Fixed a bug where `authenticatorSelection` may be undefined and cause
the extension to crash when attempting to register a new credential.
Co-authored-by: SmithThe4th <gsmith@bitwarden.com>
* [PM-5043] Update owernship of code belonging to autofill team
* [PM-5043] Updating location of webRequest.background.ts file to belong to autofill team
* [PM-5043] Updating location of autofill component settings within the popup
* Handle switch messaging
TODO: handle loading state for account switcher
* Async updates required for state
* Fallback to email for current account avatar
* Await un-awaited promises
* Remove unnecessary Prune
Prune was getting confused in browser and deleting memory in browser on
account switch. This method isn't needed since logout already removes
memory data, which is the condition for pruning
* Fix temp password in browser
* Use direct memory access until data is serializable
Safari uses a different message object extraction than firefox/chrome
and is removing `UInt8Array`s. Until all data passed into StorageService
is guaranteed serializable, we need to use direct access in state
service
* Reload badge and context menu on switch
* Gracefully switch account as they log out.
* Maintain location on account switch
* Remove unused state definitions
* Prefer null for state
undefined can be misinterpreted to indicate a value has not been set.
* Hack: structured clone in memory storage
We are currently getting dead objects on account switch due to updating
the object in the foreground state service. However, the storage service
is owned by the background. This structured clone hack ensures that all
objects stored in memory are owned by the appropriate context
* Null check nullable values
active account can be null, so we should include null safety in the
equality
* Correct background->foreground switch command
* Already providing background memory storage
* Handle connection and clipboard on switch account
* Prefer strict equal
* Ensure structuredClone is available to jsdom
This is a deficiency in jsdom --
https://github.com/jsdom/jsdom/issues/3363 -- structured clone is well
supported.
* Fixup types in faker class
* Adding the password complexity component to the password protected valut export
* Removing the zxcvbn import as the component handles the strength check
Assign ownership to many of the remaining libs/common files.
Criteria for ownership:
* Files used by a single team, is now owned by that team.
* Files related to a domain owned by a team is now owned by that team.
* Where ownership is unclear the "lowest level" service takes ownership.
* feat: add inscure types and remove the insecure fields from the page-script
* feat: securely set variables in content-script
* chore: clean up comments
* use passkeys setting
* check state service on isFido2FeatureEnabled
* fix broken json
* update description text
* make setting global
* invert logic to positive state
* fix and add to fido2 client service tests
The latest version of types/node had some breaking changes related to Timer and Timeout, #6739. It turns out that we incorrectly used the type Timer when Timeout was expected in a few places. This PR resolves them, in an effort to unblock the @types/node upgrade.
We missed an await which caused the if statement to never be true. This might have had the effect of not showing a browser integration error message when attempting to unlock should biometrics for some reason be unavailable.
* PM-2041 - (1) Bring over WebauthnApiService + required models from existing #5493 PR (2) Per discussion with Andreas, remove unnecessary methods from WebauthnApiService
* PM-2041 - Rename responses folder to response to match rest of codebase
* PM-2041 - Recreate BaseLoginViaWebAuthnComponent and then web implementation of it.
* PM-2041 - Web routing module - add LoginViaWebAuthnComponent and associated route "login-with-passkey"
* PM-2041 - InjectionTokens - add new navigator credentials injection token which provides the CredentialsContainer interface of the Credential Management API and exposes methods to request credentials and notify the user agent when events such as successful sign in or sign out happen
* PM-2041 - Rename WebauthnApiService & abstraction to WebAuthnLoginApiService
* PM-2041 - Rename WebauthnLoginApiService to WebAuthnAdminApiService
* PM-2041 - Bring over first draft of webauthn-login.service + abstraction; register on jslib-services.module.
* PM-2041 - Bring over web & base login component changes to add login with passkey button if feature flag enabled.
* PM-2041 - WebAuthnAdminApi - update list of TODOs based on conversation with Andreas
* PM-2041 - Login.module - cleanup todo after conversation w/ Andreas
* PM-2041 - Move utils out of web and into common auth/utils and renamed to webauthn-utils
* PM-2041 - Update userDecryptionOptions to support new webauthn prf decryption option
* PM-2041 - (1) Recreate webauthn-login service with updated logic (2) Move files from webauthn to webauthn-login (3) Recreate webauthn-login.strategy with updated logic
* PM-2041 - Remove completed TODO
* PM-2041 - Fix login-via-webauthn component imports + fix name (missing n)
* PM-2041 - Missed this change when renaming LoginViaWebAuthComponent to LoginViaWebAuthnComponent
* PM-2041 - Add WebAuthnLoginApiService to jslib-services.module
* PM-2041 - Remove unused param from WebAuthnLoginApiServiceAbstraction as we aren't supporting non-discoverable passkeys for MVP
* PM-2041 - WebAuthnLoginApiService - remove email and target correct endpoint for getCredentialAssertionOptions(...) call
* PM-2041 - WebAuthnLoginStrategy - (1) Remove unused dep (2) Add safeguard checks to setUserKey(...) logic similar to SSO login strategy
* PM-2041 - BaseLoginViaWebAuthnComponent - Rewrite authenticate logic to use new methods on webAuthnLoginService
* PM-2041 - UserDecryptionOptionsResponse - update naming of webAuthn options object to match server response
* PM-2041 - WebAuthnLoginAssertionResponseRequest - (1) clean up TODO (2) Fix response property name to match server
* PM-2041 - WebAuthnTokenRequest - must stringify device response b/c sending as form data
* PM-2041 - AuthService - Add WebAuthnLoginCredentials and WebAuthnLoginStrategy support to auth service
* PM-2041 - WIP tests for WebAuthnLoginService
* PM-2041 - UserDecryptionOptions - Rename WebAuthnPrfOptions to singular WebAuthnPrfOption to match server
* PM-2041 - Add TODO in login comp
* PM-2041 - (1) Update WebAuthnLoginService.assertCredential(...) to add a check to ensure we cannot leak PRF credentials to the BW server by mistake (2) Add credential to view names for clarity (3) Add JS doc style comments to WebAuthnLoginServiceAbstraction
* PM-2041 - Login.component.html - (1) Center passkey login button (2) Use correct user passkey icon
* PM-2041 - Utils + tests - (1) Add new hexStringToArrayBuffer(...) method (2) Add tests for existing fromBufferToHex(...) (3) Add tests for new hexStringToArrayBuffer(...) method
* PM-2041 - Fix broken import
* PM-2041 - WebAuthnLoginResponseRequest - Adjust warning to be correct
* PM-2041 - Webauthn-utils - createSymmetricKeyFromPrf(...) - add return type
* PM-2041 - WebAuthnLoginService spec file - good progress on figuring out how to test passkey assertion process. Tests are passing, but need to add more setup logic around the MockAuthenticatorAssertionResponse in order to be able to confirm the output is correct.
* PM-2041 - Utils + Utils Spec file changes - (1) Add new fromB64ToArrayBuffer(...) method (2) Add tests for existing fromBufferToB64(...) (3) Add tests for new fromB64ToArrayBuffer(...) method (4) Add round trip conversion tests in both directions
* PM-2041 - Utils.spec - update round trip conversion tests between hex string and array buffer.
* PM-2041 - WebAuthnLoginService.spec - assertCredential(...) happy path test passing
* PM-2041 - WebAuthnLoginAssertionResponseRequest - Add interface
* PM-2041 - WebAuthnLoginAssertionResponseRequest data should be UrlB64 strings per discussion w/ Andreas
* PM-2041 - WebAuthnLoginService Spec file - Per feedback, reverse approaches to generating test data (go from array buffer to b64 strings vs the reverse) to avoid using math.random which can introduce test inconsistency
* PM-2041 - Finish testing assertCredential(...)
* PM-2041 - WebAuthnLoginService tests completed - tested logIn method
* PM-2041 - Login html - add "or" between standard email login and passkey login
* PM-2041 - WebAuthnLoginStrategy test start
* PM-2041 - After rebase - BaseLoginViaWebAuthnComponent - Must rename ForceResetPasswordReason to ForceSetPasswordReason + refactor post login routing logic to match other auth owned flows.
* PM-2401 - Desktop - login comp - fix desktop build
* PM-2041 - Browser - login comp - fix build issue
* PM-2401 - WIP on webauthn-login.strategy testing
* PM-2401 - Finish testing webauthn login strategy
* PM-2041 - WebAuthnAdminApiService renamed to WebAuthnLoginAdminApiService
* PM-2041 - Remove unnecessary comment
* PM-2041 - Per PR feedback, remove noMargin and just add mb-3
* PM-2041 - Per PR feedback, remove unused 2FA and remember email logic (2FA isn't supported right now and we aren't using non-discoverable credentials so we aren't using a user entered email)
* PM-2401 - BaseLoginViaWebAuthnComponent - improve error handling to allow users to retry w/ another passkey
* PM-2401 - Per PR feedback, provide translated message to cover all invalid passkey scenarios.
* PM-2401 - WebAuthnLoginService - per PR feedback, remove unnecessary from
* PM-2041 - WebAuthnLoginCredentialAssertionView - per PR feedback, use actual key type
* PM-2401 - Per PR feedback, remove WebAuthnLoginStrategy constructor as it is identical to its super class constructor
* PM-2041 - WebAuthnLoginService tests - use first value from to improve tests
* PM-2401 - Fix WebAuthnLoginService build issue after changing SymmetricCryptoKey to PrfKey
* PM-2041 - WebAuthnLoginServiceAbstraction remove incorrect undefined from getCredentialAssertionOptions() abstraction
* PM-2041 - Refacor WebAuthn login service tests based on PR feedback
* PM-2041 - Per PR feedback, remove NAVIGATOR_CREDENTIALS injection token and just use WINDOW directly for WebAuthnLoginService
* PM-2041 - WebAuthnLoginServiceAbstraction - per PR feedback, improve assertCredential jsdocs with return info
* PM-2041 - Per PR feedback, update WebAuthnLoginStrategy logInTwoFactor(...) to return an exception if attempted to be called.
* PM-2041 - WebAuthnLoginResponseRequest - per PR feedback, replace fromBufferToB64(...) with fromBufferToUrlB64(...)
* PM-2041 - AssertionOptionsResponse - use doc comment per PR feedback
* PM-2041 - Per PR feedback, adjust location of helpers and mocks in WebAuthnLoginStrategy test file
* PM-2041 - Adjust WebAuthnLoginService tests to take the WebAuthnLoginResponseRequest change to use fromBufferToUrlB64(...) into account to get tests to pass again
* PM-2041 - WebAuthnLoginStrategy - adjust test name to match convention per PR feedback
* PM-2041 - More test tweaks - (1) Rename method (2) Support strict
* PM-2041 - Per PR feedback, AssertionOptionsResponse constructor should null check allowCredentials b/c it is optional
* PM-2041 - Per PR Feedback, remove duplicated fromB64ToArrayBuffer(...) from utils and update tests.
* PM-2041 - Per PR feedback, rename WebAuthnTokenRequest to WebAuthnLoginTokenRequest
* PM-2041 - Per discussion with product and Andreas, add 2FA transition handling just in case we add server support in the future.
* feat: stretch PRF key (#6927)
* feat: stretch PRF key
includes necessary utils -> service refactors
* feat: add tests
* [PM-2041] feat: assertion-options `POST` -> `GET`
* [PM-2041] chore: remove unused properties
* [PM-2041] fix: set private key
* [PM-2041] feat: remove all 2FA related fields
* [PM-2041] chore: clean up 2FA comments
* [PM-2041] chore: document `webauthn-login-prf-crypto.service.abstraction.ts`
* [PM-2041] chore: document webauthn login services
---------
Co-authored-by: Andreas Coroiu <acoroiu@bitwarden.com>
Co-authored-by: Andreas Coroiu <andreas.coroiu@gmail.com>
* added previous-url to global-state
* updated storage of previousUrl for SSO/MFA flows
* revert file changes
* added post login routing
* Clear PreviousUrl from storage on new Login
* Components do not call StateService anymore
* removed needed query params
* refactored components to use RouterService
* fixed build error
* fixed mfa component
* updated logic for previous Url
* removed unneeded base implementation
* Added state call for Redirect Guard
* Fixed test cases
* Remove routing service calls
* renamed global field, changed routing to guard
* reverting constructor changes and git lint issue
* fixing constructor ordering
* fixing diffs to be clearer on actual cahnges.
* addressing accepting emergency access case
* refactor and add locked state logic
* refactor name of guard to be more clear
* Added comments and tests
* comments + support lock page deep linking + code ownership
* readability updates
* Combined guards and specs updated routing
* Update oss-routing.module.ts
* fixed stroybook build
* Allow for update logic in state update callbacks
* Prefer reading updates to sending in stream
* Inform state providers when they must deserialize
* Update DefaultGlobalState to act more like DefaultUserState
* Fully Implement AbstractStorageService
* Add KeyDefinitionOptions
* Address PR feedback
* Prefer testing interactions for ports
* Synced memory storage for browser
* Fix port handling
* Do not stringify port message data
* Use messaging storage
* Initialize new foreground memory storage services
This will need to be rethought for short-lived background pages, but for
now the background is the source of truth for memory storage
* Use global state for account service
* Use BrowserApi listener to avoid safari memory leaks
* Fix build errors: debugging and missed impls
* Prefer bound arrow functions
* JSON Stringify Messages
* Prefer `useClass`
* Use noop services
* extract storage observable to new interface
This also reverts changes for the existing services to use
foreground/background services. Those are now used only in state
providers
* Fix web DI
* Prefer initializing observable in constructor
* Do not use jsonify as equality operator
* Remove port listener to avoid memory leaks
* Fix logic and type issues
---------
Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>
* update copy on /settings and /options (behind feature flag)
* update copy on /excluded-domains (behind feature flag)
* use && two check both conditions for presence of lock() button
* fix typos in messages
* add description on auto-fill page
