bitwarden/browser
1
0
Fork 0
mirror of https://github.com/bitwarden/browser synced 2025-12-10 21:33:27 +00:00
Code Issues Releases Wiki Activity

[PM-25131] Initialize provider keys on the SDK (#16183)

Browse Source 
* [PM-25131] Initialize provider keys on the SDK

* Remove null default

* Typechecking
This commit is contained in:
Daniel García
2025-09-04 19:37:40 +02:00
committed by GitHub
parent 9946f61296
commit bff18a8cd2
3 changed files with 55 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libs/common/src/platform/services/sdk/default-sdk.service.ts
View File

@@ -27,10 +27,9 @@ import {
UnsignedSharedKey,
} from "@bitwarden/sdk-internal";
import { EncryptedOrganizationKeyData } from "../../../admin-console/models/data/encrypted-organization-key.data";
import { AccountInfo, AccountService } from "../../../auth/abstractions/account.service";
import { DeviceType } from "../../../enums/device-type.enum";
import { EncryptedString } from "../../../key-management/crypto/models/enc-string";
import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
import { OrganizationId, UserId } from "../../../types/guid";
import { UserKey } from "../../../types/key";
import { Environment, EnvironmentService } from "../../abstractions/environment.service";
@@ -220,7 +219,7 @@ export class DefaultSdkService implements SdkService {
kdfParams: KdfConfig,
privateKey: EncryptedString,
userKey: UserKey,
orgKeys: Record<OrganizationId, EncryptedOrganizationKeyData> | null,
orgKeys: Record<OrganizationId, EncString>,
) {
await client.crypto().initialize_user_crypto({
userId: asUuid(userId),
@@ -245,9 +244,7 @@ export class DefaultSdkService implements SdkService {
// null to make sure any existing org keys are cleared.
await client.crypto().initialize_org_crypto({
organizationKeys: new Map(
Object.entries(orgKeys ?? {})
.filter(([_, v]) => v.type === "organization")
.map(([k, v]) => [asUuid(k), v.key as UnsignedSharedKey]),
Object.entries(orgKeys).map(([k, v]) => [asUuid(k), v.toJSON() as UnsignedSharedKey]),
),
});

5
libs/key-management/src/abstractions/key.service.ts
View File

@@ -1,6 +1,5 @@
import { Observable } from "rxjs";
import { EncryptedOrganizationKeyData } from "@bitwarden/common/admin-console/models/data/encrypted-organization-key.data";
import { ProfileOrganizationResponse } from "@bitwarden/common/admin-console/models/response/profile-organization.response";
import { ProfileProviderOrganizationResponse } from "@bitwarden/common/admin-console/models/response/profile-provider-organization.response";
import { ProfileProviderResponse } from "@bitwarden/common/admin-console/models/response/profile-provider.response";
@@ -406,9 +405,7 @@ export abstract class KeyService {
* @deprecated Temporary function to allow the SDK to be initialized after the login process, it
* will be removed when auth has been migrated to the SDK.
*/
abstract encryptedOrgKeys$(
userId: UserId,
): Observable<Record<OrganizationId, EncryptedOrganizationKeyData> | null>;
abstract encryptedOrgKeys$(userId: UserId): Observable<Record<OrganizationId, EncString>>;
/**
* Gets an observable stream of the users public key. If the user is does not have

55
libs/key-management/src/key.service.ts
View File

@@ -907,10 +907,57 @@ export class DefaultKeyService implements KeyServiceAbstraction {
return this.cipherDecryptionKeys$(userId).pipe(map((keys) => keys?.orgKeys ?? null));
}
encryptedOrgKeys$(
userId: UserId,
): Observable<Record<OrganizationId, EncryptedOrganizationKeyData> | null> {
return this.stateProvider.getUser(userId, USER_ENCRYPTED_ORGANIZATION_KEYS).state$;
encryptedOrgKeys$(userId: UserId): Observable<Record<OrganizationId, EncString>> {
return this.userPrivateKey$(userId)?.pipe(
switchMap((userPrivateKey) => {
if (userPrivateKey == null) {
// We can't do any org based decryption
return of({});
}
return combineLatest([
this.stateProvider.getUser(userId, USER_ENCRYPTED_ORGANIZATION_KEYS).state$,
this.providerKeysHelper$(userId, userPrivateKey),
]).pipe(
switchMap(async ([encryptedOrgKeys, providerKeys]) => {
const userPubKey = await this.derivePublicKey(userPrivateKey);
const result: Record<OrganizationId, EncString> = {};
encryptedOrgKeys = encryptedOrgKeys ?? {};
for (const orgId of Object.keys(encryptedOrgKeys) as OrganizationId[]) {
if (result[orgId] != null) {
continue;
}
const encrypted = BaseEncryptedOrganizationKey.fromData(encryptedOrgKeys[orgId]);
if (encrypted == null) {
continue;
}
let orgKey: EncString;
// Because the SDK only supports user encrypted org keys, we need to re-encrypt
// any provider encrypted org keys with the user's public key. This should be removed
// once the SDK has support for provider keys.
if (BaseEncryptedOrganizationKey.isProviderEncrypted(encrypted)) {
if (providerKeys == null) {
continue;
}
orgKey = await this.encryptService.encapsulateKeyUnsigned(
await encrypted.decrypt(this.encryptService, providerKeys!),
userPubKey!,
);
} else {
orgKey = encrypted.encryptedOrganizationKey;
}
result[orgId] = orgKey;
}
return result;
}),
);
}),
);
}
cipherDecryptionKeys$(userId: UserId): Observable<CipherDecryptionKeys | null> {