Restrict the access module to its actual API surface

Everything the CLI does not name is now pub(super). In wire only the item
DTOs stay public, because model::Item exposes them through its fields; the
auth and session DTOs are internal.

Also drops three imports the blanket allow had been hiding.

Author: detunized

crates/bitwarden-importers/src/importers/onepassword/access/README.md

@@ -35,3 +35,4 @@ into Bitwarden collections. 1P doesn't have folders, only tags.
 - The sign-in domain is taken as a raw string and never validated
 - A vault we hold no key for is skipped silently, and one undecryptable item aborts the whole import
 - The module is under a blanket `allow(dead_code, unused_imports)` until the conversion layer lands
+- Only the item DTOs in `wire` are public; the auth and session ones are `pub(super)`

crates/bitwarden-importers/src/importers/onepassword/access/account_key.rs

@@ -6,7 +6,7 @@ use super::{error::OnePasswordError, kdf};
 
 /// A parsed 1Password Account Key (also called the Secret Key), split into its format, uuid, and
 /// key.
-pub struct AccountKey {
+pub(super) struct AccountKey {
     pub format: String,
     pub uuid: String,
     pub key: String,
@@ -21,7 +21,7 @@ impl Drop for AccountKey {
 impl AccountKey {
     /// Parses a key string such as `A3-RTN9SA-DY9445Y5FF96X6E7B5GPFA95R9`. The string is uppercased
     /// and its dashes removed before splitting into `format` (2), `uuid` (6), and `key` (the rest).
-    pub fn parse(input: &str) -> Result<AccountKey, OnePasswordError> {
+    pub(super) fn parse(input: &str) -> Result<AccountKey, OnePasswordError> {
         let s = input.to_uppercase().replace('-', "");
 
         let Some(format) = s.get(..2) else {
@@ -64,12 +64,12 @@ impl AccountKey {
     }
 
     /// `HKDF-SHA256(ikm = key, salt = uuid, info = format)`, 32 bytes.
-    pub fn hash(&self) -> [u8; 32] {
+    pub(super) fn hash(&self) -> [u8; 32] {
         kdf::hkdf_sha256(&self.format, self.key.as_bytes(), self.uuid.as_bytes())
     }
 
     /// XORs the hash with `bytes`, which must be exactly 32 bytes long.
-    pub fn combine_with(&self, bytes: &[u8]) -> Result<[u8; 32], OnePasswordError> {
+    pub(super) fn combine_with(&self, bytes: &[u8]) -> Result<[u8; 32], OnePasswordError> {
         let mut h = self.hash();
         if h.len() != bytes.len() {
             return Err(OnePasswordError::Internal(

crates/bitwarden-importers/src/importers/onepassword/access/client.rs

@@ -14,7 +14,7 @@ use super::{
     two_factor::TwoFactorUi,
     wire::{
         AccountInfo, EncryptedEnvelope, KeysetsInfo, VaultAccess, VaultAttributes, VaultItem,
-        VaultItemDetails, VaultItemOverview, VaultItemsBatch,
+        VaultItemsBatch,
     },
 };
 

crates/bitwarden-importers/src/importers/onepassword/access/device.rs

@@ -26,7 +26,7 @@ pub fn generate_device_uuid() -> String {
 }
 
 /// Client identity headers sent with every request.
-pub struct ClientInfo {
+pub(super) struct ClientInfo {
     client_name: String,
     client_version: String,
     pub user_agent: String,
@@ -36,7 +36,7 @@ pub struct ClientInfo {
 
 impl ClientInfo {
     /// Impersonates the 1Password desktop client for the current platform.
-    pub fn for_desktop(device_uuid: &str) -> ClientInfo {
+    pub(super) fn for_desktop(device_uuid: &str) -> ClientInfo {
         let platform = PLATFORM;
 
         ClientInfo {
@@ -51,7 +51,7 @@ impl ClientInfo {
         }
     }
 
-    pub fn client_id(&self) -> String {
+    pub(super) fn client_id(&self) -> String {
         format!("{}/{}", self.client_name, self.client_version)
     }
 
