[PM-33569] feat: Add notification service extension to update auth request notifications

[matt-livefront]

🎟️ Tracking

PM-33569

📔 Objective

We're switching from background push notifications to alert push notifications for "login with device" auth requests. This adds a UNNotificationServiceExtension that intercepts those alert notifications and updates the body with the requesting user's email before delivery.

• Adds a new BitwardenNotificationExtension app extension target
• Adds DefaultNotificationExtensionHelper in BitwardenShared which reads account state and updates the notification title/body for auth request notifications

The backend sends:

Title: Login requested
Message: Confirm login attempt

The notification extension updates this to:

Title: Login request (localized based on app language)
Message: Confirm login attempt for (localized and email added based on the user's ID)

This handles updating the content of the push notification. There will be a separate PR to handle processing this notification in the app when it's tapped.

[claude]

Claude finished @matt-livefront's task in 2m 49s —— View job

---

Overall Assessment: APPROVE

Re-reviewed the latest commit (6a6015fa2) which extracts the shared userInfo decoding logic into a PushNotificationData.init(userInfo:) initializer, addressing reviewer feedback. Both NotificationExtensionHelper and NotificationService now use this shared initializer, eliminating the code duplication. The new initializer and missingDataDictionary error case are well-tested with happy path, empty dictionary, invalid data, and missing key scenarios.

Code Review Details

No findings. The refactoring is straightforward and correctly preserves error handling behavior in both call sites. The minor behavioral change in NotificationService.decodePayload (now throws instead of returning nil for missing "data" key) is properly caught by the existing error handler at the call site.

[claude]

Overall Assessment: APPROVE

Reviewed the new BitwardenNotificationExtension target and DefaultNotificationExtensionHelper implementation. The extension correctly intercepts auth request push notifications and updates the notification body with the requesting user's email by reading account state from the shared app group UserDefaults. The extension entry point is intentionally thin with all logic in the fully-tested helper class in BitwardenShared.

Code Review Details

No findings. The implementation follows established codebase patterns consistently:

• Error handling falls back to original notification content in all failure paths
• Force unwrap on UserDefaults(suiteName:) matches existing ServiceContainer usage
• Localization is configured via Resources.initialLanguageCode consistent with AppProcessor
• CI workflows, Fastlane provisioning profiles, and XcodeGen project spec are correctly updated
• Test coverage includes happy path, user-not-found, malformed payload, missing data key, and unhandled notification type scenarios

[github-actions]

Checkmarx One – Scan Summary & Details – dc607eee-9192-4fca-833f-031e100fbabf

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 86.20690% with 28 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.96%. Comparing base (b479386) to head (1ec498e).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...cationExtension/NotificationServiceExtension.swift	0.00%	12 Missing ⚠️
...latform/Services/NotificationExtensionHelper.swift	80.95%	8 Missing ⚠️
...form/Models/Domain/PushNotificationDataTests.swift	90.90%	4 Missing ⚠️
...rm/Services/NotificationExtensionHelperTests.swift	95.74%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2444      +/-   ##
==========================================
- Coverage   87.08%   85.96%   -1.13%     
==========================================
  Files        1872     2105     +233     
  Lines      165835   180842   +15007     
==========================================
+ Hits       144417   155457   +11040     
- Misses      21418    25385    +3967     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fedemkr]

Looks good, just some minor comments.

[vvolkgang]

@matt-livefront Triggered runs to test the new provisioning profiles:

1. BWPM - https://github.com/bitwarden/ios/actions/runs/23442727040
2. BWA (double checking everything is ok) - https://github.com/bitwarden/ios/actions/runs/23442739178

edit: both passed!

[github-actions]

Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the new BitwardenNotificationExtension target and DefaultNotificationExtensionHelper that intercepts auth request push notifications and updates the notification body with the requesting user's email. The shared PushNotificationData.init(userInfo:) initializer cleanly deduplicates decoding logic between the new extension helper and the existing NotificationService. All error paths gracefully fall back to delivering the original notification content, and the behavioral change in NotificationService.decodePayload (now throws instead of returning nil for missing "data" key) is safely caught by existing error handlers at both call sites.

Code Review Details

No findings. The implementation is consistent with established codebase patterns for app extensions, and all prior review feedback has been addressed.