[PM-33111] Implement device auth key

crates/bitwarden-core/src/platform/secret_verification_request.rs

@@ -1,6 +1,7 @@
 use serde::{Deserialize, Serialize};
 
 /// Request to verify a user's secret.
+#[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
 #[derive(Serialize, Deserialize, Debug)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct SecretVerificationRequest {

crates/bitwarden-crypto/src/keys/rotateable_key_set.rs

@@ -26,11 +26,11 @@ use crate::{
 )]
 pub struct RotateableKeySet {
     /// `DownstreamKey` protected by encapsulation key
-    encapsulated_downstream_key: UnsignedSharedKey,
+    pub encapsulated_downstream_key: UnsignedSharedKey,
     /// Encapsulation key protected by `DownstreamKey`
-    encrypted_encapsulation_key: EncString,
+    pub encrypted_encapsulation_key: EncString,
     /// Decapsulation key protected by `UpstreamKey`
-    encrypted_decapsulation_key: EncString,
+    pub encrypted_decapsulation_key: EncString,
 }
 
 impl RotateableKeySet {

crates/bitwarden-fido/Cargo.toml

@@ -19,6 +19,7 @@ uniffi = ["dep:uniffi", "bitwarden-core/uniffi", "bitwarden-vault/uniffi"]
 
 [dependencies]
 async-trait = { workspace = true }
+bitwarden-api-api = { workspace = true }
 bitwarden-core = { workspace = true }
 bitwarden-crypto = { workspace = true }
 bitwarden-encoding = { workspace = true }

crates/bitwarden-fido/src/client_fido.rs

@@ -3,8 +3,9 @@ use bitwarden_vault::CipherView;
 use thiserror::Error;
 
 use crate::{
-    Fido2Authenticator, Fido2Client, Fido2CredentialAutofillView, Fido2CredentialAutofillViewError,
-    Fido2CredentialStore, Fido2UserInterface,
+    DeviceAuthKeyAuthenticator, DeviceAuthKeyStore, Fido2Authenticator, Fido2Client,
+    Fido2CredentialAutofillView, Fido2CredentialAutofillViewError, Fido2CredentialStore,
+    Fido2UserInterface,
 };
 
 #[allow(missing_docs)]
@@ -47,6 +48,19 @@ impl ClientFido2 {
         }
     }
 
+    /// Create an authenticator intended to be used with a device-bound
+    /// credential to log into and unlock a Bitwarden vault.
+    /// `web_vault_hostname` is the fallback RP ID to use if the client does not specify it.
+    pub fn create_device_key_authenticator<'a>(
+        &'a self,
+        store: &'a mut dyn DeviceAuthKeyStore,
+    ) -> DeviceAuthKeyAuthenticator<'a> {
+        DeviceAuthKeyAuthenticator {
+            client: &self.client,
+            store,
+        }
+    }
+
     #[allow(missing_docs)]
     pub fn decrypt_fido2_autofill_credentials(
         &self,