feat(crypto): add user-key id tracking

crates/bitwarden-api-api/.openapi-generator/FILES

@@ -546,6 +546,7 @@ src/models/service_account_secrets_details_response_model_list_response_model.rs
 src/models/service_account_update_request_model.rs
 src/models/set_initial_password_request_model.rs
 src/models/set_key_connector_key_request_model.rs
+src/models/set_user_key_id_request_model.rs
 src/models/set_verify_devices_request_model.rs
 src/models/setup_business_unit_request_body.rs
 src/models/signature_key_pair_request_model.rs

crates/bitwarden-api-api/README.md

@@ -22,7 +22,7 @@ client.
 - API version: latest
 - Package version: 3.0.0
 - Server Git commit:
-  [`f15fee9e1d2f7e9d9502876e773cf1413f6519f0`](https://github.com/bitwarden/server/commit/f15fee9e1d2f7e9d9502876e773cf1413f6519f0)
+  [`ba8edda213c63ecf35d30f70385afc8e1b0b94af`](https://github.com/bitwarden/server/commit/ba8edda213c63ecf35d30f70385afc8e1b0b94af)
 - Generator version: 7.15.0
 - Build package: `org.openapitools.codegen.languages.RustClientCodegen`
 
@@ -111,6 +111,7 @@ All URIs are relative to *https://api.bitwarden.com*
 | _AccountsKeyManagementApi_                | [**post_convert_to_key_connector**](docs/AccountsKeyManagementApi.md#accounts_key_management_post_convert_to_key_connector)                                      | **POST** /accounts/convert-to-key-connector                                                              |
 | _AccountsKeyManagementApi_                | [**post_enroll_to_key_connector**](docs/AccountsKeyManagementApi.md#accounts_key_management_post_enroll_to_key_connector)                                        | **POST** /accounts/key-connector/enroll                                                                  |
 | _AccountsKeyManagementApi_                | [**post_set_key_connector_key**](docs/AccountsKeyManagementApi.md#accounts_key_management_post_set_key_connector_key)                                            | **POST** /accounts/set-key-connector-key                                                                 |
+| _AccountsKeyManagementApi_                | [**post_user_key_id**](docs/AccountsKeyManagementApi.md#accounts_key_management_post_user_key_id)                                                                | **POST** /accounts/key-management/user-key-id                                                            | Reports the key id of the caller's current user key to the server.                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | _AccountsKeyManagementApi_                | [**regenerate_keys**](docs/AccountsKeyManagementApi.md#accounts_key_management_regenerate_keys)                                                                  | **POST** /accounts/key-management/regenerate-keys                                                        |
 | _AccountsKeyManagementApi_                | [**rotate_user_keys**](docs/AccountsKeyManagementApi.md#accounts_key_management_rotate_user_keys)                                                                | **POST** /accounts/key-management/rotate-user-keys                                                       |
 | _AuthRequestsApi_                         | [**get**](docs/AuthRequestsApi.md#auth_requests_get)                                                                                                             | **GET** /auth-requests/{id}                                                                              |
@@ -1031,6 +1032,7 @@ All URIs are relative to *https://api.bitwarden.com*
 - [ServiceAccountUpdateRequestModel](docs/ServiceAccountUpdateRequestModel.md)
 - [SetInitialPasswordRequestModel](docs/SetInitialPasswordRequestModel.md)
 - [SetKeyConnectorKeyRequestModel](docs/SetKeyConnectorKeyRequestModel.md)
+- [SetUserKeyIdRequestModel](docs/SetUserKeyIdRequestModel.md)
 - [SetVerifyDevicesRequestModel](docs/SetVerifyDevicesRequestModel.md)
 - [SetupBusinessUnitRequestBody](docs/SetupBusinessUnitRequestBody.md)
 - [SignatureKeyPairRequestModel](docs/SignatureKeyPairRequestModel.md)

crates/bitwarden-api-api/src/apis/accounts_key_management_api.rs

@@ -58,6 +58,14 @@ pub trait AccountsKeyManagementApi: Send + Sync {
         set_key_connector_key_request_model: Option<models::SetKeyConnectorKeyRequestModel>,
     ) -> Result<(), Error>;
 
+    /// POST /accounts/key-management/user-key-id
+    /// This is meant for backfilling the user-key id for existing users for whom the key id is not
+    /// yet recorded.
+    async fn post_user_key_id<'a>(
+        &self,
+        set_user_key_id_request_model: Option<models::SetUserKeyIdRequestModel>,
+    ) -> Result<(), Error>;
+
     /// POST /accounts/key-management/regenerate-keys
     async fn regenerate_keys<'a>(
         &self,
@@ -205,6 +213,29 @@ impl AccountsKeyManagementApi for AccountsKeyManagementApiClient {
         bitwarden_api_base::process_with_empty_response(local_var_req_builder).await
     }
 
+    /// This is meant for backfilling the user-key id for existing users for whom the key id is not
+    /// yet recorded.
+    async fn post_user_key_id<'a>(
+        &self,
+        set_user_key_id_request_model: Option<models::SetUserKeyIdRequestModel>,
+    ) -> Result<(), Error> {
+        let local_var_configuration = &self.configuration;
+
+        let local_var_client = &local_var_configuration.client;
+
+        let local_var_uri_str = format!(
+            "{}/accounts/key-management/user-key-id",
+            local_var_configuration.base_path
+        );
+        let mut local_var_req_builder =
+            local_var_client.request(reqwest::Method::POST, local_var_uri_str.as_str());
+
+        local_var_req_builder = local_var_req_builder.with_extension(AuthRequired::Bearer);
+        local_var_req_builder = local_var_req_builder.json(&set_user_key_id_request_model);
+
+        bitwarden_api_base::process_with_empty_response(local_var_req_builder).await
+    }
+
     async fn regenerate_keys<'a>(
         &self,
         key_regeneration_request_model: Option<models::KeyRegenerationRequestModel>,

crates/bitwarden-api-api/src/models/master_password_unlock_and_authentication_data_model.rs

@@ -54,6 +54,15 @@ pub struct MasterPasswordUnlockAndAuthenticationDataModel {
         skip_serializing_if = "Option::is_none"
     )]
     pub master_password_salt: Option<String>,
+    /// Optional hex-encoded key id of the user key wrapped by
+    /// Bit.Api.KeyManagement.Models.Requests.MasterPasswordUnlockAndAuthenticationDataModel.
+    /// MasterKeyEncryptedUserKey. Absent for clients that predate the field.
+    #[serde(
+        rename = "userKeyId",
+        alias = "UserKeyId",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub user_key_id: Option<String>,
 }
 
 impl MasterPasswordUnlockAndAuthenticationDataModel {
@@ -74,6 +83,7 @@ impl MasterPasswordUnlockAndAuthenticationDataModel {
             master_key_encrypted_user_key,
             master_password_hint: None,
             master_password_salt: None,
+            user_key_id: None,
         }
     }
 }

crates/bitwarden-api-api/src/models/master_password_unlock_data_request_model.rs

@@ -23,6 +23,14 @@ pub struct MasterPasswordUnlockDataRequestModel {
     pub master_key_wrapped_user_key: String,
     #[serde(rename = "salt", alias = "Salt")]
     pub salt: String,
+    /// Optional hex-encoded key id of the wrapped user key. Absent for clients that predate the
+    /// field.
+    #[serde(
+        rename = "userKeyId",
+        alias = "UserKeyId",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub user_key_id: Option<String>,
 }
 
 impl MasterPasswordUnlockDataRequestModel {
@@ -38,6 +46,7 @@ impl MasterPasswordUnlockDataRequestModel {
             kdf: Box::new(kdf),
             master_key_wrapped_user_key,
             salt,
+            user_key_id: None,
         }
     }
 }

crates/bitwarden-api-api/src/models/mod.rs

@@ -944,6 +944,8 @@ pub mod set_initial_password_request_model;
 pub use self::set_initial_password_request_model::SetInitialPasswordRequestModel;
 pub mod set_key_connector_key_request_model;
 pub use self::set_key_connector_key_request_model::SetKeyConnectorKeyRequestModel;
+pub mod set_user_key_id_request_model;
+pub use self::set_user_key_id_request_model::SetUserKeyIdRequestModel;
 pub mod set_verify_devices_request_model;
 pub use self::set_verify_devices_request_model::SetVerifyDevicesRequestModel;
 pub mod setup_business_unit_request_body;

crates/bitwarden-api-api/src/models/rotate_user_account_keys_and_data_request_model.rs

@@ -25,6 +25,14 @@ pub struct RotateUserAccountKeysAndDataRequestModel {
     pub account_keys: Box<models::AccountKeysRequestModel>,
     #[serde(rename = "accountData", alias = "AccountData")]
     pub account_data: Box<models::AccountDataRequestModel>,
+    /// Optional hex-encoded key id of the new user key this rotation establishes. Absent for
+    /// clients that predate the field.
+    #[serde(
+        rename = "userKeyId",
+        alias = "UserKeyId",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub user_key_id: Option<String>,
 }
 
 impl RotateUserAccountKeysAndDataRequestModel {
@@ -39,6 +47,7 @@ impl RotateUserAccountKeysAndDataRequestModel {
             account_unlock_data: Box::new(account_unlock_data),
             account_keys: Box::new(account_keys),
             account_data: Box::new(account_data),
+            user_key_id: None,
         }
     }
 }

crates/bitwarden-api-api/src/models/rotate_user_keys_request_model.rs

@@ -26,6 +26,12 @@ pub struct RotateUserKeysRequestModel {
     pub account_data: Box<models::AccountDataRequestModel>,
     #[serde(rename = "unlockMethodData", alias = "UnlockMethodData")]
     pub unlock_method_data: Box<models::UnlockMethodRequestModel>,
+    #[serde(
+        rename = "userKeyId",
+        alias = "UserKeyId",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub user_key_id: Option<String>,
 }
 
 impl RotateUserKeysRequestModel {
@@ -40,6 +46,7 @@ impl RotateUserKeysRequestModel {
             unlock_data: Box::new(unlock_data),
             account_data: Box::new(account_data),
             unlock_method_data: Box::new(unlock_method_data),
+            user_key_id: None,
         }
     }
 }

crates/bitwarden-api-api/src/models/set_user_key_id_request_model.rs

@@ -0,0 +1,26 @@
+/*
+ * Bitwarden Internal API
+ *
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: latest
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use serde::{Deserialize, Serialize};
+
+use crate::models;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SetUserKeyIdRequestModel {
+    /// Hex-encoded key id of the user's current user key.
+    #[serde(rename = "userKeyId", alias = "UserKeyId")]
+    pub user_key_id: String,
+}
+
+impl SetUserKeyIdRequestModel {
+    pub fn new(user_key_id: String) -> SetUserKeyIdRequestModel {
+        SetUserKeyIdRequestModel { user_key_id }
+    }
+}

crates/bitwarden-api-api/src/models/user_decryption_response_model.rs

@@ -33,6 +33,13 @@ pub struct UserDecryptionResponseModel {
         skip_serializing_if = "Option::is_none"
     )]
     pub v2_upgrade_token: Option<Box<models::V2UpgradeTokenResponseModel>>,
+    /// Hex-encoded key id of the user's current user key, when the server knows it.
+    #[serde(
+        rename = "userKeyId",
+        alias = "UserKeyId",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub user_key_id: Option<String>,
 }
 
 impl UserDecryptionResponseModel {
@@ -41,6 +48,7 @@ impl UserDecryptionResponseModel {
             master_password_unlock: None,
             web_authn_prf_options: None,
             v2_upgrade_token: None,
+            user_key_id: None,
         }
     }
 }

crates/bitwarden-api-identity/README.md

@@ -22,7 +22,7 @@ client.
 - API version: v1
 - Package version: 3.0.0
 - Server Git commit:
-  [`c2d97d5ff2019c524405c36f7f3afc992ec0ef03`](https://github.com/bitwarden/server/commit/c2d97d5ff2019c524405c36f7f3afc992ec0ef03)
+  [`ba8edda213c63ecf35d30f70385afc8e1b0b94af`](https://github.com/bitwarden/server/commit/ba8edda213c63ecf35d30f70385afc8e1b0b94af)
 - Generator version: 7.15.0
 - Build package: `org.openapitools.codegen.languages.RustClientCodegen`
 

crates/bitwarden-api-identity/src/models/master_password_unlock_data_request_model.rs

@@ -20,6 +20,12 @@ pub struct MasterPasswordUnlockDataRequestModel {
     pub master_key_wrapped_user_key: String,
     #[serde(rename = "salt", alias = "Salt")]
     pub salt: String,
+    #[serde(
+        rename = "userKeyId",
+        alias = "UserKeyId",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub user_key_id: Option<String>,
 }
 
 impl MasterPasswordUnlockDataRequestModel {
@@ -32,6 +38,7 @@ impl MasterPasswordUnlockDataRequestModel {
             kdf: Box::new(kdf),
             master_key_wrapped_user_key,
             salt,
+            user_key_id: None,
         }
     }
 }

crates/bitwarden-core/src/auth/auth_request.rs

@@ -164,6 +164,7 @@ mod tests {
                     },
                     master_key_wrapped_user_key: user_key,
                     salt: "test@bitwarden.com".to_string(),
+                    user_key_id: None,
                 },
                 WrappedAccountCryptographicState::V1 { private_key },
                 &None,
@@ -237,6 +238,7 @@ mod tests {
                     kdf: kdf.clone(),
                     master_key_wrapped_user_key: user_key,
                     salt: email.to_string(),
+                    user_key_id: None,
                 },
                 WrappedAccountCryptographicState::V1 {
                     private_key: private_key.clone(),

crates/bitwarden-core/src/auth/password/validate.rs

@@ -142,6 +142,7 @@ mod tests {
                     kdf,
                     master_key_wrapped_user_key: user_key.clone(),
                     salt: email.to_string(),
+                    user_key_id: None,
                 },
                 WrappedAccountCryptographicState::V1 { private_key },
                 &None,
@@ -201,6 +202,7 @@ mod tests {
                     kdf,
                     master_key_wrapped_user_key: user_key.parse().unwrap(),
                     salt: email.to_string(),
+                    user_key_id: None,
                 },
                 WrappedAccountCryptographicState::V1 { private_key },
                 &None,

crates/bitwarden-core/src/auth/pin.rs

@@ -104,6 +104,7 @@ mod tests {
                     kdf,
                     master_key_wrapped_user_key: user_key.parse().unwrap(),
                     salt: email.to_string(),
+                    user_key_id: None,
                 },
                 WrappedAccountCryptographicState::V1 { private_key },
                 &None,

crates/bitwarden-core/src/client/internal.rs

@@ -509,6 +509,7 @@ mod tests {
                 kdf: new_kdf.clone(),
                 master_key_wrapped_user_key: user_key,
                 salt: email,
+                user_key_id: None,
             })
             .await
             .unwrap();
@@ -537,6 +538,7 @@ mod tests {
                 kdf,
                 master_key_wrapped_user_key: new_encrypted_user_key,
                 salt: new_email,
+                user_key_id: None,
             })
             .await
             .unwrap();

crates/bitwarden-core/src/client/test_accounts.rs

@@ -169,6 +169,7 @@ pub fn test_bitwarden_com_account() -> TestAccount {
                     kdf,
                     master_key_wrapped_user_key: "2.Q/2PhzcC7GdeiMHhWguYAQ==|GpqzVdr0go0ug5cZh1n+uixeBC3oC90CIe0hd/HWA/pTRDZ8ane4fmsEIcuc8eMKUt55Y2q/fbNzsYu41YTZzzsJUSeqVjT8/iTQtgnNdpo=|dwI+uyvZ1h/iZ03VQ+/wrGEFYVewBUUl/syYgjsNMbE=".parse().unwrap(),
                     salt: email.to_owned(),
+                    user_key_id: None,
                 },
             },
             upgrade_token: None,
@@ -270,6 +271,7 @@ pub fn test_legacy_user_key_account() -> TestAccount {
                     kdf,
                     master_key_wrapped_user_key: "0.8UClLa8IPE1iZT7chy5wzQ==|6PVfHnVk5S3XqEtQemnM5yb4JodxmPkkWzmDRdfyHtjORmvxqlLX40tBJZ+CKxQWmS8tpEB5w39rbgHg/gqs0haGdZG4cPbywsgGzxZ7uNI=".parse().unwrap(),
                     salt: email.to_owned(),
+                    user_key_id: None,
                 },
             },
             upgrade_token: None,