[PM-27232] Implement Registration for TDE Users

[quexten]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-27232
bitwarden/server#6671

📔 Objective

Implements registration for TDE users. This uses v2 encryption.

Note

The API changes here are not final and need an update to the automatic API bindings, after the corresponding server change is merged. This PR will only be merged once the binding changes are already in main and removed from this PR.

🚨 Breaking Changes

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation
  team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed
  issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – e836c2e2-230b-4e61-a04c-8b1b337f6922

Great job! No new security vulnerabilities introduced in this pull request

[github-actions]

🔍 SDK Breaking Change Detection Results

SDK Version: km/tde-registration (0618cdc)
Completed: 2025-12-18 12:56:25 UTC
Total Time: 246s

Client	Status	Details
typescript	✅ No breaking changes detected	TypeScript compilation passed with new SDK version - View Details

---

Breaking change detection completed. View SDK workflow

[codecov]

Codecov Report

❌ Patch coverage is 97.94989% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.85%. Comparing base (0a9599e) to head (0618cdc).

Files with missing lines	Patch %	Lines
crates/bitwarden-auth/src/registration.rs	98.10%	6 Missing ⚠️
.../src/key_management/account_cryptographic_state.rs	91.17%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #596      +/-   ##
==========================================
+ Coverage   78.54%   78.85%   +0.31%     
==========================================
  Files         283      283              
  Lines       29251    29625     +374     
==========================================
+ Hits        22975    23362     +387     
+ Misses       6276     6263      -13     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Overall Assessment: APPROVE

Reviewed TDE registration implementation across registration.rs, crypto.rs, account_cryptographic_state.rs, and device_key.rs. The implementation is well-structured with comprehensive test coverage (97.8%) and follows established cryptographic patterns.

See inline comments for details.

[quexten]

Moving to draft until API bindings are updated. I believe all review so far has been addressed, and we should be close to good to go.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud