PM-40278: bug: Freeze public key and fingerprint during auth request and validate against updates#7166
Conversation
github-actions
Bot
added
app:password-manager
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #7166 +/- ##
==========================================
- Coverage 86.07% 85.67% -0.40%
==========================================
Files 885 928 +43
Lines 64652 66433 +1781
Branches 9628 9671 +43
==========================================
+ Hits 55646 56916 +1270
- Misses 5553 6054 +501
- Partials 3453 3463 +10
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
🤖 Bitwarden Claude Code ReviewOverall Assessment: APPROVE This PR hardens the auth request approval flow in Code Review DetailsNo blocking or actionable findings. |
…and validate against updates
ea1838a to
0449afd
Compare
| while (currentCoroutineContext().isActive && !isComplete) { | ||
| delay(PASSWORDLESS_APPROVER_INTERVAL_MILLIS) | ||
| val updateResult = result as AuthRequestUpdatesResult.Update | ||
| delay(PASSWORDLESS_APPROVER_INTERVAL_MILLIS.milliseconds) |
There was a problem hiding this comment.
kudos for dealing with the deprecated overload! 
|
|
||
| @Suppress("MaxLineLength") | ||
| @Test | ||
| fun `getAuthRequestByIdFlow should emit update then declined and cancel when polled fingerprint does not match initial fingerprint`() = |
|
Thanks @vvolkgang |
2 participants
🎟️ Tracking
PM-40278
📔 Objective
This PR updates the Auth Requests flow. By locking the public key (and fingerprint) in with the first request but validating against subsequent requests we can ensure that the server has not changed during the process.