feat(invite-link): re-structure invite-link-client to use and expose new invite link api by quexten · Pull Request #1274 · bitwarden/sdk-internal

quexten · 2026-07-17T09:53:24Z

https://bitwarden.atlassian.net/browse/PM-40307

Re-structure the invite link clients to use the new cryptographic api for the invite, and to expose the new API. HTTP requests are moved into the SDK. Two are left open for AC to move as a follow-up once they are implemented.

github-actions · 2026-07-17T10:02:31Z

🔍 SDK Breaking Change Detection

SDK Version: invite-client-use-safe-crypto (95f522f)

⚠️ If breaking changes are detected, a corresponding pull request addressing them must be ready for merge in the affected client repository.

Client	Status	Details
typescript	❌ Breaking changes detected	Compilation failed with new SDK version. A corresponding pull request addressing the breaking changes must be ready for merge in bitwarden/clients. - View Details
android	✅ No breaking changes detected	Compilation passed with new SDK version - View Details

Breaking change detection uses the build of the SDK from this branch, including any incompatibities pre-existing on or merged into this branch. Check the workflow logs to confirm.
Results update as workflows complete.

codecov · 2026-07-17T10:31:35Z

Codecov Report

❌ Patch coverage is 89.91597% with 60 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.82%. Comparing base (6ae3f66) to head (d249dcd).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...organization-invite-link/src/invite_link_client.rs	90.45%	52 Missing ⚠️
crates/bitwarden-organization-crypto/src/wasm.rs	0.00%	8 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1274      +/-   ##
==========================================
+ Coverage   85.79%   85.82%   +0.02%     
==========================================
  Files         487      491       +4     
  Lines       69999    70676     +677     
==========================================
+ Hits        60059    60660     +601     
- Misses       9940    10016      +76

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-07-17T12:08:45Z

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the restructuring of InviteLinkClient to use the new Invite/InviteSecret crypto API and move HTTP requests into the SDK (make_invite, get_invite_secret, accept_and_optionally_confirm). The account-recovery enrollment path correctly verifies the server-supplied recovery public key against the organization public-key thumbprint bound into the invite before encapsulating the user key, closing the substituted-key attack. The key store context is confined to synchronous scopes so it is never held across .await points, and the WASM From<_> for JsValue additions are correctly motivated for async return values. Test coverage exercises the create, recover, accept, confirm, and recovery-key-mismatch paths against a mocked API.

Code Review Details

No blocking findings.

Notes (informational, no action required):

The stubbed download_wrapped_private_key and fetch_invite helpers are clearly documented TODOs (PM-40523, PM-38749) and match the PR description ("two are left open for AC to move as a follow-up"). These make the flow non-functional against a real server until the backend endpoints land, which is the acknowledged state of this feature branch.
MissingFieldError("code") and MissingFieldError("public_key") are reused for malformed-but-present values (UUID / B64 parse failures) rather than genuinely missing fields; the variant name is slightly misleading but the behavior is correct.
The deleted TS integration tests are covered by the existing reviewer thread (API requests cannot currently be mocked in TS).

…new invite link api

…expose new invite link api

aikido-pr-checks · 2026-07-28T04:54:40Z

+export const TEST_INVITE_SECRET =
+  "oSpRu_AENo_n11TqiLIryrJKaEPbQVjbdd6r4reyqUU" as unknown as InviteSecret;


Exposed secret in crates/bitwarden-wasm-internal/integration-tests/tests/org-fixtures.ts - low severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More Info}

@AikidoSec ignore: Test vector

✅ Based on your feedback, we ignored this issue because of the following reason:

