bitwarden · fedemkr · Jul 17, 2024 · Jun 10, 2024 · Jun 10, 2024 · Jun 11, 2024
@@ -230,6 +230,11 @@ protocol AuthRepository: AnyObject {
     ///
     func validatePassword(_ password: String) async throws -> Bool
 
+    /// Validates thes user's entered PIN.
+    /// - Parameter pin: Pin to validate.
+    /// - Returns: `true` if valid, `false` otherwise.
+    func validatePin(pin: String) async -> Bool
+
     /// Verifies that the entered one-time password matches the one sent to the user.
     ///
     /// - Parameter otp: The user's one-time password to verify.
@@ -774,6 +779,35 @@ extension DefaultAuthRepository: AuthRepository {
         }
     }
 
+    func validatePin(pin: String) async -> Bool {
+        guard let pinProtectedUserKey = try? await stateService.pinProtectedUserKey() else {
+            return false
+        }
+
+        // HACK: As the SDK doesn't provide a way to directly validate the pin yet, we have this method
+        // which just tries to initialize the user crypto and if it succeeds then the PIN is correct, otherwise
+        // the PIN is incorrect.
+
+        do {
+            let account = try await stateService.getActiveAccount()
+            let encryptionKeys = try await stateService.getAccountEncryptionKeys()
+
+            try await clientService.crypto().initializeUserCrypto(
+                req: InitUserCryptoRequest(
+                    kdfParams: account.kdf.sdkKdf,
+                    email: account.profile.email,
+                    privateKey: encryptionKeys.encryptedPrivateKey,
+                    method: .pin(pin: pin, pinProtectedUserKey: pinProtectedUserKey)
+                )
+            )
+            try await organizationService.initializeOrganizationCrypto()
+
+            return true
+        } catch {
+            return false
+        }
+    }
+
     func verifyOtp(_ otp: String) async throws {
         try await accountAPIService.verifyOtp(otp)
     }

@@ -1557,6 +1557,119 @@ class AuthRepositoryTests: BitwardenTestCase { // swiftlint:disable:this type_bo
         XCTAssertFalse(isValid)
     }
 
+    /// `validatePin(_:)` returns `true` if the pin is valid when initializing the user crypto.
+    func test_validatePin() async throws {
+        let account = Account.fixture()
+        stateService.activeAccount = account
+
+        stateService.accountEncryptionKeys = [
+            "1": AccountEncryptionKeys(encryptedPrivateKey: "PRIVATE_KEY", encryptedUserKey: "USER_KEY"),
+        ]
+
+        stateService.encryptedPinByUserId[account.profile.userId] = "123"
+        stateService.pinProtectedUserKeyValue[account.profile.userId] = "123"
+
+        let isPinValid = await subject.validatePin(pin: "123")
+
+        XCTAssertEqual(
+            clientService.mockCrypto.initializeUserCryptoRequest,
+            InitUserCryptoRequest(
+                kdfParams: .pbkdf2(iterations: UInt32(Constants.pbkdf2Iterations)),
+                email: "user@bitwarden.com",
+                privateKey: "PRIVATE_KEY",
+                method: .pin(pin: "123", pinProtectedUserKey: "123")
+            )
+        )
+        XCTAssertTrue(isPinValid)
+    }
+
+    /// `validatePin(_:)` returns `false` if the there is no active account.
+    func test_validatePin_noActiveAccount() async throws {
+        let account = Account.fixture()
+
+        stateService.accountEncryptionKeys = [
+            "1": AccountEncryptionKeys(encryptedPrivateKey: "PRIVATE_KEY", encryptedUserKey: "USER_KEY"),
+        ]
+
+        stateService.encryptedPinByUserId[account.profile.userId] = "123"
+
+        let isPinValid = await subject.validatePin(pin: "123")
+
+        XCTAssertNotEqual(
+            clientService.mockCrypto.initializeUserCryptoRequest,
+            InitUserCryptoRequest(
+                kdfParams: .pbkdf2(iterations: UInt32(Constants.pbkdf2Iterations)),
+                email: "user@bitwarden.com",
+                privateKey: "PRIVATE_KEY",
+                method: .pin(pin: "123", pinProtectedUserKey: "123")
+            )
+        )
+        XCTAssertFalse(isPinValid)
+    }
+
+    /// `validatePin(_:)` returns `false` if the there is no pin protected user key.
+    func test_validatePin_noPinProtectedUserKey() async throws {
+        let account = Account.fixture()
+        stateService.activeAccount = account
+
+        stateService.accountEncryptionKeys = [
+            "1": AccountEncryptionKeys(encryptedPrivateKey: "PRIVATE_KEY", encryptedUserKey: "USER_KEY"),
+        ]
+
+        stateService.encryptedPinByUserId[account.profile.userId] = "123"
+
+        let isPinValid = await subject.validatePin(pin: "123")
+
+        XCTAssertNotEqual(
+            clientService.mockCrypto.initializeUserCryptoRequest,
+            InitUserCryptoRequest(
+                kdfParams: .pbkdf2(iterations: UInt32(Constants.pbkdf2Iterations)),
+                email: "user@bitwarden.com",
+                privateKey: "PRIVATE_KEY",
+                method: .pin(pin: "123", pinProtectedUserKey: "123")
+            )
+        )
+        XCTAssertFalse(isPinValid)
+    }
+
+    /// `validatePin(_:)` returns `false` if initializing user crypto throws.
+    func test_validatePin_initializeUserCryptoThrows() async throws {
+        let account = Account.fixture()
+        stateService.activeAccount = account
+
+        stateService.accountEncryptionKeys = [
+            "1": AccountEncryptionKeys(encryptedPrivateKey: "PRIVATE_KEY", encryptedUserKey: "USER_KEY"),
+        ]
+
+        stateService.encryptedPinByUserId[account.profile.userId] = "123"
+        stateService.pinProtectedUserKeyValue[account.profile.userId] = "123"
+
+        clientService.mockCrypto.initializeUserCryptoResult = .failure(BitwardenTestError.example)
+
+        let isPinValid = await subject.validatePin(pin: "123")
+
+        XCTAssertFalse(isPinValid)
+    }
+
+    /// `validatePin(_:)` returns `false` if initializing org crypto throws.
+    func test_validatePin_initializeOrgCryptoThrows() async throws {
+        let account = Account.fixture()
+        stateService.activeAccount = account
+
+        stateService.accountEncryptionKeys = [
+            "1": AccountEncryptionKeys(encryptedPrivateKey: "PRIVATE_KEY", encryptedUserKey: "USER_KEY"),
+        ]
+
+        stateService.encryptedPinByUserId[account.profile.userId] = "123"
+        stateService.pinProtectedUserKeyValue[account.profile.userId] = "123"
+
+        organizationService.initializeOrganizationCryptoError = BitwardenTestError.example
+
+        let isPinValid = await subject.validatePin(pin: "123")
+
+        XCTAssertFalse(isPinValid)
+    }
+
     /// `verifyOtp(_:)` makes an API request to verify an OTP code.
     func test_verifyOtp() async throws {
         client.result = .httpSuccess(testData: .emptyResponse)

@@ -76,6 +76,8 @@ class MockAuthRepository: AuthRepository { // swiftlint:disable:this type_body_l
     var validatePasswordPasswords = [String]()
     var validatePasswordResult: Result<Bool, Error> = .success(true)
 
+    var validatePinResult: Bool = true
+
     var vaultTimeout = [String: SessionTimeoutValue]()
 
     func allowBioMetricUnlock(_ enabled: Bool) async throws {
@@ -303,6 +305,10 @@ class MockAuthRepository: AuthRepository { // swiftlint:disable:this type_body_l
         return try validatePasswordResult.get()
     }
 
+    func validatePin(pin: String) async -> Bool {
+        validatePinResult
+    }
+
     func verifyOtp(_ otp: String) async throws {
         verifyOtpOpt = otp
         try verifyOtpResult.get()

@@ -133,9 +133,18 @@ extension DefaultUserVerificationHelper: UserVerificationHelper {
                     continuation.resume(throwing: UserVerificationError.cancelled)
                 },
                 settingUp: false,
-                completion: { _ in
-                    // TODO: PM-8388 Perform PIN verification when method available from SDK
-                    continuation.resume(returning: .notVerified)
+                completion: { pin in
+                    guard await self.authRepository.validatePin(pin: pin) else {
+                        self.userVerificationDelegate?.showAlert(
+                            .defaultAlert(title: Localizations.invalidPIN),
+                            onDismissed: {
+                                continuation.resume(returning: .notVerified)
+                            }
+                        )
+                        return
+                    }
+
+                    continuation.resume(returning: .verified)
                 }
             )
 

@@ -219,26 +219,102 @@ class UserVerificationHelperTests: BitwardenTestCase {
     }
 
     /// `verifyPin()` unable to perform when auth repository pin unlock is not available.
-    func test_verifyPin_unableToPerformR3c0rdables() async throws {
+    func test_verifyPin_unableToPerform() async throws {
         authRepository.isPinUnlockAvailableResult = .success(false)
 
         let result = try await subject.verifyPin()
 
         XCTAssertEqual(result, .unableToPerform)
     }
 
-    // TODO: PM-8388 Add more tests for `verifyPin`
+    /// `verifyPin()` with cancelled verification.
+    func test_verifyPin_cancelled() async throws {
+        authRepository.isPinUnlockAvailableResult = .success(true)
+        let task = Task {
+            try await self.subject.verifyPin()
+        }
+
+        try await waitForAsync {
+            !self.userVerificationDelegate.alertShown.isEmpty
+        }
+
+        let alert = try XCTUnwrap(userVerificationDelegate.alertShown.last)
+        try await alert.tapAction(title: Localizations.cancel)
+
+        await assertAsyncThrows(error: UserVerificationError.cancelled) {
+            _ = try await task.value
+        }
+    }
+
+    /// `verifyPin()` with verified PIN.
+    func test_verifyPin_verified() async throws {
+        authRepository.isPinUnlockAvailableResult = .success(true)
+        authRepository.validatePinResult = true
+
+        let task = Task {
+            try await self.subject.verifyPin()
+        }
+
+        try await waitForAsync {
+            !self.userVerificationDelegate.alertShown.isEmpty
+        }
+
+        try await enterPinInAlertAndSubmit()
+
+        let result = try await task.value
+
+        XCTAssertEqual(result, .verified)
+    }
+
+    /// `verifyPin()` with not verified PIN.
+    func test_verifyPin_notVerified() async throws {
+        authRepository.isPinUnlockAvailableResult = .success(true)
+        authRepository.validatePinResult = false
+
+        let task = Task {
+            try await self.subject.verifyPin()
+        }
+
+        try await waitForAsync {
+            !self.userVerificationDelegate.alertShown.isEmpty
+        }
+
+        try await enterPinInAlertAndSubmit()
+
+        try await waitForAsync {
+            self.userVerificationDelegate.alertShown
+                .last?.title == Localizations.invalidPIN
+        }
+
+        let alert = try XCTUnwrap(userVerificationDelegate.alertShown.last)
+
+        XCTAssertEqual(alert, .defaultAlert(title: Localizations.invalidPIN))
+
+        try await alert.tapAction(title: Localizations.ok)
+
+        userVerificationDelegate.alertOnDismissed?()
+
+        let result = try await task.value
+
+        XCTAssertEqual(result, .notVerified)
+    }
 
     // MARK: Private
 
     private func enterMasterPasswordInAlertAndSubmit() async throws {
         let alert = try XCTUnwrap(userVerificationDelegate.alertShown.last)
-
         XCTAssertEqual(alert, .masterPasswordPrompt { _ in })
-        var textField = try XCTUnwrap(alert.alertTextFields.first)
-        textField = AlertTextField(id: "password", text: "password")
 
-        try await alert.tapAction(title: Localizations.submit, alertTextFields: [textField])
+        try alert.setText("password", forTextFieldWithId: "password")
+        try await alert.tapAction(title: Localizations.submit)
+    }
+
+    private func enterPinInAlertAndSubmit() async throws {
+        let alert = try XCTUnwrap(userVerificationDelegate.alertShown.last)
+        XCTAssertEqual(alert, .enterPINCode(settingUp: false) { _ in })
+
+        try alert.setText("pin", forTextFieldWithId: "pin")
+        try await alert.tapAction(title: Localizations.submit)
     }
 }