Merge branch 'main' into anders/pnpm

libs/common/src/auth/models/domain/auth-result.ts

@@ -7,14 +7,6 @@ import { TwoFactorProviderType } from "../../enums/two-factor-provider-type";
 
 export class AuthResult {
   userId: UserId;
-  // TODO: PM-3287 - Remove this after 3 releases of backwards compatibility. - Target release 2023.12 for removal
-  /**
-   * @deprecated
-   * Replace with using UserDecryptionOptions to determine if the user does
-   * not have a master password and is not using Key Connector.
-   * */
-  resetMasterPassword = false;
-
   twoFactorProviders: Partial<Record<TwoFactorProviderType, Record<string, string>>> = null;
   ssoEmail2FaSessionToken?: string;
   email: string;

libs/common/src/auth/models/response/identity-token.response.spec.ts

@@ -116,4 +116,36 @@ describe("IdentityTokenResponse", () => {
     const identityTokenResponse = new IdentityTokenResponse(response);
     expect(identityTokenResponse.userDecryptionOptions).toBeDefined();
   });
+
+  it("should create response with accountKeys not present", () => {
+    const response = {
+      access_token: accessToken,
+      token_type: tokenType,
+      AccountKeys: null as unknown,
+    };
+
+    const identityTokenResponse = new IdentityTokenResponse(response);
+    expect(identityTokenResponse.accountKeysResponseModel).toBeNull();
+  });
+
+  it("should create response with accountKeys present", () => {
+    const accountKeysData = {
+      publicKeyEncryptionKeyPair: {
+        publicKey: "testPublicKey",
+        wrappedPrivateKey: "testPrivateKey",
+      },
+    };
+
+    const response = {
+      access_token: accessToken,
+      token_type: tokenType,
+      AccountKeys: accountKeysData,
+    };
+
+    const identityTokenResponse = new IdentityTokenResponse(response);
+    expect(identityTokenResponse.accountKeysResponseModel).toBeDefined();
+    expect(
+      identityTokenResponse.accountKeysResponseModel?.publicKeyEncryptionKeyPair,
+    ).toBeDefined();
+  });
 });

libs/common/src/auth/models/response/identity-token.response.ts

@@ -5,6 +5,7 @@
 import { Argon2KdfConfig, KdfConfig, KdfType, PBKDF2KdfConfig } from "@bitwarden/key-management";
 
 import { EncString } from "../../../key-management/crypto/models/enc-string";
+import { PrivateKeysResponseModel } from "../../../key-management/keys/response/private-keys.response";
 import { BaseResponse } from "../../../models/response/base.response";
 
 import { MasterPasswordPolicyResponse } from "./master-password-policy.response";
@@ -18,8 +19,8 @@ export class IdentityTokenResponse extends BaseResponse {
   tokenType: string;
 
   // Decryption Information
-  resetMasterPassword: boolean;
   privateKey: string; // userKeyEncryptedPrivateKey
+  accountKeysResponseModel: PrivateKeysResponseModel | null = null;
   key?: EncString; // masterKeyEncryptedUserKey
   twoFactorToken: string;
   kdfConfig: KdfConfig;
@@ -52,8 +53,12 @@ export class IdentityTokenResponse extends BaseResponse {
       this.refreshToken = refreshToken;
     }
 
-    this.resetMasterPassword = this.getResponseProperty("ResetMasterPassword");
     this.privateKey = this.getResponseProperty("PrivateKey");
+    if (this.getResponseProperty("AccountKeys") != null) {
+      this.accountKeysResponseModel = new PrivateKeysResponseModel(
+        this.getResponseProperty("AccountKeys"),
+      );
+    }
     const key = this.getResponseProperty("Key");
     if (key) {
       this.key = new EncString(key);

libs/common/src/enums/event-type.enum.ts

@@ -79,6 +79,8 @@ export enum EventType {
   Organization_CollectionManagement_LimitItemDeletionDisabled = 1615,
   Organization_CollectionManagement_AllowAdminAccessToAllCollectionItemsEnabled = 1616,
   Organization_CollectionManagement_AllowAdminAccessToAllCollectionItemsDisabled = 1617,
+  Organization_ItemOrganization_Accepted = 1618,
+  Organization_ItemOrganization_Declined = 1619,
 
