[PM-33569] feat: Add notification service extension to update auth request notifications

[matt-livefront]

🎟️ Tracking

PM-33569

📔 Objective

We're switching from background push notifications to alert push notifications for "login with device" auth requests. This adds a UNNotificationServiceExtension that intercepts those alert notifications and updates the body with the requesting user's email before delivery.

• Adds a new BitwardenNotificationExtension app extension target
• Adds DefaultNotificationExtensionHelper in BitwardenShared which reads account state and updates the notification title/body for auth request notifications

The backend sends:

Title: Login requested
Message: Confirm login attempt

The notification extension updates this to:

Title: Login request (localized based on app language)
Message: Confirm login attempt for (localized and email added based on the user's ID)

This handles updating the content of the push notification. There will be a separate PR to handle processing this notification in the app when it's tapped.

[claude]

Claude finished @matt-livefront's task in 2m 49s —— View job

---

Overall Assessment: APPROVE

Re-reviewed the latest commit (6a6015fa2) which extracts the shared userInfo decoding logic into a PushNotificationData.init(userInfo:) initializer, addressing reviewer feedback. Both NotificationExtensionHelper and NotificationService now use this shared initializer, eliminating the code duplication. The new initializer and missingDataDictionary error case are well-tested with happy path, empty dictionary, invalid data, and missing key scenarios.

Code Review Details

No findings. The refactoring is straightforward and correctly preserves error handling behavior in both call sites. The minor behavioral change in NotificationService.decodePayload (now throws instead of returning nil for missing "data" key) is properly caught by the existing error handler at the call site.

[claude]

Overall Assessment: APPROVE

Reviewed the new BitwardenNotificationExtension target and DefaultNotificationExtensionHelper implementation. The extension correctly intercepts auth request push notifications and updates the notification body with the requesting user's email by reading account state from the shared app group UserDefaults. The extension entry point is intentionally thin with all logic in the fully-tested helper class in BitwardenShared.

Code Review Details

No findings. The implementation follows established codebase patterns consistently:

• Error handling falls back to original notification content in all failure paths
• Force unwrap on UserDefaults(suiteName:) matches existing ServiceContainer usage
• Localization is configured via Resources.initialLanguageCode consistent with AppProcessor
• CI workflows, Fastlane provisioning profiles, and XcodeGen project spec are correctly updated
• Test coverage includes happy path, user-not-found, malformed payload, missing data key, and unhandled notification type scenarios

[github-actions]

Checkmarx One – Scan Summary & Details – 4e0b708f-eb87-4231-9bab-223775442cbd

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 86.20690% with 28 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.72%. Comparing base (48115b8) to head (6a6015f).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
...cationExtension/NotificationServiceExtension.swift	0.00%	12 Missing ⚠️
...latform/Services/NotificationExtensionHelper.swift	80.95%	8 Missing ⚠️
...form/Models/Domain/PushNotificationDataTests.swift	90.90%	4 Missing ⚠️
...rm/Services/NotificationExtensionHelperTests.swift	95.74%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2444      +/-   ##
==========================================
- Coverage   86.86%   85.72%   -1.15%     
==========================================
  Files        1841     2077     +236     
  Lines      162244   177346   +15102     
==========================================
+ Hits       140941   152026   +11085     
- Misses      21303    25320    +4017     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fedemkr]

Looks good, just some minor comments.

[vvolkgang]

@matt-livefront Triggered runs to test the new provisioning profiles:

1. BWPM - https://github.com/bitwarden/ios/actions/runs/23442727040
2. BWA (double checking everything is ok) - https://github.com/bitwarden/ios/actions/runs/23442739178

edit: both passed!