From 1f6d45753389d8dad991771499bc935a56cf0394 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 1 Jul 2026 19:30:54 +0200 Subject: [PATCH 01/42] Add custom role permissions: Manage Users, Groups, Policies --- .gitignore | 3 + .../down.sql | 3 + .../up.sql | 3 + .../down.sql | 3 + .../up.sql | 3 + .../down.sql | 3 + .../up.sql | 3 + src/api/core/organizations.rs | 121 +++++++++++------- src/auth.rs | 84 ++++++++++++ src/db/models/organization.rs | 73 +++++------ src/db/schema.rs | 3 + .../templates/scss/vaultwarden.scss.hbs | 6 +- 12 files changed, 218 insertions(+), 90 deletions(-) create mode 100644 migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql create mode 100644 migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql create mode 100644 migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql create mode 100644 migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql create mode 100644 migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql create mode 100644 migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql diff --git a/.gitignore b/.gitignore index e991430e..06d677ca 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,6 @@ data # Web vault web-vault + +ssl/ +vcpkg/ diff --git a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql new file mode 100644 index 00000000..f1979ae7 --- /dev/null +++ b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations DROP COLUMN manage_users; +ALTER TABLE users_organizations DROP COLUMN manage_groups; +ALTER TABLE users_organizations DROP COLUMN manage_policies; diff --git a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql new file mode 100644 index 00000000..11094951 --- /dev/null +++ b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; diff --git a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql new file mode 100644 index 00000000..f1979ae7 --- /dev/null +++ b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations DROP COLUMN manage_users; +ALTER TABLE users_organizations DROP COLUMN manage_groups; +ALTER TABLE users_organizations DROP COLUMN manage_policies; diff --git a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql new file mode 100644 index 00000000..11094951 --- /dev/null +++ b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; diff --git a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql new file mode 100644 index 00000000..f1979ae7 --- /dev/null +++ b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations DROP COLUMN manage_users; +ALTER TABLE users_organizations DROP COLUMN manage_groups; +ALTER TABLE users_organizations DROP COLUMN manage_policies; diff --git a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql new file mode 100644 index 00000000..11094951 --- /dev/null +++ b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index dd68cd5b..c3940b3c 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -11,7 +11,10 @@ use crate::{ EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType, core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor}, }, - auth::{AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite}, + auth::{ + AdminHeaders, Headers, ManageGroupsHeaders, ManagePoliciesHeaders, ManageUsersHeaders, ManagerHeaders, + ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite, + }, db::{ DbConn, models::{ @@ -389,7 +392,13 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos err!("Organization not found", "Organization id's do not match"); } - if !headers.membership.has_full_access() { + // Custom users with a manage permission need to read the collection list (metadata only) + // to be able to assign collections to groups/members. This does NOT expose cipher contents. + let can_read_collection_list = headers.membership.has_full_access() + || headers.membership.manage_users + || headers.membership.manage_groups + || headers.membership.manage_policies; + if !can_read_collection_list { err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code); } @@ -1030,7 +1039,7 @@ impl InviteData { async fn send_invite( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> EmptyResult { if org_id != headers.org_id { @@ -1174,7 +1183,7 @@ async fn send_invite( async fn bulk_reinvite_members( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -1209,7 +1218,7 @@ async fn bulk_reinvite_members( async fn reinvite_member( org_id: OrganizationId, member_id: MembershipId, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> EmptyResult { if org_id != headers.org_id { @@ -1340,7 +1349,7 @@ struct BulkConfirmData { async fn bulk_confirm_invite( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, nt: Notify<'_>, ) -> JsonResult { @@ -1384,7 +1393,7 @@ async fn confirm_invite( org_id: OrganizationId, member_id: MembershipId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, nt: Notify<'_>, ) -> EmptyResult { @@ -1397,7 +1406,7 @@ async fn confirm_invite_impl( org_id: &OrganizationId, member_id: &MembershipId, key: &str, - headers: &AdminHeaders, + headers: &ManageUsersHeaders, conn: &DbConn, nt: &Notify<'_>, ) -> EmptyResult { @@ -1482,7 +1491,7 @@ async fn get_user( org_id: OrganizationId, member_id: MembershipId, data: GetOrgUserData, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -1513,7 +1522,7 @@ async fn put_member( org_id: OrganizationId, member_id: MembershipId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> EmptyResult { edit_member(org_id, member_id, data, headers, conn).await @@ -1524,7 +1533,7 @@ async fn edit_member( org_id: OrganizationId, member_id: MembershipId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> EmptyResult { if org_id != headers.org_id { @@ -1532,23 +1541,30 @@ async fn edit_member( } let data: EditUserData = data.into_inner(); - // HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission - // The from_str() will convert the custom role type into a manager role type let raw_type = &data.r#type.into_string(); - // MembershipType::from_str will convert custom (4) to manager (3) let Some(new_type) = MembershipType::from_str(raw_type) else { err!("Invalid type") }; - // HACK: This converts the Custom role which has the `Manage all collections` box checked into an access_all flag - // Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes - // If the box is not checked, the user will still be a manager, but not with the access_all permission + // For a Custom role, the "Manage all collections" parent checkbox is not sent to + // the server; we derive access_all from its three child checkboxes. Admins/Owners + // implicitly have access to all collections. let access_all = new_type >= MembershipType::Admin - || (raw_type.eq("4") + || (new_type == MembershipType::Custom && data.permissions.get("editAnyCollection") == Some(&json!(true)) && data.permissions.get("deleteAnyCollection") == Some(&json!(true)) && data.permissions.get("createNewCollections") == Some(&json!(true))); + // Read the explicit Custom-role management permissions. These only apply to the + // Custom type; for every other type they are forced to false so that changing a + // member away from Custom clears any previously granted flags. + let perm = |key: &str| { + new_type == MembershipType::Custom && data.permissions.get(key) == Some(&json!(true)) + }; + let manage_users = perm("manageUsers"); + let manage_groups = perm("manageGroups"); + let manage_policies = perm("managePolicies"); + let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else { err!("The specified user isn't member of the organization") }; @@ -1574,7 +1590,18 @@ async fn edit_member( } } + // Security: only Admins and Owners may grant the granular custom-role management + // permissions. A custom user with manage_users must not be able to grant these + // permissions (to themselves or others), which would be a privilege escalation. + if headers.membership_type < MembershipType::Admin + && (manage_users || manage_groups || manage_policies) + { + err!("Only Admins or Owners can grant custom management permissions") + } member_to_edit.access_all = access_all; + member_to_edit.manage_users = manage_users; + member_to_edit.manage_groups = manage_groups; + member_to_edit.manage_policies = manage_policies; member_to_edit.atype = new_type as i32; // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type @@ -1631,7 +1658,7 @@ async fn edit_member( async fn bulk_delete_member( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, nt: Notify<'_>, ) -> JsonResult { @@ -1667,7 +1694,7 @@ async fn bulk_delete_member( async fn delete_member( org_id: OrganizationId, member_id: MembershipId, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, nt: Notify<'_>, ) -> EmptyResult { @@ -1677,7 +1704,7 @@ async fn delete_member( async fn delete_member_impl( org_id: &OrganizationId, member_id: &MembershipId, - headers: &AdminHeaders, + headers: &ManageUsersHeaders, conn: &DbConn, nt: &Notify<'_>, ) -> EmptyResult { @@ -1722,7 +1749,7 @@ async fn delete_member_impl( async fn bulk_public_keys( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -1931,8 +1958,8 @@ async fn post_bulk_collections(data: Json, headers: Headers } #[get("/organizations//policies")] -async fn list_policies(org_id: OrganizationId, headers: AdminHeaders, conn: DbConn) -> JsonResult { - if org_id != headers.org_id { +async fn list_policies(org_id: OrganizationId, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { + if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } let policies = OrgPolicy::find_by_org(&org_id, &conn).await; @@ -1997,7 +2024,7 @@ async fn get_master_password_policy(org_id: OrganizationId, _headers: OrgMemberH } #[get("/organizations//policies/", rank = 3)] -async fn get_policy(org_id: OrganizationId, pol_type: i32, headers: AdminHeaders, conn: DbConn) -> JsonResult { +async fn get_policy(org_id: OrganizationId, pol_type: i32, headers: ManagePoliciesHeaders, conn: DbConn) -> JsonResult { if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } @@ -2025,7 +2052,7 @@ async fn put_policy( org_id: OrganizationId, pol_type: i32, data: Json, - headers: AdminHeaders, + headers: ManagePoliciesHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -2153,7 +2180,7 @@ async fn put_policy_vnext( org_id: OrganizationId, pol_type: i32, data: Json, - headers: AdminHeaders, + headers: ManagePoliciesHeaders, conn: DbConn, ) -> JsonResult { let data: PolicyDataVnext = data.into_inner(); @@ -2232,7 +2259,7 @@ struct BulkRevokeMembershipIds { async fn revoke_member( org_id: OrganizationId, member_id: MembershipId, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> EmptyResult { revoke_member_impl(&org_id, &member_id, &headers, &conn).await @@ -2242,7 +2269,7 @@ async fn revoke_member( async fn bulk_revoke_members( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -2281,7 +2308,7 @@ async fn bulk_revoke_members( async fn revoke_member_impl( org_id: &OrganizationId, member_id: &MembershipId, - headers: &AdminHeaders, + headers: &ManageUsersHeaders, conn: &DbConn, ) -> EmptyResult { if org_id != &headers.org_id { @@ -2325,7 +2352,7 @@ async fn revoke_member_impl( async fn restore_member_vnext( org_id: OrganizationId, member_id: MembershipId, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> EmptyResult { // Vaultwarden does not (yet) support the per User Collection linked to the `Enforce organization data ownership` policy. @@ -2337,7 +2364,7 @@ async fn restore_member_vnext( async fn restore_member( org_id: OrganizationId, member_id: MembershipId, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> EmptyResult { restore_member_impl(&org_id, &member_id, &headers, &conn).await @@ -2347,7 +2374,7 @@ async fn restore_member( async fn bulk_restore_members( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: ManageUsersHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -2381,7 +2408,7 @@ async fn bulk_restore_members( async fn restore_member_impl( org_id: &OrganizationId, member_id: &MembershipId, - headers: &AdminHeaders, + headers: &ManageUsersHeaders, conn: &DbConn, ) -> EmptyResult { if org_id != &headers.org_id { @@ -2528,7 +2555,7 @@ async fn post_group( org_id: OrganizationId, group_id: GroupId, data: Json, - headers: AdminHeaders, + headers: ManageGroupsHeaders, conn: DbConn, ) -> JsonResult { put_group(org_id, group_id, data, headers, conn).await @@ -2537,7 +2564,7 @@ async fn post_group( #[post("/organizations//groups", data = "")] async fn post_groups( org_id: OrganizationId, - headers: AdminHeaders, + headers: ManageGroupsHeaders, data: Json, conn: DbConn, ) -> JsonResult { @@ -2572,7 +2599,7 @@ async fn put_group( org_id: OrganizationId, group_id: GroupId, data: Json, - headers: AdminHeaders, + headers: ManageGroupsHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -2613,7 +2640,7 @@ async fn add_update_group( collections: Vec, members: Vec, org_id: OrganizationId, - headers: &AdminHeaders, + headers: &ManageGroupsHeaders, conn: &DbConn, ) -> JsonResult { group.save(conn).await?; @@ -2653,7 +2680,7 @@ async fn add_update_group( async fn get_group_details( org_id: OrganizationId, group_id: GroupId, - headers: AdminHeaders, + headers: ManageGroupsHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -2674,21 +2701,21 @@ async fn get_group_details( async fn post_delete_group( org_id: OrganizationId, group_id: GroupId, - headers: AdminHeaders, + headers: ManageGroupsHeaders, conn: DbConn, ) -> EmptyResult { delete_group_impl(&org_id, &group_id, &headers, &conn).await } #[delete("/organizations//groups/")] -async fn delete_group(org_id: OrganizationId, group_id: GroupId, headers: AdminHeaders, conn: DbConn) -> EmptyResult { +async fn delete_group(org_id: OrganizationId, group_id: GroupId, headers: ManageGroupsHeaders, conn: DbConn) -> EmptyResult { delete_group_impl(&org_id, &group_id, &headers, &conn).await } async fn delete_group_impl( org_id: &OrganizationId, group_id: &GroupId, - headers: &AdminHeaders, + headers: &ManageGroupsHeaders, conn: &DbConn, ) -> EmptyResult { if org_id != &headers.org_id { @@ -2720,7 +2747,7 @@ async fn delete_group_impl( async fn bulk_delete_groups( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: ManageGroupsHeaders, conn: DbConn, ) -> EmptyResult { if org_id != headers.org_id { @@ -2739,7 +2766,7 @@ async fn bulk_delete_groups( } #[get("/organizations//groups/", rank = 2)] -async fn get_group(org_id: OrganizationId, group_id: GroupId, headers: AdminHeaders, conn: DbConn) -> JsonResult { +async fn get_group(org_id: OrganizationId, group_id: GroupId, headers: ManageGroupsHeaders, conn: DbConn) -> JsonResult { if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } @@ -2758,7 +2785,7 @@ async fn get_group(org_id: OrganizationId, group_id: GroupId, headers: AdminHead async fn get_group_members( org_id: OrganizationId, group_id: GroupId, - headers: AdminHeaders, + headers: ManageGroupsHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -2785,7 +2812,7 @@ async fn get_group_members( async fn put_group_members( org_id: OrganizationId, group_id: GroupId, - headers: AdminHeaders, + headers: ManageGroupsHeaders, data: Json>, conn: DbConn, ) -> EmptyResult { @@ -2833,7 +2860,7 @@ async fn post_delete_group_member( org_id: OrganizationId, group_id: GroupId, member_id: MembershipId, - headers: AdminHeaders, + headers: ManageGroupsHeaders, conn: DbConn, ) -> EmptyResult { if org_id != headers.org_id { diff --git a/src/auth.rs b/src/auth.rs index 2ad95036..66e9bbe7 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -693,6 +693,7 @@ pub struct OrgHeaders { pub host: String, pub device: Device, pub user: User, + #[allow(dead_code)] pub membership_type: MembershipType, pub membership_status: MembershipStatus, pub membership: Membership, @@ -714,6 +715,24 @@ impl OrgHeaders { fn is_confirmed_and_owner(&self) -> bool { self.membership_status == MembershipStatus::Confirmed && self.membership_type == MembershipType::Owner } + fn is_confirmed(&self) -> bool { + self.membership_status == MembershipStatus::Confirmed + } + // Custom-role permission checks. Admins and Owners implicitly hold every + // permission; a Custom member holds a permission only if the matching flag + // is set on their Membership. + fn can_manage_users(&self) -> bool { + self.is_confirmed() + && (self.membership_type >= MembershipType::Admin || self.membership.manage_users) + } + fn can_manage_groups(&self) -> bool { + self.is_confirmed() + && (self.membership_type >= MembershipType::Admin || self.membership.manage_groups) + } + fn can_manage_policies(&self) -> bool { + self.is_confirmed() + && (self.membership_type >= MembershipType::Admin || self.membership.manage_policies) + } } // org_id is usually the second path param ("/organizations/"), @@ -827,6 +846,71 @@ impl<'r> FromRequest<'r> for AdminHeaders { } } +// Macro to generate a request guard that permits a confirmed Admin/Owner, or a +// confirmed Custom member holding the given permission. The generated struct +// mirrors AdminHeaders so it can be used as a drop-in replacement on endpoints. +macro_rules! generate_manage_headers { + ($name:ident, $check:ident, $err:literal) => { + #[allow(dead_code)] + pub struct $name { + pub host: String, + pub device: Device, + pub user: User, + pub membership_type: MembershipType, + pub ip: ClientIp, + pub org_id: OrganizationId, + } + + #[rocket::async_trait] + impl<'r> FromRequest<'r> for $name { + type Error = &'static str; + + async fn from_request(request: &'r Request<'_>) -> Outcome { + let headers = try_outcome!(OrgHeaders::from_request(request).await); + if headers.$check() { + Outcome::Success(Self { + host: headers.host, + device: headers.device, + user: headers.user, + membership_type: headers.membership_type, + ip: headers.ip, + org_id: headers.membership.org_uuid, + }) + } else { + err_handler!($err) + } + } + } + + impl From<$name> for Headers { + fn from(h: $name) -> Headers { + Headers { + host: h.host, + device: h.device, + user: h.user, + ip: h.ip, + } + } + } + }; +} + +generate_manage_headers!( + ManageUsersHeaders, + can_manage_users, + "You need the 'Manage Users' permission, or to be an Admin or Owner, to call this endpoint" +); +generate_manage_headers!( + ManageGroupsHeaders, + can_manage_groups, + "You need the 'Manage Groups' permission, or to be an Admin or Owner, to call this endpoint" +); +generate_manage_headers!( + ManagePoliciesHeaders, + can_manage_policies, + "You need the 'Manage Policies' permission, or to be an Admin or Owner, to call this endpoint" +); + // col_id is usually the fourth path param ("/organizations//collections/"), // but there could be cases where it is a query value. // First check the path, if this is not a valid uuid, try the query values. diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index d604add4..0fbc45a1 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -57,6 +57,9 @@ pub struct Membership { pub atype: i32, pub reset_password_key: Option, pub external_id: Option, + pub manage_users: bool, + pub manage_groups: bool, + pub manage_policies: bool, } #[derive(Identifiable, Queryable, Insertable, AsChangeset)] @@ -98,21 +101,17 @@ pub enum MembershipType { Admin = 1, User = 2, Manager = 3, + Custom = 4, } impl MembershipType { pub fn from_str(s: &str) -> Option { - #[expect( - clippy::match_same_arms, - reason = "Specifically define `4|Custom` since this is a hack, not a default" - )] match s { "0" | "Owner" => Some(MembershipType::Owner), "1" | "Admin" => Some(MembershipType::Admin), "2" | "User" => Some(MembershipType::User), "3" | "Manager" => Some(MembershipType::Manager), - // HACK: We convert the custom role to a manager role - "4" | "Custom" => Some(MembershipType::Manager), + "4" | "Custom" => Some(MembershipType::Custom), _ => None, } } @@ -121,11 +120,15 @@ impl MembershipType { impl Ord for MembershipType { fn cmp(&self, other: &MembershipType) -> Ordering { // For easy comparison, map each variant to an access level (where 0 is lowest). - const ACCESS_LEVEL: [i32; 4] = [ + // Custom is treated as a low-privilege base role (same level as Manager for + // ordering purposes); its elevated capabilities are governed by the explicit + // manage_* permission flags on the Membership, not by this ordering. + const ACCESS_LEVEL: [i32; 5] = [ 3, // Owner 2, // Admin 0, // User - 1, // Manager && Custom + 1, // Manager + 1, // Custom ]; ACCESS_LEVEL[*self as usize].cmp(&ACCESS_LEVEL[*other as usize]) } @@ -267,6 +270,9 @@ impl Membership { atype: MembershipType::User as i32, reset_password_key: None, external_id: None, + manage_users: false, + manage_groups: false, + manage_policies: false, } } @@ -306,15 +312,6 @@ impl Membership { } false } - - /// HACK: Convert the manager type to a custom type - /// It will be converted back on other locations - pub fn type_manager_as_custom(&self) -> i32 { - match self.atype { - 3 => 4, - _ => self.atype, - } - } } impl OrganizationApiKey { @@ -443,14 +440,10 @@ impl Membership { pub async fn to_json(&self, conn: &DbConn) -> Value { let org = Organization::find_by_uuid(&self.org_uuid, conn).await.unwrap(); - // HACK: Convert the manager type to a custom type - // It will be converted back on other locations - let membership_type = self.type_manager_as_custom(); + let membership_type = self.atype; let permissions = json!({ - // TODO: Add full support for Custom User Roles - // See: https://bitwarden.com/help/article/user-types-access-control/#custom-role - // Currently we use the custom role as a manager role and link the 3 Collection roles to mimic the access_all permission + // The 3 Collection roles below are linked to the access_all permission "accessEventLogs": false, "accessImportExport": false, "accessReports": false, @@ -458,10 +451,10 @@ impl Membership { "createNewCollections": membership_type == 4 && self.access_all, "editAnyCollection": membership_type == 4 && self.access_all, "deleteAnyCollection": membership_type == 4 && self.access_all, - "manageGroups": false, - "managePolicies": false, + "manageGroups": self.manage_groups, + "managePolicies": self.manage_policies, "manageSso": false, // Not supported - "manageUsers": false, + "manageUsers": self.manage_users, "manageResetPassword": false, "manageScim": false // Not supported (Not AGPLv3 Licensed) }); @@ -607,28 +600,24 @@ impl Membership { Vec::with_capacity(0) }; - // HACK: Convert the manager type to a custom type - // It will be converted back on other locations - let membership_type = self.type_manager_as_custom(); + let membership_type = self.atype; - // HACK: Only return permissions if the user is of type custom and has access_all - // Else Bitwarden will assume the defaults of all false - let permissions = if membership_type == 4 && self.access_all { + // Only return a permissions object for custom-type members. A custom member + // may have access_all (the 3 collection roles) and/or any of the explicit + // manage_* flags; otherwise Bitwarden assumes all-false defaults. + let permissions = if membership_type == MembershipType::Custom as i32 { json!({ - // TODO: Add full support for Custom User Roles - // See: https://bitwarden.com/help/article/user-types-access-control/#custom-role - // Currently we use the custom role as a manager role and link the 3 Collection roles to mimic the access_all permission "accessEventLogs": false, "accessImportExport": false, "accessReports": false, // If the following 3 Collection roles are set to true a custom user has access all permission - "createNewCollections": true, - "editAnyCollection": true, - "deleteAnyCollection": true, - "manageGroups": false, - "managePolicies": false, + "createNewCollections": self.access_all, + "editAnyCollection": self.access_all, + "deleteAnyCollection": self.access_all, + "manageGroups": self.manage_groups, + "managePolicies": self.manage_policies, "manageSso": false, // Not supported - "manageUsers": false, + "manageUsers": self.manage_users, "manageResetPassword": false, "manageScim": false // Not supported (Not AGPLv3 Licensed) }) @@ -728,7 +717,7 @@ impl Membership { json!({ "id": self.uuid, "userId": self.user_uuid, - "type": self.type_manager_as_custom(), // HACK: Convert the manager type to a custom type + "type": self.atype, "status": status, "name": user.name, "email": user.email, diff --git a/src/db/schema.rs b/src/db/schema.rs index af342186..15c43b5f 100644 --- a/src/db/schema.rs +++ b/src/db/schema.rs @@ -242,6 +242,9 @@ table! { atype -> Integer, reset_password_key -> Nullable, external_id -> Nullable, + manage_users -> Bool, + manage_groups -> Bool, + manage_policies -> Bool, } } diff --git a/src/static/templates/scss/vaultwarden.scss.hbs b/src/static/templates/scss/vaultwarden.scss.hbs index 477cdd34..c5f790ac 100644 --- a/src/static/templates/scss/vaultwarden.scss.hbs +++ b/src/static/templates/scss/vaultwarden.scss.hbs @@ -116,8 +116,12 @@ app-security > app-two-factor-setup > form { } /* Hide unsupported Custom Role options */ +/* Note: manageUsers and managePolicies are supported by Vaultwarden + and are intentionally NOT hidden here. */ bit-dialog div.tw-ml-4:has(bit-form-control input), -bit-dialog div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) { +bit-dialog div.tw-col-span-4:has(input[formcontrolname*="access"]), +bit-dialog bit-form-control:has(input[formcontrolname="manageSso"]), +bit-dialog bit-form-control:has(input[formcontrolname="manageResetPassword"]) { @extend %vw-hide; } From df18711b49984a99de872ec62a9fce9568fccf27 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 1 Jul 2026 19:39:10 +0200 Subject: [PATCH 02/42] Silence struct_excessive_bools lint for Membership --- src/db/models/organization.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 0fbc45a1..c2ba53b6 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -44,6 +44,7 @@ pub struct Organization { #[diesel(table_name = users_organizations)] #[diesel(treat_none_as_null = true)] #[diesel(primary_key(uuid))] +#[allow(clippy::struct_excessive_bools)] pub struct Membership { pub uuid: MembershipId, pub user_uuid: UserId, From 4d6b667ffcf72d8b3e90df8bcc6f35859c3e8d5e Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 2 Jul 2026 17:12:23 +0200 Subject: [PATCH 03/42] Server-side collection/group permission hardening; works without web-vault changes --- src/api/core/organizations.rs | 175 ++++++++++++++++++++++++++-------- 1 file changed, 136 insertions(+), 39 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index c3940b3c..f4c22203 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -430,6 +430,12 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea let has_full_access_to_org = member.has_full_access() || (CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(&org_id, &member.uuid, &conn).await); + // Custom users with a manage permission need the full collection list (metadata only) + // so the web client can render member/group collection assignments without crashing on + // collections it can't otherwise see. This exposes names/ids only, never cipher contents. + let can_read_collection_list = + member.manage_users || member.manage_groups || member.manage_policies; + // Get all admins, owners and managers who can manage/access all // Those are currently not listed in the col_users but need to be listed too. let manage_all_members: Vec = Membership::find_confirmed_and_manage_all_by_org(&org_id, &conn) @@ -453,8 +459,20 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea || (CONFIG.org_groups_enabled() && GroupUser::has_access_to_collection_by_member(&col.uuid, &member.uuid, &conn).await); - // If the user is a manager, and is not assigned to this collection, skip this and continue with the next collection + // If the user is a manager and is not assigned to this collection, normally skip it. + // Exception: custom users with a manage permission get a metadata-only entry (no user + // or group access details) so the web client can resolve assignment references without + // crashing. This never exposes cipher contents. if !assigned { + if can_read_collection_list { + let mut json_object = col.to_json_details(&headers.user.uuid, None, &conn).await; + json_object["assigned"] = json!(false); + json_object["users"] = json!(Vec::::new()); + json_object["groups"] = json!(Vec::::new()); + json_object["object"] = json!("collectionAccessDetails"); + json_object["unmanaged"] = json!(false); + data.push(json_object); + } continue; } @@ -514,7 +532,10 @@ async fn post_organization_collections( let data: FullCollectionData = data.into_inner(); data.validate(&org_id, &conn).await?; - if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all { + // Managers and custom users may only create collections if they have full access. + // (A custom user with manage_users/manage_groups/manage_policies but no collection + // access must not be able to create collections.) + if !headers.membership.has_full_access() && headers.membership.atype < MembershipType::Admin { err!("You don't have permission to create collections") } @@ -585,6 +606,13 @@ async fn post_bulk_access_collections( err!("Can't find organization details") } + // Security: only callers who can actually manage collections (Admins/Owners, or users with + // full access) may change collection access in bulk. A custom user with only manage_users / + // manage_groups / manage_policies must not be able to modify collection assignments here. + if !headers.membership.has_full_access() { + err!("You don't have permission to modify collection access") + } + for col_id in data.collection_ids { let Some(collection) = Collection::find_by_uuid_and_org(&col_id, &org_id, &conn).await else { err!("Collection not found") @@ -1150,8 +1178,17 @@ async fn send_invite( ) .await; + // Security: only callers who can manage collections (Admins/Owners, or users with full + // access) may assign collection access when inviting. A custom user with only manage_users + // can invite members, but cannot grant them collection access. + let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.has_full_access(), + None => false, + }; + // If no accessAll, add the collections received - if !access_all { + if !access_all && caller_can_manage_collections { for col in data.collections.iter().flatten() { match Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await { None => err!("Collection not found in Organization"), @@ -1170,9 +1207,20 @@ async fn send_invite( } } - for group_id in &data.groups { - let mut group_entry = GroupUser::new(group_id.clone(), new_member.uuid.clone()); - group_entry.save(&conn).await?; + // Security: assigning groups can indirectly grant collection access via the groups' + // collections. Only callers who may manage groups (Admins/Owners or users with + // manage_groups) are allowed to assign groups when inviting. + let caller_can_manage_groups = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.manage_groups, + None => false, + }; + + if caller_can_manage_groups { + for group_id in &data.groups { + let mut group_entry = GroupUser::new(group_id.clone(), new_member.uuid.clone()); + group_entry.save(&conn).await?; + } } } @@ -1598,6 +1646,7 @@ async fn edit_member( { err!("Only Admins or Owners can grant custom management permissions") } + member_to_edit.access_all = access_all; member_to_edit.manage_users = manage_users; member_to_edit.manage_groups = manage_groups; @@ -1608,36 +1657,59 @@ async fn edit_member( // We need to perform the check after changing the type since `admin` is exempt. OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?; - // Delete all the odd collections - for c in CollectionUser::find_by_organization_and_user_uuid(&org_id, &member_to_edit.user_uuid, &conn).await { - c.delete(&conn).await?; - } - - // If no accessAll, add the collections received - if !access_all { - for col in data.collections.iter().flatten() { - match Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await { - None => err!("Collection not found in Organization"), - Some(collection) => { - CollectionUser::save( - &member_to_edit.user_uuid, - &collection.uuid, - col.read_only, - col.hide_passwords, - col.manage, - &conn, - ) - .await?; + // Security: only callers who can actually manage collections (Admins/Owners, or users + // with full access) may change a member's collection assignments. A custom user with only + // manage_users must not be able to add/remove collection access, so we leave the existing + // assignments untouched for them. + let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.has_full_access(), + None => false, + }; + + if caller_can_manage_collections { + // Delete all the odd collections + for c in CollectionUser::find_by_organization_and_user_uuid(&org_id, &member_to_edit.user_uuid, &conn).await { + c.delete(&conn).await?; + } + + // If no accessAll, add the collections received + if !access_all { + for col in data.collections.iter().flatten() { + match Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await { + None => err!("Collection not found in Organization"), + Some(collection) => { + CollectionUser::save( + &member_to_edit.user_uuid, + &collection.uuid, + col.read_only, + col.hide_passwords, + col.manage, + &conn, + ) + .await?; + } } } } } - GroupUser::delete_all_by_member(&member_to_edit.uuid, &conn).await?; + // Security: changing a member's group membership can indirectly grant collection access + // (via the groups' collections). Only callers who may manage groups (Admins/Owners or users + // with manage_groups) are allowed to change it. For others we leave group membership untouched. + let caller_can_manage_groups = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.manage_groups, + None => false, + }; - for group_id in data.groups.iter().flatten() { - let mut group_entry = GroupUser::new(group_id.clone(), member_to_edit.uuid.clone()); - group_entry.save(&conn).await?; + if caller_can_manage_groups { + GroupUser::delete_all_by_member(&member_to_edit.uuid, &conn).await?; + + for group_id in data.groups.iter().flatten() { + let mut group_entry = GroupUser::new(group_id.clone(), member_to_edit.uuid.clone()); + group_entry.save(&conn).await?; + } } log_event( @@ -2591,7 +2663,17 @@ async fn post_groups( ) .await; - add_update_group(group, group_request.collections, group_request.users, org_id, &headers, &conn).await + // Security: only callers who can manage collections may assign collections to a new group. + // A custom user with only manage_groups can create the group, but without collection access. + let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.has_full_access(), + None => false, + }; + let collections_to_apply = + if caller_can_manage_collections { group_request.collections } else { Vec::new() }; + + add_update_group(group, collections_to_apply, group_request.users, org_id, &headers, &conn).await } #[put("/organizations//groups/", data = "")] @@ -2618,7 +2700,19 @@ async fn put_group( let updated_group = group_request.update_group(group); - CollectionGroup::delete_all_by_group(&group_id, &org_id, &conn).await?; + // Security: only callers who can actually manage collections (Admins/Owners, or users with + // full access) may change a group's collection assignments. A custom user with only + // manage_groups must not be able to add/remove collection access. For them we keep the + // group's existing collection assignments untouched (neither cleared nor overwritten). + let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.has_full_access(), + None => false, + }; + + if caller_can_manage_collections { + CollectionGroup::delete_all_by_group(&group_id, &org_id, &conn).await?; + } GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?; log_event( @@ -2632,7 +2726,10 @@ async fn put_group( ) .await; - add_update_group(updated_group, group_request.collections, group_request.users, org_id, &headers, &conn).await + // Only pass collection changes through if the caller is allowed to manage collections. + let collections_to_apply = + if caller_can_manage_collections { group_request.collections } else { Vec::new() }; + add_update_group(updated_group, collections_to_apply, group_request.users, org_id, &headers, &conn).await } async fn add_update_group( @@ -2680,10 +2777,10 @@ async fn add_update_group( async fn get_group_details( org_id: OrganizationId, group_id: GroupId, - headers: ManageGroupsHeaders, + headers: ManagerHeadersLoose, conn: DbConn, ) -> JsonResult { - if org_id != headers.org_id { + if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } if !CONFIG.org_groups_enabled() { @@ -2766,8 +2863,8 @@ async fn bulk_delete_groups( } #[get("/organizations//groups/", rank = 2)] -async fn get_group(org_id: OrganizationId, group_id: GroupId, headers: ManageGroupsHeaders, conn: DbConn) -> JsonResult { - if org_id != headers.org_id { +async fn get_group(org_id: OrganizationId, group_id: GroupId, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { + if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } if !CONFIG.org_groups_enabled() { @@ -2785,10 +2882,10 @@ async fn get_group(org_id: OrganizationId, group_id: GroupId, headers: ManageGro async fn get_group_members( org_id: OrganizationId, group_id: GroupId, - headers: ManageGroupsHeaders, + headers: ManagerHeadersLoose, conn: DbConn, ) -> JsonResult { - if org_id != headers.org_id { + if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } if !CONFIG.org_groups_enabled() { From e72c97c30d8ffca4b6f04a63823393fc4a96f0e3 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Tue, 7 Jul 2026 11:59:44 +0200 Subject: [PATCH 04/42] Harden custom-role permissions: block indirect collection access via groups; block manage_users revoke/restore of admins; cargo fmt --- src/api/core/organizations.rs | 164 +++++++++++++++++++++++++--------- src/auth.rs | 9 +- 2 files changed, 126 insertions(+), 47 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index f4c22203..ba8ab681 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -433,8 +433,7 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea // Custom users with a manage permission need the full collection list (metadata only) // so the web client can render member/group collection assignments without crashing on // collections it can't otherwise see. This exposes names/ids only, never cipher contents. - let can_read_collection_list = - member.manage_users || member.manage_groups || member.manage_policies; + let can_read_collection_list = member.manage_users || member.manage_groups || member.manage_policies; // Get all admins, owners and managers who can manage/access all // Those are currently not listed in the col_users but need to be listed too. @@ -1606,9 +1605,7 @@ async fn edit_member( // Read the explicit Custom-role management permissions. These only apply to the // Custom type; for every other type they are forced to false so that changing a // member away from Custom clears any previously granted flags. - let perm = |key: &str| { - new_type == MembershipType::Custom && data.permissions.get(key) == Some(&json!(true)) - }; + let perm = |key: &str| new_type == MembershipType::Custom && data.permissions.get(key) == Some(&json!(true)); let manage_users = perm("manageUsers"); let manage_groups = perm("manageGroups"); let manage_policies = perm("managePolicies"); @@ -1641,9 +1638,7 @@ async fn edit_member( // Security: only Admins and Owners may grant the granular custom-role management // permissions. A custom user with manage_users must not be able to grant these // permissions (to themselves or others), which would be a privilege escalation. - if headers.membership_type < MembershipType::Admin - && (manage_users || manage_groups || manage_policies) - { + if headers.membership_type < MembershipType::Admin && (manage_users || manage_groups || manage_policies) { err!("Only Admins or Owners can grant custom management permissions") } @@ -2391,6 +2386,12 @@ async fn revoke_member_impl( if member.user_uuid == headers.user.uuid { err!("You cannot revoke yourself") } + // Security: a Custom user with manage_users must not be able to revoke Admins or + // Owners. Mirrors the restriction in delete_member_impl; the Owner-specific check + // below still guards Admin-vs-Owner actions. + if member.atype != MembershipType::User && headers.membership_type < MembershipType::Admin { + err!("You don't have permission to revoke this user") + } if member.atype == MembershipType::Owner && headers.membership_type != MembershipType::Owner { err!("Only owners can revoke other owners") } @@ -2491,6 +2492,12 @@ async fn restore_member_impl( if member.user_uuid == headers.user.uuid { err!("You cannot restore yourself") } + // Security: a Custom user with manage_users must not be able to restore Admins or + // Owners. Mirrors the restriction in delete_member_impl; the Owner-specific check + // below still guards Admin-vs-Owner actions. + if member.atype != MembershipType::User && headers.membership_type < MembershipType::Admin { + err!("You don't have permission to restore this user") + } if member.atype == MembershipType::Owner && headers.membership_type != MembershipType::Owner { err!("Only owners can restore other owners") } @@ -2650,7 +2657,21 @@ async fn post_groups( let group_request = data.into_inner(); group_request.validate(&org_id, &conn).await?; - let group = group_request.to_group(&org_id); + // Security: only callers who can manage collections may assign collections to a new group. + // A custom user with only manage_groups can create the group, but without collection access. + let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.has_full_access(), + None => false, + }; + + let mut group = group_request.to_group(&org_id); + // Security: `access_all` grants the group access to every collection, so it is a + // collection-access grant just like assigning collections. A custom user without + // collection-management rights must not be able to create an access_all group. + if !caller_can_manage_collections { + group.access_all = false; + } log_event( EventType::GroupCreated as i32, @@ -2663,17 +2684,22 @@ async fn post_groups( ) .await; - // Security: only callers who can manage collections may assign collections to a new group. - // A custom user with only manage_groups can create the group, but without collection access. - let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin - || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { - Some(m) => m.has_full_access(), - None => false, - }; - let collections_to_apply = - if caller_can_manage_collections { group_request.collections } else { Vec::new() }; + let collections_to_apply = if caller_can_manage_collections { + group_request.collections + } else { + Vec::new() + }; - add_update_group(group, collections_to_apply, group_request.users, org_id, &headers, &conn).await + add_update_group( + group, + collections_to_apply, + group_request.users, + org_id, + &headers, + &conn, + caller_can_manage_collections, + ) + .await } #[put("/organizations//groups/", data = "")] @@ -2698,8 +2724,6 @@ async fn put_group( let group_request = data.into_inner(); group_request.validate(&org_id, &conn).await?; - let updated_group = group_request.update_group(group); - // Security: only callers who can actually manage collections (Admins/Owners, or users with // full access) may change a group's collection assignments. A custom user with only // manage_groups must not be able to add/remove collection access. For them we keep the @@ -2710,10 +2734,18 @@ async fn put_group( None => false, }; + // Preserve the current `access_all` grant for callers who can't manage collections, so a + // manage_groups-only user cannot turn a group into an access_all (all-collections) grant. + let previous_access_all = group.access_all; + let mut updated_group = group_request.update_group(group); + if !caller_can_manage_collections { + updated_group.access_all = previous_access_all; + } + if caller_can_manage_collections { CollectionGroup::delete_all_by_group(&group_id, &org_id, &conn).await?; } - GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?; + // NOTE: group membership is replaced (and access-gated) inside add_update_group. log_event( EventType::GroupUpdated as i32, @@ -2727,9 +2759,21 @@ async fn put_group( .await; // Only pass collection changes through if the caller is allowed to manage collections. - let collections_to_apply = - if caller_can_manage_collections { group_request.collections } else { Vec::new() }; - add_update_group(updated_group, collections_to_apply, group_request.users, org_id, &headers, &conn).await + let collections_to_apply = if caller_can_manage_collections { + group_request.collections + } else { + Vec::new() + }; + add_update_group( + updated_group, + collections_to_apply, + group_request.users, + org_id, + &headers, + &conn, + caller_can_manage_collections, + ) + .await } async fn add_update_group( @@ -2739,6 +2783,7 @@ async fn add_update_group( org_id: OrganizationId, headers: &ManageGroupsHeaders, conn: &DbConn, + caller_can_manage_collections: bool, ) -> JsonResult { group.save(conn).await?; @@ -2747,20 +2792,31 @@ async fn add_update_group( collection_group.save(&org_id, conn).await?; } - for assigned_member in members { - let mut user_entry = GroupUser::new(group.uuid.clone(), assigned_member.clone()); - user_entry.save(conn).await?; + // Security: assigning members to a group that grants collection access (via `access_all` + // or assigned collections) would indirectly grant those members access to the collections' + // contents. Only callers who can manage collections may change the membership of such a + // group; for others we leave the group's membership untouched. + let group_grants_collection_access = + group.access_all || !CollectionGroup::find_by_group(&group.uuid, &org_id, conn).await.is_empty(); - log_event( - EventType::OrganizationUserUpdatedGroups as i32, - &assigned_member, - &org_id, - &headers.user.uuid, - headers.device.atype, - &headers.ip.ip, - conn, - ) - .await; + if caller_can_manage_collections || !group_grants_collection_access { + GroupUser::delete_all_by_group(&group.uuid, &org_id, conn).await?; + + for assigned_member in members { + let mut user_entry = GroupUser::new(group.uuid.clone(), assigned_member.clone()); + user_entry.save(conn).await?; + + log_event( + EventType::OrganizationUserUpdatedGroups as i32, + &assigned_member, + &org_id, + &headers.user.uuid, + headers.device.atype, + &headers.ip.ip, + conn, + ) + .await; + } } Ok(Json(json!({ @@ -2805,7 +2861,12 @@ async fn post_delete_group( } #[delete("/organizations//groups/")] -async fn delete_group(org_id: OrganizationId, group_id: GroupId, headers: ManageGroupsHeaders, conn: DbConn) -> EmptyResult { +async fn delete_group( + org_id: OrganizationId, + group_id: GroupId, + headers: ManageGroupsHeaders, + conn: DbConn, +) -> EmptyResult { delete_group_impl(&org_id, &group_id, &headers, &conn).await } @@ -2863,7 +2924,12 @@ async fn bulk_delete_groups( } #[get("/organizations//groups/", rank = 2)] -async fn get_group(org_id: OrganizationId, group_id: GroupId, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { +async fn get_group( + org_id: OrganizationId, + group_id: GroupId, + headers: ManagerHeadersLoose, + conn: DbConn, +) -> JsonResult { if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } @@ -2920,8 +2986,24 @@ async fn put_group_members( err!("Group support is disabled"); } - if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() { + let Some(group) = Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await else { err!("Group could not be found!", "Group uuid is invalid or does not belong to the organization") + }; + + // Security: changing the membership of a group that grants collection access (via + // `access_all` or assigned collections) indirectly grants those members access to the + // collections' contents. Only callers who can actually manage collections (Admins/Owners + // or users with full access) may do this. A custom user with only manage_groups may manage + // the membership of groups that grant no collection access, but not of collection-bearing ones. + let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.has_full_access(), + None => false, + }; + let group_grants_collection_access = + group.access_all || !CollectionGroup::find_by_group(&group_id, &org_id, &conn).await.is_empty(); + if !caller_can_manage_collections && group_grants_collection_access { + err!("You don't have permission to change the membership of a group that grants collection access") } let assigned_members = data.into_inner(); diff --git a/src/auth.rs b/src/auth.rs index 66e9bbe7..75fe78da 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -722,16 +722,13 @@ impl OrgHeaders { // permission; a Custom member holds a permission only if the matching flag // is set on their Membership. fn can_manage_users(&self) -> bool { - self.is_confirmed() - && (self.membership_type >= MembershipType::Admin || self.membership.manage_users) + self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.manage_users) } fn can_manage_groups(&self) -> bool { - self.is_confirmed() - && (self.membership_type >= MembershipType::Admin || self.membership.manage_groups) + self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.manage_groups) } fn can_manage_policies(&self) -> bool { - self.is_confirmed() - && (self.membership_type >= MembershipType::Admin || self.membership.manage_policies) + self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.manage_policies) } } From 9f45aa77e7998411dc45f831226a22d42ac859a3 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Tue, 7 Jul 2026 14:12:36 +0200 Subject: [PATCH 05/42] Fix privilege escalation: gate access_all in edit_member A Custom member with only manage_users could set the "manage all collections" child permissions (createNewCollections / editAnyCollection / deleteAnyCollection) on any member, including themselves, via POST /organizations//users/. edit_member wrote member_to_edit.access_all unconditionally, so the resulting access_all=true granted full access to every collection's contents - defeating the "manage users without collection access" guarantee. Gate the access_all change on caller_can_manage_collections (Admins/Owners or full-access members), mirroring how put_group preserves a group's access_all for callers without collection rights. For everyone else the member's existing access_all is left untouched. The collection- and group-assignment paths were already gated; this closes the remaining direct path. --- src/api/core/organizations.rs | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index ba8ab681..e8403fc1 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1642,16 +1642,6 @@ async fn edit_member( err!("Only Admins or Owners can grant custom management permissions") } - member_to_edit.access_all = access_all; - member_to_edit.manage_users = manage_users; - member_to_edit.manage_groups = manage_groups; - member_to_edit.manage_policies = manage_policies; - member_to_edit.atype = new_type as i32; - - // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type - // We need to perform the check after changing the type since `admin` is exempt. - OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?; - // Security: only callers who can actually manage collections (Admins/Owners, or users // with full access) may change a member's collection assignments. A custom user with only // manage_users must not be able to add/remove collection access, so we leave the existing @@ -1662,6 +1652,23 @@ async fn edit_member( None => false, }; + // Security: `access_all` grants full access to every collection, so only callers who may + // manage collections are allowed to change it. Otherwise a custom user with only manage_users + // could set the Custom "manage all collections" child boxes on any member (including + // themselves) to grant full collection access — a privilege escalation. For everyone else we + // keep the member's existing access_all grant untouched (neither granted nor revoked). + if caller_can_manage_collections { + member_to_edit.access_all = access_all; + } + member_to_edit.manage_users = manage_users; + member_to_edit.manage_groups = manage_groups; + member_to_edit.manage_policies = manage_policies; + member_to_edit.atype = new_type as i32; + + // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type + // We need to perform the check after changing the type since `admin` is exempt. + OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?; + if caller_can_manage_collections { // Delete all the odd collections for c in CollectionUser::find_by_organization_and_user_uuid(&org_id, &member_to_edit.user_uuid, &conn).await { From 43fb19f190e75b00ab45cba31effe95bee50252f Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 8 Jul 2026 08:11:27 +0200 Subject: [PATCH 06/42] Harden custom-role permission checks Security fixes and hardening following a review of the custom-role permissions feature: - Gate the manage_* flags on the Custom membership type via new Membership::has_manage_* helpers. Previously a stale flag (e.g. left over after changing a member's type through the admin panel, which does not go through edit_member) would keep granting management permissions to a member of any type. - Clear the manage_* flags in admin::update_membership_type when a member is changed away from the Custom type. - edit_member: reject any *change* to the manage_* flags by non-admin callers. This keeps the previous protection against granting flags, and additionally prevents a manage_users member from silently stripping flags an Admin/Owner granted to fellow Custom members. Unchanged flags still pass, so the regular edit dialog keeps working. - list_policies: restrict the full policy list to Admins/Owners and Custom members holding at least one management permission. The previous loosening to ManagerHeadersLoose also exposed all policies (including their configuration data) to plain Managers. - Collection list metadata (get_org_collections{,_details}) is now only readable with manage_users or manage_groups; manage_policies does not need the collection list. - find_confirmed_and_manage_all_by_org: include Custom members with access_all, matching the pre-existing behaviour for Managers. - Fix the partial_cmp_MembershipType unit test (Custom is no longer converted to Manager) and document that Manager and Custom share an access level in Ord while remaining distinct roles under PartialEq. - Replace the remaining stale "HACK" comments and the raw "4" type comparison in send_invite; drop unrelated .gitignore entries. --- .gitignore | 3 -- src/api/admin.rs | 7 ++++ src/api/core/organizations.rs | 70 +++++++++++++++++++++-------------- src/auth.rs | 10 +++-- src/db/models/organization.rs | 32 ++++++++++++++-- 5 files changed, 85 insertions(+), 37 deletions(-) diff --git a/.gitignore b/.gitignore index 06d677ca..e991430e 100644 --- a/.gitignore +++ b/.gitignore @@ -14,6 +14,3 @@ data # Web vault web-vault - -ssl/ -vcpkg/ diff --git a/src/api/admin.rs b/src/api/admin.rs index 7037bfb1..c16fb866 100644 --- a/src/api/admin.rs +++ b/src/api/admin.rs @@ -567,6 +567,13 @@ async fn update_membership_type(data: Json, token: AdminToke } member_to_edit.atype = new_type; + // The manage_* permission flags only apply to the Custom role; clear them on any other + // type so a member changed away from Custom does not retain stale management permissions. + if new_type != MembershipType::Custom { + member_to_edit.manage_users = false; + member_to_edit.manage_groups = false; + member_to_edit.manage_policies = false; + } // This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?; diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index e8403fc1..8d63d75d 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -392,12 +392,12 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos err!("Organization not found", "Organization id's do not match"); } - // Custom users with a manage permission need to read the collection list (metadata only) - // to be able to assign collections to groups/members. This does NOT expose cipher contents. + // Custom users with a user/group manage permission need to read the collection list + // (metadata only) to be able to assign collections to groups/members. This does NOT + // expose cipher contents. manage_policies does not need the collection list. let can_read_collection_list = headers.membership.has_full_access() - || headers.membership.manage_users - || headers.membership.manage_groups - || headers.membership.manage_policies; + || headers.membership.has_manage_users() + || headers.membership.has_manage_groups(); if !can_read_collection_list { err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code); } @@ -430,10 +430,11 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea let has_full_access_to_org = member.has_full_access() || (CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(&org_id, &member.uuid, &conn).await); - // Custom users with a manage permission need the full collection list (metadata only) - // so the web client can render member/group collection assignments without crashing on - // collections it can't otherwise see. This exposes names/ids only, never cipher contents. - let can_read_collection_list = member.manage_users || member.manage_groups || member.manage_policies; + // Custom users with a user/group manage permission need the full collection list + // (metadata only) so the web client can render member/group collection assignments + // without crashing on collections it can't otherwise see. This exposes names/ids + // only, never cipher contents. manage_policies does not need the collection list. + let can_read_collection_list = member.has_manage_users() || member.has_manage_groups(); // Get all admins, owners and managers who can manage/access all // Those are currently not listed in the col_users but need to be listed too. @@ -1075,13 +1076,8 @@ async fn send_invite( let data: InviteData = data.into_inner(); data.validate(&org_id, &conn).await?; - // HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission - // The from_str() will convert the custom role type into a manager role type let raw_type = &data.r#type.into_string(); - // Membership::from_str will convert custom (4) to manager (3) - let new_type = if let Some(new_type) = MembershipType::from_str(raw_type) { - new_type as i32 - } else { + let Some(new_type) = MembershipType::from_str(raw_type) else { err!("Invalid type") }; @@ -1089,11 +1085,11 @@ async fn send_invite( err!("Only Owners can invite Managers, Admins or Owners") } - // HACK: This converts the Custom role which has the `Manage all collections` box checked into an access_all flag - // Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes - // If the box is not checked, the user will still be a manager, but not with the access_all permission + // For a Custom role, the "Manage all collections" parent checkbox is not sent to + // the server; we derive access_all from its three child checkboxes. Admins/Owners + // implicitly have access to all collections. let access_all = new_type >= MembershipType::Admin - || (raw_type.eq("4") + || (new_type == MembershipType::Custom && data.permissions.get("editAnyCollection") == Some(&json!(true)) && data.permissions.get("deleteAnyCollection") == Some(&json!(true)) && data.permissions.get("createNewCollections") == Some(&json!(true))); @@ -1135,7 +1131,7 @@ async fn send_invite( let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(headers.user.email.clone())); new_member.access_all = access_all; - new_member.atype = new_type; + new_member.atype = new_type as i32; new_member.status = member_status; new_member.save(&conn).await?; @@ -1211,7 +1207,7 @@ async fn send_invite( // manage_groups) are allowed to assign groups when inviting. let caller_can_manage_groups = headers.membership_type >= MembershipType::Admin || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { - Some(m) => m.manage_groups, + Some(m) => m.has_manage_groups(), None => false, }; @@ -1635,11 +1631,17 @@ async fn edit_member( } } - // Security: only Admins and Owners may grant the granular custom-role management - // permissions. A custom user with manage_users must not be able to grant these - // permissions (to themselves or others), which would be a privilege escalation. - if headers.membership_type < MembershipType::Admin && (manage_users || manage_groups || manage_policies) { - err!("Only Admins or Owners can grant custom management permissions") + // Security: only Admins and Owners may change the granular custom-role management + // permissions. A Custom member with manage_users must not be able to grant them (to + // themselves or others — a privilege escalation) nor strip flags an Admin/Owner has + // granted to fellow Custom members. Requests that leave the flags unchanged are + // allowed, so such members can still use the regular edit dialog. + if headers.membership_type < MembershipType::Admin + && (manage_users != member_to_edit.manage_users + || manage_groups != member_to_edit.manage_groups + || manage_policies != member_to_edit.manage_policies) + { + err!("Only Admins or Owners can change custom management permissions") } // Security: only callers who can actually manage collections (Admins/Owners, or users @@ -1701,7 +1703,7 @@ async fn edit_member( // with manage_groups) are allowed to change it. For others we leave group membership untouched. let caller_can_manage_groups = headers.membership_type >= MembershipType::Admin || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { - Some(m) => m.manage_groups, + Some(m) => m.has_manage_groups(), None => false, }; @@ -2036,6 +2038,20 @@ async fn list_policies(org_id: OrganizationId, headers: ManagerHeadersLoose, con if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } + + // Security: only Admins/Owners, or Custom members holding at least one management + // permission, may read the full policy list (the Admin Console needs it to load). + // Plain Managers and Custom members without any permission keep the pre-existing + // behaviour of having no access here. + let membership = &headers.membership; + if !(membership.atype >= MembershipType::Admin + || membership.has_manage_users() + || membership.has_manage_groups() + || membership.has_manage_policies()) + { + err!("You don't have permission to view policies") + } + let policies = OrgPolicy::find_by_org(&org_id, &conn).await; let policies_json: Vec = policies.iter().map(OrgPolicy::to_json).collect(); diff --git a/src/auth.rs b/src/auth.rs index 75fe78da..d3c74899 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -720,15 +720,17 @@ impl OrgHeaders { } // Custom-role permission checks. Admins and Owners implicitly hold every // permission; a Custom member holds a permission only if the matching flag - // is set on their Membership. + // is set on their Membership. The has_manage_* helpers gate the flags on the + // Custom type, so stale flags on other types can never grant anything. fn can_manage_users(&self) -> bool { - self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.manage_users) + self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_manage_users()) } fn can_manage_groups(&self) -> bool { - self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.manage_groups) + self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_manage_groups()) } fn can_manage_policies(&self) -> bool { - self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.manage_policies) + self.is_confirmed() + && (self.membership_type >= MembershipType::Admin || self.membership.has_manage_policies()) } } diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index c2ba53b6..92ec4973 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -124,6 +124,11 @@ impl Ord for MembershipType { // Custom is treated as a low-privilege base role (same level as Manager for // ordering purposes); its elevated capabilities are governed by the explicit // manage_* permission flags on the Membership, not by this ordering. + // + // NOTE: Manager and Custom therefore share an access level while being distinct + // variants: the derived `PartialEq` compares the role itself (Manager != Custom), + // while this ordering compares access levels (neither is greater than the other). + // Keep that in mind before relying on `cmp() == Equal` implying equality. const ACCESS_LEVEL: [i32; 5] = [ 3, // Owner 2, // Admin @@ -809,6 +814,21 @@ impl Membership { (self.access_all || self.atype >= MembershipType::Admin) && self.has_status(MembershipStatus::Confirmed) } + // The granular manage_* permission flags are only meaningful while the membership is of + // the Custom type. Gating them on the type here ensures that a stale flag left over from + // a type change (e.g. via the admin panel) can never grant anything. + pub fn has_manage_users(&self) -> bool { + self.has_type(MembershipType::Custom) && self.manage_users + } + + pub fn has_manage_groups(&self) -> bool { + self.has_type(MembershipType::Custom) && self.manage_groups + } + + pub fn has_manage_policies(&self) -> bool { + self.has_type(MembershipType::Custom) && self.manage_policies + } + pub async fn find_by_uuid(uuid: &MembershipId, conn: &DbConn) -> Option { conn.run(move |conn| { users_organizations::table.filter(users_organizations::uuid.eq(uuid)).first::(conn).ok() @@ -915,7 +935,7 @@ impl Membership { .await } - // Get all users which are either owner or admin, or a manager which can manage/access all + // Get all users which are either owner or admin, or a manager/custom member which can manage/access all pub async fn find_confirmed_and_manage_all_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec { conn.run(move |conn| { users_organizations::table @@ -925,7 +945,7 @@ impl Membership { users_organizations::atype .eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]) .or(users_organizations::atype - .eq(MembershipType::Manager as i32) + .eq_any(vec![MembershipType::Manager as i32, MembershipType::Custom as i32]) .and(users_organizations::access_all.eq(true))), ) .load::(conn) @@ -1260,6 +1280,12 @@ mod tests { assert!(MembershipType::Owner > MembershipType::Admin); assert!(MembershipType::Admin > MembershipType::Manager); assert!(MembershipType::Manager > MembershipType::User); - assert!(MembershipType::Manager == MembershipType::from_str("4").unwrap()); + assert!(MembershipType::Custom == MembershipType::from_str("4").unwrap()); + // Manager and Custom share the same access level, but are distinct roles + assert!(MembershipType::Manager != MembershipType::Custom); + assert!(MembershipType::Manager >= MembershipType::Custom); + assert!(MembershipType::Custom >= MembershipType::Manager); + assert!(MembershipType::Custom > MembershipType::User); + assert!(MembershipType::Admin > MembershipType::Custom); } } From 02b6c2c205f1d673b9c7d68cb3f3413050779888 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 8 Jul 2026 13:24:51 +0200 Subject: [PATCH 07/42] Restrict group reads to manage_groups and hide policy contents without manage_policies Tighten two custom-role read paths that were broader than intended: - get_group, get_group_details and get_group_members only required ManagerHeadersLoose, exposing group metadata, collection mappings and membership to any confirmed Manager/Custom member. Require ManageGroupsHeaders (Admin/Owner or manage_groups) instead. - list_policies returned the full policy configuration to any manage_* member. Keep the endpoint reachable so the Admin Console still loads, but return an empty list to callers without manage_policies. --- src/api/core/organizations.rs | 39 ++++++++++++++++------------------- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 8d63d75d..24e82f77 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -2039,21 +2039,18 @@ async fn list_policies(org_id: OrganizationId, headers: ManagerHeadersLoose, con err!("Organization not found", "Organization id's do not match"); } - // Security: only Admins/Owners, or Custom members holding at least one management - // permission, may read the full policy list (the Admin Console needs it to load). - // Plain Managers and Custom members without any permission keep the pre-existing - // behaviour of having no access here. - let membership = &headers.membership; - if !(membership.atype >= MembershipType::Admin - || membership.has_manage_users() - || membership.has_manage_groups() - || membership.has_manage_policies()) - { - err!("You don't have permission to view policies") - } - - let policies = OrgPolicy::find_by_org(&org_id, &conn).await; - let policies_json: Vec = policies.iter().map(OrgPolicy::to_json).collect(); + // Security: only Admins/Owners, or Custom members holding the manage_policies permission, + // may see the actual policy configuration. Other Managers/Custom members (e.g. manage_users + // or manage_groups only) are still allowed to call this endpoint so the Admin Console can + // load, but they receive an empty list instead of the policy contents. + let can_view_policies = + headers.membership.atype >= MembershipType::Admin || headers.membership.has_manage_policies(); + + let policies_json: Vec = if can_view_policies { + OrgPolicy::find_by_org(&org_id, &conn).await.iter().map(OrgPolicy::to_json).collect() + } else { + Vec::new() + }; Ok(Json(json!({ "data": policies_json, @@ -2856,10 +2853,10 @@ async fn add_update_group( async fn get_group_details( org_id: OrganizationId, group_id: GroupId, - headers: ManagerHeadersLoose, + headers: ManageGroupsHeaders, conn: DbConn, ) -> JsonResult { - if org_id != headers.membership.org_uuid { + if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } if !CONFIG.org_groups_enabled() { @@ -2950,10 +2947,10 @@ async fn bulk_delete_groups( async fn get_group( org_id: OrganizationId, group_id: GroupId, - headers: ManagerHeadersLoose, + headers: ManageGroupsHeaders, conn: DbConn, ) -> JsonResult { - if org_id != headers.membership.org_uuid { + if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } if !CONFIG.org_groups_enabled() { @@ -2971,10 +2968,10 @@ async fn get_group( async fn get_group_members( org_id: OrganizationId, group_id: GroupId, - headers: ManagerHeadersLoose, + headers: ManageGroupsHeaders, conn: DbConn, ) -> JsonResult { - if org_id != headers.membership.org_uuid { + if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } if !CONFIG.org_groups_enabled() { From 1dcd3ea26f32d73cab9ff181e55acb2c31037591 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 8 Jul 2026 15:51:57 +0200 Subject: [PATCH 08/42] Block collection access via group assignment in edit_member and send_invite A Custom member holding manage_users + manage_groups (but without collection access) could add a member -- including themselves via edit_member, or an attacker-controlled invitee via send_invite -- to an access_all or collection-bearing group, and thereby indirectly gain read access to those collections' cipher contents. This bypassed the collection-access boundary already enforced in put_group_members and add_update_group. Gate both member-centric group-assignment paths on collection-management rights via a shared `may_change_group_membership` predicate: callers who cannot manage collections may only add/remove membership of groups that confer no collection access, and collection-bearing memberships are left untouched (neither granted nor revoked). Admins/Owners and full-access callers keep the previous full-replace behaviour. Add a regression unit test for the predicate. --- src/api/core/organizations.rs | 89 +++++++++++++++++++++++++++++++++-- 1 file changed, 85 insertions(+), 4 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 8aae8b97..e0776826 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1218,6 +1218,14 @@ async fn send_invite( if caller_can_manage_groups { for group_id in &data.groups { + // Security: a caller who cannot manage collections must not grant collection + // access to the invitee by placing them into a collection-bearing group. + if !may_change_group_membership( + caller_can_manage_collections, + group_confers_collection_access(group_id, &org_id, &conn).await, + ) { + continue; + } let mut group_entry = GroupUser::new(group_id.clone(), new_member.uuid.clone()); group_entry.save(&conn).await?; } @@ -1713,11 +1721,42 @@ async fn edit_member( }; if caller_can_manage_groups { - GroupUser::delete_all_by_member(&member_to_edit.uuid, &conn).await?; + if caller_can_manage_collections { + // Caller may grant/revoke collection access via groups: full replace. + GroupUser::delete_all_by_member(&member_to_edit.uuid, &conn).await?; - for group_id in data.groups.iter().flatten() { - let mut group_entry = GroupUser::new(group_id.clone(), member_to_edit.uuid.clone()); - group_entry.save(&conn).await?; + for group_id in data.groups.iter().flatten() { + let mut group_entry = GroupUser::new(group_id.clone(), member_to_edit.uuid.clone()); + group_entry.save(&conn).await?; + } + } else { + // Security: the caller may manage groups but NOT collections. They may only change the + // member's membership in groups that confer no collection access; collection-bearing + // memberships are preserved untouched (neither granted nor revoked), mirroring the + // restriction enforced in put_group_members and add_update_group. + + // Remove the member only from non-collection-bearing groups; keep collection-bearing + // memberships so this caller cannot revoke collection access either. + for gu in GroupUser::find_by_member(&member_to_edit.uuid, &conn).await { + if may_change_group_membership( + caller_can_manage_collections, + group_confers_collection_access(&gu.groups_uuid, &org_id, &conn).await, + ) { + GroupUser::delete_by_group_and_member(&gu.groups_uuid, &member_to_edit.uuid, &conn).await?; + } + } + + // Add the requested groups, skipping any that would grant collection access. + for group_id in data.groups.iter().flatten() { + if !may_change_group_membership( + caller_can_manage_collections, + group_confers_collection_access(group_id, &org_id, &conn).await, + ) { + continue; + } + let mut group_entry = GroupUser::new(group_id.clone(), member_to_edit.uuid.clone()); + group_entry.save(&conn).await?; + } } } @@ -2809,6 +2848,25 @@ async fn put_group( .await } +/// Whether a caller may change (add OR remove) a member's membership in a group. +/// +/// A caller who cannot manage collections must never touch a *collection-bearing* group's +/// membership: adding would indirectly grant collection access, removing would revoke it. +/// Callers who can manage collections may change any group's membership. This mirrors the +/// restriction already enforced inline in `put_group_members` and `add_update_group`. +fn may_change_group_membership(caller_can_manage_collections: bool, group_confers_collection_access: bool) -> bool { + caller_can_manage_collections || !group_confers_collection_access +} + +/// Returns true if being a member of `group_id` confers collection access — either because the +/// group has `access_all` set, or because it has collections assigned. +async fn group_confers_collection_access(group_id: &GroupId, org_id: &OrganizationId, conn: &DbConn) -> bool { + match Group::find_by_uuid_and_org(group_id, org_id, conn).await { + Some(group) => group.access_all || !CollectionGroup::find_by_group(group_id, org_id, conn).await.is_empty(), + None => false, + } +} + async fn add_update_group( mut group: Group, collections: Vec, @@ -3439,3 +3497,26 @@ async fn rotate_api_key( ) -> JsonResult { api_key(&org_id, data, true, headers, conn).await } + +#[cfg(test)] +mod tests { + use super::may_change_group_membership; + + #[test] + fn manage_groups_caller_cannot_grant_collection_access_via_groups() { + // A caller who can manage collections may change membership of any group. + assert!(may_change_group_membership(true, true)); + assert!(may_change_group_membership(true, false)); + + // A caller who cannot manage collections may change membership of groups that confer no + // collection access (plain groups). + assert!(may_change_group_membership(false, false)); + + // REGRESSION (privilege escalation, PR #7397): a caller who cannot manage collections must + // NOT be able to change membership of a collection-bearing / access_all group. This is the + // vector that let a Custom user with manage_users + manage_groups add themselves to an + // access_all group and read all collection contents via edit_member / send_invite. Adding + // AND removing such memberships must be denied. + assert!(!may_change_group_membership(false, true)); + } +} From 81b76d9782aa84cfb8e5a9dbf5b7342456b8139f Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 8 Jul 2026 18:29:52 +0200 Subject: [PATCH 09/42] Persist manage_* permission flags on invite send_invite computed access_all from the invite permissions but never wrote the manage_users / manage_groups / manage_policies flags onto the new membership, so a Custom member invited with a management permission checked was created without it (the web-vault sends everything in a single invite POST, with no follow-up edit). Mirror the handling in edit_member and persist the flags at invite time. Only Owners can invite Custom members, so the caller is always authorized to grant these; the flags are gated on the Custom type and forced false for every other type. --- src/api/core/organizations.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index e0776826..9528a756 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1095,6 +1095,14 @@ async fn send_invite( && data.permissions.get("deleteAnyCollection") == Some(&json!(true)) && data.permissions.get("createNewCollections") == Some(&json!(true))); + // Read the explicit Custom-role management permissions. These only apply to the + // Custom type; for every other type they are forced to false. Only Owners can invite + // Custom members (checked above), so the caller is always authorized to grant these. + let perm = |key: &str| new_type == MembershipType::Custom && data.permissions.get(key) == Some(&json!(true)); + let manage_users = perm("manageUsers"); + let manage_groups = perm("manageGroups"); + let manage_policies = perm("managePolicies"); + let mut user_created: bool = false; for email in &data.emails { let mut member_status = MembershipStatus::Invited as i32; @@ -1137,6 +1145,9 @@ async fn send_invite( let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(headers.user.email.clone())); new_member.access_all = access_all; new_member.atype = new_type as i32; + new_member.manage_users = manage_users; + new_member.manage_groups = manage_groups; + new_member.manage_policies = manage_policies; new_member.status = member_status; new_member.save(&conn).await?; From 8a65c6631a9a93842e73551daf6ba96c608c3b57 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 8 Jul 2026 19:39:49 +0200 Subject: [PATCH 10/42] Security: gate group delete/member-removal on collection access A Custom member with only the manage_groups permission could revoke other members' collection access via two endpoints that were missing the collection-access check enforced elsewhere (put_group_members, edit_member): - POST /organizations//groups//delete-user/ (post_delete_group_member) removed a member from any group, including collection-bearing ones. - DELETE /organizations//groups/ and its bulk variant (delete_group_impl / bulk_delete_groups) deleted collection-bearing groups outright, revoking access for all their members. Neither path can grant access, so confidentiality was never at risk, but both let a manage_groups-only user tamper with other members' collection access, contradicting the permission's invariant. Both now require Admin/Owner or full collection access before touching a group that confers collection access (via access_all or assigned collections). --- src/api/core/organizations.rs | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 9528a756..73465b80 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -2989,6 +2989,23 @@ async fn delete_group_impl( err!("Group not found", "Group uuid is invalid or does not belong to the organization") }; + // Security: deleting a group that grants collection access (via `access_all` or assigned + // collections) revokes that access for all its members. A custom user with only manage_groups + // must not be able to affect collection access, so only callers who can actually manage + // collections (Admins/Owners or users with full access) may delete such a group. Mirrors the + // restriction in put_group_members / post_delete_group_member. Also covers bulk_delete_groups, + // which funnels through this function. + let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, org_id, conn).await { + Some(m) => m.has_full_access(), + None => false, + }; + if !caller_can_manage_collections + && (group.access_all || !CollectionGroup::find_by_group(group_id, org_id, conn).await.is_empty()) + { + err!("You don't have permission to delete a group that grants collection access") + } + log_event( EventType::GroupDeleted as i32, &group.uuid, @@ -3159,6 +3176,20 @@ async fn post_delete_group_member( err!("Group could not be found or does not belong to the organization."); } + // Security: removing a member from a group that grants collection access (via `access_all` + // or assigned collections) revokes that member's collection access. A custom user with only + // manage_groups must not be able to affect collection access, so only callers who can actually + // manage collections (Admins/Owners or users with full access) may do this. Mirrors the + // restriction enforced in put_group_members. + let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin + || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(m) => m.has_full_access(), + None => false, + }; + if !caller_can_manage_collections && group_confers_collection_access(&group_id, &org_id, &conn).await { + err!("You don't have permission to change the membership of a group that grants collection access") + } + log_event( EventType::OrganizationUserUpdatedGroups as i32, &member_id, From b571efcaddeeb7b33a84c1baae243041b621e7e4 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 9 Jul 2026 16:20:16 +0200 Subject: [PATCH 11/42] Migrate legacy Manager members to the Custom type Before this PR every member created with the Custom role was stored as Manager (3) and masqueraded as Custom (4) in API responses. With the masquerade removed, those members would suddenly surface as type 3, which current clients no longer support and the admin panel cannot render. Convert them to the now-persisted Custom type; access_all is preserved and the new manage_* flags stay false, matching the exact capabilities and appearance these members had before. The down migration converts Custom members back to Manager so older server versions (which cannot load type 4) keep working after a rollback. --- .../2026-06-30-120000_add_custom_role_permissions/down.sql | 3 +++ .../2026-06-30-120000_add_custom_role_permissions/up.sql | 6 ++++++ .../2026-06-30-120000_add_custom_role_permissions/down.sql | 3 +++ .../2026-06-30-120000_add_custom_role_permissions/up.sql | 6 ++++++ .../2026-06-30-120000_add_custom_role_permissions/down.sql | 3 +++ .../2026-06-30-120000_add_custom_role_permissions/up.sql | 6 ++++++ 6 files changed, 27 insertions(+) diff --git a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql index f1979ae7..9ac54bfb 100644 --- a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql +++ b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -1,3 +1,6 @@ +-- Convert Custom members back to Manager, the representation older server versions +-- expect (they masquerade Manager as Custom in API responses and cannot load type 4). +UPDATE users_organizations SET atype = 3 WHERE atype = 4; ALTER TABLE users_organizations DROP COLUMN manage_users; ALTER TABLE users_organizations DROP COLUMN manage_groups; ALTER TABLE users_organizations DROP COLUMN manage_policies; diff --git a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql index 11094951..6ffdca13 100644 --- a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql +++ b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -1,3 +1,9 @@ ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; +-- Previously the server stored members created with the Custom role as Manager (3) and +-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted +-- type, convert those members so clients (which no longer know the Manager role) keep +-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE, +-- which matches the capabilities these members had. +UPDATE users_organizations SET atype = 4 WHERE atype = 3; diff --git a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql index f1979ae7..9ac54bfb 100644 --- a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql +++ b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -1,3 +1,6 @@ +-- Convert Custom members back to Manager, the representation older server versions +-- expect (they masquerade Manager as Custom in API responses and cannot load type 4). +UPDATE users_organizations SET atype = 3 WHERE atype = 4; ALTER TABLE users_organizations DROP COLUMN manage_users; ALTER TABLE users_organizations DROP COLUMN manage_groups; ALTER TABLE users_organizations DROP COLUMN manage_policies; diff --git a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql index 11094951..6ffdca13 100644 --- a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql +++ b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -1,3 +1,9 @@ ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; +-- Previously the server stored members created with the Custom role as Manager (3) and +-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted +-- type, convert those members so clients (which no longer know the Manager role) keep +-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE, +-- which matches the capabilities these members had. +UPDATE users_organizations SET atype = 4 WHERE atype = 3; diff --git a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql index f1979ae7..9ac54bfb 100644 --- a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql +++ b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -1,3 +1,6 @@ +-- Convert Custom members back to Manager, the representation older server versions +-- expect (they masquerade Manager as Custom in API responses and cannot load type 4). +UPDATE users_organizations SET atype = 3 WHERE atype = 4; ALTER TABLE users_organizations DROP COLUMN manage_users; ALTER TABLE users_organizations DROP COLUMN manage_groups; ALTER TABLE users_organizations DROP COLUMN manage_policies; diff --git a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql index 11094951..6ffdca13 100644 --- a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql +++ b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -1,3 +1,9 @@ ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; +-- Previously the server stored members created with the Custom role as Manager (3) and +-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted +-- type, convert those members so clients (which no longer know the Manager role) keep +-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE, +-- which matches the capabilities these members had. +UPDATE users_organizations SET atype = 4 WHERE atype = 3; From 011e5c005bcbb62bbe0ad3aa593d9ac0935f81f3 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 9 Jul 2026 16:20:36 +0200 Subject: [PATCH 12/42] Add the Custom role to the admin panel The admin panel only knew types 0/1/2 plus the masqueraded "4": Manager mapping. A Custom member would have been shown as "Manager" with the Manager radio (value 3) preselected in the role dialog, so saving it silently converted the member to Manager and wiped their manage_* flags. Any remaining legacy Manager member (type 3) would have thrown a TypeError and broken the dialog entirely. Add a proper Custom (4) entry and radio button, and keep a Manager (3) entry for members created through older clients. --- src/static/scripts/admin_users.js | 6 +++++- src/static/templates/admin/users.hbs | 3 +++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/static/scripts/admin_users.js b/src/static/scripts/admin_users.js index 99e39aab..1bae0aa3 100644 --- a/src/static/scripts/admin_users.js +++ b/src/static/scripts/admin_users.js @@ -174,10 +174,14 @@ const ORG_TYPES = { "name": "User", "bg": "blue" }, - "4": { + "3": { "name": "Manager", "bg": "green" }, + "4": { + "name": "Custom", + "bg": "teal" + }, }; // Special sort function to sort dates in ISO format diff --git a/src/static/templates/admin/users.hbs b/src/static/templates/admin/users.hbs index 4c91bc0e..3bd63446 100644 --- a/src/static/templates/admin/users.hbs +++ b/src/static/templates/admin/users.hbs @@ -135,6 +135,9 @@
+
+ +
From 84b8de124e640540fdbdb17d3445f55471a4a6ba Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 9 Jul 2026 16:20:37 +0200 Subject: [PATCH 13/42] Keep per-collection manage working for Custom members The manage flag in collection JSON was gated on atype == Manager, a raw comparison that now excludes Custom (4). A Custom member holding an explicit per-collection manage assignment (or full read/write access) would have lost the manage capability in /sync and the collection details endpoints - before this PR they were stored as Manager and matched. Compare by access level (>= Manager, which Manager and Custom share) instead, restoring the exact pre-PR behavior for migrated members. Admins/Owners are unaffected: they are caught by the earlier has_full_access / >= Admin arms. --- src/db/models/collection.rs | 11 ++++++----- src/db/models/organization.rs | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index f29843f7..51a8d2c2 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -102,8 +102,9 @@ impl Collection { // Owners and Admins always have true. Users are not able to have full access Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager), Some(m) => { - // Only let a manager manage collections when the have full read/write access - let is_manager = m.atype == MembershipType::Manager; + // Only let a manager-level member (Manager or Custom) manage collections + // when they have full read/write access + let is_manager = m.atype >= MembershipType::Manager; if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) { ( cu.read_only, @@ -125,11 +126,11 @@ impl Collection { } else { match Membership::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await { Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager), - Some(m) if m.atype == MembershipType::Manager && self.is_manageable_by_user(user_uuid, conn).await => { + Some(m) if m.atype >= MembershipType::Manager && self.is_manageable_by_user(user_uuid, conn).await => { (false, false, true) } Some(m) => { - let is_manager = m.atype == MembershipType::Manager; + let is_manager = m.atype >= MembershipType::Manager; let read_only = !self.is_writable_by_user(user_uuid, conn).await; let hide_passwords = self.hide_passwords_for_user(user_uuid, conn).await; (read_only, hide_passwords, is_manager && !read_only && !hide_passwords) @@ -945,7 +946,7 @@ impl CollectionMembership { "hidePasswords": self.hide_passwords, "manage": membership_type >= MembershipType::Admin || self.manage - || (membership_type == MembershipType::Manager + || (membership_type >= MembershipType::Manager && !self.read_only && !self.hide_passwords), }) diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 92ec4973..11789ec9 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -584,7 +584,7 @@ impl Membership { ( cu.read_only, cu.hide_passwords, - cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords), + cu.manage || (self.atype >= MembershipType::Manager && !cu.read_only && !cu.hide_passwords), ) // If previous checks failed it might be that this user has access via a group, but we should not return those elements here // Those are returned via a special group endpoint From 4b90b47dec79841b3f4debe671133552140e91ef Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sat, 11 Jul 2026 00:31:18 +0200 Subject: [PATCH 14/42] Fix privilege escalation: restrict role-type changes to Admins/Owners in edit_member A Custom member with the manage_users permission reaches edit_member via ManageUsersHeaders. Every mutated field there (access_all, the manage_* flags, collection and group assignments) is gated behind an Admin/collection-management check -- except the role type itself, which was written unconditionally aside from the existing Admin/Owner-elevation guard. Because collection "manage" rights are role-derived (`atype >= Manager` grants manage on any collection the member can write), a manage_users caller with no collection access could promote a plain User to Manager/Custom to grant them collection administration (rename/delete/re-share), or demote to revoke it -- a separation-of-duties break between the user-management and data planes. Add a may_change_member_type() guard so callers below Admin may only submit an unchanged role (keeping the regular edit dialog working), and cover it with a regression unit test. --- src/api/core/organizations.rs | 55 ++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 0b0df1ac..b2a2a6a0 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1641,6 +1641,18 @@ async fn edit_member( err!("Only Owners can grant and remove Admin or Owner privileges") } + // Security: only Admins and Owners may change a member's role type at all. A Custom member + // with manage_users must not change roles: raising a member to Manager/Custom grants + // collection-"manage" on every collection they can already write (see the `atype >= Manager` + // branch in `Collection`/`Membership` json), and lowering it revokes that access — both are + // collection-access changes this caller is not entitled to make, even though the manage_* + // flags and access_all are already gated below. Requests that leave the role unchanged are + // allowed, so such members can still use the regular edit dialog. The Admin/Owner guard above + // still governs Admin/Owner transitions for Owners. + if !may_change_member_type(headers.membership_type, member_to_edit.atype, new_type) { + err!("Only Admins or Owners can change a member's role") + } + if member_to_edit.atype == MembershipType::Owner && headers.membership_type != MembershipType::Owner { err!("Only Owners can edit Owner users") } @@ -2869,6 +2881,20 @@ fn may_change_group_membership(caller_can_manage_collections: bool, group_confer caller_can_manage_collections || !group_confers_collection_access } +/// Whether a caller of `edit_member` may change a member's role type. +/// +/// Only Admins and Owners may change a member's role at all. A Custom member with `manage_users` +/// must not, because the role type has collection-access side effects: a member of type +/// `Manager`/`Custom` gains collection-"manage" on every collection they can write (the +/// `atype >= Manager` branches in `Collection`/`Membership`), so promoting grants that access and +/// demoting revokes it. `manage_users` covers the user lifecycle, not the data plane, so role +/// changes are reserved for Admins/Owners. Leaving the role unchanged is always allowed so +/// `manage_users` members can still use the regular edit dialog. Admin/Owner transitions are +/// additionally governed by the dedicated Owner-only guard in `edit_member`. +fn may_change_member_type(caller_type: MembershipType, current_atype: i32, new_type: MembershipType) -> bool { + caller_type >= MembershipType::Admin || new_type == current_atype +} + /// Returns true if being a member of `group_id` confers collection access — either because the /// group has `access_all` set, or because it has collections assigned. async fn group_confers_collection_access(group_id: &GroupId, org_id: &OrganizationId, conn: &DbConn) -> bool { @@ -3542,7 +3568,34 @@ async fn rotate_api_key( #[cfg(test)] mod tests { - use super::may_change_group_membership; + use super::{may_change_group_membership, may_change_member_type}; + use crate::db::models::MembershipType; + + #[test] + fn manage_users_caller_cannot_change_member_role() { + let user = MembershipType::User as i32; + let manager = MembershipType::Manager as i32; + let custom = MembershipType::Custom as i32; + + // Admins and Owners may change a member's role. + assert!(may_change_member_type(MembershipType::Owner, user, MembershipType::Manager)); + assert!(may_change_member_type(MembershipType::Admin, user, MembershipType::Custom)); + + // A below-Admin caller (Manager / Custom-with-manage_users) may only submit an unchanged + // role, so the regular edit dialog keeps working. + assert!(may_change_member_type(MembershipType::Custom, user, MembershipType::User)); + assert!(may_change_member_type(MembershipType::Custom, custom, MembershipType::Custom)); + assert!(may_change_member_type(MembershipType::Manager, manager, MembershipType::Manager)); + + // REGRESSION (privilege escalation, PR #7397 / finding F1): a caller below Admin must NOT + // be able to change a member's role. Promoting User -> Manager/Custom grants that member + // collection-"manage" on their writable collections (atype >= Manager), and demoting + // revokes it — collection-access changes a manage_users caller is not entitled to make. + assert!(!may_change_member_type(MembershipType::Custom, user, MembershipType::Manager)); + assert!(!may_change_member_type(MembershipType::Custom, user, MembershipType::Custom)); + assert!(!may_change_member_type(MembershipType::Custom, manager, MembershipType::User)); + assert!(!may_change_member_type(MembershipType::Manager, custom, MembershipType::User)); + } #[test] fn manage_groups_caller_cannot_grant_collection_access_via_groups() { From 44139eb0c79ea429fc5e6e021686bc442b7a7fbf Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:18:49 +0200 Subject: [PATCH 15/42] Add granular custom collection permissions Persist create, edit-any, and delete-any collection grants independently for Custom members. Enforce dedicated create/delete guards, preserve edit-any cipher access, cover imports and metadata reads, and add fail-closed role transitions, migrations, and regression tests. --- .../down.sql | 9 + .../up.sql | 11 + .../down.sql | 9 + .../up.sql | 11 + .../down.sql | 9 + .../up.sql | 11 + src/api/admin.rs | 86 +++++- src/api/core/organizations.rs | 274 ++++++++++++------ src/auth.rs | 216 +++++++++++++- src/db/models/organization.rs | 201 +++++++++++-- src/db/schema.rs | 3 + .../templates/scss/vaultwarden.scss.hbs | 5 +- 12 files changed, 716 insertions(+), 129 deletions(-) create mode 100644 migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/down.sql create mode 100644 migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql create mode 100644 migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/down.sql create mode 100644 migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql create mode 100644 migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql create mode 100644 migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql diff --git a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/down.sql b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/down.sql new file mode 100644 index 00000000..6506059d --- /dev/null +++ b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/down.sql @@ -0,0 +1,9 @@ +-- The previous schema exposes access_all as the three collection permissions together. Avoid +-- turning Edit-only memberships into Create/Edit/Delete grants when rolling back. +UPDATE users_organizations +SET access_all = create_new_collections AND edit_any_collection AND delete_any_collection +WHERE atype = 4; + +ALTER TABLE users_organizations DROP COLUMN create_new_collections; +ALTER TABLE users_organizations DROP COLUMN edit_any_collection; +ALTER TABLE users_organizations DROP COLUMN delete_any_collection; diff --git a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql new file mode 100644 index 00000000..c13662c4 --- /dev/null +++ b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -0,0 +1,11 @@ +ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE; + +-- Before these permissions were persisted independently, access_all represented the legacy +-- "Manage all collections" checkbox. Preserve that capability for existing Custom members. +UPDATE users_organizations +SET create_new_collections = access_all, + edit_any_collection = access_all, + delete_any_collection = access_all +WHERE atype = 4; diff --git a/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/down.sql b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/down.sql new file mode 100644 index 00000000..6506059d --- /dev/null +++ b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/down.sql @@ -0,0 +1,9 @@ +-- The previous schema exposes access_all as the three collection permissions together. Avoid +-- turning Edit-only memberships into Create/Edit/Delete grants when rolling back. +UPDATE users_organizations +SET access_all = create_new_collections AND edit_any_collection AND delete_any_collection +WHERE atype = 4; + +ALTER TABLE users_organizations DROP COLUMN create_new_collections; +ALTER TABLE users_organizations DROP COLUMN edit_any_collection; +ALTER TABLE users_organizations DROP COLUMN delete_any_collection; diff --git a/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql new file mode 100644 index 00000000..c13662c4 --- /dev/null +++ b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -0,0 +1,11 @@ +ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE; + +-- Before these permissions were persisted independently, access_all represented the legacy +-- "Manage all collections" checkbox. Preserve that capability for existing Custom members. +UPDATE users_organizations +SET create_new_collections = access_all, + edit_any_collection = access_all, + delete_any_collection = access_all +WHERE atype = 4; diff --git a/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql new file mode 100644 index 00000000..6506059d --- /dev/null +++ b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql @@ -0,0 +1,9 @@ +-- The previous schema exposes access_all as the three collection permissions together. Avoid +-- turning Edit-only memberships into Create/Edit/Delete grants when rolling back. +UPDATE users_organizations +SET access_all = create_new_collections AND edit_any_collection AND delete_any_collection +WHERE atype = 4; + +ALTER TABLE users_organizations DROP COLUMN create_new_collections; +ALTER TABLE users_organizations DROP COLUMN edit_any_collection; +ALTER TABLE users_organizations DROP COLUMN delete_any_collection; diff --git a/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql new file mode 100644 index 00000000..c13662c4 --- /dev/null +++ b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -0,0 +1,11 @@ +ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE; + +-- Before these permissions were persisted independently, access_all represented the legacy +-- "Manage all collections" checkbox. Preserve that capability for existing Custom members. +UPDATE users_organizations +SET create_new_collections = access_all, + edit_any_collection = access_all, + delete_any_collection = access_all +WHERE atype = 4; diff --git a/src/api/admin.rs b/src/api/admin.rs index c16fb866..0c85d562 100644 --- a/src/api/admin.rs +++ b/src/api/admin.rs @@ -544,6 +544,31 @@ struct MembershipTypeData { org_uuid: OrganizationId, } +fn apply_membership_type_change(membership: &mut Membership, new_type: MembershipType) { + let was_custom = membership.atype == MembershipType::Custom; + + // Entering Custom through the Vaultwarden admin panel is deliberately fail-closed because + // that UI cannot select granular permissions; they can be granted later through the regular + // organization member dialog. + if new_type == MembershipType::Custom && !was_custom { + membership.clear_custom_permissions(); + membership.access_all = false; + } + if new_type != MembershipType::Custom { + membership.clear_custom_permissions(); + } + + // Prevent stale access_all from surviving a demotion to User. Admins/Owners have implicit + // full access, while legacy Manager access_all is intentionally preserved for compatibility. + match new_type { + MembershipType::Owner | MembershipType::Admin => membership.access_all = true, + MembershipType::User => membership.access_all = false, + MembershipType::Manager | MembershipType::Custom => {} + } + + membership.atype = new_type as i32; +} + #[post("/users/org_type", format = "application/json", data = "")] async fn update_membership_type(data: Json, token: AdminToken, conn: DbConn) -> EmptyResult { let data: MembershipTypeData = data.into_inner(); @@ -553,9 +578,7 @@ async fn update_membership_type(data: Json, token: AdminToke err!("The specified user isn't member of the organization") }; - let new_type = if let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) { - new_type as i32 - } else { + let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) else { err!("Invalid type") }; @@ -566,14 +589,7 @@ async fn update_membership_type(data: Json, token: AdminToke } } - member_to_edit.atype = new_type; - // The manage_* permission flags only apply to the Custom role; clear them on any other - // type so a member changed away from Custom does not retain stale management permissions. - if new_type != MembershipType::Custom { - member_to_edit.manage_users = false; - member_to_edit.manage_groups = false; - member_to_edit.manage_policies = false; - } + apply_membership_type_change(&mut member_to_edit, new_type); // This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?; @@ -876,6 +892,14 @@ impl<'r> FromRequest<'r> for AdminToken { #[cfg(test)] mod tests { use super::*; + use crate::db::models::MembershipStatus; + + fn membership(member_type: MembershipType) -> Membership { + let mut membership = Membership::new("test-user".to_owned().into(), "test-org".to_owned().into(), None); + membership.atype = member_type as i32; + membership.status = MembershipStatus::Confirmed as i32; + membership + } #[test] fn validate_web_vault_compare() { @@ -900,4 +924,44 @@ mod tests { assert!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1") == 1); assert!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2") == 1); } + + #[test] + fn admin_type_changes_clear_custom_permissions_and_stale_access() { + let mut custom = membership(MembershipType::Custom); + custom.access_all = true; + custom.manage_users = true; + custom.create_new_collections = true; + custom.edit_any_collection = true; + custom.delete_any_collection = true; + + apply_membership_type_change(&mut custom, MembershipType::User); + assert_eq!(custom.atype, MembershipType::User as i32); + assert!(!custom.access_all); + assert!(!custom.manage_users); + assert!(!custom.create_new_collections); + assert!(!custom.edit_any_collection); + assert!(!custom.delete_any_collection); + + let mut admin = membership(MembershipType::Admin); + admin.access_all = true; + apply_membership_type_change(&mut admin, MembershipType::Custom); + assert_eq!(admin.atype, MembershipType::Custom as i32); + assert!(!admin.access_all, "entering Custom through this UI must be fail-closed"); + assert!(!admin.has_manage_all_collections()); + } + + #[test] + fn admin_and_legacy_manager_access_all_behavior_is_preserved() { + let mut user = membership(MembershipType::User); + apply_membership_type_change(&mut user, MembershipType::Admin); + assert!(user.access_all); + + let mut custom = membership(MembershipType::Custom); + custom.access_all = true; + custom.edit_any_collection = true; + apply_membership_type_change(&mut custom, MembershipType::Manager); + assert_eq!(custom.atype, MembershipType::Manager as i32); + assert!(custom.access_all); + assert!(!custom.edit_any_collection); + } } diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index b2a2a6a0..63d142e8 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -12,8 +12,9 @@ use crate::{ core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor}, }, auth::{ - AdminHeaders, Headers, ManageGroupsHeaders, ManagePoliciesHeaders, ManageUsersHeaders, ManagerHeaders, - ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite, + AdminHeaders, CollectionDeleteHeaders, CollectionReadHeaders, Headers, ManageGroupsHeaders, + ManagePoliciesHeaders, ManageUsersHeaders, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, + decode_invite, }, db::{ DbConn, @@ -398,7 +399,8 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos // expose cipher contents. manage_policies does not need the collection list. let can_read_collection_list = headers.membership.has_full_access() || headers.membership.has_manage_users() - || headers.membership.has_manage_groups(); + || headers.membership.has_manage_groups() + || headers.membership.has_delete_any_collection(); if !can_read_collection_list { err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code); } @@ -435,7 +437,12 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea // (metadata only) so the web client can render member/group collection assignments // without crashing on collections it can't otherwise see. This exposes names/ids // only, never cipher contents. manage_policies does not need the collection list. - let can_read_collection_list = member.has_manage_users() || member.has_manage_groups(); + let can_read_collection_list = + member.has_manage_users() || member.has_manage_groups() || member.has_delete_any_collection(); + // Delete any collection can reveal collection access metadata, matching Bitwarden's + // ReadAllWithAccess behavior, but still does not grant cipher access. Manage Users/Groups + // retain the narrower metadata-only view introduced by the base PR. + let can_read_all_collection_access = member.has_edit_any_collection() || member.has_delete_any_collection(); // Get all admins, owners and managers who can manage/access all // Those are currently not listed in the col_users but need to be listed too. @@ -464,7 +471,7 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea // Exception: custom users with a manage permission get a metadata-only entry (no user // or group access details) so the web client can resolve assignment references without // crashing. This never exposes cipher contents. - if !assigned { + if !assigned && !can_read_all_collection_access { if can_read_collection_list { let mut json_object = col.to_json_details(&headers.user.uuid, None, &conn).await; json_object["assigned"] = json!(false); @@ -530,16 +537,16 @@ async fn post_organization_collections( if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } - let data: FullCollectionData = data.into_inner(); - data.validate(&org_id, &conn).await?; - // Managers and custom users may only create collections if they have full access. - // (A custom user with manage_users/manage_groups/manage_policies but no collection - // access must not be able to create collections.) - if !headers.membership.has_full_access() && headers.membership.atype < MembershipType::Admin { + // Create is independent from Edit/Delete. In particular, Edit any collection's internal + // access_all representation must not implicitly grant this endpoint. + if !headers.membership.can_create_new_collections() { err!("You don't have permission to create collections") } + let data: FullCollectionData = data.into_inner(); + data.validate(&org_id, &conn).await?; + let collection = Collection::new(org_id.clone(), data.name, data.external_id); collection.save(&conn).await?; @@ -743,7 +750,7 @@ async fn post_organization_collection_update( async fn delete_organization_collection_impl( org_id: &OrganizationId, col_id: &CollectionId, - headers: &ManagerHeaders, + headers: &CollectionDeleteHeaders, conn: &DbConn, ) -> EmptyResult { if org_id != &headers.org_id { @@ -769,7 +776,7 @@ async fn delete_organization_collection_impl( async fn delete_organization_collection( org_id: OrganizationId, col_id: CollectionId, - headers: ManagerHeaders, + headers: CollectionDeleteHeaders, conn: DbConn, ) -> EmptyResult { delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await @@ -779,7 +786,7 @@ async fn delete_organization_collection( async fn post_organization_collection_delete( org_id: OrganizationId, col_id: CollectionId, - headers: ManagerHeaders, + headers: CollectionDeleteHeaders, conn: DbConn, ) -> EmptyResult { delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await @@ -805,7 +812,7 @@ async fn bulk_delete_organization_collections( let collections = data.ids; - let headers = ManagerHeaders::from_loose(headers, &collections, &conn).await?; + let headers = CollectionDeleteHeaders::from_loose(headers, &collections, &conn).await?; for col_id in collections { delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await?; @@ -817,23 +824,19 @@ async fn bulk_delete_organization_collections( async fn get_org_collection_detail( org_id: OrganizationId, col_id: CollectionId, - headers: ManagerHeaders, + headers: CollectionReadHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } - match Collection::find_by_uuid_and_user(&col_id, headers.user.uuid.clone(), &conn).await { + match Collection::find_by_uuid_and_org(&col_id, &org_id, &conn).await { None => err!("Collection not found"), Some(collection) => { if collection.org_uuid != org_id { err!("Collection is not owned by organization") } - let Some(member) = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await else { - err!("User is not part of organization") - }; - let groups: Vec = if CONFIG.org_groups_enabled() { CollectionGroup::find_by_collection(&collection.uuid, &conn) .await @@ -867,7 +870,7 @@ async fn get_org_collection_detail( }) .collect(); - let assigned = Collection::can_access_collection(&member, &collection.uuid, &conn).await; + let assigned = Collection::can_access_collection(&headers.membership, &collection.uuid, &conn).await; let mut json_object = collection.to_json_details(&headers.user.uuid, None, &conn).await; json_object["assigned"] = json!(assigned); @@ -884,7 +887,7 @@ async fn get_org_collection_detail( async fn get_collection_users( org_id: OrganizationId, col_id: CollectionId, - headers: ManagerHeaders, + headers: CollectionReadHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { @@ -1035,6 +1038,61 @@ async fn post_org_keys( }))) } +#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)] +// This is intentionally a permission bitmap: every field represents an independent API grant. +#[allow(clippy::struct_excessive_bools)] +struct CustomRolePermissions { + manage_users: bool, + manage_groups: bool, + manage_policies: bool, + create_new_collections: bool, + edit_any_collection: bool, + delete_any_collection: bool, +} + +impl CustomRolePermissions { + fn from_request(member_type: MembershipType, permissions: &HashMap) -> Self { + if member_type != MembershipType::Custom { + return Self::default(); + } + + let enabled = |key: &str| matches!(permissions.get(key), Some(Value::Bool(true))); + Self { + manage_users: enabled("manageUsers"), + manage_groups: enabled("manageGroups"), + manage_policies: enabled("managePolicies"), + create_new_collections: enabled("createNewCollections"), + edit_any_collection: enabled("editAnyCollection"), + delete_any_collection: enabled("deleteAnyCollection"), + } + } + + /// Bitwarden grants a Custom member with Edit any collection full read/edit/manage access to + /// organization ciphers. Vaultwarden's existing access_all flag is the internal data-plane + /// representation of that capability. Create and Delete remain completely independent. + fn access_all_for(self, member_type: MembershipType) -> bool { + member_type >= MembershipType::Admin || (member_type == MembershipType::Custom && self.edit_any_collection) + } + + fn differs_from(self, membership: &Membership) -> bool { + self.manage_users != membership.manage_users + || self.manage_groups != membership.manage_groups + || self.manage_policies != membership.manage_policies + || self.create_new_collections != membership.create_new_collections + || self.edit_any_collection != membership.edit_any_collection + || self.delete_any_collection != membership.delete_any_collection + } + + fn apply_to(self, membership: &mut Membership) { + membership.manage_users = self.manage_users; + membership.manage_groups = self.manage_groups; + membership.manage_policies = self.manage_policies; + membership.create_new_collections = self.create_new_collections; + membership.edit_any_collection = self.edit_any_collection; + membership.delete_any_collection = self.delete_any_collection; + } +} + #[derive(Deserialize)] #[serde(rename_all = "camelCase")] struct InviteData { @@ -1086,22 +1144,10 @@ async fn send_invite( err!("Only Owners can invite Managers, Admins or Owners") } - // For a Custom role, the "Manage all collections" parent checkbox is not sent to - // the server; we derive access_all from its three child checkboxes. Admins/Owners - // implicitly have access to all collections. - let access_all = new_type >= MembershipType::Admin - || (new_type == MembershipType::Custom - && data.permissions.get("editAnyCollection") == Some(&json!(true)) - && data.permissions.get("deleteAnyCollection") == Some(&json!(true)) - && data.permissions.get("createNewCollections") == Some(&json!(true))); - - // Read the explicit Custom-role management permissions. These only apply to the - // Custom type; for every other type they are forced to false. Only Owners can invite - // Custom members (checked above), so the caller is always authorized to grant these. - let perm = |key: &str| new_type == MembershipType::Custom && data.permissions.get(key) == Some(&json!(true)); - let manage_users = perm("manageUsers"); - let manage_groups = perm("manageGroups"); - let manage_policies = perm("managePolicies"); + // manageAllCollections is a client-only aggregate. Persist its three children independently; + // only Edit any collection maps to the existing all-cipher access representation. + let custom_permissions = CustomRolePermissions::from_request(new_type, &data.permissions); + let access_all = custom_permissions.access_all_for(new_type); let mut user_created: bool = false; for email in &data.emails { @@ -1145,9 +1191,7 @@ async fn send_invite( let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(headers.user.email.clone())); new_member.access_all = access_all; new_member.atype = new_type as i32; - new_member.manage_users = manage_users; - new_member.manage_groups = manage_groups; - new_member.manage_policies = manage_policies; + custom_permissions.apply_to(&mut new_member); new_member.status = member_status; new_member.save(&conn).await?; @@ -1613,22 +1657,8 @@ async fn edit_member( err!("Invalid type") }; - // For a Custom role, the "Manage all collections" parent checkbox is not sent to - // the server; we derive access_all from its three child checkboxes. Admins/Owners - // implicitly have access to all collections. - let access_all = new_type >= MembershipType::Admin - || (new_type == MembershipType::Custom - && data.permissions.get("editAnyCollection") == Some(&json!(true)) - && data.permissions.get("deleteAnyCollection") == Some(&json!(true)) - && data.permissions.get("createNewCollections") == Some(&json!(true))); - - // Read the explicit Custom-role management permissions. These only apply to the - // Custom type; for every other type they are forced to false so that changing a - // member away from Custom clears any previously granted flags. - let perm = |key: &str| new_type == MembershipType::Custom && data.permissions.get(key) == Some(&json!(true)); - let manage_users = perm("manageUsers"); - let manage_groups = perm("manageGroups"); - let manage_policies = perm("managePolicies"); + let custom_permissions = CustomRolePermissions::from_request(new_type, &data.permissions); + let access_all = custom_permissions.access_all_for(new_type); let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else { err!("The specified user isn't member of the organization") @@ -1645,10 +1675,10 @@ async fn edit_member( // with manage_users must not change roles: raising a member to Manager/Custom grants // collection-"manage" on every collection they can already write (see the `atype >= Manager` // branch in `Collection`/`Membership` json), and lowering it revokes that access — both are - // collection-access changes this caller is not entitled to make, even though the manage_* - // flags and access_all are already gated below. Requests that leave the role unchanged are - // allowed, so such members can still use the regular edit dialog. The Admin/Owner guard above - // still governs Admin/Owner transitions for Owners. + // collection-access changes this caller is not entitled to make, even though the custom + // permission flags and access_all are already gated below. Requests that leave the role + // unchanged are allowed, so such members can still use the regular edit dialog. The + // Admin/Owner guard above still governs Admin/Owner transitions for Owners. if !may_change_member_type(headers.membership_type, member_to_edit.atype, new_type) { err!("Only Admins or Owners can change a member's role") } @@ -1667,17 +1697,13 @@ async fn edit_member( } } - // Security: only Admins and Owners may change the granular custom-role management - // permissions. A Custom member with manage_users must not be able to grant them (to - // themselves or others — a privilege escalation) nor strip flags an Admin/Owner has - // granted to fellow Custom members. Requests that leave the flags unchanged are - // allowed, so such members can still use the regular edit dialog. - if headers.membership_type < MembershipType::Admin - && (manage_users != member_to_edit.manage_users - || manage_groups != member_to_edit.manage_groups - || manage_policies != member_to_edit.manage_policies) - { - err!("Only Admins or Owners can change custom management permissions") + // Security: only Admins and Owners may change the granular custom-role permissions. A Custom + // member with manage_users must not be able to grant them to themselves or others (a + // privilege escalation), nor strip flags an Admin/Owner has granted to fellow Custom members. + // Requests that leave the flags unchanged are allowed, so such members can still use the + // regular edit dialog. + if headers.membership_type < MembershipType::Admin && custom_permissions.differs_from(&member_to_edit) { + err!("Only Admins or Owners can change custom permissions") } // Security: only callers who can actually manage collections (Admins/Owners, or users @@ -1692,15 +1718,13 @@ async fn edit_member( // Security: `access_all` grants full access to every collection, so only callers who may // manage collections are allowed to change it. Otherwise a custom user with only manage_users - // could set the Custom "manage all collections" child boxes on any member (including - // themselves) to grant full collection access — a privilege escalation. For everyone else we - // keep the member's existing access_all grant untouched (neither granted nor revoked). + // could enable Edit any collection on any member (including themselves) to grant full + // collection access — a privilege escalation. For everyone else we keep the member's existing + // access_all grant untouched (neither granted nor revoked). if caller_can_manage_collections { member_to_edit.access_all = access_all; } - member_to_edit.manage_users = manage_users; - member_to_edit.manage_groups = manage_groups; - member_to_edit.manage_policies = manage_policies; + custom_permissions.apply_to(&mut member_to_edit); member_to_edit.atype = new_type as i32; // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type @@ -1992,13 +2016,21 @@ async fn post_org_import( } col_id } else { - // We do not allow users or managers which can not manage all collections to create new collections - // If there is any collection other than an existing import collection, abort the import. - if headers.membership.atype <= MembershipType::Manager && !headers.membership.has_full_access() { + // Collection creation through an organization import is governed by the same + // independent permission as the regular create endpoint. In particular, + // Edit any collection's access_all mirror must not satisfy this check. + if !headers.membership.can_create_new_collections() { err!(Compact, "The current user isn't allowed to create new collections") } let new_collection = Collection::new(org_id.clone(), col.name, col.external_id); new_collection.save(&conn).await?; + // Import-created collections do not carry the regular create endpoint's user access + // selections. Give a create-only importer Manage access to the collection they just + // created, matching Bitwarden's organization-import behavior. + if !headers.membership.has_full_access() { + CollectionUser::save(&headers.membership.user_uuid, &new_collection.uuid, false, false, true, &conn) + .await?; + } new_collection.uuid }; @@ -3568,8 +3600,12 @@ async fn rotate_api_key( #[cfg(test)] mod tests { - use super::{may_change_group_membership, may_change_member_type}; - use crate::db::models::MembershipType; + use std::collections::HashMap; + + use serde_json::{Value, json}; + + use super::{CustomRolePermissions, may_change_group_membership, may_change_member_type}; + use crate::db::models::{Membership, MembershipStatus, MembershipType}; #[test] fn manage_users_caller_cannot_change_member_role() { @@ -3614,4 +3650,74 @@ mod tests { // AND removing such memberships must be denied. assert!(!may_change_group_membership(false, true)); } + + #[test] + fn collection_permission_request_combinations_remain_independent() { + for mask in 0_u8..8 { + let create = mask & 0b001 != 0; + let edit = mask & 0b010 != 0; + let delete = mask & 0b100 != 0; + let permissions = HashMap::from([ + ("createNewCollections".to_owned(), json!(create)), + ("editAnyCollection".to_owned(), json!(edit)), + ("deleteAnyCollection".to_owned(), json!(delete)), + ]); + + let parsed = CustomRolePermissions::from_request(MembershipType::Custom, &permissions); + assert_eq!(parsed.create_new_collections, create, "mask={mask:03b}"); + assert_eq!(parsed.edit_any_collection, edit, "mask={mask:03b}"); + assert_eq!(parsed.delete_any_collection, delete, "mask={mask:03b}"); + // Only Edit any collection maps to all-cipher access. Create/Delete must never do so. + assert_eq!(parsed.access_all_for(MembershipType::Custom), edit, "mask={mask:03b}"); + } + } + + #[test] + fn custom_permission_parser_is_strict_and_non_custom_roles_are_fail_closed() { + let permissions = HashMap::from([ + ("manageUsers".to_owned(), Value::String("true".to_owned())), + ("manageGroups".to_owned(), json!(true)), + ("managePolicies".to_owned(), json!(true)), + ("createNewCollections".to_owned(), json!(true)), + ("editAnyCollection".to_owned(), json!(true)), + ("deleteAnyCollection".to_owned(), json!(true)), + ]); + + let custom = CustomRolePermissions::from_request(MembershipType::Custom, &permissions); + assert!(!custom.manage_users, "string values must not be accepted as booleans"); + assert!(custom.manage_groups); + assert!(custom.manage_policies); + assert!(custom.create_new_collections); + assert!(custom.edit_any_collection); + assert!(custom.delete_any_collection); + + let user = CustomRolePermissions::from_request(MembershipType::User, &permissions); + assert_eq!(user, CustomRolePermissions::default()); + assert!(!user.access_all_for(MembershipType::User)); + + let admin = CustomRolePermissions::from_request(MembershipType::Admin, &permissions); + assert_eq!(admin, CustomRolePermissions::default()); + assert!(admin.access_all_for(MembershipType::Admin)); + } + + #[test] + fn custom_permission_change_detection_covers_collection_flags() { + let mut membership = Membership::new("test-user".to_owned().into(), "test-org".to_owned().into(), None); + membership.atype = MembershipType::Custom as i32; + membership.status = MembershipStatus::Confirmed as i32; + + let requested = CustomRolePermissions { + create_new_collections: true, + edit_any_collection: true, + delete_any_collection: true, + ..CustomRolePermissions::default() + }; + + assert!(requested.differs_from(&membership)); + requested.apply_to(&mut membership); + assert!(!requested.differs_from(&membership)); + assert!(membership.create_new_collections); + assert!(membership.edit_any_collection); + assert!(membership.delete_any_collection); + } } diff --git a/src/auth.rs b/src/auth.rs index b7e02f89..bdaf2b6e 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -735,7 +735,7 @@ impl OrgHeaders { } // Custom-role permission checks. Admins and Owners implicitly hold every // permission; a Custom member holds a permission only if the matching flag - // is set on their Membership. The has_manage_* helpers gate the flags on the + // is set on their Membership. The has_* helpers gate the flags on the // Custom type, so stale flags on other types can never grant anything. fn can_manage_users(&self) -> bool { self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_manage_users()) @@ -744,8 +744,7 @@ impl OrgHeaders { self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_manage_groups()) } fn can_manage_policies(&self) -> bool { - self.is_confirmed() - && (self.membership_type >= MembershipType::Admin || self.membership.has_manage_policies()) + self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_manage_policies()) } } @@ -944,9 +943,28 @@ fn get_col_id(request: &Request<'_>) -> Option { None } -/// The ManagerHeaders are used to check if you are at least a Manager -/// and have access to the specific collection provided via the /collections/collectionId. -/// This does strict checking on the collection_id, ManagerHeadersLoose does not. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +enum CollectionDeleteAccess { + Any, + ManagedOnly, + Denied, +} + +fn collection_delete_access(membership: &Membership) -> CollectionDeleteAccess { + if membership.can_delete_any_collection() { + CollectionDeleteAccess::Any + } else if membership.has_status(MembershipStatus::Confirmed) && membership.has_type(MembershipType::Manager) { + // Preserve the legacy Manager role's pre-existing per-collection deletion behavior. + CollectionDeleteAccess::ManagedOnly + } else { + CollectionDeleteAccess::Denied + } +} + +/// ManagerHeaders authorizes collection updates. A Custom member with Edit any collection can +/// update every collection; otherwise the caller must be at least a legacy Manager and have the +/// per-collection Manage permission. Read and delete use separate guards so Edit cannot +/// accidentally imply Delete. pub struct ManagerHeaders { pub host: String, pub device: Device, @@ -967,7 +985,9 @@ impl<'r> FromRequest<'r> for ManagerHeaders { err_handler!("Error getting DB") }; - if !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await { + if !headers.membership.has_edit_any_collection() + && !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await + { err_handler!("The current user isn't a manager for this collection") } } else { @@ -987,6 +1007,131 @@ impl<'r> FromRequest<'r> for ManagerHeaders { } } +/// Read access to collection metadata and assignment details. Delete any collection needs this +/// visibility to render the standard collection view, but it does not grant edit or cipher access. +pub struct CollectionReadHeaders { + pub host: String, + pub device: Device, + pub user: User, + pub membership: Membership, + pub ip: ClientIp, + pub org_id: OrganizationId, +} + +#[rocket::async_trait] +impl<'r> FromRequest<'r> for CollectionReadHeaders { + type Error = &'static str; + + async fn from_request(request: &'r Request<'_>) -> Outcome { + let headers = try_outcome!(OrgHeaders::from_request(request).await); + if !headers.is_confirmed_and_manager() { + err_handler!("You need collection read permission to call this endpoint") + } + + let Some(col_id) = get_col_id(request) else { + err_handler!("Error getting the collection id") + }; + + let can_read_any_collection = headers.is_confirmed_and_admin() + || headers.membership.has_edit_any_collection() + || headers.membership.has_delete_any_collection(); + + if !can_read_any_collection { + let Outcome::Success(conn) = DbConn::from_request(request).await else { + err_handler!("Error getting DB") + }; + + if !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await { + err_handler!("The current user isn't a manager for this collection") + } + } + + Outcome::Success(Self { + host: headers.host, + device: headers.device, + user: headers.user, + ip: headers.ip, + org_id: headers.membership.org_uuid.clone(), + membership: headers.membership, + }) + } +} + +impl From for Headers { + fn from(h: CollectionReadHeaders) -> Headers { + Headers { + host: h.host, + device: h.device, + user: h.user, + ip: h.ip, + } + } +} + +/// Delete is intentionally independent from Edit any collection. Vaultwarden advertises +/// limitCollectionDeletion=true, so Custom members require the explicit Delete any collection +/// permission. The legacy Manager role retains its previous per-collection behavior. +pub struct CollectionDeleteHeaders { + pub host: String, + pub device: Device, + pub user: User, + pub ip: ClientIp, + pub org_id: OrganizationId, +} + +#[rocket::async_trait] +impl<'r> FromRequest<'r> for CollectionDeleteHeaders { + type Error = &'static str; + + async fn from_request(request: &'r Request<'_>) -> Outcome { + let headers = try_outcome!(OrgHeaders::from_request(request).await); + if !headers.is_confirmed_and_manager() { + err_handler!("You need collection delete permission to call this endpoint") + } + + let Some(col_id) = get_col_id(request) else { + err_handler!("Error getting the collection id") + }; + + match collection_delete_access(&headers.membership) { + CollectionDeleteAccess::Any => {} + CollectionDeleteAccess::Denied => { + // Custom is a distinct, fail-closed role. In particular, Edit any collection and + // access_all must not satisfy a Delete request without the explicit delete flag. + err_handler!("You need the 'Delete any collection' permission to call this endpoint") + } + CollectionDeleteAccess::ManagedOnly => { + let Outcome::Success(conn) = DbConn::from_request(request).await else { + err_handler!("Error getting DB") + }; + + if !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await { + err_handler!("The current user isn't a manager for this collection") + } + } + } + + Outcome::Success(Self { + host: headers.host, + device: headers.device, + user: headers.user, + ip: headers.ip, + org_id: headers.membership.org_uuid, + }) + } +} + +impl From for Headers { + fn from(h: CollectionDeleteHeaders) -> Headers { + Headers { + host: h.host, + device: h.device, + user: h.user, + ip: h.ip, + } + } +} + impl From for Headers { fn from(h: ManagerHeaders) -> Headers { Headers { @@ -1039,22 +1184,32 @@ impl From for Headers { } } -impl ManagerHeaders { +impl CollectionDeleteHeaders { pub async fn from_loose( h: ManagerHeadersLoose, collections: &Vec, conn: &DbConn, - ) -> Result { + ) -> Result { + let delete_access = collection_delete_access(&h.membership); + if delete_access == CollectionDeleteAccess::Denied { + err!("You need the 'Delete any collection' permission to call this endpoint") + } + for col_id in collections { if uuid::Uuid::parse_str(col_id.as_ref()).is_err() { err!("Collection Id is malformed!"); } - if !Collection::is_coll_manageable_by_user(col_id, &h.membership.user_uuid, conn).await { + if Collection::find_by_uuid_and_org(col_id, &h.membership.org_uuid, conn).await.is_none() { + err!("Collection not found", "Collection does not exist or does not belong to this organization") + } + if delete_access == CollectionDeleteAccess::ManagedOnly + && !Collection::is_coll_manageable_by_user(col_id, &h.membership.user_uuid, conn).await + { err!("Collection not found", "The current user isn't a manager for this collection") } } - Ok(ManagerHeaders { + Ok(CollectionDeleteHeaders { host: h.host, device: h.device, user: h.user, @@ -1396,3 +1551,42 @@ pub async fn refresh_tokens( Ok((device, auth_tokens)) } + +#[cfg(test)] +mod tests { + use super::{CollectionDeleteAccess, collection_delete_access}; + use crate::db::models::{Membership, MembershipStatus, MembershipType}; + + fn membership(member_type: MembershipType) -> Membership { + let mut membership = Membership::new("test-user".to_owned().into(), "test-org".to_owned().into(), None); + membership.atype = member_type as i32; + membership.status = MembershipStatus::Confirmed as i32; + membership + } + + #[test] + fn collection_delete_permission_is_independent_from_edit_and_access_all() { + let mut custom = membership(MembershipType::Custom); + custom.edit_any_collection = true; + custom.access_all = true; + assert_eq!(collection_delete_access(&custom), CollectionDeleteAccess::Denied); + + custom.delete_any_collection = true; + assert_eq!(collection_delete_access(&custom), CollectionDeleteAccess::Any); + + custom.status = MembershipStatus::Accepted as i32; + assert_eq!(collection_delete_access(&custom), CollectionDeleteAccess::Denied); + } + + #[test] + fn collection_delete_permission_preserves_admin_and_legacy_manager_behavior() { + let admin = membership(MembershipType::Admin); + assert_eq!(collection_delete_access(&admin), CollectionDeleteAccess::Any); + + let manager = membership(MembershipType::Manager); + assert_eq!(collection_delete_access(&manager), CollectionDeleteAccess::ManagedOnly); + + let user = membership(MembershipType::User); + assert_eq!(collection_delete_access(&user), CollectionDeleteAccess::Denied); + } +} diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 78228588..3fbfc789 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -61,6 +61,9 @@ pub struct Membership { pub manage_users: bool, pub manage_groups: bool, pub manage_policies: bool, + pub create_new_collections: bool, + pub edit_any_collection: bool, + pub delete_any_collection: bool, } #[derive(Identifiable, Queryable, Insertable, AsChangeset)] @@ -123,7 +126,7 @@ impl Ord for MembershipType { // For easy comparison, map each variant to an access level (where 0 is lowest). // Custom is treated as a low-privilege base role (same level as Manager for // ordering purposes); its elevated capabilities are governed by the explicit - // manage_* permission flags on the Membership, not by this ordering. + // custom permission flags on the Membership, not by this ordering. // // NOTE: Manager and Custom therefore share an access level while being distinct // variants: the derived `PartialEq` compares the role itself (Manager != Custom), @@ -279,6 +282,9 @@ impl Membership { manage_users: false, manage_groups: false, manage_policies: false, + create_new_collections: false, + edit_any_collection: false, + delete_any_collection: false, } } @@ -449,22 +455,26 @@ impl Membership { let membership_type = self.atype; let permissions = json!({ - // The 3 Collection roles below are linked to the access_all permission "accessEventLogs": false, "accessImportExport": false, "accessReports": false, - // If the following 3 Collection roles are set to true a custom user has access all permission - "createNewCollections": membership_type == 4 && self.access_all, - "editAnyCollection": membership_type == 4 && self.access_all, - "deleteAnyCollection": membership_type == 4 && self.access_all, - "manageGroups": self.manage_groups, - "managePolicies": self.manage_policies, + "createNewCollections": membership_type == MembershipType::Custom as i32 && self.create_new_collections, + "editAnyCollection": membership_type == MembershipType::Custom as i32 && self.edit_any_collection, + "deleteAnyCollection": membership_type == MembershipType::Custom as i32 && self.delete_any_collection, + "manageGroups": membership_type == MembershipType::Custom as i32 && self.manage_groups, + "managePolicies": membership_type == MembershipType::Custom as i32 && self.manage_policies, "manageSso": false, // Not supported - "manageUsers": self.manage_users, + "manageUsers": membership_type == MembershipType::Custom as i32 && self.manage_users, "manageResetPassword": false, "manageScim": false // Not supported (Not AGPLv3 Licensed) }); + // edit_any_collection is internally mirrored to access_all to provide Bitwarden-compatible + // cipher access, but it must not accidentally grant collection creation. The client treats + // limitCollectionCreation=false as an independent create grant, so compute it from the + // actual role/permission rather than access_all for Custom members. + let limit_collection_creation = self.limit_collection_creation(); + // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs json!({ "id": self.org_uuid, @@ -508,8 +518,7 @@ impl Membership { "familySponsorshipValidUntil": null, "familySponsorshipToDelete": null, "accessSecretsManager": false, - // limit collection creation to managers with access_all permission to prevent issues - "limitCollectionCreation": self.atype < MembershipType::Manager || !self.access_all, + "limitCollectionCreation": limit_collection_creation, "limitCollectionDeletion": true, "limitItemDeletion": false, "allowAdminAccessToAllCollectionItems": true, @@ -608,18 +617,16 @@ impl Membership { let membership_type = self.atype; - // Only return a permissions object for custom-type members. A custom member - // may have access_all (the 3 collection roles) and/or any of the explicit - // manage_* flags; otherwise Bitwarden assumes all-false defaults. + // Only return a permissions object for custom-type members. Otherwise Bitwarden assumes + // all-false defaults and the role itself supplies any elevated capabilities. let permissions = if membership_type == MembershipType::Custom as i32 { json!({ "accessEventLogs": false, "accessImportExport": false, "accessReports": false, - // If the following 3 Collection roles are set to true a custom user has access all permission - "createNewCollections": self.access_all, - "editAnyCollection": self.access_all, - "deleteAnyCollection": self.access_all, + "createNewCollections": self.create_new_collections, + "editAnyCollection": self.edit_any_collection, + "deleteAnyCollection": self.delete_any_collection, "manageGroups": self.manage_groups, "managePolicies": self.manage_policies, "manageSso": false, // Not supported @@ -811,10 +818,11 @@ impl Membership { } pub fn has_full_access(&self) -> bool { - (self.access_all || self.atype >= MembershipType::Admin) && self.has_status(MembershipStatus::Confirmed) + (self.access_all || self.has_edit_any_collection() || self.atype >= MembershipType::Admin) + && self.has_status(MembershipStatus::Confirmed) } - // The granular manage_* permission flags are only meaningful while the membership is of + // The granular custom permission flags are only meaningful while the membership is of // the Custom type. Gating them on the type here ensures that a stale flag left over from // a type change (e.g. via the admin panel) can never grant anything. pub fn has_manage_users(&self) -> bool { @@ -829,6 +837,63 @@ impl Membership { self.has_type(MembershipType::Custom) && self.manage_policies } + pub fn has_create_new_collections(&self) -> bool { + self.has_type(MembershipType::Custom) && self.create_new_collections + } + + pub fn has_edit_any_collection(&self) -> bool { + self.has_type(MembershipType::Custom) && self.edit_any_collection + } + + pub fn has_delete_any_collection(&self) -> bool { + self.has_type(MembershipType::Custom) && self.delete_any_collection + } + + /// `manageAllCollections` is a client-side aggregate checkbox, not a separately persisted + /// Bitwarden permission. It is selected exactly when all three child permissions are selected. + pub fn has_manage_all_collections(&self) -> bool { + self.has_create_new_collections() && self.has_edit_any_collection() && self.has_delete_any_collection() + } + + /// Match Vaultwarden's existing collection-creation policy while keeping the new Custom + /// permission independent from edit/delete. Legacy Manager memberships retain their former + /// access_all-based behavior. + pub fn can_create_new_collections(&self) -> bool { + if !self.has_status(MembershipStatus::Confirmed) { + return false; + } + + match MembershipType::from_i32(self.atype) { + Some(MembershipType::Owner | MembershipType::Admin) => true, + Some(MembershipType::Manager) => self.access_all, + Some(MembershipType::Custom) => self.create_new_collections, + Some(MembershipType::User) | None => false, + } + } + + pub fn limit_collection_creation(&self) -> bool { + match MembershipType::from_i32(self.atype) { + Some(MembershipType::Owner | MembershipType::Admin) => false, + Some(MembershipType::Manager) => !self.access_all, + Some(MembershipType::Custom) => !self.create_new_collections, + Some(MembershipType::User) | None => true, + } + } + + pub fn can_delete_any_collection(&self) -> bool { + self.has_status(MembershipStatus::Confirmed) + && (self.atype >= MembershipType::Admin || self.has_delete_any_collection()) + } + + pub fn clear_custom_permissions(&mut self) { + self.manage_users = false; + self.manage_groups = false; + self.manage_policies = false; + self.create_new_collections = false; + self.edit_any_collection = false; + self.delete_any_collection = false; + } + pub async fn find_by_uuid(uuid: &MembershipId, conn: &DbConn) -> Option { conn.run(move |conn| { users_organizations::table.filter(users_organizations::uuid.eq(uuid)).first::(conn).ok() @@ -1274,6 +1339,13 @@ pub struct OrgApiKeyId(String); mod tests { use super::*; + fn membership(member_type: MembershipType) -> Membership { + let mut membership = Membership::new("test-user".to_owned().into(), "test-org".to_owned().into(), None); + membership.atype = member_type as i32; + membership.status = MembershipStatus::Confirmed as i32; + membership + } + #[test] #[allow(non_snake_case)] fn partial_cmp_MembershipType() { @@ -1288,4 +1360,93 @@ mod tests { assert!(MembershipType::Custom > MembershipType::User); assert!(MembershipType::Admin > MembershipType::Custom); } + + #[test] + fn custom_collection_permissions_are_independent_and_type_gated() { + let mut member = membership(MembershipType::Custom); + member.create_new_collections = true; + + assert!(member.has_create_new_collections()); + assert!(member.can_create_new_collections()); + assert!(!member.limit_collection_creation()); + assert!(!member.has_full_access()); + assert!(!member.can_delete_any_collection()); + assert!(!member.has_manage_all_collections()); + + member.delete_any_collection = true; + assert!(member.has_delete_any_collection()); + assert!(member.can_delete_any_collection()); + assert!(!member.has_full_access()); + assert!(!member.has_manage_all_collections()); + + member.edit_any_collection = true; + assert!(member.has_edit_any_collection()); + assert!(member.has_full_access()); + assert!(member.has_manage_all_collections()); + + // Stale flags on a non-Custom role are inert. + member.atype = MembershipType::User as i32; + assert!(!member.has_create_new_collections()); + assert!(!member.has_edit_any_collection()); + assert!(!member.has_delete_any_collection()); + assert!(!member.can_create_new_collections()); + assert!(!member.can_delete_any_collection()); + assert!(!member.has_full_access()); + } + + #[test] + fn edit_any_collection_does_not_imply_create_or_delete() { + let mut custom = membership(MembershipType::Custom); + custom.edit_any_collection = true; + // The persisted access_all mirror is intentionally tested too: client-facing create and + // delete decisions must still use their dedicated permissions. + custom.access_all = true; + + assert!(custom.has_full_access()); + assert!(!custom.can_create_new_collections()); + assert!(custom.limit_collection_creation()); + assert!(!custom.can_delete_any_collection()); + + let mut manager = membership(MembershipType::Manager); + manager.access_all = true; + assert!(manager.can_create_new_collections()); + + let admin = membership(MembershipType::Admin); + assert!(admin.can_create_new_collections()); + assert!(!admin.limit_collection_creation()); + assert!(admin.can_delete_any_collection()); + } + + #[test] + fn custom_collection_permissions_require_confirmed_membership() { + let mut member = membership(MembershipType::Custom); + member.create_new_collections = true; + member.edit_any_collection = true; + member.delete_any_collection = true; + member.status = MembershipStatus::Accepted as i32; + + assert!(!member.can_create_new_collections()); + assert!(!member.can_delete_any_collection()); + assert!(!member.has_full_access()); + } + + #[test] + fn clearing_custom_permissions_clears_every_flag() { + let mut member = membership(MembershipType::Custom); + member.manage_users = true; + member.manage_groups = true; + member.manage_policies = true; + member.create_new_collections = true; + member.edit_any_collection = true; + member.delete_any_collection = true; + + member.clear_custom_permissions(); + + assert!(!member.manage_users); + assert!(!member.manage_groups); + assert!(!member.manage_policies); + assert!(!member.create_new_collections); + assert!(!member.edit_any_collection); + assert!(!member.delete_any_collection); + } } diff --git a/src/db/schema.rs b/src/db/schema.rs index 15c43b5f..e8840acd 100644 --- a/src/db/schema.rs +++ b/src/db/schema.rs @@ -245,6 +245,9 @@ table! { manage_users -> Bool, manage_groups -> Bool, manage_policies -> Bool, + create_new_collections -> Bool, + edit_any_collection -> Bool, + delete_any_collection -> Bool, } } diff --git a/src/static/templates/scss/vaultwarden.scss.hbs b/src/static/templates/scss/vaultwarden.scss.hbs index c5f790ac..6cf97cb6 100644 --- a/src/static/templates/scss/vaultwarden.scss.hbs +++ b/src/static/templates/scss/vaultwarden.scss.hbs @@ -116,9 +116,8 @@ app-security > app-two-factor-setup > form { } /* Hide unsupported Custom Role options */ -/* Note: manageUsers and managePolicies are supported by Vaultwarden - and are intentionally NOT hidden here. */ -bit-dialog div.tw-ml-4:has(bit-form-control input), +/* The collection permission group plus manageUsers, manageGroups, managePolicies are supported + by Vaultwarden and are intentionally not hidden here. */ bit-dialog div.tw-col-span-4:has(input[formcontrolname*="access"]), bit-dialog bit-form-control:has(input[formcontrolname="manageSso"]), bit-dialog bit-form-control:has(input[formcontrolname="manageResetPassword"]) { From e67fb30c5ffb36bd33e9da817b12d2a799197ccf Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 16 Jul 2026 19:31:49 +0200 Subject: [PATCH 16/42] Fix delete-only collection access in web vault --- src/api/core/organizations.rs | 72 ++++++++++++++++++++++++++++++++++- 1 file changed, 70 insertions(+), 2 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 63d142e8..bf78e0d8 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -51,6 +51,7 @@ pub fn routes() -> Vec { post_organization_collection_delete, bulk_delete_organization_collections, post_bulk_collections, + get_assigned_org_details, get_org_details, get_org_domain_sso_verified, get_members, @@ -917,6 +918,49 @@ struct OrgIdData { organization_id: OrganizationId, } +fn filter_ciphers_for_organization(ciphers: Vec, org_id: &OrganizationId) -> Vec { + ciphers.into_iter().filter(|cipher| cipher.organization_uuid.as_ref() == Some(org_id)).collect() +} + +// The Admin Console uses this endpoint when the acting member is not allowed to read every +// cipher in the organization. In particular, a Custom member with only DeleteAnyCollection +// needs an empty successful response so the collection list can finish loading and expose its +// collection-only delete controls. +// +// Security: start from the regular user-visible cipher query and then constrain the result to +// the requested organization. DeleteAnyCollection itself must never make cipher contents visible. +#[get("/ciphers/organization-details/assigned?")] +async fn get_assigned_org_details(data: OrgIdData, headers: Headers, conn: DbConn) -> JsonResult { + if Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &data.organization_id, &conn).await.is_none() { + err_code!( + "Resource not found.", + "User is not a confirmed member of the organization", + rocket::http::Status::NotFound.code + ); + } + + let ciphers = filter_ciphers_for_organization( + Cipher::find_by_user_visible(&headers.user.uuid, &conn).await, + &data.organization_id, + ); + let cipher_sync_data = CipherSyncData::new(&headers.user.uuid, CipherSyncType::User, &conn).await; + + let mut ciphers_json = Vec::with_capacity(ciphers.len()); + for cipher in ciphers { + ciphers_json.push( + cipher + .to_json(&headers.host, &headers.user.uuid, Some(&cipher_sync_data), CipherSyncType::User, &conn) + .await?, + ); + } + + Ok(Json(json!({ + "data": ciphers_json, + "object": "list", + "continuationToken": null, + }))) +} + #[get("/ciphers/organization-details?")] async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { if data.organization_id != headers.membership.org_uuid { @@ -3604,8 +3648,32 @@ mod tests { use serde_json::{Value, json}; - use super::{CustomRolePermissions, may_change_group_membership, may_change_member_type}; - use crate::db::models::{Membership, MembershipStatus, MembershipType}; + use super::{ + CustomRolePermissions, filter_ciphers_for_organization, may_change_group_membership, may_change_member_type, + }; + use crate::db::models::{Cipher, Membership, MembershipStatus, MembershipType, OrganizationId}; + + #[test] + fn assigned_cipher_response_is_scoped_to_requested_organization() { + let requested_org: OrganizationId = "requested-org".to_owned().into(); + let other_org: OrganizationId = "other-org".to_owned().into(); + + let mut requested_cipher = Cipher::new(1, "requested".to_owned()); + requested_cipher.organization_uuid = Some(requested_org.clone()); + let requested_cipher_id = requested_cipher.uuid.clone(); + + let mut other_cipher = Cipher::new(1, "other".to_owned()); + other_cipher.organization_uuid = Some(other_org); + + let personal_cipher = Cipher::new(1, "personal".to_owned()); + + let filtered = + filter_ciphers_for_organization(vec![other_cipher, personal_cipher, requested_cipher], &requested_org); + + assert_eq!(filtered.len(), 1); + assert_eq!(filtered[0].uuid, requested_cipher_id); + assert_eq!(filtered[0].organization_uuid.as_ref(), Some(&requested_org)); + } #[test] fn manage_users_caller_cannot_change_member_role() { From a992695c0075d0b0c91d5c71bf49d8a9f8b8a9d6 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 16 Jul 2026 21:51:29 +0200 Subject: [PATCH 17/42] Fix cross-tenant and revoke authorization bypasses from security audit Addresses the confirmed High/Medium findings of the granular-collection- permissions security audit: - H-1: bind direct (non-sync) cipher access to a confirmed membership in the cipher's organization, and harden the user/group collection access-flag queries to require org consistency plus confirmed status. Revoked/invited members can no longer reach ciphers via stale assignment rows. - H-2: validate group ids against the org before mutating group membership in edit_member, and reject cross-org group<->membership links in GroupUser::save and Group::is_in_full_access_group. - H-3: fully pre-validate collections/groups/users in bulk-access and collection create before any mutation, and reject cross-org collection<->group links in CollectionGroup::save. - M-1: require Manage Users for the full member list and Manage Users/Groups for group details (new ManageUsersOrGroupsHeaders guard). - M-2: validate the whole bulk-access request before the destructive delete/replace so an invalid element can't leave partial state behind. - M-3: bounds-validate import collection relationships before writing and propagate cipher-save errors instead of discarding them. --- src/api/core/organizations.rs | 126 +++++++++++++++++++++++++++------- src/auth.rs | 14 ++++ src/db/models/cipher.rs | 59 ++++++++++++++-- src/db/models/group.rs | 35 +++++++++- 4 files changed, 202 insertions(+), 32 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index bf78e0d8..4b2e7187 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -13,8 +13,8 @@ use crate::{ }, auth::{ AdminHeaders, CollectionDeleteHeaders, CollectionReadHeaders, Headers, ManageGroupsHeaders, - ManagePoliciesHeaders, ManageUsersHeaders, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, - decode_invite, + ManagePoliciesHeaders, ManageUsersHeaders, ManageUsersOrGroupsHeaders, ManagerHeaders, ManagerHeadersLoose, + OrgMemberHeaders, OwnerHeaders, decode_invite, }, db::{ DbConn, @@ -548,6 +548,20 @@ async fn post_organization_collections( let data: FullCollectionData = data.into_inner(); data.validate(&org_id, &conn).await?; + // Security (audit H-3): validate every referenced group and user against this organization + // *before* creating the collection or any assignment, so a foreign-tenant group can't be + // attached to the new collection and no partial state is left behind on rejection. + for group in &data.groups { + if Group::find_by_uuid_and_org(&group.id, &org_id, &conn).await.is_none() { + err!("Group not found in this organization") + } + } + for user in &data.users { + if Membership::find_by_uuid_and_org(&user.id, &org_id, &conn).await.is_none() { + err!("User is not part of organization") + } + } + let collection = Collection::new(org_id.clone(), data.name, data.external_id); collection.save(&conn).await?; @@ -622,8 +636,25 @@ async fn post_bulk_access_collections( err!("You don't have permission to modify collection access") } - for col_id in data.collection_ids { - let Some(collection) = Collection::find_by_uuid_and_org(&col_id, &org_id, &conn).await else { + // Security (audit H-3) and atomicity (audit M-2): validate the whole request against this + // organization *before* mutating anything. Every collection must exist in the org and be + // manageable by the caller, and every referenced group and user must belong to the org. Only + // once the entire request is known-valid do we begin the destructive delete/replace of + // assignments, so a foreign-tenant group can never be linked and a later invalid element can no + // longer leave earlier collections with their assignments already wiped. + for group in &data.groups { + if Group::find_by_uuid_and_org(&group.id, &org_id, &conn).await.is_none() { + err!("Group not found in this organization") + } + } + for user in &data.users { + if Membership::find_by_uuid_and_org(&user.id, &org_id, &conn).await.is_none() { + err!("User is not part of organization") + } + } + let mut collections = Vec::with_capacity(data.collection_ids.len()); + for col_id in &data.collection_ids { + let Some(collection) = Collection::find_by_uuid_and_org(col_id, &org_id, &conn).await else { err!("Collection not found") }; @@ -631,6 +662,12 @@ async fn post_bulk_access_collections( err!("Collection not found", "The current user isn't a manager for this collection") } + collections.push(collection); + } + + for collection in collections { + let col_id = &collection.uuid; + // update collection modification date collection.save(&conn).await?; @@ -645,14 +682,14 @@ async fn post_bulk_access_collections( ) .await; - CollectionGroup::delete_all_by_collection(&col_id, &org_id, &conn).await?; + CollectionGroup::delete_all_by_collection(col_id, &org_id, &conn).await?; for group in &data.groups { CollectionGroup::new(col_id.clone(), group.id.clone(), group.read_only, group.hide_passwords, group.manage) .save(&org_id, &conn) .await?; } - CollectionUser::delete_all_by_collection(&col_id, &conn).await?; + CollectionUser::delete_all_by_collection(col_id, &conn).await?; for user in &data.users { let Some(member) = Membership::find_by_uuid_and_org(&user.id, &org_id, &conn).await else { err!("User is not part of organization") @@ -662,7 +699,7 @@ async fn post_bulk_access_collections( continue; } - CollectionUser::save(&member.user_uuid, &col_id, user.read_only, user.hide_passwords, user.manage, &conn) + CollectionUser::save(&member.user_uuid, col_id, user.read_only, user.hide_passwords, user.manage, &conn) .await?; } } @@ -1024,10 +1061,14 @@ struct GetOrgUserData { async fn get_members( data: GetOrgUserData, org_id: OrganizationId, - headers: ManagerHeadersLoose, + // Security (audit M-1): the full member list exposes each member's PII, 2FA/enrollment status, + // permission flags and (optionally) collection/group assignments. Reading it requires the + // 'Manage Users' permission (or Admin/Owner), matching Bitwarden. Members who only need to + // reference other users (e.g. the collection dialog) use the member-readable mini-details. + headers: ManageUsersHeaders, conn: DbConn, ) -> JsonResult { - if org_id != headers.membership.org_uuid { + if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } let mut users_json = Vec::new(); @@ -1812,6 +1853,16 @@ async fn edit_member( }; if caller_can_manage_groups { + // Security (audit H-2): validate that every requested group belongs to this organization + // *before* mutating any group membership. Otherwise a caller could link the member to a + // group of a foreign tenant (e.g. an access-all group), which the direct cipher-access + // checks would then honor. Fail closed on the whole request if any group is foreign. + for group_id in data.groups.iter().flatten() { + if Group::find_by_uuid_and_org(group_id, &org_id, &conn).await.is_none() { + err!("Group not found in this organization") + } + } + if caller_can_manage_collections { // Caller may grant/revoke collection access via groups: full replace. GroupUser::delete_all_by_member(&member_to_edit.uuid, &conn).await?; @@ -2046,6 +2097,22 @@ async fn post_org_import( // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks. Cipher::validate_cipher_data(&data.ciphers)?; + // Robustness/DoS (audit M-3): validate every collection<->cipher relationship index against the + // import payload *before* creating any collection or cipher. `key` indexes into `ciphers` and + // `value` into `collections`; an out-of-range index would otherwise cause an out-of-bounds panic + // when the relations are applied below — a 500 (or a process abort under panic="abort") that + // happens after rows have already been written, leaving partial state behind. + let import_cipher_count = data.ciphers.len(); + let import_collection_count = data.collections.len(); + for relation in &data.collection_relationships { + if relation.key >= import_cipher_count || relation.value >= import_collection_count { + err!( + "Invalid collection relationship", + "A collection relationship references a non-existent cipher or collection" + ) + } + } + let existing_collections: HashSet> = Collection::find_by_organization(&org_id, &conn).await.into_iter().map(|c| Some(c.uuid)).collect(); let mut collections: Vec = Vec::with_capacity(data.collections.len()); @@ -2095,6 +2162,9 @@ async fn post_org_import( // Always clear folder_id's via an organization import cipher_data.folder_id = None; let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone()); + // Propagate cipher-save failures instead of silently discarding them (audit M-3): a + // discarded error would still push the cipher id and let a relationship reference a cipher + // that was never persisted. This matches Bitwarden's all-or-nothing import semantics. update_cipher_from_data( &mut cipher, cipher_data, @@ -2104,15 +2174,16 @@ async fn post_org_import( &nt, UpdateType::None, ) - .await - .ok(); + .await?; ciphers.push(cipher.uuid); } - // Assign the collections + // Assign the collections. Indices were bounds-validated above, but use `.get()` here as well so + // any future drift fails closed with an error instead of panicking. for (cipher_index, col_index) in relations { - let cipher_id = &ciphers[cipher_index]; - let col_id = &collections[col_index]; + let (Some(cipher_id), Some(col_id)) = (ciphers.get(cipher_index), collections.get(col_index)) else { + err!("Invalid collection relationship", "A collection relationship references a non-existent cipher or collection") + }; CollectionCipher::save(cipher_id, col_id, &conn).await?; } @@ -2696,15 +2767,7 @@ async fn restore_member_impl( Ok(()) } -async fn get_groups_data( - details: bool, - org_id: OrganizationId, - headers: ManagerHeadersLoose, - conn: DbConn, -) -> JsonResult { - if org_id != headers.membership.org_uuid { - err!("Organization not found", "Organization id's do not match"); - } +async fn get_groups_data(details: bool, org_id: OrganizationId, conn: DbConn) -> JsonResult { let groups: Vec = if CONFIG.org_groups_enabled() { let groups = Group::find_by_organization(&org_id, &conn).await; let mut groups_json = Vec::with_capacity(groups.len()); @@ -2732,14 +2795,25 @@ async fn get_groups_data( }))) } +// The plain group list (id, name, externalId) stays member-readable: the web vault needs it to +// render group names, and it exposes no access mappings. #[get("/organizations//groups")] async fn get_groups(org_id: OrganizationId, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { - get_groups_data(false, org_id, headers, conn).await + if org_id != headers.membership.org_uuid { + err!("Organization not found", "Organization id's do not match"); + } + get_groups_data(false, org_id, conn).await } +// Security (audit M-1): group *details* expose accessAll, external IDs and collection mappings, so +// reading them requires the 'Manage Users' or 'Manage Groups' permission (or Admin/Owner), matching +// Bitwarden's ReadAll/ReadAllWithAccess authorization. #[get("/organizations//groups/details", rank = 1)] -async fn get_groups_details(org_id: OrganizationId, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { - get_groups_data(true, org_id, headers, conn).await +async fn get_groups_details(org_id: OrganizationId, headers: ManageUsersOrGroupsHeaders, conn: DbConn) -> JsonResult { + if org_id != headers.org_id { + err!("Organization not found", "Organization id's do not match"); + } + get_groups_data(true, org_id, conn).await } #[derive(Deserialize)] diff --git a/src/auth.rs b/src/auth.rs index bdaf2b6e..c50b3d4c 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -746,6 +746,15 @@ impl OrgHeaders { fn can_manage_policies(&self) -> bool { self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_manage_policies()) } + // Reading the full member/group *details* (PII, 2FA status, permission flags, access mappings) + // requires the ability to manage users or groups, matching Bitwarden's `ReadAll`/`ReadAllWithAccess` + // authorization. Basic member mini-details and the plain group list remain member-readable. + fn can_manage_users_or_groups(&self) -> bool { + self.is_confirmed() + && (self.membership_type >= MembershipType::Admin + || self.membership.has_manage_users() + || self.membership.has_manage_groups()) + } } // org_id is usually the second path param ("/organizations/"), @@ -923,6 +932,11 @@ generate_manage_headers!( can_manage_policies, "You need the 'Manage Policies' permission, or to be an Admin or Owner, to call this endpoint" ); +generate_manage_headers!( + ManageUsersOrGroupsHeaders, + can_manage_users_or_groups, + "You need the 'Manage Users' or 'Manage Groups' permission, or to be an Admin or Owner, to call this endpoint" +); // col_id is usually the fourth path param ("/organizations//collections/"), // but there could be cases where it is a query value. diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs index 8357c9eb..40b27d5a 100644 --- a/src/db/models/cipher.rs +++ b/src/db/models/cipher.rs @@ -604,6 +604,24 @@ impl Cipher { cipher_sync_data: Option<&CipherSyncData>, conn: &DbConn, ) -> Option<(bool, bool, bool)> { + // Security: central fail-closed check binding cipher -> organization -> confirmed membership. + // + // In the direct (non-sync) authorization path an organization cipher is only accessible to a + // user who has a *confirmed* membership in that same organization. This denies access to + // members whose collection/group assignment rows still exist after they were revoked (or are + // still only invited/accepted), and to cross-organization collection/group assignments that + // another code path might have persisted. Without it, the queries below would keep granting + // access from those stale or cross-tenant rows (security audit findings H-1, H-2, H-3). + // + // The sync path (cipher_sync_data is Some) is intentionally left to the caller: it is built + // only from confirmed memberships and evaluated below against that cached data. + if cipher_sync_data.is_none() + && let Some(ref org_uuid) = self.organization_uuid + && Membership::find_confirmed_by_user_and_org(user_uuid, org_uuid, conn).await.is_none() + { + return None; + } + // Check whether this cipher is directly owned by the user, or is in // a collection that the user has full access to. If so, there are no // access restrictions. @@ -669,16 +687,34 @@ impl Cipher { } async fn get_user_collections_access_flags(&self, user_uuid: &UserId, conn: &DbConn) -> Vec<(bool, bool, bool)> { + let cipher_uuid = self.uuid.clone(); + let user_uuid = user_uuid.clone(); conn.run(move |conn| { // Check whether this cipher is in any collections accessible to the // user. If so, retrieve the access flags for each collection. + // + // Security: bind the assignment to a *confirmed* membership in the same organization as + // both the cipher and the collection. Without this, a `users_collections` row left behind + // after a revoke, or an assignment pointing at a collection in a different organization, + // would keep granting access (defense in depth for audit findings H-1 and H-3). ciphers::table - .filter(ciphers::uuid.eq(&self.uuid)) + .filter(ciphers::uuid.eq(cipher_uuid)) .inner_join(ciphers_collections::table.on(ciphers::uuid.eq(ciphers_collections::cipher_uuid))) + .inner_join( + collections::table.on(collections::uuid + .eq(ciphers_collections::collection_uuid) + .and(collections::org_uuid.nullable().eq(ciphers::organization_uuid))), + ) .inner_join( users_collections::table.on(ciphers_collections::collection_uuid .eq(users_collections::collection_uuid) - .and(users_collections::user_uuid.eq(user_uuid))), + .and(users_collections::user_uuid.eq(user_uuid.clone()))), + ) + .inner_join( + users_organizations::table.on(users_organizations::user_uuid + .eq(user_uuid) + .and(users_organizations::org_uuid.eq(collections::org_uuid)) + .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))), ) .select((users_collections::read_only, users_collections::hide_passwords, users_collections::manage)) .load::<(bool, bool, bool)>(conn) @@ -691,9 +727,16 @@ impl Cipher { if !CONFIG.org_groups_enabled() { return Vec::new(); } + let cipher_uuid = self.uuid.clone(); + let user_uuid = user_uuid.clone(); conn.run(move |conn| { + // Security: bind the group assignment to a *confirmed* membership and require that the + // cipher, the collection, the group and the membership all belong to the same + // organization. The `collections` join in particular prevents a cross-organization + // collection<->group assignment from granting access to a foreign organization's ciphers + // (defense in depth for audit findings H-1, H-2 and H-3). ciphers::table - .filter(ciphers::uuid.eq(&self.uuid)) + .filter(ciphers::uuid.eq(cipher_uuid)) .inner_join(ciphers_collections::table.on(ciphers::uuid.eq(ciphers_collections::cipher_uuid))) .inner_join( collections_groups::table @@ -701,13 +744,21 @@ impl Cipher { ) .inner_join(groups_users::table.on(groups_users::groups_uuid.eq(collections_groups::groups_uuid))) .inner_join( - users_organizations::table.on(users_organizations::uuid.eq(groups_users::users_organizations_uuid)), + users_organizations::table.on(users_organizations::uuid + .eq(groups_users::users_organizations_uuid) + .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))), ) .inner_join( groups::table.on(groups::uuid .eq(collections_groups::groups_uuid) .and(groups::organizations_uuid.eq(users_organizations::org_uuid))), ) + .inner_join( + collections::table.on(collections::uuid + .eq(ciphers_collections::collection_uuid) + .and(collections::org_uuid.eq(groups::organizations_uuid)) + .and(collections::org_uuid.nullable().eq(ciphers::organization_uuid))), + ) .filter(users_organizations::user_uuid.eq(user_uuid)) .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage)) .load::<(bool, bool, bool)>(conn) diff --git a/src/db/models/group.rs b/src/db/models/group.rs index 820d3700..2f5348d7 100644 --- a/src/db/models/group.rs +++ b/src/db/models/group.rs @@ -13,7 +13,7 @@ use crate::{ }; use macros::UuidFromParam; -use super::{CollectionId, Membership, MembershipId, OrganizationId, User, UserId}; +use super::{Collection, CollectionId, Membership, MembershipId, MembershipStatus, OrganizationId, User, UserId}; #[derive(Identifiable, Queryable, Insertable, AsChangeset)] #[diesel(table_name = groups)] @@ -257,6 +257,7 @@ impl Group { .and(groups::organizations_uuid.eq(users_organizations::org_uuid))), ) .filter(users_organizations::user_uuid.eq(user_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter(groups::access_all.eq(true)) .select(groups::organizations_uuid) .distinct() @@ -268,12 +269,19 @@ impl Group { pub async fn is_in_full_access_group(user_uuid: &UserId, org_uuid: &OrganizationId, conn: &DbConn) -> bool { conn.run(move |conn| { + // Security: the membership linked through `groups_users` must itself belong to the same + // organization as the group and must be confirmed. Otherwise a cross-organization + // `groups_users` row (a member of org A linked to an access-all group of org B) would let + // that member pass as having full access to org B (audit finding H-2). groups::table .inner_join(groups_users::table.on(groups_users::groups_uuid.eq(groups::uuid))) .inner_join( - users_organizations::table.on(users_organizations::uuid.eq(groups_users::users_organizations_uuid)), + users_organizations::table.on(users_organizations::uuid + .eq(groups_users::users_organizations_uuid) + .and(users_organizations::org_uuid.eq(groups::organizations_uuid))), ) .filter(users_organizations::user_uuid.eq(user_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter(groups::organizations_uuid.eq(org_uuid)) .filter(groups::access_all.eq(true)) .select(groups::access_all) @@ -319,6 +327,17 @@ impl Group { impl CollectionGroup { pub async fn save(&mut self, org_uuid: &OrganizationId, conn: &DbConn) -> EmptyResult { + // Security (audit H-3): never persist a cross-organization link between a collection and a + // group. Both must belong to the organization this assignment is scoped to; otherwise a + // caller could attach a foreign-tenant group to this organization's collection and thereby + // grant that group's members access to it. This is a defense-in-depth guard so no route can + // create such a link even if it fails to validate its inputs. + if Collection::find_by_uuid_and_org(&self.collections_uuid, org_uuid, conn).await.is_none() + || Group::find_by_uuid_and_org(&self.groups_uuid, org_uuid, conn).await.is_none() + { + err!("Collection and group must belong to the same organization") + } + let group_users = GroupUser::find_by_group(&self.groups_uuid, org_uuid, conn).await; for group_user in group_users { group_user.update_user_revision(conn).await; @@ -493,6 +512,18 @@ impl CollectionGroup { impl GroupUser { pub async fn save(&mut self, conn: &DbConn) -> EmptyResult { + // Security (audit H-2): never persist a cross-organization link between a group and a + // membership. The group must belong to the same organization as the membership; otherwise a + // caller could grant a member of one organization full access to another organization's + // collections through an access-all group. This is a defense-in-depth guard so no route can + // create such a link even if it fails to validate its inputs. + let Some(member) = Membership::find_by_uuid(&self.users_organizations_uuid, conn).await else { + err!("Member not found while assigning to group") + }; + if Group::find_by_uuid_and_org(&self.groups_uuid, &member.org_uuid, conn).await.is_none() { + err!("Group and member must belong to the same organization") + } + self.update_user_revision(conn).await; db_run! { conn: From 1cc4238654f85c82c0307d9402ec5d420a31a4a1 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Fri, 17 Jul 2026 14:35:44 +0200 Subject: [PATCH 18/42] Fix collection delete for legacy Managers migrated to Custom The custom-role migration converts every legacy Manager (atype 3) into a Custom member (atype 4) with all collection flags false. collection_delete_access only granted the per-collection (ManagedOnly) path to atype == Manager, so those migrated members silently lost the ability to delete collections they still manage via an explicit users_collections.manage / collections_groups.manage grant (audit finding F-1). Grant ManagedOnly to confirmed Custom members as well, but only when they hold neither edit_any_collection nor access_all, so Edit any collection (which is mirrored onto access_all) can never become a blanket delete. The downstream is_coll_manageable_by_user check still requires a real per-collection Manage grant, so a flagless Custom member without any assignment gains nothing; a blanket "delete any collection" still requires the explicit delete_any_collection permission handled by the Any branch. Adds regression test migrated_legacy_manager_retains_managed_collection_delete. --- src/auth.rs | 65 +++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 61 insertions(+), 4 deletions(-) diff --git a/src/auth.rs b/src/auth.rs index c50b3d4c..131b7ad2 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -967,8 +967,24 @@ enum CollectionDeleteAccess { fn collection_delete_access(membership: &Membership) -> CollectionDeleteAccess { if membership.can_delete_any_collection() { CollectionDeleteAccess::Any - } else if membership.has_status(MembershipStatus::Confirmed) && membership.has_type(MembershipType::Manager) { - // Preserve the legacy Manager role's pre-existing per-collection deletion behavior. + } else if membership.has_status(MembershipStatus::Confirmed) + && (membership.has_type(MembershipType::Manager) + // A member holding the per-collection Manage grant may delete the collections they + // manage (Bitwarden's per-collection "Manage" includes deletion). This covers the + // legacy Manager role as well as legacy Managers that the custom-role migration + // converted into all-flags-false Custom members (audit finding F-1); without it those + // members would silently lose the ability to delete collections they still manage. + // + // The per-collection Manage decision is made downstream by `is_coll_manageable_by_user`, + // which also treats `access_all` as manage-everything. `edit_any_collection` is mirrored + // onto `access_all`, so a Custom member holding Edit any collection (or access_all) is + // deliberately excluded here: Delete must stay independent from Edit and must never + // become a blanket "delete any collection" without the explicit `delete_any_collection` + // permission handled by the `Any` branch above. + || (membership.has_type(MembershipType::Custom) + && !membership.has_edit_any_collection() + && !membership.access_all)) + { CollectionDeleteAccess::ManagedOnly } else { CollectionDeleteAccess::Denied @@ -1083,8 +1099,11 @@ impl From for Headers { } /// Delete is intentionally independent from Edit any collection. Vaultwarden advertises -/// limitCollectionDeletion=true, so Custom members require the explicit Delete any collection -/// permission. The legacy Manager role retains its previous per-collection behavior. +/// limitCollectionDeletion=true, so deleting *any* collection requires the explicit Delete any +/// collection permission (or Admin/Owner). Deleting an individual collection is additionally +/// allowed for members holding the per-collection Manage grant on it — the legacy Manager role and +/// the Custom members the migration produced from legacy Managers — but Edit any collection and +/// access_all never satisfy a delete on their own. pub struct CollectionDeleteHeaders { pub host: String, pub device: Device, @@ -1580,6 +1599,10 @@ mod tests { #[test] fn collection_delete_permission_is_independent_from_edit_and_access_all() { + // Edit any collection (which mirrors onto access_all) must never satisfy a delete on its + // own: it maps to `Denied` here, not `ManagedOnly`, so it can't ride the per-collection + // manage path into deleting collections. Only the explicit Delete any collection flag + // (handled by the `Any` branch) turns Edit-any members into collection deleters. let mut custom = membership(MembershipType::Custom); custom.edit_any_collection = true; custom.access_all = true; @@ -1603,4 +1626,38 @@ mod tests { let user = membership(MembershipType::User); assert_eq!(collection_delete_access(&user), CollectionDeleteAccess::Denied); } + + #[test] + fn migrated_legacy_manager_retains_managed_collection_delete() { + // Regression (audit finding F-1): the custom-role migration turns every legacy Manager + // (including those with access_all=false and an explicit per-collection Manage grant) into a + // Custom member with all collection flags false. Such a member must still reach the + // per-collection Manage check (`ManagedOnly`) instead of being denied outright, otherwise it + // silently loses the ability to delete the collections it manages. `ManagedOnly` is not a + // blanket grant: the downstream `is_coll_manageable_by_user` check still requires an actual + // Manage assignment (users_collections.manage / collections_groups.manage), which a plain + // Custom member without any assignment does not have. + let confirmed_custom = membership(MembershipType::Custom); + assert!(!confirmed_custom.access_all); + assert!(!confirmed_custom.edit_any_collection); + assert!(!confirmed_custom.delete_any_collection); + assert_eq!(collection_delete_access(&confirmed_custom), CollectionDeleteAccess::ManagedOnly); + + // create_new_collections alone must not change the delete decision either way. + let mut create_only = membership(MembershipType::Custom); + create_only.create_new_collections = true; + assert_eq!(collection_delete_access(&create_only), CollectionDeleteAccess::ManagedOnly); + + // Edit any collection / access_all still map to Denied (see the independence test above), + // so a Custom member gains a blanket delete only through delete_any_collection. + let mut edit_any = membership(MembershipType::Custom); + edit_any.edit_any_collection = true; + edit_any.access_all = true; + assert_eq!(collection_delete_access(&edit_any), CollectionDeleteAccess::Denied); + + // The membership must be confirmed; an invited/accepted member is always denied. + let mut unconfirmed = membership(MembershipType::Custom); + unconfirmed.status = MembershipStatus::Accepted as i32; + assert_eq!(collection_delete_access(&unconfirmed), CollectionDeleteAccess::Denied); + } } From 3cd4dd8bfa880269a5a53aa984670c795e895e7d Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sat, 18 Jul 2026 14:04:32 +0200 Subject: [PATCH 19/42] Fix custom collection authorization --- .../up.sql | 16 ++ .../up.sql | 16 ++ .../up.sql | 16 ++ src/api/core/organizations.rs | 5 +- src/auth.rs | 224 ++++++++++-------- src/db/models/organization.rs | 129 +++++++--- 6 files changed, 279 insertions(+), 127 deletions(-) diff --git a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql index c13662c4..da66070a 100644 --- a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql +++ b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -9,3 +9,19 @@ SET create_new_collections = access_all, edit_any_collection = access_all, delete_any_collection = access_all WHERE atype = 4; + +-- A legacy Manager also managed every collection when one of their groups had access_all, +-- even if the membership itself did not. Preserve that existing edit/delete capability without +-- granting collection creation, which historically still required membership access_all. +UPDATE users_organizations +SET edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype = 4 + AND EXISTS ( + SELECT 1 + FROM groups_users + INNER JOIN groups ON groups.uuid = groups_users.groups_uuid + WHERE groups_users.users_organizations_uuid = users_organizations.uuid + AND groups.organizations_uuid = users_organizations.org_uuid + AND groups.access_all = TRUE + ); diff --git a/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql index c13662c4..da66070a 100644 --- a/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql +++ b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -9,3 +9,19 @@ SET create_new_collections = access_all, edit_any_collection = access_all, delete_any_collection = access_all WHERE atype = 4; + +-- A legacy Manager also managed every collection when one of their groups had access_all, +-- even if the membership itself did not. Preserve that existing edit/delete capability without +-- granting collection creation, which historically still required membership access_all. +UPDATE users_organizations +SET edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype = 4 + AND EXISTS ( + SELECT 1 + FROM groups_users + INNER JOIN groups ON groups.uuid = groups_users.groups_uuid + WHERE groups_users.users_organizations_uuid = users_organizations.uuid + AND groups.organizations_uuid = users_organizations.org_uuid + AND groups.access_all = TRUE + ); diff --git a/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql index c13662c4..da66070a 100644 --- a/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql +++ b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -9,3 +9,19 @@ SET create_new_collections = access_all, edit_any_collection = access_all, delete_any_collection = access_all WHERE atype = 4; + +-- A legacy Manager also managed every collection when one of their groups had access_all, +-- even if the membership itself did not. Preserve that existing edit/delete capability without +-- granting collection creation, which historically still required membership access_all. +UPDATE users_organizations +SET edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype = 4 + AND EXISTS ( + SELECT 1 + FROM groups_users + INNER JOIN groups ON groups.uuid = groups_users.groups_uuid + WHERE groups_users.users_organizations_uuid = users_organizations.uuid + AND groups.organizations_uuid = users_organizations.org_uuid + AND groups.access_all = TRUE + ); diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 4b2e7187..ca30766e 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -2182,7 +2182,10 @@ async fn post_org_import( // any future drift fails closed with an error instead of panicking. for (cipher_index, col_index) in relations { let (Some(cipher_id), Some(col_id)) = (ciphers.get(cipher_index), collections.get(col_index)) else { - err!("Invalid collection relationship", "A collection relationship references a non-existent cipher or collection") + err!( + "Invalid collection relationship", + "A collection relationship references a non-existent cipher or collection" + ) }; CollectionCipher::save(cipher_id, col_id, &conn).await?; } diff --git a/src/auth.rs b/src/auth.rs index 131b7ad2..786f864c 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -958,36 +958,61 @@ fn get_col_id(request: &Request<'_>) -> Option { } #[derive(Clone, Copy, Debug, Eq, PartialEq)] -enum CollectionDeleteAccess { +enum CollectionManageAccess { Any, - ManagedOnly, + LegacyManager, + ExplicitManage, Denied, } -fn collection_delete_access(membership: &Membership) -> CollectionDeleteAccess { - if membership.can_delete_any_collection() { - CollectionDeleteAccess::Any - } else if membership.has_status(MembershipStatus::Confirmed) - && (membership.has_type(MembershipType::Manager) - // A member holding the per-collection Manage grant may delete the collections they - // manage (Bitwarden's per-collection "Manage" includes deletion). This covers the - // legacy Manager role as well as legacy Managers that the custom-role migration - // converted into all-flags-false Custom members (audit finding F-1); without it those - // members would silently lose the ability to delete collections they still manage. - // - // The per-collection Manage decision is made downstream by `is_coll_manageable_by_user`, - // which also treats `access_all` as manage-everything. `edit_any_collection` is mirrored - // onto `access_all`, so a Custom member holding Edit any collection (or access_all) is - // deliberately excluded here: Delete must stay independent from Edit and must never - // become a blanket "delete any collection" without the explicit `delete_any_collection` - // permission handled by the `Any` branch above. - || (membership.has_type(MembershipType::Custom) - && !membership.has_edit_any_collection() - && !membership.access_all)) - { - CollectionDeleteAccess::ManagedOnly - } else { - CollectionDeleteAccess::Denied +fn collection_access_by_role(membership: &Membership, custom_has_any_access: bool) -> CollectionManageAccess { + if !membership.has_status(MembershipStatus::Confirmed) { + return CollectionManageAccess::Denied; + } + + match MembershipType::from_i32(membership.atype) { + Some(MembershipType::Owner | MembershipType::Admin) => CollectionManageAccess::Any, + // Keep the pre-Custom role's broad behavior isolated to an exact legacy Manager. Its + // existing helper intentionally accepts membership/group access_all. + Some(MembershipType::Manager) => CollectionManageAccess::LegacyManager, + Some(MembershipType::Custom) if custom_has_any_access => CollectionManageAccess::Any, + // A Custom member must prove an actual users_collections.manage or + // collections_groups.manage assignment. In particular, groups.access_all is not Manage. + Some(MembershipType::Custom) => CollectionManageAccess::ExplicitManage, + Some(MembershipType::User) | None => CollectionManageAccess::Denied, + } +} + +fn collection_edit_access(membership: &Membership) -> CollectionManageAccess { + collection_access_by_role(membership, membership.has_edit_any_collection()) +} + +fn collection_read_access(membership: &Membership) -> CollectionManageAccess { + collection_access_by_role( + membership, + membership.has_edit_any_collection() || membership.has_delete_any_collection(), + ) +} + +fn collection_delete_access(membership: &Membership) -> CollectionManageAccess { + collection_access_by_role(membership, membership.has_delete_any_collection()) +} + +async fn can_manage_collection( + access: CollectionManageAccess, + membership: &Membership, + collection_uuid: &CollectionId, + conn: &DbConn, +) -> bool { + match access { + CollectionManageAccess::Any => true, + CollectionManageAccess::LegacyManager => { + Collection::is_coll_manageable_by_user(collection_uuid, &membership.user_uuid, conn).await + } + CollectionManageAccess::ExplicitManage => { + membership.has_explicit_collection_manage_access(collection_uuid, conn).await + } + CollectionManageAccess::Denied => false, } } @@ -1011,14 +1036,15 @@ impl<'r> FromRequest<'r> for ManagerHeaders { let headers = try_outcome!(OrgHeaders::from_request(request).await); if headers.is_confirmed_and_manager() { if let Some(col_id) = get_col_id(request) { - let Outcome::Success(conn) = DbConn::from_request(request).await else { - err_handler!("Error getting DB") - }; - - if !headers.membership.has_edit_any_collection() - && !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await - { - err_handler!("The current user isn't a manager for this collection") + let access = collection_edit_access(&headers.membership); + if access != CollectionManageAccess::Any { + let Outcome::Success(conn) = DbConn::from_request(request).await else { + err_handler!("Error getting DB") + }; + + if !can_manage_collection(access, &headers.membership, &col_id, &conn).await { + err_handler!("The current user isn't a manager for this collection") + } } } else { err_handler!("Error getting the collection id") @@ -1062,16 +1088,14 @@ impl<'r> FromRequest<'r> for CollectionReadHeaders { err_handler!("Error getting the collection id") }; - let can_read_any_collection = headers.is_confirmed_and_admin() - || headers.membership.has_edit_any_collection() - || headers.membership.has_delete_any_collection(); + let access = collection_read_access(&headers.membership); - if !can_read_any_collection { + if access != CollectionManageAccess::Any { let Outcome::Success(conn) = DbConn::from_request(request).await else { err_handler!("Error getting DB") }; - if !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await { + if !can_manage_collection(access, &headers.membership, &col_id, &conn).await { err_handler!("The current user isn't a manager for this collection") } } @@ -1101,9 +1125,9 @@ impl From for Headers { /// Delete is intentionally independent from Edit any collection. Vaultwarden advertises /// limitCollectionDeletion=true, so deleting *any* collection requires the explicit Delete any /// collection permission (or Admin/Owner). Deleting an individual collection is additionally -/// allowed for members holding the per-collection Manage grant on it — the legacy Manager role and -/// the Custom members the migration produced from legacy Managers — but Edit any collection and -/// access_all never satisfy a delete on their own. +/// allowed for members holding the per-collection Manage grant on it. Custom members use the +/// explicit assignment only; unlike the exact legacy Manager path, membership/group access_all +/// never counts as their per-collection Manage grant. pub struct CollectionDeleteHeaders { pub host: String, pub device: Device, @@ -1127,18 +1151,18 @@ impl<'r> FromRequest<'r> for CollectionDeleteHeaders { }; match collection_delete_access(&headers.membership) { - CollectionDeleteAccess::Any => {} - CollectionDeleteAccess::Denied => { - // Custom is a distinct, fail-closed role. In particular, Edit any collection and - // access_all must not satisfy a Delete request without the explicit delete flag. + CollectionManageAccess::Any => {} + CollectionManageAccess::Denied => { + // Custom is a distinct, fail-closed role. Edit any collection and access_all alone + // must not satisfy a Delete request without either Delete any or explicit Manage. err_handler!("You need the 'Delete any collection' permission to call this endpoint") } - CollectionDeleteAccess::ManagedOnly => { + access @ (CollectionManageAccess::LegacyManager | CollectionManageAccess::ExplicitManage) => { let Outcome::Success(conn) = DbConn::from_request(request).await else { err_handler!("Error getting DB") }; - if !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await { + if !can_manage_collection(access, &headers.membership, &col_id, &conn).await { err_handler!("The current user isn't a manager for this collection") } } @@ -1224,7 +1248,7 @@ impl CollectionDeleteHeaders { conn: &DbConn, ) -> Result { let delete_access = collection_delete_access(&h.membership); - if delete_access == CollectionDeleteAccess::Denied { + if delete_access == CollectionManageAccess::Denied { err!("You need the 'Delete any collection' permission to call this endpoint") } @@ -1235,8 +1259,8 @@ impl CollectionDeleteHeaders { if Collection::find_by_uuid_and_org(col_id, &h.membership.org_uuid, conn).await.is_none() { err!("Collection not found", "Collection does not exist or does not belong to this organization") } - if delete_access == CollectionDeleteAccess::ManagedOnly - && !Collection::is_coll_manageable_by_user(col_id, &h.membership.user_uuid, conn).await + if delete_access != CollectionManageAccess::Any + && !can_manage_collection(delete_access, &h.membership, col_id, conn).await { err!("Collection not found", "The current user isn't a manager for this collection") } @@ -1587,7 +1611,7 @@ pub async fn refresh_tokens( #[cfg(test)] mod tests { - use super::{CollectionDeleteAccess, collection_delete_access}; + use super::{CollectionManageAccess, collection_delete_access, collection_edit_access, collection_read_access}; use crate::db::models::{Membership, MembershipStatus, MembershipType}; fn membership(member_type: MembershipType) -> Membership { @@ -1598,66 +1622,68 @@ mod tests { } #[test] - fn collection_delete_permission_is_independent_from_edit_and_access_all() { - // Edit any collection (which mirrors onto access_all) must never satisfy a delete on its - // own: it maps to `Denied` here, not `ManagedOnly`, so it can't ride the per-collection - // manage path into deleting collections. Only the explicit Delete any collection flag - // (handled by the `Any` branch) turns Edit-any members into collection deleters. - let mut custom = membership(MembershipType::Custom); - custom.edit_any_collection = true; - custom.access_all = true; - assert_eq!(collection_delete_access(&custom), CollectionDeleteAccess::Denied); + fn flagless_custom_requires_explicit_manage_for_edit_read_and_delete() { + let custom = membership(MembershipType::Custom); + assert_eq!(collection_edit_access(&custom), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_read_access(&custom), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_delete_access(&custom), CollectionManageAccess::ExplicitManage); + + // Neither a stale membership access_all value nor an external groups.access_all grant may + // switch a Custom member to the legacy broad helper. ExplicitManage invokes the database + // helper that only accepts users_collections.manage / collections_groups.manage. + let mut access_all = membership(MembershipType::Custom); + access_all.access_all = true; + assert_eq!(collection_edit_access(&access_all), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_read_access(&access_all), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_delete_access(&access_all), CollectionManageAccess::ExplicitManage); + } - custom.delete_any_collection = true; - assert_eq!(collection_delete_access(&custom), CollectionDeleteAccess::Any); + #[test] + fn custom_any_permissions_remain_independent() { + let mut edit_any = membership(MembershipType::Custom); + edit_any.edit_any_collection = true; + edit_any.access_all = true; + assert_eq!(collection_edit_access(&edit_any), CollectionManageAccess::Any); + assert_eq!(collection_read_access(&edit_any), CollectionManageAccess::Any); + // Edit-any alone is not blanket Delete. It still permits deletion of an explicitly managed + // collection, which is why the result is ExplicitManage rather than Denied. + assert_eq!(collection_delete_access(&edit_any), CollectionManageAccess::ExplicitManage); - custom.status = MembershipStatus::Accepted as i32; - assert_eq!(collection_delete_access(&custom), CollectionDeleteAccess::Denied); + let mut delete_any = membership(MembershipType::Custom); + delete_any.delete_any_collection = true; + assert_eq!(collection_edit_access(&delete_any), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_read_access(&delete_any), CollectionManageAccess::Any); + assert_eq!(collection_delete_access(&delete_any), CollectionManageAccess::Any); } #[test] - fn collection_delete_permission_preserves_admin_and_legacy_manager_behavior() { - let admin = membership(MembershipType::Admin); - assert_eq!(collection_delete_access(&admin), CollectionDeleteAccess::Any); - + fn exact_legacy_manager_keeps_broad_helper() { let manager = membership(MembershipType::Manager); - assert_eq!(collection_delete_access(&manager), CollectionDeleteAccess::ManagedOnly); + assert_eq!(collection_edit_access(&manager), CollectionManageAccess::LegacyManager); + assert_eq!(collection_read_access(&manager), CollectionManageAccess::LegacyManager); + assert_eq!(collection_delete_access(&manager), CollectionManageAccess::LegacyManager); + + let admin = membership(MembershipType::Admin); + assert_eq!(collection_edit_access(&admin), CollectionManageAccess::Any); + assert_eq!(collection_delete_access(&admin), CollectionManageAccess::Any); let user = membership(MembershipType::User); - assert_eq!(collection_delete_access(&user), CollectionDeleteAccess::Denied); + assert_eq!(collection_edit_access(&user), CollectionManageAccess::Denied); + assert_eq!(collection_delete_access(&user), CollectionManageAccess::Denied); } #[test] - fn migrated_legacy_manager_retains_managed_collection_delete() { - // Regression (audit finding F-1): the custom-role migration turns every legacy Manager - // (including those with access_all=false and an explicit per-collection Manage grant) into a - // Custom member with all collection flags false. Such a member must still reach the - // per-collection Manage check (`ManagedOnly`) instead of being denied outright, otherwise it - // silently loses the ability to delete the collections it manages. `ManagedOnly` is not a - // blanket grant: the downstream `is_coll_manageable_by_user` check still requires an actual - // Manage assignment (users_collections.manage / collections_groups.manage), which a plain - // Custom member without any assignment does not have. - let confirmed_custom = membership(MembershipType::Custom); - assert!(!confirmed_custom.access_all); - assert!(!confirmed_custom.edit_any_collection); - assert!(!confirmed_custom.delete_any_collection); - assert_eq!(collection_delete_access(&confirmed_custom), CollectionDeleteAccess::ManagedOnly); - - // create_new_collections alone must not change the delete decision either way. - let mut create_only = membership(MembershipType::Custom); - create_only.create_new_collections = true; - assert_eq!(collection_delete_access(&create_only), CollectionDeleteAccess::ManagedOnly); - - // Edit any collection / access_all still map to Denied (see the independence test above), - // so a Custom member gains a blanket delete only through delete_any_collection. - let mut edit_any = membership(MembershipType::Custom); - edit_any.edit_any_collection = true; - edit_any.access_all = true; - assert_eq!(collection_delete_access(&edit_any), CollectionDeleteAccess::Denied); + fn migrated_legacy_manager_retains_explicit_collection_manage() { + // The role migration converts legacy Managers to flagless Custom members. They retain + // edit/delete only for collections with a persisted per-collection Manage assignment; + // the restrictive helper deliberately excludes group and membership access_all. + let migrated_manager = membership(MembershipType::Custom); + assert_eq!(collection_edit_access(&migrated_manager), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_delete_access(&migrated_manager), CollectionManageAccess::ExplicitManage); - // The membership must be confirmed; an invited/accepted member is always denied. let mut unconfirmed = membership(MembershipType::Custom); unconfirmed.status = MembershipStatus::Accepted as i32; - assert_eq!(collection_delete_access(&unconfirmed), CollectionDeleteAccess::Denied); + assert_eq!(collection_edit_access(&unconfirmed), CollectionManageAccess::Denied); + assert_eq!(collection_delete_access(&unconfirmed), CollectionManageAccess::Denied); } } diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 3fbfc789..81ceb15c 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -15,8 +15,8 @@ use crate::{ db::{ DbConn, schema::{ - ciphers, ciphers_collections, collections_groups, groups, groups_users, org_policies, organization_api_key, - organizations, users, users_collections, users_organizations, + ciphers, ciphers_collections, collections, collections_groups, groups, groups_users, org_policies, + organization_api_key, organizations, users, users_collections, users_organizations, }, }, error::MapResult, @@ -119,27 +119,25 @@ impl MembershipType { _ => None, } } + + const fn access_rank(self) -> u8 { + match self { + Self::User => 0, + Self::Manager | Self::Custom => 1, + Self::Admin => 2, + Self::Owner => 3, + } + } } impl Ord for MembershipType { fn cmp(&self, other: &MembershipType) -> Ordering { - // For easy comparison, map each variant to an access level (where 0 is lowest). - // Custom is treated as a low-privilege base role (same level as Manager for - // ordering purposes); its elevated capabilities are governed by the explicit - // custom permission flags on the Membership, not by this ordering. - // - // NOTE: Manager and Custom therefore share an access level while being distinct - // variants: the derived `PartialEq` compares the role itself (Manager != Custom), - // while this ordering compares access levels (neither is greater than the other). - // Keep that in mind before relying on `cmp() == Equal` implying equality. - const ACCESS_LEVEL: [i32; 5] = [ - 3, // Owner - 2, // Admin - 0, // User - 1, // Manager - 1, // Custom - ]; - ACCESS_LEVEL[*self as usize].cmp(&ACCESS_LEVEL[*other as usize]) + // Manager and Custom intentionally share the same authorization rank. A total ordering + // still has to distinguish unequal enum variants, otherwise `Ord` would disagree with + // `Eq` and ordered maps/sets could collapse one role into the other. The discriminant is a + // stable tie-breaker and places Custom after Manager, preserving `Custom >= Manager` while + // keeping both roles below Admin. + self.access_rank().cmp(&other.access_rank()).then_with(|| (*self as i32).cmp(&(*other as i32))) } } @@ -849,6 +847,69 @@ impl Membership { self.has_type(MembershipType::Custom) && self.delete_any_collection } + /// Check for an explicit per-collection Manage grant without treating any `access_all` value + /// as such a grant. Custom-role collection guards use this instead of the legacy broad helper, + /// because membership/group `access_all` must not manufacture a per-collection Manage grant. + pub async fn has_explicit_collection_manage_access(&self, collection_uuid: &CollectionId, conn: &DbConn) -> bool { + let membership_uuid = self.uuid.clone(); + let user_uuid = self.user_uuid.clone(); + let org_uuid = self.org_uuid.clone(); + let collection_uuid = collection_uuid.clone(); + + conn.run(move |conn| { + let has_direct_manage = users_organizations::table + .inner_join( + users_collections::table.on(users_collections::user_uuid.eq(users_organizations::user_uuid)), + ) + .inner_join( + collections::table.on(collections::uuid + .eq(users_collections::collection_uuid) + .and(collections::org_uuid.eq(users_organizations::org_uuid))), + ) + .filter(users_organizations::uuid.eq(membership_uuid.clone())) + .filter(users_organizations::user_uuid.eq(user_uuid.clone())) + .filter(users_organizations::org_uuid.eq(org_uuid.clone())) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) + .filter(collections::uuid.eq(collection_uuid.clone())) + .filter(users_collections::manage.eq(true)) + .count() + .first::(conn) + .unwrap_or(0) + != 0; + + if has_direct_manage { + return true; + } + + users_organizations::table + .inner_join( + groups_users::table.on(groups_users::users_organizations_uuid.eq(users_organizations::uuid)), + ) + .inner_join( + groups::table.on(groups::uuid + .eq(groups_users::groups_uuid) + .and(groups::organizations_uuid.eq(users_organizations::org_uuid))), + ) + .inner_join(collections_groups::table.on(collections_groups::groups_uuid.eq(groups_users::groups_uuid))) + .inner_join( + collections::table.on(collections::uuid + .eq(collections_groups::collections_uuid) + .and(collections::org_uuid.eq(users_organizations::org_uuid))), + ) + .filter(users_organizations::uuid.eq(membership_uuid)) + .filter(users_organizations::user_uuid.eq(user_uuid)) + .filter(users_organizations::org_uuid.eq(org_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) + .filter(collections::uuid.eq(collection_uuid)) + .filter(collections_groups::manage.eq(true)) + .count() + .first::(conn) + .unwrap_or(0) + != 0 + }) + .await + } + /// `manageAllCollections` is a client-side aggregate checkbox, not a separately persisted /// Bitwarden permission. It is selected exactly when all three child permissions are selected. pub fn has_manage_all_collections(&self) -> bool { @@ -1347,18 +1408,32 @@ mod tests { } #[test] - #[allow(non_snake_case)] - fn partial_cmp_MembershipType() { + fn membership_type_order_preserves_access_rank_and_ord_contract() { assert!(MembershipType::Owner > MembershipType::Admin); - assert!(MembershipType::Admin > MembershipType::Manager); + assert!(MembershipType::Admin > MembershipType::Custom); + assert!(MembershipType::Custom > MembershipType::Manager); assert!(MembershipType::Manager > MembershipType::User); assert!(MembershipType::Custom == MembershipType::from_str("4").unwrap()); - // Manager and Custom share the same access level, but are distinct roles - assert!(MembershipType::Manager != MembershipType::Custom); - assert!(MembershipType::Manager >= MembershipType::Custom); + + // Permission comparisons continue to treat Custom as manager-level and below Admin. assert!(MembershipType::Custom >= MembershipType::Manager); - assert!(MembershipType::Custom > MembershipType::User); - assert!(MembershipType::Admin > MembershipType::Custom); + let custom = MembershipType::Custom as i32; + assert!(custom >= MembershipType::Manager); + assert!(custom < MembershipType::Admin); + + let types = [ + MembershipType::Owner, + MembershipType::Admin, + MembershipType::User, + MembershipType::Manager, + MembershipType::Custom, + ]; + for lhs in types { + for rhs in types { + assert_eq!(lhs.cmp(&rhs) == Ordering::Equal, lhs == rhs); + assert_eq!(lhs.cmp(&rhs), rhs.cmp(&lhs).reverse()); + } + } } #[test] From 84edbf23b0b7ae368e222af9526e7a6b5d943431 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sat, 18 Jul 2026 23:19:10 +0200 Subject: [PATCH 20/42] Fix Custom Role selectors for new dialogs --- src/static/templates/scss/vaultwarden.scss.hbs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/static/templates/scss/vaultwarden.scss.hbs b/src/static/templates/scss/vaultwarden.scss.hbs index 6cf97cb6..11bcbad6 100644 --- a/src/static/templates/scss/vaultwarden.scss.hbs +++ b/src/static/templates/scss/vaultwarden.scss.hbs @@ -118,9 +118,9 @@ app-security > app-two-factor-setup > form { /* Hide unsupported Custom Role options */ /* The collection permission group plus manageUsers, manageGroups, managePolicies are supported by Vaultwarden and are intentionally not hidden here. */ -bit-dialog div.tw-col-span-4:has(input[formcontrolname*="access"]), -bit-dialog bit-form-control:has(input[formcontrolname="manageSso"]), -bit-dialog bit-form-control:has(input[formcontrolname="manageResetPassword"]) { +:is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"]), +:is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageSso"]), +:is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageResetPassword"]) { @extend %vw-hide; } From 8289e2dcff314853e5cc8c0fdac27edb9535284c Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sun, 19 Jul 2026 20:20:15 +0200 Subject: [PATCH 21/42] Fix custom-role privilege escalation and align read guards (security review) Follow-up hardening on the custom-role work, found during a static review: - Admin panel type change (apply_membership_type_change): when converting a Custom member to the legacy Manager role, only preserve `access_all` if the member actually held the full "manage all collections" grant (all three collection flags). Previously an Edit-any-collection-only Custom member (whose access_all is just the Edit mirror) became a Manager with a broad access_all grant, silently escalating Edit-only into Create + Edit + Delete. Mirrors the collection-permissions down-migration. Unit test updated. - Bulk collection access (post_bulk_access_collections): drop the blanket has_full_access() requirement and rely on the existing per-collection is_manageable_by_user check (as the single-collection endpoint and the pre-existing behavior do). Pure manage_users / manage_groups / manage_policies Custom members hold no per-collection manage grant and are still rejected, while a Manager/Custom member who manages some collections regains the ability to bulk-edit exactly those collections. - Group details (GET /organizations//groups//details): align the guard with the list endpoint (/groups/details) to ManageUsersOrGroups, so a manage_users member is not denied the single-group view of the same data it can already read in bulk. --- src/api/admin.rs | 42 +++++++++++++++++++++++++++++------ src/api/core/organizations.rs | 20 +++++++++++------ 2 files changed, 48 insertions(+), 14 deletions(-) diff --git a/src/api/admin.rs b/src/api/admin.rs index 0c85d562..8c60e0c7 100644 --- a/src/api/admin.rs +++ b/src/api/admin.rs @@ -547,6 +547,16 @@ struct MembershipTypeData { fn apply_membership_type_change(membership: &mut Membership, new_type: MembershipType) { let was_custom = membership.atype == MembershipType::Custom; + // Leaving Custom for the legacy Manager role: `access_all` is the internal mirror of + // Edit any collection, but a Manager's `access_all` means the broad "manage all collections" + // grant (Create + Edit + Delete). Carrying an Edit-only mirror over would silently escalate the + // member to Create/Edit/Delete. Only preserve `access_all` when the member actually held the + // full manage-all grant, mirroring the collection-permissions down-migration. Must be evaluated + // before the flags are cleared below (and while the type is still Custom). + if was_custom && new_type == MembershipType::Manager { + membership.access_all = membership.has_manage_all_collections(); + } + // Entering Custom through the Vaultwarden admin panel is deliberately fail-closed because // that UI cannot select granular permissions; they can be granted later through the regular // organization member dialog. @@ -956,12 +966,30 @@ mod tests { apply_membership_type_change(&mut user, MembershipType::Admin); assert!(user.access_all); - let mut custom = membership(MembershipType::Custom); - custom.access_all = true; - custom.edit_any_collection = true; - apply_membership_type_change(&mut custom, MembershipType::Manager); - assert_eq!(custom.atype, MembershipType::Manager as i32); - assert!(custom.access_all); - assert!(!custom.edit_any_collection); + // REGRESSION (privilege escalation, PR #7397 / finding F2): a Custom member whose + // `access_all` is only the Edit-any-collection mirror must NOT be turned into a legacy + // Manager with the broad "manage all collections" `access_all` grant. That would escalate + // an Edit-only member into Create + Edit + Delete. Mirrors the collection down-migration. + let mut edit_only = membership(MembershipType::Custom); + edit_only.access_all = true; + edit_only.edit_any_collection = true; + apply_membership_type_change(&mut edit_only, MembershipType::Manager); + assert_eq!(edit_only.atype, MembershipType::Manager as i32); + assert!(!edit_only.access_all, "Edit-only Custom must not become an access_all Manager"); + assert!(!edit_only.edit_any_collection); + + // A Custom member who genuinely held the full manage-all grant (all three collection + // flags) keeps the equivalent legacy Manager `access_all`. + let mut manage_all = membership(MembershipType::Custom); + manage_all.access_all = true; + manage_all.create_new_collections = true; + manage_all.edit_any_collection = true; + manage_all.delete_any_collection = true; + apply_membership_type_change(&mut manage_all, MembershipType::Manager); + assert_eq!(manage_all.atype, MembershipType::Manager as i32); + assert!(manage_all.access_all, "full manage-all Custom keeps legacy Manager access_all"); + assert!(!manage_all.create_new_collections); + assert!(!manage_all.edit_any_collection); + assert!(!manage_all.delete_any_collection); } } diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index ca30766e..4945f3dc 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -629,12 +629,13 @@ async fn post_bulk_access_collections( err!("Can't find organization details") } - // Security: only callers who can actually manage collections (Admins/Owners, or users with - // full access) may change collection access in bulk. A custom user with only manage_users / - // manage_groups / manage_policies must not be able to modify collection assignments here. - if !headers.membership.has_full_access() { - err!("You don't have permission to modify collection access") - } + // Security: authorization is enforced per collection below via `is_manageable_by_user`, which + // requires a real manage grant on each requested collection (direct users_collections.manage, + // a manage group, membership/group access_all, or Admin/Owner). This matches the single + // collection edit endpoint and the pre-existing behavior of this endpoint. A custom user with + // only manage_users / manage_groups / manage_policies holds no such grant and is therefore + // rejected, while a Manager/Custom member who manages some collections keeps the ability to + // bulk-edit exactly those (a blanket full-access requirement would wrongly deny that here). // Security (audit H-3) and atomicity (audit M-2): validate the whole request against this // organization *before* mutating anything. Every collection must exist in the org and be @@ -3110,11 +3111,16 @@ async fn add_update_group( }))) } +// Reads a single group's details (accessAll, externalId, collection mappings). This is the same +// data the `/groups/details` list endpoint returns, so it uses the same guard: Manage Users OR +// Manage Groups (or Admin/Owner). Requiring Manage Groups here while the list only requires Manage +// Users-or-Groups would let a manage_users member read every group's details in bulk but be denied +// the single-group view of the same data. #[get("/organizations//groups//details")] async fn get_group_details( org_id: OrganizationId, group_id: GroupId, - headers: ManageGroupsHeaders, + headers: ManageUsersOrGroupsHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { From 031051b61cc6ae3b0d51b83dd08e667a1096bad9 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Tue, 21 Jul 2026 23:07:09 +0200 Subject: [PATCH 22/42] Fix privilege escalation: Edit any collection could reach Delete any collection A Custom member holding only `edit_any_collection` (whose `access_all` mirror makes every collection "manageable") could grant a per-collection `manage` row to a group it belongs to -- via post_bulk_access_collections, post_organization_collection_update, add_update_group or edit_member -- and then delete that collection through CollectionDeleteHeaders' `has_explicit_collection_manage_access` path, despite holding no `delete_any_collection` permission. This defeated the intended edit != delete separation (confirmed end-to-end: the delete returned 200 before this change). Gate every caller-controlled collection-assignment `manage` write behind a new `caller_may_grant_collection_manage()` check that mirrors the delete authorization exactly: a caller may confer `manage` (which carries delete authority) on a collection only if it could delete that collection itself -- Admin/Owner or `delete_any_collection` always; an exact legacy Manager via its per-collection manage helper; any other Custom member only with a real persisted `users_collections.manage` / `collections_groups.manage` grant. `edit_any_collection`'s `access_all` mirror deliberately does not count. The change is strictly subtractive: it can only ever downgrade a requested `manage` to false, never grant it, so it opens no new access and leaves Admins/Owners and genuinely delete-capable members unaffected. The create, organization-import and invite paths are intentionally left alone (new-collection creators must manage their own collection; non-owner invites can only create plain Users, which cannot delete). Adds a unit test for the collection-independent part of the gate. --- src/api/core/organizations.rs | 185 +++++++++++++++++++++++++++++++--- 1 file changed, 173 insertions(+), 12 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 4945f3dc..93b6fa4b 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -669,6 +669,11 @@ async fn post_bulk_access_collections( for collection in collections { let col_id = &collection.uuid; + // Security (F-1): only a caller who could delete this collection may confer a `manage` grant + // on it. Otherwise the requested `manage` is forced to false, so a caller whose access comes + // from Edit-any-collection cannot escalate into deletion by self-assigning a manage row. + let may_grant_manage = caller_may_grant_collection_manage(&headers.membership, col_id, &conn).await; + // update collection modification date collection.save(&conn).await?; @@ -685,9 +690,15 @@ async fn post_bulk_access_collections( CollectionGroup::delete_all_by_collection(col_id, &org_id, &conn).await?; for group in &data.groups { - CollectionGroup::new(col_id.clone(), group.id.clone(), group.read_only, group.hide_passwords, group.manage) - .save(&org_id, &conn) - .await?; + CollectionGroup::new( + col_id.clone(), + group.id.clone(), + group.read_only, + group.hide_passwords, + group.manage && may_grant_manage, + ) + .save(&org_id, &conn) + .await?; } CollectionUser::delete_all_by_collection(col_id, &conn).await?; @@ -700,8 +711,15 @@ async fn post_bulk_access_collections( continue; } - CollectionUser::save(&member.user_uuid, col_id, user.read_only, user.hide_passwords, user.manage, &conn) - .await?; + CollectionUser::save( + &member.user_uuid, + col_id, + user.read_only, + user.hide_passwords, + user.manage && may_grant_manage, + &conn, + ) + .await?; } } @@ -760,12 +778,26 @@ async fn post_organization_collection_update( ) .await; + // Security (F-1): only a caller who could delete this collection may confer a `manage` grant on + // it (a `manage` row carries delete authority). For everyone else the requested `manage` is + // forced to false, so Edit-any-collection can rewrite access but never escalate into deletion. + let may_grant_manage = match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + Some(caller) => caller_may_grant_collection_manage(&caller, &col_id, &conn).await, + None => false, + }; + CollectionGroup::delete_all_by_collection(&col_id, &org_id, &conn).await?; for group in data.groups { - CollectionGroup::new(col_id.clone(), group.id, group.read_only, group.hide_passwords, group.manage) - .save(&org_id, &conn) - .await?; + CollectionGroup::new( + col_id.clone(), + group.id, + group.read_only, + group.hide_passwords, + group.manage && may_grant_manage, + ) + .save(&org_id, &conn) + .await?; } CollectionUser::delete_all_by_collection(&col_id, &conn).await?; @@ -779,8 +811,15 @@ async fn post_organization_collection_update( continue; } - CollectionUser::save(&member.user_uuid, &col_id, user.read_only, user.hide_passwords, user.manage, &conn) - .await?; + CollectionUser::save( + &member.user_uuid, + &col_id, + user.read_only, + user.hide_passwords, + user.manage && may_grant_manage, + &conn, + ) + .await?; } Ok(Json(collection.to_json_details(&headers.user.uuid, None, &conn).await)) @@ -1823,18 +1862,28 @@ async fn edit_member( c.delete(&conn).await?; } + // Security (F-1): a per-collection `manage` grant carries delete authority, so the caller + // may only confer it on collections they could delete themselves. A caller acting via + // Edit-any-collection thus cannot hand another member a manage/delete grant it lacks. + let caller = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await; + // If no accessAll, add the collections received if !access_all { for col in data.collections.iter().flatten() { match Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await { None => err!