Draft
Conversation
Contributor
|
Great job! No new security vulnerabilities introduced in this pull request |
iinuwa
force-pushed
the
PM-33111/sdk-device-auth-key
branch
from
da66377 to
c404e6d
Compare
Contributor
🔍 SDK Breaking Change Detection ResultsSDK Version:
Breaking change detection completed. View SDK workflow |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #816 +/- ##
==========================================
- Coverage 82.40% 81.21% -1.19%
==========================================
Files 350 351 +1
Lines 41751 42362 +611
==========================================
Hits 34404 34404
- Misses 7347 7958 +611 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
iinuwa
force-pushed
the
PM-33111/sdk-device-auth-key
branch
from
04e5d6c to
86eb07f
Compare
|
iinuwa
commented
Mar 12, 2026
Comment on lines
+54
to
+59
| // TODO: These parameters are limiting: | ||
| // - Is there some way to accept the master password hash directly instead of having to do | ||
| // it in here? | ||
| // - Do we need to support all the options (master password hash, OTP, secret, auth access | ||
| // token)? Or just master password hash and OTP? | ||
| // We do this in get_user_api_key, consider centralizing this logic |
Contributor
Author
There was a problem hiding this comment.
As listed in the TODO comment, I'm not sure where to go with this:
- What's the expected pattern for deriving a
SecretVerificationRequestfrom a master password? Should the app do it, and then send it to the SDK, or does the SDK do it by referencing the internalKdfClient? TheKdfClientseems to be marked as a "stop-gap," but is used in other places in the SDK. Not sure which way to go. - Should I turn SecretVerificationRequest into an enum? E.g.,
struct MasterPasswordSecretVerificationRequest {
/// User's email
email: String,
/// User's master password to be hashed.
password: String
/// KDF parameters for the user's account.
kdf: Kdf,
}
impl MasterPasswordSecretVerificationRequest {
async fn hash_password(&self, kdf_client: KdfClient) -> Result<String, _> {
kdf_client.hash_password(
self.email.clone(),
self.password.clone(),
self.kdf,
HashPurpose::ServerAuthorization
).await
}
}
enum SecretVerificationRequest {
MasterPassword(MasterPasswordSecretVerificationRequest),
Otp(String),
AuthAccessToken, // I don't really know what these two are,
Secret, // but I see their definitions in the server
}
iinuwa
commented
Mar 12, 2026
| None | ||
| }; | ||
|
|
||
| // TODO: Make this an enum? |
Contributor
Author
There was a problem hiding this comment.
See note above on this TODO
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎟️ Tracking
PM-33111
📔 Objective
This adds methods to create and use a Bitwarden "device auth key", which is a passkey with PRF that can login and unlock the vault. The handles:
Clients are responsible for implementing a trait to store and retrieve the passkey in secure device storage.
Depends on:
🚨 Breaking Changes
No breaking changes.