clients/apps/cli/src
Dmitry Yakimenko bb3748f265
[PM-33198] Keeper direct importer (#19395)
* Direct Keeper importer UI and a dummy access module (WIP)

* Add Keeper importer impl, fix it to run in the browser not node (WIP)

* Add request logging to Keeper client

* Auto-close Keeper device approval dialog on websocket notification

When user approves their device via email link, the websocket receives a
device_verified notification. Previously the dialog remained open requiring
manual dismissal. Now the dialog closes automatically when approval succeeds.

* Remove Continue button from Keeper device approval dialog

The button did not actually do anything useful since approval happens via
email link click. Updated dialog to show a message that it will close
automatically. Added missing Keeper i18n messages to web app.

* Add device approval method selection dialog for Keeper import

- Created KeeperApprovalMethodSelectComponent to let user choose between
  Email and Keeper Push approval methods
- Removed TwoFactor from DeviceApprovalChannel (not supported yet)
- Show waiting dialog for Keeper Push approval (was missing)
- Added i18n messages for approval method selection
- Added debug logging for push requests

* Add Keeper data center region selection dropdown

- Added region dropdown with US, EU, AU, CA, JP, US (GOV) options
- Region is passed to Keeper client when opening vault
- Updated test script to select EU region
- Added i18n messages for region label

* Add verification code input to Keeper device approval dialog

Users can now either click the approval link in the email or enter the
6-digit verification code directly in the dialog. Both methods work to
approve the device and continue the import flow.

* Fix AES-CBC no-padding decryption for Keeper encryption params

Web Crypto API requires PKCS7 padding for AES-CBC decryption. The previous
workaround of appending zeros failed because decrypted zeros do not produce
valid PKCS7 padding bytes.

New approach: encrypt a proper PKCS7 padding block (16 bytes of 0x10) using
the last ciphertext block as IV, then append this encrypted padding to create
valid padded ciphertext that Web Crypto can decrypt.

* More scripts for testing

* Remove generated files we don't need

* Test scripts (remove later)

* Refactor the sync-down processing to be able to test easier

* Fix lint errors

* Cleanup

* New token

* New fixture and export

* Some tests

* Move the code into a new place

* Simplify Vault spec

* Use BaseImporter

* Add more record types

* Disable console.log in tests

* Update test data and tests

* Test each record type

* Fix folders

* Major refactor

* Decrypt shared record keys

* Remove account summary

* Add folders to records

* Build all paths

* Collect paths for all records

* uidToString

* Refactor base64 URL encoding/decoding using Utils from common library

* Add README for Direct Keeper importer and refactor VaultItem handling

* Refactor KeeperDirectImporter to streamline password and username handling in import process

* Implement reference collection and resolution in KeeperDirectImporter

* TODO

* More TODOs

* 2FA selection

* Handle SMS

* Add .proto and proto compiler to generate .ts from .proto

* Remove debugging code

* Delete debug scripts

* Update readme

* Update proto build script to disable ESLint checks for generated files

* Remove keeper-export.json

* Refactor ClientOptions to use KeeperRegion const object

* Remove includeSharedFolders option

* Make sure nx serve builds proto

* Clean up crypto

* Clean up crypto.ts

* cleanup

* Remove unnecessary exception class

* Move fixture into proper place, fix tests

* Move code around to match lastpass/access structure better

* Add protobuf generation step to CI test workflow

* Fix date expectations in keeper direct importer tests

* Build .proto files before typechecking

* Fix npm run test:types errors

* Rename .proto files to kebap case to prevent CI lint warnings about having capital case letters in filenames

* Commit generated protobuf TS files and remove build-time proto generation

The protobuf build step was causing CI issues. Generated TS files are now
committed directly. Proto source files remain as reference with a README
documenting how to regenerate.

* Change npx instruction to run directly from npm

* Add generated files README, update proto README

* Update TODO comment in vault.ts

* Add @protobuf-ts/runtime to Tools dep ownership in renovate config

* Implement Duo 2FA support for Keeper direct importer

- Fix Duo Passcode/SMS using wrong value type (TWO_FA_CODE_TOTP -> TWO_FA_CODE_DUO)
- Remove unnecessary socket wait after Passcode/SMS validation (token returned directly by API)
- Add waiting dialog for Duo Push/Voice methods instead of just showing a spinner
- Add code input support for Duo Passcode/SMS methods
- Make all Ui interface methods required

* Fix README

* Changes suggested by @quexten (doc comments)

* Fix TS type checked warnings

* Filter out unsupported 2FA methods from UI

* Skip file-based import flow for Keeper direct import

* Show error when no supported 2FA found but 2FA is required

* Migrate from @protobuf-ts/runtime to @bufbuild/protobuf

* Track possible cycles in the folder strcuture and break them (was suggested in review)

* Fix leftover merge conflict marker in web messages.json

* [PM-33198] angular modernization changes

* Remove KeeperPush from supported 2FAs for now, update README with more TODOs

* Reuse existing 'email' i18n key instead of keeperApprovalMethodEmail

* Reuse existing 'verificationCode' i18n key instead of keeperVerificationCode

* Replace keeperMFADesc with generic mfaTotpDesc i18n key

* Consolidate keeperTwoFactorSms and keeperDuoSms into generic textMessageSms i18n key

* Rename keeperTwoFactorBackup and keeperTwoFactorDuo to generic i18n keys

* Rename keeperDuo* i18n keys to generic duoVerification/duoPushWaiting/duoSmsWaiting/duoVoiceWaiting

* Consolidate keeperTwoFactorUnknown and keeperDuoUnknown into generic unknownMethod i18n key

* Reuse existing 'passcode' i18n key instead of keeperDuoPasscode

* Rename keeperRegion to generic dataCenterLocation i18n key

* Rename keeperSelectApprovalMethod* to generic selectApprovalMethod* i18n keys

* Rename keeperDeviceApprovalEmailDesc to generic approvalEmailDesc i18n key

* Rename generic keeper-prefixed i18n keys to content-driven names

* Rename keeperSelect* i18n keys to generic selectTwoFactorMethod/selectDuoMethod

* Rename remaining keeper-prefixed i18n keys to content-driven names

Consolidate keeperApprovalMethodPush and keeperTwoFactorKeeperPush into
single keeperPush key.

* Add Keeper DNA Push 2FA support for direct importer

* Add Keeper DNA manual code entry

* Add two-factor authentication as device approval method

* Mark DNA and backup codes as done.

* Add TryAnother sentinel and loop device approval flow

* Add 'Try another method' button to Keeper device approval

* Unify Keeper importer auth flow into a single dialog

* Remove unused per-state Keeper dialog components

* Hide empty Keeper email hint to remove gap below the field

* Defer Keeper password prompt until server requests it

* Split Keeper direct importer into its own format option

* Refine Keeper email and region field labels

* Redesign Keeper auth dialog and route Try another method back to selection

* Restyle Keeper master password dialog and route close to cancel

* Show Keeper email subtitle on every auth dialog stage

* Add Cancel to single-button Keeper auth stages and use Continue label

* Use radio buttons for Keeper two-factor method selection

* Group Keeper auth dialog by stage via reusable shell

Each @case now contains one self-contained <keeper-stage-shell> block
with a comment header. The shell wraps bit-dialog and holds the
stage-independent header bits (X close button, title with email
subtitle), forwarding bitDialogContent and bitDialogFooter slots through
via ngProjectAs. Footer projection is gated by an explicit [hasFooter]
input — bit-dialog detects its footer via contentChild on a real
DialogFooterDirective, and ngProjectAs alone does not satisfy that
check.

The shell also sets disableAnimations on the inner bit-dialog, so stage
transitions no longer slide.

* Use radio buttons for Keeper Duo and DNA method selection

* Move Keeper auth dialog footer buttons into the stage shell

* Match Keeper email approval dialog to design and fix Resend

- Split approvalCode email vs push: email gets "Email verification"
  title, no spinner, and a Resend code link
- Update i18n copy for Approval methods, descriptions, and add
  emailVerification, twoFactorMethod, plus refined approvalEmailDesc
- Fix Resend handling in handleDeviceApproval so re-requesting the
  verification email keeps the dialog open instead of throwing

* Match Keeper push approval dialog to design

* Match Keeper 2FA code dialog to design and support resend

* Trigger 2FA push on device approval and wire resend

* Show method-specific copy for TOTP and SMS 2FA prompts

* Streamline Keeper DNA flow and pick up watch approval via socket

* Show loading spinner on Continue while validating master password

* Drop Try another method from 2FA and DNA push dialogs

* Tidy Keeper import callout copy and rename email field

* Unify device approval dialog titles and restore Try another method on 2FA approval

