PM-2035: PRF Unlock (web + extension)

apps/browser/src/_locales/en/messages.json

@@ -28,6 +28,9 @@
   "logInWithPasskey": {
     "message": "Log in with passkey"
   },
+  "unlockWithPasskey": {
+    "message": "Unlock with passkey"
+  },
   "useSingleSignOn": {
     "message": "Use single sign-on"
   },
@@ -3237,6 +3240,12 @@
   "error": {
     "message": "Error"
   },
+  "prfUnlockFailed": {
+    "message": "Failed to unlock with passkey. Please try again or use another unlock method."
+  },
+  "noPrfCredentialsAvailable": {
+    "message": "No PRF-enabled passkeys are available for unlock. Please log in with a passkey first."
+  },
   "decryptionError": {
     "message": "Decryption error"
   },

apps/browser/src/key-management/lock/services/extension-lock-component.service.spec.ts

@@ -14,7 +14,7 @@ import {
   BiometricsStatus,
   BiometricStateService,
 } from "@bitwarden/key-management";
-import { UnlockOptions } from "@bitwarden/key-management-ui";
+import { UnlockOptions, WebAuthnPrfUnlockService } from "@bitwarden/key-management-ui";
 
 import { BrowserApi } from "../../../platform/browser/browser-api";
 import BrowserPopupUtils from "../../../platform/browser/browser-popup-utils";
@@ -34,6 +34,7 @@ describe("ExtensionLockComponentService", () => {
   let vaultTimeoutSettingsService: MockProxy<VaultTimeoutSettingsService>;
   let routerService: MockProxy<BrowserRouterService>;
   let biometricStateService: MockProxy<BiometricStateService>;
+  let webAuthnPrfUnlockService: MockProxy<WebAuthnPrfUnlockService>;
 
   beforeEach(() => {
     userDecryptionOptionsService = mock<UserDecryptionOptionsServiceAbstraction>();
@@ -43,37 +44,21 @@ describe("ExtensionLockComponentService", () => {
     vaultTimeoutSettingsService = mock<VaultTimeoutSettingsService>();
     routerService = mock<BrowserRouterService>();
     biometricStateService = mock<BiometricStateService>();
+    webAuthnPrfUnlockService = mock<WebAuthnPrfUnlockService>();
 
     TestBed.configureTestingModule({
       providers: [
-        ExtensionLockComponentService,
         {
-          provide: UserDecryptionOptionsServiceAbstraction,
-          useValue: userDecryptionOptionsService,
-        },
-        {
-          provide: PlatformUtilsService,
-          useValue: platformUtilsService,
-        },
-        {
-          provide: BiometricsService,
-          useValue: biometricsService,
-        },
-        {
-          provide: PinServiceAbstraction,
-          useValue: pinService,
-        },
-        {
-          provide: VaultTimeoutSettingsService,
-          useValue: vaultTimeoutSettingsService,
-        },
-        {
-          provide: BrowserRouterService,
-          useValue: routerService,
-        },
-        {
-          provide: BiometricStateService,
-          useValue: biometricStateService,
+          provide: ExtensionLockComponentService,
+          useFactory: () =>
+            new ExtensionLockComponentService(
+              userDecryptionOptionsService,
+              biometricsService,
+              pinService,
+              biometricStateService,
+              routerService,
+              webAuthnPrfUnlockService,
+            ),
         },
       ],
     });
@@ -212,6 +197,9 @@ describe("ExtensionLockComponentService", () => {
             enabled: true,
             biometricsStatus: BiometricsStatus.Available,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -234,6 +222,9 @@ describe("ExtensionLockComponentService", () => {
             enabled: true,
             biometricsStatus: BiometricsStatus.Available,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -256,6 +247,9 @@ describe("ExtensionLockComponentService", () => {
             enabled: true,
             biometricsStatus: BiometricsStatus.Available,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -278,6 +272,9 @@ describe("ExtensionLockComponentService", () => {
             enabled: true,
             biometricsStatus: BiometricsStatus.Available,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -300,6 +297,9 @@ describe("ExtensionLockComponentService", () => {
             enabled: false,
             biometricsStatus: BiometricsStatus.UnlockNeeded,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -322,6 +322,9 @@ describe("ExtensionLockComponentService", () => {
             enabled: false,
             biometricsStatus: BiometricsStatus.NotEnabledInConnectedDesktopApp,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -344,6 +347,9 @@ describe("ExtensionLockComponentService", () => {
             enabled: false,
             biometricsStatus: BiometricsStatus.HardwareUnavailable,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
     ];
@@ -374,6 +380,9 @@ describe("ExtensionLockComponentService", () => {
       //  PIN
       pinService.isPinDecryptionAvailable.mockResolvedValue(mockInputs.pinDecryptionAvailable);
 
+      // PRF
+      webAuthnPrfUnlockService.isPrfUnlockAvailable.mockResolvedValue(false);
+
       const unlockOptions = await firstValueFrom(service.getAvailableUnlockOptions$(userId));
 
       expect(unlockOptions).toEqual(expectedOutput);

apps/browser/src/key-management/lock/services/extension-lock-component.service.ts

@@ -1,6 +1,3 @@
-// FIXME (PM-22628): angular imports are forbidden in background
-// eslint-disable-next-line no-restricted-imports
-import { inject } from "@angular/core";
 import { combineLatest, defer, firstValueFrom, map, Observable } from "rxjs";
 
 import { UserDecryptionOptionsServiceAbstraction } from "@bitwarden/auth/common";
@@ -11,7 +8,11 @@ import {
   BiometricsStatus,
   BiometricStateService,
 } from "@bitwarden/key-management";
-import { LockComponentService, UnlockOptions } from "@bitwarden/key-management-ui";
+import {
+  LockComponentService,
+  UnlockOptions,
+  WebAuthnPrfUnlockService,
+} from "@bitwarden/key-management-ui";
 
 import { BiometricErrors, BiometricErrorTypes } from "../../../models/biometricErrors";
 import { BrowserApi } from "../../../platform/browser/browser-api";
@@ -21,11 +22,14 @@ import BrowserPopupUtils from "../../../platform/browser/browser-popup-utils";
 import { BrowserRouterService } from "../../../platform/popup/services/browser-router.service";
 
 export class ExtensionLockComponentService implements LockComponentService {
-  private readonly userDecryptionOptionsService = inject(UserDecryptionOptionsServiceAbstraction);
-  private readonly biometricsService = inject(BiometricsService);
-  private readonly pinService = inject(PinServiceAbstraction);
-  private readonly routerService = inject(BrowserRouterService);
-  private readonly biometricStateService = inject(BiometricStateService);
+  constructor(
+    private readonly userDecryptionOptionsService: UserDecryptionOptionsServiceAbstraction,
+    private readonly biometricsService: BiometricsService,
+    private readonly pinService: PinServiceAbstraction,
+    private readonly biometricStateService: BiometricStateService,
+    private readonly routerService: BrowserRouterService,
+    private readonly webAuthnPrfUnlockService: WebAuthnPrfUnlockService,
+  ) {}
 
   getPreviousUrl(): string | null {
     return this.routerService.getPreviousUrl() ?? null;
@@ -81,8 +85,12 @@ export class ExtensionLockComponentService implements LockComponentService {
       }),
       this.userDecryptionOptionsService.userDecryptionOptionsById$(userId),
       defer(() => this.pinService.isPinDecryptionAvailable(userId)),
+      defer(async () => {
+        const available = await this.webAuthnPrfUnlockService.isPrfUnlockAvailable(userId);
+        return { available };
+      }),
     ]).pipe(
-      map(([biometricsStatus, userDecryptionOptions, pinDecryptionAvailable]) => {
+      map(([biometricsStatus, userDecryptionOptions, pinDecryptionAvailable, prfUnlockInfo]) => {
         const unlockOpts: UnlockOptions = {
           masterPassword: {
             enabled: userDecryptionOptions?.hasMasterPassword,
@@ -94,6 +102,9 @@ export class ExtensionLockComponentService implements LockComponentService {
             enabled: biometricsStatus === BiometricsStatus.Available,
             biometricsStatus: biometricsStatus,
           },
+          prf: {
+            enabled: prfUnlockInfo.available,
+          },
         };
         return unlockOpts;
       }),

apps/browser/src/popup/services/services.module.ts

@@ -36,8 +36,10 @@ import {
   LoginEmailService,
   SsoUrlService,
   LogoutService,
+  UserDecryptionOptionsServiceAbstraction,
 } from "@bitwarden/auth/common";
 import { ExtensionNewDeviceVerificationComponentService } from "@bitwarden/browser/auth/services/new-device-verification/extension-new-device-verification-component.service";
+import { BrowserRouterService } from "@bitwarden/browser/platform/popup/services/browser-router.service";
 import { ApiService } from "@bitwarden/common/abstractions/api.service";
 import { EventCollectionService as EventCollectionServiceAbstraction } from "@bitwarden/common/abstractions/event/event-collection.service";
 import { PolicyService } from "@bitwarden/common/admin-console/abstractions/policy/policy.service.abstraction";
@@ -51,6 +53,7 @@ import { MasterPasswordApiService } from "@bitwarden/common/auth/abstractions/ma
 import { SsoLoginServiceAbstraction } from "@bitwarden/common/auth/abstractions/sso-login.service.abstraction";
 import { TokenService } from "@bitwarden/common/auth/abstractions/token.service";
 import { UserVerificationService } from "@bitwarden/common/auth/abstractions/user-verification/user-verification.service.abstraction";
+import { WebAuthnLoginPrfKeyServiceAbstraction } from "@bitwarden/common/auth/abstractions/webauthn/webauthn-login-prf-key.service.abstraction";
 import { AuthRequestAnsweringService } from "@bitwarden/common/auth/services/auth-request-answering/auth-request-answering.service";
 import { PendingAuthRequestsStateService } from "@bitwarden/common/auth/services/auth-request-answering/pending-auth-requests.state";
 import {
@@ -75,6 +78,7 @@ import {
   InternalMasterPasswordServiceAbstraction,
   MasterPasswordServiceAbstraction,
 } from "@bitwarden/common/key-management/master-password/abstractions/master-password.service.abstraction";
+import { PinServiceAbstraction } from "@bitwarden/common/key-management/pin/pin.service.abstraction";
 import {
   VaultTimeoutService,
   VaultTimeoutStringType,
@@ -137,11 +141,16 @@ import {
 import { PasswordGenerationServiceAbstraction } from "@bitwarden/generator-legacy";
 import {
   BiometricsService,
+  BiometricStateService,
   DefaultKeyService,
   KdfConfigService,
   KeyService,
 } from "@bitwarden/key-management";
-import { LockComponentService } from "@bitwarden/key-management-ui";
+import {
+  LockComponentService,
+  WebAuthnPrfUnlockService,
+  DefaultWebAuthnPrfUnlockService,
+} from "@bitwarden/key-management-ui";
 import { DerivedStateProvider, GlobalStateProvider, StateProvider } from "@bitwarden/state";
 import { InlineDerivedStateProvider } from "@bitwarden/state-internal";
 import {
@@ -561,7 +570,14 @@ const safeProviders: SafeProvider[] = [
   safeProvider({
     provide: LockComponentService,
     useClass: ExtensionLockComponentService,
-    deps: [],
+    deps: [
+      UserDecryptionOptionsServiceAbstraction,
+      BiometricsService,
+      PinServiceAbstraction,
+      BiometricStateService,
+      BrowserRouterService,
+      WebAuthnPrfUnlockService,
+    ],
   }),
   // TODO: PM-18182 - Refactor component services into lazy loaded modules
   safeProvider({
@@ -605,6 +621,20 @@ const safeProviders: SafeProvider[] = [
     useClass: Fido2UserVerificationService,
     deps: [PasswordRepromptService, UserVerificationService, DialogService],
   }),
+  safeProvider({
+    provide: WebAuthnPrfUnlockService,
+    useClass: DefaultWebAuthnPrfUnlockService,
+    deps: [
+      WebAuthnLoginPrfKeyServiceAbstraction,
+      KeyService,
+      UserDecryptionOptionsServiceAbstraction,
+      EncryptService,
+      EnvironmentService,
+      PlatformUtilsService,
+      WINDOW,
+      LogService,
+    ],
+  }),
   safeProvider({
     provide: AnimationControlService,
     useClass: DefaultAnimationControlService,

apps/desktop/src/key-management/lock/services/desktop-lock-component.service.spec.ts

@@ -177,6 +177,9 @@ describe("DesktopLockComponentService", () => {
             enabled: true,
             biometricsStatus: BiometricsStatus.Available,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -197,6 +200,9 @@ describe("DesktopLockComponentService", () => {
             enabled: true,
             biometricsStatus: BiometricsStatus.Available,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -218,6 +224,9 @@ describe("DesktopLockComponentService", () => {
             enabled: false,
             biometricsStatus: BiometricsStatus.NotEnabledLocally,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -238,6 +247,9 @@ describe("DesktopLockComponentService", () => {
             enabled: false,
             biometricsStatus: BiometricsStatus.HardwareUnavailable,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
       [
@@ -258,6 +270,9 @@ describe("DesktopLockComponentService", () => {
             enabled: false,
             biometricsStatus: BiometricsStatus.PlatformUnsupported,
           },
+          prf: {
+            enabled: false,
+          },
         },
       ],
     ];

apps/desktop/src/key-management/lock/services/desktop-lock-component.service.ts

@@ -69,6 +69,9 @@ export class DesktopLockComponentService implements LockComponentService {
             enabled: biometricsStatus == BiometricsStatus.Available,
             biometricsStatus: biometricsStatus,
           },
+          prf: {
+            enabled: false,
+          },
         };
 
         return unlockOpts;