[rr-bw]

🎟️ Tracking

PM-40673

PR Stack

• auth/pm-40673/part-1 - Entity, Repository, and Command/Query updates
• auth/pm-40673/part-2 - Add token issuance to login flow (and migrates from old-to-new tokens)
• auth/pm-40673/part-3 - Updates call sites where we want to revoke 2FA remember tokens (admin 2FA reset, recovery code usage, removal of last 2FA method)

📔 Objective

Updates call sites where we want to revoke 2FA remember tokens (admin 2FA reset, recovery code usage, removal of last 2FA method)

📸 Screenshots

Screen recordings on Jira ticket

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.85%. Comparing base (89faab1) to head (37b4443).

Additional details and impacted files

@@                   Coverage Diff                    @@
##           auth/pm-40673/part-2    #8429      +/-   ##
========================================================
+ Coverage                 68.47%   74.85%   +6.37%     
========================================================
  Files                      2745     2751       +6     
  Lines                    117558   117653      +95     
  Branches                  10776    10787      +11     
========================================================
+ Hits                      80503    88067    +7564     
+ Misses                    34514    26933    -7581     
- Partials                   2541     2653     +112     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This review covers the full Part 3 diff at head 37b44437: the revoke calls in ResetUserTwoFactorCommand, UserService.DisableTwoFactorProviderAsync / RecoverTwoFactorAsync, and both emergency access takeover paths, plus the RecoveryCode exclusion in BaseRequestValidator and the renaming from "remembered device" to "2FA remember token". Each revoke runs after the request is validated and before the user is saved, so if the revoke fails, the user's 2FA is still in place and the operation can be retried. IRevokeTwoFactorRememberTokensCommand is registered with DI, and none of the changed services is constructed by hand anywhere. The newest commit only changes tests: ValidateTwoFactorRememberTokenQueryTests now uses a frozen FakeTimeProvider through the internal ExpiringTokenable.TimeProvider, and the boundary tests for token and row expiry agree with IsExpired.

Code Review Details

No findings. The open question in the readme.md thread (org Duo removal, plan downgrade, member removal) is with product in Jira and is not raised again here.

[rr-bw]

@JaredSnider-Bitwarden Two more commits since rebasing the stack:

• b13474f - [PM-40673 Part 3] assert that a rejected emergency access takeover does not revoke 2FA remember tokens
• 5b3c6e1 - [PM-40673 Part 3] add integration test for 2FA remember token revoke on the legacy emergency access takeover path
• 37b4443 - [PM-40673 Part 3] use the fake clock for token expiry in ValidateTwoFactorRememberTokenQueryTests