   Policy_Updated = 1700,
 

libs/common/src/enums/feature-flag.enum.ts

@@ -22,6 +22,7 @@ export enum FeatureFlag {
   /* Autofill */
   MacOsNativeCredentialSync = "macos-native-credential-sync",
   WindowsDesktopAutotype = "windows-desktop-autotype",
+  WindowsDesktopAutotypeGA = "windows-desktop-autotype-ga",
 
   /* Billing */
   TrialPaymentOptional = "PM-8163-trial-payment",
@@ -29,7 +30,6 @@ export enum FeatureFlag {
   PM24032_NewNavigationPremiumUpgradeButton = "pm-24032-new-navigation-premium-upgrade-button",
   PM25379_UseNewOrganizationMetadataStructure = "pm-25379-use-new-organization-metadata-structure",
   PM24996_ImplementUpgradeFromFreeDialog = "pm-24996-implement-upgrade-from-free-dialog",
-  PM24033PremiumUpgradeNewDesign = "pm-24033-updat-premium-subscription-page",
   PM26793_FetchPremiumPriceFromPricingService = "pm-26793-fetch-premium-price-from-pricing-service",
   PM23713_PremiumBadgeOpensNewPremiumUpgradeDialog = "pm-23713-premium-badge-opens-new-premium-upgrade-dialog",
   PM26462_Milestone_3 = "pm-26462-milestone-3",
@@ -50,6 +50,8 @@ export enum FeatureFlag {
   DesktopSendUIRefresh = "desktop-send-ui-refresh",
   UseSdkPasswordGenerators = "pm-19976-use-sdk-password-generators",
   ChromiumImporterWithABE = "pm-25855-chromium-importer-abe",
+  SendUIRefresh = "pm-28175-send-ui-refresh",
+  SendEmailOTP = "pm-19051-send-email-verification",
 
   /* DIRT */
   EventManagementForDataDogAndCrowdStrike = "event-management-for-datadog-and-crowdstrike",
@@ -105,11 +107,14 @@ export const DefaultFeatureFlagValue = {
   /* Autofill */
   [FeatureFlag.MacOsNativeCredentialSync]: FALSE,
   [FeatureFlag.WindowsDesktopAutotype]: FALSE,
+  [FeatureFlag.WindowsDesktopAutotypeGA]: FALSE,
 
   /* Tools */
   [FeatureFlag.DesktopSendUIRefresh]: FALSE,
   [FeatureFlag.UseSdkPasswordGenerators]: FALSE,
   [FeatureFlag.ChromiumImporterWithABE]: FALSE,
+  [FeatureFlag.SendUIRefresh]: FALSE,
+  [FeatureFlag.SendEmailOTP]: FALSE,
 
   /* DIRT */
   [FeatureFlag.EventManagementForDataDogAndCrowdStrike]: FALSE,
@@ -136,7 +141,6 @@ export const DefaultFeatureFlagValue = {
   [FeatureFlag.PM24032_NewNavigationPremiumUpgradeButton]: FALSE,
   [FeatureFlag.PM25379_UseNewOrganizationMetadataStructure]: FALSE,
   [FeatureFlag.PM24996_ImplementUpgradeFromFreeDialog]: FALSE,
-  [FeatureFlag.PM24033PremiumUpgradeNewDesign]: FALSE,
   [FeatureFlag.PM26793_FetchPremiumPriceFromPricingService]: FALSE,
   [FeatureFlag.PM23713_PremiumBadgeOpensNewPremiumUpgradeDialog]: FALSE,
   [FeatureFlag.PM26462_Milestone_3]: FALSE,

libs/common/src/key-management/account-cryptography/account-cryptographic-state.service.ts

@@ -0,0 +1,22 @@
+import { Observable } from "rxjs";
+
+import { WrappedAccountCryptographicState } from "@bitwarden/sdk-internal";
+import { UserId } from "@bitwarden/user-core";
+
+export abstract class AccountCryptographicStateService {
+  /**
+   * Emits the provided user's account cryptographic state or null if there is no account cryptographic state present for the user.
+   */
+  abstract accountCryptographicState$(
+    userId: UserId,
+  ): Observable<WrappedAccountCryptographicState | null>;
+
+  /**
+   * Sets the account cryptographic state.
+   * This is not yet validated, and is only validated upon SDK initialization.
+   */
+  abstract setAccountCryptographicState(
+    accountCryptographicState: WrappedAccountCryptographicState,
+    userId: UserId,
+  ): Promise<void>;
+}

libs/common/src/key-management/account-cryptography/default-account-cryptographic-state.service.spec.ts

@@ -0,0 +1,133 @@
+import { firstValueFrom } from "rxjs";
+
+import { WrappedAccountCryptographicState } from "@bitwarden/sdk-internal";
+import { FakeStateProvider } from "@bitwarden/state-test-utils";
+import { UserId } from "@bitwarden/user-core";
+
+import { FakeAccountService, mockAccountServiceWith } from "../../../spec";
+
+import {
+  ACCOUNT_CRYPTOGRAPHIC_STATE,
+  DefaultAccountCryptographicStateService,
+} from "./default-account-cryptographic-state.service";
+
+describe("DefaultAccountCryptographicStateService", () => {
+  let service: DefaultAccountCryptographicStateService;
+  let stateProvider: FakeStateProvider;
+  let accountService: FakeAccountService;
+
+  const mockUserId = "user-id" as UserId;
+
+  beforeEach(() => {
+    accountService = mockAccountServiceWith(mockUserId);
+    stateProvider = new FakeStateProvider(accountService);
+    service = new DefaultAccountCryptographicStateService(stateProvider);
+  });
+
+  describe("accountCryptographicState$", () => {
+    it("returns null when no state is set", async () => {
+      const result = await firstValueFrom(service.accountCryptographicState$(mockUserId));
+      expect(result).toBeNull();
+    });
+
+    it("returns the account cryptographic state when set (V1)", async () => {
+      const mockState: WrappedAccountCryptographicState = {
+        V1: {
+          private_key: "test-wrapped-state" as any,
+        },
+      };
+      await stateProvider.setUserState(ACCOUNT_CRYPTOGRAPHIC_STATE, mockState, mockUserId);
+      const result = await firstValueFrom(service.accountCryptographicState$(mockUserId));
+      expect(result).toEqual(mockState);
+    });
+
+    it("returns the account cryptographic state when set (V2)", async () => {
+      const mockState: WrappedAccountCryptographicState = {
+        V2: {
+          private_key: "test-wrapped-private-key" as any,
+          signing_key: "test-wrapped-signing-key" as any,
+          signed_public_key: "test-signed-public-key" as any,
+          security_state: "test-security-state",
+        },
+      };
+      await stateProvider.setUserState(ACCOUNT_CRYPTOGRAPHIC_STATE, mockState, mockUserId);
+      const result = await firstValueFrom(service.accountCryptographicState$(mockUserId));
+      expect(result).toEqual(mockState);
+    });
+
+    it("emits updated state when state changes", async () => {
+      const mockState1: any = {
+        V1: {
+          private_key: "test-state-1" as any,
+        },
+      };
+      const mockState2: any = {
+        V1: {
+          private_key: "test-state-2" as any,
+        },
+      };
+
+      await stateProvider.setUserState(ACCOUNT_CRYPTOGRAPHIC_STATE, mockState1, mockUserId);
+
+      const observable = service.accountCryptographicState$(mockUserId);
+      const results: (WrappedAccountCryptographicState | null)[] = [];
+      const subscription = observable.subscribe((state) => results.push(state));
+
+      await stateProvider.setUserState(ACCOUNT_CRYPTOGRAPHIC_STATE, mockState2, mockUserId);
+
+      subscription.unsubscribe();
+
+      expect(results).toHaveLength(2);
+      expect(results[0]).toEqual(mockState1);
+      expect(results[1]).toEqual(mockState2);
+    });
+  });
+
+  describe("setAccountCryptographicState", () => {
+    it("sets the account cryptographic state", async () => {
+      const mockState: WrappedAccountCryptographicState = {
+        V1: {
+          private_key: "test-wrapped-state" as any,
+        },
+      };
+
+      await service.setAccountCryptographicState(mockState, mockUserId);
+
+      const result = await firstValueFrom(service.accountCryptographicState$(mockUserId));
+
+      expect(result).toEqual(mockState);
+    });
+
+    it("overwrites existing state", async () => {
+      const mockState1: WrappedAccountCryptographicState = {
+        V1: {
+          private_key: "test-state-1" as any,
+        },
+      };
+      const mockState2: WrappedAccountCryptographicState = {
+        V1: {
+          private_key: "test-state-2" as any,
+        },
+      };
+
+      await service.setAccountCryptographicState(mockState1, mockUserId);
+      await service.setAccountCryptographicState(mockState2, mockUserId);
+
+      const result = await firstValueFrom(service.accountCryptographicState$(mockUserId));
+
+      expect(result).toEqual(mockState2);
+    });
+  });
+
+  describe("ACCOUNT_CRYPTOGRAPHIC_STATE key definition", () => {
+    it("deserializer returns object as-is", () => {
+      const mockState: any = {
+        V1: {
+          private_key: "test" as any,
+        },
+      };
+      const result = ACCOUNT_CRYPTOGRAPHIC_STATE.deserializer(mockState);
+      expect(result).toBe(mockState);
+    });
+  });
+});

libs/common/src/key-management/account-cryptography/default-account-cryptographic-state.service.ts

@@ -0,0 +1,35 @@
+import { Observable } from "rxjs";
+
+import { WrappedAccountCryptographicState } from "@bitwarden/sdk-internal";
+import { CRYPTO_DISK, StateProvider, UserKeyDefinition } from "@bitwarden/state";
+import { UserId } from "@bitwarden/user-core";
+
+import { AccountCryptographicStateService } from "./account-cryptographic-state.service";
+
+export const ACCOUNT_CRYPTOGRAPHIC_STATE = new UserKeyDefinition<WrappedAccountCryptographicState>(
+  CRYPTO_DISK,
+  "accountCryptographicState",
+  {
+    deserializer: (obj) => obj as WrappedAccountCryptographicState,
+    clearOn: ["logout"],
+  },
+);
+
+export class DefaultAccountCryptographicStateService implements AccountCryptographicStateService {
+  constructor(protected stateProvider: StateProvider) {}
+
+  accountCryptographicState$(userId: UserId): Observable<WrappedAccountCryptographicState | null> {
+    return this.stateProvider.getUserState$(ACCOUNT_CRYPTOGRAPHIC_STATE, userId);
+  }
+
+  async setAccountCryptographicState(
+    accountCryptographicState: WrappedAccountCryptographicState,
+    userId: UserId,
+  ): Promise<void> {
+    await this.stateProvider.setUserState(
+      ACCOUNT_CRYPTOGRAPHIC_STATE,
+      accountCryptographicState,
+      userId,
+    );
+  }
+}

libs/common/src/key-management/kdf/change-kdf.service.spec.ts

@@ -2,13 +2,14 @@ import { mock } from "jest-mock-extended";
 import { of } from "rxjs";
 
 // eslint-disable-next-line no-restricted-imports
-import { PBKDF2KdfConfig } from "@bitwarden/key-management";
+import { KeyService, PBKDF2KdfConfig } from "@bitwarden/key-management";
 
 import { makeEncString } from "../../../spec";
 import { KdfRequest } from "../../models/request/kdf.request";
 import { SdkService } from "../../platform/abstractions/sdk/sdk.service";
 import { UserId } from "../../types/guid";
 import { EncString } from "../crypto/models/enc-string";
+import { InternalMasterPasswordServiceAbstraction } from "../master-password/abstractions/master-password.service.abstraction";
 import {
   MasterKeyWrappedUserKey,
   MasterPasswordAuthenticationHash,
@@ -22,6 +23,8 @@ import { DefaultChangeKdfService } from "./change-kdf.service";
 describe("ChangeKdfService", () => {
   const changeKdfApiService = mock<ChangeKdfApiService>();
   const sdkService = mock<SdkService>();
+  const keyService = mock<KeyService>();
+  const masterPasswordService = mock<InternalMasterPasswordServiceAbstraction>();
 
   let sut: DefaultChangeKdfService;
 
@@ -48,7 +51,12 @@ describe("ChangeKdfService", () => {
 
   beforeEach(() => {
     sdkService.userClient$ = jest.fn((userId: UserId) => of(mockSdk)) as any;
-    sut = new DefaultChangeKdfService(changeKdfApiService, sdkService);
+    sut = new DefaultChangeKdfService(
+      changeKdfApiService,
+      sdkService,
+      keyService,
+      masterPasswordService,
+    );
   });
 
   afterEach(() => {
@@ -163,6 +171,20 @@ describe("ChangeKdfService", () => {
       expect(changeKdfApiService.updateUserKdfParams).toHaveBeenCalledWith(expectedRequest);
     });
 
+    it("should set master key and hash after KDF update", async () => {
+      const masterPassword = "masterPassword";
+      const mockMasterKey = {} as any;
+      const mockHash = "localHash";
+
+      keyService.makeMasterKey.mockResolvedValue(mockMasterKey);
+      keyService.hashMasterKey.mockResolvedValue(mockHash);
+
+      await sut.updateUserKdfParams(masterPassword, mockNewKdfConfig, mockUserId);
+
+      expect(masterPasswordService.setMasterKey).toHaveBeenCalledWith(mockMasterKey, mockUserId);
+      expect(masterPasswordService.setMasterKeyHash).toHaveBeenCalledWith(mockHash, mockUserId);
+    });
+
     it("should properly dispose of SDK resources", async () => {
       const masterPassword = "masterPassword";
       jest.spyOn(mockNewKdfConfig, "toSdkConfig").mockReturnValue({} as any);

libs/common/src/key-management/kdf/change-kdf.service.ts

@@ -1,12 +1,14 @@
 import { firstValueFrom, map } from "rxjs";
 
 import { assertNonNullish } from "@bitwarden/common/auth/utils";
+import { HashPurpose } from "@bitwarden/common/platform/enums";
 import { UserId } from "@bitwarden/common/types/guid";
 // eslint-disable-next-line no-restricted-imports
-import { KdfConfig } from "@bitwarden/key-management";
+import { KdfConfig, KeyService } from "@bitwarden/key-management";
 
 import { KdfRequest } from "../../models/request/kdf.request";
 import { SdkService } from "../../platform/abstractions/sdk/sdk.service";
+import { InternalMasterPasswordServiceAbstraction } from "../master-password/abstractions/master-password.service.abstraction";
 import {
   fromSdkAuthenticationData,
   MasterPasswordAuthenticationData,
@@ -20,6 +22,8 @@ export class DefaultChangeKdfService implements ChangeKdfService {
   constructor(
     private changeKdfApiService: ChangeKdfApiService,
     private sdkService: SdkService,
+    private keyService: KeyService,
+    private masterPasswordService: InternalMasterPasswordServiceAbstraction,
   ) {}
 
   async updateUserKdfParams(masterPassword: string, kdf: KdfConfig, userId: UserId): Promise<void> {
@@ -56,5 +60,19 @@ export class DefaultChangeKdfService implements ChangeKdfService {
     const request = new KdfRequest(authenticationData, unlockData);
     request.authenticateWith(oldAuthenticationData);
     await this.changeKdfApiService.updateUserKdfParams(request);
+
+    // Update the locally stored master key and hash, so that UV, etc. still works
+    const masterKey = await this.keyService.makeMasterKey(
+      masterPassword,
+      unlockData.salt,
+      unlockData.kdf,
+    );
+    const localMasterKeyHash = await this.keyService.hashMasterKey(
+      masterPassword,
+      masterKey,
+      HashPurpose.LocalAuthorization,
+    );
+    await this.masterPasswordService.setMasterKeyHash(localMasterKeyHash, userId);
+    await this.masterPasswordService.setMasterKey(masterKey, userId);
   }
 }

libs/common/src/key-management/keys/response/private-keys.response.ts

@@ -1,3 +1,5 @@
+import { SignedPublicKey, WrappedAccountCryptographicState } from "@bitwarden/sdk-internal";
+
 import { SecurityStateResponse } from "../../security-state/response/security-state.response";
 
 import { PublicKeyEncryptionKeyPairResponse } from "./public-key-encryption-key-pair.response";
@@ -52,4 +54,31 @@ export class PrivateKeysResponseModel {
       );
     }
   }
+
+  toWrappedAccountCryptographicState(): WrappedAccountCryptographicState {
+    if (this.signatureKeyPair === null && this.securityState === null) {
+      // V1 user
+      return {
+        V1: {
+          private_key: this.publicKeyEncryptionKeyPair.wrappedPrivateKey,
+        },
+      };
+    } else if (this.signatureKeyPair !== null && this.securityState !== null) {
+      // V2 user
+      return {
+        V2: {
+          private_key: this.publicKeyEncryptionKeyPair.wrappedPrivateKey,
+          signing_key: this.signatureKeyPair.wrappedSigningKey,
+          signed_public_key: this.publicKeyEncryptionKeyPair.signedPublicKey as SignedPublicKey,
+          security_state: this.securityState.securityState as string,
+        },
+      };
+    } else {
+      throw new Error("Both signatureKeyPair and securityState must be present or absent together");
+    }
+  }
+
+  isV2Encryption(): boolean {
+    return this.signatureKeyPair !== null && this.securityState !== null;
+  }
 }

libs/common/src/platform/services/key-state/user-key.state.spec.ts

@@ -1,4 +1,4 @@
-import { EncString } from "../../../key-management/crypto/models/enc-string";
+import { EncryptedString, EncString } from "../../../key-management/crypto/models/enc-string";
 import { EncryptionType } from "../../enums";
 import { Utils } from "../../misc/utils";
 
@@ -27,7 +27,9 @@ describe("Encrypted private key", () => {
   it("should deserialize encrypted private key", () => {
     const encryptedPrivateKey = makeEncString().encryptedString;
 
-    const result = sut.deserializer(JSON.parse(JSON.stringify(encryptedPrivateKey)));
+    const result = sut.deserializer(
+      JSON.parse(JSON.stringify(encryptedPrivateKey as unknown)) as unknown as EncryptedString,
+    );
 
     expect(result).toEqual(encryptedPrivateKey);
   });

libs/common/src/platform/sync/default-sync.service.spec.ts

@@ -11,8 +11,6 @@ import {
   UserDecryptionOptions,
   UserDecryptionOptionsServiceAbstraction,
 } from "@bitwarden/auth/common";
-import { EncString } from "@bitwarden/common/key-management/crypto/models/enc-string";
-import { SecurityStateService } from "@bitwarden/common/key-management/security-state/abstractions/security-state.service";
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
 import { KdfConfigService, KeyService, PBKDF2KdfConfig } from "@bitwarden/key-management";
@@ -29,6 +27,8 @@ import { TokenService } from "../../auth/abstractions/token.service";
 import { AuthenticationStatus } from "../../auth/enums/authentication-status";
 import { DomainSettingsService } from "../../autofill/services/domain-settings.service";
 import { BillingAccountProfileStateService } from "../../billing/abstractions";
+import { AccountCryptographicStateService } from "../../key-management/account-cryptography/account-cryptographic-state.service";
+import { EncString } from "../../key-management/crypto/models/enc-string";
 import { KeyConnectorService } from "../../key-management/key-connector/abstractions/key-connector.service";
 import { InternalMasterPasswordServiceAbstraction } from "../../key-management/master-password/abstractions/master-password.service.abstraction";
 import {
@@ -36,6 +36,7 @@ import {
   MasterPasswordSalt,
   MasterPasswordUnlockData,
 } from "../../key-management/master-password/types/master-password.types";
+import { SecurityStateService } from "../../key-management/security-state/abstractions/security-state.service";
 import { SendApiService } from "../../tools/send/services/send-api.service.abstraction";
 import { InternalSendService } from "../../tools/send/services/send.service.abstraction";
 import { UserId } from "../../types/guid";
@@ -76,6 +77,7 @@ describe("DefaultSyncService", () => {
   let stateProvider: MockProxy<StateProvider>;
   let securityStateService: MockProxy<SecurityStateService>;
   let kdfConfigService: MockProxy<KdfConfigService>;
+  let accountCryptographicStateService: MockProxy<AccountCryptographicStateService>;
 
   let sut: DefaultSyncService;
 
@@ -107,6 +109,7 @@ describe("DefaultSyncService", () => {
     stateProvider = mock();
     securityStateService = mock();
     kdfConfigService = mock();
+    accountCryptographicStateService = mock();
 
     sut = new DefaultSyncService(
       masterPasswordAbstraction,
@@ -135,6 +138,7 @@ describe("DefaultSyncService", () => {
       stateProvider,
       securityStateService,
       kdfConfigService,
+      accountCryptographicStateService,
     );
   });
 

libs/common/src/platform/sync/default-sync.service.ts

@@ -9,8 +9,9 @@ import {
   CollectionDetailsResponse,
   CollectionService,
 } from "@bitwarden/admin-console/common";
-// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
+import { AccountCryptographicStateService } from "@bitwarden/common/key-management/account-cryptography/account-cryptographic-state.service";
 import { SecurityStateService } from "@bitwarden/common/key-management/security-state/abstractions/security-state.service";
+// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
 import { KdfConfigService, KeyService } from "@bitwarden/key-management";
 
@@ -101,6 +102,7 @@ export class DefaultSyncService extends CoreSyncService {
     stateProvider: StateProvider,
     private securityStateService: SecurityStateService,
     private kdfConfigService: KdfConfigService,
+    private accountCryptographicStateService: AccountCryptographicStateService,
   ) {
     super(
       tokenService,
@@ -239,12 +241,18 @@ export class DefaultSyncService extends CoreSyncService {
 
     // Cleanup: Only the first branch should be kept after the server always returns accountKeys https://bitwarden.atlassian.net/browse/PM-21768
     if (response.accountKeys != null) {
+      await this.accountCryptographicStateService.setAccountCryptographicState(
+        response.accountKeys.toWrappedAccountCryptographicState(),
+        response.id,
+      );
+
+      // V1 and V2 users
       await this.keyService.setPrivateKey(
         response.accountKeys.publicKeyEncryptionKeyPair.wrappedPrivateKey,
         response.id,
       );
-      if (response.accountKeys.signatureKeyPair !== null) {
-        // User is V2 user
+      // V2 users only
+      if (response.accountKeys.isV2Encryption()) {
         await this.keyService.setUserSigningKey(
           response.accountKeys.signatureKeyPair.wrappedSigningKey,
           response.id,