fix(vault): force cipher-key presence in blob cipher

crates/bitwarden-vault/src/cipher/blob/encryption.rs

@@ -43,7 +43,7 @@ fn seal_cipher(
     ctx: &mut KeyStoreContext<KeySlotIds>,
     wrapping_key: SymmetricKeySlotId,
 ) -> Result<String, BlobEncryptionError> {
-    let cipher_key = Cipher::decrypt_cipher_key(ctx, wrapping_key, &view.key)?;
+    let cipher_key = Cipher::decrypt_required_cipher_key(ctx, wrapping_key, &view.key)?;
     let blob = CipherBlobLatest::from_cipher_view(view, ctx, cipher_key)?;
     seal_blob_content(blob, cipher_key, ctx)
 }
@@ -97,7 +97,7 @@ pub(crate) fn encrypt_blob_cipher_with_wrapping_key(
         view.generate_cipher_key(ctx, wrapping_key)?;
     }
 
-    let cipher_key = Cipher::decrypt_cipher_key(ctx, wrapping_key, &view.key)?;
+    let cipher_key = Cipher::decrypt_required_cipher_key(ctx, wrapping_key, &view.key)?;
 
     let sealed_string = seal_cipher(view, ctx, wrapping_key)?;
 
@@ -161,7 +161,7 @@ pub(crate) fn decrypt_blob_cipher(
     ctx: &mut KeyStoreContext<KeySlotIds>,
     wrapping_key: SymmetricKeySlotId,
 ) -> Result<CipherView, BlobEncryptionError> {
-    let cipher_key = Cipher::decrypt_cipher_key(ctx, wrapping_key, &cipher.key)?;
+    let cipher_key = Cipher::decrypt_required_cipher_key(ctx, wrapping_key, &cipher.key)?;
 
     let CipherBlob::CipherBlobV1(blob) = sealed.unseal(&cipher_key, ctx)?;
 
@@ -657,6 +657,41 @@ mod tests {
         assert!(restored.key.is_some());
     }
 
+    #[test]
+    fn test_decrypt_blob_cipher_requires_cipher_key() {
+        let (key_store, _) = create_test_key_store();
+        let mut ctx = key_store.context_mut();
+
+        // Seal a blob under a freshly generated cipher key.
+        let mut view = create_shell_cipher_view(CipherType::SecureNote);
+        view.name = "No Key".to_string();
+        view.secure_note = Some(SecureNoteView {
+            r#type: SecureNoteType::Generic,
+        });
+        view.generate_cipher_key(&mut ctx, view.key_identifier())
+            .unwrap();
+        let sealed_string = seal_cipher(&view, &mut ctx, view.key_identifier()).unwrap();
+
+        // Build a blob-format cipher that is missing its per-cipher key. Decryption must reject it
+        // rather than falling back to the user key.
+        let mut cipher = make_test_cipher_with_data(&mut ctx, Some(sealed_string));
+        cipher.key = None;
+
+        let result = decrypt_blob_cipher(
+            &cipher,
+            &try_parse_blob(&cipher).unwrap(),
+            &mut ctx,
+            cipher.key_identifier(),
+        );
+
+        assert!(matches!(
+            result,
+            Err(BlobEncryptionError::Crypto(CryptoError::MissingField(
+                "key"
+            )))
+        ));
+    }
+
     #[test]
     fn test_try_parse_blob_returns_none_for_legacy() {
         let (key_store, _) = create_test_key_store();

crates/bitwarden-vault/src/cipher/cipher.rs

@@ -810,6 +810,30 @@ impl Cipher {
         }
     }
 
+    /// Decrypt the individual encryption key for this cipher, requiring that one is present.
+    ///
+    /// Unlike [`Cipher::decrypt_cipher_key`], this does NOT fall back to the wrapping
+    /// (user/organization) key when the cipher has no key. It is used by the blob-encryption path,
+    /// where every cipher must carry its own key and operating directly on the user/organization
+    /// key would be incorrect.
+    ///
+    /// # Arguments
+    ///
+    /// * `ctx` - The key store context where the cipher key will be decrypted
+    /// * `wrapping_key` - The key used to unwrap the cipher key, i.e. the user or organization key
+    /// * `ciphers_key` - The encrypted cipher key, which must be present
+    #[bitwarden_logging::instrument(err)]
+    pub(crate) fn decrypt_required_cipher_key(
+        ctx: &mut KeyStoreContext<KeySlotIds>,
+        wrapping_key: SymmetricKeySlotId,
+        ciphers_key: &Option<EncString>,
+    ) -> Result<SymmetricKeySlotId, CryptoError> {
+        let ciphers_key = ciphers_key
+            .as_ref()
+            .ok_or(CryptoError::MissingField("key"))?;
+        ctx.unwrap_symmetric_key(wrapping_key, ciphers_key)
+    }
+
     /// Builds the cryptographic material for a new attachment: a fresh key (raw and wrapped with
     /// the cipher key) plus the encrypted file name.
     ///