[rr-bw]

🎟️ Tracking

PM-40673

PR Stack

• auth/pm-40673/part-1 - Entity, Repository, and Command/Query updates
• auth/pm-40673/part-2 - Add token issuance to login flow (and migrates from old-to-new tokens)
• auth/pm-40673/part-3 - Updates call sites where we want to revoke 2FA remember tokens (admin 2FA reset, recovery code usage, removal of last 2FA method)

📔 Objective

Add token issuance and validation to the login flow (and migrates from old-to-new tokens)

📸 Screenshots

[codecov]

Codecov Report

❌ Patch coverage is 95.23810% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.47%. Comparing base (7e6de55) to head (89faab1).

Files with missing lines	Patch %	Lines
...uestValidators/TwoFactorAuthenticationValidator.cs	92.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8428      +/-   ##
==========================================
+ Coverage   68.44%   68.47%   +0.03%     
==========================================
  Files        2744     2745       +1     
  Lines      117536   117558      +22     
  Branches    10772    10776       +4     
==========================================
+ Hits        80450    80503      +53     
+ Misses      34547    34514      -33     
- Partials     2539     2541       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Re-reviewed part 2 of the PM-40673 stack at head 9264c8d90, including the latest commits that add TwoFactorRemember=1 coverage to the no-reissue test and update the remembered-device integration tests for device-bound email 2FA codes. BaseRequestValidator issues remember tokens through IIssueTwoFactorRememberTokenCommand only after DeviceValidator has set and saved the device. Current-format tokens are checked by the device-bound ValidateAsync(user, deviceIdentifier, token) query, and a replacement is issued only when a legacy token was accepted, so a Remember-provider login gets no new token whether TwoFactorRemember is 0 or 1. Earlier threads are all resolved, DI registrations for the new command and query are in place, and I found no new issues.

[mkincaid-bw]

I removed the DBops review request because it looks like there's nothing here for us to review.