("Collection not found in Organization"), Some(collection) => { + let manage = col.manage + && match &caller { + Some(c) => caller_may_grant_collection_manage(c, &collection.uuid, &conn).await, + None => false, + }; CollectionUser::save( &member_to_edit.user_uuid, &collection.uuid, col.read_only, col.hide_passwords, - col.manage, + manage, &conn, ) .await?; @@ -3058,6 +3107,64 @@ async fn group_confers_collection_access(group_id: &GroupId, org_id: &Organizati } } +/// Whether `caller` may set a per-collection `manage` grant (`users_collections.manage` / +/// `collections_groups.manage`) on `col_id`. +/// +/// Security (F-1, edit-any -> delete-any escalation): a `manage` grant carries collection *delete* +/// authority — `CollectionDeleteHeaders` accepts it via `has_explicit_collection_manage_access`. +/// Without this gate a Custom member holding only `edit_any_collection` (whose `access_all` mirror +/// makes every collection "manageable") could, through the collection-access / group endpoints, +/// hand a `manage` row to a group they belong to (or to a manager-level member) and thereby gain +/// deletion — a capability `edit_any_collection` must never imply. +/// +/// We therefore allow granting `manage` on a collection only to a caller who could delete that same +/// collection themselves, mirroring `collection_delete_access` exactly so it can never hand out a +/// right the caller lacks: Admin/Owner and Custom-with-`delete_any_collection` always qualify; an +/// exact legacy Manager uses its per-collection manage helper; any other Custom member must hold a +/// real explicit manage grant. This is strictly subtractive — it can only ever downgrade a requested +/// `manage` to `false`, never grant it — so it opens no new access, and delete-capable members +/// (including all Admins/Owners) are unaffected. +async fn caller_may_grant_collection_manage(caller: &Membership, col_id: &CollectionId, conn: &DbConn) -> bool { + match caller_manage_grant_role_check(caller) { + // Role alone decides it (Admin/Owner or delete_any -> yes; User/unknown/unconfirmed -> no). + Some(decision) => decision, + // Manager/Custom: the answer is per-collection and must reflect a *real* manage grant. + None => match MembershipType::from_i32(caller.atype) { + // The exact legacy Manager keeps its broad per-collection manage helper (which also + // honors membership/group access_all), matching its pre-existing delete authorization. + Some(MembershipType::Manager) => { + Collection::is_coll_manageable_by_user(col_id, &caller.user_uuid, conn).await + } + // A Custom member must prove a real users_collections.manage / collections_groups.manage + // grant; edit_any_collection's access_all mirror deliberately does not count here. + Some(MembershipType::Custom) => caller.has_explicit_collection_manage_access(col_id, conn).await, + _ => false, + }, + } +} + +/// Pure, collection-independent part of `caller_may_grant_collection_manage`. +/// +/// `Some(true)` -> the caller may grant `manage` on *any* collection (Admin/Owner, or a Custom +/// member holding `delete_any_collection`). +/// `Some(false)` -> the caller may never grant `manage` (unconfirmed, plain User, or unknown type). +/// `None` -> depends on a real per-collection manage grant, resolved against the database. +/// +/// Kept separate so the role gating — in particular that `edit_any_collection` alone yields `None` +/// (a DB check for a genuine grant) rather than `Some(true)` — is unit-testable without a DB. +fn caller_manage_grant_role_check(caller: &Membership) -> Option { + if caller.can_delete_any_collection() { + return Some(true); // Admin/Owner, or a Custom member holding delete_any_collection + } + if !caller.has_status(MembershipStatus::Confirmed) { + return Some(false); + } + match MembershipType::from_i32(caller.atype) { + Some(MembershipType::Manager | MembershipType::Custom) => None, + _ => Some(false), + } +} + async fn add_update_group( mut group: Group, collections: Vec, @@ -3069,8 +3176,20 @@ async fn add_update_group( ) -> JsonResult { group.save(conn).await?; + // Security (F-1): a `collections_groups.manage` grant carries collection delete authority, so a + // caller may only set it on a collection they could delete themselves. This stops a caller whose + // access derives from Edit-any-collection from creating a manage-bearing group and then joining + // it to reach Delete-any-collection. Fetched once; delete-capable callers keep `manage`. + let caller = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, conn).await; for col_selection in collections { let mut collection_group = col_selection.to_collection_group(group.uuid.clone()); + if collection_group.manage { + let may_grant_manage = match &caller { + Some(c) => caller_may_grant_collection_manage(c, &collection_group.collections_uuid, conn).await, + None => false, + }; + collection_group.manage = may_grant_manage; + } collection_group.save(&org_id, conn).await?; } @@ -3732,10 +3851,52 @@ mod tests { use serde_json::{Value, json}; use super::{ - CustomRolePermissions, filter_ciphers_for_organization, may_change_group_membership, may_change_member_type, + CustomRolePermissions, caller_manage_grant_role_check, filter_ciphers_for_organization, + may_change_group_membership, may_change_member_type, }; use crate::db::models::{Cipher, Membership, MembershipStatus, MembershipType, OrganizationId}; + fn confirmed_member(member_type: MembershipType) -> Membership { + let mut m = Membership::new("test-user".to_owned().into(), "test-org".to_owned().into(), None); + m.atype = member_type as i32; + m.status = MembershipStatus::Confirmed as i32; + m + } + + #[test] + fn only_delete_capable_callers_may_grant_collection_manage() { + // Admin/Owner may always confer a per-collection `manage` (delete) grant. + assert_eq!(caller_manage_grant_role_check(&confirmed_member(MembershipType::Owner)), Some(true)); + assert_eq!(caller_manage_grant_role_check(&confirmed_member(MembershipType::Admin)), Some(true)); + + // A Custom member with `delete_any_collection` may also always grant it. + let mut delete_any = confirmed_member(MembershipType::Custom); + delete_any.delete_any_collection = true; + assert_eq!(caller_manage_grant_role_check(&delete_any), Some(true)); + + // REGRESSION (F-1): a Custom member with ONLY `edit_any_collection` must NOT get a blanket + // yes. The role check returns None so the decision falls through to a real per-collection + // manage grant in the DB — which a self-assigned group/user manage row is prevented from + // manufacturing. This is what stops edit-any from escalating into delete-any. + let mut edit_any = confirmed_member(MembershipType::Custom); + edit_any.edit_any_collection = true; + edit_any.access_all = true; // the internal mirror of edit_any must not shortcut to yes + assert_eq!(caller_manage_grant_role_check(&edit_any), None); + + // A flagless Custom / exact Manager also defer to the per-collection DB check. + assert_eq!(caller_manage_grant_role_check(&confirmed_member(MembershipType::Custom)), None); + assert_eq!(caller_manage_grant_role_check(&confirmed_member(MembershipType::Manager)), None); + + // Plain User never qualifies. + assert_eq!(caller_manage_grant_role_check(&confirmed_member(MembershipType::User)), Some(false)); + + // An unconfirmed caller never qualifies, even with delete_any set. + let mut unconfirmed = confirmed_member(MembershipType::Custom); + unconfirmed.status = MembershipStatus::Accepted as i32; + unconfirmed.delete_any_collection = true; + assert_eq!(caller_manage_grant_role_check(&unconfirmed), Some(false)); + } + #[test] fn assigned_cipher_response_is_scoped_to_requested_organization() { let requested_org: OrganizationId = "requested-org".to_owned().into(); From fe3111d9b593ea6ac2d3a2ca7380c4fe7d7ef3c4 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:16:59 +0200 Subject: [PATCH 23/42] Align bulk collection-access authorization with single-collection edit post_bulk_access_collections authorized each requested collection via the legacy Collection::is_manageable_by_user helper, which also accepts a member's membership/group access_all. For a Custom member this diverged from the single-collection edit endpoint (ManagerHeaders -> collection_edit_access), which requires a real per-collection Manage grant and never treats a Custom member's access_all as one. A flagless Custom member placed in an access_all group could therefore rewrite collection user/group assignments in bulk while the single-collection edit endpoint denied the exact same change. Add auth::can_edit_collection - the collection_edit_access + can_manage_collection pair the ManagerHeaders guard already uses - and call it per collection in the bulk-access endpoint. Legacy Managers, Admins/Owners and Edit-any-collection members are unaffected; only a Custom member's access_all shortcut is removed, so bulk-access now enforces exactly what the single-collection edit endpoint does. --- src/api/core/organizations.rs | 18 ++++++++++-------- src/auth.rs | 18 ++++++++++++++++++ 2 files changed, 28 insertions(+), 8 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 93b6fa4b..718bf21a 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -629,13 +629,15 @@ async fn post_bulk_access_collections( err!("Can't find organization details") } - // Security: authorization is enforced per collection below via `is_manageable_by_user`, which - // requires a real manage grant on each requested collection (direct users_collections.manage, - // a manage group, membership/group access_all, or Admin/Owner). This matches the single - // collection edit endpoint and the pre-existing behavior of this endpoint. A custom user with - // only manage_users / manage_groups / manage_policies holds no such grant and is therefore - // rejected, while a Manager/Custom member who manages some collections keeps the ability to - // bulk-edit exactly those (a blanket full-access requirement would wrongly deny that here). + // Security (F-1): authorization is enforced per collection below via `auth::can_edit_collection`, + // the exact same Custom-aware check the single-collection edit endpoint (`ManagerHeaders`) uses. + // Edit any collection (or Admin/Owner) may bulk-edit every collection; a legacy Manager keeps its + // broad per-collection helper; any other Custom member must hold a real per-collection Manage + // grant. In particular a Custom member's membership/group `access_all` does NOT satisfy this here + // (it did under the previous `is_manageable_by_user` check, which diverged from the single-edit + // endpoint). A custom user with only manage_users / manage_groups / manage_policies holds no such + // grant and is rejected, while a member who manages some collections keeps the ability to + // bulk-edit exactly those. // Security (audit H-3) and atomicity (audit M-2): validate the whole request against this // organization *before* mutating anything. Every collection must exist in the org and be @@ -659,7 +661,7 @@ async fn post_bulk_access_collections( err!("Collection not found") }; - if !collection.is_manageable_by_user(&headers.membership.user_uuid, &conn).await { + if !crate::auth::can_edit_collection(&headers.membership, &collection.uuid, &conn).await { err!("Collection not found", "The current user isn't a manager for this collection") } diff --git a/src/auth.rs b/src/auth.rs index 786f864c..4716b6e2 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -1016,6 +1016,24 @@ async fn can_manage_collection( } } +/// Whether `membership` may edit (rewrite the access of) `collection_uuid`, using exactly the same +/// Custom-aware rules as the path-based `ManagerHeaders` guard (`collection_edit_access`): Edit any +/// collection (or Admin/Owner) may edit every collection, otherwise only collections on which the +/// member holds a real per-collection Manage grant. In particular, a Custom member's membership or +/// group `access_all` does NOT satisfy this — it must be an explicit `users_collections.manage` / +/// `collections_groups.manage` assignment, exactly as an in-path collection edit would require. +/// +/// Body-param endpoints (e.g. bulk collection access) take collection ids in the request body and +/// therefore cannot use `ManagerHeaders`; they must run this per collection to stay consistent with +/// the single-collection edit endpoint. +pub(crate) async fn can_edit_collection( + membership: &Membership, + collection_uuid: &CollectionId, + conn: &DbConn, +) -> bool { + can_manage_collection(collection_edit_access(membership), membership, collection_uuid, conn).await +} + /// ManagerHeaders authorizes collection updates. A Custom member with Edit any collection can /// update every collection; otherwise the caller must be at least a legacy Manager and have the /// per-collection Manage permission. Read and delete use separate guards so Edit cannot From 22439225175a8d0a188d091a0bacec25b3755665 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:27:39 +0200 Subject: [PATCH 24/42] Quote reserved `groups` identifier in MySQL collection-permissions migration `groups` is a reserved keyword in MySQL 8, so the unquoted `INNER JOIN groups` in the second UPDATE of the MySQL variant of 2026-07-16-120000_add_custom_collection_permissions/up.sql fails with ERROR 1064 (syntax error), aborting the migration and preventing the server from starting on MySQL/MariaDB. Backtick the table references, matching the existing 2022-07-27-110000_add_group_support migration. PostgreSQL and SQLite do not reserve the word and are unchanged. --- .../up.sql | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql index da66070a..d247d1e9 100644 --- a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql +++ b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -20,8 +20,10 @@ WHERE atype = 4 AND EXISTS ( SELECT 1 FROM groups_users - INNER JOIN groups ON groups.uuid = groups_users.groups_uuid + -- `groups` is a reserved word in MySQL 8 and must be quoted, matching the existing + -- `2022-07-27-110000_add_group_support` migration. (PostgreSQL/SQLite do not reserve it.) + INNER JOIN `groups` ON `groups`.uuid = groups_users.groups_uuid WHERE groups_users.users_organizations_uuid = users_organizations.uuid - AND groups.organizations_uuid = users_organizations.org_uuid - AND groups.access_all = TRUE + AND `groups`.organizations_uuid = users_organizations.org_uuid + AND `groups`.access_all = TRUE ); From e467062c945be39f88b657c7db44f770a53489fe Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 23 Jul 2026 18:37:03 +0200 Subject: [PATCH 25/42] Fix privilege escalation: collection manage grants bypassed delete gate A per-collection `manage` row carries collection delete authority via `has_explicit_collection_manage_access` -> `CollectionDeleteHeaders`, so only a caller who could delete the collection may confer it. Two write paths still passed the client-supplied `manage` bit through unguarded: - `send_invite` gated the initial collection assignments only on `has_full_access()`, which `edit_any_collection` alone satisfies, so a Custom member with manage-users and edit-any-collection could plant a manage row on any collection for an account they control. - `post_organization_collections` wrote `group.manage` / `user.manage` directly. With the create guard narrowed to `can_create_new_collections()`, a create-only Custom member could grant manage on the new collection to itself, another member, or a group. Both now AND the requested bit with `caller_may_grant_collection_manage`, the same gate `post_bulk_access_collections`, `post_organization_collection_update`, `edit_member` and `add_update_group` already use. In the create handler the gate is evaluated once, before both assignment loops, so no grant can bootstrap the next. The check is strictly subtractive: Admin/Owner, Custom-with-delete-any-collection and the access_all Manager are unaffected. --- src/api/core/organizations.rs | 38 ++++++++++++++++++++++++++++++----- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 718bf21a..edc88881 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -576,10 +576,27 @@ async fn post_organization_collections( ) .await; + // Security (F-3): a `manage` grant carries collection *delete*/administer authority + // (`has_explicit_collection_manage_access` -> CollectionDeleteHeaders/ManagerHeaders), so only a + // caller who could delete this collection may confer it — the same rule the collection-update and + // bulk-access endpoints apply. Create is deliberately independent from Edit/Delete, so a Custom + // member holding only `create_new_collections` must not be able to hand a manage row to another + // member or to a group (nor to itself) while creating the collection. For such callers the + // requested `manage` is forced to false; Admin/Owner, Custom-with-`delete_any_collection` and the + // legacy access_all Manager keep it. Evaluated after the collection exists so the per-collection + // lookup sees it. + let may_grant_manage = caller_may_grant_collection_manage(&headers.membership, &collection.uuid, &conn).await; + for group in data.groups { - CollectionGroup::new(collection.uuid.clone(), group.id, group.read_only, group.hide_passwords, group.manage) - .save(&org_id, &conn) - .await?; + CollectionGroup::new( + collection.uuid.clone(), + group.id, + group.read_only, + group.hide_passwords, + group.manage && may_grant_manage, + ) + .save(&org_id, &conn) + .await?; } for user in data.users { @@ -596,7 +613,7 @@ async fn post_organization_collections( &collection.uuid, user.read_only, user.hide_passwords, - user.manage, + user.manage && may_grant_manage, &conn, ) .await?; @@ -1371,16 +1388,27 @@ async fn send_invite( // If no accessAll, add the collections received if !access_all && caller_can_manage_collections { + // Security (F-1): a per-collection `manage` grant carries delete authority, so the + // caller may only confer it on collections they could delete themselves. Otherwise a + // caller acting via Edit-any-collection could invite an account they control with a + // `manage` row and reach Delete-any-collection through it. + let caller = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await; + for col in data.collections.iter().flatten() { match Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await { None => err!("Collection not found in Organization"), Some(collection) => { + let manage = col.manage + && match &caller { + Some(c) => caller_may_grant_collection_manage(c, &collection.uuid, &conn).await, + None => false, + }; CollectionUser::save( &user.uuid, &collection.uuid, col.read_only, col.hide_passwords, - col.manage, + manage, &conn, ) .await?; From 5558b418015c16895fe7f272263602087228b22f Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 23 Jul 2026 22:15:32 +0200 Subject: [PATCH 26/42] Remove membership access_all flag and fold Manager role into Custom The per-membership `access_all` flag was Vaultwarden's pre-permissions patch for "this member reaches every collection". It is now fully represented by the role model: Owners/Admins hold it implicitly, and a Custom member holds it via `edit_any_collection`. Every authorization query that read `users_organizations.access_all` now reads `edit_any_collection = true OR atype <= Admin` instead, which is exactly the set the flag ever identified, so admin/owner and edit-any access is preserved. The column is dropped via a new migration (down-migration restores it from the role/permission model). `groups.access_all` is a separate, still-supported group feature and is untouched. The legacy Manager role (wire value 3) is folded into Custom: the `MembershipType::Manager` variant is removed, all `>= Manager` rank checks become `>= Custom` (identical authorization rank), the `LegacyManager` collection-access path collapses into the Custom rules, and an incoming wire `type=3` is mapped onto Custom for backward compatibility. Custom stays `type=4` because that is the only role modern Bitwarden clients render with custom permissions. Existing type-3 members were already converted to Custom by the earlier migration. Server-only change; verified against the unmodified web-vault. Unit tests, clippy and rustfmt pass; migration up/down verified against SQLite. --- .../down.sql | 6 + .../up.sql | 5 + .../down.sql | 6 + .../up.sql | 5 + .../down.sql | 6 + .../up.sql | 5 + src/api/admin.rs | 89 ++++------- src/api/core/organizations.rs | 147 ++++++++---------- src/api/core/public.rs | 1 - src/auth.rs | 46 ++---- src/db/models/cipher.rs | 36 +++-- src/db/models/collection.rs | 58 ++++--- src/db/models/organization.rs | 118 +++++++------- src/db/schema.rs | 1 - 14 files changed, 260 insertions(+), 269 deletions(-) create mode 100644 migrations/mysql/2026-07-24-120000_drop_membership_access_all/down.sql create mode 100644 migrations/mysql/2026-07-24-120000_drop_membership_access_all/up.sql create mode 100644 migrations/postgresql/2026-07-24-120000_drop_membership_access_all/down.sql create mode 100644 migrations/postgresql/2026-07-24-120000_drop_membership_access_all/up.sql create mode 100644 migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql create mode 100644 migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql diff --git a/migrations/mysql/2026-07-24-120000_drop_membership_access_all/down.sql b/migrations/mysql/2026-07-24-120000_drop_membership_access_all/down.sql new file mode 100644 index 00000000..01295bf5 --- /dev/null +++ b/migrations/mysql/2026-07-24-120000_drop_membership_access_all/down.sql @@ -0,0 +1,6 @@ +-- Recreate the column and repopulate it from the role/permission model that replaced it, restoring +-- the invariant older server versions rely on: access_all == access to every collection. That is +-- exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; +UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); +UPDATE users_organizations SET access_all = TRUE WHERE atype = 4 AND edit_any_collection = TRUE; diff --git a/migrations/mysql/2026-07-24-120000_drop_membership_access_all/up.sql b/migrations/mysql/2026-07-24-120000_drop_membership_access_all/up.sql new file mode 100644 index 00000000..e11fb611 --- /dev/null +++ b/migrations/mysql/2026-07-24-120000_drop_membership_access_all/up.sql @@ -0,0 +1,5 @@ +-- The membership `access_all` flag was Vaultwarden's pre-permissions patch for "this member can +-- reach every collection". It is now fully represented by the role model: Owners/Admins hold it +-- implicitly, and a Custom member holds it via `edit_any_collection`. Drop the redundant column. +-- This only concerns users_organizations; groups.access_all is a separate, still-supported feature. +ALTER TABLE users_organizations DROP COLUMN access_all; diff --git a/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/down.sql b/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/down.sql new file mode 100644 index 00000000..01295bf5 --- /dev/null +++ b/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/down.sql @@ -0,0 +1,6 @@ +-- Recreate the column and repopulate it from the role/permission model that replaced it, restoring +-- the invariant older server versions rely on: access_all == access to every collection. That is +-- exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; +UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); +UPDATE users_organizations SET access_all = TRUE WHERE atype = 4 AND edit_any_collection = TRUE; diff --git a/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/up.sql b/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/up.sql new file mode 100644 index 00000000..e11fb611 --- /dev/null +++ b/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/up.sql @@ -0,0 +1,5 @@ +-- The membership `access_all` flag was Vaultwarden's pre-permissions patch for "this member can +-- reach every collection". It is now fully represented by the role model: Owners/Admins hold it +-- implicitly, and a Custom member holds it via `edit_any_collection`. Drop the redundant column. +-- This only concerns users_organizations; groups.access_all is a separate, still-supported feature. +ALTER TABLE users_organizations DROP COLUMN access_all; diff --git a/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql b/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql new file mode 100644 index 00000000..01295bf5 --- /dev/null +++ b/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql @@ -0,0 +1,6 @@ +-- Recreate the column and repopulate it from the role/permission model that replaced it, restoring +-- the invariant older server versions rely on: access_all == access to every collection. That is +-- exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; +UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); +UPDATE users_organizations SET access_all = TRUE WHERE atype = 4 AND edit_any_collection = TRUE; diff --git a/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql b/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql new file mode 100644 index 00000000..e11fb611 --- /dev/null +++ b/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql @@ -0,0 +1,5 @@ +-- The membership `access_all` flag was Vaultwarden's pre-permissions patch for "this member can +-- reach every collection". It is now fully represented by the role model: Owners/Admins hold it +-- implicitly, and a Custom member holds it via `edit_any_collection`. Drop the redundant column. +-- This only concerns users_organizations; groups.access_all is a separate, still-supported feature. +ALTER TABLE users_organizations DROP COLUMN access_all; diff --git a/src/api/admin.rs b/src/api/admin.rs index 8c60e0c7..b03946af 100644 --- a/src/api/admin.rs +++ b/src/api/admin.rs @@ -545,35 +545,13 @@ struct MembershipTypeData { } fn apply_membership_type_change(membership: &mut Membership, new_type: MembershipType) { - let was_custom = membership.atype == MembershipType::Custom; - - // Leaving Custom for the legacy Manager role: `access_all` is the internal mirror of - // Edit any collection, but a Manager's `access_all` means the broad "manage all collections" - // grant (Create + Edit + Delete). Carrying an Edit-only mirror over would silently escalate the - // member to Create/Edit/Delete. Only preserve `access_all` when the member actually held the - // full manage-all grant, mirroring the collection-permissions down-migration. Must be evaluated - // before the flags are cleared below (and while the type is still Custom). - if was_custom && new_type == MembershipType::Manager { - membership.access_all = membership.has_manage_all_collections(); - } - - // Entering Custom through the Vaultwarden admin panel is deliberately fail-closed because - // that UI cannot select granular permissions; they can be granted later through the regular - // organization member dialog. - if new_type == MembershipType::Custom && !was_custom { + // Entering Custom through the Vaultwarden admin panel is deliberately fail-closed because that + // UI cannot select granular permissions; they can be granted later through the regular + // organization member dialog. Any non-Custom role carries no custom flags at all. Only a member + // that is already Custom and stays Custom keeps its existing flags. + let stays_custom = new_type == MembershipType::Custom && membership.atype == MembershipType::Custom; + if !stays_custom { membership.clear_custom_permissions(); - membership.access_all = false; - } - if new_type != MembershipType::Custom { - membership.clear_custom_permissions(); - } - - // Prevent stale access_all from surviving a demotion to User. Admins/Owners have implicit - // full access, while legacy Manager access_all is intentionally preserved for compatibility. - match new_type { - MembershipType::Owner | MembershipType::Admin => membership.access_all = true, - MembershipType::User => membership.access_all = false, - MembershipType::Manager | MembershipType::Custom => {} } membership.atype = new_type as i32; @@ -936,9 +914,8 @@ mod tests { } #[test] - fn admin_type_changes_clear_custom_permissions_and_stale_access() { + fn admin_type_changes_clear_custom_permissions() { let mut custom = membership(MembershipType::Custom); - custom.access_all = true; custom.manage_users = true; custom.create_new_collections = true; custom.edit_any_collection = true; @@ -946,50 +923,36 @@ mod tests { apply_membership_type_change(&mut custom, MembershipType::User); assert_eq!(custom.atype, MembershipType::User as i32); - assert!(!custom.access_all); assert!(!custom.manage_users); assert!(!custom.create_new_collections); assert!(!custom.edit_any_collection); assert!(!custom.delete_any_collection); + // Entering Custom through the admin panel is fail-closed: no granular permissions are set. let mut admin = membership(MembershipType::Admin); - admin.access_all = true; apply_membership_type_change(&mut admin, MembershipType::Custom); assert_eq!(admin.atype, MembershipType::Custom as i32); - assert!(!admin.access_all, "entering Custom through this UI must be fail-closed"); assert!(!admin.has_manage_all_collections()); + assert!(!admin.edit_any_collection); } #[test] - fn admin_and_legacy_manager_access_all_behavior_is_preserved() { - let mut user = membership(MembershipType::User); - apply_membership_type_change(&mut user, MembershipType::Admin); - assert!(user.access_all); - - // REGRESSION (privilege escalation, PR #7397 / finding F2): a Custom member whose - // `access_all` is only the Edit-any-collection mirror must NOT be turned into a legacy - // Manager with the broad "manage all collections" `access_all` grant. That would escalate - // an Edit-only member into Create + Edit + Delete. Mirrors the collection down-migration. - let mut edit_only = membership(MembershipType::Custom); - edit_only.access_all = true; - edit_only.edit_any_collection = true; - apply_membership_type_change(&mut edit_only, MembershipType::Manager); - assert_eq!(edit_only.atype, MembershipType::Manager as i32); - assert!(!edit_only.access_all, "Edit-only Custom must not become an access_all Manager"); - assert!(!edit_only.edit_any_collection); - - // A Custom member who genuinely held the full manage-all grant (all three collection - // flags) keeps the equivalent legacy Manager `access_all`. - let mut manage_all = membership(MembershipType::Custom); - manage_all.access_all = true; - manage_all.create_new_collections = true; - manage_all.edit_any_collection = true; - manage_all.delete_any_collection = true; - apply_membership_type_change(&mut manage_all, MembershipType::Manager); - assert_eq!(manage_all.atype, MembershipType::Manager as i32); - assert!(manage_all.access_all, "full manage-all Custom keeps legacy Manager access_all"); - assert!(!manage_all.create_new_collections); - assert!(!manage_all.edit_any_collection); - assert!(!manage_all.delete_any_collection); + fn admin_custom_to_custom_keeps_flags_but_other_transitions_clear() { + // A member kept as Custom retains its granular flags: the admin panel does not touch them; + // they are managed through the regular organization member dialog. + let mut custom = membership(MembershipType::Custom); + custom.manage_users = true; + custom.edit_any_collection = true; + apply_membership_type_change(&mut custom, MembershipType::Custom); + assert_eq!(custom.atype, MembershipType::Custom as i32); + assert!(custom.manage_users); + assert!(custom.edit_any_collection); + + // Promoting to Admin/Owner drops any stale custom flags. + let mut promo = membership(MembershipType::Custom); + promo.edit_any_collection = true; + apply_membership_type_change(&mut promo, MembershipType::Admin); + assert_eq!(promo.atype, MembershipType::Admin as i32); + assert!(!promo.edit_any_collection); } } diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index edc88881..b5309f9d 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -219,7 +219,6 @@ async fn create_organization(headers: Headers, data: Json, conn: DbConn let collection = Collection::new(org.uuid.clone(), data.collection_name, None); member.akey = data.key; - member.access_all = true; member.atype = MembershipType::Owner as i32; member.status = MembershipStatus::Confirmed as i32; @@ -539,8 +538,8 @@ async fn post_organization_collections( err!("Organization not found", "Organization id's do not match"); } - // Create is independent from Edit/Delete. In particular, Edit any collection's internal - // access_all representation must not implicitly grant this endpoint. + // Create is independent from Edit/Delete. In particular, Edit any collection (full access to + // every collection) must not implicitly grant this endpoint. if !headers.membership.can_create_new_collections() { err!("You don't have permission to create collections") } @@ -582,9 +581,8 @@ async fn post_organization_collections( // bulk-access endpoints apply. Create is deliberately independent from Edit/Delete, so a Custom // member holding only `create_new_collections` must not be able to hand a manage row to another // member or to a group (nor to itself) while creating the collection. For such callers the - // requested `manage` is forced to false; Admin/Owner, Custom-with-`delete_any_collection` and the - // legacy access_all Manager keep it. Evaluated after the collection exists so the per-collection - // lookup sees it. + // requested `manage` is forced to false; Admin/Owner and Custom-with-`delete_any_collection` + // keep it. Evaluated after the collection exists so the per-collection lookup sees it. let may_grant_manage = caller_may_grant_collection_manage(&headers.membership, &collection.uuid, &conn).await; for group in data.groups { @@ -604,7 +602,7 @@ async fn post_organization_collections( err!("User is not part of organization") }; - if member.access_all { + if member.grants_access_to_all_collections() { continue; } @@ -648,13 +646,12 @@ async fn post_bulk_access_collections( // Security (F-1): authorization is enforced per collection below via `auth::can_edit_collection`, // the exact same Custom-aware check the single-collection edit endpoint (`ManagerHeaders`) uses. - // Edit any collection (or Admin/Owner) may bulk-edit every collection; a legacy Manager keeps its - // broad per-collection helper; any other Custom member must hold a real per-collection Manage - // grant. In particular a Custom member's membership/group `access_all` does NOT satisfy this here - // (it did under the previous `is_manageable_by_user` check, which diverged from the single-edit - // endpoint). A custom user with only manage_users / manage_groups / manage_policies holds no such - // grant and is rejected, while a member who manages some collections keeps the ability to - // bulk-edit exactly those. + // Edit any collection (or Admin/Owner) may bulk-edit every collection; any other Custom member + // must hold a real per-collection Manage grant. In particular a Custom member's group + // `access_all` does NOT satisfy this here (it did under the previous `is_manageable_by_user` + // check, which diverged from the single-edit endpoint). A custom user with only manage_users / + // manage_groups / manage_policies holds no such grant and is rejected, while a member who manages + // some collections keeps the ability to bulk-edit exactly those. // Security (audit H-3) and atomicity (audit M-2): validate the whole request against this // organization *before* mutating anything. Every collection must exist in the org and be @@ -726,7 +723,7 @@ async fn post_bulk_access_collections( err!("User is not part of organization") }; - if member.access_all { + if member.grants_access_to_all_collections() { continue; } @@ -826,7 +823,7 @@ async fn post_organization_collection_update( err!("User is not part of organization") }; - if member.access_all { + if member.grants_access_to_all_collections() { continue; } @@ -1211,10 +1208,11 @@ impl CustomRolePermissions { } } - /// Bitwarden grants a Custom member with Edit any collection full read/edit/manage access to - /// organization ciphers. Vaultwarden's existing access_all flag is the internal data-plane - /// representation of that capability. Create and Delete remain completely independent. - fn access_all_for(self, member_type: MembershipType) -> bool { + /// Whether the requested role/permissions give this member access to *every* collection in the + /// org: Admins/Owners implicitly, and a Custom member holding Edit any collection. Such members + /// do not need (and must not be given) individual per-collection assignments. Create and Delete + /// remain completely independent of this. + fn grants_full_collection_access(self, member_type: MembershipType) -> bool { member_type >= MembershipType::Admin || (member_type == MembershipType::Custom && self.edit_any_collection) } @@ -1285,13 +1283,14 @@ async fn send_invite( }; if new_type != MembershipType::User && headers.membership_type != MembershipType::Owner { - err!("Only Owners can invite Managers, Admins or Owners") + err!("Only Owners can invite Admins, Owners or Custom members") } - // manageAllCollections is a client-only aggregate. Persist its three children independently; - // only Edit any collection maps to the existing all-cipher access representation. + // manageAllCollections is a client-only aggregate. Persist its three children independently. + // Whether the member reaches every collection (Admin/Owner, or Custom + Edit any collection) + // decides whether we skip creating individual per-collection assignments below. let custom_permissions = CustomRolePermissions::from_request(new_type, &data.permissions); - let access_all = custom_permissions.access_all_for(new_type); + let grants_full_access = custom_permissions.grants_full_collection_access(new_type); let mut user_created: bool = false; for email in &data.emails { @@ -1333,7 +1332,6 @@ async fn send_invite( }; let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(headers.user.email.clone())); - new_member.access_all = access_all; new_member.atype = new_type as i32; custom_permissions.apply_to(&mut new_member); new_member.status = member_status; @@ -1386,8 +1384,8 @@ async fn send_invite( None => false, }; - // If no accessAll, add the collections received - if !access_all && caller_can_manage_collections { + // If the member does not already reach every collection, add the collections received + if !grants_full_access && caller_can_manage_collections { // Security (F-1): a per-collection `manage` grant carries delete authority, so the // caller may only confer it on collections they could delete themselves. Otherwise a // caller acting via Edit-any-collection could invite an account they control with a @@ -1688,7 +1686,7 @@ async fn confirm_invite_impl( }; if member_to_confirm.atype != MembershipType::User && headers.membership_type != MembershipType::Owner { - err!("Only Owners can confirm Managers, Admins or Owners") + err!("Only Owners can confirm Admins, Owners or Custom members") } if member_to_confirm.status != MembershipStatus::Accepted as i32 { @@ -1813,7 +1811,7 @@ async fn edit_member( }; let custom_permissions = CustomRolePermissions::from_request(new_type, &data.permissions); - let access_all = custom_permissions.access_all_for(new_type); + let grants_full_access = custom_permissions.grants_full_collection_access(new_type); let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else { err!("The specified user isn't member of the organization") @@ -1827,13 +1825,13 @@ async fn edit_member( } // Security: only Admins and Owners may change a member's role type at all. A Custom member - // with manage_users must not change roles: raising a member to Manager/Custom grants - // collection-"manage" on every collection they can already write (see the `atype >= Manager` - // branch in `Collection`/`Membership` json), and lowering it revokes that access — both are - // collection-access changes this caller is not entitled to make, even though the custom - // permission flags and access_all are already gated below. Requests that leave the role - // unchanged are allowed, so such members can still use the regular edit dialog. The - // Admin/Owner guard above still governs Admin/Owner transitions for Owners. + // with manage_users must not change roles: raising a member to Custom grants collection-"manage" + // on every collection they can already write (see the `atype >= Custom` branch in + // `Collection`/`Membership` json), and lowering it revokes that access — both are collection- + // access changes this caller is not entitled to make, even though the custom permission flags + // are already gated below. Requests that leave the role unchanged are allowed, so such members + // can still use the regular edit dialog. The Admin/Owner guard above still governs Admin/Owner + // transitions for Owners. if !may_change_member_type(headers.membership_type, member_to_edit.atype, new_type) { err!("Only Admins or Owners can change a member's role") } @@ -1871,14 +1869,10 @@ async fn edit_member( None => false, }; - // Security: `access_all` grants full access to every collection, so only callers who may - // manage collections are allowed to change it. Otherwise a custom user with only manage_users - // could enable Edit any collection on any member (including themselves) to grant full - // collection access — a privilege escalation. For everyone else we keep the member's existing - // access_all grant untouched (neither granted nor revoked). - if caller_can_manage_collections { - member_to_edit.access_all = access_all; - } + // Edit any collection (the successor of the removed access_all flag) grants full access to + // every collection. It is part of the granular custom permissions applied here, and the + // differs_from guard above already prevents a non-Admin caller from changing it — so a Custom + // member with only manage_users can never grant themselves or others full collection access. custom_permissions.apply_to(&mut member_to_edit); member_to_edit.atype = new_type as i32; @@ -1897,8 +1891,8 @@ async fn edit_member( // Edit-any-collection thus cannot hand another member a manage/delete grant it lacks. let caller = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await; - // If no accessAll, add the collections received - if !access_all { + // If the member does not already reach every collection, add the collections received + if !grants_full_access { for col in data.collections.iter().flatten() { match Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await { None => err!("Collection not found in Organization"), @@ -2209,7 +2203,7 @@ async fn post_org_import( } else { // Collection creation through an organization import is governed by the same // independent permission as the regular create endpoint. In particular, - // Edit any collection's access_all mirror must not satisfy this check. + // Edit any collection (full access to every collection) must not satisfy this check. if !headers.membership.can_create_new_collections() { err!