[PM-32424] Send Access Enumeration protection

[ike-kottlowski]

🎟️ Tracking

PM-32424

Server PR: bitwarden/server#7166
SDK PR: bitwarden/sdk-internal#821

📔 Objective

Improve enumeration protection of Sends

📸 Screenshots

[github-actions]

Checkmarx One – Scan Summary & Details – 8fccfffe-2a59-4b37-8bb1-f093d1a0cea6

---

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	Angular_Usage_of_Unsafe_DOM_Sanitizer	/libs/components/src/svg/svg.component.ts: 29

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.38%. Comparing base (25dda0c) to head (645b80c).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #19422   +/-   ##
=======================================
  Coverage   45.38%   45.38%           
=======================================
  Files        3764     3764           
  Lines      110717   110709    -8     
  Branches    16864    16860    -4     
=======================================
- Hits        50249    50247    -2     
+ Misses      58250    58244    -6     
  Partials     2218     2218           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JaredSnider-Bitwarden]

Looking good, but a few more items to clean up 👇

[claude]

Claude finished @ike-kottlowski's task in 3m 5s —— View job

---

Code Review: PM-32424 Send Access Enumeration Protection

Reviewed commit: 645b80c (Merge branch 'main' into auth/pm-32424/send-enumeration-protection)
Previous review: March 9, 2026 -- this is a re-review after SDK update and test fix commits.

Summary

This PR improves Send access enumeration protection by removing client-side handling for otp_invalid and otp_generation_failed error types that the server no longer returns. Instead of sending a distinct "OTP invalid" response (which could leak whether an email was valid), the server now responds uniformly with email_and_otp_required, and the existing emailAndOtpRequired code paths already handle this correctly.

Changes reviewed:

• libs/common/src/auth/send-access/types/invalid-grant-errors.type.ts -- Removed OtpInvalid, OtpGenerationFailed types and their type guard functions
• apps/cli/src/tools/send/commands/receive.command.ts -- Removed otpInvalid error branch (which returned the same message as the emailAndOtpRequired branch)
• apps/web/src/app/tools/send/send-access/send-auth.component.ts -- Removed otpInvalid error branch; the emailAndOtpRequired path correctly uses the otpSubmitted flag to show the error toast on re-submissions
• libs/common/src/auth/send-access/services/default-send-token.service.spec.ts -- Removed "otp_invalid" and "otp_generation_failed" from test data
• package.json / package-lock.json -- SDK bump from 0.2.0-main.589 to 0.2.0-main.590

Assessment

No critical or important issues found. The removal is clean and behavior is preserved:

• In the web component, the emailAndOtpRequired handler at line 196 already shows the "invalidEmailOrVerificationCode" toast when otpSubmitted is true, matching the previous otpInvalid behavior exactly.
• In the CLI, both the removed otpInvalid branch and the remaining emailAndOtpRequired branch returned the identical "Invalid email or verification code" message, so the consolidation is correct.
• The type definitions and spec file were properly updated to remove the obsolete types.

Previously flagged (still outstanding): apps/cli/src/tools/send/commands/receive.command.spec.ts line 373-386 still contains a test referencing "otp_invalid" with as any. This test does not exercise any meaningful behavior (it only asserts isDefined). This was noted in the previous review.

Verdict: Approved ✅

[JaredSnider-Bitwarden]

LGTM!

[ike-kottlowski]

Breaking changes from this SDK PR bitwarden/sdk-internal#829 blocks this from merging until this Clients PR is merged #19433.

[mzieniukbw]

#19471 has been merged, should unblock now.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud