Auth/PM-40520 - Registration - Open Org Invite Seal / Unseal Support

.github/CODEOWNERS

@@ -1,40 +1,58 @@
 # Please sort into logical groups with comment headers. Sort groups in order of specificity.
+
 # For example, default owners should always be the first group.
+
 # Sort lines alphabetically within these groups to avoid accidentally adding duplicates.
+
 #
+
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
 
 # We have a few ownership models in use here, applied to team-owned crates as well as CLI code:
+
 # 1. Full ownership by team-platform-dev, for cases where teams have not yet onboarded at all.
+
 # 2. Joint team ownership with team-platform-dev, as a team onboards into SDK development and close guidance is necessary.
+
 # 3. Full team ownership, once a team is comfortable with SDK development and has enough shared experience to ensure alignment with SDK architecture.
 
 # Platform is the default owner for all files
-* @bitwarden/team-platform-dev
+
+- @bitwarden/team-platform-dev
 
 # CODEOWNERS owners
+
 .github/CODEOWNERS @bitwarden/tech-leads
 
 # Auto-generated bindings
+
 # For these bindings, we want Platform to continue to own everything except the auto-generated code.
+
 # Bindings for our API do not have an owner as the API is shared between teams.
+
 crates/bitwarden-api-api/src/**
 crates/bitwarden-api-api/README.md
 crates/bitwarden-api-api/.openapi-generator/**
+
 # Bindings for Identity are owned by Auth.
+
 crates/bitwarden-api-identity/src/** @bitwarden/team-auth-dev
 crates/bitwarden-api-identity/README.md @bitwarden/team-auth-dev
 crates/bitwarden-api-identity/.openapi-generator/** @bitwarden/team-auth-dev
+
 # Bindings for Key Connector are owned by Key Management.
-crates/bitwarden-api-key-connector/src/** @bitwarden/team-key-management-dev
+
+crates/bitwarden-api-key-connector/src/\*\* @bitwarden/team-key-management-dev
 
 # Claude related files
+
 .claude/ @bitwarden/team-ai-sme
 .claude/skills/create-testvectors/ @bitwarden/team-ai-sme @bitwarden/team-key-management-dev
 .github/workflows/respond.yml @bitwarden/team-ai-sme
 .github/workflows/review-code.yml @bitwarden/team-ai-sme
 
 # Team-owned crates
+
 bitwarden_license/bitwarden-pam/** @bitwarden/team-pam-dev
 bitwarden_license/bitwarden-sm/** @bitwarden/team-secrets-manager-dev @bitwarden/team-platform-dev
 crates/bitwarden-auth/** @bitwarden/team-auth-dev
@@ -59,38 +77,46 @@ crates/bitwarden-user-crypto-management/** @bitwarden/team-key-management-dev
 crates/bitwarden-vault/** @bitwarden/team-vault-dev
 
 # Team-owned folders in other crates (to be avoided if possible)
+
 crates/bitwarden-wasm-internal/integration-tests/tests/organizations/** @bitwarden/team-admin-console-dev
+crates/bitwarden-wasm-internal/integration-tests/tests/registration/** @bitwarden/team-auth-dev
 crates/bitwarden-wasm-internal/integration-tests/tests/unlock/** @bitwarden/team-key-management-dev
 crates/bitwarden-wasm-internal/src/pure_crypto.rs @bitwarden/team-key-management-dev
 crates/bitwarden-core/src/key_management/** @bitwarden/team-key-management-dev @bitwarden/team-platform-dev
 crates/bitwarden-ipc/src/crypto_provider/noise/ @bitwarden/team-key-management-dev
 
 # BW CLI
+
 crates/bw/src/admin_console/** @bitwarden/team-platform-dev
 crates/bw/src/auth/** @bitwarden/team-auth-dev
 crates/bw/src/key_management/** @bitwarden/team-key-management-dev
 crates/bw/src/tools/** @bitwarden/team-tools-dev @bitwarden/team-platform-dev
-crates/bw/src/vault/** @bitwarden/team-vault-dev
+crates/bw/src/vault/\*\* @bitwarden/team-vault-dev
 
 # BRE for publish workflow changes
-.github/workflows/publish-*.yml @bitwarden/dept-bre
+
+.github/workflows/publish-\*.yml @bitwarden/dept-bre
 .github/workflows/release-rust-crates.yml @bitwarden/dept-bre
 .github/workflows/release-swift.yml @bitwarden/dept-bre
 
 ## Multiple owners
-.github/workflows/build-* @bitwarden/team-platform-dev
+
+.github/workflows/build-\* @bitwarden/team-platform-dev
 .github/workflows/version-bump.yml @bitwarden/team-platform-dev
 
 # Docker-related files
+
 **/Dockerfile @bitwarden/team-appsec @bitwarden/dept-bre
-**/*.dockerignore @bitwarden/team-appsec @bitwarden/dept-bre
+**/\*.dockerignore @bitwarden/team-appsec @bitwarden/dept-bre
 **/entrypoint.sh @bitwarden/team-appsec @bitwarden/dept-bre
 **/docker-compose.yml @bitwarden/team-appsec @bitwarden/dept-bre
 
 # UniFFI config files. Platform owns to avoid review bingo when they are all changed.
-**/uniffi.toml @bitwarden/team-platform-dev
+
+\*\*/uniffi.toml @bitwarden/team-platform-dev
 
 ## No ownership for root dependency management files to allow Renovate to manage updates
+
 /Cargo.lock
 /Cargo.toml
 /package-lock.json

crates/bitwarden-auth/Cargo.toml

@@ -22,13 +22,9 @@ wasm = [
     "dep:tsify",
     "dep:wasm-bindgen",
     "dep:wasm-bindgen-futures",
-] # WASM support
-uniffi = [
-    "bitwarden-core/uniffi",
-    "bitwarden-policies/uniffi",
-    "dep:uniffi",
-] # Uniffi bindings
-secrets = ["bitwarden-core/secrets"] # Secrets Manager support
+]
+uniffi = ["bitwarden-core/uniffi", "bitwarden-policies/uniffi", "dep:uniffi"]
+secrets = ["bitwarden-core/secrets"]
 
 # Note: dependencies must be alphabetized to pass the cargo sort check in the CI pipeline.
 [dependencies]
@@ -43,6 +39,7 @@ bitwarden-error = { workspace = true }
 bitwarden-policies = { workspace = true }
 bitwarden-state = { workspace = true }
 chrono = { workspace = true }
+ciborium = { workspace = true }
 http = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }

crates/bitwarden-auth/src/registration/mod.rs

@@ -3,12 +3,16 @@
 //! mechanisms to establish their cryptographic state and register with
 //! the Bitwarden server
 
+mod open_org_invite_crypto;
 mod post_keys_for_jit_password_registration;
 mod post_keys_for_key_connector_registration;
 mod post_keys_for_tde_registration;
 mod post_keys_for_user_password_registration;
 mod registration_client;
 
+pub use open_org_invite_crypto::{
+    OpenOrgInvite, SealedOpenOrgInvite, SealedOpenOrgInviteData, SealedOpenOrgInviteDataError,
+};
 pub use post_keys_for_jit_password_registration::{
     JitMasterPasswordRegistrationRequest, JitMasterPasswordRegistrationResponse,
 };

crates/bitwarden-auth/src/registration/open_org_invite_crypto/client.rs

@@ -0,0 +1,95 @@
+//! FFI-facing seal/unseal. The [`RegistrationClient`] methods are thin wrappers over
+//! [`SealedOpenOrgInviteData::seal`] / [`SealedOpenOrgInviteData::unseal`];
+//! [`SealedOpenOrgInvite`] bundles both halves of the seal output as one WASM return type.
+
+use bitwarden_crypto::safe::HighEntropySecret;
+use serde::{Deserialize, Serialize};
+#[cfg(feature = "wasm")]
+use tsify::Tsify;
+#[cfg(feature = "wasm")]
+use wasm_bindgen::prelude::*;
+
+use super::{OpenOrgInvite, SealedOpenOrgInviteData};
+use crate::registration::registration_client::{RegistrationClient, RegistrationError};
+
+/// Sealed open-organization-invite payload. Produced by
+/// [`RegistrationClient::seal_open_org_invite_data`] and consumed by
+/// [`RegistrationClient::unseal_open_org_invite_data`]. Both fields are required to unseal;
+/// neither half is useful on its own.
+#[cfg_attr(feature = "wasm", derive(Tsify), tsify(into_wasm_abi, from_wasm_abi))]
+#[derive(Serialize, Deserialize, Debug, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct SealedOpenOrgInvite {
+    /// URL-safe opaque payload; place on the verification-email link.
+    pub sealed_data: SealedOpenOrgInviteData,
+    /// Paired secret; keep client-side (e.g. `localStorage`) and never send to the server.
+    pub high_entropy_secret: HighEntropySecret,
+}
+
+#[cfg_attr(feature = "wasm", wasm_bindgen)]
+impl RegistrationClient {
+    /// Seals an [`OpenOrgInvite`] into a [`SealedOpenOrgInvite`]. The returned
+    /// `sealed_data` is safe to place on the verification-email link; the returned
+    /// `high_entropy_secret` must stay client-side.
+    pub fn seal_open_org_invite_data(
+        &self,
+        input: OpenOrgInvite,
+    ) -> Result<SealedOpenOrgInvite, RegistrationError> {
+        let (sealed_data, high_entropy_secret) = SealedOpenOrgInviteData::seal(input)?;
+        Ok(SealedOpenOrgInvite {
+            sealed_data,
+            high_entropy_secret,
+        })
+    }
+
+    /// Unseals a [`SealedOpenOrgInvite`] back into an [`OpenOrgInvite`]. Returns
+    /// [`RegistrationError::Crypto`] if the paired secret does not match the sealed payload or
+    /// the payload has been tampered with.
+    pub fn unseal_open_org_invite_data(
+        &self,
+        sealed: SealedOpenOrgInvite,
+    ) -> Result<OpenOrgInvite, RegistrationError> {
+        sealed.sealed_data.unseal(&sealed.high_entropy_secret)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use bitwarden_core::Client;
+
+    use super::*;
+
+    fn sample_input() -> OpenOrgInvite {
+        OpenOrgInvite {
+            organization_id: "1bc9ac1e-f5aa-45f2-94bf-b181009709b8".to_string(),
+            invite_link_code: "abcd1234efgh5678".to_string(),
+            invite_secret: "raw-invite-secret-material-base64url".to_string(),
+        }
+    }
+
+    #[test]
+    fn sealed_open_org_invite_json_wire_shape_is_stable() {
+        // Locks the JSON wire: two-key camelCase object, both values as strings.
+        let client = Client::new(None);
+        let registration_client = RegistrationClient::new(client);
+        let sealed = registration_client
+            .seal_open_org_invite_data(sample_input())
+            .expect("seal should succeed");
+
+        let json = serde_json::to_value(&sealed).expect("serialize");
+        let obj = json.as_object().expect("must be a JSON object");
+        assert_eq!(obj.len(), 2, "no extra or missing fields");
+        assert!(
+            obj.get("sealedData")
+                .expect("sealedData key must be present")
+                .is_string(),
+            "sealedData must serialize as a JSON string"
+        );
+        assert!(
+            obj.get("highEntropySecret")
+                .expect("highEntropySecret key must be present")
+                .is_string(),
+            "highEntropySecret must serialize as a JSON string"
+        );
+    }
+}

crates/bitwarden-auth/src/registration/open_org_invite_crypto/data_v1.rs

@@ -0,0 +1,21 @@
+//! Version 1 of the open-org-invite plaintext payload — the innermost thing sealed by the
+//! [`bitwarden_crypto::safe::DataEnvelope`]. Not to be confused with the sealed opaque blob
+//! ([`super::SealedOpenOrgInviteData`]) or the outbound JSON ([`super::SealedOpenOrgInvite`]);
+//! this file describes only the cleartext shape that gets CBOR-encoded and encrypted.
+//!
+//! Once this shape ships it cannot be broken: any field change means adding a new `V2` struct
+//! and registering both variants on the versioned enum in [`super`], so old sealed payloads
+//! still unseal.
+
+use bitwarden_crypto::safe::SealableData;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub(super) struct RegistrationOpenOrgInviteDataV1 {
+    pub(super) organization_id: String,
+    pub(super) invite_link_code: String,
+    pub(super) invite_secret: String,
+}
+
+impl SealableData for RegistrationOpenOrgInviteDataV1 {}

crates/bitwarden-auth/src/registration/open_org_invite_crypto/mod.rs

@@ -0,0 +1,28 @@
+//! Open-organization-invite registration crossing.
+//!
+//! The app seals an invite context on registration-start submit and unseals it on the accept
+//! open-org-invite component after a successful registration-finish. This module owns the
+//! versioned plaintext payload (`data_v1`), the domain types and crypto operations
+//! (`open_org_invite`), their wire encoding (`serialization`), and the FFI-facing client
+//! methods (`client`).
+
+mod client;
+mod data_v1;
+mod open_org_invite;
+mod serialization;
+
+use bitwarden_crypto::{
+    generate_versioned_sealable,
+    safe::{DataEnvelopeNamespace, SealableData, SealableVersionedData},
+};
+pub use client::SealedOpenOrgInvite;
+use data_v1::RegistrationOpenOrgInviteDataV1;
+pub use open_org_invite::{OpenOrgInvite, SealedOpenOrgInviteData};
+use serde::{Deserialize, Serialize};
+pub use serialization::SealedOpenOrgInviteDataError;
+
+generate_versioned_sealable!(
+    RegistrationOpenOrgInviteData,
+    DataEnvelopeNamespace::RegistrationOpenOrgInviteData,
+    [RegistrationOpenOrgInviteDataV1 => "1"]
+);