[PM-27280] Support v2 encryption on key-connector signups

[mzieniukbw]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-27280

📔 Objective

Support v2 encryption on key-connector signups. Changes inPOST /accounts/key-management/set-key-connector-key controller:

• New keyConnectorKeyWrappedUserKey and AccountKeys request fields.
  • Deprecated old request fields
  • Kdf are not needed, so we use a default
  • Backwards compatible for V1, until remove later
• The V2 logic in dedicated command with one helper query.
• Added feature flag, later to be used in client's enable-account-encryption-v2-key-connector-registration

Requires #6669

📸 Screenshots

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions[bot]]

Checkmarx One – Scan Summary & Details – b7b159a8-c25f-473f-bb42-c709fa5408c8

New Issues (1)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145	details Method at line 145 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi... ID: dfIswfBHHVtGN%2FYyINPQseahW5M%3D Attack Vector

[claude[bot]]

Claude finished @mzieniukbw's task in 3m 10s —— View job

---

Code Review Complete

I've completed a thorough review of PR #6712 following Bitwarden engineering standards. The specialized code reviewer has posted detailed inline comments and findings.

Review Status: Changes identified

The review focused on:

• Security and zero-knowledge encryption principles
• Code correctness and transaction safety
• Architecture and separation of concerns
• Test coverage
• Database safety

Please review the inline comments and summary posted by the code review agent for detailed findings and recommendations.

[codecov[bot]]

Codecov Report

:x: Patch coverage is 98.95288% with 2 lines in your changes missing coverage. Please review. :white_check_mark: Project coverage is 58.42%. Comparing base (04efe40) to head (952ba07). :warning: Report is 15 commits behind head on main.

Files with missing lines	Patch %	Lines
...ure.EntityFramework/Repositories/UserRepository.cs	92.59%	2 Missing :warning:

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6712      +/-   ##
==========================================
+ Coverage   54.40%   58.42%   +4.01%     
==========================================
  Files        1921     1925       +4     
  Lines       85205    85380     +175     
  Branches     7633     7651      +18     
==========================================
+ Hits        46358    49884    +3526     
+ Misses      37074    33647    -3427     
- Partials     1773     1849      +76     

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

:rocket: New features to boost your workflow:

• :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• :package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.