PM-31953: Support multiple schemes for Duo, WebAuthn, and SSO callbacks

[david-livefront]

🎟️ Tracking

PM-31953

📔 Objective

This PR lays all the groundwork for supporting Universal links when logging in via Duo, WebAuthn, and SSO.

Notably, this PR does not actually change the app to use the universal links as all variants still use the bitwarden schemed deeplink. A future PR will make the final transition to universal links.

Changes in this PR:

• Send the deeplinkScheme to all requests to getToken
• Allow for parsing of deeplinks from bitwarden.pw
• Sending an appropriate deeplinkScheme when launching an AuthTab
• Abstract launching an AuthTab with a universal link or a custom deeplink.

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[claude]

Claude finished @david-livefront's task in 3m 28s —— View job

---

Code Review Summary

PR: PM-31953: Support multiple schemes for Duo, WebAuthn, and SSO callbacks

Review Status: Approved

This PR lays the groundwork for supporting Universal links (app links) when logging in via Duo, WebAuthn, and SSO. The implementation is well-structured and follows the established architecture patterns.

Changes Reviewed

Area	Assessment
Security	Callback URL validation properly restricts to known Bitwarden hosts
Architecture	Clean abstraction with AuthTabData sealed class
Test Coverage	Comprehensive tests updated to match implementation
Breaking Changes	None - currently all variants still use custom scheme

Key Observations

Well-designed abstraction: The AuthTabData sealed class cleanly separates CustomScheme (for bitwarden:// deeplinks) from HttpsScheme (for future universal links), allowing gradual migration per PM-26577.

Security-conscious callback parsing: The utility functions (DuoUtils, SsoUtils, WebAuthUtils) properly validate callbacks against known Bitwarden hosts (bitwarden.com, bitwarden.eu, bitwarden.pw) and expected paths, preventing spoofing.

Network layer integration: The deeplinkScheme parameter is now passed through to getToken requests, enabling the backend to generate appropriate callback URLs.

Previously Identified Issues - All Resolved

Issue	Status
WebAuthUtilsTest base64 encoding mismatch	Fixed - now correctly encodes mobile:true
EnterpriseSignOnViewModelTest expecting HttpsScheme	Fixed - now expects CustomScheme
TwoFactorLoginViewModelTest Duo test	Fixed - now expects CustomScheme
TwoFactorLoginViewModelTest WebAuthn test	Fixed - now expects CustomScheme

No New Issues Found

The code is clean, well-tested, and follows established patterns. All TODOs appropriately reference PM-26577 for future universal link implementation.

---

Reviewed with Claude Code

[github-actions]

Checkmarx One – Scan Summary & Details – 386f8549-331b-4338-a8c6-02dbb7fddd80

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 93.61702% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.37%. Comparing base (6eba9ec) to head (1a27b2a).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
.../feature/twofactorlogin/TwoFactorLoginViewModel.kt	93.47%	0 Missing and 3 partials ⚠️
...it/bitwarden/data/auth/repository/util/DuoUtils.kt	50.00%	0 Missing and 1 partial ⚠️
...it/bitwarden/data/auth/repository/util/SsoUtils.kt	66.66%	0 Missing and 1 partial ⚠️
...itwarden/data/auth/repository/util/WebAuthUtils.kt	75.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6498   +/-   ##
=======================================
  Coverage   86.36%   86.37%           
=======================================
  Files         767      768    +1     
  Lines       56035    56076   +41     
  Branches     8151     8153    +2     
=======================================
+ Hits        48395    48434   +39     
  Misses       4800     4800           
- Partials     2840     2842    +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.