[PM- 22675] Send password auth method (#6228)

* feat: add Passwordvalidation
* fix: update strings to constants
* fix: add customResponse for rust consumption
* test: add tests for SendPasswordValidator. fix: update tests for SendAccessGrantValidator
* feat: update send access constants.

Author: ike-kottlowski

src/Core/AssemblyInfo.cs

@@ -1,3 +1,4 @@
 using System.Runtime.CompilerServices;
 
 [assembly: InternalsVisibleTo("Core.Test")]
+[assembly: InternalsVisibleTo("Identity.IntegrationTest")]

src/Identity/IdentityServer/RequestValidators/SendAccess/Enums/SendGrantValidatorResultTypes.cs

@@ -0,0 +1,73 @@
+using Duende.IdentityServer.Validation;
+
+namespace Bit.Identity.IdentityServer.RequestValidators.SendAccess;
+
+/// <summary>
+/// String constants for the Send Access user feature
+/// </summary>
+public static class SendAccessConstants
+{
+    /// <summary>
+    /// A catch all error type for send access related errors. Used mainly in the <see cref="GrantValidationResult.CustomResponse"/>
+    /// </summary>
+    public const string SendAccessError = "send_access_error_type";
+    public static class TokenRequest
+    {
+        /// <summary>
+        /// used to fetch Send from database.
+        /// </summary>
+        public const string SendId = "send_id";
+        /// <summary>
+        /// used to validate Send protected passwords
+        /// </summary>
+        public const string ClientB64HashedPassword = "password_hash_b64";
+        /// <summary>
+        /// email used to see if email is associated with the Send
+        /// </summary>
+        public const string Email = "email";
+        /// <summary>
+        /// Otp code sent to email associated with the Send
+        /// </summary>
+        public const string Otp = "otp";
+    }
+
+    public static class GrantValidatorResults
+    {
+        /// <summary>
+        /// The sendId is valid and the request is well formed.
+        /// </summary>
+        public const string ValidSendGuid = "valid_send_guid";
+        /// <summary>
+        /// The sendId is missing from the request.
+        /// </summary>
+        public const string MissingSendId = "send_id_required";
+        /// <summary>
+        /// The sendId is invalid, does not match a known send.
+        /// </summary>
+        public const string InvalidSendId = "send_id_invalid";
+    }
+
+    public static class PasswordValidatorResults
+    {
+        /// <summary>
+        /// The passwordHashB64 does not match the send's password hash.
+        /// </summary>
+        public const string RequestPasswordDoesNotMatch = "password_hash_b64_invalid";
+        /// <summary>
+        /// The passwordHashB64 is missing from the request.
+        /// </summary>
+        public const string RequestPasswordIsRequired = "password_hash_b64_required";
+    }
+
+    public static class EmailOtpValidatorResults
+    {
+        /// <summary>
+        /// Represents the error code indicating that an email address is required.
+        /// </summary>
+        public const string EmailRequired = "email_required";
+        /// <summary>
+        /// Represents the status indicating that both email and OTP are required, and the OTP has been sent.
+        /// </summary>
+        public const string EmailOtpSent = "email_and_otp_required_otp_sent";
+    }
+}

src/Identity/IdentityServer/RequestValidators/SendAccess/Enums/SendPasswordValidatorResultTypes.cs

@@ -6,7 +6,6 @@
 using Bit.Core.Tools.SendFeatures.Queries.Interfaces;
 using Bit.Core.Utilities;
 using Bit.Identity.IdentityServer.Enums;
-using Bit.Identity.IdentityServer.RequestValidators.SendAccess.Enums;
 using Duende.IdentityServer.Models;
 using Duende.IdentityServer.Validation;
 
@@ -20,11 +19,11 @@ public class SendAccessGrantValidator(
 {
     string IExtensionGrantValidator.GrantType => CustomGrantTypes.SendAccess;
 
-    private static readonly Dictionary<SendGrantValidatorResultTypes, string>
-    _sendGrantValidatorErrors = new()
+    private static readonly Dictionary<string, string>
+    _sendGrantValidatorErrorDescriptions = new()
     {
-        { SendGrantValidatorResultTypes.MissingSendId, "send_id is required." },
-        { SendGrantValidatorResultTypes.InvalidSendId, "send_id is invalid." }
+        { SendAccessConstants.GrantValidatorResults.MissingSendId, $"{SendAccessConstants.TokenRequest.SendId} is required." },
+        { SendAccessConstants.GrantValidatorResults.InvalidSendId, $"{SendAccessConstants.TokenRequest.SendId} is invalid." }
     };
 
 
@@ -38,7 +37,7 @@ public async Task ValidateAsync(ExtensionGrantValidationContext context)
         }
 
         var (sendIdGuid, result) = GetRequestSendId(context);
-        if (result != SendGrantValidatorResultTypes.ValidSendGuid)
+        if (result != SendAccessConstants.GrantValidatorResults.ValidSendGuid)
         {
             context.Result = BuildErrorResult(result);
             return;
@@ -55,7 +54,7 @@ public async Task ValidateAsync(ExtensionGrantValidationContext context)
                 // We should only map to password or email + OTP protected.
                 // If user submits password guess for a falsely protected send, then we will return invalid password.
                 // If user submits email + OTP guess for a falsely protected send, then we will return email sent, do not actually send an email.
-                context.Result = BuildErrorResult(SendGrantValidatorResultTypes.InvalidSendId);
+                context.Result = BuildErrorResult(SendAccessConstants.GrantValidatorResults.InvalidSendId);
                 return;
 
             case NotAuthenticated:
@@ -64,7 +63,7 @@ public async Task ValidateAsync(ExtensionGrantValidationContext context)
                 return;
 
             case ResourcePassword rp:
-                // TODO PM-22675: Validate if the password is correct.
+                // Validate if the password is correct, or if we need to respond with a 400 stating a password has is required
                 context.Result = _sendPasswordRequestValidator.ValidateSendPassword(context, rp, sendIdGuid);
                 return;
             case EmailOtp eo:
@@ -84,15 +83,15 @@ public async Task ValidateAsync(ExtensionGrantValidationContext context)
     /// </summary>
     /// <param name="context">request context</param>
     /// <returns>a parsed sendId Guid and success result or a Guid.Empty and error type otherwise</returns>
-    private static (Guid, SendGrantValidatorResultTypes) GetRequestSendId(ExtensionGrantValidationContext context)
+    private static (Guid, string) GetRequestSendId(ExtensionGrantValidationContext context)
     {
         var request = context.Request.Raw;
-        var sendId = request.Get("send_id");
+        var sendId = request.Get(SendAccessConstants.TokenRequest.SendId);
 
         // if the sendId is null then the request is the wrong shape and the request is invalid
         if (sendId == null)
         {
-            return (Guid.Empty, SendGrantValidatorResultTypes.MissingSendId);
+            return (Guid.Empty, SendAccessConstants.GrantValidatorResults.MissingSendId);
         }
         // the send_id is not null so the request is the correct shape, so we will attempt to parse it
         try
@@ -102,13 +101,13 @@ private static (Guid, SendGrantValidatorResultTypes) GetRequestSendId(ExtensionG
             // Guid.Empty indicates an invalid send_id return invalid grant
             if (sendGuid == Guid.Empty)
             {
-                return (Guid.Empty, SendGrantValidatorResultTypes.InvalidSendId);
+                return (Guid.Empty, SendAccessConstants.GrantValidatorResults.InvalidSendId);
             }
-            return (sendGuid, SendGrantValidatorResultTypes.ValidSendGuid);
+            return (sendGuid, SendAccessConstants.GrantValidatorResults.ValidSendGuid);
         }
         catch
         {
-            return (Guid.Empty, SendGrantValidatorResultTypes.InvalidSendId);
+            return (Guid.Empty, SendAccessConstants.GrantValidatorResults.InvalidSendId);
         }
     }
 
@@ -117,18 +116,26 @@ private static (Guid, SendGrantValidatorResultTypes) GetRequestSendId(ExtensionG
     /// </summary>
     /// <param name="error">The error type.</param>
     /// <returns>The error result.</returns>
-    private static GrantValidationResult BuildErrorResult(SendGrantValidatorResultTypes error)
+    private static GrantValidationResult BuildErrorResult(string error)
     {
         return error switch
         {
             // Request is the wrong shape
-            SendGrantValidatorResultTypes.MissingSendId => new GrantValidationResult(
+            SendAccessConstants.GrantValidatorResults.MissingSendId => new GrantValidationResult(
                                 TokenRequestErrors.InvalidRequest,
-                                errorDescription: _sendGrantValidatorErrors[SendGrantValidatorResultTypes.MissingSendId]),
+                                errorDescription: _sendGrantValidatorErrorDescriptions[SendAccessConstants.GrantValidatorResults.MissingSendId],
+                                new Dictionary<string, object>
+                                {
+                                    { SendAccessConstants.SendAccessError, SendAccessConstants.GrantValidatorResults.MissingSendId}
+                                }),
             // Request is correct shape but data is bad
-            SendGrantValidatorResultTypes.InvalidSendId => new GrantValidationResult(
+            SendAccessConstants.GrantValidatorResults.InvalidSendId => new GrantValidationResult(
                                 TokenRequestErrors.InvalidGrant,
-                                errorDescription: _sendGrantValidatorErrors[SendGrantValidatorResultTypes.InvalidSendId]),
+                                errorDescription: _sendGrantValidatorErrorDescriptions[SendAccessConstants.GrantValidatorResults.InvalidSendId],
+                                new Dictionary<string, object>
+                                {
+                                    { SendAccessConstants.SendAccessError, SendAccessConstants.GrantValidatorResults.InvalidSendId }
+                                }),
             // should never get here
             _ => new GrantValidationResult(TokenRequestErrors.InvalidRequest)
         };

src/Identity/IdentityServer/RequestValidators/SendAccess/SendAccessConstants.cs

@@ -3,7 +3,6 @@
 using Bit.Core.KeyManagement.Sends;
 using Bit.Core.Tools.Models.Data;
 using Bit.Identity.IdentityServer.Enums;
-using Bit.Identity.IdentityServer.RequestValidators.SendAccess.Enums;
 using Duende.IdentityServer.Models;
 using Duende.IdentityServer.Validation;
 
@@ -16,31 +15,44 @@ public class SendPasswordRequestValidator(ISendPasswordHasher sendPasswordHasher
     /// <summary>
     /// static object that contains the error messages for the SendPasswordRequestValidator.
     /// </summary>
-    private static Dictionary<SendPasswordValidatorResultTypes, string> _sendPasswordValidatorErrors = new()
+    private static readonly Dictionary<string, string> _sendPasswordValidatorErrorDescriptions = new()
     {
-        { SendPasswordValidatorResultTypes.RequestPasswordDoesNotMatch, "Request Password hash is invalid." }
+        { SendAccessConstants.PasswordValidatorResults.RequestPasswordDoesNotMatch, $"{SendAccessConstants.TokenRequest.ClientB64HashedPassword} is invalid." },
+        { SendAccessConstants.PasswordValidatorResults.RequestPasswordIsRequired, $"{SendAccessConstants.TokenRequest.ClientB64HashedPassword} is required." }
     };
 
     public GrantValidationResult ValidateSendPassword(ExtensionGrantValidationContext context, ResourcePassword resourcePassword, Guid sendId)
     {
         var request = context.Request.Raw;
-        var clientHashedPassword = request.Get("password_hash");
+        var clientHashedPassword = request.Get(SendAccessConstants.TokenRequest.ClientB64HashedPassword);
 
-        if (string.IsNullOrEmpty(clientHashedPassword))
+        // It is an invalid request _only_ if the passwordHashB64 is missing which indicated bad shape.
+        if (clientHashedPassword == null)
         {
+            // Request is the wrong shape and doesn't contain a passwordHashB64 field.
             return new GrantValidationResult(
                 TokenRequestErrors.InvalidRequest,
-                errorDescription: _sendPasswordValidatorErrors[SendPasswordValidatorResultTypes.RequestPasswordDoesNotMatch]);
+                errorDescription: _sendPasswordValidatorErrorDescriptions[SendAccessConstants.PasswordValidatorResults.RequestPasswordIsRequired],
+                new Dictionary<string, object>
+                {
+                    { SendAccessConstants.SendAccessError, SendAccessConstants.PasswordValidatorResults.RequestPasswordIsRequired }
+                });
         }
 
+        // _sendPasswordHasher.PasswordHashMatches checks for an empty string so no need to do it before we make the call.
         var hashMatches = _sendPasswordHasher.PasswordHashMatches(
             resourcePassword.Hash, clientHashedPassword);
 
         if (!hashMatches)
         {
+            // Request is the correct shape but the passwordHashB64 doesn't match, hash could be empty.
             return new GrantValidationResult(
                 TokenRequestErrors.InvalidGrant,
-                errorDescription: _sendPasswordValidatorErrors[SendPasswordValidatorResultTypes.RequestPasswordDoesNotMatch]);
+                errorDescription: _sendPasswordValidatorErrorDescriptions[SendAccessConstants.PasswordValidatorResults.RequestPasswordDoesNotMatch],
+                new Dictionary<string, object>
+                {
+                    { SendAccessConstants.SendAccessError, SendAccessConstants.PasswordValidatorResults.RequestPasswordDoesNotMatch }
+                });
         }
 
         return BuildSendPasswordSuccessResult(sendId);

src/Identity/IdentityServer/RequestValidators/SendAccess/SendAccessGrantValidator.cs

@@ -8,6 +8,7 @@
 using Bit.Identity.IdentityServer.Enums;
 using Bit.Identity.IdentityServer.RequestValidators.SendAccess;
 using Bit.IntegrationTestCommon.Factories;
+using Duende.IdentityModel;
 using Duende.IdentityServer.Validation;
 using NSubstitute;
 using Xunit;
@@ -96,17 +97,17 @@ public async Task SendAccessGrant_MissingSendId_ReturnsInvalidRequest()
         }).CreateClient();
 
         var requestBody = new FormUrlEncodedContent([
-            new KeyValuePair<string, string>("grant_type", CustomGrantTypes.SendAccess),
-            new KeyValuePair<string, string>("client_id", BitwardenClient.Send)
+            new KeyValuePair<string, string>(OidcConstants.TokenRequest.GrantType, CustomGrantTypes.SendAccess),
+            new KeyValuePair<string, string>(OidcConstants.TokenRequest.ClientId, BitwardenClient.Send)
         ]);
 
         // Act
         var response = await client.PostAsync("/connect/token", requestBody);
 
         // Assert
         var content = await response.Content.ReadAsStringAsync();
-        Assert.Contains("invalid_request", content);
-        Assert.Contains("send_id is required", content);
+        Assert.Contains(OidcConstants.TokenErrors.InvalidRequest, content);
+        Assert.Contains($"{SendAccessConstants.TokenRequest.SendId} is required", content);
     }
 
     [Fact]
@@ -245,16 +246,16 @@ private static FormUrlEncodedContent CreateTokenRequestBody(
         var sendIdBase64 = CoreHelpers.Base64UrlEncode(sendId.ToByteArray());
         var parameters = new List<KeyValuePair<string, string>>
         {
-            new("grant_type", CustomGrantTypes.SendAccess),
-            new("client_id", BitwardenClient.Send ),
-            new("scope", ApiScopes.ApiSendAccess),
+            new(OidcConstants.TokenRequest.GrantType, CustomGrantTypes.SendAccess),
+            new(OidcConstants.TokenRequest.ClientId, BitwardenClient.Send ),
+            new(OidcConstants.TokenRequest.Scope, ApiScopes.ApiSendAccess),
             new("deviceType", ((int)DeviceType.FirefoxBrowser).ToString()),
-            new("send_id", sendIdBase64)
+            new(SendAccessConstants.TokenRequest.SendId, sendIdBase64)
         };
 
         if (!string.IsNullOrEmpty(password))
         {
-            parameters.Add(new("password_hash", password));
+            parameters.Add(new(SendAccessConstants.TokenRequest.ClientB64HashedPassword, password));
         }
 
         if (!string.IsNullOrEmpty(emailOtp) && !string.IsNullOrEmpty(sendEmail))