[PM- 30370] [PM-28827] Add Salt to Auth and KM DTOs

[ike-kottlowski]

🎟️ Tracking

PM-30370
PM-28827

📔 Objective

Add MasterPasswordSalt to Auth and KM models.

[github-actions]

Checkmarx One – Scan Summary & Details – cc70e901-f1ec-4055-925a-d47f0539629d

---

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1592	details Method at line 1592 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector
2		CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1419	details Method at line 1419 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector

---

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 293

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.64%. Comparing base (d977ba4) to head (955f048).

Files with missing lines	Patch %	Lines
.../Data/MasterPasswordUnlockAndAuthenticationData.cs	25.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7239   +/-   ##
=======================================
  Coverage   57.64%   57.64%           
=======================================
  Files        2033     2033           
  Lines       89622    89627    +5     
  Branches     7977     7978    +1     
=======================================
+ Hits        51660    51663    +3     
- Misses      36106    36107    +1     
- Partials     1856     1857    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Claude finished @ike-kottlowski's task in 2m 15s —— View job

---

Code Review: PR #7239 - Add Salt to Auth and KM DTOs

• Gather context and review PR diff
• Perform detailed code review
• Post findings

Review Summary

Verdict: Clean PR — no actionable findings. ✅

This PR adds the MasterPasswordSalt property to Auth and Key Management DTOs, enabling a transition from email-derived salt to explicit salt values. The changes include a new optional field on MasterPasswordUnlockAndAuthenticationDataModel with appropriate [MaxLength(256)] validation, backward-compatible fallback logic (MasterPasswordSalt ?? Email), and an update to UserDecryptionOptionsBuilder to use User.GetMasterPasswordSalt(). Test coverage is thorough, with new tests for both explicit salt and null-salt fallback scenarios across registration, TDE set-password, and initial master password flows.

What was reviewed:

File	Change
MasterPasswordUnlockDataAndAuthenticationModel.cs	New MasterPasswordSalt property with [MaxLength(256)] validation, mapped through ToUnlockData()
RegisterFinishRequestModel.cs	Salt mapping enabled (correctly defers fallback — per author's note, no coalescing on write path)
UserDecryptionOptionsBuilder.cs	Switched from hardcoded Email.ToLowerInvariant() to canonical GetMasterPasswordSalt()
4 test files	Good coverage for explicit salt and null-salt-with-email-fallback scenarios

No security, correctness, or style issues identified.

[ike-kottlowski]

We are not coalescing here because this data is used to write to the database, and we agreed that when writing to the database, we only supply what the client give us allowing null to be an options. Tracking fallbacks on both the server and the client was deemed too complex to follow and unwind in the future.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud