mirror of
https://github.com/bitwarden/browser
synced 2025-12-21 10:43:35 +00:00
a860f218bd
* fix: broken SDK interface * Fix all compile errors related to uuids * Update usages of sdk to type-safe SDK type * Update sdk version * Update to "toSdk" * Move pin service to km ownership * Run format * Eslint * Fix tsconfig * Fix imports and test * Clean up imports * Pin tmp * Initial version of updated pin service * Add tests * Rename function * Clean up logging * Fix imports * Fix cli build * Fix browser desktop * Fix tests * Attempt to fix * Fix build * Fix tests * Fix browser build * Add missing empty line * Fix linting * Remove non-required change * Missing newline * Re-add comment * Undo change to file * Fix missing empty line * Cleanup * Cleanup * Cleanup * Cleanup * Switch to replaysubject * Add comments * Fix tests * Run prettier * Undo change * Fix browser * Fix circular dependency on browser * Add missing clear ephemeral pin * Address feedback * Update docs * Simplify sdk usage in pin service * Replace with mock sdk * Update sdk * Initialize pin service via unlock instead of listening to keyservice * Cleanup * Fix test * Prevent race condition with userkey not being set * Filter null userkeys * [PM-24124] Pin State Service (#16641) * add pin-state.service * add remaining tests * improve description for clearEphemeralPinState * rename getUserKeyWrappedPin$ to userKeyWrappedPin$ * drop temp variable in setPinState * add new test and remove copied one * Fix dep cycle * Fix tests and remaining build issues * Fix cli build * Add comments about functions not being public API --------- Co-authored-by: Andreas Coroiu <andreas.coroiu@gmail.com> Co-authored-by: Hinton <hinton@users.noreply.github.com> Co-authored-by: Jake Fink <jfink@bitwarden.com>
79 lines
2.9 KiB
TypeScript
79 lines
2.9 KiB
TypeScript
// eslint-disable-next-line no-restricted-imports
|
|
import { KdfConfig } from "@bitwarden/key-management";
|
|
|
|
import { UserId } from "../../types/guid";
|
|
import { PinKey, UserKey } from "../../types/key";
|
|
|
|
import { PinLockType } from "./pin-lock-type";
|
|
|
|
/**
|
|
* The PinService provides PIN-based unlock functionality for user accounts.
|
|
*
|
|
* ## Overview
|
|
*
|
|
* - The PIN is used to unlock the user's UserKey
|
|
* - PIN state and key material are managed using secure envelopes and encrypted state, with support for both ephemeral (in-memory) and persistent (on-disk) storage.
|
|
* When stored ephemerally, PIN unlock is only available after first unlock. When stored persistent, PIN unlock is available before first unlock.
|
|
* - The PIN is also stored, encrypted with the user's UserKey. After first unlock, the PIN can be retrieved.
|
|
*/
|
|
export abstract class PinServiceAbstraction {
|
|
/**
|
|
* Gets the user's PIN
|
|
* @throws If the user is locked
|
|
* @returns The user's PIN
|
|
*/
|
|
abstract getPin(userId: UserId): Promise<string>;
|
|
|
|
/**
|
|
* Setup pin unlock
|
|
* @throws If the provided user is locked
|
|
*/
|
|
abstract setPin(pin: string, pinLockType: PinLockType, userId: UserId): Promise<void>;
|
|
|
|
/**
|
|
* Clear pin unlock
|
|
*/
|
|
abstract unsetPin(userId: UserId): Promise<void>;
|
|
|
|
/**
|
|
* Gets the user's PinLockType {@link PinLockType}.
|
|
*/
|
|
abstract getPinLockType(userId: UserId): Promise<PinLockType>;
|
|
|
|
/**
|
|
* Declares whether or not the user has a PIN set (either persistent or ephemeral).
|
|
* Note: for ephemeral, this does not check if we actual have an ephemeral PIN-encrypted UserKey stored in memory.
|
|
* Decryption might not be possible even if this returns true. Use {@link isPinDecryptionAvailable} if decryption is required.
|
|
*/
|
|
abstract isPinSet(userId: UserId): Promise<boolean>;
|
|
|
|
/**
|
|
* Checks if PIN-encrypted keys are stored for the user.
|
|
* Used for unlock / user verification scenarios where we will need to decrypt the UserKey with the PIN.
|
|
*/
|
|
abstract isPinDecryptionAvailable(userId: UserId): Promise<boolean>;
|
|
|
|
/**
|
|
* Clears ephemeral PINs for the user being logged out.
|
|
*/
|
|
abstract logout(userId: UserId): Promise<void>;
|
|
|
|
/**
|
|
* Decrypts the UserKey with the provided PIN.
|
|
* @returns UserKey
|
|
* @throws If the pin lock type is ephemeral but the ephemeral pin protected user key envelope is not available
|
|
*/
|
|
abstract decryptUserKeyWithPin(pin: string, userId: UserId): Promise<UserKey | null>;
|
|
|
|
/**
|
|
* @deprecated This is not deprecated, but only meant to be called by KeyService. DO NOT USE IT.
|
|
*/
|
|
abstract userUnlocked(userId: UserId): Promise<void>;
|
|
|
|
/**
|
|
* Makes a PinKey from the provided PIN.
|
|
* @deprecated - Note: This is currently re-used by vault exports, which is still permitted but should be refactored out to use a different construct.
|
|
*/
|
|
abstract makePinKey(pin: string, salt: string, kdfConfig: KdfConfig): Promise<PinKey>;
|
|
}
|