Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PM-5550 Implement on-page autofil for single line TOTP #12058

Merged
merged 24 commits into from
Dec 13, 2024

Conversation

dan-livefront
Copy link
Collaborator

@dan-livefront dan-livefront commented Nov 19, 2024

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-5550

📔 Objective

Core Changes

  • Introduce a feature flag ( InlineMenuTotp = "inline-menu-totp" ).
  • Update the disqualification logic to no longer exclude TOTP fields if the feature flag is enabled.

Update Inline Menu Cipher Data

Modify the inline menu cipher data to include the following fields:

  • totpCode: The generated TOTP code.
  • totpTimeInterval: Time left for the current TOTP code.
  • totpField: Boolean indicating if the field is a TOTP field.

Populate New Inline Menu for TOTP Fields

When a TOTP code is available and the field is identified as a TOTP field:

  • Display the TOTP code in the inline menu.
  • Include a countdown timer (similar to the existing one in the extension) showing the remaining validity of the code.
  • Add a heading explicitly labeling it as a TOTP code.
  • When the totp code expires, refresh overlay ciphers

Tests

  • Test the behavior with the feature flag enabled and disabled:
  • Ensure TOTP fields are not disqualified when the flag is enabled.
  • Confirm default behavior (TOTP fields disqualified) when the flag is disabled and enabled

Note:

  • I organized some of the styling file names to not directly assign a hex code in dark mode scenarios but I can remove these changes if they will add to much friction to this PR.

  • this ticket
    This ticket will handle multiple totp login items on the same field

  • this ticket This ticket will handle the way we are determining if a field is a totp field on the page

  • this ticket handles multi input totp fields

  • this ticket this ticket will mitigate showing totp codes when MP prompt is on

  • This ticket adds the subscription paywall

  • This ticket will remove totp code inline menu items that do not have a totp code

📸 Screenshots

Screenshot 2024-11-19 at 3 37 49 PM Screenshot 2024-11-19 at 3 37 55 PM

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

-Edit tests
-Clean up styling
-New method to validate totpfields
@dan-livefront dan-livefront self-assigned this Nov 19, 2024
Copy link

codecov bot commented Nov 19, 2024

Codecov Report

Attention: Patch coverage is 73.68421% with 20 lines in your changes missing coverage. Please review.

Project coverage is 33.46%. Comparing base (1b6b5d3) to head (8aa2616).
Report is 16 commits behind head on main.

✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
...wser/src/autofill/background/overlay.background.ts 33.33% 7 Missing and 3 partials ⚠️
...nline-menu/pages/list/autofill-inline-menu-list.ts 85.71% 4 Missing and 3 partials ⚠️
...ervices/inline-menu-field-qualification.service.ts 80.00% 2 Missing ⚠️
apps/browser/src/background/runtime.background.ts 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #12058      +/-   ##
==========================================
+ Coverage   33.42%   33.46%   +0.03%     
==========================================
  Files        2901     2901              
  Lines       90564    90634      +70     
  Branches    17212    17223      +11     
==========================================
+ Hits        30271    30329      +58     
- Misses      57899    57905       +6     
- Partials     2394     2400       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

github-actions bot commented Dec 2, 2024

Logo
Checkmarx One – Scan Summary & Detailsf907ac6c-70be-4173-8df2-b9c20433601d

New Issues

Severity Issue Source File / Package Checkmarx Insight
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1166 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 86 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 130 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 38 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 515 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1239 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1221 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 503 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 497 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1238 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1238 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1220 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1220 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1171 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 581 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 565 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1074 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1074 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1074 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 670 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 693 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 671 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 680 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 679 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 673 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 665 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 664 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 663 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 662 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 661 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1045 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1237 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1219 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1221 Attack Vector

Fixed Issues

Severity Issue Source File / Package
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 657
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 670
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 564
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 514
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 580
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 496
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 502
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 653
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 647
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 646
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 645
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 644
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 643
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 656
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1108
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1127
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1145
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1074
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 819
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1126
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1126
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1128
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1128
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1144
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 1144

@dan-livefront dan-livefront requested a review from jprusik December 3, 2024 18:02
@dan-livefront dan-livefront marked this pull request as ready for review December 3, 2024 18:02
@dan-livefront dan-livefront requested a review from a team as a code owner December 3, 2024 18:02
danielleflinn
danielleflinn previously approved these changes Dec 5, 2024
Copy link
Member

@danielleflinn danielleflinn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested build locally, UI looks as expected and overall works as expected when navigating with a mouse as well as with a screen reader and keyboard.

I did catch 2 bugs / edge cases that we hadn't thought of:

  1. We are showing the TOTP fill UI when an item has MP reprompt "on" which feels a bit odd since selecting it to autofill then launches the popout. And in the Extension Refresh we actually require the user to enter their MP to view a vault item OR to copy the TOTP.

  2. Secondly, for Free users we are showing the TOTP menu UI even though we are not showing the TOTP in the popup (requires premium upgrade). This was an edge case that did not come up during design.

I'll likely log both of these as bugs on the Jira though so they can be addressed in separate PRs.

@jprusik
Copy link
Contributor

jprusik commented Dec 5, 2024

I'll likely log both of these as bugs on the Jira though so they can be addressed in separate PRs.

Agreed - let's follow up on these as separate tasks


const svgElement = buildSvgDomElement(`
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 29 29">
<g>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

non-blocking nit; are we able to drop this group tag from the SVG?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The group can be dropped and won't affect any functionality, I will drop it.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

innerCircleElement.classList.toggle("circle-danger-color", totpExpiryApproaching);
outerCircleElement.classList.toggle("circle-danger-color", totpExpiryApproaching);

innerCircleElement.style.strokeDashoffset = `${((intervalSeconds - totpSeconds) / intervalSeconds) * (2 * Math.PI * 12.5)}`;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jprusik
Copy link
Contributor

jprusik commented Dec 5, 2024

Formatting suggestion

Co-authored-by: Jonathan Prusik <[email protected]>
Comment on lines 174 to 180
/**
* Autofill does not fill password type totp input fields
*/
if (this.inlineMenuTotpFeatureFlag) {
if (isTotpField) {
const isTotpField = this.isTotpField(field);
const passwordType = field.type === "password";
if (isTotpField && !passwordType) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit (for follow up work in next PRs, don't worry about it in this one), let's move that comment to be more local to the line in question:

Suggested change
/**
* Autofill does not fill password type totp input fields
*/
if (this.inlineMenuTotpFeatureFlag) {
if (isTotpField) {
const isTotpField = this.isTotpField(field);
const passwordType = field.type === "password";
if (isTotpField && !passwordType) {
if (this.inlineMenuTotpFeatureFlag) {
const isTotpField = this.isTotpField(field);
// Autofill does not fill totp inputs with a "password" `type` attribute value
const passwordType = field.type === "password";
if (isTotpField && !passwordType) {

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will do! good call out.

jprusik
jprusik previously approved these changes Dec 11, 2024
Copy link
Contributor

@jprusik jprusik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

v. nice work; thanks @dan-livefront

@jprusik
Copy link
Contributor

jprusik commented Dec 12, 2024

New BIT run with the "inline-menu-field-qualification" flag enabled as well:
https://github.com/bitwarden/browser-interactions-testing/actions/runs/12299952000

@dan-livefront dan-livefront merged commit 6383048 into main Dec 13, 2024
75 checks passed
@dan-livefront dan-livefront deleted the PM-5550-implement-on-page-autofill-menu-for-totp branch December 13, 2024 17:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants