Skip to content

Auth/poc/master password service example#7349

Draft
Patrick-Pimentel-Bitwarden wants to merge 29 commits intomainfrom
auth/poc/master-password-service-example
Draft

Auth/poc/master password service example#7349
Patrick-Pimentel-Bitwarden wants to merge 29 commits intomainfrom
auth/poc/master-password-service-example

Conversation

@Patrick-Pimentel-Bitwarden
Copy link
Copy Markdown
Contributor

🎟️ Tracking

📔 Objective

📸 Screenshots

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 30, 2026

Logo
Checkmarx One – Scan Summary & Detailsd6202e1f-0fff-44f4-a09b-441a6065f736


New Issues (2) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 HIGH Path_Traversal /src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs: 56
detailsMethod at line 56 of /src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs gets dynamic data from the model element. This ...
Attack Vector
2 MEDIUM CSRF /src/Api/Auth/Controllers/EmergencyAccessController.cs: 174
detailsMethod at line 174 of /src/Api/Auth/Controllers/EmergencyAccessController.cs gets a parameter from a user request from model. This parameter val...
Attack Vector

Fixed Issues (5) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 145
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 721
MEDIUM CSRF /src/Api/Auth/Controllers/EmergencyAccessController.cs: 173
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 385
MEDIUM CSRF /src/Api/Auth/Controllers/AccountsController.cs: 412

… Tests are broken but getting closer to the ideal setup.
…to use the unlock and authentication data. Also added in a new master password function to build the transaction for set password
…s around set data and updating occurences to use the master password service.
… around the request models and tightening them up to all be shaped similarly
… updated the changekdf function to use the master password service.
…request models and the master password service.
…assword to use it's own standalone request and added commment for other function.
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 10, 2026

Codecov Report

❌ Patch coverage is 61.10345% with 282 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.10%. Comparing base (9e49955) to head (aeb77a8).
⚠️ Report is 9 commits behind head on main.

Files with missing lines Patch % Lines
...fboardingPassword/TdeOffboardingPasswordCommand.cs 5.71% 33 Missing ⚠️
src/Api/Auth/Controllers/AccountsController.cs 58.66% 30 Missing and 1 partial ⚠️
...atures/UserMasterPassword/MasterPasswordService.cs 82.19% 22 Missing and 4 partials ⚠️
...counts/UpdateTdeOffboardingPasswordRequestModel.cs 0.00% 24 Missing ⚠️
...Request/Accounts/UpdateTempPasswordRequestModel.cs 0.00% 24 Missing ⚠️
...uth/Models/Request/EmergencyAccessRequestModels.cs 8.00% 23 Missing ⚠️
...assword/ReplaceAdminSetTemporaryPasswordCommand.cs 23.07% 20 Missing ⚠️
...th/Models/Request/Accounts/PasswordRequestModel.cs 22.72% 16 Missing and 1 partial ⚠️
...ord/Data/SetInitialOrUpdateExistingPasswordData.cs 23.80% 16 Missing ⚠️
...tions/OrganizationUserResetPasswordRequestModel.cs 42.30% 10 Missing and 5 partials ⚠️
... and 9 more
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7349      +/-   ##
==========================================
+ Coverage   58.71%   63.10%   +4.39%     
==========================================
  Files        2069     2079      +10     
  Lines       91207    91866     +659     
  Branches     8123     8211      +88     
==========================================
+ Hits        53551    57975    +4424     
+ Misses      35742    31862    -3880     
- Partials     1914     2029     +115     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.


[HttpPost("kdf")]
public async Task PostKdf([FromBody] PasswordRequestModel model)
public async Task PostKdf([FromBody] ChangeKdfRequestModel model)
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to double check if this will break anything with the sdk

Comment thread src/Api/Auth/Controllers/AccountsController.cs
@sonarqubecloud
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant