Auth/PM-5268 - DeviceTrustCryptoService state provider migration (#7882)

* PM-5268 - Add DEVICE_TRUST_DISK to state definitions

* PM-5268 - DeviceTrustCryptoService - Get most of state provider refactor done - WIP - commented out stuff for now.

* PM-5268 - DeviceTrustCryptoServiceStateProviderMigrator - WIP - got first draft of migrator in place and working on tests. Rollback tests are failing for some reason TBD.

* PM-5268 - more WIP on device trust crypto service migrator tests

* PM-5268 - DeviceTrustCryptoServiceStateProviderMigrator - Refactor based on call with platform

* PM-5268 - DeviceTrustCryptoServiceStateProviderMigrator - tests passing

* PM-5268 - Update DeviceTrustCryptoService to convert over to state providers + update all service instantiations / dependencies to ensure state provider is passed in or injected.

* PM-5268 - Register new migration

* PM-5268 - Temporarily remove device trust crypto service from migrator to ease merge conflicts as there are 6 more migrators before I can apply mine in main.

* PM-5268 - Update migration numbers of DeviceTrustCryptoServiceStateProviderMigrator based on latest migrations from main.

* PM-5268 - (1) Export new KeyDefinitions from DeviceTrustCryptoService for use in test suite (2) Update DeviceTrustCryptoService test file to use state provider.

* PM-5268 - Fix DeviceTrustCryptoServiceStateProviderMigrator tests to use proper versions

* PM-5268 - Actually fix all instances of DeviceTrustCryptoServiceStateProviderMigrator test failures

* PM-5268 - Clean up state service, account, and login strategy of all migrated references

* PM-5268 - Account - finish cleaning up device key

* PM-5268 - StateService - clean up last reference to device key

* PM-5268 - Remove even more device key refs. *facepalm*

* PM-5268 - Finish resolving merge conflicts by incrementing migration version from 22 to 23

* PM-5268 - bump migration versions

* PM-5268 - DeviceTrustCryptoService - Implement secure storage functionality for getDeviceKey and setDeviceKey (to achieve feature parity with the ElectronStateService implementation prior to the state provider migration). Tests to follow shortly.

* PM-5268 - DeviceTrustCryptoService tests - getDeviceKey now tested with all new secure storage scenarios. SetDeviceKey tests to follow.

* PM-5268 - DeviceTrustCryptoService tests - test all setDeviceKey scenarios with state provider & secure storage

* PM-5268 - Update DeviceTrustCryptoService deps to actually use secure storage svc on platforms that support it.

* PM-5268 - Bump migration version due to merge conflicts.

* PM-5268 - Bump migration version

* PM-5268 - tweak jsdocs to be single line per PR feedback

* PM-5268 - DeviceTrustCryptoSvc - improve debuggability.

* PM-5268 - Remove state service as a dependency on the device trust crypto service (woo!)

* PM-5268 - Update migration test json to correctly reflect reality.

* PM-5268 - DeviceTrustCryptoSvc - getDeviceKey - add throw error for active user id missing.

* PM-5268 - Fix tests

* PM-5268 - WIP start on adding user id to every method on device trust crypto service.

* PM-5268 - Update lock comp dependencies across clients

* PM-5268 - Update login via auth request deps across clients to add acct service.

* PM-5268 - UserKeyRotationSvc - add acct service to get active acct id for call to rotateDevicesTrust and then update tests.

* PM-5268 - WIP on trying to fix device trust crypto svc tests.

* PM-5268 - More WIP device trust crypto svc tests passing

* PM-5268 - Device Trust crypto service - get all tests passing

* PM-5268 - DeviceTrustCryptoService.getDeviceKey - fix secure storage b64 to symmetric crypto key conversion

* PM-5268 - Add more tests and update test names

* PM-5268 - rename state to indicate it was disk local

* PM-5268 - DeviceTrustCryptoService - save symmetric key in JSON format

* PM-5268 - Fix lock comp tests by adding acct service dep

* PM-5268 - Update set device key tests to pass

* PM-5268 - Bump migration versions again

* PM-5268 - Fix user key rotation svc tests

* PM-5268 - Update web jest config to allow use of common spec in user-key-rotation-svc tests

* PM-5268 - Bump migration version

* PM-5268 - Per PR feedback, save off user id

* PM-5268 - bump migration version

* PM-5268 - Per PR feedback, remove unnecessary await.

* PM-5268 - Bump migration verson

libs/common/src/state-migrations/migrate.ts

@@ -49,6 +49,7 @@ import { AddKeyTypeToOrgKeysMigrator } from "./migrations/5-add-key-type-to-org-
 import { KeyConnectorMigrator } from "./migrations/50-move-key-connector-to-state-provider";
 import { RememberedEmailMigrator } from "./migrations/51-move-remembered-email-to-state-providers";
 import { DeleteInstalledVersion } from "./migrations/52-delete-installed-version";
+import { DeviceTrustCryptoServiceStateProviderMigrator } from "./migrations/53-migrate-device-trust-crypto-svc-to-state-providers";
 import { RemoveLegacyEtmKeyMigrator } from "./migrations/6-remove-legacy-etm-key";
 import { MoveBiometricAutoPromptToAccount } from "./migrations/7-move-biometric-auto-prompt-to-account";
 import { MoveStateVersionMigrator } from "./migrations/8-move-state-version";
@@ -56,8 +57,7 @@ import { MoveBrowserSettingsToGlobal } from "./migrations/9-move-browser-setting
 import { MinVersionMigrator } from "./migrations/min-version";
 
 export const MIN_VERSION = 3;
-export const CURRENT_VERSION = 52;
-
+export const CURRENT_VERSION = 53;
 export type MinVersion = typeof MIN_VERSION;
 
 export function createMigrationBuilder() {
@@ -111,7 +111,8 @@ export function createMigrationBuilder() {
     .with(AccountServerConfigMigrator, 48, 49)
     .with(KeyConnectorMigrator, 49, 50)
     .with(RememberedEmailMigrator, 50, 51)
-    .with(DeleteInstalledVersion, 51, CURRENT_VERSION);
+    .with(DeleteInstalledVersion, 51, 52)
+    .with(DeviceTrustCryptoServiceStateProviderMigrator, 52, CURRENT_VERSION);
 }
 
 export async function currentVersion(

libs/common/src/state-migrations/migrations/53-migrate-device-trust-crypto-svc-to-state-providers.spec.ts

@@ -0,0 +1,171 @@
+import { MockProxy, any } from "jest-mock-extended";
+
+import { MigrationHelper } from "../migration-helper";
+import { mockMigrationHelper } from "../migration-helper.spec";
+
+import {
+  DEVICE_KEY,
+  DeviceTrustCryptoServiceStateProviderMigrator,
+  SHOULD_TRUST_DEVICE,
+} from "./53-migrate-device-trust-crypto-svc-to-state-providers";
+
+// Represents data in state service pre-migration
+function preMigrationJson() {
+  return {
+    global: {
+      otherStuff: "otherStuff1",
+    },
+    authenticatedAccounts: ["user1", "user2", "user3"],
+    user1: {
+      keys: {
+        deviceKey: {
+          keyB64: "user1_deviceKey",
+        },
+        otherStuff: "overStuff2",
+      },
+      settings: {
+        trustDeviceChoiceForDecryption: true,
+        otherStuff: "overStuff3",
+      },
+      otherStuff: "otherStuff4",
+    },
+    user2: {
+      keys: {
+        // no device key
+        otherStuff: "otherStuff5",
+      },
+      settings: {
+        // no trust device choice
+        otherStuff: "overStuff6",
+      },
+      otherStuff: "otherStuff7",
+    },
+  };
+}
+
+function rollbackJSON() {
+  return {
+    // use pattern user_{userId}_{stateDefinitionName}_{keyDefinitionKey} for each user
+    // User1 migrated data
+    user_user1_deviceTrust_deviceKey: {
+      keyB64: "user1_deviceKey",
+    },
+    user_user1_deviceTrust_shouldTrustDevice: true,
+
+    // User2 does not have migrated data
+
+    global: {
+      otherStuff: "otherStuff1",
+    },
+    authenticatedAccounts: ["user1", "user2", "user3"],
+    user1: {
+      keys: {
+        otherStuff: "overStuff2",
+      },
+      settings: {
+        otherStuff: "overStuff3",
+      },
+      otherStuff: "otherStuff4",
+    },
+    user2: {
+      keys: {
+        otherStuff: "otherStuff5",
+      },
+      settings: {
+        otherStuff: "overStuff6",
+      },
+      otherStuff: "otherStuff6",
+    },
+  };
+}
+
+describe("DeviceTrustCryptoServiceStateProviderMigrator", () => {
+  let helper: MockProxy<MigrationHelper>;
+  let sut: DeviceTrustCryptoServiceStateProviderMigrator;
+
+  describe("migrate", () => {
+    beforeEach(() => {
+      helper = mockMigrationHelper(preMigrationJson(), 52);
+      sut = new DeviceTrustCryptoServiceStateProviderMigrator(52, 53);
+    });
+
+    // it should remove deviceKey and trustDeviceChoiceForDecryption from all accounts
+    it("should remove deviceKey and trustDeviceChoiceForDecryption from all accounts that have it", async () => {
+      await sut.migrate(helper);
+      expect(helper.set).toHaveBeenCalledWith("user1", {
+        keys: {
+          otherStuff: "overStuff2",
+        },
+        settings: {
+          otherStuff: "overStuff3",
+        },
+        otherStuff: "otherStuff4",
+      });
+
+      expect(helper.set).toHaveBeenCalledTimes(1);
+      expect(helper.set).not.toHaveBeenCalledWith("user2", any());
+      expect(helper.set).not.toHaveBeenCalledWith("user3", any());
+    });
+
+    it("should migrate deviceKey and trustDeviceChoiceForDecryption to state providers for accounts that have the data", async () => {
+      await sut.migrate(helper);
+
+      expect(helper.setToUser).toHaveBeenCalledWith("user1", DEVICE_KEY, {
+        keyB64: "user1_deviceKey",
+      });
+      expect(helper.setToUser).toHaveBeenCalledWith("user1", SHOULD_TRUST_DEVICE, true);
+
+      expect(helper.setToUser).not.toHaveBeenCalledWith("user2", DEVICE_KEY, any());
+      expect(helper.setToUser).not.toHaveBeenCalledWith("user2", SHOULD_TRUST_DEVICE, any());
+
+      expect(helper.setToUser).not.toHaveBeenCalledWith("user3", DEVICE_KEY, any());
+      expect(helper.setToUser).not.toHaveBeenCalledWith("user3", SHOULD_TRUST_DEVICE, any());
+    });
+  });
+
+  describe("rollback", () => {
+    beforeEach(() => {
+      helper = mockMigrationHelper(rollbackJSON(), 53);
+      sut = new DeviceTrustCryptoServiceStateProviderMigrator(52, 53);
+    });
+
+    it("should null out newly migrated entries in state provider framework", async () => {
+      await sut.rollback(helper);
+
+      expect(helper.setToUser).toHaveBeenCalledWith("user1", DEVICE_KEY, null);
+      expect(helper.setToUser).toHaveBeenCalledWith("user1", SHOULD_TRUST_DEVICE, null);
+
+      expect(helper.setToUser).toHaveBeenCalledWith("user2", DEVICE_KEY, null);
+      expect(helper.setToUser).toHaveBeenCalledWith("user2", SHOULD_TRUST_DEVICE, null);
+
+      expect(helper.setToUser).toHaveBeenCalledWith("user3", DEVICE_KEY, null);
+      expect(helper.setToUser).toHaveBeenCalledWith("user3", SHOULD_TRUST_DEVICE, null);
+    });
+
+    it("should add back deviceKey and trustDeviceChoiceForDecryption to all accounts", async () => {
+      await sut.rollback(helper);
+
+      expect(helper.set).toHaveBeenCalledWith("user1", {
+        keys: {
+          deviceKey: {
+            keyB64: "user1_deviceKey",
+          },
+          otherStuff: "overStuff2",
+        },
+        settings: {
+          trustDeviceChoiceForDecryption: true,
+          otherStuff: "overStuff3",
+        },
+        otherStuff: "otherStuff4",
+      });
+    });
+
+    it("should not add data back if data wasn't migrated or acct doesn't exist", async () => {
+      await sut.rollback(helper);
+
+      // no data to add back for user2 (acct exists but no migrated data) and user3 (no acct)
+      expect(helper.set).not.toHaveBeenCalledWith("user2", any());
+      expect(helper.set).not.toHaveBeenCalledWith("user3", any());
+    });
+  });
+});

libs/common/src/state-migrations/migrations/53-migrate-device-trust-crypto-svc-to-state-providers.ts

