[PM-33393] fix: TOTP auth key can be shown by users without permission [bug-factory poc] (#7487)

Co-authored-by: bug-factory <bug-factory@bitwarden.com>

app/src/main/kotlin/com/x8bit/bitwarden/ui/vault/feature/addedit/VaultAddEditLoginItems.kt

@@ -366,6 +366,16 @@ private fun TotpRow(
     onTotpSetupClick: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
+    if (!canViewTotp && totpKey != null) {
+        BitwardenHiddenPasswordField(
+            label = stringResource(id = BitwardenString.authenticator_key),
+            value = totpKey,
+            passwordFieldTestTag = "LoginTotpEntry",
+            cardStyle = CardStyle.Full,
+            modifier = modifier.fillMaxWidth(),
+        )
+        return
+    }
     BitwardenPasswordField(
         label = stringResource(id = BitwardenString.authenticator_key),
         value = totpKey.orEmpty(),

app/src/test/kotlin/com/x8bit/bitwarden/ui/vault/feature/addedit/VaultAddEditScreenTest.kt

@@ -1333,13 +1333,19 @@ class VaultAddEditScreenTest : BitwardenComposeTest() {
         }
 
         composeTestRule
-            .onNodeWithTextAfterScroll(text = "Set up authenticator key")
-            .assertIsDisplayed()
+            .onNodeWithTextAfterScroll(text = "Authenticator key")
+            .assertTextEquals("Authenticator key", "••••••••")
             .assertIsNotEnabled()
-
-        composeTestRule.assertScrollableNodeDoesNotExist("Delete")
-        composeTestRule.assertScrollableNodeDoesNotExist("Copy TOTP")
-        composeTestRule.assertScrollableNodeDoesNotExist("Camera")
+        composeTestRule
+            .onNodeWithContentDescription("Show")
+            .assertDoesNotExist()
+        composeTestRule
+            .onNodeWithContentDescription("Copy TOTP")
+            .assertDoesNotExist()
+        composeTestRule
+            .onNodeWithContentDescription("Delete")
+            .assertDoesNotExist()
+        composeTestRule.assertScrollableNodeDoesNotExist("Set up authenticator key")
     }
 
     @Test