@@ -60,7 +60,7 @@ impl ClientInfo {
     /// The real 1Password clients also send `model` and `osVersion`. The server accepted their
     /// removal when this was tested, so they are left out, but add them back if it starts
     /// rejecting the request.
-    pub fn device_body(&self) -> Value {
+    pub(super) fn device_body(&self) -> Value {
         json!({
             "uuid": self.device_uuid,
             "clientName": self.client_name,
@@ -74,7 +74,7 @@ impl ClientInfo {
 }
 
 /// Registers the device with the server.
-pub async fn register_device(
+pub(super) async fn register_device(
     client_info: &ClientInfo,
     rest: &RestClient,
 ) -> Result<(), OnePasswordError> {
@@ -85,7 +85,7 @@ pub async fn register_device(
 }
 
 /// Reauthorizes a previously deleted device.
-pub async fn reauthorize_device(
+pub(super) async fn reauthorize_device(
     client_info: &ClientInfo,
     rest: &RestClient,
 ) -> Result<(), OnePasswordError> {

crates/bitwarden-importers/src/importers/onepassword/access/identity.rs

@@ -13,16 +13,16 @@
 //! an open question. See the development notes in this module's README.
 
 /// The desktop app's build number, sent as the client version and inside the op user agent.
-pub const VERSION: &str = "81210036";
+pub(super) const VERSION: &str = "81210036";
 
 /// The HTTP library the desktop app reports. That app is itself written in Rust, so this is *its*
 /// reqwest version, not ours. Do not sync it with the workspace's reqwest pin; it is part of the
 /// fingerprint, and the two are unrelated.
-pub const HTTP_LIB: &str = "reqwest|0.12.24";
+pub(super) const HTTP_LIB: &str = "reqwest|0.12.24";
 
 /// The per-platform half of the identity. The version and HTTP library above are the same
 /// everywhere, so only these four fields vary.
-pub struct Platform {
+pub(super) struct Platform {
     /// Names the client: `1Password for Mac`.
     pub os: &'static str,
     /// Single-letter platform code, the second field of the op user agent.
@@ -34,15 +34,15 @@ pub struct Platform {
 }
 
 #[cfg(target_os = "macos")]
-pub const PLATFORM: Platform = Platform {
+pub(super) const PLATFORM: Platform = Platform {
     os: "Mac",
     op_code: "M",
     os_suffix: "MacOSX|26.3.1|aarch64",
     os_name: "macOS",
 };
 
 #[cfg(target_os = "linux")]
-pub const PLATFORM: Platform = Platform {
+pub(super) const PLATFORM: Platform = Platform {
     os: "Linux",
     op_code: "L",
     os_suffix: "Linux|Ubuntu 24.04|x86_64",
@@ -51,7 +51,7 @@ pub const PLATFORM: Platform = Platform {
 
 // Every other target, wasm32 included, presents as the Windows build.
 #[cfg(not(any(target_os = "macos", target_os = "linux")))]
-pub const PLATFORM: Platform = Platform {
+pub(super) const PLATFORM: Platform = Platform {
     os: "Windows",
     op_code: "W",
     os_suffix: "Windows|25H2 11.0.26200|x86_64",

crates/bitwarden-importers/src/importers/onepassword/access/kdf.rs

@@ -8,7 +8,7 @@ use sha2::{Sha256, Sha512};
 use super::{account_key::AccountKey, error::OnePasswordError};
 