@@ -0,0 +1,95 @@
+import { KeyDefinitionLike, MigrationHelper } from "../migration-helper";
+import { Migrator } from "../migrator";
+
+// Types to represent data as it is stored in JSON
+type DeviceKeyJsonType = {
+  keyB64: string;
+};
+
+type ExpectedAccountType = {
+  keys?: {
+    deviceKey?: DeviceKeyJsonType;
+  };
+  settings?: {
+    trustDeviceChoiceForDecryption?: boolean;
+  };
+};
+
+export const DEVICE_KEY: KeyDefinitionLike = {
+  key: "deviceKey", // matches KeyDefinition.key in DeviceTrustCryptoService
+  stateDefinition: {
+    name: "deviceTrust", // matches StateDefinition.name in StateDefinitions
+  },
+};
+
+export const SHOULD_TRUST_DEVICE: KeyDefinitionLike = {
+  key: "shouldTrustDevice",
+  stateDefinition: {
+    name: "deviceTrust",
+  },
+};
+
+export class DeviceTrustCryptoServiceStateProviderMigrator extends Migrator<52, 53> {
+  async migrate(helper: MigrationHelper): Promise<void> {
+    const accounts = await helper.getAccounts<ExpectedAccountType>();
+    async function migrateAccount(userId: string, account: ExpectedAccountType): Promise<void> {
+      let updatedAccount = false;
+
+      // Migrate deviceKey
+      const existingDeviceKey = account?.keys?.deviceKey;
+
+      if (existingDeviceKey != null) {
+        // Only migrate data that exists
+        await helper.setToUser(userId, DEVICE_KEY, existingDeviceKey);
+        delete account.keys.deviceKey;
+        updatedAccount = true;
+      }
+
+      // Migrate shouldTrustDevice
+      const existingShouldTrustDevice = account?.settings?.trustDeviceChoiceForDecryption;
+
+      if (existingShouldTrustDevice != null) {
+        await helper.setToUser(userId, SHOULD_TRUST_DEVICE, existingShouldTrustDevice);
+        delete account.settings.trustDeviceChoiceForDecryption;
+        updatedAccount = true;
+      }
+
+      if (updatedAccount) {
+        // Save the migrated account
+        await helper.set(userId, account);
+      }
+    }
+
+    await Promise.all([...accounts.map(({ userId, account }) => migrateAccount(userId, account))]);
+  }
+
+  async rollback(helper: MigrationHelper): Promise<void> {
+    const accounts = await helper.getAccounts<ExpectedAccountType>();
+    async function rollbackAccount(userId: string, account: ExpectedAccountType): Promise<void> {
+      // Rollback deviceKey
+      const migratedDeviceKey: DeviceKeyJsonType = await helper.getFromUser(userId, DEVICE_KEY);
+
+      if (account?.keys && migratedDeviceKey != null) {
+        account.keys.deviceKey = migratedDeviceKey;
+        await helper.set(userId, account);
+      }
+
+      await helper.setToUser(userId, DEVICE_KEY, null);
+
+      // Rollback shouldTrustDevice
+      const migratedShouldTrustDevice = await helper.getFromUser<boolean>(
+        userId,
+        SHOULD_TRUST_DEVICE,
+      );
+
+      if (account?.settings && migratedShouldTrustDevice != null) {
+        account.settings.trustDeviceChoiceForDecryption = migratedShouldTrustDevice;
+        await helper.set(userId, account);
+      }
+
+      await helper.setToUser(userId, SHOULD_TRUST_DEVICE, null);
+    }
+
+    await Promise.all([...accounts.map(({ userId, account }) => rollbackAccount(userId, account))]);
+  }
+}