bitwarden/browser
1
0
Fork 0
mirror of https://github.com/bitwarden/browser synced 2025-12-06 00:13:28 +00:00
Code Issues Releases Wiki Activity

[PM-25131] Initialize provider keys on the SDK (#16183)

Browse Source 
* [PM-25131] Initialize provider keys on the SDK

* Remove null default

* Typechecking
This commit is contained in:
Daniel García
2025-09-04 19:37:40 +02:00
committed by GitHub
parent 9946f61296
commit bff18a8cd2
3 changed files with 55 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libs/key-management/src/abstractions/key.service.ts
View File

@@ -1,6 +1,5 @@
import { Observable } from "rxjs";
import { EncryptedOrganizationKeyData } from "@bitwarden/common/admin-console/models/data/encrypted-organization-key.data";
import { ProfileOrganizationResponse } from "@bitwarden/common/admin-console/models/response/profile-organization.response";
import { ProfileProviderOrganizationResponse } from "@bitwarden/common/admin-console/models/response/profile-provider-organization.response";
import { ProfileProviderResponse } from "@bitwarden/common/admin-console/models/response/profile-provider.response";
@@ -406,9 +405,7 @@ export abstract class KeyService {
* @deprecated Temporary function to allow the SDK to be initialized after the login process, it
* will be removed when auth has been migrated to the SDK.
*/
abstract encryptedOrgKeys$(
userId: UserId,
): Observable<Record<OrganizationId, EncryptedOrganizationKeyData> | null>;
abstract encryptedOrgKeys$(userId: UserId): Observable<Record<OrganizationId, EncString>>;
/**
* Gets an observable stream of the users public key. If the user is does not have

55
libs/key-management/src/key.service.ts
View File

@@ -907,10 +907,57 @@ export class DefaultKeyService implements KeyServiceAbstraction {
return this.cipherDecryptionKeys$(userId).pipe(map((keys) => keys?.orgKeys ?? null));
}
encryptedOrgKeys$(
userId: UserId,
): Observable<Record<OrganizationId, EncryptedOrganizationKeyData> | null> {
return this.stateProvider.getUser(userId, USER_ENCRYPTED_ORGANIZATION_KEYS).state$;
encryptedOrgKeys$(userId: UserId): Observable<Record<OrganizationId, EncString>> {
return this.userPrivateKey$(userId)?.pipe(
switchMap((userPrivateKey) => {
if (userPrivateKey == null) {
// We can't do any org based decryption
return of({});
}
return combineLatest([
this.stateProvider.getUser(userId, USER_ENCRYPTED_ORGANIZATION_KEYS).state$,
this.providerKeysHelper$(userId, userPrivateKey),
]).pipe(
switchMap(async ([encryptedOrgKeys, providerKeys]) => {
const userPubKey = await this.derivePublicKey(userPrivateKey);
const result: Record<OrganizationId, EncString> = {};
encryptedOrgKeys = encryptedOrgKeys ?? {};
for (const orgId of Object.keys(encryptedOrgKeys) as OrganizationId[]) {
if (result[orgId] != null) {
continue;
}
const encrypted = BaseEncryptedOrganizationKey.fromData(encryptedOrgKeys[orgId]);
if (encrypted == null) {
continue;
}
let orgKey: EncString;
// Because the SDK only supports user encrypted org keys, we need to re-encrypt
// any provider encrypted org keys with the user's public key. This should be removed
// once the SDK has support for provider keys.
if (BaseEncryptedOrganizationKey.isProviderEncrypted(encrypted)) {
if (providerKeys == null) {
continue;
}
orgKey = await this.encryptService.encapsulateKeyUnsigned(
await encrypted.decrypt(this.encryptService, providerKeys!),
userPubKey!,
);
} else {
orgKey = encrypted.encryptedOrganizationKey;
}
result[orgId] = orgKey;
}
return result;
}),
);
}),
);
}
cipherDecryptionKeys$(userId: UserId): Observable<CipherDecryptionKeys | null> {