[PM-4280] MP reprompt not respected on passkey creation and retrieval

apps/browser/src/vault/popup/components/fido2/fido2.component.ts

@@ -220,35 +220,28 @@
   async submit() {
     const data = this.message$.value;
     if (data?.type === "PickCredentialRequest") {
-      let userVerified = false;
-      if (data.userVerification) {
-        userVerified = await this.passwordRepromptService.showPasswordPrompt();
-      }
+      const userVerified = await this.handleUserVerification(data.userVerification, this.cipher);
 
       this.send({
         sessionId: this.sessionId,
         cipherId: this.cipher.id,
         type: "PickCredentialResponse",
         userVerified,
       });
     } else if (data?.type === "ConfirmNewCredentialRequest") {
-      let userVerified = false;
-
       if (this.cipher.login.hasFido2Credentials) {
         const confirmed = await this.dialogService.openSimpleDialog({
           title: { key: "overwritePasskey" },
           content: { key: "overwritePasskeyAlert" },
           type: "info",
         });
 
         if (!confirmed) {
           return false;
         }
       }
 
-      if (data.userVerification) {
-        userVerified = await this.passwordRepromptService.showPasswordPrompt();
-      }
+      const userVerified = await this.handleUserVerification(data.userVerification, this.cipher);
 
       this.send({
         sessionId: this.sessionId,
@@ -411,6 +404,20 @@
     }
   }
 
+  private async handleUserVerification(
+    userVerification: boolean,
+    cipher: CipherView
+  ): Promise<boolean> {
+    const masterPasswordRepromptRequiered = cipher && cipher.reprompt !== 0;
+    const verificationRequired = userVerification || masterPasswordRepromptRequiered;
+
+    if (!verificationRequired) {
+      return false;
+    }
+
+    return await this.passwordRepromptService.showPasswordPrompt();
+  }
+
   private send(msg: BrowserFido2Message) {
     BrowserFido2UserInterfaceSession.sendMessage({
       sessionId: this.sessionId,

libs/common/src/vault/services/fido2/fido2-authenticator.service.ts

@@ -1,4 +1,4 @@
 import { LogService } from "../../../platform/abstractions/log.service";
 import { Utils } from "../../../platform/misc/utils";
 import { CipherService } from "../../abstractions/cipher.service";
 import {
@@ -136,6 +136,14 @@
         cipher = await encrypted.decrypt(
           await this.cipherService.getKeyForCipherKeyDecryption(encrypted)
         );
+
+        if (cipher.reprompt !== 0 && !userVerified) {
+          this.logService?.warning(
+            `[Fido2Authenticator] Aborting because user verification was unsuccessful.`
+          );
+          throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed);
+        }
+
         fido2Credential = await createKeyView(params, keyPair.privateKey);
         cipher.login.fido2Credentials = [fido2Credential];
         const reencrypted = await this.cipherService.encrypt(cipher);
@@ -242,6 +250,13 @@
         throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed);
       }
 
+      if (selectedCipher.reprompt !== 0 && !userVerified) {
+        this.logService?.warning(
+          `[Fido2Authenticator] Aborting because user verification was unsuccessful.`
+        );
+        throw new Fido2AutenticatorError(Fido2AutenticatorErrorCode.NotAllowed);
+      }
+
       try {
         const selectedFido2Credential = selectedCipher.login.fido2Credentials[0];
         const selectedCredentialId = selectedFido2Credential.credentialId;