Test vector

aikido-pr-checks · 2026-07-28T04:54:40Z

+  "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwunODXi0Bv17ZDioko6yqGls/2lJVsT1Wab98TW2RMWaWiyqnhNqKSDvuVAmQ5/XBKJzlBnpVx3nfT/soDI4CrbUh5wOSYypzcVhymcRZ9PmNMa3u6ib2iSPr36UXawqTgw2cS6TG30TmtEM0PLCLcsfNUnD2reAlnBpgqlaHR/n1slbIH7Qn7Hy7MC5ElyRc7h3cm92l7K2d1rfCoyX+/xZ/cf4JOY2rGPYx106wR+IBt6SivdBsBYuFNS1BjTlXELJlJsOKcxgXXWbFV9BzJUe2DlYSq7PuIKCd4yYm8mDmDa5m3wFtXAr4CHTVxwOdtA/0x7ZLgKc2O++7a9S6QIDAQAB";
+
+export const TEST_INVITE =
+  '{"sealed_invite_data":"g1hHpQEDA3gjYXBwbGljYXRpb24veC5iaXR3YXJkZW4uY2Jvci1wYWRkZWQEUOeB/QFwHUwsvdEq0eCp5Us6AAE4gQI6AAE4gAKhBUx0ff7FDlj8cQzQvL1Yy97w7gc4TFOvBS/whCehNcW04jWGFaeNliHZyBRoIhKTHcKP1lJTYEh5ykybxh7ktkuznHCwv3Mz3jQ6Y7fdfINkGpvDo6EL8psW0dXu0BWAoJu1c2IvKFwSlz4fsHwCHCX8a+i2EagdSC1yfOlFqA9Iu6OxX9nEABCQ17GVsa+JanExuT/8W/BKgTZGgp9ptGz98i0hOVLSBbIkOABDNs3ONmxilICzf9jipZsGFjwWpBXJgjAiK5qDHnlYTe6/ASdjvywwbiJjnwr+","invite_key_sealed_invite_data_cek":"g1g+pgE6AAEReQMYZQRQeHT1pCPgaB9CYG+Rb8scAjoAARVcUOeB/QFwHUwsvdEq0eCp5Us6AAE4gQM6AAE4gAKhBVgYnr1DARLvnvtw1bsYXa2gueder+FZz2D4WE1gkmCx7GnYs+54fw+OeTJhutaOhz9gd7lwfRj5V0tGlP3yNdOUxLyyBDN/+L1qQzjbo3Utm17Wfl1ZrVbBZcFsQzue0/Zq0Lk8+/h+cA==","invite_secret_sealed_invite_key":"hFgopQEDAxhlOgABFVxQeHT1pCPgaB9CYG+Rb8scAjoAATiBBjoAATiAAaEFTB07pVNo3oYWy0o/XlhUQA/hxa3AsrA2OnLDQE8ffqZ/J29CXGv3YbPqOgIEXWPWOKEo9SZW+TbhBi6q3Wf0EewTdeWADozr80J79rJTxTfXKS2yNCmT+fjIjJcI0ov8HpnlgYNAogEpM1ggvtgywem/2QA8V1q/wgKtv6Rk1jLDpbZrbvE5+efMGkL2","invite_key_sealed_organization_key":"g1hKpQE6AAEReQN4ImFwcGxpY2F0aW9uL3guYml0d2FyZGVuLmxlZ2FjeS1rZXkEUHh09aQj4GgfQmBvkW/LHAI6AAE4gQM6AAE4gAKhBVgYQ5qCc8T8brREcCQFDzA2QhqjeTjoHtl2WFBuAdHlH509FDCxbqgjPUM56nEXVawZFQSpotSWXQsCYAz/MUce7LREwgkUZ5f3x9y4CpkvNTPkmEGTw675emwwpR05x6gJ0aL/UoyoF4bSpw==","organization_key_sealed_invite_key":"2.YnutjO6dOLfu/FzUXmdpaw==|nQnSQSO5EjB/sq6aMEK3bcEY9PQdLTBmelj1ftsMP7tiWUeoS6RTLKzg4kv8qggUgx+xh+XjBxULwdYJeV3k+pChTrnTRogClph2m3N9RtQ=|/dsbX2NfWpSVFPTHa5HQxBT7b9EdlwVlEgjJzyq3SvA="}' as unknown as Invite;


Exposed secret in crates/bitwarden-wasm-internal/integration-tests/tests/org-fixtures.ts - low severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More Info}

@AikidoSec ignore: Test vector

✅ Based on your feedback, we ignored this issue because of the following reason:

Test vector

…ations

eliykat

Approving CODEOWNERS changes and @quexten 's initial changes to AC code. I've asked another AC engineer to review as well.

dereknance

✅ Platform: crates/bitwarden-wasm-internal/integration-tests/tests/

mzieniukbw · 2026-07-28T12:36:34Z

+            supports_confirmation: response.supports_confirmation.unwrap_or(false),
+            creation_date: require!(response.creation_date)
+                .parse()
+                .map_err(|_| MissingFieldError("creation_date"))?,


❓ Isn't this more like malformed ?

@eliykat Would you mind taking a look? Since this is nit I merged since this is VFO work with a tight deadline. / it lives in your code.

BTreston

This all seems good to me, one non-blocking question for @eliykat

BTreston · 2026-07-28T14:24:07Z

🎨❓ Do we think its worth also moving the delete functionality into the SDK for consistency? There are no crypto operations on it currently, so it doesn't have to. But it would be nice to have all the CRUD operations live in the SDK client. It would make invite link completely portable across clients if we so desired. Perhaps a follow up?

