@bitwarden/cli 2023.9.0 → 2023.9.1

package/build/bw.js

@@ -20,7 +20,7 @@ module.exports = require("url");
 /***/ 147:
 /***/ ((module) => {
 
-module.exports = JSON.parse('{"name":"@bitwarden/cli","description":"A secure and free password manager for all of your devices.","version":"2023.9.0","keywords":["bitwarden","password","vault","password manager","cli"],"author":"Bitwarden Inc. <hello@bitwarden.com> (https://bitwarden.com)","homepage":"https://bitwarden.com","repository":{"type":"git","url":"https://github.com/bitwarden/clients"},"license":"GPL-3.0-only","scripts":{"clean":"rimraf dist","build":"webpack","build:debug":"npm run build && node --inspect ./build/bw.js","build:watch":"webpack --watch","build:prod":"cross-env NODE_ENV=production webpack","build:prod:watch":"cross-env NODE_ENV=production webpack --watch","package":"npm run package:win && npm run package:mac && npm run package:lin","package:win":"pkg . --targets win-x64 --output ./dist/windows/bw.exe","package:mac":"pkg . --targets macos-x64 --output ./dist/macos/bw","package:lin":"pkg . --targets linux-x64 --output ./dist/linux/bw","debug":"node --inspect ./build/bw.js","dist":"npm run build:prod && npm run clean && npm run package","dist:win":"npm run build:prod && npm run clean && npm run package:win","dist:mac":"npm run build:prod && npm run clean && npm run package:mac","dist:lin":"npm run build:prod && npm run clean && npm run package:lin","publish:npm":"npm run build:prod && npm publish --access public","test":"jest","test:watch":"jest --watch","test:watch:all":"jest --watchAll"},"bin":{"bw":"build/bw.js"},"pkg":{"assets":["./build/**/*","../../node_modules/argon2/**/*"]},"dependencies":{"@koa/multer":"3.0.2","@koa/router":"12.0.0","argon2":"0.31.0","big-integer":"1.6.51","browser-hrtime":"1.1.8","chalk":"4.1.2","commander":"7.2.0","form-data":"4.0.0","https-proxy-agent":"5.0.1","inquirer":"8.2.6","jsdom":"22.1.0","jszip":"3.10.1","koa":"2.14.2","koa-bodyparser":"4.4.1","koa-json":"2.0.2","lowdb":"1.0.0","lunr":"2.3.9","multer":"1.4.5-lts.1","node-fetch":"2.6.12","node-forge":"1.3.1","open":"8.4.2","papaparse":"5.4.1","proper-lockfile":"4.1.2","rxjs":"7.8.1","tldts":"6.0.14","zxcvbn":"4.4.2"}}');
+module.exports = JSON.parse('{"name":"@bitwarden/cli","description":"A secure and free password manager for all of your devices.","version":"2023.9.1","keywords":["bitwarden","password","vault","password manager","cli"],"author":"Bitwarden Inc. <hello@bitwarden.com> (https://bitwarden.com)","homepage":"https://bitwarden.com","repository":{"type":"git","url":"https://github.com/bitwarden/clients"},"license":"GPL-3.0-only","scripts":{"clean":"rimraf dist","build":"webpack","build:debug":"npm run build && node --inspect ./build/bw.js","build:watch":"webpack --watch","build:prod":"cross-env NODE_ENV=production webpack","build:prod:watch":"cross-env NODE_ENV=production webpack --watch","package":"npm run package:win && npm run package:mac && npm run package:lin","package:win":"pkg . --targets win-x64 --output ./dist/windows/bw.exe","package:mac":"pkg . --targets macos-x64 --output ./dist/macos/bw","package:lin":"pkg . --targets linux-x64 --output ./dist/linux/bw","debug":"node --inspect ./build/bw.js","dist":"npm run build:prod && npm run clean && npm run package","dist:win":"npm run build:prod && npm run clean && npm run package:win","dist:mac":"npm run build:prod && npm run clean && npm run package:mac","dist:lin":"npm run build:prod && npm run clean && npm run package:lin","publish:npm":"npm run build:prod && npm publish --access public","test":"jest","test:watch":"jest --watch","test:watch:all":"jest --watchAll"},"bin":{"bw":"build/bw.js"},"pkg":{"assets":["./build/**/*","../../node_modules/argon2/**/*"]},"dependencies":{"@koa/multer":"3.0.2","@koa/router":"12.0.0","argon2":"0.31.0","big-integer":"1.6.51","browser-hrtime":"1.1.8","chalk":"4.1.2","commander":"7.2.0","form-data":"4.0.0","https-proxy-agent":"5.0.1","inquirer":"8.2.6","jsdom":"22.1.0","jszip":"3.10.1","koa":"2.14.2","koa-bodyparser":"4.4.1","koa-json":"2.0.2","lowdb":"1.0.0","lunr":"2.3.9","multer":"1.4.5-lts.1","node-fetch":"2.6.12","node-forge":"1.3.1","open":"8.4.2","papaparse":"5.4.1","proper-lockfile":"4.1.2","rxjs":"7.8.1","tldts":"6.0.14","zxcvbn":"4.4.2"}}');
 
 /***/ })
 
@@ -6090,6 +6090,73 @@ class BroadcasterService {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/platform/models/response/server-config.response.ts
+
+class ServerConfigResponse extends BaseResponse {
+    constructor(response) {
+        super(response);
+        this.featureStates = {};
+        if (response == null) {
+            return;
+        }
+        this.version = this.getResponseProperty("Version");
+        this.gitHash = this.getResponseProperty("GitHash");
+        this.server = new ThirdPartyServerConfigResponse(this.getResponseProperty("Server"));
+        this.environment = new EnvironmentServerConfigResponse(this.getResponseProperty("Environment"));
+        this.featureStates = this.getResponseProperty("FeatureStates");
+    }
+}
+class EnvironmentServerConfigResponse extends BaseResponse {
+    constructor(data = null) {
+        super(data);
+        if (data == null) {
+            return;
+        }
+        this.cloudRegion = this.getResponseProperty("CloudRegion");
+        this.vault = this.getResponseProperty("Vault");
+        this.api = this.getResponseProperty("Api");
+        this.identity = this.getResponseProperty("Identity");
+        this.notifications = this.getResponseProperty("Notifications");
+        this.sso = this.getResponseProperty("Sso");
+    }
+}
+class ThirdPartyServerConfigResponse extends BaseResponse {
+    constructor(data = null) {
+        super(data);
+        if (data == null) {
+            return;
+        }
+        this.name = this.getResponseProperty("Name");
+        this.url = this.getResponseProperty("Url");
+    }
+}
+
+;// CONCATENATED MODULE: ../../libs/common/src/platform/services/config/config-api.service.ts
+var config_api_service_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+class ConfigApiService {
+    constructor(apiService, authService) {
+        this.apiService = apiService;
+        this.authService = authService;
+    }
+    get() {
+        return config_api_service_awaiter(this, void 0, void 0, function* () {
+            const authed = (yield this.authService.getAuthStatus()) !== AuthenticationStatus.LoggedOut;
+            const r = yield this.apiService.send("GET", "/config", null, authed, true);
+            return new ServerConfigResponse(r);
+        });
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/platform/services/container.service.ts
 class ContainerService {
     constructor(cryptoService, encryptService) {
@@ -14545,6 +14612,12 @@ class CryptoService {
             return new SymmetricCryptoKey(sendKey);
         });
     }
+    makeCipherKey() {
+        return crypto_service_awaiter(this, void 0, void 0, function* () {
+            const randomBytes = yield this.cryptoFunctionService.aesGenerateKey(512);
+            return new SymmetricCryptoKey(randomBytes);
+        });
+    }
     clearKeys(userId) {
         return crypto_service_awaiter(this, void 0, void 0, function* () {
             yield this.clearUserKey(true, userId);
@@ -17355,6 +17428,7 @@ class CipherData {
         this.creationDate = response.creationDate;
         this.deletedDate = response.deletedDate;
         this.reprompt = response.reprompt;
+        this.key = response.key;
         switch (this.type) {
             case CipherType.Login:
                 this.login = new LoginData(response.login);
@@ -23100,6 +23174,57 @@ class SendService {
     }
 }
 
+;// CONCATENATED MODULE: external "semver"
+const external_semver_namespaceObject = require("semver");
+;// CONCATENATED MODULE: ../../libs/common/src/platform/misc/flags.ts
+function getFlags(envFlags) {
+    if (typeof envFlags === "string") {
+        return JSON.parse(envFlags);
+    }
+    else {
+        return envFlags;
+    }
+}
+/**
+ * Gets the value of a feature flag from environment.
+ * All flags default to "on" (true).
+ * Only use for shared code in `libs`, otherwise use the client-specific function.
+ * @param flag The name of the feature flag to check
+ * @returns The value of the flag
+ */
+function flagEnabled(flag) {
+    const flags = getFlags({"enableCipherKeyEncryption":false});
+    return flags[flag] == null || !!flags[flag];
+}
+/**
+ * Gets the value of a dev flag from environment.
+ * Will always return false unless in development.
+ * Only use for shared code in `libs`, otherwise use the client-specific function.
+ * @param flag The name of the dev flag to check
+ * @returns The value of the flag
+ */
+function devFlagEnabled(flag) {
+    if (process.env.ENV !== "development") {
+        return false;
+    }
+    const devFlags = getFlags(process.env.DEV_FLAGS);
+    return devFlags[flag] == null || !!devFlags[flag];
+}
+/**
+ * Gets the value of a dev flag from environment.
+ * Will always return false unless in development.
+ * @param flag The name of the dev flag to check
+ * @returns The value of the flag
+ * @throws Error if the flag is not enabled
+ */
+function devFlagValue(flag) {
+    if (!devFlagEnabled(flag)) {
+        throw new Error(`This method should not be called, it is protected by a disabled dev flag.`);
+    }
+    const devFlags = getFlags(process.env.DEV_FLAGS);
+    return devFlags[flag];
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/domain/attachment.ts
 var attachment_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -23647,6 +23772,8 @@ var cipher_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _a
 
 
 
+
+
 class Cipher extends Domain {
     constructor(obj, localData = null) {
         super();
@@ -23660,6 +23787,7 @@ class Cipher extends Domain {
             folderId: null,
             name: null,
             notes: null,
+            key: null,
         }, ["id", "organizationId", "folderId"]);
         this.type = obj.type;
         this.favorite = obj.favorite;
@@ -23712,9 +23840,16 @@ class Cipher extends Domain {
             this.passwordHistory = null;
         }
     }
+    // We are passing the organizationId into the EncString.decrypt() method here, but because the encKey will always be
+    // present and so the organizationId will not be used.
+    // We will refactor the EncString.decrypt() in https://bitwarden.atlassian.net/browse/PM-3762 to remove the dependency on the organizationId.
     decrypt(encKey) {
         return cipher_awaiter(this, void 0, void 0, function* () {
             const model = new CipherView(this);
+            if (this.key != null) {
+                const encryptService = utils_Utils.getContainerService().getEncryptService();
+                encKey = new SymmetricCryptoKey(yield encryptService.decryptToBytes(this.key, encKey));
+            }
             yield this.decryptObj(model, {
                 name: null,
                 notes: null,
@@ -23735,13 +23870,12 @@ class Cipher extends Domain {
                 default:
                     break;
             }
-            const orgId = this.organizationId;
             if (this.attachments != null && this.attachments.length > 0) {
                 const attachments = [];
                 yield this.attachments.reduce((promise, attachment) => {
                     return promise
                         .then(() => {
-                        return attachment.decrypt(orgId, encKey);
+                        return attachment.decrypt(this.organizationId, encKey);
                     })
                         .then((decAttachment) => {
                         attachments.push(decAttachment);
@@ -23754,7 +23888,7 @@ class Cipher extends Domain {
                 yield this.fields.reduce((promise, field) => {
                     return promise
                         .then(() => {
-                        return field.decrypt(orgId, encKey);
+                        return field.decrypt(this.organizationId, encKey);
                     })
                         .then((decField) => {
                         fields.push(decField);
@@ -23767,7 +23901,7 @@ class Cipher extends Domain {
                 yield this.passwordHistory.reduce((promise, ph) => {
                     return promise
                         .then(() => {
-                        return ph.decrypt(orgId, encKey);
+                        return ph.decrypt(this.organizationId, encKey);
                     })
                         .then((decPh) => {
                         passwordHistory.push(decPh);
@@ -23779,6 +23913,7 @@ class Cipher extends Domain {
         });
     }
     toCipherData() {
+        var _a;
         const c = new CipherData();
         c.id = this.id;
         c.organizationId = this.organizationId;
@@ -23793,6 +23928,7 @@ class Cipher extends Domain {
         c.creationDate = this.creationDate != null ? this.creationDate.toISOString() : null;
         c.deletedDate = this.deletedDate != null ? this.deletedDate.toISOString() : null;
         c.reprompt = this.reprompt;
+        c.key = (_a = this.key) === null || _a === void 0 ? void 0 : _a.encryptedString;
         this.buildDataModel(this, c, {
             name: null,
             notes: null,
@@ -23837,6 +23973,7 @@ class Cipher extends Domain {
         const attachments = (_a = obj.attachments) === null || _a === void 0 ? void 0 : _a.map((a) => Attachment.fromJSON(a));
         const fields = (_b = obj.fields) === null || _b === void 0 ? void 0 : _b.map((f) => Field.fromJSON(f));
         const passwordHistory = (_c = obj.passwordHistory) === null || _c === void 0 ? void 0 : _c.map((ph) => Password.fromJSON(ph));
+        const key = EncString.fromJSON(obj.key);
         Object.assign(domain, obj, {
             name,
             notes,
@@ -23845,6 +23982,7 @@ class Cipher extends Domain {
             attachments,
             fields,
             passwordHistory,
+            key,
         });
         switch (obj.type) {
             case CipherType.Card:
@@ -24083,6 +24221,7 @@ class AttachmentRequest {
 
 class CipherRequest {
     constructor(cipher) {
+        var _a;
         this.type = cipher.type;
         this.folderId = cipher.folderId;
         this.organizationId = cipher.organizationId;
@@ -24091,6 +24230,7 @@ class CipherRequest {
         this.favorite = cipher.favorite;
         this.lastKnownRevisionDate = cipher.revisionDate;
         this.reprompt = cipher.reprompt;
+        this.key = (_a = cipher.key) === null || _a === void 0 ? void 0 : _a.encryptedString;
         switch (this.type) {
             case CipherType.Login:
                 this.login = new LoginApi();
@@ -24311,8 +24451,13 @@ var cipher_service_awaiter = (undefined && undefined.__awaiter) || function (thi
 
 
 
