[PM-41073] Remove nested EncStrings on decrypted CipherViews

crates/bitwarden-exporters/src/export.rs

@@ -92,7 +92,7 @@ pub fn encrypt_import(
     if let Some(passkey) = passkey {
         let passkeys = passkey.into_iter().map(|p| p.into()).collect();
 
-        view.set_new_fido2_credentials(ctx, passkeys)?;
+        view.set_new_fido2_credentials(passkeys)?;
     }
 
     // Select the encryption format based on the account's current security state, matching how

crates/bitwarden-exporters/src/models.rs

@@ -95,7 +95,7 @@ impl From<PasswordHistoryView> for crate::PasswordHistory {
 /// Convert a `LoginView` into a `crate::Login`.
 fn from_login(
     view: &CipherView,
-    key_store: &KeyStore<KeySlotIds>,
+    _key_store: &KeyStore<KeySlotIds>,
 ) -> Result<crate::Login, MissingFieldError> {
     let l = require!(view.login.clone());
 
@@ -110,11 +110,16 @@ fn from_login(
             .collect(),
         totp: l.totp,
         fido2_credentials: l.fido2_credentials.as_ref().and_then(|_| {
-            let credentials = view.get_fido2_credentials(&mut key_store.context()).ok()?;
+            let credentials = view.get_fido2_credentials();
             if credentials.is_empty() {
                 None
             } else {
-                Some(credentials.into_iter().map(|c| c.into()).collect())
+                Some(
+                    credentials
+                        .into_iter()
+                        .map(|c| Fido2CredentialFullView::from(c).into())
+                        .collect(),
+                )
             }
         }),
     })

crates/bitwarden-fido/src/authenticator.rs

@@ -326,16 +326,14 @@ impl<'a> Fido2Authenticator<'a> {
     pub(super) fn get_selected_credential(
         &self,
     ) -> Result<SelectedCredential, GetSelectedCredentialError> {
-        let key_store = self.client.internal.get_key_store();
-
         let cipher = self
             .selected_cipher
             .lock()
             .expect("Mutex is not poisoned")
             .clone()
             .ok_or(GetSelectedCredentialError::NoSelectedCredential)?;
 
-        let creds = cipher.decrypt_fido2_credentials(&mut key_store.context())?;
+        let creds = cipher.get_fido2_credentials();
 
         let credential = creds
             .first()
@@ -480,9 +478,7 @@ impl passkey::authenticator::CredentialStore for CredentialStoreImpl<'_> {
                 .clone()
                 .ok_or(InnerError::NoSelectedCredential)?;
 
-            let key_store = this.authenticator.client.internal.get_key_store();
-
-            selected.set_new_fido2_credentials(&mut key_store.context(), vec![cred])?;
+            selected.set_new_fido2_credentials(vec![cred])?;
 
             // Store the updated credential for later use
             this.authenticator
@@ -554,10 +550,8 @@ impl passkey::authenticator::CredentialStore for CredentialStoreImpl<'_> {
 
             let cred = fill_with_credential(&selected.credential, cred)?;
 
-            let key_store = this.authenticator.client.internal.get_key_store();
-
             let mut selected = selected.cipher;
-            selected.set_new_fido2_credentials(&mut key_store.context(), vec![cred])?;
+            selected.set_new_fido2_credentials(vec![cred])?;
 
             // Store the updated credential for later use
             this.authenticator
@@ -681,15 +675,12 @@ fn map_ui_hint(hint: UiHint<'_, CipherViewContainer>) -> UiHint<'_, CipherView>
 #[cfg(test)]
 mod tests {
     use async_trait::async_trait;
-    use bitwarden_core::{
-        Client,
-        key_management::{KeySlotIds, SymmetricKeySlotId},
-    };
-    use bitwarden_crypto::{KeyStoreContext, PrimitiveEncryptable, SymmetricCryptoKey};
+    use bitwarden_core::{Client, key_management::SymmetricKeySlotId};
+    use bitwarden_crypto::SymmetricCryptoKey;
     use bitwarden_encoding::B64Url;
     use bitwarden_vault::{
         CipherListView, CipherRepromptType, CipherType, CipherView, EncryptionContext,
-        Fido2Credential, Fido2CredentialNewView, LoginView,
+        Fido2CredentialNewView, Fido2CredentialView, LoginView,
     };
     use passkey::authenticator::UiHint;
 
@@ -783,23 +774,22 @@ mod tests {
         0x84, 0x05, 0x71,
     ];
 
-    fn create_test_cipher(ctx: &mut KeyStoreContext<KeySlotIds>) -> CipherView {
-        let key = SymmetricKeySlotId::User;
+    fn create_test_cipher() -> CipherView {
         let key_value = B64Url::from(TEST_FIDO_P256_KEY).to_string();
 
-        let fido2_credential = Fido2Credential {
-            credential_id: TEST_FIDO_CREDENTIAL_ID.encrypt(ctx, key).unwrap(),
-            key_type: "public-key".to_string().encrypt(ctx, key).unwrap(),
-            key_algorithm: "ECDSA".to_string().encrypt(ctx, key).unwrap(),
-            key_curve: "P-256".to_string().encrypt(ctx, key).unwrap(),
-            key_value: key_value.encrypt(ctx, key).unwrap(),
-            rp_id: TEST_FIDO_RP_ID.encrypt(ctx, key).unwrap(),
-            user_handle: Some(TEST_FIDO_USER_HANDLE.encrypt(ctx, key).unwrap()),
+        let fido2_credential = Fido2CredentialView {
+            credential_id: TEST_FIDO_CREDENTIAL_ID.to_string(),
+            key_type: "public-key".to_string(),
+            key_algorithm: "ECDSA".to_string(),
+            key_curve: "P-256".to_string(),
+            key_value,
+            rp_id: TEST_FIDO_RP_ID.to_string(),
+            user_handle: Some(TEST_FIDO_USER_HANDLE.to_string()),
             user_name: None,
-            counter: "0".to_string().encrypt(ctx, key).unwrap(),
+            counter: "0".to_string(),
             rp_name: None,
             user_display_name: None,
-            discoverable: "true".to_string().encrypt(ctx, key).unwrap(),
+            discoverable: "true".to_string(),
             creation_date: "2024-06-07T14:12:36.150Z".parse().unwrap(),
         };
 
@@ -867,10 +857,7 @@ mod tests {
             .set_symmetric_key(SymmetricKeySlotId::User, user_key)
             .unwrap();
 
-        let cipher = {
-            let mut ctx = client.internal.get_key_store().context();
-            create_test_cipher(&mut ctx)
-        };
+        let cipher = create_test_cipher();
 
         let user_interface = MockUserInterface;
         let credential_store = MockCredentialStore { cipher };

crates/bitwarden-fido/src/lib.rs

@@ -73,8 +73,15 @@ pub(crate) struct CipherViewContainer {
 }
 
 impl CipherViewContainer {
-    fn new(cipher: CipherView, ctx: &mut KeyStoreContext<KeySlotIds>) -> Result<Self, CipherError> {
-        let fido2_credentials = cipher.get_fido2_credentials(ctx)?;
+    fn new(
+        cipher: CipherView,
+        _ctx: &mut KeyStoreContext<KeySlotIds>,
+    ) -> Result<Self, CipherError> {
+        let fido2_credentials = cipher
+            .get_fido2_credentials()
+            .into_iter()
+            .map(Fido2CredentialFullView::from)
+            .collect();
         Ok(Self {
             cipher,
             fido2_credentials,

crates/bitwarden-fido/src/types.rs

@@ -70,9 +70,9 @@ impl Fido2CredentialAutofillView {
     #[allow(missing_docs)]
     pub fn from_cipher_view(
         cipher: &CipherView,
-        ctx: &mut KeyStoreContext<KeySlotIds>,
+        _ctx: &mut KeyStoreContext<KeySlotIds>,
     ) -> Result<Vec<Fido2CredentialAutofillView>, Fido2CredentialAutofillViewError> {
-        let credentials = cipher.decrypt_fido2_credentials(ctx)?;
+        let credentials = cipher.get_fido2_credentials();
 
         credentials
             .iter()

crates/bitwarden-user-crypto-management/src/key_rotation/data.rs

@@ -408,7 +408,7 @@ mod tests {
 
         // A legacy cipher that already carries a per-item cipher key
         let mut cipher = make_cipher_view();
-        cipher.generate_cipher_key(&mut ctx, user_key_old).unwrap();
+        cipher.generate_cipher_key(&mut ctx).unwrap();
         let encrypted = EncryptMode::Legacy(cipher.clone())
             .encrypt_composite(&mut ctx, user_key_old)
             .unwrap();