github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-11-10 01:15:13 -06:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[PR #2769] [PM-3726] prevent legacy user login #3796

New Issue
Closed
opened 2025-11-26 23:37:18 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-26 23:37:18 -06:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/bitwarden/android/pull/2769

State: closed
Merged: Yes

Type of change

  • Bug fix
  • New feature development
  • Tech debt (refactoring, code cleanup, dependency upgrades, etc)
  • Build/deploy pipeline (DevOps)
  • Other

Objective

Prevent legacy users from logging in and direct them to the web vault for migration.

Code changes

Legacy users are detected early in the AuthService.LoginHelper by checking for the existence of a local hashed password (meaning MP was used to login) and the absence of a IdentityToken.Key. We can then return early before the authentication process and prevent any state from being set.

  • LockPageViewModel.cs: Prevents unlocks for legacy users. Most of these changes are formatting. I split out the SubmitAsync method into UnlockWithPinAsync and UnlockWithMasterPasswordAsync. I also am catching any LegacyUserException errors now in the SubmitAsync method in order to process them.
  • BaseLockPasswordViewController.cs: Duplicate changes as LockPageViewModel
  • LoginPageViewModel.cs: Prevent logins for legacy users. Note: Instead of using the LegacyUserException like on the LockPage, I have added AuthResult.RequiresEncryptionKeyMigration. The clients repo couldn't use an exception in the same way so I decided to keep the models similar.
  • AuthService.cs: If a user is logging in with their MP, we can determine if they are a legacy user and return early.
  • CryptoService.cs: Add ValidateUserKeyAsync and IsLegacyUserAsync for legacy user detection. Throw exceptions from migration methods if a legacy user is detected.
  • VaultTimeoutService.cs: If a legacy user has an auto key set, we need to catch the exception and log them out before they are migrated.

Screenshots

image

Before you submit

  • Please check for formatting errors (dotnet format --verify-no-changes) (required)
  • Please add unit tests where it makes sense to do so (encouraged but not required)
  • If this change requires a documentation update - notify the documentation team
  • If this change has particular deployment requirements - notify the DevOps team
**Original Pull Request:** https://github.com/bitwarden/android/pull/2769 **State:** closed **Merged:** Yes --- ## Type of change - [x] Bug fix - [ ] New feature development - [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc) - [ ] Build/deploy pipeline (DevOps) - [ ] Other ## Objective <!--Describe what the purpose of this PR is. For example: what bug you're fixing or what new feature you're adding--> Prevent legacy users from logging in and direct them to the web vault for migration. ## Code changes <!--Explain the changes you've made to each file or major component. This should help the reviewer understand your changes--> <!--Also refer to any related changes or PRs in other repositories--> Legacy users are detected early in the `AuthService.LoginHelper` by checking for the existence of a local hashed password (meaning MP was used to login) and the absence of a `IdentityToken.Key`. We can then return early before the authentication process and prevent any state from being set. - **LockPageViewModel.cs:** Prevents unlocks for legacy users. Most of these changes are formatting. I split out the `SubmitAsync` method into `UnlockWithPinAsync` and `UnlockWithMasterPasswordAsync`. I also am catching any `LegacyUserException` errors now in the `SubmitAsync` method in order to process them. - **BaseLockPasswordViewController.cs:** Duplicate changes as `LockPageViewModel` - **LoginPageViewModel.cs:** Prevent logins for legacy users. **Note:** Instead of using the `LegacyUserException` like on the LockPage, I have added `AuthResult.RequiresEncryptionKeyMigration`. The clients repo couldn't use an exception in the same way so I decided to keep the models similar. - **AuthService.cs:** If a user is logging in with their MP, we can determine if they are a legacy user and return early. - **CryptoService.cs:** Add `ValidateUserKeyAsync` and `IsLegacyUserAsync` for legacy user detection. Throw exceptions from migration methods if a legacy user is detected. - **VaultTimeoutService.cs:** If a legacy user has an auto key set, we need to catch the exception and log them out before they are migrated. ## Screenshots <!--Required for any UI changes. Delete if not applicable--> ![image](https://github.com/bitwarden/mobile/assets/24985544/52fdff17-2c55-451b-8960-f53c44738b36) ## Before you submit - Please check for formatting errors (`dotnet format --verify-no-changes`) (required) - Please add **unit tests** where it makes sense to do so (encouraged but not required) - If this change requires a **documentation update** - notify the documentation team - If this change has particular **deployment requirements** - notify the DevOps team
GiteaMirror added the pull-request label 2025-11-26 23:37:18 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#3796