Auth / PM-32421 - CLI - Login Command - Validate SSO account has a CLI-supported decryption path

[JaredSnider-Bitwarden]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-32421
#18992

📔 Objective

Consolidates the post-SSO-login decryption path check into a single guard that short-circuits on master password or Key Connector and otherwise throws a remediation-specific error for TDE, PRF passkey, or an MP-encryption org member who never set an MP. Closes the gap where TDE and PRF-only accounts reached "You are logged in!" without a viable decryption path in CLI.

📸 Screenshots

Only recording TDE as the tests prove the other cases + it's the core problem we are fixing with displaying a clearer error.

PM-32421.-.CLI.-.SSO.+.TDE.-.Login.Error.Improved.mov

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.86%. Comparing base (9001fdd) to head (e5a58bf).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #22411      +/-   ##
==========================================
+ Coverage   53.63%   53.86%   +0.23%     
==========================================
  Files        4287     4293       +6     
  Lines      136043   136326     +283     
  Branches    21494    21547      +53     
==========================================
+ Hits        72961    73433     +472     
+ Misses      57733    57534     -199     
- Partials     5349     5359      +10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the CLI post-SSO decryption path guard in apps/cli/src/auth/commands/login.command.ts and its accompanying tests. The rewritten validateSsoUserHasCliSupportedDecryptionPath short-circuits on master password or Key Connector and otherwise logs out and throws a state-specific remediation message for TDE, PRF, or a JIT-provisioned MP-encryption org member, which strictly narrows what is accepted relative to the previous check — no previously blocked state becomes reachable. Verified the TDE rejection is safe for the CLI: device keys live in NodeEnvSecureStorageService keyed off BW_SESSION, which validatedParams() regenerates on every login, so trusted-device decryption cannot succeed there. Test coverage exercises each branch directly plus an end-to-end SSO run, env vars are snapshot/restored, and canInteract is re-read inside run() so the nested BW_NOINTERACTION override takes effect.

Code Review Details

No findings.

Notes considered and dismissed during validation:

• webAuthnPrfOptions is an array, so a truthy empty array would select the PRF message over the "set your master password" message — not reachable, since UserDecryptionOptions.fromIdentityTokenResponse only assigns the field when a valid option exists and never assigns [], and this branch is already documented as unreachable defense-in-depth.
• Hardcoded English error strings match the existing convention throughout login.command.ts.
• Behavior change worth noting for release notes rather than as a finding: TDE-only and PRF-only SSO accounts that previously reached "You are logged in!" (without a usable unlock path) are now logged out with an explicit error.