[PM-7879, PM-7635] Add server verification for master password to user verification

apps/browser/src/background/main.background.ts

@@ -745,7 +745,6 @@ export default class MainBackground {
     this.folderApiService = new FolderApiService(this.folderService, this.apiService);
 
     this.userVerificationService = new UserVerificationService(
-      this.stateService,
       this.cryptoService,
       this.accountService,
       this.masterPasswordService,

apps/cli/src/auth/commands/unlock.command.ts

@@ -1,19 +1,18 @@
 import { firstValueFrom, map } from "rxjs";
 
-import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { OrganizationApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/organization/organization-api.service.abstraction";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
-import { KdfConfigService } from "@bitwarden/common/auth/abstractions/kdf-config.service";
 import { KeyConnectorService } from "@bitwarden/common/auth/abstractions/key-connector.service";
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/auth/abstractions/master-password.service.abstraction";
-import { SecretVerificationRequest } from "@bitwarden/common/auth/models/request/secret-verification.request";
+import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
+import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
+import { MasterPasswordVerification } from "@bitwarden/common/auth/types/verification";
 import { CryptoFunctionService } from "@bitwarden/common/platform/abstractions/crypto-function.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
-import { StateService } from "@bitwarden/common/platform/abstractions/state.service";
-import { HashPurpose } from "@bitwarden/common/platform/enums";
 import { Utils } from "@bitwarden/common/platform/misc/utils";
 import { ConsoleLogService } from "@bitwarden/common/platform/services/console-log.service";
+import { MasterKey } from "@bitwarden/common/types/key";
 import { SyncService } from "@bitwarden/common/vault/abstractions/sync/sync.service.abstraction";
 
 import { ConvertToKeyConnectorCommand } from "../../commands/convert-to-key-connector.command";
@@ -26,16 +25,14 @@
     private accountService: AccountService,
     private masterPasswordService: InternalMasterPasswordServiceAbstraction,
     private cryptoService: CryptoService,
-    private stateService: StateService,
+    private userVerificationService: UserVerificationService,
     private cryptoFunctionService: CryptoFunctionService,
-    private apiService: ApiService,
     private logService: ConsoleLogService,
     private keyConnectorService: KeyConnectorService,
     private environmentService: EnvironmentService,
     private syncService: SyncService,
     private organizationApiService: OrganizationApiServiceAbstraction,
     private logout: () => Promise<void>,
-    private kdfConfigService: KdfConfigService,
   ) {}
 
   async run(password: string, cmdOptions: Record<string, any>) {
@@ -51,63 +48,44 @@
     await this.setNewSessionKey();
     const [userId, email] = await firstValueFrom(
       this.accountService.activeAccount$.pipe(map((a) => [a?.id, a?.email])),
     );
-    const kdfConfig = await this.kdfConfigService.getKdfConfig();
-    const masterKey = await this.cryptoService.makeMasterKey(password, email, kdfConfig);
-    const storedMasterKeyHash = await firstValueFrom(
-      this.masterPasswordService.masterKeyHash$(userId),
-    );
 
-    let passwordValid = false;
-    if (masterKey != null) {
-      if (storedMasterKeyHash != null) {
-        passwordValid = await this.cryptoService.compareAndUpdateKeyHash(password, masterKey);
-      } else {
-        const serverKeyHash = await this.cryptoService.hashMasterKey(
-          password,
-          masterKey,
-          HashPurpose.ServerAuthorization,
-        );
-        const request = new SecretVerificationRequest();
-        request.masterPasswordHash = serverKeyHash;
-        try {
-          await this.apiService.postAccountVerifyPassword(request);
-          passwordValid = true;
-          const localKeyHash = await this.cryptoService.hashMasterKey(
-            password,
-            masterKey,
-            HashPurpose.LocalAuthorization,
-          );
-          await this.masterPasswordService.setMasterKeyHash(localKeyHash, userId);
-        } catch {
-          // Ignore
-        }
-      }
+    const verification = {
+      type: VerificationType.MasterPassword,
+      secret: password,
+    } as MasterPasswordVerification;
+
+    let masterKey: MasterKey;
+    try {
+      const response = await this.userVerificationService.verifyUserByMasterPassword(
+        verification,
+        userId,
+        email,
+      );
+      masterKey = response.masterKey;
+    } catch (e) {
+      // verification failure throws
+      return Response.error(e.message);
     }
 
