github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-13 13:44:36 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

[PR #2686] [PM-3394] Fix login with device for passwordless approvals #3737

New Issue
Closed
opened 2025-11-26 23:36:42 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-26 23:36:42 -06:00
Owner
Copy Link

Original Pull Request: https://github.com/bitwarden/android/pull/2686

State: closed
Merged: Yes

Type of change

  • Bug fix
  • New feature development
  • Tech debt (refactoring, code cleanup, dependency upgrades, etc)
  • Build/deploy pipeline (DevOps)
  • Other

Objective

If the approving device doesn't have a master key, users should still be able to use Login with Device. This adds a token request in that instance, and sets the user key after.

While investigating this, I discovered that we're not clearing the active user id when adding a new account. This is problematic because isAuthenticated simply checks if the user id is null.
Edit: I originally fixed this by setting the active user Id to null but we can't do that for autofill purposes. Instead I am passing the AuthRequestType to any auth request logic so we know whether to use the Admin Approval logic or Unlock and Authenticate.

I also discovered that our background script to log out inactive accounts was attempting to set the user key if the vault timeout was set to 'never'. This change prevents that from happening as well, simply just returning if we have an auto key without using it.

Code changes

  • file.ext: Description of what was changed and why

Screenshots

Before you submit

  • Please check for formatting errors (dotnet format --verify-no-changes) (required)
  • Please add unit tests where it makes sense to do so (encouraged but not required)
  • If this change requires a documentation update - notify the documentation team
  • If this change has particular deployment requirements - notify the DevOps team
**Original Pull Request:** https://github.com/bitwarden/android/pull/2686 **State:** closed **Merged:** Yes --- ## Type of change - [x] Bug fix - [ ] New feature development - [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc) - [ ] Build/deploy pipeline (DevOps) - [ ] Other ## Objective <!--Describe what the purpose of this PR is. For example: what bug you're fixing or what new feature you're adding--> If the approving device doesn't have a master key, users should still be able to use Login with Device. This adds a token request in that instance, and sets the user key after. While investigating this, I discovered that we're not clearing the active user id when adding a new account. This is problematic because `isAuthenticated` simply checks if the user id is `null`. **Edit:** I originally fixed this by setting the active user Id to `null` but we can't do that for autofill purposes. Instead I am passing the `AuthRequestType` to any auth request logic so we know whether to use the Admin Approval logic or Unlock and Authenticate. I also discovered that our background script to log out inactive accounts was attempting to set the user key if the vault timeout was set to 'never'. This change prevents that from happening as well, simply just returning if we have an auto key without using it. ## Code changes <!--Explain the changes you've made to each file or major component. This should help the reviewer understand your changes--> <!--Also refer to any related changes or PRs in other repositories--> * **file.ext:** Description of what was changed and why ## Screenshots <!--Required for any UI changes. Delete if not applicable--> ## Before you submit - Please check for formatting errors (`dotnet format --verify-no-changes`) (required) - Please add **unit tests** where it makes sense to do so (encouraged but not required) - If this change requires a **documentation update** - notify the documentation team - If this change has particular **deployment requirements** - notify the DevOps team
GiteaMirror added the pull-request label 2025-11-26 23:36:42 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#3737
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?