 /// HKDF-SHA256 producing 32 bytes, with `method` as the `info` parameter.
-pub fn hkdf_sha256(method: &str, ikm: &[u8], salt: &[u8]) -> [u8; 32] {
+pub(super) fn hkdf_sha256(method: &str, ikm: &[u8], salt: &[u8]) -> [u8; 32] {
     let hk = Hkdf::<Sha256>::new(Some(salt), ikm);
     let mut okm = [0u8; 32];
     hk.expand(method.as_bytes(), &mut okm)
@@ -20,7 +20,7 @@ pub fn hkdf_sha256(method: &str, ikm: &[u8], salt: &[u8]) -> [u8; 32] {
 ///
 /// `PBES2[g]-HS256` uses PBKDF2-HMAC-SHA256, `PBES2[g]-HS512` uses PBKDF2-HMAC-SHA512, both 32
 /// bytes.
-pub fn pbes2(
+pub(super) fn pbes2(
     method: &str,
     password: &str,
     salt: &[u8],
@@ -48,7 +48,7 @@ pub fn pbes2(
 ///
 /// `k1 = HKDF(info = algorithm, ikm = salt, salt = lower(username))`; `k2 = PBES2(algorithm,
 /// NFC(password), k1, iterations)`; result `= account_key.combine_with(k2)`.
-pub fn derive_master_key(
+pub(super) fn derive_master_key(
     algorithm: &str,
     iterations: u32,
     salt: &[u8],

crates/bitwarden-importers/src/importers/onepassword/access/keychain.rs

@@ -10,7 +10,7 @@ use super::{
     kdf,
     opdata::{AesKey, Encrypted, decode64_loose},
     rsa::RsaKey,
-    wire::{AesKeyJson, EncryptedEnvelope, KeysetInfo, KeysetsInfo, RsaKeyJwk},
+    wire::{AesKeyJson, EncryptedEnvelope, KeysetInfo, RsaKeyJwk},
 };
 
 const AES_SCHEME: &str = "A256GCM";
@@ -19,21 +19,21 @@ const MASTER_KEY_ID: &str = "mp";
 
 /// A store of AES and RSA keys keyed by their kid.
 #[derive(Default)]
-pub struct Keychain {
+pub(super) struct Keychain {
     aes: HashMap<String, AesKey>,
     rsa: HashMap<String, RsaKey>,
 }
 
 impl Keychain {
-    pub fn new() -> Keychain {
+    pub(super) fn new() -> Keychain {
         Keychain::default()
     }
 
-    pub fn add_aes(&mut self, key: AesKey) {
+    pub(super) fn add_aes(&mut self, key: AesKey) {
         self.aes.insert(key.id.clone(), key);
     }
 
-    pub fn add_rsa(&mut self, key: RsaKey) {
+    pub(super) fn add_rsa(&mut self, key: RsaKey) {
         self.rsa.insert(key.id.clone(), key);
     }
 
@@ -48,7 +48,7 @@ impl Keychain {
     }
 
     /// Decrypts an envelope by dispatching on its scheme to the AES or RSA key named by its kid.
-    pub fn decrypt(&self, encrypted: &Encrypted) -> Result<Vec<u8>, OnePasswordError> {
+    pub(super) fn decrypt(&self, encrypted: &Encrypted) -> Result<Vec<u8>, OnePasswordError> {
         if encrypted.scheme == AES_SCHEME {
             let key = self.aes.get(&encrypted.key_id).ok_or_else(|| {
                 OnePasswordError::Internal(format!("AES key '{}' not found", encrypted.key_id))
@@ -73,7 +73,7 @@ impl Keychain {
     ///
     /// A scheme this module does not implement is an error, not a `false`: the caller cannot tell
     /// "we lack the key" from "we cannot read this format" otherwise, and would silently drop data.
-    pub fn can_decrypt(&self, encrypted: &Encrypted) -> Result<bool, OnePasswordError> {
+    pub(super) fn can_decrypt(&self, encrypted: &Encrypted) -> Result<bool, OnePasswordError> {
         if encrypted.scheme == AES_SCHEME {
             return Ok(self.aes.contains_key(&encrypted.key_id));
         }
@@ -89,7 +89,7 @@ impl Keychain {
     }
 
     /// Decrypts an envelope and parses its JSON plaintext.
-    pub fn decrypt_json<T: DeserializeOwned>(
+    pub(super) fn decrypt_json<T: DeserializeOwned>(
         &self,
         envelope: &EncryptedEnvelope,
     ) -> Result<T, OnePasswordError> {
@@ -98,7 +98,7 @@ impl Keychain {
     }
 
     /// Derives the master key from the credentials, then decrypts every keyset into the keychain.
-    pub fn decrypt_keysets(
+    pub(super) fn decrypt_keysets(
         &mut self,
         keysets: &[KeysetInfo],
         username: &str,
@@ -132,7 +132,7 @@ impl Keychain {
     }
 
     /// Decrypts an encrypted AES key and adds it to the keychain.
-    pub fn decrypt_aes_key(
+    pub(super) fn decrypt_aes_key(
         &mut self,
         envelope: &EncryptedEnvelope,
     ) -> Result<(), OnePasswordError> {
@@ -229,7 +229,7 @@ fn encrypted_by(keyset: &KeysetInfo) -> &str {
 mod tests {
     use data_encoding::HEXLOWER;
 
-    use super::*;
+    use super::{super::wire::KeysetsInfo, *};
 
     fn hex(s: &str) -> Vec<u8> {
         HEXLOWER.decode(s.as_bytes()).expect("valid hex")

crates/bitwarden-importers/src/importers/onepassword/access/login.rs

@@ -29,15 +29,15 @@ const AUTH_COMPLETE_ENDPOINT: &str = "v2/auth/complete";
 
 /// The result of a single login attempt: a finished session, or a rejected OTP that asks for a full
 /// restart.
-pub enum LoginOutcome {
+pub(super) enum LoginOutcome {
     /// Authentication succeeded.
     Success(Box<Session>),
     /// The submitted TOTP code was rejected; the caller should retry from the start.
     BadOtp,
 }
 
 /// Confirms the account offers a given auth method.
-pub async fn fetch_auth_methods(
+pub(super) async fn fetch_auth_methods(
     username: &str,
     rest: &RestClient,
 ) -> Result<LoginInfo, OnePasswordError> {
@@ -47,7 +47,7 @@ pub async fn fetch_auth_methods(
 
 /// Runs one full login sequence: start a session, exchange SRP, verify the key, and drive 2FA if
 /// the server asks for it.
-pub async fn login_attempt(
+pub(super) async fn login_attempt(
     credentials: &Credentials,
     account_key: &AccountKey,
     client_info: &ClientInfo,

crates/bitwarden-importers/src/importers/onepassword/access/mac.rs

@@ -13,15 +13,15 @@ use super::{error::OnePasswordError, opdata::AesKey};
 const SESSION_HMAC_SECRET: &str = "He never wears a Mac, in the pouring rain. Very strange.";
 
 /// Signs requests with the per-session MAC header, bumping the request id on each signature.
-pub struct MacSigner {
+pub(super) struct MacSigner {
     session_id: String,
     salt: [u8; 32],
     request_id: AtomicU32,
 }
 
 impl MacSigner {
     /// Creates a signer from the session key, starting from a random request id.
-    pub fn new(session_key: &AesKey) -> MacSigner {
+    pub(super) fn new(session_key: &AesKey) -> MacSigner {
         Self::with_request_id(session_key, bitwarden_random::rng().next_u32())
     }
 
@@ -36,7 +36,7 @@ impl MacSigner {
     /// Returns the `X-AgileBits-MAC` header value for a request and takes the next request id.
     ///
     /// The id only has to differ between requests, so nothing needs ordering against other threads.
-    pub fn sign(&self, url: &str, method: &str) -> Result<String, OnePasswordError> {
+    pub(super) fn sign(&self, url: &str, method: &str) -> Result<String, OnePasswordError> {
         let id = self.request_id.fetch_add(1, Ordering::Relaxed);
 
         let message = self.calculate_auth_message(url, method, id)?;

crates/bitwarden-importers/src/importers/onepassword/access/model.rs

@@ -86,7 +86,7 @@ pub enum ItemCategory {
 impl ItemCategory {
     /// Maps a 1Password template id to a category. Extends the `TemplateId` handling in
     /// `Client.ConvertVaultItem` to the full standard template set.
-    pub fn from_template_id(id: &str) -> ItemCategory {
+    pub(super) fn from_template_id(id: &str) -> ItemCategory {
         match id {
             "001" => ItemCategory::Login,
             "002" => ItemCategory::CreditCard,