Skip to content

Auth / PM-32421 - CLI - Login Command - Validate SSO account has a CLI-supported decryption path - #22411

Merged
JaredSnider-Bitwarden merged 4 commits into
mainfrom
auth/pm-32421/cli-sso-login-improve-decryption-validation
Aug 20, 2026
Merged

Auth / PM-32421 - CLI - Login Command - Validate SSO account has a CLI-supported decryption path#22411
JaredSnider-Bitwarden merged 4 commits into
mainfrom
auth/pm-32421/cli-sso-login-improve-decryption-validation

Conversation

@JaredSnider-Bitwarden

@JaredSnider-Bitwarden JaredSnider-Bitwarden commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-32421
#18992

📔 Objective

Consolidates the post-SSO-login decryption path check into a single guard that short-circuits on master password or Key Connector and otherwise throws a remediation-specific error for TDE, PRF passkey, or an MP-encryption org member who never set an MP. Closes the gap where TDE and PRF-only accounts reached "You are logged in!" without a viable decryption path in CLI.

📸 Screenshots

Only recording TDE as the tests prove the other cases + it's the core problem we are fixing with displaying a clearer error.

PM-32421.-.CLI.-.SSO.+.TDE.-.Login.Error.Improved.mov

@JaredSnider-Bitwarden
PM-32421 - CLI: validate SSO account has a CLI-supported decryption path
c3b9631 
Consolidates the post-SSO-login decryption path check into a single guard
that short-circuits on master password or Key Connector and otherwise
throws a remediation-specific error for TDE, PRF passkey, or an MP-encryption
org member who never set an MP. Closes the gap where TDE and PRF-only accounts
reached "You are logged in!" without a viable decryption path in CLI.
@JaredSnider-Bitwarden JaredSnider-Bitwarden changed the title Auth / PM-32421 - CLI: validate SSO account has a CLI-supported decryption path Auth / PM-32421 - CLI - Login Command - Validate SSO account has a CLI-supported decryption path Aug 13, 2026
@codecov

codecov Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.21%. Comparing base (73edc74) to head (cb65f00).
✅ All tests successful. No failed tests found.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #22411      +/-   ##
==========================================
+ Coverage   54.20%   54.21%   +0.01%     
==========================================
  Files        4314     4314              
  Lines      137167   137169       +2     
  Branches    21712    21713       +1     
==========================================
+ Hits        74347    74372      +25     
+ Misses      57402    57382      -20     
+ Partials     5418     5415       -3

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@JaredSnider-Bitwarden JaredSnider-Bitwarden added t:bugfix Change Type - Bugfix ai-review Request a Claude code review labels Aug 13, 2026
@JaredSnider-Bitwarden
PM-32421 - Document PRF branch as defense-in-depth
e5a58bf 
Note that the PRF unsupported-path branch is currently unreachable via SSO
(server only populates PRF options through the WebAuthn grant) so a future
reader understands why the branch exists.
@github-actions

github-actions Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the renamed post-SSO guard validateSsoUserHasCliSupportedDecryptionPath in apps/cli/src/auth/commands/login.command.ts and the accompanying unit and end-to-end tests. The guard short-circuits on master password or Key Connector, then logs out and throws a state-specific remediation message for TDE, PRF, or a JIT-provisioned MP-encryption org member, which strictly narrows what the CLI accepts relative to the previous check — no previously rejected state becomes reachable, and TDE/PRF accounts that used to reach "You are logged in!" without a decryption path now fail with actionable guidance. Verified against UserDecryptionOptions that trustedDeviceOption, keyConnectorOption, and webAuthnPrfOptions are only populated when the corresponding option exists, that thrown Response objects are converted correctly by the outer catch via Response.error, and that the CLI has no trusted-device or auth-request login path that this guard would regress. No findings.

@JaredSnider-Bitwarden
JaredSnider-Bitwarden marked this pull request as ready for review August 13, 2026 19:52
@JaredSnider-Bitwarden
JaredSnider-Bitwarden requested a review from a team as a code owner August 13, 2026 19:52
@JaredSnider-Bitwarden
JaredSnider-Bitwarden requested review from enmande and rr-bw and removed request for enmande August 13, 2026 19:52
rr-bw
rr-bw approved these changes Aug 17, 2026
View reviewed changes
Comment thread apps/cli/src/auth/commands/login.command.ts
// MP-encryption org without completing setup.
throw Response.error(
"In order to log in with SSO from the CLI, you must first log in" +
" through the web vault, the desktop, or the extension to set your master password.",

@rr-bw rr-bw Aug 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit (non-blocking): web vault should be web app

  • 3 usages here
  • 2 usages in test file

@JaredSnider-Bitwarden
JaredSnider-Bitwarden merged commit ac1f433 into main Aug 20, 2026
66 of 70 checks passed
@JaredSnider-Bitwarden
JaredSnider-Bitwarden deleted the auth/pm-32421/cli-sso-login-improve-decryption-validation branch August 20, 2026 16:43
This was referenced Aug 20, 2026
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rr-bw rr-bw rr-bw approved these changes

Assignees

No one assigned

Labels

ai-review Request a Claude code review t:bugfix Change Type - Bugfix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@JaredSnider-Bitwarden @rr-bw