* Add Keeper Cloud SSO, admin approval, and browser auto-capture

* Add Keeper import Method dropdown for direct, CSV, and JSON

* Auto-capture Keeper SSO token in browser via spinner stage

* Mark temp feature for removal

* Retry Keeper approval and 2FA codes on server rejection

* Update Keeper push/admin approval dialog copy and add heading

* Skip Keeper SSO dialog on browser extension

* Confirm before cancelling Keeper admin approval flow

* Attach Keeper import async validator to email control

* Simplify Keeper spinner block spacing to typography defaults

* Restyle admin approval cancel confirmation as danger

* Restore missing ImportResult import after upstream merge

* Retry Keeper master password on server rejection

* Clean up PR hygiene: remove stray lock file and proto EOF blanks

* Use bitIconButton label input for accessible close button

* Reject Keeper SSO login when user closes IdP tab

* Restore Keeper csv/json importers for CLI and hide from web dropdown

* Move Keeper direct import out of async validator into explicit submit

* Fix strict-mode type errors in Keeper device approval flow

* Set organizationId on Keeper direct importer so org imports keep folders

* Require email for Keeper direct import and show login errors in the field

* Keep browser import in persistent context

* Fix package-lock.json to match @bufbuild/protobuf 2.11.0 in package.json

* Remove leftover merge conflict marker in web messages.json

* Fix formatting in vault.spec.ts

* Update Keeper importer README reviewers section

* Clarify Windows File Send test name

* Anchor Keeper SSO callback URL regex to https:// to prevent substring matches

* Route Keeper SSO script injection through BrowserApi abstraction

* Reject default Keeper SSO monitor promise instead of leaving it pending

* Replace string-matched Keeper auth errors with typed error codes

* Clean up Keeper importer dead code and i18n inconsistencies

* Resolve linked record keys and report skipped items in Keeper direct import

* Update partial import dialog copy and aggregate skipped items by type

* Show skipped item types in Keeper partial import dialog

* List skipped item names instead of record types in Keeper import dialog

* Revert "List skipped item names instead of record types in Keeper import dialog"

This reverts commit b504becf45.

* Identify Keeper import errors by record UID instead of decrypted name

* Relabel Keeper driverLicense import type as Driver's licence

* Fix NG0100 in import dialog when selecting Keeper format

* [PM-33198] adding opaque types for type safety

* [PM-33198] implement constant time checks to prevent timing attacks

* Address Keeper direct importer review feedback

- Move keeper from the pinned top of featuredImportOptions to its
  alphabetical position after KeePass 2 (featured list renders in array order)
- Reword the import-keeper component comment from a review note into
  production documentation
- Drop the now-resolved README note about the temporary pinning

* Abort Keeper import when a push socket message can't be processed

A push frame that failed to decrypt or parse was silently swallowed, so the
consumer racing on waitForMessage never resolved and the import hung with no
trace. Fail the socket instead: reject the waiting consumer, which unwinds the
login and surfaces a connection error to the user. The error carries only
structural metadata (stage, byte count, error name), never frame contents.

* Restart Keeper login when the login token expires during device approval

* Merge bitwarden:main

* Revert "Merge bitwarden:main"

This reverts commit b9c1f2df96.

* Map Keeper Direct import identity records to correct item types

driverLicense, ssnCard and passport now import as Identity and invalid SSH keys fall back to a secure note, matching the Keeper JSON importer.

---------

Co-authored-by: Alex Dragovich <adragovich@bitwarden.com>
Co-authored-by: Alex Dragovich <46065570+itsadrago@users.noreply.github.com>
2026-07-09 06:14:15 -07:00
..
admin-console [PM-36407] Ts strict bulk member components (#21455) 2026-06-29 11:04:16 -04:00
auth/commands fix(sso-callback-server-host) [Auth/PM-32604] Specify argument in listen method (#19766) 2026-04-03 10:56:08 -07:00
commands fix(cli): harden bw serve origin-protection against DNS rebinding [PM-36600] (#20881) 2026-06-09 17:14:17 -04:00
key-management [PM-39259] Migrate key-management key-generation to SDK (#21707) 2026-07-09 17:25:06 +09:00
locales/en [PM-31731] [Defect] No error is returned when entering an invalid email + an invalid verification code (#18913) 2026-02-18 14:08:57 -08:00
models [PM-33526] honor hidden password permission in bw list items and bw get item (#19537) 2026-04-14 10:41:20 -04:00
platform [deps] Vault: Update https-proxy-agent to v9 (#20124) 2026-05-21 18:44:22 -04:00
service-container [PM-39259] Migrate key-management key-generation to SDK (#21707) 2026-07-09 17:25:06 +09:00
tools [PM-33198] Keeper direct importer (#19395) 2026-07-09 06:14:15 -07:00
vault [PM-34114] Add Passport item type to the CLI (#20621) 2026-05-18 10:46:13 -05:00
base-program.ts [PM-39259] Migrate key-management key-generation to SDK (#21707) 2026-07-09 17:25:06 +09:00
bw.ts Improve SDK direct function usage (#13353) 2025-02-26 09:08:42 +01:00
oss-serve-configurator.ts [PM-39259] Migrate key-management key-generation to SDK (#21707) 2026-07-09 17:25:06 +09:00
program.ts [PM-39259] Migrate key-management key-generation to SDK (#21707) 2026-07-09 17:25:06 +09:00
register-oss-programs.ts [PM-30922] Client changes to encrypt send access email list (#18486) 2026-01-28 14:31:48 -07:00
serve.program.ts [BEEEP: PM-10190] Use strict TS checks in CLI service container (#10298) 2024-08-05 11:39:08 -04:00
utils.spec.ts Fix boolean parsing when using serve command (#20302) 2026-05-01 14:13:34 -07:00
utils.ts Fix boolean parsing when using serve command (#20302) 2026-05-01 14:13:34 -07:00
vault.program.ts check for collection access before move (#21010) 2026-06-10 08:36:23 -05:00