fix(sdk-core): validate password for UMKR share acceptance

Author: zahin-mohammad

modules/sdk-core/src/bitgo/bitgoBase.ts

@@ -60,5 +60,6 @@ export interface BitGoBase {
   options(url: string): BitGoRequest;
   setRequestTracer(reqTracer: IRequestTracer): void;
   url(path: string, version?: number): string;
+  verifyPassword(params: { password: string }): Promise<boolean>;
   register(name: string, coin: CoinConstructor): void;
 }

modules/sdk-core/src/bitgo/wallet/wallets.ts

@@ -1358,8 +1358,11 @@ export class Wallets implements IWallets {
       throw new Error('No valid wallet shares found to accept');
     }
 
+    const hasSharesRequiringDecryption = walletShares.some(
+      (walletShare) => !walletShare.userMultiKeyRotationRequired && walletShare.keychain
+    );
     let sharingKeychainPrv: string | undefined;
-    if (walletShares.some((walletShare) => !walletShare.userMultiKeyRotationRequired && walletShare.keychain)) {
+    if (hasSharesRequiringDecryption) {
       const sharingKeychain = await this.bitgo.getECDHKeychain();
       if (_.isUndefined(sharingKeychain.encryptedXprv)) {
         throw new Error('encryptedXprv was not found on sharing keychain');
@@ -1369,6 +1372,8 @@ export class Wallets implements IWallets {
         password: params.userLoginPassword,
         input: sharingKeychain.encryptedXprv,
       });
+    } else if (!(await this.bitgo.verifyPassword({ password: params.userLoginPassword }))) {
+      throw new Error('Incorrect password. Please try again.');
     }
     const newWalletPassphrase = params.newWalletPassphrase || params.userLoginPassword;
     const webauthnInfo = params.webauthnInfo;

modules/sdk-core/test/unit/bitgo/wallet/walletsEncryptionVersion.ts

@@ -42,6 +42,7 @@ describe('Wallets - encryptionVersion threading', function () {
           .returns({ result: sinon.stub().resolves({ acceptedWalletShares: [], walletShareUpdateErrors: [] }) }),
       }),
       getECDHKeychain: sinon.stub().resolves({ encryptedXprv: 'encXprv' }),
+      verifyPassword: sinon.stub().resolves(true),
       setRequestTracer: sinon.stub(),
       url: sinon.stub().returns('/test/url'),
     };
@@ -145,18 +146,34 @@ describe('Wallets - encryptionVersion threading', function () {
       assert.strictEqual(call.args[1], undefined);
     });
 
-    it('accepts a UMKR-only batch without fetching the ECDH keychain', async function () {
-      mockBitGo.getECDHKeychain.resolves(new Error('missing'));
-
+    it('validates the login password without fetching the ECDH keychain for a UMKR-only batch', async function () {
       await wallets.bulkAcceptShare({
         walletShareIds: ['share-id'],
         userLoginPassword: 'login-password',
       });
 
       assert.strictEqual(mockBitGo.getECDHKeychain.called, false);
+      assert.deepStrictEqual(mockBitGo.verifyPassword.firstCall.args, [{ password: 'login-password' }]);
       assert.strictEqual(mockBitGo.put.called, true);
     });
 
+    it('rejects a UMKR-only batch when the login password is incorrect', async function () {
+      mockBitGo.verifyPassword.resolves(false);
+
+      await assert.rejects(
+        wallets.bulkAcceptShare({
+          walletShareIds: ['share-id'],
+          userLoginPassword: 'incorrect-password',
+        }),
+        { message: 'Incorrect password. Please try again.' }
+      );
+
+      assert.strictEqual(mockBitGo.getECDHKeychain.called, false);
+      assert.strictEqual(mockBitGo.createEncryptionSession.called, false);
+      assert.strictEqual(mockKeychains.create.called, false);
+      assert.strictEqual(mockBitGo.put.called, false);
+    });
+
     it('still requires the ECDH keychain when the batch also holds a share with a keychain', async function () {
       mockBitGo.get.returns({
         result: sinon.stub().resolves({
@@ -187,6 +204,7 @@ describe('Wallets - encryptionVersion threading', function () {
         { message: 'encryptedXprv was not found on sharing keychain' }
       );
       assert.strictEqual(mockBitGo.getECDHKeychain.calledOnce, true);
+      assert.strictEqual(mockBitGo.verifyPassword.called, false);
     });
 
     it('processes shares in batches of 16 to avoid WASM memory exhaustion', async function () {