…: re-structure invite-link-client to use and expose new invite link api (bitwarden/sdk-internal#1274)

quexten commented Jul 17, 2026

View reviewed changes

Comment thread crates/bitwarden-wasm-internal/integration-tests/tests/invite/invite-link.test.ts

github-actions Bot added the breaking-change label Jul 17, 2026

quexten force-pushed the invite-client-use-safe-crypto branch 2 times, most recently from 70c1a5d to 1d26aa5 Compare July 17, 2026 11:50

quexten marked this pull request as ready for review July 17, 2026 12:08

quexten requested review from a team as code owners July 17, 2026 12:08

quexten requested review from mzieniukbw and sven-bitwarden July 17, 2026 12:08

quexten force-pushed the invite-client-use-safe-crypto branch from 1d26aa5 to 2c2359e Compare July 20, 2026 09:32

quexten force-pushed the invite-client-use-safe-crypto branch from 2c2359e to 568a6e6 Compare July 20, 2026 13:18

github-actions Bot added breaking-change and removed breaking-change labels Jul 20, 2026

quexten force-pushed the invite-client-use-safe-crypto branch from 568a6e6 to 52bfcc5 Compare July 20, 2026 13:44

quexten force-pushed the invite-client-use-safe-crypto branch from 52bfcc5 to ffb720b Compare July 21, 2026 03:35

github-actions Bot added breaking-change and removed breaking-change labels Jul 21, 2026

quexten force-pushed the invite-client-use-safe-crypto branch from ffb720b to 3b20922 Compare July 21, 2026 07:08

quexten requested review from eliykat and removed request for sven-bitwarden July 21, 2026 07:27

quexten force-pushed the invite-client-use-safe-crypto branch from 3b20922 to c05b283 Compare July 21, 2026 07:54

quexten and others added 6 commits July 28, 2026 09:21

fixup! fixup! fixup! fixup! fixup! fixup! feat(safe): add key hierarchy

c904b6b

chore(crypto): drop unused error variant

0a4a6c5

feat(invite-link): re-structure invite-link-client to use and expose …

a878bb0

…new invite link api

fixup! feat(invite-link): re-structure invite-link-client to use and …

dcc35f9

…expose new invite link api

Align invite link impl

36fcbb3

fix: fix return of invite secret

21d0b51

eliykat force-pushed the invite-client-use-safe-crypto branch from 8d255c0 to 21d0b51 Compare July 27, 2026 23:21

fix: fix ffi / add integration tests

a16413a

quexten requested a review from a team as a code owner July 28, 2026 04:54

quexten requested a review from dereknance July 28, 2026 04:54

aikido-pr-checks Bot reviewed Jul 28, 2026

View reviewed changes

quexten and others added 4 commits July 28, 2026 13:55

Clean up comment

c4b1da7

Fix supports_confirmation behavior

4f12aee

Fix integration tests

923c86a

chore(codeowners): update codeowners of integration tests for organiz…

d249dcd

…ations

quexten requested a review from a team as a code owner July 28, 2026 06:14

quexten requested review from JaredSnider-Bitwarden and mzieniukbw July 28, 2026 06:15

eliykat approved these changes Jul 28, 2026

View reviewed changes

dereknance approved these changes Jul 28, 2026

View reviewed changes

mzieniukbw approved these changes Jul 28, 2026

View reviewed changes

JaredSnider-Bitwarden removed their request for review July 28, 2026 14:45

BTreston approved these changes Jul 28, 2026

View reviewed changes

quexten merged commit a91e406 into main Jul 28, 2026
84 checks passed

quexten deleted the invite-client-use-safe-crypto branch July 28, 2026 17:11

bw-ghapp Bot added a commit to bitwarden/sdk-swift that referenced this pull request Jul 28, 2026

bitwarden/sdk-internal@a91e406 3.0.0-7329-a91e406 - feat(invite-link)…

ea073f2

…: re-structure invite-link-client to use and expose new invite link api (bitwarden/sdk-internal#1274)

This was referenced Jul 28, 2026

Update SDK to 3.0.0-8066-b2c68b46 bitwarden/android#7217

Open

Update sdk-internal to 0.2.0-main.928 bitwarden/clients#21870

Merged

eliykat mentioned this pull request Jul 28, 2026

[PM-40307] chore: add malformed field error #1306

Merged

		export const TEST_INVITE_SECRET =
		"oSpRu_AENo_n11TqiLIryrJKaEPbQVjbdd6r4reyqUU" as unknown as InviteSecret;

Uh oh!

Conversation

quexten commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 SDK Breaking Change Detection

Uh oh!

codecov Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Bitwarden Claude Code Review

Uh oh!

aikido-pr-checks Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

quexten Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

quexten Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

eliykat left a comment

Choose a reason for hiding this comment

Uh oh!

dereknance left a comment

Choose a reason for hiding this comment

Uh oh!

mzieniukbw Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

quexten Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

BTreston left a comment

Choose a reason for hiding this comment

Uh oh!

BTreston Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

quexten commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading

codecov Bot commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading