[PM-32421] CLI: prevent false-success SSO login when account cannot decrypt (#18992) - #19044
[PM-32421] CLI: prevent false-success SSO login when account cannot decrypt (#18992)#19044HadiAyache wants to merge 1 commit into
Conversation
|
|
|
Thank you for your contribution! We've added this to our internal tracking system for review. Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process. |
bitwarden-bot
changed the title
c18f569 to
518c775
Compare
518c775 to
b1b2972
Compare
|
Quick status: current failing checks appear to be permission-gated workflow checks (author permission level) rather than deterministic code/test failures in this branch. If maintainers can rerun/approve the gated workflow path, I can immediately address any concrete code failures that remain. |
|
@HadiAyache thank you for your submission. We've chosen to solve this with product approved copy internally and simply based on known supported user decryption options with #22411. |
4 participants
Summary
Fixes a CLI SSO edge case where login reports "You are logged in!" even though the account cannot decrypt/unlock in CLI.
This updates SSO validation to fail early only when all are true:
This avoids over-blocking valid no-master-password flows (for example, key connector setup).
Changes
apps/cli/src/auth/commands/login.command.tsvalidateSsoUserInMpEncryptionOrgHasMpgating logicapps/cli/src/auth/commands/login.command.spec.ts(new)Tests
Ran locally:
npx jest apps/cli/src/auth/commands/login.command.spec.ts --runInBandnpx jest libs/auth/src/common/login-strategies/sso-login.strategy.spec.ts --runInBandnpx jest apps/cli/src/key-management/commands/unlock.command.spec.ts --runInBandAll passed.
Closes #18992