bitwarden/server
1
0
Fork 0
mirror of https://github.com/bitwarden/server synced 2026-01-02 16:43:25 +00:00
Code Issues Releases Wiki Activity

fix(auth-validator): [PM-22975] Client Version Validator - Took in feedback from km. Removed IsV2User in favor of checking the security version on the user.

Browse Source
This commit is contained in:
Patrick Pimentel
2025-12-03 09:46:00 -05:00
parent c1bc10bf40
commit 753670d26f
10 changed files with 36 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Core/KeyManagement/Constants.cs
View File

@@ -2,5 +2,5 @@
public static class Constants
{
public static readonly Version MinimumClientVersionForV2Encryption = new Version("2025.11.0");
public static readonly Version MinimumClientVersionForV2Encryption = new("2025.11.0");
}

1
src/Core/KeyManagement/KeyManagementServiceCollectionExtensions.cs
View File

@@ -26,7 +26,6 @@ public static class KeyManagementServiceCollectionExtensions
private static void AddKeyManagementQueries(this IServiceCollection services)
{
services.AddScoped<IUserAccountKeysQuery, UserAccountKeysQuery>();
services.AddScoped<IIsV2EncryptionUserQuery, IsV2EncryptionUserQuery>();
services.AddScoped<IGetMinimumClientVersionForUserQuery, GetMinimumClientVersionForUserQuery>();
}
}

12
src/Core/KeyManagement/Queries/GetMinimumClientVersionForUserQuery.cs
View File

@@ -3,21 +3,21 @@ using Bit.Core.KeyManagement.Queries.Interfaces;
namespace Bit.Core.KeyManagement.Queries;
public class GetMinimumClientVersionForUserQuery(IIsV2EncryptionUserQuery isV2EncryptionUserQuery)
public class GetMinimumClientVersionForUserQuery()
: IGetMinimumClientVersionForUserQuery
{
public async Task<Version?> Run(User? user)
public Task<Version?> Run(User? user)
{
if (user == null)
{
return null;
return Task.FromResult<Version?>(null);
}
if (await isV2EncryptionUserQuery.Run(user))
if (user.IsSecurityVersionTwo())
{
return Constants.MinimumClientVersionForV2Encryption;
return Task.FromResult(Constants.MinimumClientVersionForV2Encryption)!;
}
return null;
return Task.FromResult<Version?>(null);
}
}

8
src/Core/KeyManagement/Queries/Interfaces/IIsV2EncryptionUserQuery.cs
View File

@@ -1,8 +0,0 @@
using Bit.Core.Entities;
namespace Bit.Core.KeyManagement.Queries.Interfaces;
public interface IIsV2EncryptionUserQuery
{
Task<bool> Run(User user);
}

31
src/Core/KeyManagement/Queries/IsV2EncryptionUserQuery.cs
View File

@@ -1,31 +0,0 @@
using Bit.Core.Entities;
using Bit.Core.Enums;
using Bit.Core.KeyManagement.Queries.Interfaces;
using Bit.Core.KeyManagement.Repositories;
using Bit.Core.KeyManagement.Utilities;
namespace Bit.Core.KeyManagement.Queries;
public class IsV2EncryptionUserQuery(IUserSignatureKeyPairRepository userSignatureKeyPairRepository)
: IIsV2EncryptionUserQuery
{
public async Task<bool> Run(User user)
{
ArgumentNullException.ThrowIfNull(user);
var hasSignatureKeyPair = await userSignatureKeyPairRepository.GetByUserIdAsync(user.Id) != null;
var isPrivateKeyEncryptionV2 =
!string.IsNullOrWhiteSpace(user.PrivateKey) &&
EncryptionParsing.GetEncryptionType(user.PrivateKey) == EncryptionType.XChaCha20Poly1305_B64;
return hasSignatureKeyPair switch
{
// Valid v2 user
true when isPrivateKeyEncryptionV2 => true,
// Valid v1 user
false when !isPrivateKeyEncryptionV2 => false,
_ => throw new InvalidOperationException(
"User is in an invalid state for key rotation. User has a signature key pair, but the private key is not in v2 format, or vice versa.")
};
}
}

4
src/Core/KeyManagement/Utilities/EncryptionParsing.cs
View File

@@ -7,8 +7,10 @@ public static class EncryptionParsing
/// <summary>
/// Helper method to convert an encryption type string to an enum value.
/// </summary>
public static EncryptionType GetEncryptionType(string encString)
public static EncryptionType GetEncryptionType(string? encString)
{
ArgumentNullException.ThrowIfNull(encString);
var parts = encString.Split('.');
if (parts.Length == 1)
{