Auth/PM-40520 - Registration - Open Org Invite Seal / Unseal Support

.github/CODEOWNERS

@@ -60,6 +60,7 @@ crates/bitwarden-vault/** @bitwarden/team-vault-dev
 
 # Team-owned folders in other crates (to be avoided if possible)
 crates/bitwarden-wasm-internal/integration-tests/tests/invite/** @bitwarden/team-admin-console-dev
+crates/bitwarden-wasm-internal/integration-tests/tests/registration/** @bitwarden/team-auth-dev
 crates/bitwarden-wasm-internal/integration-tests/tests/unlock/** @bitwarden/team-key-management-dev
 crates/bitwarden-wasm-internal/src/pure_crypto.rs @bitwarden/team-key-management-dev
 crates/bitwarden-core/src/key_management/** @bitwarden/team-key-management-dev @bitwarden/team-platform-dev

crates/bitwarden-auth/Cargo.toml

@@ -22,13 +22,9 @@ wasm = [
     "dep:tsify",
     "dep:wasm-bindgen",
     "dep:wasm-bindgen-futures",
-] # WASM support
-uniffi = [
-    "bitwarden-core/uniffi",
-    "bitwarden-policies/uniffi",
-    "dep:uniffi",
-] # Uniffi bindings
-secrets = ["bitwarden-core/secrets"] # Secrets Manager support
+]
+uniffi = ["bitwarden-core/uniffi", "bitwarden-policies/uniffi", "dep:uniffi"]
+secrets = ["bitwarden-core/secrets"]
 
 # Note: dependencies must be alphabetized to pass the cargo sort check in the CI pipeline.
 [dependencies]
@@ -43,6 +39,7 @@ bitwarden-error = { workspace = true }
 bitwarden-policies = { workspace = true }
 bitwarden-state = { workspace = true }
 chrono = { workspace = true }
+ciborium = { workspace = true }
 http = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }

crates/bitwarden-auth/src/registration/mod.rs

@@ -3,12 +3,16 @@
 //! mechanisms to establish their cryptographic state and register with
 //! the Bitwarden server
 
+mod open_org_invite;
 mod post_keys_for_jit_password_registration;
 mod post_keys_for_key_connector_registration;
 mod post_keys_for_tde_registration;
 mod post_keys_for_user_password_registration;
 mod registration_client;
 
+pub use open_org_invite::{
+    OpenOrgInvite, SealedOpenOrgInvite, SealedOpenOrgInviteData, SealedOpenOrgInviteDataError,
+};
 pub use post_keys_for_jit_password_registration::{
     JitMasterPasswordRegistrationRequest, JitMasterPasswordRegistrationResponse,
 };

crates/bitwarden-auth/src/registration/open_org_invite/data_v1.rs

@@ -0,0 +1,22 @@
+//! Version 1 of the open-org-invite plaintext payload — the innermost thing sealed by the
+//! [`bitwarden_crypto::safe::DataEnvelope`] in [`super::seal`]. Not to be confused with the sealed
+//! opaque blob ([`super::SealedOpenOrgInviteData`]) or the outbound JSON
+//! ([`super::SealedOpenOrgInvite`]); this file describes only the cleartext shape that gets
+//! CBOR-encoded and encrypted.
+//!
+//! Once this shape ships it cannot be broken: any field change means adding a new `V2` struct
+//! and registering both variants on the versioned enum in [`super`], so old sealed payloads
+//! still unseal.
+
+use bitwarden_crypto::safe::SealableData;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub(super) struct RegistrationOpenOrgInviteDataV1 {
+    pub(super) organization_id: String,
+    pub(super) invite_link_code: String,
+    pub(super) invite_secret: String,
+}
+
+impl SealableData for RegistrationOpenOrgInviteDataV1 {}

crates/bitwarden-auth/src/registration/open_org_invite/mod.rs

@@ -0,0 +1,26 @@
+//! Open-organization-invite registration crossing.
+//!
+//! The app seals an invite context on registration-start submit and unseals it on the accept
+//! open-org-invite component after a successful registration-finish. This module owns the
+//! versioned plaintext payload (`data_v1`), the seal path (`seal`), and the unseal path
+//! (`unseal`).
+
+mod data_v1;
+mod seal;
+mod unseal;
+
+use bitwarden_crypto::{
+    generate_versioned_sealable,
+    safe::{DataEnvelopeNamespace, SealableData, SealableVersionedData},
+};
+use data_v1::RegistrationOpenOrgInviteDataV1;
+pub use seal::{
+    OpenOrgInvite, SealedOpenOrgInvite, SealedOpenOrgInviteData, SealedOpenOrgInviteDataError,
+};
+use serde::{Deserialize, Serialize};
+
+generate_versioned_sealable!(
+    RegistrationOpenOrgInviteData,
+    DataEnvelopeNamespace::RegistrationOpenOrgInviteData,
+    [RegistrationOpenOrgInviteDataV1 => "1"]
+);