-    if (passwordValid) {
-      await this.masterPasswordService.setMasterKey(masterKey, userId);
-      const userKey = await this.masterPasswordService.decryptUserKeyWithMasterKey(masterKey);
-      await this.cryptoService.setUserKey(userKey);
+    const userKey = await this.masterPasswordService.decryptUserKeyWithMasterKey(masterKey);
+    await this.cryptoService.setUserKey(userKey);
 
-      if (await this.keyConnectorService.getConvertAccountRequired()) {
-        const convertToKeyConnectorCommand = new ConvertToKeyConnectorCommand(
-          this.keyConnectorService,
-          this.environmentService,
-          this.syncService,
-          this.organizationApiService,
-          this.logout,
-        );
-        const convertResponse = await convertToKeyConnectorCommand.run();
-        if (!convertResponse.success) {
-          return convertResponse;
-        }
+    if (await this.keyConnectorService.getConvertAccountRequired()) {
+      const convertToKeyConnectorCommand = new ConvertToKeyConnectorCommand(
+        this.keyConnectorService,
+        this.environmentService,
+        this.syncService,
+        this.organizationApiService,
+        this.logout,
+      );
+      const convertResponse = await convertToKeyConnectorCommand.run();
+      if (!convertResponse.success) {
+        return convertResponse;
       }
-
-      return this.successResponse();
-    } else {
-      return Response.error("Invalid master password.");
     }
+
+    return this.successResponse();
   }
 
   private async setNewSessionKey() {

apps/cli/src/base-program.ts

@@ -140,16 +140,14 @@ export abstract class BaseProgram {
           this.serviceContainer.accountService,
           this.serviceContainer.masterPasswordService,
           this.serviceContainer.cryptoService,
-          this.serviceContainer.stateService,
+          this.serviceContainer.userVerificationService,
           this.serviceContainer.cryptoFunctionService,
-          this.serviceContainer.apiService,
           this.serviceContainer.logService,
           this.serviceContainer.keyConnectorService,
           this.serviceContainer.environmentService,
           this.serviceContainer.syncService,
           this.serviceContainer.organizationApiService,
           this.serviceContainer.logout,
-          this.serviceContainer.kdfConfigService,
         );
         const response = await command.run(null, null);
         if (!response.success) {

apps/cli/src/oss-serve-configurator.ts

@@ -120,16 +120,14 @@ export class OssServeConfigurator {
       this.serviceContainer.accountService,
       this.serviceContainer.masterPasswordService,
       this.serviceContainer.cryptoService,
-      this.serviceContainer.stateService,
+      this.serviceContainer.userVerificationService,
       this.serviceContainer.cryptoFunctionService,
-      this.serviceContainer.apiService,
       this.serviceContainer.logService,
       this.serviceContainer.keyConnectorService,
       this.serviceContainer.environmentService,
       this.serviceContainer.syncService,
       this.serviceContainer.organizationApiService,
       async () => await this.serviceContainer.logout(),
-      this.serviceContainer.kdfConfigService,
     );
 
     this.sendCreateCommand = new SendCreateCommand(

apps/cli/src/program.ts

@@ -270,16 +270,14 @@
             this.serviceContainer.accountService,
             this.serviceContainer.masterPasswordService,
             this.serviceContainer.cryptoService,
-            this.serviceContainer.stateService,
+            this.serviceContainer.userVerificationService,
             this.serviceContainer.cryptoFunctionService,
-            this.serviceContainer.apiService,
             this.serviceContainer.logService,
             this.serviceContainer.keyConnectorService,
             this.serviceContainer.environmentService,
             this.serviceContainer.syncService,
             this.serviceContainer.organizationApiService,
             async () => await this.serviceContainer.logout(),
-            this.serviceContainer.kdfConfigService,
           );
           const response = await command.run(password, cmd);
           this.processResponse(response);

apps/cli/src/service-container.ts

@@ -612,8 +612,7 @@
     const lockedCallback = async (userId?: string) =>
       await this.cryptoService.clearStoredUserKey(KeySuffixOptions.Auto);
 
     this.userVerificationService = new UserVerificationService(
-      this.stateService,
       this.cryptoService,
       this.accountService,
       this.masterPasswordService,

libs/angular/src/auth/components/lock.component.ts

@@ -17,9 +17,12 @@
 import { InternalMasterPasswordServiceAbstraction } from "@bitwarden/common/auth/abstractions/master-password.service.abstraction";
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
 import { AuthenticationStatus } from "@bitwarden/common/auth/enums/authentication-status";
+import { VerificationType } from "@bitwarden/common/auth/enums/verification-type";
 import { ForceSetPasswordReason } from "@bitwarden/common/auth/models/domain/force-set-password-reason";
-import { SecretVerificationRequest } from "@bitwarden/common/auth/models/request/secret-verification.request";
-import { MasterPasswordPolicyResponse } from "@bitwarden/common/auth/models/response/master-password-policy.response";
+import {
+  MasterPasswordVerification,
+  MasterPasswordVerificationResponse,
+} from "@bitwarden/common/auth/types/verification";
 import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action.enum";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
 import { EnvironmentService } from "@bitwarden/common/platform/abstractions/environment.service";
@@ -29,7 +32,7 @@
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
 import { StateService } from "@bitwarden/common/platform/abstractions/state.service";
 import { BiometricStateService } from "@bitwarden/common/platform/biometrics/biometric-state.service";
-import { HashPurpose, KeySuffixOptions } from "@bitwarden/common/platform/enums";
+import { KeySuffixOptions } from "@bitwarden/common/platform/enums";
 import { PasswordStrengthServiceAbstraction } from "@bitwarden/common/tools/password-strength";
 import { UserId } from "@bitwarden/common/types/guid";
 import { UserKey } from "@bitwarden/common/types/key";
@@ -45,7 +48,7 @@
   pinEnabled = false;
   masterPasswordEnabled = false;
   webVaultHostname = "";
-  formPromise: Promise<MasterPasswordPolicyResponse>;
+  formPromise: Promise<MasterPasswordVerificationResponse>;
   supportsBiometric: boolean;
   biometricLock: boolean;
 
@@ -218,51 +221,30 @@
   }
 
   private async doUnlockWithMasterPassword() {
-    const kdfConfig = await this.kdfConfigService.getKdfConfig();
     const userId = (await firstValueFrom(this.accountService.activeAccount$))?.id;
 
-    const masterKey = await this.cryptoService.makeMasterKey(
-      this.masterPassword,
-      this.email,
-      kdfConfig,
-    );
-    const storedMasterKeyHash = await firstValueFrom(
-      this.masterPasswordService.masterKeyHash$(userId),
-    );
+    const verification = {
+      type: VerificationType.MasterPassword,
+      secret: this.masterPassword,
+    } as MasterPasswordVerification;
 