+
+
+
+
+const CIPHER_KEY_ENC_MIN_SERVER_VER = new external_semver_namespaceObject.SemVer("2023.9.1");
 class CipherService {
-    constructor(cryptoService, settingsService, apiService, i18nService, searchService, stateService, encryptService, cipherFileUploadService) {
+    constructor(cryptoService, settingsService, apiService, i18nService, searchService, stateService, encryptService, cipherFileUploadService, configService) {
         this.cryptoService = cryptoService;
         this.settingsService = settingsService;
         this.apiService = apiService;
@@ -24321,6 +24466,7 @@ class CipherService {
         this.stateService = stateService;
         this.encryptService = encryptService;
         this.cipherFileUploadService = cipherFileUploadService;
+        this.configService = configService;
         this.sortedCiphersCache = new SortedCiphersCache(this.sortCiphersByLastUsed);
     }
     getDecryptedCipherCache() {
@@ -24347,56 +24493,17 @@ class CipherService {
             yield this.clearDecryptedCiphersState(userId);
         });
     }
-    encrypt(model, key, originalCipher = null) {
+    encrypt(model, keyForEncryption, keyForCipherKeyDecryption, originalCipher = null) {
+        var _a;
         return cipher_service_awaiter(this, void 0, void 0, function* () {
-            // Adjust password history
             if (model.id != null) {
                 if (originalCipher == null) {
                     originalCipher = yield this.get(model.id);
                 }
                 if (originalCipher != null) {
-                    const existingCipher = yield originalCipher.decrypt();
-                    model.passwordHistory = existingCipher.passwordHistory || [];
-                    if (model.type === CipherType.Login && existingCipher.type === CipherType.Login) {
-                        if (existingCipher.login.password != null &&
-                            existingCipher.login.password !== "" &&
-                            existingCipher.login.password !== model.login.password) {
-                            const ph = new PasswordHistoryView();
-                            ph.password = existingCipher.login.password;
-                            ph.lastUsedDate = model.login.passwordRevisionDate = new Date();
-                            model.passwordHistory.splice(0, 0, ph);
-                        }
-                        else {
-                            model.login.passwordRevisionDate = existingCipher.login.passwordRevisionDate;
-                        }
-                    }
-                    if (existingCipher.hasFields) {
-                        const existingHiddenFields = existingCipher.fields.filter((f) => f.type === FieldType.Hidden &&
-                            f.name != null &&
-                            f.name !== "" &&
-                            f.value != null &&
-                            f.value !== "");
-                        const hiddenFields = model.fields == null
-                            ? []
-                            : model.fields.filter((f) => f.type === FieldType.Hidden && f.name != null && f.name !== "");
-                        existingHiddenFields.forEach((ef) => {
-                            const matchedField = hiddenFields.find((f) => f.name === ef.name);
-                            if (matchedField == null || matchedField.value !== ef.value) {
-                                const ph = new PasswordHistoryView();
-                                ph.password = ef.name + ": " + ef.value;
-                                ph.lastUsedDate = new Date();
-                                model.passwordHistory.splice(0, 0, ph);
-                            }
-                        });
-                    }
-                }
-                if (model.passwordHistory != null && model.passwordHistory.length === 0) {
-                    model.passwordHistory = null;
-                }
-                else if (model.passwordHistory != null && model.passwordHistory.length > 5) {
-                    // only save last 5 history
-                    model.passwordHistory = model.passwordHistory.slice(0, 5);
+                    yield this.updateModelfromExistingCipher(model, originalCipher);
                 }
+                this.adjustPasswordHistoryLength(model);
             }
             const cipher = new Cipher();
             cipher.id = model.id;
@@ -24408,29 +24515,28 @@ class CipherService {
             cipher.revisionDate = model.revisionDate;
             cipher.reprompt = model.reprompt;
             cipher.edit = model.edit;
-            if (key == null && cipher.organizationId != null) {
-                key = yield this.cryptoService.getOrgKey(cipher.organizationId);
-                if (key == null) {
-                    throw new Error("Cannot encrypt cipher for organization. No key.");
+            if (yield this.getCipherKeyEncryptionEnabled()) {
+                cipher.key = (_a = originalCipher === null || originalCipher === void 0 ? void 0 : originalCipher.key) !== null && _a !== void 0 ? _a : null;
+                const userOrOrgKey = yield this.getKeyForCipherKeyDecryption(cipher);
+                // The keyForEncryption is only used for encrypting the cipher key, not the cipher itself, since cipher key encryption is enabled.
+                // If the caller has provided a key for cipher key encryption, use it. Otherwise, use the user or org key.
+                keyForEncryption || (keyForEncryption = userOrOrgKey);
+                // If the caller has provided a key for cipher key decryption, use it. Otherwise, use the user or org key.
+                keyForCipherKeyDecryption || (keyForCipherKeyDecryption = userOrOrgKey);
+                return this.encryptCipherWithCipherKey(model, cipher, keyForEncryption, keyForCipherKeyDecryption);
+            }
+            else {
+                if (keyForEncryption == null && cipher.organizationId != null) {
+                    keyForEncryption = yield this.cryptoService.getOrgKey(cipher.organizationId);
+                    if (keyForEncryption == null) {
+                        throw new Error("Cannot encrypt cipher for organization. No key.");
+                    }
                 }
+                // We want to ensure that the cipher key is null if cipher key encryption is disabled
+                // so that decryption uses the proper key.
+                cipher.key = null;
+                return this.encryptCipher(model, cipher, keyForEncryption);
             }
-            yield Promise.all([
-                this.encryptObjProperty(model, cipher, {
-                    name: null,
-                    notes: null,
-                }, key),
-                this.encryptCipherData(cipher, model, key),
-                this.encryptFields(model.fields, key).then((fields) => {
-                    cipher.fields = fields;
-                }),
-                this.encryptPasswordHistories(model.passwordHistory, key).then((ph) => {
-                    cipher.passwordHistory = ph;
-                }),
-                this.encryptAttachments(model.attachments, key).then((attachments) => {
-                    cipher.attachments = attachments;
-                }),
-            ]);
-            return cipher;
         });
     }
     encryptAttachments(attachmentsModel, key) {
@@ -24774,7 +24880,7 @@ class CipherService {
             yield Promise.all(attachmentPromises);
             cipher.organizationId = organizationId;
             cipher.collectionIds = collectionIds;
-            const encCipher = yield this.encrypt(cipher);
+            const encCipher = yield this.encryptSharedCipher(cipher);
             const request = new CipherShareRequest(encCipher);
             const response = yield this.apiService.putShareCipher(cipher.id, request);
             const data = new CipherData(response, collectionIds);
@@ -24788,7 +24894,7 @@ class CipherService {
             for (const cipher of ciphers) {
                 cipher.organizationId = organizationId;
                 cipher.collectionIds = collectionIds;
-                promises.push(this.encrypt(cipher).then((c) => {
+                promises.push(this.encryptSharedCipher(cipher).then((c) => {
                     encCiphers.push(c);
                 }));
             }
@@ -24827,12 +24933,22 @@ class CipherService {
     }
     saveAttachmentRawWithServer(cipher, filename, data, admin = false) {
         return cipher_service_awaiter(this, void 0, void 0, function* () {
-            let encKey;
-            encKey = yield this.cryptoService.getOrgKey(cipher.organizationId);
-            encKey || (encKey = yield this.cryptoService.getUserKeyWithLegacySupport());
-            const dataEncKey = yield this.cryptoService.makeDataEncKey(encKey);
-            const encFileName = yield this.encryptService.encrypt(filename, encKey);
-            const encData = yield this.encryptService.encryptToBytes(data, dataEncKey[0]);
+            const encKey = yield this.getKeyForCipherKeyDecryption(cipher);
+            const cipherKeyEncryptionEnabled = yield this.getCipherKeyEncryptionEnabled();
+            const cipherEncKey = cipherKeyEncryptionEnabled && cipher.key != null
+                ? new SymmetricCryptoKey(yield this.encryptService.decryptToBytes(cipher.key, encKey))
+                : encKey;
+            //if cipher key encryption is disabled but the item has an individual key,
+            //then we rollback to using the user key as the main key of encryption of the item
+            //in order to keep item and it's attachments with the same encryption level
+            if (cipher.key != null && !cipherKeyEncryptionEnabled) {
+                const model = yield cipher.decrypt(yield this.getKeyForCipherKeyDecryption(cipher));
+                cipher = yield this.encrypt(model);
+                yield this.updateWithServer(cipher);
+            }
+            const encFileName = yield this.encryptService.encrypt(filename, cipherEncKey);
+            const dataEncKey = yield this.cryptoService.makeDataEncKey(cipherEncKey);
+            const encData = yield this.encryptService.encryptToBytes(new Uint8Array(data), dataEncKey[0]);
             const response = yield this.cipherFileUploadService.upload(cipher, encFileName, encData, admin, dataEncKey);
             const cData = new CipherData(response, cipher.collectionIds);
             if (!admin) {
@@ -25120,7 +25236,68 @@ class CipherService {
             yield this.restore(restores);
         });
     }
+    getKeyForCipherKeyDecryption(cipher) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            return ((yield this.cryptoService.getOrgKey(cipher.organizationId)) ||
+                (yield this.cryptoService.getUserKeyWithLegacySupport()));
+        });
+    }
     // Helpers
+    // In the case of a cipher that is being shared with an organization, we want to decrypt the
+    // cipher key with the user's key and then re-encrypt it with the organization's key.
+    encryptSharedCipher(model) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            const keyForCipherKeyDecryption = yield this.cryptoService.getUserKeyWithLegacySupport();
+            return yield this.encrypt(model, null, keyForCipherKeyDecryption);
+        });
+    }
+    updateModelfromExistingCipher(model, originalCipher) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            const existingCipher = yield originalCipher.decrypt(yield this.getKeyForCipherKeyDecryption(originalCipher));
+            model.passwordHistory = existingCipher.passwordHistory || [];
+            if (model.type === CipherType.Login && existingCipher.type === CipherType.Login) {
+                if (existingCipher.login.password != null &&
+                    existingCipher.login.password !== "" &&
+                    existingCipher.login.password !== model.login.password) {
+                    const ph = new PasswordHistoryView();
+                    ph.password = existingCipher.login.password;
+                    ph.lastUsedDate = model.login.passwordRevisionDate = new Date();
+                    model.passwordHistory.splice(0, 0, ph);
+                }
+                else {
+                    model.login.passwordRevisionDate = existingCipher.login.passwordRevisionDate;
+                }
+            }
+            if (existingCipher.hasFields) {
+                const existingHiddenFields = existingCipher.fields.filter((f) => f.type === FieldType.Hidden &&
+                    f.name != null &&
+                    f.name !== "" &&
+                    f.value != null &&
+                    f.value !== "");
+                const hiddenFields = model.fields == null
+                    ? []
+                    : model.fields.filter((f) => f.type === FieldType.Hidden && f.name != null && f.name !== "");
+                existingHiddenFields.forEach((ef) => {
+                    const matchedField = hiddenFields.find((f) => f.name === ef.name);
+                    if (matchedField == null || matchedField.value !== ef.value) {
+                        const ph = new PasswordHistoryView();
+                        ph.password = ef.name + ": " + ef.value;
+                        ph.lastUsedDate = new Date();
+                        model.passwordHistory.splice(0, 0, ph);
+                    }
+                });
+            }
+        });
+    }
+    adjustPasswordHistoryLength(model) {
+        if (model.passwordHistory != null && model.passwordHistory.length === 0) {
+            model.passwordHistory = null;
+        }
+        else if (model.passwordHistory != null && model.passwordHistory.length > 5) {
+            // only save last 5 history
+            model.passwordHistory = model.passwordHistory.slice(0, 5);
+        }
+    }
     shareAttachmentWithServer(attachmentView, cipherId, organizationId) {
         return cipher_service_awaiter(this, void 0, void 0, function* () {
             const attachmentResponse = yield this.apiService.nativeFetch(new Request(attachmentView.url, { cache: "no-store" }));
@@ -25298,6 +25475,49 @@ class CipherService {
     clearSortedCiphers() {
         this.sortedCiphersCache.clear();
     }
+    encryptCipher(model, cipher, key) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            yield Promise.all([
+                this.encryptObjProperty(model, cipher, {
+                    name: null,
+                    notes: null,
+                }, key),
+                this.encryptCipherData(cipher, model, key),
+                this.encryptFields(model.fields, key).then((fields) => {
+                    cipher.fields = fields;
+                }),
+                this.encryptPasswordHistories(model.passwordHistory, key).then((ph) => {
+                    cipher.passwordHistory = ph;
+                }),
+                this.encryptAttachments(model.attachments, key).then((attachments) => {
+                    cipher.attachments = attachments;
+                }),
+            ]);
+            return cipher;
+        });
+    }
+    encryptCipherWithCipherKey(model, cipher, keyForCipherKeyEncryption, keyForCipherKeyDecryption) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            // First, we get the key for cipher key encryption, in its decrypted form
+            let decryptedCipherKey;
+            if (cipher.key == null) {
+                decryptedCipherKey = yield this.cryptoService.makeCipherKey();
+            }
+            else {
+                decryptedCipherKey = new SymmetricCryptoKey(yield this.encryptService.decryptToBytes(cipher.key, keyForCipherKeyDecryption));
+            }
+            // Then, we have to encrypt the cipher key with the proper key.
+            cipher.key = yield this.encryptService.encrypt(decryptedCipherKey.key, keyForCipherKeyEncryption);
+            // Finally, we can encrypt the cipher with the decrypted cipher key.
+            return this.encryptCipher(model, cipher, decryptedCipherKey);
+        });
+    }
+    getCipherKeyEncryptionEnabled() {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            return (flagEnabled("enableCipherKeyEncryption") &&
+                (yield (0,external_rxjs_namespaceObject.firstValueFrom)(this.configService.checkServerMeetsVersionRequirement$(CIPHER_KEY_ENC_MIN_SERVER_VER))));
+        });
+    }
 }
 cipher_service_decorate([
     sequentialize(() => "getAllDecrypted"),
@@ -26961,6 +27181,7 @@ class CipherExport {
         domain.notes = req.notes != null ? new EncString(req.notes) : null;
         domain.favorite = req.favorite;
         domain.reprompt = (_a = req.reprompt) !== null && _a !== void 0 ? _a : CipherRepromptType.None;
+        domain.key = req.key != null ? new EncString(req.key) : null;
         if (req.fields != null) {
             domain.fields = req.fields.map((f) => FieldExport.toDomain(f));
         }
@@ -26988,7 +27209,7 @@ class CipherExport {
     }
     // Use build method instead of ctor so that we can control order of JSON stringify for pretty print
     build(o) {
-        var _a, _b;
+        var _a, _b, _c;
         this.organizationId = o.organizationId;
         this.folderId = o.folderId;
         this.type = o.type;
@@ -27000,6 +27221,7 @@ class CipherExport {
         else {
             this.name = (_a = o.name) === null || _a === void 0 ? void 0 : _a.encryptedString;
             this.notes = (_b = o.notes) === null || _b === void 0 ? void 0 : _b.encryptedString;
+            this.key = (_c = o.key) === null || _c === void 0 ? void 0 : _c.encryptedString;
         }
         this.favorite = o.favorite;
         if (o.fields != null) {
@@ -27398,12 +27620,15 @@ class VaultExportService {
                     if (exportData.ciphers != null && exportData.ciphers.length > 0) {
                         exportData.ciphers
                             .filter((c) => c.deletedDate === null)
-                            .forEach((c) => {
+                            .forEach((c) => vault_export_service_awaiter(this, void 0, void 0, function* () {
                             const cipher = new Cipher(new CipherData(c));
-                            exportPromises.push(cipher.decrypt().then((decCipher) => {
+                            exportPromises.push(this.cipherService
+                                .getKeyForCipherKeyDecryption(cipher)
+                                .then((key) => cipher.decrypt(key))
+                                .then((decCipher) => {
                                 decCiphers.push(decCipher);
                             }));
-                        });
+                        }));
                     }
                 }
                 return Promise.all(exportPromises);
@@ -28409,10 +28634,11 @@ var bitwarden_json_importer_awaiter = (undefined && undefined.__awaiter) || func
 
 
 class BitwardenJsonImporter extends base_importer_BaseImporter {
-    constructor(cryptoService, i18nService) {
+    constructor(cryptoService, i18nService, cipherService) {
         super();
         this.cryptoService = cryptoService;
         this.i18nService = i18nService;
+        this.cipherService = cipherService;
     }
     parse(data) {
         return bitwarden_json_importer_awaiter(this, void 0, void 0, function* () {
@@ -28472,7 +28698,7 @@ class BitwardenJsonImporter extends base_importer_BaseImporter {
                         }
                     });
                 }
-                const view = yield cipher.decrypt();
+                const view = yield cipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(cipher));
                 this.cleanupCipher(view);
                 this.result.ciphers.push(view);
             }
@@ -28584,8 +28810,8 @@ var bitwarden_password_protected_importer_awaiter = (undefined && undefined.__aw
 
 
 class BitwardenPasswordProtectedImporter extends BitwardenJsonImporter {
-    constructor(cryptoService, i18nService, promptForPassword_callback) {
-        super(cryptoService, i18nService);
+    constructor(cryptoService, i18nService, cipherService, promptForPassword_callback) {
+        super(cryptoService, i18nService, cipherService);
         this.promptForPassword_callback = promptForPassword_callback;
     }
     parse(data) {
@@ -33736,7 +33962,7 @@ class ImportService {
                 return new BitwardenCsvImporter();
             case "bitwardenjson":
             case "bitwardenpasswordprotected":
-                return new BitwardenPasswordProtectedImporter(this.cryptoService, this.i18nService, promptForPassword_callback);
+                return new BitwardenPasswordProtectedImporter(this.cryptoService, this.i18nService, this.cipherService, promptForPassword_callback);
             case "lastpasscsv":
             case "passboltcsv":
                 return new LastPassCsvImporter();
@@ -34278,6 +34504,147 @@ class NodeCryptoFunctionService {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/platform/abstractions/config/server-config.ts
+const dayInMilliseconds = 24 * 3600 * 1000;
+const eighteenHoursInMilliseconds = 18 * 3600 * 1000;
+class ServerConfig {
+    constructor(serverConfigData) {
+        var _a, _b;
+        this.featureStates = {};
+        this.version = serverConfigData.version;
+        this.gitHash = serverConfigData.gitHash;
+        this.server = serverConfigData.server;
+        this.utcDate = new Date(serverConfigData.utcDate);
+        this.environment = serverConfigData.environment;
+        this.featureStates = serverConfigData.featureStates;
+        if (((_a = this.server) === null || _a === void 0 ? void 0 : _a.name) == null && ((_b = this.server) === null || _b === void 0 ? void 0 : _b.url) == null) {
+            this.server = null;
+        }
+    }
+    getAgeInMilliseconds() {
+        var _a;
+        return new Date().getTime() - ((_a = this.utcDate) === null || _a === void 0 ? void 0 : _a.getTime());
+    }
+    isValid() {
+        return this.getAgeInMilliseconds() <= dayInMilliseconds;
+    }
+    expiresSoon() {
+        return this.getAgeInMilliseconds() >= eighteenHoursInMilliseconds;
+    }
+    static fromJSON(obj) {
+        if (obj == null) {
+            return null;
+        }
+        return new ServerConfig(obj);
+    }
+}
+
+;// CONCATENATED MODULE: ../../libs/common/src/platform/services/config/config.service.ts
+var config_service_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+
+
+
+
+const ONE_HOUR_IN_MILLISECONDS = 1000 * 3600;
+class ConfigService {
+    constructor(stateService, configApiService, authService, environmentService, logService, 
+    // Used to avoid duplicate subscriptions, e.g. in browser between the background and popup
+    subscribe = true) {
+        this.stateService = stateService;
+        this.configApiService = configApiService;
+        this.authService = authService;
+        this.environmentService = environmentService;
+        this.logService = logService;
+        this.subscribe = subscribe;
+        this.inited = false;
+        this._serverConfig = new external_rxjs_namespaceObject.ReplaySubject(1);
+        this.serverConfig$ = this._serverConfig.asObservable();
+        this._forceFetchConfig = new external_rxjs_namespaceObject.Subject();
+        this.refreshTimer$ = (0,external_rxjs_namespaceObject.timer)(ONE_HOUR_IN_MILLISECONDS, ONE_HOUR_IN_MILLISECONDS); // after 1 hour, then every hour
+        this.cloudRegion$ = this.serverConfig$.pipe((0,external_rxjs_namespaceObject.map)((config) => { var _a, _b; return (_b = (_a = config === null || config === void 0 ? void 0 : config.environment) === null || _a === void 0 ? void 0 : _a.cloudRegion) !== null && _b !== void 0 ? _b : Region.US; }));
+    }
+    init() {
+        if (!this.subscribe || this.inited) {
+            return;
+        }
+        const latestServerConfig$ = (0,external_rxjs_namespaceObject.defer)(() => this.configApiService.get()).pipe((0,external_rxjs_namespaceObject.map)((response) => new ServerConfigData(response)), (0,external_rxjs_namespaceObject.delayWhen)((data) => this.saveConfig(data)), (0,external_rxjs_namespaceObject.catchError)((e) => {
+            // fall back to stored ServerConfig (if any)
+            this.logService.error("Unable to fetch ServerConfig: " + (e === null || e === void 0 ? void 0 : e.message));
+            return this.stateService.getServerConfig();
+        }));
+        // If you need to fetch a new config when an event occurs, add an observable that emits on that event here
+        (0,external_rxjs_namespaceObject.merge)(this.refreshTimer$, // an overridable interval
+        this.environmentService.urls, // when environment URLs change (including when app is started)
+        this._forceFetchConfig // manual
+        )
+            .pipe((0,external_rxjs_namespaceObject.concatMap)(() => latestServerConfig$), (0,external_rxjs_namespaceObject.map)((data) => (data == null ? null : new ServerConfig(data))))
+            .subscribe((config) => this._serverConfig.next(config));
+        this.inited = true;
+    }
+    getFeatureFlag$(key, defaultValue) {
+        return this.serverConfig$.pipe((0,external_rxjs_namespaceObject.map)((serverConfig) => {
+            if ((serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.featureStates) == null || serverConfig.featureStates[key] == null) {
+                return defaultValue;
+            }
+            return serverConfig.featureStates[key];
+        }));
+    }
+    getFeatureFlag(key, defaultValue) {
+        return config_service_awaiter(this, void 0, void 0, function* () {
+            return yield (0,external_rxjs_namespaceObject.firstValueFrom)(this.getFeatureFlag$(key, defaultValue));
+        });
+    }
+    triggerServerConfigFetch() {
+        this._forceFetchConfig.next();
+    }
+    saveConfig(data) {
+        var _a;
+        return config_service_awaiter(this, void 0, void 0, function* () {
+            if ((yield this.authService.getAuthStatus()) === AuthenticationStatus.LoggedOut) {
+                return;
+            }
+            yield this.stateService.setServerConfig(data);
+            this.environmentService.setCloudWebVaultUrl((_a = data.environment) === null || _a === void 0 ? void 0 : _a.cloudRegion);
+        });
+    }
+    /**
+     * Verifies whether the server version meets the minimum required version
+     * @param minimumRequiredServerVersion The minimum version required
+     * @returns True if the server version is greater than or equal to the minimum required version
+     */
+    checkServerMeetsVersionRequirement$(minimumRequiredServerVersion) {
+        return this.serverConfig$.pipe((0,external_rxjs_namespaceObject.map)((serverConfig) => {
+            if (serverConfig == null) {
+                return false;
+            }
+            const serverVersion = new external_semver_namespaceObject.SemVer(serverConfig.version);
+            return serverVersion.compare(minimumRequiredServerVersion) >= 0;
+        }));
+    }
+}
+
+;// CONCATENATED MODULE: ./src/platform/services/cli-config.service.ts
+
+
+class CliConfigService extends ConfigService {
+    constructor() {
+        super(...arguments);
+        // The rxjs timer uses setTimeout/setInterval under the hood, which prevents the node process from exiting
+        // when the command is finished. Cli should never be alive long enough to use the timer, so we disable it.
+        this.refreshTimer$ = external_rxjs_namespaceObject.NEVER;
+    }
+}
+
 ;// CONCATENATED MODULE: external "child_process"
 const external_child_process_namespaceObject = require("child_process");
 ;// CONCATENATED MODULE: ./src/platform/services/cli-platform-utils.service.ts
@@ -34958,6 +35325,7 @@ class CipherResponse extends BaseResponse {
             this.passwordHistory = passwordHistory.map((h) => new PasswordHistoryResponse(h));
         }
         this.reprompt = this.getResponseProperty("Reprompt") || CipherRepromptType.None;
+        this.key = this.getResponseProperty("Key") || null;
     }
 }
 
@@ -38724,11 +39092,11 @@ class ShareCommand {
             if (cipher.organizationId != null) {
                 return Response.badRequest("This item already belongs to an organization.");
             }
-            const cipherView = yield cipher.decrypt();
+            const cipherView = yield cipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(cipher));
             try {
                 yield this.cipherService.shareWithServer(cipherView, organizationId, req);
                 const updatedCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield updatedCipher.decrypt();
+                const decCipher = yield updatedCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(updatedCipher));
                 const res = new cipher_response_CipherResponse(decCipher);
                 return Response.success(res);
             }
@@ -39824,7 +40192,7 @@ class CreateCommand {
             try {
                 yield this.cipherService.createWithServer(cipher);
                 const newCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield newCipher.decrypt();
+                const decCipher = yield newCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(newCipher));
                 const res = new cipher_response_CipherResponse(decCipher);
                 return Response.success(res);
             }
@@ -39877,7 +40245,7 @@ class CreateCommand {
             try {
                 yield this.cipherService.saveAttachmentRawWithServer(cipher, fileName, new Uint8Array(fileBuf).buffer);
                 const updatedCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield updatedCipher.decrypt();
+                const decCipher = yield updatedCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(updatedCipher));
                 return Response.success(new cipher_response_CipherResponse(decCipher));
             }
             catch (e) {
@@ -40200,7 +40568,7 @@ class EditCommand {
             if (cipher == null) {
                 return Response.notFound();
             }
-            let cipherView = yield cipher.decrypt();
+            let cipherView = yield cipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(cipher));
             if (cipherView.isDeleted) {
                 return Response.badRequest("You may not edit a deleted item. Use the restore command first.");
             }
@@ -40209,7 +40577,7 @@ class EditCommand {
             try {
                 yield this.cipherService.updateWithServer(encCipher);
                 const updatedCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield updatedCipher.decrypt();
+                const decCipher = yield updatedCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(updatedCipher));
                 const res = new cipher_response_CipherResponse(decCipher);
                 return Response.success(res);
             }
@@ -40231,7 +40599,7 @@ class EditCommand {
             try {
                 yield this.cipherService.saveCollectionsWithServer(cipher);
                 const updatedCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield updatedCipher.decrypt();
+                const decCipher = yield updatedCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(updatedCipher));
                 const res = new cipher_response_CipherResponse(decCipher);
                 return Response.success(res);
             }
@@ -40448,7 +40816,7 @@ class GetCommand extends DownloadCommand {
             if (utils_Utils.isGuid(id)) {
                 const cipher = yield this.cipherService.get(id);
                 if (cipher != null) {
-                    decCipher = yield cipher.decrypt();
+                    decCipher = yield cipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(cipher));
                 }
             }
             else if (id.trim() !== "") {
@@ -43031,6 +43399,8 @@ var bw_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _argum
 
 
 
+
+
 
 
 
@@ -43089,10 +43459,7 @@ class Main {
         this.cipherFileUploadService = new CipherFileUploadService(this.apiService, this.fileUploadService);
         this.sendApiService = this.sendApiService = new SendApiService(this.apiService, this.fileUploadService, this.sendService);
         this.searchService = new SearchService(this.logService, this.i18nService);
-        this.cipherService = new CipherService(this.cryptoService, this.settingsService, this.apiService, this.i18nService, this.searchService, this.stateService, this.encryptService, this.cipherFileUploadService);
         this.broadcasterService = new BroadcasterService();
-        this.folderService = new FolderService(this.cryptoService, this.i18nService, this.cipherService, this.stateService);
-        this.folderApiService = new FolderApiService(this.folderService, this.apiService);
         this.collectionService = new CollectionService(this.cryptoService, this.i18nService, this.stateService);
         this.providerService = new ProviderService(this.stateService);
         this.organizationService = new organization_service_OrganizationService(this.stateService);
@@ -43107,6 +43474,11 @@ class Main {
         this.deviceTrustCryptoService = new DeviceTrustCryptoService(this.cryptoFunctionService, this.cryptoService, this.encryptService, this.stateService, this.appIdService, this.devicesApiService, this.i18nService, this.platformUtilsService);
         this.authRequestCryptoService = new AuthRequestCryptoServiceImplementation(this.cryptoService);
         this.authService = new AuthService(this.cryptoService, this.apiService, this.tokenService, this.appIdService, this.platformUtilsService, this.messagingService, this.logService, this.keyConnectorService, this.environmentService, this.stateService, this.twoFactorService, this.i18nService, this.encryptService, this.passwordStrengthService, this.policyService, this.deviceTrustCryptoService, this.authRequestCryptoService);
+        this.configApiService = new ConfigApiService(this.apiService, this.authService);
+        this.configService = new CliConfigService(this.stateService, this.configApiService, this.authService, this.environmentService, this.logService, true);
+        this.cipherService = new CipherService(this.cryptoService, this.settingsService, this.apiService, this.i18nService, this.searchService, this.stateService, this.encryptService, this.cipherFileUploadService, this.configService);
+        this.folderService = new FolderService(this.cryptoService, this.i18nService, this.cipherService, this.stateService);
+        this.folderApiService = new FolderApiService(this.folderService, this.apiService);
         const lockedCallback = (userId) => bw_awaiter(this, void 0, void 0, function* () { return yield this.cryptoService.clearStoredUserKey(KeySuffixOptions.Auto); });
         this.userVerificationService = new UserVerificationService(this.stateService, this.cryptoService, this.i18nService, this.userVerificationApiService);
         this.vaultTimeoutSettingsService = new VaultTimeoutSettingsService(this.cryptoService, this.tokenService, this.policyService, this.stateService, this.userVerificationService);
@@ -43163,6 +43535,7 @@ class Main {
             const locale = yield this.stateService.getLocale();
             yield this.i18nService.init(locale);
             this.twoFactorService.init();
+            this.configService.init();
             const installedVersion = yield this.stateService.getInstalledVersion();
             const currentVersion = yield this.platformUtilsService.getApplicationVersion();
             if (installedVersion == null || installedVersion !== currentVersion) {