatedSendView.password = null;
     }
 
-    await this.addEditFormService.saveSend(this.updatedSendView, this.file, this.config);
-
     this.toastService.showToast({
       variant: "success",
       title: null,
-      message: this.i18nService.t(
-        this.config.mode === "edit" || this.config.mode === "partial-edit"
-          ? "editedItem"
-          : "addedItem",
-      ),
+      message: this.i18nService.t("editedItem"),
     });
-
-    this.sendSaved.emit(this.updatedSendView);
+    this.onSendUpdated.emit(this.updatedSendView);
   };
 }

libs/tools/send/send-ui/src/send-form/services/default-send-form.service.ts

@@ -19,6 +19,7 @@ export class DefaultSendFormService implements SendFormService {
 
   async saveSend(send: SendView, file: File | ArrayBuffer, config: SendFormConfig) {
     const sendData = await this.sendService.encrypt(send, file, send.password, null);
-    return await this.sendApiService.save(sendData);
+    const newSend = await this.sendApiService.save(sendData);
+    return await this.decryptSend(newSend);
   }
 }