[PM-32833] Remove Input Password Flag from Change Password

[rr-bw]

🎟️ Tracking

PM-32833

📔 Objective

This PR removes pm-27086-update-authentication-apis-for-input-password feature flag usage from the ChangePasswordComponent and related files.

Note

This PR is part of a larger group of PRs (split up for easier review) that will each get merged into a base branch for this flag removal work: auth/pm-32833/remove-input-password-flag-base (base PR). That base branch is the one that will get merged to main.

Breakdown of branching structure:

main
 └── auth/pm-32833/remove-input-password-flag-base  ← targets main; accumulates sub-PRs
     ├── auth/pm-32833/registration-finish            ← targets base
     ├── auth/pm-32833/set-initial-password           ← targets base
     ├── auth/pm-32833/change-password                ← targets base [THIS PR 🟢]
     ├── auth/pm-32833/emergency-access               ← targets base
     ├── auth/pm-32833/account-recovery               ← targets base
     └── auth/pm-32833/input-password-component       ← targets base; reviewed LAST

[github-actions]

Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the removal of the pm-27086-update-authentication-apis-for-input-password feature flag from ChangePasswordComponent, the ChangePasswordService abstraction, DefaultChangePasswordService, and WebChangePasswordService, along with corresponding spec cleanup and removal of the pre-flag verifyCurrentPassword helper in InputPasswordComponent. The deprecated rotateUserKeyMasterPasswordAndEncryptedData abstraction method and the preparePasswordChange helper are removed, and the previously flag-gated code paths are promoted to become the only paths. No other callers of the removed ChangePasswordService.rotateUserKeyMasterPasswordAndEncryptedData method remain; remaining references are to the distinct UserKeyRotationService.rotateUserKeyMasterPasswordAndEncryptedData, which is still used by WebChangePasswordService.changePasswordAndRotateUserKey. The SyncService dependency removal from ChangePasswordComponent is safe — fullSync(true) is still invoked inside WebChangePasswordService.changePasswordAndRotateUserKey for the key-rotation path, which was the only path previously reaching syncService.fullSync in the component.

Code Review Details

No findings.

[github-actions]

Checkmarx One – Scan Summary & Details – 3aa25d5e-053a-4217-b53c-94546a8e38d2

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 84.37500% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.02%. Comparing base (9280b12) to head (b589aab).
⚠️ Report is 32 commits behind head on auth/pm-32833/remove-input-password-flag-base.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...ement/change-password/change-password.component.ts	0.00%	5 Missing ⚠️

Additional details and impacted files

@@                                Coverage Diff                                @@
##           auth/pm-32833/remove-input-password-flag-base   #20308      +/-   ##
=================================================================================
- Coverage                                          47.02%   47.02%   -0.01%     
=================================================================================
  Files                                               3913     3913              
  Lines                                             118323   118260      -63     
  Branches                                           18103    18084      -19     
=================================================================================
- Hits                                               55647    55613      -34     
+ Misses                                             58486    58458      -28     
+ Partials                                            4190     4189       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud