Merge branch 'main' into experiment/custom-role-complete
Brings the branch up to date with upstream main (5040bcb7, a6a88e79,
46ae59ea).
Conflict resolutions, all in src/api/core/organizations.rs:
* post_bulk_access_collections: kept this branch's up-front validation of
the whole request (groups, users and collections are checked before any
assignment is deleted), using upstream's single-query group check.
* send_invite / edit_member: kept this branch's permission gating around
group assignment. Upstream's new "group belongs to this organization"
check is already covered here - by InviteData::validate for the invite
path and by the explicit pre-validation loop for edit_member.
* post_org_import: took upstream's rewrite, which authorizes pre-existing
collections with Collection::is_writable_by_user instead of
can_access_collection. This closes an issue a security review of this
branch reported as F8: can_access_collection is satisfied by a
read-only assignment, so a member with import permission and read-only
access to a shared collection could plant ciphers in it. This branch's
relationship-index pre-validation is kept on top.
* get_groups_data: adopted upstream's authorization gate. The plain group
list now needs full organization access or a manageable collection; the
details view needs full access. Extended for the custom-role model:
the 'Manage Users'/'Manage Groups' permissions also satisfy the check,
since they are what the route guards require for the details view and a
member holding them may reach no collection of their own.
To make the membership available to that check, the permission-guard
macro in auth.rs now carries the caller's Membership record.
Verified: cargo check, cargo clippy --features sqlite (both clean),
cargo test --features sqlite (47 passed), cargo fmt --all -- --check.
/// Icon service |> The predefined icon services are: internal, bitwarden, duckduckgo, google.
/// To specify a custom icon service, set a URL template with exactly one instance of `{}`,
/// which is replaced with the domain. For example: `https://icon.example.com/domain/{}`.
@ -768,6 +774,11 @@ make_config! {
/// Max burst size for login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `login_ratelimit_seconds`. Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2
login_ratelimit_max_burst: u32,false,def,10;
/// Seconds between unauthenticated requests |> Number of seconds, on average, between requests from the same IP address to any of the rate limited unauthenticated endpoints
/// Max burst size for unauthenticated requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `unauthenticated_ratelimit_seconds`. This is shared between several endpoints, so it needs to be more lenient than the login one
/// Seconds between admin login requests |> Number of seconds, on average, between admin requests from the same IP address before rate limiting kicks in
admin_ratelimit_seconds: u64,false,def,300;
/// Max burst size for admin login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `admin_ratelimit_seconds`
tom27052006
3 weeks ago