PM-27241: feat: TDE encryption v2 by david-livefront · Pull Request #6821 · bitwarden/android

david-livefront · 2026-04-22T15:17:05Z

🎟️ Tracking

📔 Objective

This PR adds the updated v2 encryption flow for a SSO TDE new user.

codecov · 2026-04-22T15:21:15Z

Codecov Report

❌ Patch coverage is 97.84946% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.75%. Comparing base (e6f0db6) to head (bf0e8a6).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...twarden/data/auth/repository/AuthRepositoryImpl.kt	97.53%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6821      +/-   ##
==========================================
- Coverage   85.80%   85.75%   -0.06%     
==========================================
  Files         836      839       +3     
  Lines       59408    59494      +86     
  Branches     8672     8676       +4     
==========================================
+ Hits        50977    51020      +43     
- Misses       5442     5483      +41     
- Partials     2989     2991       +2

Flag	Coverage Δ
app-data	`17.60% <97.84%> (+0.06%)`	⬆️
app-ui-auth-tools	`20.11% <0.00%> (-0.02%)`	⬇️
app-ui-platform	`15.84% <0.00%> (-0.02%)`	⬇️
app-ui-vault	`25.64% <0.00%> (-0.02%)`	⬇️
authenticator	`6.60% <0.00%> (-0.01%)`	⬇️
lib-core-network-bridge	`4.28% <0.00%> (-0.01%)`	⬇️
lib-data-ui	`1.02% <0.00%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions · 2026-04-22T15:23:41Z

Checkmarx One – Scan Summary & Details – 4d14c4de-81f9-4fe5-a651-64cecb833186

Great job! No new security vulnerabilities introduced in this pull request

github-actions · 2026-05-01T14:19:03Z

🤖 Bitwarden Claude Code Review

Overall Assessment: REQUEST CHANGES

This PR introduces the v2 TDE encryption flow for new SSO users behind the V2EncryptionTde feature flag, adding postKeysForTdeRegistration to the SDK source and splitting createNewSsoUser into v1/v2 branches. The v1 path is preserved in registerUserForTdeV1 and the new v2 path in registerUserForTdeV2 calls unlockVault directly using the wrapped account cryptographic state returned from the SDK. New unit tests cover the success path and the SDK-level failure path for v2.

Code Review Details

⚠️ : unlockVault failures in registerUserForTdeV2 are wrapped as Result.success(VaultUnlockError) and reported to the caller as NewSsoUserResult.Success, leaving the user with a locked vault and partially set up state.
- app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepositoryImpl.kt:574

claude · 2026-05-01T14:22:45Z

+            .map { response ->
+                // Clear the 'should trust device' flag, since the SDK trusted the device above.
+                authDiskSource.storeShouldTrustDevice(userId = userId, shouldTrustDevice = null)
+                this
+                    .unlockVault(
+                        accountCryptographicState = response.accountCryptographicState,
+                        accountProfile = profile,
+                        initUserCryptoMethod = InitUserCryptoMethod.DecryptedKey(
+                            decryptedUserKey = response.userKey,
+                        ),
+                    )
+                    .also { result ->
+                        if (result is VaultUnlockResult.Success) {
+                            authDiskSource.storeAccountKeys(
+                                userId = userId,
+                                accountKeys = response.accountCryptographicState.accountKeysJson,
+                            )
+
+                            // Storing the private key here for legacy purposes, the
+                            // `accountKeysJson` stored above will be used for most purposes.
+                            authDiskSource.storePrivateKey(
+                                userId = userId,
+                                privateKey = response.accountCryptographicState.privateKey,
+                            )
+                            if (shouldTrustDevice) {
+                                authDiskSource.storeDeviceKey(
+                                    userId = userId,
+                                    deviceKey = response.deviceKey,
+                                )
+                            }
+                        }
+                    }
+            }
    }


⚠️ IMPORTANT: unlockVault failures are silently swallowed and reported as NewSsoUserResult.Success.

Details and fix

registerUserForTdeV2 returns Result<VaultUnlockResult>. When postKeysForTdeRegistration succeeds but unlockVault returns a VaultUnlockError variant (e.g., GenericError, InvalidStateError), the .map { ... } block still completes and produces Result.success(VaultUnlockResult.GenericError(...)). The outer createNewSsoUser then runs .fold(onSuccess = { NewSsoUserResult.Success }, ...), which ignores the wrapped error variant and returns NewSsoUserResult.Success. The caller (TrustedDeviceViewModel.handleContinueClick) treats Success as a fully completed login and navigates the user forward, but the vault is locked, account keys were never stored, and shouldTrustDevice has already been cleared on disk.

The AuthRepository.createNewSsoUser KDoc explicitly states: "Upon success the new user will also have the vault automatically unlocked for them." That contract is broken here.

The V2 JIT password flow already handles this correctly — see registerUserForJitPasswordV2 around line 1314:

.flatMap { response -> when (val result = vaultRepository.unlockVaultWithMasterPassword(password)) { VaultUnlockResult.Success -> response.asSuccess() is VaultUnlockError -> { (result.error ?: IllegalStateException("Failed to unlock vault")) .asFailure() } } }

Suggest converting the .map { ... } here to a .flatMap { ... } that turns a VaultUnlockError into Result.failure, matching that pattern. The on-success disk writes can then run inside the Success branch (or in a subsequent .onSuccess).

@claude That is intended.

david-livefront · 2026-05-01T15:17:57Z

Thanks @quexten & @SaintPatrck

github-actions Bot added app:password-manager Bitwarden Password Manager app context app:authenticator Bitwarden Authenticator app context t:feature Change Type - Feature Development labels Apr 22, 2026

david-livefront force-pushed the PM-27241-tde-v2-encryption branch from f2d2d21 to cb67878 Compare April 22, 2026 15:25

github-actions Bot removed the app:authenticator Bitwarden Authenticator app context label Apr 22, 2026

david-livefront force-pushed the PM-27241-tde-v2-encryption branch 2 times, most recently from b5f6dd7 to 30fb187 Compare April 29, 2026 16:35

quexten reviewed Apr 30, 2026

View reviewed changes

Comment thread app/src/main/kotlin/com/x8bit/bitwarden/data/auth/repository/AuthRepositoryImpl.kt Outdated

david-livefront force-pushed the PM-27241-tde-v2-encryption branch from 30fb187 to 6016e1b Compare April 30, 2026 14:19

PM-27241: TDE encryption v2

bf0e8a6

david-livefront force-pushed the PM-27241-tde-v2-encryption branch from 6016e1b to bf0e8a6 Compare May 1, 2026 14:17

github-actions Bot added app:authenticator Bitwarden Authenticator app context t:deps Change Type - Dependencies labels May 1, 2026

david-livefront marked this pull request as ready for review May 1, 2026 14:18

david-livefront requested a review from a team as a code owner May 1, 2026 14:18

david-livefront added ai-review-vnext Request a Claude code review using the vNext workflow and removed t:deps Change Type - Dependencies labels May 1, 2026

claude Bot reviewed May 1, 2026

View reviewed changes

quexten approved these changes May 1, 2026

View reviewed changes

SaintPatrck approved these changes May 1, 2026

View reviewed changes

david-livefront added this pull request to the merge queue May 1, 2026

Merged via the queue into main with commit a1cf193 May 1, 2026
41 of 42 checks passed

david-livefront deleted the PM-27241-tde-v2-encryption branch May 1, 2026 15:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PM-27241: feat: TDE encryption v2#6821

PM-27241: feat: TDE encryption v2#6821
david-livefront merged 1 commit intomainfrom
PM-27241-tde-v2-encryption

david-livefront commented Apr 22, 2026 •

edited by atlassian Bot

Loading

Uh oh!

codecov Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented May 1, 2026 •

edited

Loading

Uh oh!

claude Bot May 1, 2026

Uh oh!

david-livefront May 1, 2026

Uh oh!

david-livefront commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

david-livefront commented Apr 22, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎟️ Tracking

📔 Objective

Uh oh!

codecov Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Great job! No new security vulnerabilities introduced in this pull request

Uh oh!

Uh oh!

github-actions Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Bitwarden Claude Code Review

Uh oh!

claude Bot May 1, 2026

Choose a reason for hiding this comment

Uh oh!

david-livefront May 1, 2026

Choose a reason for hiding this comment

Uh oh!

david-livefront commented May 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

david-livefront commented Apr 22, 2026 •

edited by atlassian Bot

Loading

codecov Bot commented Apr 22, 2026 •

edited

Loading

github-actions Bot commented Apr 22, 2026 •

edited

Loading

github-actions Bot commented May 1, 2026 •

edited

Loading