     let passwordValid = false;
-
-    if (storedMasterKeyHash != null) {
-      // Offline unlock possible
-      passwordValid = await this.cryptoService.compareAndUpdateKeyHash(
-        this.masterPassword,
-        masterKey,
+    let response: MasterPasswordVerificationResponse;
+    try {
+      this.formPromise = this.userVerificationService.verifyUserByMasterPassword(
+        verification,
+        userId,
+        this.email,
       );
-    } else {
-      // Online only
-      const request = new SecretVerificationRequest();
-      const serverKeyHash = await this.cryptoService.hashMasterKey(
-        this.masterPassword,
-        masterKey,
-        HashPurpose.ServerAuthorization,
+      response = await this.formPromise;
+      this.enforcedMasterPasswordOptions = MasterPasswordPolicyOptions.fromResponse(
+        response.policyOptions,
       );
-      request.masterPasswordHash = serverKeyHash;
-      try {
-        this.formPromise = this.apiService.postAccountVerifyPassword(request);
-        const response = await this.formPromise;
-        this.enforcedMasterPasswordOptions = MasterPasswordPolicyOptions.fromResponse(response);
-        passwordValid = true;
-        const localKeyHash = await this.cryptoService.hashMasterKey(
-          this.masterPassword,
-          masterKey,
-          HashPurpose.LocalAuthorization,
-        );
-        await this.masterPasswordService.setMasterKeyHash(localKeyHash, userId);
-      } catch (e) {
-        this.logService.error(e);
-      } finally {
-        this.formPromise = null;
-      }
+      passwordValid = true;
+    } catch (e) {
+      this.logService.error(e);
+    } finally {
+      this.formPromise = null;
     }
 
     if (!passwordValid) {
@@ -274,8 +256,9 @@
       return;
     }
 
-    const userKey = await this.masterPasswordService.decryptUserKeyWithMasterKey(masterKey);
-    await this.masterPasswordService.setMasterKey(masterKey, userId);
+    const userKey = await this.masterPasswordService.decryptUserKeyWithMasterKey(
+      response.masterKey,
+    );
     await this.setUserKeyAndContinue(userKey, true);
   }
 

libs/angular/src/services/jslib-services.module.ts

@@ -874,7 +874,6 @@ const safeProviders: SafeProvider[] = [
     provide: UserVerificationServiceAbstraction,
     useClass: UserVerificationService,
     deps: [
-      StateServiceAbstraction,
       CryptoServiceAbstraction,
       AccountServiceAbstraction,
       InternalMasterPasswordServiceAbstraction,

libs/common/src/abstractions/api.service.ts

@@ -61,7 +61,6 @@ import { IdentityCaptchaResponse } from "../auth/models/response/identity-captch
 import { IdentityTokenResponse } from "../auth/models/response/identity-token.response";
 import { IdentityTwoFactorResponse } from "../auth/models/response/identity-two-factor.response";
 import { KeyConnectorUserKeyResponse } from "../auth/models/response/key-connector-user-key.response";
-import { MasterPasswordPolicyResponse } from "../auth/models/response/master-password-policy.response";
 import { PreloginResponse } from "../auth/models/response/prelogin.response";
 import { RegisterResponse } from "../auth/models/response/register.response";
 import { SsoPreValidateResponse } from "../auth/models/response/sso-pre-validate.response";
@@ -175,9 +174,6 @@ export abstract class ApiService {
   postAccountKeys: (request: KeysRequest) => Promise<any>;
   postAccountVerifyEmail: () => Promise<any>;
   postAccountVerifyEmailToken: (request: VerifyEmailRequest) => Promise<any>;
-  postAccountVerifyPassword: (
-    request: SecretVerificationRequest,
-  ) => Promise<MasterPasswordPolicyResponse>;
   postAccountRecoverDelete: (request: DeleteRecoverRequest) => Promise<any>;
   postAccountRecoverDeleteToken: (request: VerifyDeleteRecoverRequest) => Promise<any>;
   postAccountKdf: (request: KdfRequest) => Promise<any>;

libs/common/src/auth/abstractions/user-verification/user-verification-api.service.abstraction.ts

@@ -1,6 +1,11 @@
+import { SecretVerificationRequest } from "../../models/request/secret-verification.request";
 import { VerifyOTPRequest } from "../../models/request/verify-otp.request";
+import { MasterPasswordPolicyResponse } from "../../models/response/master-password-policy.response";
 
 export abstract class UserVerificationApiServiceAbstraction {
   postAccountVerifyOTP: (request: VerifyOTPRequest) => Promise<void>;
   postAccountRequestOTP: () => Promise<void>;
+  postAccountVerifyPassword: (
+    request: SecretVerificationRequest,
+  ) => Promise<MasterPasswordPolicyResponse>;
 }