Skip to content

PM-31118: feat: Add support for SDK pin unlock #7289

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
david-livefront merged 1 commit into from
Aug 24, 2026
Merged

PM-31118: feat: Add support for SDK pin unlock #7289

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 33 additions & 19 deletions app/src/main/kotlin/com/x8bit/bitwarden/data/vault/repository/VaultRepositoryImpl.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package com.x8bit.bitwarden.data.vault.repository

import com.bitwarden.core.InitUserCryptoMethod
import com.bitwarden.core.data.manager.dispatcher.DispatcherManager
import com.bitwarden.core.data.manager.model.FlagKey
import com.bitwarden.core.data.repository.error.MissingPropertyException
import com.bitwarden.core.data.repository.model.DataState
import com.bitwarden.core.data.repository.util.bufferedMutableSharedFlow
Expand All @@ -22,6 +23,7 @@ import com.x8bit.bitwarden.data.auth.datasource.disk.AuthDiskSource
import com.x8bit.bitwarden.data.auth.repository.util.toSdkParams
import com.x8bit.bitwarden.data.autofill.util.login
import com.x8bit.bitwarden.data.platform.error.NoActiveUserException
import com.x8bit.bitwarden.data.platform.manager.FeatureFlagManager
import com.x8bit.bitwarden.data.platform.util.isActive
import com.x8bit.bitwarden.data.vault.datasource.disk.VaultDiskSource
import com.x8bit.bitwarden.data.vault.datasource.sdk.VaultSdkSource
Expand Down Expand Up @@ -70,7 +72,7 @@ import javax.crypto.Cipher
* Default implementation of [VaultRepository].
*/
@Suppress("TooManyFunctions", "LongParameterList")
class VaultRepositoryImpl(
internal class VaultRepositoryImpl(
private val vaultDiskSource: VaultDiskSource,
private val vaultSdkSource: VaultSdkSource,
private val authDiskSource: AuthDiskSource,
Expand All @@ -82,6 +84,7 @@ class VaultRepositoryImpl(
private val vaultSyncManager: VaultSyncManager,
private val credentialExchangeImportManager: CredentialExchangeImportManager,
private val pinProtectedUserKeyManager: PinProtectedUserKeyManager,
private val featureFlagManager: FeatureFlagManager,
Comment thread
david-livefront marked this conversation as resolved.
dispatcherManager: DispatcherManager,
) : VaultRepository,
CipherManager by cipherManager,
Expand Down Expand Up @@ -371,28 +374,16 @@ class VaultRepositoryImpl(
override suspend fun unlockVaultWithPin(
pin: String,
): VaultUnlockResult {
val userId = activeUserId
?: return VaultUnlockResult.InvalidStateError(error = NoActiveUserException())
val userId = activeUserId ?: return VaultUnlockResult.InvalidStateError(
error = NoActiveUserException(),
)

return authDiskSource.getPinProtectedUserKeyEnvelope(userId = userId)
?.let { pinProtectedUserKeyEnvelope ->
this.unlockVaultForUser(
userId = userId,
initUserCryptoMethod = InitUserCryptoMethod.PinEnvelope(
pin = pin,
pinProtectedUserKeyEnvelope = pinProtectedUserKeyEnvelope,
),
)
}
?: run {
return authDiskSource
.getPinProtectedUserKey(userId = userId)
?.let { pinProtectedUserKey ->
// This is needed to support unlocking with a legacy pin protected user key.
// Once the vault is unlocked, the user's pin protected user key is migrated to
// a pin protected user key envelope.
val pinProtectedUserKey = authDiskSource.getPinProtectedUserKey(userId = userId)
?: return VaultUnlockResult.InvalidStateError(
error = MissingPropertyException("Pin protected key"),
)

this.unlockVaultForUser(
userId = userId,
initUserCryptoMethod = InitUserCryptoMethod.Pin(
Expand All @@ -401,6 +392,29 @@ class VaultRepositoryImpl(
),
)
}
?: run {
Comment thread
david-livefront marked this conversation as resolved.
if (featureFlagManager.getFeatureFlag(key = FlagKey.SdkPinUnlock)) {
this.unlockVaultForUser(
userId = userId,
initUserCryptoMethod = InitUserCryptoMethod.PinState(pin = pin),

@david-livefront david-livefront Aug 21, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With this new init method, the SDK will retrieve the pinProtectedUserKeyEnvelope using the SdkStateBridge.

)
} else {
authDiskSource
.getPinProtectedUserKeyEnvelope(userId = userId)
?.let { pinProtectedUserKeyEnvelope ->
this.unlockVaultForUser(
userId = userId,
initUserCryptoMethod = InitUserCryptoMethod.PinEnvelope(
pin = pin,
pinProtectedUserKeyEnvelope = pinProtectedUserKeyEnvelope,
),
)
}
?: VaultUnlockResult.InvalidStateError(
error = MissingPropertyException("Pin protected key envelope"),
)
}
}
}

override suspend fun generateTotp(
Expand Down
3 changes: 3 additions & 0 deletions app/src/main/kotlin/com/x8bit/bitwarden/data/vault/repository/di/VaultRepositoryModule.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package com.x8bit.bitwarden.data.vault.repository.di

import com.bitwarden.core.data.manager.dispatcher.DispatcherManager
import com.x8bit.bitwarden.data.auth.datasource.disk.AuthDiskSource
import com.x8bit.bitwarden.data.platform.manager.FeatureFlagManager
import com.x8bit.bitwarden.data.vault.datasource.disk.VaultDiskSource
import com.x8bit.bitwarden.data.vault.datasource.sdk.VaultSdkSource
import com.x8bit.bitwarden.data.vault.manager.CipherManager
Expand Down Expand Up @@ -42,6 +43,7 @@ object VaultRepositoryModule {
vaultSyncManager: VaultSyncManager,
credentialExchangeImportManager: CredentialExchangeImportManager,
pinProtectedUserKeyManager: PinProtectedUserKeyManager,
featureFlagManager: FeatureFlagManager,
): VaultRepository = VaultRepositoryImpl(
vaultDiskSource = vaultDiskSource,
vaultSdkSource = vaultSdkSource,
Expand All @@ -55,5 +57,6 @@ object VaultRepositoryModule {
vaultSyncManager = vaultSyncManager,
credentialExchangeImportManager = credentialExchangeImportManager,
pinProtectedUserKeyManager = pinProtectedUserKeyManager,
featureFlagManager = featureFlagManager,
)
}
Loading
Loading