Skip to content

[PM-33162] Refactor user key rotation#7201

Open
Thomas-Avery wants to merge 3 commits intomainfrom
km/pm-33162
Open

[PM-33162] Refactor user key rotation#7201
Thomas-Avery wants to merge 3 commits intomainfrom
km/pm-33162

Conversation

@Thomas-Avery
Copy link
Contributor

@Thomas-Avery Thomas-Avery commented Mar 11, 2026

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-33162

📔 Objective

The objective of this PR is to refactor the current change password and user key rotation endpoint to use, via composition, a new base data model. This is preparation of adding a new endpoint to support none password change userKey rotation that will share the same base data model and processing logic.

Note to Auth reviewers:
The only auth code changes was moving MasterPasswordUnlockAndAuthenticationDataModel to KM ownership.
MasterPasswordUnlockAndAuthenticationDataModel the request model is only used on the KM key rotation endpoint. Let me know if you don't agree and want to still retain ownership.

@Thomas-Avery Thomas-Avery self-assigned this Mar 11, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 11, 2026

Logo
Checkmarx One – Scan Summary & Details73f674d2-5e52-45f2-a1eb-62a40f4cee66


New Issues (3) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 105
detailsMethod at line 105 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi...
Attack Vector
2 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1592
detailsMethod at line 1592 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
3 MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1419
detailsMethod at line 1419 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector

Fixed Issues (3) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 105
MEDIUM CSRF /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 105
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 293

@codecov
Copy link

codecov bot commented Mar 11, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.55%. Comparing base (c118f23) to head (b0e5467).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7201      +/-   ##
==========================================
+ Coverage   57.53%   57.55%   +0.01%     
==========================================
  Files        2032     2032              
  Lines       89486    89504      +18     
  Branches     7957     7954       -3     
==========================================
+ Hits        51487    51510      +23     
+ Misses      36154    36149       -5     
  Partials     1845     1845              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Thomas-Avery Thomas-Avery marked this pull request as ready for review March 11, 2026 21:21
@Thomas-Avery Thomas-Avery requested review from a team as code owners March 11, 2026 21:21

[HttpPost("key-management/rotate-user-account-keys")]
public async Task RotateUserAccountKeysAsync([FromBody] RotateUserAccountKeysAndDataRequestModel model)
public async Task PasswordChangeAndRotateUserAccountKeysAsync([FromBody] RotateUserAccountKeysAndDataRequestModel model)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

KM team, I've realized changing this method name will effect the SDK name of the generated API bindings. Do we think that is worth it or should I just revert it back to the original name?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm OK with it, it just means we need to fix the breaking API bindings PR. I.e we run the API bindings automation on the SDK repo and do a rename on that branch, and review. Should be fairly low effort?

@sonarqubecloud
Copy link

@Patrick-Pimentel-Bitwarden
Copy link
Contributor

Patrick-Pimentel-Bitwarden commented Mar 17, 2026

  1. Could you help me understand why we don't use the unlock and authentication data types separately for key rotation request model?
  2. Could we take the time here to update rotate account keys to standardize using the two independent request models (MasterPasswordUnlockData/MasterPasswordAuthenticationData) to make applying validation consistent and bring this endpoint in line with how all the other endpoints that concern unlock and authentication work?

@enmande enmande requested a review from ike-kottlowski March 17, 2026 14:21
Copy link
Contributor

@quexten quexten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good from my side; Only one question

@ike-kottlowski ike-kottlowski self-requested a review March 17, 2026 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants