[PM-29309] [BWA-209] Fix TOTP countdown freeze when returning to Authenticator app (change Flow to StateFlow) by tajchert · Pull Request #6246 · bitwarden/android

tajchert · 2025-12-07T15:34:36Z

Disclaimer: This PR was created with AI assisted agent (Claude Code) but manually checked myself to my best knowledge and this repository standards. If you feel this is against contribution guidelines (I haven't found anything related to such) feel free to disregard this PR. I honestly believe this is valid PR, and I tested it manually as well.

This fix OTP code freeze when returning to Authenticator app from background - issue #6244
when occasionally user can experience frozen TOTP codes and countdown timers when returning to the Authenticator app from background. The codes remain static and don't update until the screen is manually refreshed. This changes flow implementation in AUthenticator app (Flow) to one that is Password Manager (StateFlow).

Root Cause

The bug stems from a flow lifecycle mismatch in TotpCodeManagerImpl. The TOTP code update mechanism relies on continuous Flow emissions with a 1-second delay loop, but this flow stops when the app goes to background.

The race condition:

App goes to background → collectAsStateWithLifecycle() stops collecting
After 5 seconds → SharingStarted.WhileSubscribed(5_000L) stops upstream flows
The delay(ONE_SECOND_MILLISECOND) timer loop stops entirely
On return to foreground:
- Collection resumes, triggering new subscription
- Cold Flow is recreated from scratch for each item
- Stale cached stateIn value briefly displayed before new emissions
- Multiple items compound this as combine() waits for all flows to emit

Solution

Aligned TotpCodeManagerImpl with the Password Manager's proven pattern:

Return StateFlow instead of cold Flow — Maintains current state, subscribers get immediate value
Per-item StateFlow caching via mutableMapOf<AuthenticatorItem, StateFlow<...>> — Prevents flow recreation on resubscribe
Per-item CoroutineScope — Each TOTP timer runs independently with proper lifecycle
Removed 5-second stop timeout — Uses SharingStarted.WhileSubscribed() without delay
Use SharingStarted.Eagerly for per-item flows — Ensures cached per-item flows continue emitting even when the combined flow changes (e.g., when adding new items)
Explicit cleanup via onCompletion — Removes flows from cache and cancels scope when no longer needed

Changes

TotpCodeManager.kt — Changed return type from Flow<List<VerificationCodeItem>> to StateFlow<List<VerificationCodeItem>>
TotpCodeManagerImpl.kt — Added DispatcherManager dependency, per-item StateFlow caching with getOrCreateItemStateFlow(), and cleanup handlers
AuthenticatorManagerModule.kt — Passes dispatcherManager to TotpCodeManagerImpl constructor
AuthenticatorRepositoryImpl.kt — Removed 5-second timeout, now uses SharingStarted.WhileSubscribed() without delay
Test files — Updated mocks to use MutableStateFlow() instead of flowOf()

Testing

All existing unit tests pass
Manual testing verified:
- Background app for 5+ seconds, return ✓
- Background during code expiration, return ✓
- Rotate device while showing codes ✓
- Rapid app switching ✓

I wasn't able to recreate issue after this fix.

CLAassistant · 2025-12-07T15:34:42Z

All committers have signed the CLA.

bitwarden-bot · 2025-12-07T15:35:18Z

Thank you for your contribution! We've added this to our internal tracking system for review.
ID: PM-29309
Link: https://bitwarden.atlassian.net/browse/PM-29309

Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process.

SaintPatrck

Thank you for contributing, @tajchert.

I've left a few blocking concerns that need to be addressed.

Since you are using Claude to assist with development, would you be open to allowing our Claude agent to review your changes alongside us?

SaintPatrck · 2026-01-29T20:40:18Z

-                delay(ONE_SECOND_MILLISECOND)
+                .stateIn(
+                    scope = itemScope,
+                    started = SharingStarted.Eagerly,


I think this has the potential to cause leaks. Can we use WhileSubscribed()? That appears to be working in the PasswordManager version.

SaintPatrck · 2026-01-29T20:50:12Z

+        var verificationCodeItem: VerificationCodeItem? = null
+
+        while (currentCoroutineContext().isActive) {
+            val time = (clock.millis() / ONE_SECOND_MILLISECOND).toInt()


The PasswordManager version gets dateTime and time differently. Can you update this to follow it? It will also give you an instance of DateTime so that you don't have to create one inline, below.

SaintPatrck · 2026-01-29T20:52:03Z

+                    .getOrNull()
+                    ?.let { response ->


Can we use onSuccess and onFailure here, like we're doing in the PasswordManager version?

SaintPatrck · 2026-01-29T20:53:38Z

+                            issueTime = clock.millis(),
+                            id = when (item.source) {
+                                is AuthenticatorItem.Source.Local -> item.source.cipherId
+                                is AuthenticatorItem.Source.Shared -> UUID.randomUUID().toString()


We recently introduced a UuidManager to ease testing. Can you use it here instead of UUID directly?

SaintPatrck · 2026-01-29T20:58:26Z

+            // Emit item
+            emit(verificationCodeItem)
+
+            // Wait one second before heading to the top of the loop:
+            delay(ONE_SECOND_MILLISECOND)


These comments are redundant. The code itself already describes what is being done. Comments would only be helpful here if they described why it's being done, which is obvious.

SaintPatrck · 2026-01-29T21:12:26Z

+ *
+ * This implementation uses per-item [StateFlow] caching to prevent flow recreation on each
+ * subscribe, ensuring smooth UI updates when returning from background. The pattern mirrors
+ * the Password Manager's [com.x8bit.bitwarden.data.vault.manager.TotpCodeManagerImpl].


Add this to the imports if needed so we don't need the FQN.

SaintPatrck · 2026-01-29T21:14:19Z

+    @Suppress("LongMethod")
+    private fun createVerificationCodeFlow(
+        item: AuthenticatorItem,
+    ) = flow<VerificationCodeItem?> {


⛏️

Suggested change

) = flow<VerificationCodeItem?> {

): Flow<VerificationCodeItem?> = flow {

SaintPatrck · 2026-01-29T21:17:38Z


    @Test
-    fun `getTotpCodesFlow should return flow that emits empty list when input list is empty`() =
+    fun `getTotpCodesFlow should return StateFlow that emits empty list when input list is empty`() =


This is going to trigger detekt. Can you add Suppress("MaxLineLength")?

I recommend setting up detekt as a commit-hook as described in README#setup, or at least running it manually before submitting changes.

SaintPatrck · 2026-01-29T21:21:22Z

+     * updated verification codes every second. The StateFlow is cached per-item to prevent
+     * recreation on each subscribe, ensuring smooth UI updates when returning from background.


The last sentence reads more like implementation detail. Since the implementation has good KDoc let's remove those details from the interface.

david-livefront · 2026-04-06T15:12:51Z

@tajchert I'm going to rebase this PR and address some of the comment @SaintPatrck has left behind. I think we can push this PR through in fairly short order 😄

github-actions · 2026-04-06T15:15:30Z

Checkmarx One – Scan Summary & Details – 9adf7a4a-e33d-4f55-b036-ef099d85b2f5

New Issues (128)

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 154	details The web application's `clearCookies should remove all stored cookie configs` method creates a cookie Cookie, at line 154 of /app/src/test/kotlin/... Attack Vector
2	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 148	details The web application's `clearCookies should remove all stored cookie configs` method creates a cookie Cookie, at line 148 of /app/src/test/kotlin/... Attack Vector
3	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/network/NetworkCookieManagerTest.kt: 203	details The web application's Lambda method creates a cookie Cookie, at line 203 of /app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/network/... Attack Vector
4	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/network/NetworkCookieManagerTest.kt: 229	details The web application's Lambda method creates a cookie Cookie, at line 229 of /app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/network/... Attack Vector
5	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/util/CookieConfigurationDataExtensionsTest.kt: 45	details The web application's `toNetworkCookieList should map multiple cookies correctly` method creates a cookie Cookie, at line 45 of /app/src/test/kot... Attack Vector
6	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/util/CookieConfigurationDataExtensionsTest.kt: 62	details The web application's `toNetworkCookie should map name and value correctly` method creates a cookie Cookie, at line 62 of /app/src/test/kotlin/co... Attack Vector
7	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/util/CookieConfigurationDataExtensionsTest.kt: 46	details The web application's `toNetworkCookieList should map multiple cookies correctly` method creates a cookie Cookie, at line 46 of /app/src/test/kot... Attack Vector
8	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/util/CookieConfigurationDataExtensionsTest.kt: 31	details The web application's `toNetworkCookieList should map single cookie correctly` method creates a cookie Cookie, at line 31 of /app/src/test/kotlin... Attack Vector
9	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 129	details The web application's `storeCookieConfig with null should not affect other hostnames` method creates a cookie Cookie, at line 129 of /app/src/tes... Attack Vector
10	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 123	details The web application's `storeCookieConfig with null should not affect other hostnames` method creates a cookie Cookie, at line 123 of /app/src/tes... Attack Vector
11	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 103	details The web application's `storeCookieConfig with null should remove stored config` method creates a cookie Cookie, at line 103 of /app/src/test/kotl... Attack Vector
12	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/repository/util/CookieConfigurationDataExtensionsTest.kt: 32	details The web application's `toAcquiredCookiesList should map list of Cookie to list of AcquiredCookie` method creates a cookie Cookie, at line 32 of /... Attack Vector
13	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/repository/util/AcquiredCookieExtensionsTest.kt: 39	details The web application's `toConfigurationDataCookies should map list of AcquiredCookie to list of Cookie` method creates a cookie Cookie, at line 39... Attack Vector
14	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/repository/util/CookieConfigurationDataExtensionsTest.kt: 31	details The web application's `toAcquiredCookiesList should map list of Cookie to list of AcquiredCookie` method creates a cookie Cookie, at line 31 of /... Attack Vector
15	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/repository/util/CookieConfigurationDataExtensionsTest.kt: 12	details The web application's `toAcquiredCookie should map Cookie to AcquiredCookie` method creates a cookie Cookie, at line 12 of /app/src/test/kotlin/c... Attack Vector
16	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/repository/util/AcquiredCookieExtensionsTest.kt: 40	details The web application's `toConfigurationDataCookies should map list of AcquiredCookie to list of Cookie` method creates a cookie Cookie, at line 40... Attack Vector
17	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/repository/util/AcquiredCookieExtensionsTest.kt: 20	details The web application's `toConfigurationCookie should map AcquiredCookie to CookieConfigurationData Cookie` method creates a cookie Cookie, at line... Attack Vector
18	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/sdk/ServerCommunicationConfigRepositoryTest.kt: 72	details The web application's Lambda method creates a cookie Cookie, at line 72 of /app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/sdk/Se... Attack Vector
19	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/sdk/ServerCommunicationConfigRepositoryTest.kt: 156	details The web application's Lambda method creates a cookie Cookie, at line 156 of /app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/sdk/S... Attack Vector
20	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/sdk/ServerCommunicationConfigRepositoryTest.kt: 157	details The web application's Lambda method creates a cookie Cookie, at line 157 of /app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/sdk/S... Attack Vector
21	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/sdk/ServerCommunicationConfigRepositoryTest.kt: 71	details The web application's Lambda method creates a cookie Cookie, at line 71 of /app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/sdk/Se... Attack Vector
22	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 189	details The web application's `storage should isolate configs by hostname` method creates a cookie Cookie, at line 189 of /app/src/test/kotlin/com/x8bit/... Attack Vector
23	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 180	details The web application's `storage should isolate configs by hostname` method creates a cookie Cookie, at line 180 of /app/src/test/kotlin/com/x8bit/... Attack Vector
24	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 81	details The web application's `storage should handle cookies with multiple values` method creates a cookie Cookie, at line 81 of /app/src/test/kotlin/com... Attack Vector
25	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 85	details The web application's `storage should handle cookies with multiple values` method creates a cookie Cookie, at line 85 of /app/src/test/kotlin/com... Attack Vector
26	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 51	details The web application's `storeCookieConfig should update existing config` method creates a cookie Cookie, at line 51 of /app/src/test/kotlin/com/x8... Attack Vector
27	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 61	details The web application's `storeCookieConfig should update existing config` method creates a cookie Cookie, at line 61 of /app/src/test/kotlin/com/x8... Attack Vector
28	HttpOnly_Cookie_Flag_Not_Set	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/datasource/disk/CookieDiskSourceTest.kt: 32	details The web application's `storeCookieConfig should persist config and getCookieConfig should retrieve it` method creates a cookie Cookie, at line 32... Attack Vector
29	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt: 98	details Method createMockCipherView at line 98 of /app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt sends user in... Attack Vector
30	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/tools/feature/generator/passwordhistory/PasswordHistoryViewModelTest.kt: 203	details Method Lambda at line 203 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/tools/feature/generator/passwordhistory/PasswordHistoryViewModelTest.kt s... Attack Vector
31	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/tools/feature/send/addedit/AddEditSendViewModelTest.kt: 1202	details Method Lambda at line 1202 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/tools/feature/send/addedit/AddEditSendViewModelTest.kt sends user inform... Attack Vector
32	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 429	details Method Lambda at line 429 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
33	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 386	details Method Lambda at line 386 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
34	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 402	details Method Lambda at line 402 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
35	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 334	details Method Lambda at line 334 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
36	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 305	details Method Lambda at line 305 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
37	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 265	details Method Lambda at line 265 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
38	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 237	details Method Lambda at line 237 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
39	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 206	details Method Lambda at line 206 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
40	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 170	details Method Lambda at line 170 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
41	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 110	details Method Lambda at line 110 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest... Attack Vector
42	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 90	details Method Lambda at line 90 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.... Attack Vector
43	Privacy_Violation	/testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.kt: 70	details Method Lambda at line 70 of /testharness/src/test/kotlin/com/bitwarden/testharness/ui/platform/feature/createpassword/CreatePasswordViewModelTest.... Attack Vector
44	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/vault/feature/exportitems/verifypassword/VerifyPasswordViewModelTest.kt: 482	details Method Lambda at line 482 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/vault/feature/exportitems/verifypassword/VerifyPasswordViewModelTest.kt s... Attack Vector
45	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt: 585	details Method Lambda at line 585 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt se... Attack Vector
46	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/vaultunlock/VaultUnlockViewModelTest.kt: 796	details Method `on UnlockClick for password unlock should display error dialog on AuthenticationError` at line 796 of /app/src/test/kotlin/com/x8bit/bitw... Attack Vector
47	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/platform/feature/settings/accountsecurity/deleteaccount/DeleteAccountViewModelTest.kt: 175	details Method Lambda at line 175 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/platform/feature/settings/accountsecurity/deleteaccount/DeleteAccountViewM... Attack Vector
48	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt: 61	details Method Lambda at line 61 of /app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt sends user information outs... Attack Vector
49	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt: 61	details Method Lambda at line 61 of /app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt sends user information outs... Attack Vector
50	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt: 125	details Method createMockLoginView at line 125 of /app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt sends user in... Attack Vector
51	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/data/credentials/model/Fido2CredentialAssertionRequestUtil.kt: 12	details Method createMockFido2CredentialAssertionRequest at line 12 of /app/src/test/kotlin/com/x8bit/bitwarden/data/credentials/model/Fido2CredentialAsser... Attack Vector
52	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/platform/feature/settings/accountsecurity/loginapproval/LoginApprovalViewModelTest.kt: 150	details Method `on ApproveAccountChangeClick dialog state should be cleared, user should be switched, and getAuthRequestByIdFlow should be called` at lin... Attack Vector
53	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/platform/feature/settings/accountsecurity/loginapproval/LoginApprovalViewModelTest.kt: 376	details Method Lambda at line 376 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/platform/feature/settings/accountsecurity/loginapproval/LoginApprovalViewM... Attack Vector
54	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/platform/feature/settings/accountsecurity/loginapproval/LoginApprovalViewModelTest.kt: 307	details Method Lambda at line 307 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/platform/feature/settings/accountsecurity/loginapproval/LoginApprovalViewM... Attack Vector
55	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt: 446	details Method Lambda at line 446 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt se... Attack Vector
56	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt: 330	details Method Lambda at line 330 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt se... Attack Vector
57	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt: 362	details Method Lambda at line 362 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt se... Attack Vector
58	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt: 675	details Method at line 675 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt sends us... Attack Vector
59	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt: 687	details Method at line 687 of /app/src/test/kotlin/com/x8bit/bitwarden/ui/auth/feature/completeregistration/CompleteRegistrationViewModelTest.kt sends us... Attack Vector
60	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt: 77	details Method Lambda at line 77 of /app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt sends user information outs... Attack Vector
61	Privacy_Violation	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt: 77	details Method Lambda at line 77 of /app/src/test/kotlin/com/x8bit/bitwarden/data/vault/datasource/sdk/model/CipherViewUtil.kt sends user information outs... Attack Vector
62	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/ui/vault/feature/attachments/AttachmentsViewModelTest.kt: 596	details The application uses the hard-coded password "mockId-1" for authentication purposes, either using it to verify users' identities, or to access an... Attack Vector
63	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/data/platform/manager/sdk/repository/SdkCipherRepositoryTest.kt: 205	details The application uses the hard-coded password "cipherId" for authentication purposes, either using it to verify users' identities, or to access ano... Attack Vector
64	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/ui/tools/feature/send/addedit/AddEditSendViewModelTest.kt: 573	details The application uses the hard-coded password "some-password" for authentication purposes, either using it to verify users' identities, or to acce... Attack Vector
65	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/ui/platform/feature/rootnav/RootNavViewModelTest.kt: 772	details The application uses the hard-coded password "testPassword123" for authentication purposes, either using it to verify users' identities, or to acc... Attack Vector
66	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/manager/VaultLockManagerTest.kt: 2011	details The application uses the hard-coded password "mockValue" for authentication purposes, either using it to verify users' identities, or to access an... Attack Vector
67	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/manager/VaultLockManagerTest.kt: 1955	details The application uses the hard-coded password "mockValue" for authentication purposes, either using it to verify users' identities, or to access an... Attack Vector
68	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/manager/VaultLockManagerTest.kt: 1544	details The application uses the hard-coded password "mockValue" for authentication purposes, either using it to verify users' identities, or to access an... Attack Vector
69	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/manager/VaultLockManagerTest.kt: 1727	details The application uses the hard-coded password "mockValue" for authentication purposes, either using it to verify users' identities, or to access an... Attack Vector
70	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/manager/VaultLockManagerTest.kt: 1443	details The application uses the hard-coded password "mockValue" for authentication purposes, either using it to verify users' identities, or to access an... Attack Vector
71	Use_of_Hardcoded_Password	/app/src/test/kotlin/com/x8bit/bitwarden/data/vault/manager/VaultLockManagerTest.kt: 1036	details The application uses the hard-coded password "mockValue" for authentication purposes, either using it to verify users' identities, or to access an... Attack Vector

More results are available on the CxOne platform

david-livefront · 2026-04-06T15:23:26Z

My apologies, I seemed to have closed this PR with my previous comment.

I have re-opened this here with all the same commits and attributions.

david-livefront · 2026-04-06T18:51:05Z

The updated PR has been merged.

@tajchert Thank you for your contribution!

tajchert · 2026-04-06T19:34:18Z

Thanks, sorry for not responding to the comments to my PR and addressing them @david-livefront

tajchert requested review from a team, brian-livefront and david-livefront as code owners December 7, 2025 15:34

bitwarden-bot changed the title ~~[BWA-209] Fix TOTP countdown freeze when returning to Authenticator app (change Flow to StateFlow)~~ [PM-29309] [BWA-209] Fix TOTP countdown freeze when returning to Authenticator app (change Flow to StateFlow) Dec 7, 2025

bitwarden-bot added community-pr needs-qa labels Dec 7, 2025

tajchert force-pushed the main branch from 5cb471c to e65adda Compare December 7, 2025 15:36

SaintPatrck requested changes Jan 29, 2026

View reviewed changes

david-livefront closed this Apr 6, 2026

david-livefront force-pushed the main branch from e65adda to 61955d7 Compare April 6, 2026 15:13

david-livefront mentioned this pull request Apr 6, 2026

[PM-29309] [BWA-209] bug: Fix TOTP countdown freeze when returning to Authenticator app (change Flow to StateFlow) #6764

Merged

	) = flow<VerificationCodeItem?> {
	): Flow<VerificationCodeItem?> = flow {

		* updated verification codes every second. The StateFlow is cached per-item to prevent
		* recreation on each subscribe, ensuring smooth UI updates when returning from background.

Conversation

tajchert commented Dec 7, 2025

Root Cause

Solution

Changes

Testing

Uh oh!

CLAassistant commented Dec 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bitwarden-bot commented Dec 7, 2025

Uh oh!

SaintPatrck left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

david-livefront commented Apr 6, 2026

Uh oh!

github-actions Bot commented Apr 6, 2026

Uh oh!

david-livefront commented Apr 6, 2026

Uh oh!

david-livefront commented Apr 6, 2026

Uh oh!

tajchert commented Apr 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

CLAassistant commented Dec 7, 2025 •

edited

Loading