chore(vault): unconditionally enable cipher-keys

Author: quexten

crates/bitwarden-core/src/client/flags.rs

@@ -9,10 +9,6 @@
 #[derive(Debug, Default, Clone, serde::Serialize, serde::Deserialize)]
 #[serde(default, rename_all = "kebab-case")]
 pub struct Flags {
-    /// Enable cipher key encryption.
-    #[serde(alias = "enableCipherKeyEncryption", alias = "cipher-key-encryption")]
-    pub enable_cipher_key_encryption: bool,
-
     /// Enable strict cipher field decryption (propagates errors instead of nulling fields).
     #[serde(alias = "pm-34500-strict-cipher-decryption")]
     pub strict_cipher_decryption: bool,
@@ -41,30 +37,30 @@ mod tests {
     fn test_load_empty_map() {
         let map = std::collections::HashMap::new();
         let flags = Flags::load_from_map(map);
-        assert!(!flags.enable_cipher_key_encryption);
+        assert!(!flags.strict_cipher_decryption);
     }
 
     #[test]
     fn test_load_valid_map() {
         let mut map = std::collections::HashMap::new();
-        map.insert("enableCipherKeyEncryption".into(), true);
+        map.insert("strict-cipher-decryption".into(), true);
         let flags = Flags::load_from_map(map);
-        assert!(flags.enable_cipher_key_encryption);
+        assert!(flags.strict_cipher_decryption);
     }
 
     #[test]
     fn test_load_valid_map_alias() {
         let mut map = std::collections::HashMap::new();
-        map.insert("cipher-key-encryption".into(), true);
+        map.insert("pm-34500-strict-cipher-decryption".into(), true);
         let flags = Flags::load_from_map(map);
-        assert!(flags.enable_cipher_key_encryption);
+        assert!(flags.strict_cipher_decryption);
     }
 
     #[test]
     fn test_load_invalid_map() {
         let mut map = std::collections::HashMap::new();
         map.insert("thisIsNotAFlag".into(), true);
         let flags = Flags::load_from_map(map);
-        assert!(!flags.enable_cipher_key_encryption);
+        assert!(!flags.strict_cipher_decryption);
     }
 }

crates/bitwarden-core/src/client/flags_client.rs

@@ -158,18 +158,15 @@ mod tests {
 
         // With no flags loaded yet, get should return defaults.
         let initial = client.flags().get().await;
-        assert!(!initial.enable_cipher_key_encryption);
         assert!(!initial.strict_cipher_decryption);
 
         // Loading flags should persist them via the FLAGS setting.
         let mut map = HashMap::new();
-        map.insert("enableCipherKeyEncryption".to_string(), true);
         map.insert("pm-34500-strict-cipher-decryption".to_string(), true);
         client.flags().load(map).await;
 
         // get should now return the loaded values.
         let loaded = client.flags().get().await;
-        assert!(loaded.enable_cipher_key_encryption);
         assert!(loaded.strict_cipher_decryption);
 
         // The values should be readable directly from the setting too.
@@ -182,7 +179,6 @@ mod tests {
             .await
             .unwrap()
             .expect("flags should be persisted after load");
-        assert!(persisted.enable_cipher_key_encryption);
         assert!(persisted.strict_cipher_decryption);
     }
 
@@ -192,7 +188,7 @@ mod tests {
         Mock::given(method("GET"))
             .and(path("/config"))
             .respond_with(ResponseTemplate::new(200).set_body_json(json!({
-                "featureStates": { "enableCipherKeyEncryption": true }
+                "featureStates": { "pm-34500-strict-cipher-decryption": true }
             })))
             .expect(1)
             .mount(&server)
@@ -202,7 +198,7 @@ mod tests {
         let before = Utc::now();
         client.flags().fetch(true).await.unwrap();
 
-        assert!(client.flags().get().await.enable_cipher_key_encryption);
+        assert!(client.flags().get().await.strict_cipher_decryption);
         let fetched_at = read_fetched_at(&client)
             .await
             .expect("fetched_at must be set after a successful fetch");
@@ -247,7 +243,7 @@ mod tests {
         Mock::given(method("GET"))
             .and(path("/config"))
             .respond_with(ResponseTemplate::new(200).set_body_json(json!({
-                "featureStates": { "enableCipherKeyEncryption": true }
+                "featureStates": { "pm-34500-strict-cipher-decryption": true }
             })))
             .expect(1)
             .mount(&server)
@@ -259,7 +255,7 @@ mod tests {
 
         client.flags().fetch(false).await.unwrap();
 
-        assert!(client.flags().get().await.enable_cipher_key_encryption);
+        assert!(client.flags().get().await.strict_cipher_decryption);
         let fetched_at = read_fetched_at(&client).await.unwrap();
         assert!(fetched_at > stale);
     }
@@ -277,14 +273,14 @@ mod tests {
         client
             .flags()
             .load(HashMap::from([(
-                "enableCipherKeyEncryption".to_string(),
+                "pm-34500-strict-cipher-decryption".to_string(),
                 true,
             )]))
             .await;
 
         assert!(client.flags().fetch(true).await.is_err());
         assert!(
-            client.flags().get().await.enable_cipher_key_encryption,
+            client.flags().get().await.strict_cipher_decryption,
             "previously persisted flags must survive a failed fetch"
         );
     }

crates/bitwarden-core/src/client/test_accounts.rs

@@ -42,14 +42,6 @@ impl Client {
     pub async fn init_test_account(account: TestAccount) -> Self {
         let client = Client::new_test(None);
 
-        client
-            .flags()
-            .load(HashMap::from([(
-                "enableCipherKeyEncryption".to_owned(),
-                true,
-            )]))
-            .await;
-
         client
             .crypto()
             .initialize_user_crypto(account.user)

crates/bitwarden-fido/src/authenticator.rs

@@ -497,8 +497,7 @@ impl passkey::authenticator::CredentialStore for CredentialStoreImpl<'_> {
                 .client
                 .vault()
                 .ciphers()
-                .encrypt(selected)
-                .await?;
+                .encrypt(selected)?;
 
             this.authenticator
                 .credential_store
@@ -572,8 +571,7 @@ impl passkey::authenticator::CredentialStore for CredentialStoreImpl<'_> {
                 .client
                 .vault()
                 .ciphers()
-                .encrypt(selected)
-                .await?;
+                .encrypt(selected)?;
 
             this.authenticator
                 .credential_store

crates/bitwarden-uniffi/src/vault/ciphers.rs

@@ -14,8 +14,8 @@ pub struct CiphersClient(pub(crate) bitwarden_vault::CiphersClient);
 #[uniffi::export(async_runtime = "tokio")]
 impl CiphersClient {
     /// Encrypt cipher
-    pub async fn encrypt(&self, cipher_view: CipherView) -> Result<EncryptionContext> {
-        Ok(self.0.encrypt(cipher_view).await?)
+    pub fn encrypt(&self, cipher_view: CipherView) -> Result<EncryptionContext> {
+        Ok(self.0.encrypt(cipher_view)?)
     }
 
     /// Decrypt cipher

crates/bitwarden-vault/src/cipher/cipher_client/admin/create.rs

@@ -112,12 +112,10 @@ impl CipherAdminClient {
 
         let mut view: CipherView = convert_request_to_cipher_view(request);
 
-        // TODO: Once this flag is removed, the key generation logic should
-        // be moved directly into the CompositeEncryptable implementation.
-        if self.client.flags().get().await.enable_cipher_key_encryption {
-            let key = view.key_identifier();
-            view.generate_cipher_key(&mut key_store.context(), key)?;
-        }
+        // TODO: The key generation logic should be moved directly into the
+        // CompositeEncryptable implementation.
+        let key = view.key_identifier();
+        view.generate_cipher_key(&mut key_store.context(), key)?;
 
         let use_blob = should_use_blob_encryption(&key_store.context(), view.organization_id);
 

crates/bitwarden-vault/src/cipher/cipher_client/admin/edit.rs

@@ -53,9 +53,9 @@ impl<T> From<bitwarden_api_api::apis::Error<T>> for EditCipherAdminError {
     }
 }
 
-// `use_strict_decryption`, `enable_cipher_key_encryption`, and `use_blob` are
-// short-lived feature-rollout flags that will be removed once their migrations
-// complete, at which point the argument count drops back under the limit.
+// `use_strict_decryption` and `use_blob` are short-lived feature-rollout flags
+// that will be removed once their migrations complete, at which point the
+// argument count drops back under the limit.
 #[allow(clippy::too_many_arguments)]
 async fn edit_cipher(
     key_store: &KeyStore<KeySlotIds>,
@@ -64,7 +64,6 @@ async fn edit_cipher(
     original_cipher_view: CipherView,
     request: CipherEditRequest,
     use_strict_decryption: bool,
-    enable_cipher_key_encryption: bool,
     use_blob: bool,
 ) -> Result<CipherView, EditCipherAdminError> {
     let cipher_id = request.id;
@@ -76,9 +75,9 @@ async fn edit_cipher(
     let mut view: CipherView = convert_request_to_cipher_view(request);
     view.update_password_history(&original_cipher_view);
 
-    // TODO: Once this flag is removed, the key generation logic should be
-    // moved directly into the CompositeEncryptable implementation.
-    if view.key.is_none() && enable_cipher_key_encryption {
+    // TODO: The key generation logic should be moved directly into the
+    // CompositeEncryptable implementation.
+    if view.key.is_none() {
         let key = view.key_identifier();
         view.generate_cipher_key(&mut key_store.context(), key)?;
     }
@@ -167,9 +166,6 @@ impl CipherAdminClient {
             .get_user_id()
             .ok_or(NotAuthenticatedError)?;
 
-        let enable_cipher_key_encryption =
-            self.client.flags().get().await.enable_cipher_key_encryption;
-
         let use_blob = should_use_blob_encryption(&key_store.context(), request.organization_id);
 
         edit_cipher(
@@ -179,7 +175,6 @@ impl CipherAdminClient {
             original_cipher_view,
             request,
             self.is_strict_decrypt().await,
-            enable_cipher_key_encryption,
             use_blob,
         )
         .await
@@ -327,7 +322,6 @@ mod tests {
             request,
             false,
             false,
-            false,
         )
         .await
         .unwrap();
@@ -383,7 +377,6 @@ mod tests {
             original_cipher_view,
             request,
             false,
-            false,
             true, // use_blob
         )
         .await
@@ -419,7 +412,6 @@ mod tests {
             request,
             false,
             false,
-            false,
         )
         .await;
 

crates/bitwarden-vault/src/cipher/cipher_client/create.rs

@@ -179,12 +179,10 @@ impl CiphersClient {
 
         let mut view: CipherView = convert_request_to_cipher_view(request);
 
-        // TODO: Once this flag is removed, the key generation logic should
-        // be moved directly into the CompositeEncryptable implementation.
-        if self.client.flags().get().await.enable_cipher_key_encryption {
-            let key = view.key_identifier();
-            view.generate_cipher_key(&mut key_store.context(), key)?;
-        }
+        // TODO: The key generation logic should be moved directly into the
+        // CompositeEncryptable implementation.
+        let key = view.key_identifier();
+        view.generate_cipher_key(&mut key_store.context(), key)?;
 
         let use_blob = self.should_use_blob_encryption(view.organization_id);
 

crates/bitwarden-vault/src/cipher/cipher_client/edit.rs

@@ -165,9 +165,9 @@ pub(crate) fn convert_request_to_cipher_view(r: CipherEditRequest) -> CipherView
     }
 }
 
-// `use_strict_decryption`, `enable_cipher_key_encryption`, and `use_blob` are
-// short-lived feature-rollout flags that will be removed once their migrations
-// complete, at which point the argument count drops back under the limit.
+// `use_strict_decryption` and `use_blob` are short-lived feature-rollout flags
+// that will be removed once their migrations complete, at which point the
+// argument count drops back under the limit.
 #[allow(clippy::too_many_arguments)]
 async fn edit_cipher<R: Repository<Cipher> + ?Sized>(
     key_store: &KeyStore<KeySlotIds>,
@@ -176,7 +176,6 @@ async fn edit_cipher<R: Repository<Cipher> + ?Sized>(
     encrypted_for: UserId,
     request: CipherEditRequest,
     use_strict_decryption: bool,
-    enable_cipher_key_encryption: bool,
     use_blob: bool,
 ) -> Result<CipherView, EditCipherError> {
     let cipher_id = request.id;
@@ -191,9 +190,9 @@ async fn edit_cipher<R: Repository<Cipher> + ?Sized>(
     let mut view: CipherView = convert_request_to_cipher_view(request);
     view.update_password_history(&original_cipher_view);
 
-    // TODO: Once this flag is removed, the key generation logic should be
-    // moved directly into the CompositeEncryptable implementation.
-    if view.key.is_none() && enable_cipher_key_encryption {
+    // TODO: The key generation logic should be moved directly into the
+    // CompositeEncryptable implementation.
+    if view.key.is_none() {
         let key = view.key_identifier();
         view.generate_cipher_key(&mut key_store.context(), key)?;
     }
@@ -273,9 +272,6 @@ impl CiphersClient {
             .get_user_id()
             .ok_or(NotAuthenticatedError)?;
 
-        let enable_cipher_key_encryption =
-            self.client.flags().get().await.enable_cipher_key_encryption;
-
         let use_blob = self.should_use_blob_encryption(request.organization_id);
 
         edit_cipher(
@@ -285,7 +281,6 @@ impl CiphersClient {
             user_id,
             request,
             self.is_strict_decrypt().await,
-            enable_cipher_key_encryption,
             use_blob,
         )
         .await
@@ -564,7 +559,6 @@ mod tests {
             request,
             false,
             false,
-            false,
         )
         .await
         .unwrap();
@@ -704,7 +698,6 @@ mod tests {
             request,
             false,
             false,
-            false,
         )
         .await;
 
@@ -747,7 +740,6 @@ mod tests {
             request,
             false,
             false,
-            false,
         )
         .await;