[PM-19107] Introduce user-trusted privileged apps for Credential Manager #4848

SaintPatrck · 2025-03-11T20:03:39Z

🎟️ Tracking

PM-19107

📔 Objective

This change introduces the ability for users to trust specific privileged apps (browsers) for Credential Manager operations. When an operation originates from an untrusted browser, the user will be prompted to either trust the browser or cancel the operation.

Key changes include:

Added a PrivilegedAppDatabase to store user-trusted apps.
Implemented PrivilegedAppRepository and related classes for managing
trusted apps.
Updated OriginManagerImpl to check the user's trusted list in
addition to Google and community allow lists.
Modified VaultItemListingViewModel to handle the trust prompt and
subsequent actions.
Added new UI elements (TrustPrivilegedAddPrompt dialog) and string
resources for the trust flow.
Updated CallingAppInfoExtensions to correctly validate against allow
lists.

📸 Screenshots

Coming soon!

⏰ Reminders before review

Contributor guidelines followed
All formatters and local linters executed and passed
Written new unit and / or integration tests where applicable
Protected functional changes with optionality (feature flags)
Used internationalization (i18n) for all UI strings
CI builds passed
Communicated to DevOps any deployment requirements
Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

👍 (:+1:) or similar for great changes
📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
❓ (:question:) for questions
🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
🎨 (:art:) for suggestions / improvements
❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
⛏ (:pick:) for minor or nitpick changes

codecov · 2025-03-11T20:06:59Z

Codecov Report

Attention: Patch coverage is 96.02273% with 7 lines in your changes missing coverage. Please review.

Project coverage is 82.84%. Comparing base (a59eaf5) to head (51c8a2e).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...ault/feature/itemlisting/VaultItemListingScreen.kt	82.60%	3 Missing and 1 partial ⚠️
...t/feature/itemlisting/VaultItemListingViewModel.kt	96.62%	1 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4848      +/-   ##
==========================================
+ Coverage   82.82%   82.84%   +0.02%     
==========================================
  Files         678      693      +15     
  Lines       50918    51277     +359     
  Branches     6927     6943      +16     
==========================================
+ Hits        42171    42481     +310     
- Misses       6428     6471      +43     
- Partials     2319     2325       +6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions · 2025-03-11T20:09:33Z

Checkmarx One – Scan Summary & Details – 81153a51-a408-4f85-85d9-24d3a076583b

New Issues (5)

Checkmarx found the following issues in this Pull Request

Issue	Source File / Package	Checkmarx Insight
Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/data/credentials/model/Fido2CredentialAssertionRequestUtil.kt: 12	details Method createMockFido2CredentialAssertionRequest at line 12 of /app/src/test/kotlin/com/x8bit/bitwarden/data/credentials/model/Fido2CredentialAsser... `ID: VwCpb9S%2FFhT9PyyWLHzwPkYTsVA%3D` Attack Vector
Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/ui/vault/feature/itemlisting/VaultItemListingViewModelTest.kt: 4114	details The application uses the hard-coded password "password" for authentication purposes, either using it to verify users' identities, or to access ano... `ID: a12WRSdpWAeWSUBTREF2UYZFQFk%3D` Attack Vector
Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/ui/vault/feature/itemlisting/VaultItemListingViewModelTest.kt: 4082	details The application uses the hard-coded password "password" for authentication purposes, either using it to verify users' identities, or to access ano... `ID: Q0ccJobcLxh9cBY%2BGJoZHoYI%2Bxc%3D` Attack Vector
Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/ui/vault/feature/itemlisting/VaultItemListingViewModelTest.kt: 4052	details The application uses the hard-coded password "password" for authentication purposes, either using it to verify users' identities, or to access ano... `ID: dqm8rjcb%2B%2By7T1%2FtKug79MM2rkY%3D` Attack Vector
Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/ui/vault/feature/itemlisting/VaultItemListingViewModelTest.kt: 4022	details The application uses the hard-coded password "password" for authentication purposes, either using it to verify users' identities, or to access ano... `ID: pK%2BfahnI6CjSuhl7phsEUqpp86c%3D` Attack Vector

...est/kotlin/com/x8bit/bitwarden/data/credentials/model/Fido2CredentialAssertionRequestUtil.kt

This change introduces the ability for users to trust specific privileged apps (browsers) for Credential Manager operations. When an operation originates from an untrusted browser, the user will be prompted to either trust the browser or cancel the operation. Key changes include: - Added a `PrivilegedAppDatabase` to store user-trusted apps. - Implemented `PrivilegedAppRepository` and related classes for managing trusted apps. - Updated `OriginManagerImpl` to check the user's trusted list in addition to Google and community allow lists. - Modified `VaultItemListingViewModel` to handle the trust prompt and subsequent actions. - Added new UI elements (`TrustPrivilegedAddPrompt` dialog) and string resources for the trust flow. - Updated `CallingAppInfoExtensions` to correctly validate against allow lists.

david-livefront · 2025-06-05T21:09:30Z

...src/main/kotlin/com/x8bit/bitwarden/data/credentials/datasource/disk/dao/PrivilegedAppDao.kt

+     * Removes a trusted privileged app.
+     */
+    @Suppress("MaxLineLength")
+    @Query("DELETE FROM privileged_apps WHERE package_name = :packageName AND signature = :signature")


Instead of the suppression, you can also do this:

@Query( "DELETE FROM privileged_apps WHERE package_name = :packageName AND signature = :signature" ) ```

david-livefront · 2025-06-05T21:10:16Z

...otlin/com/x8bit/bitwarden/data/credentials/datasource/disk/database/PrivilegedAppDatabase.kt

+@Database(
+    entities = [PrivilegedAppEntity::class],
+    version = 1,
+)


We should be exporting the schema here

david-livefront · 2025-06-05T21:11:33Z

...main/kotlin/com/x8bit/bitwarden/data/credentials/datasource/disk/di/CredentialsDiskModule.kt

+    @Singleton
+    fun providePrivilegedAppDiskSource(
+        privilegedAppDao: PrivilegedAppDao,
+        @UnencryptedPreferences sharedPreferences: SharedPreferences,


DO we need these shared preferences here?

david-livefront · 2025-06-05T21:15:17Z

app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/manager/OriginManagerImpl.kt

@@ -85,12 +76,17 @@ class OriginManagerImpl(

    private suspend fun validatePrivilegedAppSignatureWithCommunityList(
        callingAppInfo: CallingAppInfo,
-    ): ValidateOriginResult =
-        validatePrivilegedAppSignatureWithAllowList(
+    ): ValidateOriginResult = validatePrivilegedAppSignatureWithAllowList(
            callingAppInfo = callingAppInfo,
            fileName = COMMUNITY_ALLOW_LIST_FILE_NAME,
        )


Something is off here, wanna check the formatter

david-livefront · 2025-06-05T21:17:51Z

...c/main/kotlin/com/x8bit/bitwarden/data/credentials/repository/PrivilegedAppRepositoryImpl.kt

+    override suspend fun removeTrustedPrivilegedApp(
+        packageName: String,
+        signature: String,
+    ) = privilegedAppDiskSource


Can we add some return type for these public methods

david-livefront · 2025-06-05T21:18:25Z

app/src/main/kotlin/com/x8bit/bitwarden/data/platform/util/CallingAppInfoExtensions.kt

@@ -23,7 +23,7 @@ fun CallingAppInfo.getSignatureFingerprintAsHexString(): String? {
 */
 fun CallingAppInfo.validatePrivilegedApp(allowList: String): ValidateOriginResult {

-    if (!allowList.contains("\"package_name\": \"$packageName\"")) {
+    if (!allowList.contains("\"$packageName\"")) {


Was this needed?

david-livefront · 2025-06-05T21:19:31Z

app/src/main/kotlin/com/x8bit/bitwarden/ui/vault/feature/itemlisting/VaultItemListingScreen.kt

@@ -352,7 +362,7 @@ private fun VaultItemListingDialogs(
        is VaultItemListingState.DialogState.CredentialManagerOperationFail -> BitwardenBasicDialog(
            title = dialogState.title(),
            message = dialogState.message(),
-            onDismissRequest = { onDismissFido2ErrorDialog(dialogState.message) },
+            onDismissRequest = { onDismissCredentialManagerErrorDialog(dialogState.message) },


Why do we send message back here?

david-livefront · 2025-06-05T21:20:36Z

app/src/main/kotlin/com/x8bit/bitwarden/ui/vault/feature/itemlisting/VaultItemListingScreen.kt

+                onDismissRequest = {
+                    onDismissCredentialManagerErrorDialog(
+                        R.string.passkey_operation_failed_because_the_browser_is_not_trusted
+                            .asText(),


Missing a test?

SaintPatrck force-pushed the innovation-sprint/privileged-apps/trust-dialog branch from 4c2645a to d587122 Compare March 11, 2025 20:08

SaintPatrck changed the base branch from main to innovation-sprint/privileged-apps/base March 11, 2025 20:09

SaintPatrck force-pushed the innovation-sprint/privileged-apps/trust-dialog branch 5 times, most recently from ac3ad3e to 465c5ce Compare March 13, 2025 19:41

SaintPatrck force-pushed the innovation-sprint/privileged-apps/trust-dialog branch from 465c5ce to 9beb3ec Compare March 19, 2025 20:03

SaintPatrck force-pushed the innovation-sprint/privileged-apps/trust-dialog branch from 9beb3ec to 8ce9b2d Compare June 5, 2025 18:26

SaintPatrck changed the base branch from innovation-sprint/privileged-apps/base to main June 5, 2025 19:03

SaintPatrck force-pushed the innovation-sprint/privileged-apps/trust-dialog branch from 8ce9b2d to f5ad016 Compare June 5, 2025 19:04

github-advanced-security bot found potential problems Jun 5, 2025

View reviewed changes

...est/kotlin/com/x8bit/bitwarden/data/credentials/model/Fido2CredentialAssertionRequestUtil.kt Dismissed Show dismissed Hide dismissed

SaintPatrck marked this pull request as ready for review June 5, 2025 19:50

SaintPatrck requested review from brian-livefront, david-livefront and a team as code owners June 5, 2025 19:50

SaintPatrck force-pushed the innovation-sprint/privileged-apps/trust-dialog branch from f5ad016 to 51c8a2e Compare June 5, 2025 19:56

SaintPatrck changed the title ~~[PM-19107] Implement privileged app management for FIDO2~~ [PM-19107] Introduce user-trusted privileged apps for Credential Manager Jun 5, 2025

david-livefront reviewed Jun 5, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[PM-19107] Introduce user-trusted privileged apps for Credential Manager #4848

[PM-19107] Introduce user-trusted privileged apps for Credential Manager #4848

SaintPatrck commented Mar 11, 2025 •

edited

Loading

Uh oh!

codecov bot commented Mar 11, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Mar 11, 2025 •

edited

Loading

Uh oh!

Uh oh!

david-livefront Jun 5, 2025

Uh oh!

david-livefront Jun 5, 2025

Uh oh!

david-livefront Jun 5, 2025

Uh oh!

david-livefront Jun 5, 2025

Uh oh!

david-livefront Jun 5, 2025

Uh oh!

david-livefront Jun 5, 2025

Uh oh!

david-livefront Jun 5, 2025

Uh oh!

david-livefront Jun 5, 2025

Uh oh!

Uh oh!

[PM-19107] Introduce user-trusted privileged apps for Credential Manager #4848

Are you sure you want to change the base?

[PM-19107] Introduce user-trusted privileged apps for Credential Manager #4848

Conversation

SaintPatrck commented Mar 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎟️ Tracking

📔 Objective

📸 Screenshots

⏰ Reminders before review

🦮 Reviewer guidelines

Uh oh!

codecov bot commented Mar 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Mar 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SaintPatrck commented Mar 11, 2025 •

edited

Loading

codecov bot commented Mar 11, 2025 •

edited

Loading

github-actions bot commented Mar 11, 2025 •

edited

Loading