Merge remote-tracking branch 'upstream/main' into feature/custom-role-permissions

# Conflicts:
#	src/api/core/events.rs
#	src/api/core/organizations.rs

.env.template

@@ -518,6 +518,9 @@
 ## Prevent users from logging in directly without going through SSO
 # SSO_ONLY=false
 
+## Allow SSO flow to create account. You probably want to disable it when using a public provider.
+# SSO_SIGNUPS_ALLOWED=true
+
 ## On SSO Signup if a user with a matching email already exists make the association
 # SSO_SIGNUPS_MATCH_EMAIL=true
 

migrations/mysql/2024-03-13-170000_sso_users_cascade/up.sql

@@ -1,15 +1,31 @@
--- Dynamically create DROP FOREIGN KEY
+SELECT if (
--- Some versions of MySQL or MariaDB might fail if the key doesn't exists
+    EXISTS(
--- This checks if the key exists, and if so, will drop it.
+        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
-SET @drop_sso_fk = IF((SELECT true FROM information_schema.TABLE_CONSTRAINTS WHERE
+            WHERE TABLE_SCHEMA = DATABASE()
-    CONSTRAINT_SCHEMA = DATABASE() AND
+                AND TABLE_NAME = 'sso_users'
-    TABLE_NAME = 'sso_users' AND
+                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
-    CONSTRAINT_NAME = 'sso_users_ibfk_1' AND
+                AND CONSTRAINT_NAME = 'sso_users_ibfk_1'
-    CONSTRAINT_TYPE = 'FOREIGN KEY') = true,
+    )
-    'ALTER TABLE sso_users DROP FOREIGN KEY sso_users_ibfk_1',
+    ,'ALTER TABLE sso_users DROP FOREIGN KEY `sso_users_ibfk_1`'
-    'SELECT 1');
+    ,'SELECT "info: FK sso_users_ibfk_1 does not exist."'
-PREPARE stmt FROM @drop_sso_fk;
+) INTO @drop_stmt;
-EXECUTE stmt;
+PREPARE drop_stmt FROM @drop_stmt;
-DEALLOCATE PREPARE stmt;
+EXECUTE drop_stmt;
+
+SELECT if (
+    EXISTS(
+        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
+            WHERE TABLE_SCHEMA = DATABASE()
+                AND TABLE_NAME = 'sso_users'
+                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
+                AND CONSTRAINT_NAME = '1'
+    )
+    ,'ALTER TABLE sso_users DROP FOREIGN KEY `1`'
+    ,'SELECT "info: FK sso_users 1 does not exist."'
+) INTO @drop_stmt;
+PREPARE drop_stmt FROM @drop_stmt;
+EXECUTE drop_stmt;
+
+DEALLOCATE PREPARE drop_stmt;
 
 ALTER TABLE sso_users ADD FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE;

playwright/docker-compose.yml

@@ -61,7 +61,7 @@ services:
   Mariadb:
     profiles: ["playwright"]
     container_name: playwright_mariadb
-    image: mariadb:11.2.4
+    image: mariadb:12.2.2
     env_file: test.env
     healthcheck:
       test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]

src/api/admin.rs

@@ -425,7 +425,7 @@ async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyR
 
     for membership in memberships {
         log_event(
-            EventType::OrganizationUserDeleted as i32,
+            EventType::OrganizationUserDeleted,
             &membership.uuid,
             &membership.org_uuid,
             &ACTING_ADMIN_USER.into(),
@@ -446,7 +446,7 @@ async fn delete_sso_user(user_id: UserId, token: AdminToken, conn: DbConn) -> Em
 
     for membership in memberships {
         log_event(
-            EventType::OrganizationUserUnlinkedSso as i32,
+            EventType::OrganizationUserUnlinkedSso,
             &membership.uuid,
             &membership.org_uuid,
             &ACTING_ADMIN_USER.into(),
@@ -595,7 +595,7 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
     OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
 
     log_event(
-        EventType::OrganizationUserUpdated as i32,
+        EventType::OrganizationUserUpdated,
         &member_to_edit.uuid,
         &data.org_uuid,
         &ACTING_ADMIN_USER.into(),

src/api/core/ciphers.rs

@@ -167,7 +167,7 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
         api::core::get_eq_domains(&headers, true).into_inner()
     };
 
-    // This is very similar to the the userDecryptionOptions sent in connect/token,
+    // This is very similar to the userDecryptionOptions sent in connect/token,
     // but as of 2025-12-19 they're both using different casing conventions.
     let has_master_password = !headers.user.password_hash.is_empty();
     let master_password_unlock = if has_master_password {
@@ -561,16 +561,8 @@ pub async fn update_cipher_from_data(
                 (_, _) => EventType::CipherUpdated,
             };
 
-            log_event(
+            log_event(event_type, &cipher.uuid, org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, conn)
-                event_type as i32,
+                .await;
-                &cipher.uuid,
-                org_id,
-                &headers.user.uuid,
-                headers.device.atype,
-                &headers.ip.ip,
-                conn,
-            )
-            .await;
         }
         nt.send_cipher_update(
             ut,
@@ -874,7 +866,7 @@ async fn post_collections_update(
     .await;
 
     log_event(
-        EventType::CipherUpdatedCollections as i32,
+        EventType::CipherUpdatedCollections,
         &cipher.uuid,
         org_uuid,
         &headers.user.uuid,
@@ -954,7 +946,7 @@ async fn post_collections_admin(
     .await;
 
     log_event(
-        EventType::CipherUpdatedCollections as i32,
+        EventType::CipherUpdatedCollections,
         &cipher.uuid,
         org_uuid,
         &headers.user.uuid,
@@ -1359,7 +1351,7 @@ async fn save_attachment(
 
     if let Some(org_id) = &cipher.organization_uuid {
         log_event(
-            EventType::CipherAttachmentCreated as i32,
+            EventType::CipherAttachmentCreated,
             &cipher.uuid,
             org_id,
             &headers.user.uuid,
@@ -1720,7 +1712,7 @@ async fn purge_org_vault(
             nt.send_user_update(UpdateType::SyncVault, &user, headers.device.push_uuid.as_ref(), &conn).await;
 
             log_event(
-                EventType::OrganizationPurgedVault as i32,
+                EventType::OrganizationPurgedVault,
                 &organization.org_id,
                 &organization.org_id,
                 &user.uuid,
@@ -1848,9 +1840,9 @@ async fn delete_cipher_by_uuid(
         let event_type = if *delete_options == CipherDeleteOptions::SoftSingle
             || *delete_options == CipherDeleteOptions::SoftMulti
         {
-            EventType::CipherSoftDeleted as i32
+            EventType::CipherSoftDeleted
         } else {
-            EventType::CipherDeleted as i32
+            EventType::CipherDeleted
         };
 
         log_event(event_type, &cipher.uuid, &org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, conn)
@@ -1919,7 +1911,7 @@ async fn restore_cipher_by_uuid(
 
     if let Some(org_id) = &cipher.organization_uuid {
         log_event(
-            EventType::CipherRestored as i32,
+            EventType::CipherRestored,
             &cipher.uuid.clone(),
             org_id,
             &headers.user.uuid,
@@ -1996,7 +1988,7 @@ async fn delete_cipher_attachment_by_id(
 
     if let Some(ref org_id) = cipher.organization_uuid {
         log_event(
-            EventType::CipherAttachmentDeleted as i32,
+            EventType::CipherAttachmentDeleted,
             &cipher.uuid,
             org_id,
             &headers.user.uuid,

src/api/core/events.rs

@@ -419,7 +419,7 @@ async fn log_user_event_impl(
 }
 
 pub async fn log_event(
-    event_type: i32,
+    event_type: EventType,
     source_uuid: &str,
     org_id: &OrganizationId,
     act_user_id: &UserId,
@@ -430,7 +430,7 @@ pub async fn log_event(
     if !CONFIG.org_events_enabled() {
         return;
     }
-    log_event_impl(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
+    log_event_impl(event_type as i32, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
 }
 
 #[expect(clippy::too_many_arguments)]

src/api/core/organizations.rs

@@ -273,7 +273,7 @@ async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, c
     }
 
     log_event(
-        EventType::OrganizationUserLeft as i32,
+        EventType::OrganizationUserLeft,
         &membership.uuid,
         &org_id,
         &headers.user.uuid,
@@ -331,7 +331,7 @@ async fn post_organization(
     org.save(&conn).await?;
 
     log_event(
-        EventType::OrganizationUpdated as i32,
+        EventType::OrganizationUpdated,
         org_id.as_ref(),
         &org_id,
         &headers.user.uuid,
@@ -655,7 +655,7 @@ async fn post_organization_collections(
     // Emit the success event only after all requested assignments and the creator's object-scoped
     // manage grant have been persisted. A later write failure must not leave a false audit record.
     log_event(
-        EventType::CollectionCreated as i32,
+        EventType::CollectionCreated,
         &collection.uuid,
         &org_id,
         &headers.user.uuid,
@@ -735,7 +735,7 @@ async fn post_bulk_access_collections(
         collection.save(&conn).await?;
 
         log_event(
-            EventType::CollectionUpdated as i32,
+            EventType::CollectionUpdated,
             &collection.uuid,
             &org_id,
             &headers.user.uuid,
@@ -825,7 +825,7 @@ async fn post_organization_collection_update(
     collection.save(&conn).await?;
 
     log_event(
-        EventType::CollectionUpdated as i32,
+        EventType::CollectionUpdated,
         &collection.uuid,
         &org_id,
         &headers.user.uuid,
@@ -895,7 +895,7 @@ async fn delete_organization_collection_impl(
         err!("Collection not found", "Collection does not exist or does not belong to this organization")
     };
     log_event(
-        EventType::CollectionDeleted as i32,
+        EventType::CollectionDeleted,
         &collection.uuid,
         org_id,
         &headers.user.uuid,
@@ -1567,7 +1567,7 @@ async fn send_invite(
         }
 
         log_event(
-            EventType::OrganizationUserInvited as i32,
+            EventType::OrganizationUserInvited,
             &new_member.uuid,
             &org_id,
             &headers.user.uuid,
@@ -1893,7 +1893,7 @@ async fn confirm_invite_impl(
     OrgPolicy::check_user_allowed(&member_to_confirm, "confirm", conn).await?;
 
     log_event(
-        EventType::OrganizationUserConfirmed as i32,
+        EventType::OrganizationUserConfirmed,
         &member_to_confirm.uuid,
         org_id,
         &headers.user.uuid,
@@ -2233,7 +2233,7 @@ async fn edit_member(
     }
 
     log_event(
-        EventType::OrganizationUserUpdated as i32,
+        EventType::OrganizationUserUpdated,
         &member_to_edit.uuid,
         &org_id,
         &headers.user.uuid,
@@ -2320,7 +2320,7 @@ async fn delete_member_impl(
     }
 
     log_event(
-        EventType::OrganizationUserRemoved as i32,
+        EventType::OrganizationUserRemoved,
         &member_to_delete.uuid,
         org_id,
         &headers.user.uuid,
@@ -2799,7 +2799,7 @@ async fn put_policy(
                 }
 
                 log_event(
-                    EventType::OrganizationUserRemoved as i32,
+                    EventType::OrganizationUserRemoved,
                     &member.uuid,
                     &org_id,
                     &headers.user.uuid,
@@ -2825,7 +2825,7 @@ async fn put_policy(
     policy.save(&conn).await?;
 
     log_event(
-        EventType::PolicyUpdated as i32,
+        EventType::PolicyUpdated,
         policy.uuid.as_ref(),
         &org_id,
         &headers.user.uuid,
@@ -2994,7 +2994,7 @@ async fn revoke_member_impl(
             member.save(conn).await?;
 
             log_event(
-                EventType::OrganizationUserRevoked as i32,
+                EventType::OrganizationUserRevoked,
                 &member.uuid,
                 org_id,
                 &headers.user.uuid,
@@ -3092,7 +3092,7 @@ async fn restore_member_impl(
             member.save(conn).await?;
 
             log_event(
-                EventType::OrganizationUserRestored as i32,
+                EventType::OrganizationUserRestored,
                 &member.uuid,
                 org_id,
                 &headers.user.uuid,
@@ -3294,7 +3294,7 @@ async fn post_groups(
     let group = group_request.to_group(&org_id);
 
     log_event(
-        EventType::GroupCreated as i32,
+        EventType::GroupCreated,
         &group.uuid,
         &org_id,
         &headers.user.uuid,
@@ -3417,7 +3417,7 @@ async fn put_group(
     // change the caller may not make, and an event written before it recorded an update that never
     // happened.
     log_event(
-        EventType::GroupUpdated as i32,
+        EventType::GroupUpdated,
         &group_id,
         &org_id,
         &headers.user.uuid,
@@ -3766,7 +3766,7 @@ async fn add_update_group(
             user_entry.save(conn).await?;
 
             log_event(
-                EventType::OrganizationUserUpdatedGroups as i32,
+                EventType::OrganizationUserUpdatedGroups,
                 &assigned_member,
                 &org_id,
                 &headers.user.uuid,
@@ -3890,7 +3890,7 @@ async fn delete_authorized_group(
     conn: &DbConn,
 ) -> EmptyResult {
     log_event(
-        EventType::GroupDeleted as i32,
+        EventType::GroupDeleted,
         &group.uuid,
         org_id,
         &headers.user.uuid,
@@ -4047,7 +4047,7 @@ async fn put_group_members(
         user_entry.save(&conn).await?;
 
         log_event(
-            EventType::OrganizationUserUpdatedGroups as i32,
+            EventType::OrganizationUserUpdatedGroups,
             &assigned_member,
             &org_id,
             &headers.user.uuid,
@@ -4099,7 +4099,7 @@ async fn post_delete_group_member(
     }
 
     log_event(
-        EventType::OrganizationUserUpdatedGroups as i32,
+        EventType::OrganizationUserUpdatedGroups,
         &member_id,
         &org_id,
         &headers.user.uuid,
@@ -4235,7 +4235,7 @@ async fn recover_account(
     nt.send_logout(&user, None, &conn).await;
 
     log_event(
-        EventType::OrganizationUserAdminResetPassword as i32,
+        EventType::OrganizationUserAdminResetPassword,
         &member_id,
         &org_id,
         &headers.user.uuid,
@@ -4362,9 +4362,9 @@ async fn put_reset_password_enrollment(
     membership.save(&conn).await?;
 
     let event_type = if membership.reset_password_key.is_some() {
-        EventType::OrganizationUserResetPasswordEnroll as i32
+        EventType::OrganizationUserResetPasswordEnroll
     } else {
-        EventType::OrganizationUserResetPasswordWithdraw as i32
+        EventType::OrganizationUserResetPasswordWithdraw
     };
 
     log_event(event_type, &membership.uuid, &org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)

src/api/core/two_factor/mod.rs

@@ -190,7 +190,7 @@ pub async fn enforce_2fa_policy(
             member.save(conn).await?;
 
             log_event(
-                EventType::OrganizationUserRevoked as i32,
+                EventType::OrganizationUserRevoked,
                 &member.uuid,
                 &member.org_uuid,
                 act_user_id,
@@ -228,16 +228,8 @@ pub async fn enforce_2fa_policy_for_org(
             member.revoke();
             member.save(conn).await?;
 
-            log_event(
+            log_event(EventType::OrganizationUserRevoked, &member.uuid, org_id, act_user_id, device_type, ip, conn)
-                EventType::OrganizationUserRevoked as i32,
+                .await;
-                &member.uuid,
-                org_id,
-                act_user_id,
-                device_type,
-                ip,
-                conn,
-            )
-            .await;
         }
     }
 

src/api/identity.rs

@@ -234,6 +234,24 @@ async fn sso_login(
                     }
                 )
             }
+            Some((user, None))
+                if user.private_key.is_none()
+                    && !CONFIG.sso_signups_allowed()
+                    && !CONFIG.is_email_domain_allowed(&user.email)
+                    && !CONFIG.mail_enabled()
+                    && Invitation::find_by_mail(&user.email, conn).await.is_none() =>
+            {
+                error!(
+                    "Login failure ({}), no invitation with email ({}) was found",
+                    user_infos.identifier, user.email
+                );
+                err_silent!(
+                    "Missing invitation",
+                    ErrorEvent {
+                        event: EventType::UserFailedLogIn
+                    }
+                )
+            }
             Some((user, None)) if user.private_key.is_some() && !CONFIG.sso_signups_match_email() => {
                 error!(
                     "Login failure ({}), existing non SSO user ({}) with same email ({}) and association is disabled",
@@ -281,7 +299,15 @@ async fn sso_login(
     // Will trigger 2FA flow if needed
     let (user, mut device, twofactor_token, sso_user) = match user_with_sso {
         None => {
-            if !CONFIG.is_email_domain_allowed(&user_infos.email) {
+            if !CONFIG.is_sso_signup_allowed(&user_infos.email) {
+                if CONFIG.signups_domains_whitelist().is_empty() {
+                    err!(
+                        "Signups are disabled. You will need an invitation",
+                        ErrorEvent {
+                            event: EventType::UserFailedLogIn
+                        }
+                    );
+                }
                 err!(
                     "Email domain not allowed",
                     ErrorEvent {

src/config.rs

@@ -822,6 +822,8 @@ make_config! {
         sso_enabled:                    bool,   true,   def,    false;
         /// Only SSO login |> Disable Email+Master Password login
         sso_only:                       bool,   true,   def,    false;
+        /// Allow SSO flow to create account |> You probably want to disable it when using a public provider
+        sso_signups_allowed:            bool,   true,   def,    true;
         /// Allow email association |> Associate existing non-SSO user based on email
         sso_signups_match_email:        bool,   true,   def,    true;
         /// Allow unknown email verification status |> Allowing this with `SSO_SIGNUPS_MATCH_EMAIL=true` open potential account takeover.
@@ -1556,6 +1558,17 @@ impl Config {
         }
     }
 
+    /// Tests whether SSO signup is allowed for an email address, taking into
+    /// account the sso_signups_allowed and signups_domains_whitelist settings.
+    pub fn is_sso_signup_allowed(&self, email: &str) -> bool {
+        if self.signups_domains_whitelist().is_empty() {
+            self.sso_signups_allowed()
+        } else {
+            // The whitelist setting overrides the signups_allowed setting.
+            self.is_email_domain_allowed(email)
+        }
+    }
+
     // The registration link should be hidden if
     //  - Signup is not allowed and email whitelist is empty unless mail is disabled and invitations are allowed
     //  - The SSO is activated and password login is disabled.

src/db/models/org_policy.rs

@@ -318,6 +318,13 @@ impl OrgPolicy {
     }
 
     pub async fn org_is_reset_password_auto_enroll(org_uuid: &OrganizationId, conn: &DbConn) -> bool {
+        // Account recovery depends on outbound mail. When SMTP is disabled, treat the
+        // auto-enroll policy as inactive so invites/registration are not forced to
+        // supply a reset-password key (see check_reset_password_applicable).
+        if !CONFIG.mail_enabled() {
+            return false;
+        }
+
         match OrgPolicy::find_by_org_and_type(org_uuid, OrgPolicyType::ResetPassword, conn).await {
             Some(policy) => match serde_json::from_str::<ResetPasswordDataModel>(&policy.data) {
                 Ok(opts) => {