(Compact, "The current user isn't allowed to create new collections") } @@ -3142,31 +3136,25 @@ async fn group_confers_collection_access(group_id: &GroupId, org_id: &Organizati /// /// Security (F-1, edit-any -> delete-any escalation): a `manage` grant carries collection *delete* /// authority — `CollectionDeleteHeaders` accepts it via `has_explicit_collection_manage_access`. -/// Without this gate a Custom member holding only `edit_any_collection` (whose `access_all` mirror -/// makes every collection "manageable") could, through the collection-access / group endpoints, -/// hand a `manage` row to a group they belong to (or to a manager-level member) and thereby gain -/// deletion — a capability `edit_any_collection` must never imply. +/// Without this gate a Custom member holding only `edit_any_collection` (which grants full access to +/// every collection) could, through the collection-access / group endpoints, hand a `manage` row to +/// a group they belong to (or to a manager-level member) and thereby gain deletion — a capability +/// `edit_any_collection` must never imply. /// /// We therefore allow granting `manage` on a collection only to a caller who could delete that same /// collection themselves, mirroring `collection_delete_access` exactly so it can never hand out a -/// right the caller lacks: Admin/Owner and Custom-with-`delete_any_collection` always qualify; an -/// exact legacy Manager uses its per-collection manage helper; any other Custom member must hold a -/// real explicit manage grant. This is strictly subtractive — it can only ever downgrade a requested -/// `manage` to `false`, never grant it — so it opens no new access, and delete-capable members -/// (including all Admins/Owners) are unaffected. +/// right the caller lacks: Admin/Owner and Custom-with-`delete_any_collection` always qualify; any +/// other Custom member must hold a real explicit manage grant. This is strictly subtractive — it can +/// only ever downgrade a requested `manage` to `false`, never grant it — so it opens no new access, +/// and delete-capable members (including all Admins/Owners) are unaffected. async fn caller_may_grant_collection_manage(caller: &Membership, col_id: &CollectionId, conn: &DbConn) -> bool { match caller_manage_grant_role_check(caller) { // Role alone decides it (Admin/Owner or delete_any -> yes; User/unknown/unconfirmed -> no). Some(decision) => decision, - // Manager/Custom: the answer is per-collection and must reflect a *real* manage grant. + // Custom without delete_any: the answer is per-collection and must reflect a *real* manage + // grant. A Custom member must prove a real users_collections.manage / + // collections_groups.manage grant; Edit any collection deliberately does not count here. None => match MembershipType::from_i32(caller.atype) { - // The exact legacy Manager keeps its broad per-collection manage helper (which also - // honors membership/group access_all), matching its pre-existing delete authorization. - Some(MembershipType::Manager) => { - Collection::is_coll_manageable_by_user(col_id, &caller.user_uuid, conn).await - } - // A Custom member must prove a real users_collections.manage / collections_groups.manage - // grant; edit_any_collection's access_all mirror deliberately does not count here. Some(MembershipType::Custom) => caller.has_explicit_collection_manage_access(col_id, conn).await, _ => false, }, @@ -3190,7 +3178,7 @@ fn caller_manage_grant_role_check(caller: &Membership) -> Option { return Some(false); } match MembershipType::from_i32(caller.atype) { - Some(MembershipType::Manager | MembershipType::Custom) => None, + Some(MembershipType::Custom) => None, _ => Some(false), } } @@ -3910,12 +3898,11 @@ mod tests { // manufacturing. This is what stops edit-any from escalating into delete-any. let mut edit_any = confirmed_member(MembershipType::Custom); edit_any.edit_any_collection = true; - edit_any.access_all = true; // the internal mirror of edit_any must not shortcut to yes assert_eq!(caller_manage_grant_role_check(&edit_any), None); - // A flagless Custom / exact Manager also defer to the per-collection DB check. + // A flagless Custom member (this is what a migrated legacy Manager becomes) also defers to + // the per-collection DB check. assert_eq!(caller_manage_grant_role_check(&confirmed_member(MembershipType::Custom)), None); - assert_eq!(caller_manage_grant_role_check(&confirmed_member(MembershipType::Manager)), None); // Plain User never qualifies. assert_eq!(caller_manage_grant_role_check(&confirmed_member(MembershipType::User)), Some(false)); @@ -3952,27 +3939,23 @@ mod tests { #[test] fn manage_users_caller_cannot_change_member_role() { let user = MembershipType::User as i32; - let manager = MembershipType::Manager as i32; let custom = MembershipType::Custom as i32; // Admins and Owners may change a member's role. - assert!(may_change_member_type(MembershipType::Owner, user, MembershipType::Manager)); + assert!(may_change_member_type(MembershipType::Owner, user, MembershipType::Custom)); assert!(may_change_member_type(MembershipType::Admin, user, MembershipType::Custom)); - // A below-Admin caller (Manager / Custom-with-manage_users) may only submit an unchanged - // role, so the regular edit dialog keeps working. + // A below-Admin caller (Custom-with-manage_users) may only submit an unchanged role, so the + // regular edit dialog keeps working. assert!(may_change_member_type(MembershipType::Custom, user, MembershipType::User)); assert!(may_change_member_type(MembershipType::Custom, custom, MembershipType::Custom)); - assert!(may_change_member_type(MembershipType::Manager, manager, MembershipType::Manager)); // REGRESSION (privilege escalation, PR #7397 / finding F1): a caller below Admin must NOT - // be able to change a member's role. Promoting User -> Manager/Custom grants that member - // collection-"manage" on their writable collections (atype >= Manager), and demoting + // be able to change a member's role. Promoting User -> Custom grants that member + // collection-"manage" on their writable collections (atype >= Custom), and demoting // revokes it — collection-access changes a manage_users caller is not entitled to make. - assert!(!may_change_member_type(MembershipType::Custom, user, MembershipType::Manager)); assert!(!may_change_member_type(MembershipType::Custom, user, MembershipType::Custom)); - assert!(!may_change_member_type(MembershipType::Custom, manager, MembershipType::User)); - assert!(!may_change_member_type(MembershipType::Manager, custom, MembershipType::User)); + assert!(!may_change_member_type(MembershipType::Custom, custom, MembershipType::User)); } #[test] @@ -4009,8 +3992,8 @@ mod tests { assert_eq!(parsed.create_new_collections, create, "mask={mask:03b}"); assert_eq!(parsed.edit_any_collection, edit, "mask={mask:03b}"); assert_eq!(parsed.delete_any_collection, delete, "mask={mask:03b}"); - // Only Edit any collection maps to all-cipher access. Create/Delete must never do so. - assert_eq!(parsed.access_all_for(MembershipType::Custom), edit, "mask={mask:03b}"); + // Only Edit any collection maps to all-collection access. Create/Delete must never do so. + assert_eq!(parsed.grants_full_collection_access(MembershipType::Custom), edit, "mask={mask:03b}"); } } @@ -4035,11 +4018,11 @@ mod tests { let user = CustomRolePermissions::from_request(MembershipType::User, &permissions); assert_eq!(user, CustomRolePermissions::default()); - assert!(!user.access_all_for(MembershipType::User)); + assert!(!user.grants_full_collection_access(MembershipType::User)); let admin = CustomRolePermissions::from_request(MembershipType::Admin, &permissions); assert_eq!(admin, CustomRolePermissions::default()); - assert!(admin.access_all_for(MembershipType::Admin)); + assert!(admin.grants_full_collection_access(MembershipType::Admin)); } #[test] diff --git a/src/api/core/public.rs b/src/api/core/public.rs index 33189e78..f58cd6da 100644 --- a/src/api/core/public.rs +++ b/src/api/core/public.rs @@ -118,7 +118,6 @@ async fn ldap_import(data: Json, token: PublicToken, conn: DbConn let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(org_email.clone())); new_member.set_external_id(Some(user_data.external_id.clone())); - new_member.access_all = false; new_member.atype = MembershipType::User as i32; new_member.status = member_status; diff --git a/src/auth.rs b/src/auth.rs index 4716b6e2..05cdbd78 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -724,8 +724,10 @@ impl OrgHeaders { fn is_confirmed_and_admin(&self) -> bool { self.membership_status == MembershipStatus::Confirmed && self.membership_type >= MembershipType::Admin } + // "Manager-level or above": a confirmed Custom, Admin or Owner member. (The legacy Manager role + // has been folded into Custom, which shares the same authorization rank.) fn is_confirmed_and_manager(&self) -> bool { - self.membership_status == MembershipStatus::Confirmed && self.membership_type >= MembershipType::Manager + self.membership_status == MembershipStatus::Confirmed && self.membership_type >= MembershipType::Custom } fn is_confirmed_and_owner(&self) -> bool { self.membership_status == MembershipStatus::Confirmed && self.membership_type == MembershipType::Owner @@ -960,7 +962,6 @@ fn get_col_id(request: &Request<'_>) -> Option { #[derive(Clone, Copy, Debug, Eq, PartialEq)] enum CollectionManageAccess { Any, - LegacyManager, ExplicitManage, Denied, } @@ -972,9 +973,6 @@ fn collection_access_by_role(membership: &Membership, custom_has_any_access: boo match MembershipType::from_i32(membership.atype) { Some(MembershipType::Owner | MembershipType::Admin) => CollectionManageAccess::Any, - // Keep the pre-Custom role's broad behavior isolated to an exact legacy Manager. Its - // existing helper intentionally accepts membership/group access_all. - Some(MembershipType::Manager) => CollectionManageAccess::LegacyManager, Some(MembershipType::Custom) if custom_has_any_access => CollectionManageAccess::Any, // A Custom member must prove an actual users_collections.manage or // collections_groups.manage assignment. In particular, groups.access_all is not Manage. @@ -1006,9 +1004,6 @@ async fn can_manage_collection( ) -> bool { match access { CollectionManageAccess::Any => true, - CollectionManageAccess::LegacyManager => { - Collection::is_coll_manageable_by_user(collection_uuid, &membership.user_uuid, conn).await - } CollectionManageAccess::ExplicitManage => { membership.has_explicit_collection_manage_access(collection_uuid, conn).await } @@ -1035,7 +1030,7 @@ pub(crate) async fn can_edit_collection( } /// ManagerHeaders authorizes collection updates. A Custom member with Edit any collection can -/// update every collection; otherwise the caller must be at least a legacy Manager and have the +/// update every collection; otherwise the caller must be a Custom member (or above) holding the /// per-collection Manage permission. Read and delete use separate guards so Edit cannot /// accidentally imply Delete. pub struct ManagerHeaders { @@ -1144,8 +1139,8 @@ impl From for Headers { /// limitCollectionDeletion=true, so deleting *any* collection requires the explicit Delete any /// collection permission (or Admin/Owner). Deleting an individual collection is additionally /// allowed for members holding the per-collection Manage grant on it. Custom members use the -/// explicit assignment only; unlike the exact legacy Manager path, membership/group access_all -/// never counts as their per-collection Manage grant. +/// explicit assignment only; a group `access_all` grant never counts as their per-collection Manage +/// grant. pub struct CollectionDeleteHeaders { pub host: String, pub device: Device, @@ -1171,11 +1166,11 @@ impl<'r> FromRequest<'r> for CollectionDeleteHeaders { match collection_delete_access(&headers.membership) { CollectionManageAccess::Any => {} CollectionManageAccess::Denied => { - // Custom is a distinct, fail-closed role. Edit any collection and access_all alone - // must not satisfy a Delete request without either Delete any or explicit Manage. + // Custom is a distinct, fail-closed role. Edit any collection alone must not satisfy + // a Delete request without either Delete any or an explicit per-collection Manage. err_handler!("You need the 'Delete any collection' permission to call this endpoint") } - access @ (CollectionManageAccess::LegacyManager | CollectionManageAccess::ExplicitManage) => { + access @ CollectionManageAccess::ExplicitManage => { let Outcome::Success(conn) = DbConn::from_request(request).await else { err_handler!("Error getting DB") }; @@ -1641,26 +1636,20 @@ mod tests { #[test] fn flagless_custom_requires_explicit_manage_for_edit_read_and_delete() { + // A flagless Custom member (this is what a migrated legacy Manager becomes) must prove a + // real per-collection Manage grant for every collection operation. ExplicitManage invokes + // the database helper that only accepts users_collections.manage / collections_groups.manage + // — an external groups.access_all grant deliberately does not switch to a broad helper. let custom = membership(MembershipType::Custom); assert_eq!(collection_edit_access(&custom), CollectionManageAccess::ExplicitManage); assert_eq!(collection_read_access(&custom), CollectionManageAccess::ExplicitManage); assert_eq!(collection_delete_access(&custom), CollectionManageAccess::ExplicitManage); - - // Neither a stale membership access_all value nor an external groups.access_all grant may - // switch a Custom member to the legacy broad helper. ExplicitManage invokes the database - // helper that only accepts users_collections.manage / collections_groups.manage. - let mut access_all = membership(MembershipType::Custom); - access_all.access_all = true; - assert_eq!(collection_edit_access(&access_all), CollectionManageAccess::ExplicitManage); - assert_eq!(collection_read_access(&access_all), CollectionManageAccess::ExplicitManage); - assert_eq!(collection_delete_access(&access_all), CollectionManageAccess::ExplicitManage); } #[test] fn custom_any_permissions_remain_independent() { let mut edit_any = membership(MembershipType::Custom); edit_any.edit_any_collection = true; - edit_any.access_all = true; assert_eq!(collection_edit_access(&edit_any), CollectionManageAccess::Any); assert_eq!(collection_read_access(&edit_any), CollectionManageAccess::Any); // Edit-any alone is not blanket Delete. It still permits deletion of an explicitly managed @@ -1675,18 +1664,15 @@ mod tests { } #[test] - fn exact_legacy_manager_keeps_broad_helper() { - let manager = membership(MembershipType::Manager); - assert_eq!(collection_edit_access(&manager), CollectionManageAccess::LegacyManager); - assert_eq!(collection_read_access(&manager), CollectionManageAccess::LegacyManager); - assert_eq!(collection_delete_access(&manager), CollectionManageAccess::LegacyManager); - + fn admin_and_user_collection_access_roles() { let admin = membership(MembershipType::Admin); assert_eq!(collection_edit_access(&admin), CollectionManageAccess::Any); + assert_eq!(collection_read_access(&admin), CollectionManageAccess::Any); assert_eq!(collection_delete_access(&admin), CollectionManageAccess::Any); let user = membership(MembershipType::User); assert_eq!(collection_edit_access(&user), CollectionManageAccess::Denied); + assert_eq!(collection_read_access(&user), CollectionManageAccess::Denied); assert_eq!(collection_delete_access(&user), CollectionManageAccess::Denied); } diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs index 69600e5b..77301514 100644 --- a/src/db/models/cipher.rs +++ b/src/db/models/cipher.rs @@ -881,7 +881,12 @@ impl Cipher { .and(collections_groups::groups_uuid.eq(groups::uuid))), ) .filter(ciphers::user_uuid.eq(user_uuid)) // Cipher owner - .or_filter(users_organizations::access_all.eq(true)) // access_all in org + // Edit any collection (Custom) or org admin/owner — the successor of access_all + .or_filter( + users_organizations::edit_any_collection + .eq(true) + .or(users_organizations::atype.le(MembershipType::Admin as i32)), + ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // Access to collection .or_filter(groups::access_all.eq(true)) // Access via groups .or_filter(collections_groups::collections_uuid.is_not_null()) // Access via groups @@ -918,7 +923,12 @@ impl Cipher { .and(users_organizations::user_uuid.eq(users_collections::user_uuid))), ) .filter(ciphers::user_uuid.eq(user_uuid)) // Cipher owner - .or_filter(users_organizations::access_all.eq(true)) // access_all in org + // Edit any collection (Custom) or org admin/owner — the successor of access_all + .or_filter( + users_organizations::edit_any_collection + .eq(true) + .or(users_organizations::atype.le(MembershipType::Admin as i32)), + ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // Access to collection .into_boxed(); @@ -1041,8 +1051,9 @@ impl Cipher { .and(collections_groups::groups_uuid.eq(groups::uuid))), ) .filter( - users_organizations::access_all - .eq(true) // User has access all + users_organizations::edit_any_collection + .eq(true) // Custom "Edit any collection" (successor of access_all) + .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection .and(users_collections::read_only.eq(false))) @@ -1072,8 +1083,9 @@ impl Cipher { .and(users_collections::user_uuid.eq(user_uuid.clone()))), ) .filter( - users_organizations::access_all - .eq(true) // User has access all + users_organizations::edit_any_collection + .eq(true) // Custom "Edit any collection" (successor of access_all) + .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection .and(users_collections::read_only.eq(false))), @@ -1116,8 +1128,9 @@ impl Cipher { .and(collections_groups::groups_uuid.eq(groups::uuid))), ) .filter( - users_organizations::access_all - .eq(true) // User has access all + users_organizations::edit_any_collection + .eq(true) // Custom "Edit any collection" (successor of access_all) + .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection .and(users_collections::read_only.eq(false))) @@ -1148,8 +1161,9 @@ impl Cipher { .and(users_collections::user_uuid.eq(user_uuid.clone()))), ) .filter( - users_organizations::access_all - .eq(true) // User has access all + users_organizations::edit_any_collection + .eq(true) // Custom "Edit any collection" (successor of access_all) + .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection .and(users_collections::read_only.eq(false))) @@ -1194,7 +1208,7 @@ impl Cipher { .and(collections_groups::groups_uuid.eq(groups::uuid))), ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection - .or_filter(users_organizations::access_all.eq(true)) // User has access all + .or_filter(users_organizations::edit_any_collection.eq(true)) // Custom "Edit any collection" (successor of access_all) .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner .or_filter(groups::access_all.eq(true)) //Access via group .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index 51a8d2c2..8145be69 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -98,13 +98,13 @@ impl Collection { ) -> Value { let (read_only, hide_passwords, manage) = if let Some(cipher_sync_data) = cipher_sync_data { match cipher_sync_data.members.get(&self.org_uuid) { - // Only for Manager types Bitwarden returns true for the manage option - // Owners and Admins always have true. Users are not able to have full access - Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager), + // Only for manager-level (Custom) members does Bitwarden return true for the manage + // option. Owners and Admins always have true. Users cannot have full access. + Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Custom), Some(m) => { - // Only let a manager-level member (Manager or Custom) manage collections + // Only let a manager-level (Custom) member manage collections // when they have full read/write access - let is_manager = m.atype >= MembershipType::Manager; + let is_manager = m.atype >= MembershipType::Custom; if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) { ( cu.read_only, @@ -125,12 +125,12 @@ impl Collection { } } else { match Membership::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await { - Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager), - Some(m) if m.atype >= MembershipType::Manager && self.is_manageable_by_user(user_uuid, conn).await => { + Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Custom), + Some(m) if m.atype >= MembershipType::Custom && self.is_manageable_by_user(user_uuid, conn).await => { (false, false, true) } Some(m) => { - let is_manager = m.atype >= MembershipType::Manager; + let is_manager = m.atype >= MembershipType::Custom; let read_only = !self.is_writable_by_user(user_uuid, conn).await; let hide_passwords = self.hide_passwords_for_user(user_uuid, conn).await; (read_only, hide_passwords, is_manager && !read_only && !hide_passwords) @@ -255,8 +255,11 @@ impl Collection { users_collections::user_uuid .eq(user_uuid) .or( - // Directly accessed collection - users_organizations::access_all.eq(true), // access_all in Organization + // Full-access member: Custom "Edit any collection" or org admin/owner + // (successor of the removed membership access_all) + users_organizations::edit_any_collection + .eq(true) + .or(users_organizations::atype.le(MembershipType::Admin as i32)), ) .or( groups::access_all.eq(true), // access_all in groups @@ -288,10 +291,15 @@ impl Collection { .and(users_organizations::user_uuid.eq(user_uuid.clone()))), ) .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) - .filter(users_collections::user_uuid.eq(user_uuid).or( - // Directly accessed collection - users_organizations::access_all.eq(true), // access_all in Organization - )) + .filter( + users_collections::user_uuid.eq(user_uuid).or( + // Full-access member: Custom "Edit any collection" or org admin/owner + // (successor of the removed membership access_all) + users_organizations::edit_any_collection + .eq(true) + .or(users_organizations::atype.le(MembershipType::Admin as i32)), + ), + ) .select(collections::all_columns) .distinct() .load::(conn) @@ -375,8 +383,8 @@ impl Collection { .eq(uuid) .or( // Directly accessed collection - users_organizations::access_all.eq(true).or( - // access_all in Organization + users_organizations::edit_any_collection.eq(true).or( + // Custom "Edit any collection" or org admin/owner (successor of access_all) users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner ), ) @@ -411,8 +419,8 @@ impl Collection { .filter(collections::uuid.eq(uuid)) .filter(users_collections::collection_uuid.eq(uuid).or( // Directly accessed collection - users_organizations::access_all.eq(true).or( - // access_all in Organization + users_organizations::edit_any_collection.eq(true).or( + // Custom "Edit any collection" or org admin/owner (successor of access_all) users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner ), )) @@ -456,7 +464,7 @@ impl Collection { .filter( users_organizations::atype .le(MembershipType::Admin as i32) // Org admin or owner - .or(users_organizations::access_all.eq(true)) // access_all via membership + .or(users_organizations::edit_any_collection.eq(true)) // Custom "Edit any collection" (successor of access_all) .or(users_collections::collection_uuid .eq(&self.uuid) // write access given to collection .and(users_collections::read_only.eq(false))) @@ -489,7 +497,7 @@ impl Collection { .filter( users_organizations::atype .le(MembershipType::Admin as i32) // Org admin or owner - .or(users_organizations::access_all.eq(true)) // access_all via membership + .or(users_organizations::edit_any_collection.eq(true)) // Custom "Edit any collection" (successor of access_all) .or(users_collections::collection_uuid .eq(&self.uuid) // write access given to collection .and(users_collections::read_only.eq(false))), @@ -536,8 +544,8 @@ impl Collection { .and(users_collections::hide_passwords.eq(true)) .or( // Directly accessed collection - users_organizations::access_all.eq(true).or( - // access_all in Organization + users_organizations::edit_any_collection.eq(true).or( + // Custom "Edit any collection" or org admin/owner (successor of access_all) users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner ), ) @@ -595,8 +603,8 @@ impl Collection { .and(users_collections::manage.eq(true)) .or( // Directly accessed collection - users_organizations::access_all.eq(true).or( - // access_all in Organization + users_organizations::edit_any_collection.eq(true).or( + // Custom "Edit any collection" or org admin/owner (successor of access_all) users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner ), ) @@ -946,7 +954,7 @@ impl CollectionMembership { "hidePasswords": self.hide_passwords, "manage": membership_type >= MembershipType::Admin || self.manage - || (membership_type >= MembershipType::Manager + || (membership_type >= MembershipType::Custom && !self.read_only && !self.hide_passwords), }) diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 81ceb15c..d55d44b6 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -52,7 +52,6 @@ pub struct Membership { pub invited_by_email: Option, - pub access_all: bool, pub akey: String, pub status: i32, pub atype: i32, @@ -104,7 +103,10 @@ pub enum MembershipType { Owner = 0, Admin = 1, User = 2, - Manager = 3, + // NOTE: the legacy Manager role (wire value 3) has been folded into Custom. It is no longer a + // distinct variant: it is never persisted or emitted, and an incoming value 3 is mapped onto + // Custom for backward compatibility (see `from_str`). The Custom discriminant stays 4 because + // that is the only role modern Bitwarden clients understand as carrying custom permissions. Custom = 4, } @@ -114,8 +116,10 @@ impl MembershipType { "0" | "Owner" => Some(MembershipType::Owner), "1" | "Admin" => Some(MembershipType::Admin), "2" | "User" => Some(MembershipType::User), - "3" | "Manager" => Some(MembershipType::Manager), - "4" | "Custom" => Some(MembershipType::Custom), + // "3"/"Manager" is the legacy Manager role. Modern clients no longer offer it, but an old + // client or stored request may still send value 3. Custom supersedes Manager, so accept + // and fold it onto Custom. + "3" | "Manager" | "4" | "Custom" => Some(MembershipType::Custom), _ => None, } } @@ -123,7 +127,7 @@ impl MembershipType { const fn access_rank(self) -> u8 { match self { Self::User => 0, - Self::Manager | Self::Custom => 1, + Self::Custom => 1, Self::Admin => 2, Self::Owner => 3, } @@ -132,11 +136,9 @@ impl MembershipType { impl Ord for MembershipType { fn cmp(&self, other: &MembershipType) -> Ordering { - // Manager and Custom intentionally share the same authorization rank. A total ordering - // still has to distinguish unequal enum variants, otherwise `Ord` would disagree with - // `Eq` and ordered maps/sets could collapse one role into the other. The discriminant is a - // stable tie-breaker and places Custom after Manager, preserving `Custom >= Manager` while - // keeping both roles below Admin. + // Roles are ordered by their authorization rank, not by their raw discriminant (Custom's + // discriminant is 4 but it ranks between User and Admin). The discriminant is kept as a + // stable tie-breaker so `Ord` never disagrees with `Eq`. self.access_rank().cmp(&other.access_rank()).then_with(|| (*self as i32).cmp(&(*other as i32))) } } @@ -271,7 +273,6 @@ impl Membership { org_uuid, invited_by_email, - access_all: false, akey: String::new(), status: MembershipStatus::Accepted as i32, atype: MembershipType::User as i32, @@ -467,10 +468,9 @@ impl Membership { "manageScim": false // Not supported (Not AGPLv3 Licensed) }); - // edit_any_collection is internally mirrored to access_all to provide Bitwarden-compatible - // cipher access, but it must not accidentally grant collection creation. The client treats - // limitCollectionCreation=false as an independent create grant, so compute it from the - // actual role/permission rather than access_all for Custom members. + // Edit any collection grants full read/edit access to every collection, but it must not + // accidentally grant collection creation. The client treats limitCollectionCreation=false as + // an independent create grant, so compute it from the actual role/permission. let limit_collection_creation = self.limit_collection_creation(); // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs @@ -565,7 +565,9 @@ impl Membership { CONFIG.org_groups_enabled() && Group::is_in_full_access_group(&self.user_uuid, &self.org_uuid, conn).await; // If collections are to be included, only include them if the user does not have full access via a group or defined to the user it self - let collections: Vec = if include_collections && !(full_access_group || self.access_all) { + let collections: Vec = if include_collections + && !(full_access_group || self.grants_access_to_all_collections()) + { // Get all collections for the user here already to prevent more queries let cu: HashMap = CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn) @@ -586,12 +588,12 @@ impl Membership { .into_iter() .filter_map(|c| { let (read_only, hide_passwords, manage) = if self.has_full_access() { - (false, false, self.atype >= MembershipType::Manager) + (false, false, self.atype >= MembershipType::Custom) } else if let Some(cu) = cu.get(&c.uuid) { ( cu.read_only, cu.hide_passwords, - cu.manage || (self.atype >= MembershipType::Manager && !cu.read_only && !cu.hide_passwords), + cu.manage || (self.atype >= MembershipType::Custom && !cu.read_only && !cu.hide_passwords), ) // If previous checks failed it might be that this user has access via a group, but we should not return those elements here // Those are returned via a special group endpoint @@ -648,7 +650,9 @@ impl Membership { "status": status, "type": membership_type, - "accessAll": self.access_all, + // `access_all` no longer exists as a stored flag; report the effective all-collection + // access so clients that still read this obsolete field keep seeing a consistent value. + "accessAll": self.grants_access_to_all_collections(), "twoFactorEnabled": twofactor_enabled, "resetPasswordEnrolled": self.reset_password_key.is_some(), "hasMasterPassword": !user.password_hash.is_empty(), @@ -675,7 +679,7 @@ impl Membership { } pub async fn to_json_details(&self, conn: &DbConn) -> Value { - let coll_uuids = if self.access_all { + let coll_uuids = if self.grants_access_to_all_collections() { vec![] // If we have complete access, no need to fill the array } else { let collections = @@ -707,7 +711,8 @@ impl Membership { "status": status, "type": self.atype, - "accessAll": self.access_all, + // Obsolete stored flag removed; report the effective all-collection access instead. + "accessAll": self.grants_access_to_all_collections(), "collections": coll_uuids, "object": "organizationUserDetails", @@ -816,10 +821,19 @@ impl Membership { } pub fn has_full_access(&self) -> bool { - (self.access_all || self.has_edit_any_collection() || self.atype >= MembershipType::Admin) + (self.has_edit_any_collection() || self.atype >= MembershipType::Admin) && self.has_status(MembershipStatus::Confirmed) } + /// Whether this membership reaches every collection in the org regardless of per-collection + /// assignments — Admins/Owners implicitly, and Custom members holding `edit_any_collection`. + /// This is the successor of the removed `access_all` flag: it backs the `accessAll` field the + /// Bitwarden clients still read, and it intentionally does not gate on status, matching the old + /// column's semantics. Authorization decisions use the status-aware `has_full_access` instead. + pub fn grants_access_to_all_collections(&self) -> bool { + self.atype >= MembershipType::Admin || self.has_edit_any_collection() + } + // The granular custom permission flags are only meaningful while the membership is of // the Custom type. Gating them on the type here ensures that a stale flag left over from // a type change (e.g. via the admin panel) can never grant anything. @@ -916,9 +930,8 @@ impl Membership { self.has_create_new_collections() && self.has_edit_any_collection() && self.has_delete_any_collection() } - /// Match Vaultwarden's existing collection-creation policy while keeping the new Custom - /// permission independent from edit/delete. Legacy Manager memberships retain their former - /// access_all-based behavior. + /// Match Vaultwarden's existing collection-creation policy while keeping the Custom + /// permission independent from edit/delete. pub fn can_create_new_collections(&self) -> bool { if !self.has_status(MembershipStatus::Confirmed) { return false; @@ -926,7 +939,6 @@ impl Membership { match MembershipType::from_i32(self.atype) { Some(MembershipType::Owner | MembershipType::Admin) => true, - Some(MembershipType::Manager) => self.access_all, Some(MembershipType::Custom) => self.create_new_collections, Some(MembershipType::User) | None => false, } @@ -935,7 +947,6 @@ impl Membership { pub fn limit_collection_creation(&self) -> bool { match MembershipType::from_i32(self.atype) { Some(MembershipType::Owner | MembershipType::Admin) => false, - Some(MembershipType::Manager) => !self.access_all, Some(MembershipType::Custom) => !self.create_new_collections, Some(MembershipType::User) | None => true, } @@ -1061,7 +1072,7 @@ impl Membership { .await } - // Get all users which are either owner or admin, or a manager/custom member which can manage/access all + // Get all users which are either owner or admin, or a Custom member which can access all collections pub async fn find_confirmed_and_manage_all_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec { conn.run(move |conn| { users_organizations::table @@ -1071,8 +1082,8 @@ impl Membership { users_organizations::atype .eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]) .or(users_organizations::atype - .eq_any(vec![MembershipType::Manager as i32, MembershipType::Custom as i32]) - .and(users_organizations::access_all.eq(true))), + .eq(MembershipType::Custom as i32) + .and(users_organizations::edit_any_collection.eq(true))), ) .load::(conn) .unwrap_or_default() @@ -1196,10 +1207,12 @@ impl Membership { .eq(users_collections::collection_uuid) .and(ciphers_collections::cipher_uuid.eq(&cipher_uuid))), ) - .filter(users_organizations::access_all.eq(true).or( - // AccessAll.. - ciphers_collections::cipher_uuid.eq(&cipher_uuid), // ..or access to collection with cipher - )) + .filter( + users_organizations::edit_any_collection + .eq(true) // Custom "Edit any collection" (successor of access_all) + .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner + .or(ciphers_collections::cipher_uuid.eq(&cipher_uuid)), // ..or access to collection with cipher + ) .select(users_organizations::all_columns) .distinct() .load::(conn) @@ -1272,10 +1285,12 @@ impl Membership { users_organizations::table .filter(users_organizations::org_uuid.eq(org_uuid)) .left_join(users_collections::table.on(users_collections::user_uuid.eq(users_organizations::user_uuid))) - .filter(users_organizations::access_all.eq(true).or( - // AccessAll.. - users_collections::collection_uuid.eq(&collection_uuid), // ..or access to collection with cipher - )) + .filter( + users_organizations::edit_any_collection + .eq(true) // Custom "Edit any collection" (successor of access_all) + .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner + .or(users_collections::collection_uuid.eq(&collection_uuid)), // ..or access to collection + ) .select(users_organizations::all_columns) .load::(conn) .expect("Error loading user organizations") @@ -1411,23 +1426,17 @@ mod tests { fn membership_type_order_preserves_access_rank_and_ord_contract() { assert!(MembershipType::Owner > MembershipType::Admin); assert!(MembershipType::Admin > MembershipType::Custom); - assert!(MembershipType::Custom > MembershipType::Manager); - assert!(MembershipType::Manager > MembershipType::User); + assert!(MembershipType::Custom > MembershipType::User); assert!(MembershipType::Custom == MembershipType::from_str("4").unwrap()); + // The legacy Manager wire value (3) is accepted and folded onto Custom. + assert!(MembershipType::Custom == MembershipType::from_str("3").unwrap()); // Permission comparisons continue to treat Custom as manager-level and below Admin. - assert!(MembershipType::Custom >= MembershipType::Manager); let custom = MembershipType::Custom as i32; - assert!(custom >= MembershipType::Manager); + assert!(custom >= MembershipType::Custom); assert!(custom < MembershipType::Admin); - let types = [ - MembershipType::Owner, - MembershipType::Admin, - MembershipType::User, - MembershipType::Manager, - MembershipType::Custom, - ]; + let types = [MembershipType::Owner, MembershipType::Admin, MembershipType::User, MembershipType::Custom]; for lhs in types { for rhs in types { assert_eq!(lhs.cmp(&rhs) == Ordering::Equal, lhs == rhs); @@ -1473,23 +1482,20 @@ mod tests { fn edit_any_collection_does_not_imply_create_or_delete() { let mut custom = membership(MembershipType::Custom); custom.edit_any_collection = true; - // The persisted access_all mirror is intentionally tested too: client-facing create and - // delete decisions must still use their dedicated permissions. - custom.access_all = true; + // Edit any collection grants full (read/edit) access to every collection, but client-facing + // create and delete decisions must still use their own dedicated permissions. assert!(custom.has_full_access()); + assert!(custom.grants_access_to_all_collections()); assert!(!custom.can_create_new_collections()); assert!(custom.limit_collection_creation()); assert!(!custom.can_delete_any_collection()); - let mut manager = membership(MembershipType::Manager); - manager.access_all = true; - assert!(manager.can_create_new_collections()); - let admin = membership(MembershipType::Admin); assert!(admin.can_create_new_collections()); assert!(!admin.limit_collection_creation()); assert!(admin.can_delete_any_collection()); + assert!(admin.grants_access_to_all_collections()); } #[test] diff --git a/src/db/schema.rs b/src/db/schema.rs index e8840acd..8e53e099 100644 --- a/src/db/schema.rs +++ b/src/db/schema.rs @@ -236,7 +236,6 @@ table! { user_uuid -> Text, org_uuid -> Text, invited_by_email -> Nullable, - access_all -> Bool, akey -> Text, status -> Integer, atype -> Integer, From bf56c9b169ae2fd2ca7e1f732b84d00644377e7e Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 23 Jul 2026 23:00:15 +0200 Subject: [PATCH 27/42] Add accessEventLogs, accessImportExport and accessReports Custom permissions Implements the three remaining Bitwarden Custom-role permissions on top of the existing set. Each is an independent, persisted flag on the membership, gated on the Custom role in code (stale flags on other roles grant nothing); Owners/Admins hold every permission implicitly. They are parsed from and emitted in the `permissions` object (replacing the previously hard-coded `false`) so the unmodified web-vault shows and round-trips them. Server-side enforcement: - accessEventLogs: the organization event-log endpoints (`GET .../events` and `GET .../users//events`) now use a new `AccessEventLogsHeaders` guard (Admin/Owner or the permission) instead of `AdminHeaders`. - accessImportExport: `GET .../export` uses a new `AccessImportExportHeaders` guard, and `post_org_import` gains an explicit permission check. NOTE: this tightens org import, which previously accepted any confirmed member (with per-collection gating). It now requires Admin/Owner or the permission, matching Bitwarden and the web-vault, which only offers org import to permitted members. Flagged here for maintainer review. - accessReports has no server endpoint in Vaultwarden (reports are computed client-side from vault data the member already has), so it is stored and reported in the permissions object and enforced by the client UI, matching Bitwarden's own model. No server route gates it. New migration adds the three columns (down drops them). Unit tests cover independence, type-gating, parsing and change-detection; a black-box probe over HTTP confirms the event-log/export/import gating and the permission round-trip (16/16), and the existing custom-role suite still passes (30/30). --- .../down.sql | 3 + .../up.sql | 5 ++ .../down.sql | 3 + .../up.sql | 5 ++ .../down.sql | 3 + .../up.sql | 5 ++ src/api/core/events.rs | 11 +++- src/api/core/organizations.rs | 46 ++++++++++++-- src/auth.rs | 21 +++++++ src/db/models/organization.rs | 62 +++++++++++++++++-- src/db/schema.rs | 3 + 11 files changed, 154 insertions(+), 13 deletions(-) create mode 100644 migrations/mysql/2026-07-24-130000_add_custom_access_permissions/down.sql create mode 100644 migrations/mysql/2026-07-24-130000_add_custom_access_permissions/up.sql create mode 100644 migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/down.sql create mode 100644 migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/up.sql create mode 100644 migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql create mode 100644 migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/up.sql diff --git a/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/down.sql b/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/down.sql new file mode 100644 index 00000000..f276ea5b --- /dev/null +++ b/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/down.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations DROP COLUMN access_event_logs; +ALTER TABLE users_organizations DROP COLUMN access_import_export; +ALTER TABLE users_organizations DROP COLUMN access_reports; diff --git a/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/up.sql b/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/up.sql new file mode 100644 index 00000000..9d9c31ff --- /dev/null +++ b/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/up.sql @@ -0,0 +1,5 @@ +-- Three additional Bitwarden Custom-role permissions. They are only meaningful for Custom members +-- (gated on the role in code); Owners/Admins hold every permission implicitly. +ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE; diff --git a/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/down.sql b/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/down.sql new file mode 100644 index 00000000..f276ea5b --- /dev/null +++ b/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/down.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations DROP COLUMN access_event_logs; +ALTER TABLE users_organizations DROP COLUMN access_import_export; +ALTER TABLE users_organizations DROP COLUMN access_reports; diff --git a/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/up.sql b/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/up.sql new file mode 100644 index 00000000..9d9c31ff --- /dev/null +++ b/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/up.sql @@ -0,0 +1,5 @@ +-- Three additional Bitwarden Custom-role permissions. They are only meaningful for Custom members +-- (gated on the role in code); Owners/Admins hold every permission implicitly. +ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE; diff --git a/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql b/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql new file mode 100644 index 00000000..f276ea5b --- /dev/null +++ b/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql @@ -0,0 +1,3 @@ +ALTER TABLE users_organizations DROP COLUMN access_event_logs; +ALTER TABLE users_organizations DROP COLUMN access_import_export; +ALTER TABLE users_organizations DROP COLUMN access_reports; diff --git a/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/up.sql b/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/up.sql new file mode 100644 index 00000000..9d9c31ff --- /dev/null +++ b/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/up.sql @@ -0,0 +1,5 @@ +-- Three additional Bitwarden Custom-role permissions. They are only meaningful for Custom members +-- (gated on the role in code); Owners/Admins hold every permission implicitly. +ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE; diff --git a/src/api/core/events.rs b/src/api/core/events.rs index 698a890f..3fea281e 100644 --- a/src/api/core/events.rs +++ b/src/api/core/events.rs @@ -7,7 +7,7 @@ use serde_json::Value; use crate::{ CONFIG, api::{EmptyResult, JsonResult}, - auth::{AdminHeaders, Headers}, + auth::{AccessEventLogsHeaders, Headers}, db::{ DbConn, DbPool, models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId}, @@ -31,7 +31,12 @@ struct EventRange { // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/EventsController.cs#L87 #[get("/organizations//events?")] -async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: AdminHeaders, conn: DbConn) -> JsonResult { +async fn get_org_events( + org_id: OrganizationId, + data: EventRange, + headers: AccessEventLogsHeaders, + conn: DbConn, +) -> JsonResult { if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } @@ -93,7 +98,7 @@ async fn get_user_events( org_id: OrganizationId, member_id: MembershipId, data: EventRange, - headers: AdminHeaders, + headers: AccessEventLogsHeaders, conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index edc88881..001b546f 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -12,9 +12,9 @@ use crate::{ core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor}, }, auth::{ - AdminHeaders, CollectionDeleteHeaders, CollectionReadHeaders, Headers, ManageGroupsHeaders, - ManagePoliciesHeaders, ManageUsersHeaders, ManageUsersOrGroupsHeaders, ManagerHeaders, ManagerHeadersLoose, - OrgMemberHeaders, OwnerHeaders, decode_invite, + AccessImportExportHeaders, AdminHeaders, CollectionDeleteHeaders, CollectionReadHeaders, Headers, + ManageGroupsHeaders, ManagePoliciesHeaders, ManageUsersHeaders, ManageUsersOrGroupsHeaders, ManagerHeaders, + ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite, }, db::{ DbConn, @@ -1192,6 +1192,9 @@ struct CustomRolePermissions { create_new_collections: bool, edit_any_collection: bool, delete_any_collection: bool, + access_event_logs: bool, + access_import_export: bool, + access_reports: bool, } impl CustomRolePermissions { @@ -1208,6 +1211,9 @@ impl CustomRolePermissions { create_new_collections: enabled("createNewCollections"), edit_any_collection: enabled("editAnyCollection"), delete_any_collection: enabled("deleteAnyCollection"), + access_event_logs: enabled("accessEventLogs"), + access_import_export: enabled("accessImportExport"), + access_reports: enabled("accessReports"), } } @@ -1225,6 +1231,9 @@ impl CustomRolePermissions { || self.create_new_collections != membership.create_new_collections || self.edit_any_collection != membership.edit_any_collection || self.delete_any_collection != membership.delete_any_collection + || self.access_event_logs != membership.access_event_logs + || self.access_import_export != membership.access_import_export + || self.access_reports != membership.access_reports } fn apply_to(self, membership: &mut Membership) { @@ -1234,6 +1243,9 @@ impl CustomRolePermissions { membership.create_new_collections = self.create_new_collections; membership.edit_any_collection = self.edit_any_collection; membership.delete_any_collection = self.delete_any_collection; + membership.access_event_logs = self.access_event_logs; + membership.access_import_export = self.access_import_export; + membership.access_reports = self.access_reports; } } @@ -2169,6 +2181,20 @@ async fn post_org_import( if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } + + // accessImportExport: importing into the organization requires the permission (or Admin/Owner), + // mirroring the export endpoint and the Bitwarden permission model. The web-vault only offers org + // import to members holding this permission; enforcing it server-side keeps the two consistent. + // NOTE: this tightens the previous member-level behaviour (any confirmed member could import into + // collections they could write) — see the branch notes. + if !(headers.membership.has_status(MembershipStatus::Confirmed) + && (headers.membership.atype >= MembershipType::Admin || headers.membership.has_access_import_export())) + { + err!( + "You need the 'Access Import/Export' permission, or to be an Admin or Owner, to import into this organization" + ) + } + let data: ImportData = data.into_inner(); // Validate the import before continuing @@ -3806,7 +3832,7 @@ async fn put_reset_password_enrollment( // Vaultwarden does not yet support exporting only managed collections! // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/OrganizationExportController.cs#L52 #[get("/organizations//export")] -async fn get_org_export(org_id: OrganizationId, headers: AdminHeaders, conn: DbConn) -> JsonResult { +async fn get_org_export(org_id: OrganizationId, headers: AccessImportExportHeaders, conn: DbConn) -> JsonResult { if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } @@ -4023,6 +4049,9 @@ mod tests { ("createNewCollections".to_owned(), json!(true)), ("editAnyCollection".to_owned(), json!(true)), ("deleteAnyCollection".to_owned(), json!(true)), + ("accessEventLogs".to_owned(), json!(true)), + ("accessImportExport".to_owned(), json!(true)), + ("accessReports".to_owned(), json!(true)), ]); let custom = CustomRolePermissions::from_request(MembershipType::Custom, &permissions); @@ -4032,6 +4061,9 @@ mod tests { assert!(custom.create_new_collections); assert!(custom.edit_any_collection); assert!(custom.delete_any_collection); + assert!(custom.access_event_logs); + assert!(custom.access_import_export); + assert!(custom.access_reports); let user = CustomRolePermissions::from_request(MembershipType::User, &permissions); assert_eq!(user, CustomRolePermissions::default()); @@ -4052,6 +4084,9 @@ mod tests { create_new_collections: true, edit_any_collection: true, delete_any_collection: true, + access_event_logs: true, + access_import_export: true, + access_reports: true, ..CustomRolePermissions::default() }; @@ -4061,5 +4096,8 @@ mod tests { assert!(membership.create_new_collections); assert!(membership.edit_any_collection); assert!(membership.delete_any_collection); + assert!(membership.access_event_logs); + assert!(membership.access_import_export); + assert!(membership.access_reports); } } diff --git a/src/auth.rs b/src/auth.rs index 4716b6e2..9e89a16b 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -755,6 +755,14 @@ impl OrgHeaders { || self.membership.has_manage_users() || self.membership.has_manage_groups()) } + fn can_access_event_logs(&self) -> bool { + self.is_confirmed() + && (self.membership_type >= MembershipType::Admin || self.membership.has_access_event_logs()) + } + fn can_access_import_export(&self) -> bool { + self.is_confirmed() + && (self.membership_type >= MembershipType::Admin || self.membership.has_access_import_export()) + } } // org_id is usually the second path param ("/organizations/"), @@ -839,6 +847,9 @@ impl<'r> FromRequest<'r> for OrgHeaders { } pub struct AdminHeaders { + // Kept for parity with the other org header guards (and possible future use); the org export + // endpoint that used to read this now goes through `AccessImportExportHeaders` instead. + #[allow(dead_code)] pub host: String, pub device: Device, pub user: User, @@ -937,6 +948,16 @@ generate_manage_headers!( can_manage_users_or_groups, "You need the 'Manage Users' or 'Manage Groups' permission, or to be an Admin or Owner, to call this endpoint" ); +generate_manage_headers!( + AccessEventLogsHeaders, + can_access_event_logs, + "You need the 'Access Event Logs' permission, or to be an Admin or Owner, to call this endpoint" +); +generate_manage_headers!( + AccessImportExportHeaders, + can_access_import_export, + "You need the 'Access Import/Export' permission, or to be an Admin or Owner, to call this endpoint" +); // col_id is usually the fourth path param ("/organizations//collections/"), // but there could be cases where it is a query value. diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 81ceb15c..0ddfcc80 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -64,6 +64,9 @@ pub struct Membership { pub create_new_collections: bool, pub edit_any_collection: bool, pub delete_any_collection: bool, + pub access_event_logs: bool, + pub access_import_export: bool, + pub access_reports: bool, } #[derive(Identifiable, Queryable, Insertable, AsChangeset)] @@ -283,6 +286,9 @@ impl Membership { create_new_collections: false, edit_any_collection: false, delete_any_collection: false, + access_event_logs: false, + access_import_export: false, + access_reports: false, } } @@ -453,9 +459,9 @@ impl Membership { let membership_type = self.atype; let permissions = json!({ - "accessEventLogs": false, - "accessImportExport": false, - "accessReports": false, + "accessEventLogs": membership_type == MembershipType::Custom as i32 && self.access_event_logs, + "accessImportExport": membership_type == MembershipType::Custom as i32 && self.access_import_export, + "accessReports": membership_type == MembershipType::Custom as i32 && self.access_reports, "createNewCollections": membership_type == MembershipType::Custom as i32 && self.create_new_collections, "editAnyCollection": membership_type == MembershipType::Custom as i32 && self.edit_any_collection, "deleteAnyCollection": membership_type == MembershipType::Custom as i32 && self.delete_any_collection, @@ -619,9 +625,9 @@ impl Membership { // all-false defaults and the role itself supplies any elevated capabilities. let permissions = if membership_type == MembershipType::Custom as i32 { json!({ - "accessEventLogs": false, - "accessImportExport": false, - "accessReports": false, + "accessEventLogs": self.access_event_logs, + "accessImportExport": self.access_import_export, + "accessReports": self.access_reports, "createNewCollections": self.create_new_collections, "editAnyCollection": self.edit_any_collection, "deleteAnyCollection": self.delete_any_collection, @@ -847,6 +853,18 @@ impl Membership { self.has_type(MembershipType::Custom) && self.delete_any_collection } + pub fn has_access_event_logs(&self) -> bool { + self.has_type(MembershipType::Custom) && self.access_event_logs + } + + pub fn has_access_import_export(&self) -> bool { + self.has_type(MembershipType::Custom) && self.access_import_export + } + + pub fn has_access_reports(&self) -> bool { + self.has_type(MembershipType::Custom) && self.access_reports + } + /// Check for an explicit per-collection Manage grant without treating any `access_all` value /// as such a grant. Custom-role collection guards use this instead of the legacy broad helper, /// because membership/group `access_all` must not manufacture a per-collection Manage grant. @@ -953,6 +971,9 @@ impl Membership { self.create_new_collections = false; self.edit_any_collection = false; self.delete_any_collection = false; + self.access_event_logs = false; + self.access_import_export = false; + self.access_reports = false; } pub async fn find_by_uuid(uuid: &MembershipId, conn: &DbConn) -> Option { @@ -1514,6 +1535,9 @@ mod tests { member.create_new_collections = true; member.edit_any_collection = true; member.delete_any_collection = true; + member.access_event_logs = true; + member.access_import_export = true; + member.access_reports = true; member.clear_custom_permissions(); @@ -1523,5 +1547,31 @@ mod tests { assert!(!member.create_new_collections); assert!(!member.edit_any_collection); assert!(!member.delete_any_collection); + assert!(!member.access_event_logs); + assert!(!member.access_import_export); + assert!(!member.access_reports); + } + + #[test] + fn custom_access_permissions_are_independent_and_type_gated() { + let mut member = membership(MembershipType::Custom); + member.access_event_logs = true; + assert!(member.has_access_event_logs()); + assert!(!member.has_access_import_export()); + assert!(!member.has_access_reports()); + + member.access_import_export = true; + member.access_reports = true; + assert!(member.has_access_import_export()); + assert!(member.has_access_reports()); + // None of them imply collection or management capabilities. + assert!(!member.has_full_access()); + assert!(!member.has_manage_users()); + + // Stale flags on a non-Custom role grant nothing. + member.atype = MembershipType::User as i32; + assert!(!member.has_access_event_logs()); + assert!(!member.has_access_import_export()); + assert!(!member.has_access_reports()); } } diff --git a/src/db/schema.rs b/src/db/schema.rs index e8840acd..aee26991 100644 --- a/src/db/schema.rs +++ b/src/db/schema.rs @@ -248,6 +248,9 @@ table! { create_new_collections -> Bool, edit_any_collection -> Bool, delete_any_collection -> Bool, + access_event_logs -> Bool, + access_import_export -> Bool, + access_reports -> Bool, } } From aa58ef576c6c175f2502103326facfa13b5d922f Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sat, 25 Jul 2026 20:25:12 +0200 Subject: [PATCH 28/42] Scope the organization export to what the caller may actually read A security review of this branch (finding F1) pointed out that the 'Access Import/Export' permission, which this branch added and which opens GET /organizations//export via AccessImportExportHeaders, decided *whether* a member may export but not *what* they get: the handler always dumped Cipher::find_by_org(), and CipherSyncType:: Organization deliberately skips the per-cipher access restrictions. A confirmed Custom member holding only accessImportExport - assigned to no collection at all - therefore received every cipher of the organization, including collections they were explicitly excluded from. Every confirmed member holds the organization key, so the exported blobs are decryptable by the caller. The export is now built from the caller's own assignments unless they already reach every collection anyway (Admin/Owner, or a Custom member with 'Edit any collection'), which is what Bitwarden's export controller does. Group-based access is covered: both scoped queries honour group assignments and group access_all. * new helper may_export_entire_organization() names the decision and keeps it unit-testable * get_org_details_impl() split into ciphers_to_org_json() so the export can serialize an already-authorized cipher list; the serializer's doc comment states that requirement * new regression test access_import_export_alone_does_not_widen_the_export Verified: cargo check, cargo clippy --features sqlite (clean), cargo test --features sqlite (48 passed), cargo fmt --all -- --check. --- src/api/core/organizations.rs | 76 ++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 6 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 6481d003..50754dd8 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1077,7 +1077,18 @@ async fn get_org_details_impl( user_id: &UserId, conn: &DbConn, ) -> Result { - let ciphers = Cipher::find_by_org(org_id, conn).await; + ciphers_to_org_json(Cipher::find_by_org(org_id, conn).await, host, user_id, conn).await +} + +// Serialize an already-authorized set of organization ciphers. The caller decides which ciphers go +// in: `CipherSyncType::Organization` skips the per-cipher access restrictions, so this must never be +// handed a cipher the user is not allowed to see. +async fn ciphers_to_org_json( + ciphers: Vec, + host: &str, + user_id: &UserId, + conn: &DbConn, +) -> Result { let cipher_sync_data = CipherSyncData::new(user_id, CipherSyncType::Organization, conn).await; let mut ciphers_json = Vec::with_capacity(ciphers.len()); @@ -3218,6 +3229,17 @@ async fn caller_may_grant_collection_manage(caller: &Membership, col_id: &Collec } } +/// Whether `caller` may export the *entire* organization instead of only their own assignments. +/// +/// Security (audit F1): the `AccessImportExportHeaders` guard on `get_org_export` decides whether a +/// member may export at all; it must not decide *what* they get. Only members who already reach +/// every collection — Admins/Owners, and Custom members holding `edit_any_collection` — may receive +/// the full organization dump. For anyone else the export is built from their own assigned +/// collections/ciphers, so 'Access Import/Export' can never turn into a full vault read. +fn may_export_entire_organization(caller: &Membership) -> bool { + caller.has_full_access() +} + /// Pure, collection-independent part of `caller_may_grant_collection_manage`. /// /// `Some(true)` -> the caller may grant `manage` on *any* collection (Admin/Owner, or a Custom @@ -3847,8 +3869,9 @@ async fn put_reset_password_enrollment( // NOTE: It seems clients can't handle uppercase-first keys!! // We need to convert all keys so they have the first character to be a lowercase. // Else the export will be just an empty JSON file. -// We currently only support exports by members of the Admin or Owner status. -// Vaultwarden does not yet support exporting only managed collections! +// Members with full access to the organization (Admin/Owner, or a Custom member with +// 'Edit any collection') export the whole organization; everyone else exports only what they can +// actually reach, like Bitwarden's export controller does. // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/OrganizationExportController.cs#L52 #[get("/organizations//export")] async fn get_org_export(org_id: OrganizationId, headers: AccessImportExportHeaders, conn: DbConn) -> JsonResult { @@ -3856,9 +3879,24 @@ async fn get_org_export(org_id: OrganizationId, headers: AccessImportExportHeade err!("Organization not found", "Organization id's do not match"); } + // Security (audit F1): 'Access Import/Export' decides *whether* a member may export, it must not + // widen *what* they may read. Without this scoping a Custom member holding only this permission + // — assigned to no collection at all — would receive every cipher in the organization, because + // the organization sync type deliberately skips the per-cipher access restrictions. + let (collections, ciphers) = if may_export_entire_organization(&headers.membership) { + (Collection::find_by_organization(&org_id, &conn).await, Cipher::find_by_org(&org_id, &conn).await) + } else { + ( + Collection::find_by_organization_and_user_uuid(&org_id, &headers.user.uuid, &conn).await, + filter_ciphers_for_organization(Cipher::find_by_user_visible(&headers.user.uuid, &conn).await, &org_id), + ) + }; + + let collections_json: Value = collections.iter().map(Collection::to_json).collect(); + Ok(Json(json!({ - "collections": convert_json_key_lcase_first(get_org_collections_impl(&org_id, &conn).await), - "ciphers": convert_json_key_lcase_first(get_org_details_impl(&org_id, &headers.host, &headers.user.uuid, &conn).await?), + "collections": convert_json_key_lcase_first(collections_json), + "ciphers": convert_json_key_lcase_first(ciphers_to_org_json(ciphers, &headers.host, &headers.user.uuid, &conn).await?), }))) } @@ -3927,7 +3965,7 @@ mod tests { use super::{ CustomRolePermissions, caller_manage_grant_role_check, filter_ciphers_for_organization, - may_change_group_membership, may_change_member_type, + may_change_group_membership, may_change_member_type, may_export_entire_organization, }; use crate::db::models::{Cipher, Membership, MembershipStatus, MembershipType, OrganizationId}; @@ -3971,6 +4009,32 @@ mod tests { assert_eq!(caller_manage_grant_role_check(&unconfirmed), Some(false)); } + #[test] + fn access_import_export_alone_does_not_widen_the_export() { + // REGRESSION (audit F1): 'Access Import/Export' opens the export endpoint, but a Custom + // member holding only that permission reaches no collection of their own, so the export + // must be built from their assignments — never from the whole organization. + let mut import_export_only = confirmed_member(MembershipType::Custom); + import_export_only.access_import_export = true; + assert!(!may_export_entire_organization(&import_export_only)); + + // Custom members who already reach every collection keep the full dump. + let mut edit_any = confirmed_member(MembershipType::Custom); + edit_any.edit_any_collection = true; + edit_any.access_import_export = true; + assert!(may_export_entire_organization(&edit_any)); + + // Admins and Owners are unaffected. + assert!(may_export_entire_organization(&confirmed_member(MembershipType::Admin))); + assert!(may_export_entire_organization(&confirmed_member(MembershipType::Owner))); + + // An unconfirmed membership never qualifies, whatever its flags say. + let mut unconfirmed = confirmed_member(MembershipType::Custom); + unconfirmed.edit_any_collection = true; + unconfirmed.status = MembershipStatus::Accepted as i32; + assert!(!may_export_entire_organization(&unconfirmed)); + } + #[test] fn assigned_cipher_response_is_scoped_to_requested_organization() { let requested_org: OrganizationId = "requested-org".to_owned().into(); From fc96fbe8d38ffc4353b22afcc4c1526bf10414f3 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sun, 26 Jul 2026 00:56:40 +0200 Subject: [PATCH 29/42] Harden custom-role authorization and migrations --- docs/custom-role-migration-recovery.md | 200 +++++ .../down.sql | 1 + .../up.sql | 13 + .../down.sql | 3 + .../up.sql | 67 ++ .../down.sql | 7 + .../up.sql | 3 + .../down.sql | 1 + .../up.sql | 13 + .../down.sql | 3 + .../up.sql | 65 ++ .../down.sql | 7 + .../up.sql | 3 + .../down.sql | 1 + .../up.sql | 12 + .../down.sql | 3 + .../up.sql | 65 ++ .../down.sql | 7 + .../up.sql | 3 + src/api/admin.rs | 27 +- src/api/core/events.rs | 328 +++++++- src/api/core/organizations.rs | 247 ++++-- src/db/mod.rs | 768 +++++++++++++++++- src/db/models/collection.rs | 135 +-- src/db/models/organization.rs | 102 ++- src/static/scripts/admin_users.js | 16 +- src/static/templates/admin/users.hbs | 5 +- .../templates/scss/vaultwarden.scss.hbs | 6 +- src/util.rs | 10 +- 29 files changed, 1864 insertions(+), 257 deletions(-) create mode 100644 docs/custom-role-migration-recovery.md create mode 100644 migrations/mysql/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql create mode 100644 migrations/mysql/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql create mode 100644 migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql create mode 100644 migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql create mode 100644 migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql create mode 100644 migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql create mode 100644 migrations/postgresql/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql create mode 100644 migrations/postgresql/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql create mode 100644 migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql create mode 100644 migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql create mode 100644 migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql create mode 100644 migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql create mode 100644 migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql create mode 100644 migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql create mode 100644 migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql create mode 100644 migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql create mode 100644 migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql create mode 100644 migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql diff --git a/docs/custom-role-migration-recovery.md b/docs/custom-role-migration-recovery.md new file mode 100644 index 00000000..64fad205 --- /dev/null +++ b/docs/custom-role-migration-recovery.md @@ -0,0 +1,200 @@ +# Custom-role migration recovery + +Vaultwarden deliberately stops the Custom-role migration when the old database state cannot be +translated without either removing access or adding new management authority. A failed preflight +does not authorize Vaultwarden to choose between those outcomes. + +## Before doing anything + +1. Stop every Vaultwarden instance that uses the database. Do not perform this migration during a + rolling deployment. +2. Take and verify a full database backup. +3. Keep the complete startup error. It identifies the state that needs review. +4. Do not add or delete rows in `__diesel_schema_migrations` merely to bypass the preflight. + +The relevant versions are: + +| Version | Purpose | +|---|---| +| `2026-07-15-120000` | Mark that `2026-07-16` is pending in the same migration sequence | +| `2026-07-16-120000` | Add the three collection-permission columns | +| `2026-07-23-120000` | Reconcile legacy Manager/Custom membership permissions | +| `2026-07-24-120000` | Drop membership-level `access_all` | +| `2026-07-24-130000` | Add the three Custom Access permissions | +| `2026-07-24-140000` | Refuse a lossy Custom-role downgrade | + +Diesel stores these directory versions without punctuation in `__diesel_schema_migrations` (for +example, `2026-07-16-120000` is stored as `20260716120000`). +The immutable `2026-06-30-120000` migration is an earlier prerequisite; this table focuses on the +new marker/repair/drop/downgrade safety sequence. + +## Legacy User with membership `access_all` + +Find the affected memberships before the source column is dropped: + +```sql +SELECT uuid, user_uuid, org_uuid, status +FROM users_organizations +WHERE atype = 2 AND access_all = TRUE; +``` + +This state was accepted by older Vaultwarden versions. It has no exact representation in the new +nine-bit Custom-role model: + +- clearing `access_all` keeps the User role but removes organization-wide vault access; +- changing the member to Custom with all three collection permissions preserves broad vault access, + but also grants collection-management capabilities the old User role did not have. + +An organization owner must decide the intended role and permissions for each result. Make that +change on the backed-up pre-drop database and record the decision: + +- to keep the member a normal User, set that membership's `access_all` to false; +- to intentionally promote the member to Custom with Create/Edit/Delete-any authority, set that + membership's `atype` to the legacy Manager value `3` and keep `access_all` true. The repair copies + the bit to all three collection permissions before converting `atype` to `4`. + +Apply either change by exact membership UUID while all Vaultwarden instances are stopped. Do not +bulk-promote these records automatically. + +## Group-derived legacy collection management + +An organization-local `groups.access_all` relationship is safe when the membership has no direct +collection permissions. During a normal upgrade, the older `2026-07-16` migration temporarily +copies that relationship to the exact direct `create/edit/delete = 0/1/1` pattern. The new repair +recognizes the still-present, organization-bound source and deterministically resets the direct +Edit/Delete bits to false **only** when the durable `2026-07-15` marker proves that `2026-07-16` was +pending in the same migration sequence. Vault access remains group-derived, so removing the member +from the group also removes that access. + +The marker survives a process failure between `2026-07-16` and `2026-07-23`, allowing the next +startup to finish the deterministic repair. `2026-07-23` transactionally clears the marker row only +after all guards and data updates succeed. The empty internal bookkeeping table is intentionally +retained so MySQL does not introduce a DDL commit boundary. Do not create, remove, or populate +`__vw_custom_role_same_run_0716` manually. + +The preflight stops only when the three columns already exist and it finds a `0/1/1` pattern. At +that point the values may be either an intentional direct Edit+Delete grant or an older group +backfill whose source group was removed; the database has no provenance bit that can distinguish +them. + +For each stopped `0/1/1` membership, the owner must choose one of these executable outcomes: + +- **Group-derived or obsolete:** set `edit_any_collection` and `delete_any_collection` to false for + that exact membership. Leave the intended group relationship in place if access should remain + group-derived. The next preflight can then proceed. +- **Intentionally direct Edit+Delete:** while every server is stopped, temporarily set + `create_new_collections` to true for that exact membership. The unambiguous `1/1/1` state passes + the repair and is not treated as a group backfill. Run the migration in a maintenance instance + that is not reachable by clients, stop it as soon as all six recovery-sequence versions listed + above are recorded, then set `create_new_collections` back to false before normal service resumes. + This restores the explicitly reviewed direct `0/1/1` state after the repair marker exists. + +The organization boundary used to identify a current group source is: + +```sql +SELECT DISTINCT uo.uuid, uo.org_uuid, g.uuid AS group_uuid +FROM users_organizations AS uo +INNER JOIN groups_users AS gu ON gu.users_organizations_uuid = uo.uuid +INNER JOIN groups AS g ON g.uuid = gu.groups_uuid +WHERE uo.atype IN (3, 4) + AND uo.access_all = FALSE + AND g.organizations_uuid = uo.org_uuid + AND g.access_all = TRUE; +``` + +On MySQL, quote the table as `` `groups` ``. Review direct `0/1/1` records separately: + +```sql +SELECT uuid, user_uuid, org_uuid +FROM users_organizations +WHERE atype IN (3, 4) + AND access_all = FALSE + AND create_new_collections = FALSE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE; +``` + +Because an explicit Edit+Delete assignment has the same stored values as the historical derived +state, Vaultwarden cannot classify those records automatically. Never use the temporary Create bit +while a server is accepting client traffic. + +## The `access_all` column was already dropped + +If `2026-07-24-120000` is recorded but `2026-07-23-120000` is not, restore a backup from before the +drop and migrate again after resolving the cases above. The old membership bit is no longer present, +so a later migration cannot prove which members had it. + +If no such backup exists, perform a membership-by-membership authorization review using +administrative records before changing roles or flags. Only after the final state has been reviewed +may an operator mark the repair version as resolved. Vaultwarden intentionally provides no automatic +command for this irreversible case. + +## Historical MySQL partial `2026-07-16` migration + +An older branch revision could fail on the unquoted `groups` identifier after MySQL had already +committed all three `ADD COLUMN` statements. The migration version was not recorded, so a normal +retry then failed on duplicate columns. + +Vaultwarden automatically completes this state only when all of the following are true: + +- `2026-07-16-120000` is absent from the ledger; +- all three expected columns exist, are non-null booleans, and default to false; +- `access_all` still exists and `2026-07-24-120000` has not run; +- the stored values are either the untouched false defaults, the values produced by the canonical + membership-`access_all` copy, or exact `0/1/1` values accompanied by both the durable same-run + marker and a current same-organization `groups.access_all` source; and +- neither a legacy User/access-all case nor ambiguous group provenance exists. + +It then reapplies the canonical membership data copy and inserts the ledger row in one transaction. +For the narrowly accepted same-run `0/1/1` crash state, that copy first reconstructs `0/0/0`; the +pending canonical group backfill and `2026-07-23` repair then run normally. A missing group source, +any other partial column set, changed definition, or unexpected value stops startup. Preserve that +database and repair it manually from the verified backup; do not drop columns that may contain +independently changed permissions. + +## Verification after recovery + +After a successful start, verify: + +```sql +SELECT version +FROM __diesel_schema_migrations +WHERE version IN ( + '20260715120000', + '20260716120000', + '20260723120000', + '20260724120000', + '20260724130000', + '20260724140000' +) +ORDER BY version; + +SELECT COUNT(*) AS invalid_manager_types +FROM users_organizations +WHERE atype = 3; +``` + +All six versions must be present and `invalid_manager_types` must be zero. Then test a fresh login, +sync, collection read/edit/delete, and group removal for every membership that was reviewed. + +## Downgrade guard + +The old schema cannot encode nine independent permissions in its single membership `access_all` +bit. Even a state that currently happens to use only `0/0/0` or `1/1/1` could be changed after a +one-step guard was reverted and before a later incremental downgrade. A conditional guard would +therefore create false confidence. + +The newest migration always stops an automatic downgrade with a duplicate-key error in the +`__vw_custom_role_downgrade_guard` temporary table, before any production permission column or +migration-ledger row is removed. This mechanism is enforced by primary keys on SQLite, PostgreSQL, +MySQL 5.7+, and MariaDB; it does not rely on historically ignored MySQL `CHECK` constraints. This is +intentional. + +Rollback requires either: + +- restoring a verified database backup taken before the Custom-role upgrade; or +- an explicit offline transformation plan that exports all permissions, defines the accepted + semantic loss or role changes membership by membership, and is tested against a disposable copy + on the same database backend. + +Do not delete the `20260724140000` ledger row merely to bypass this protection. diff --git a/migrations/mysql/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql b/migrations/mysql/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql new file mode 100644 index 00000000..04346743 --- /dev/null +++ b/migrations/mysql/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql @@ -0,0 +1 @@ +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; diff --git a/migrations/mysql/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql b/migrations/mysql/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql new file mode 100644 index 00000000..1ba47e9d --- /dev/null +++ b/migrations/mysql/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql @@ -0,0 +1,13 @@ +-- Record whether 2026-07-16 is about to run in this migration sequence. The durable marker lets a +-- retry distinguish its deterministic group-derived 0/1/1 backfill from older, ambiguous data. +CREATE TABLE IF NOT EXISTS __vw_custom_role_same_run_0716 ( + marker INTEGER NOT NULL PRIMARY KEY +); +INSERT IGNORE INTO __vw_custom_role_same_run_0716 (marker) +SELECT 1 +FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 + FROM __diesel_schema_migrations + WHERE version = '20260716120000' +); diff --git a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql new file mode 100644 index 00000000..b9d4e9e6 --- /dev/null +++ b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql @@ -0,0 +1,3 @@ +-- This is an idempotent data repair. Reverting it must not remove permissions or recreate the +-- invalid persisted Manager type; the older-schema migration performs its own safe conversion. +SELECT 1; diff --git a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql new file mode 100644 index 00000000..3186fe6a --- /dev/null +++ b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -0,0 +1,67 @@ +-- A normal User with the historical membership-level access_all bit cannot be mapped to the +-- Custom role without adding collection-management authority. Stop before dropping the source bit. +CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype = 2 AND access_all = TRUE +LIMIT 1; +DROP TEMPORARY TABLE __vw_legacy_user_access_all_guard; + +-- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the +-- exact direct 0/1/1 pattern. While the same organization-local source group is still present, +-- remove that deterministic copy so later group removal also revokes the authority. +UPDATE users_organizations +SET edit_any_collection = FALSE, + delete_any_collection = FALSE +WHERE atype IN (3, 4) + AND access_all = FALSE + AND create_new_collections = FALSE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE + AND EXISTS (SELECT 1 FROM __vw_custom_role_same_run_0716 WHERE marker = 1) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN `groups` AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = users_organizations.uuid + AND g.organizations_uuid = users_organizations.org_uuid + AND g.access_all = TRUE + ); + +-- A remaining 0/1/1 pattern may be either an intentional direct grant or an older derived grant +-- whose source group has already been removed. Do not guess which one it is. +CREATE TEMPORARY TABLE __vw_legacy_group_access_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_group_access_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_group_access_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype IN (3, 4) + AND access_all = FALSE + AND create_new_collections = FALSE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE +LIMIT 1; +DROP TEMPORARY TABLE __vw_legacy_group_access_guard; + +-- Membership access_all on a legacy Manager/Custom represented all three collection capabilities. +-- Set only TRUE values so this repair never removes independently configured permissions. +UPDATE users_organizations +SET create_new_collections = TRUE, + edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype IN (3, 4) + AND access_all = TRUE; + +-- Convert only after the legacy bit has been copied. +UPDATE users_organizations SET atype = 4 WHERE atype = 3; + +-- Clear only the marker row as transactional DML. Keeping the empty bookkeeping table avoids +-- MySQL DDL implicit commits, so the permission repair, marker clear, and Diesel ledger insert +-- either commit together or are all retried. +DELETE FROM __vw_custom_role_same_run_0716 WHERE marker = 1; diff --git a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql new file mode 100644 index 00000000..4eb19e97 --- /dev/null +++ b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -0,0 +1,7 @@ +-- Nine independent Custom-role permissions cannot be represented losslessly by the legacy +-- role/access_all schema. Always stop before any older down migration removes permission data. +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); diff --git a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql new file mode 100644 index 00000000..af5fed1b --- /dev/null +++ b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -0,0 +1,3 @@ +-- Forward migration marker. Its down migration intentionally blocks an automatic lossy downgrade +-- before any granular permission column is removed. +SELECT 1; diff --git a/migrations/postgresql/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql b/migrations/postgresql/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql new file mode 100644 index 00000000..04346743 --- /dev/null +++ b/migrations/postgresql/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql @@ -0,0 +1 @@ +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; diff --git a/migrations/postgresql/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql b/migrations/postgresql/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql new file mode 100644 index 00000000..f4f6862e --- /dev/null +++ b/migrations/postgresql/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql @@ -0,0 +1,13 @@ +-- Record whether 2026-07-16 is about to run in this migration sequence. The durable marker lets a +-- retry distinguish its deterministic group-derived 0/1/1 backfill from older, ambiguous data. +CREATE TABLE IF NOT EXISTS __vw_custom_role_same_run_0716 ( + marker INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_same_run_0716 (marker) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 + FROM __diesel_schema_migrations + WHERE version = '20260716120000' +) +ON CONFLICT (marker) DO NOTHING; diff --git a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql new file mode 100644 index 00000000..b9d4e9e6 --- /dev/null +++ b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql @@ -0,0 +1,3 @@ +-- This is an idempotent data repair. Reverting it must not remove permissions or recreate the +-- invalid persisted Manager type; the older-schema migration performs its own safe conversion. +SELECT 1; diff --git a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql new file mode 100644 index 00000000..6d75889c --- /dev/null +++ b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -0,0 +1,65 @@ +-- A normal User with the historical membership-level access_all bit cannot be mapped to the +-- Custom role without adding collection-management authority. Stop before dropping the source bit. +CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype = 2 AND access_all = TRUE +LIMIT 1; +DROP TABLE __vw_legacy_user_access_all_guard; + +-- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the +-- exact direct 0/1/1 pattern. While the same organization-local source group is still present, +-- remove that deterministic copy so later group removal also revokes the authority. +UPDATE users_organizations +SET edit_any_collection = FALSE, + delete_any_collection = FALSE +WHERE atype IN (3, 4) + AND access_all = FALSE + AND create_new_collections = FALSE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE + AND EXISTS (SELECT 1 FROM __vw_custom_role_same_run_0716 WHERE marker = 1) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN "groups" AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = users_organizations.uuid + AND g.organizations_uuid = users_organizations.org_uuid + AND g.access_all = TRUE + ); + +-- A remaining 0/1/1 pattern may be either an intentional direct grant or an older derived grant +-- whose source group has already been removed. Do not guess which one it is. +CREATE TEMPORARY TABLE __vw_legacy_group_access_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_group_access_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_group_access_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype IN (3, 4) + AND access_all = FALSE + AND create_new_collections = FALSE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE +LIMIT 1; +DROP TABLE __vw_legacy_group_access_guard; + +-- Membership access_all on a legacy Manager/Custom represented all three collection capabilities. +-- Set only TRUE values so this repair never removes independently configured permissions. +UPDATE users_organizations +SET create_new_collections = TRUE, + edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype IN (3, 4) + AND access_all = TRUE; + +-- Convert only after the legacy bit has been copied. +UPDATE users_organizations SET atype = 4 WHERE atype = 3; + +-- Clear the same-run marker only after every guard and permission update succeeds. +DELETE FROM __vw_custom_role_same_run_0716 WHERE marker = 1; diff --git a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql new file mode 100644 index 00000000..4eb19e97 --- /dev/null +++ b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -0,0 +1,7 @@ +-- Nine independent Custom-role permissions cannot be represented losslessly by the legacy +-- role/access_all schema. Always stop before any older down migration removes permission data. +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); diff --git a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql new file mode 100644 index 00000000..af5fed1b --- /dev/null +++ b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -0,0 +1,3 @@ +-- Forward migration marker. Its down migration intentionally blocks an automatic lossy downgrade +-- before any granular permission column is removed. +SELECT 1; diff --git a/migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql b/migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql new file mode 100644 index 00000000..04346743 --- /dev/null +++ b/migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql @@ -0,0 +1 @@ +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; diff --git a/migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql b/migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql new file mode 100644 index 00000000..53fd7671 --- /dev/null +++ b/migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql @@ -0,0 +1,12 @@ +-- Record whether 2026-07-16 is about to run in this migration sequence. The durable marker lets a +-- retry distinguish its deterministic group-derived 0/1/1 backfill from older, ambiguous data. +CREATE TABLE IF NOT EXISTS __vw_custom_role_same_run_0716 ( + marker INTEGER NOT NULL PRIMARY KEY +); +INSERT OR IGNORE INTO __vw_custom_role_same_run_0716 (marker) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 + FROM __diesel_schema_migrations + WHERE version = '20260716120000' +); diff --git a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql new file mode 100644 index 00000000..b9d4e9e6 --- /dev/null +++ b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql @@ -0,0 +1,3 @@ +-- This is an idempotent data repair. Reverting it must not remove permissions or recreate the +-- invalid persisted Manager type; the older-schema migration performs its own safe conversion. +SELECT 1; diff --git a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql new file mode 100644 index 00000000..6d75889c --- /dev/null +++ b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -0,0 +1,65 @@ +-- A normal User with the historical membership-level access_all bit cannot be mapped to the +-- Custom role without adding collection-management authority. Stop before dropping the source bit. +CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype = 2 AND access_all = TRUE +LIMIT 1; +DROP TABLE __vw_legacy_user_access_all_guard; + +-- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the +-- exact direct 0/1/1 pattern. While the same organization-local source group is still present, +-- remove that deterministic copy so later group removal also revokes the authority. +UPDATE users_organizations +SET edit_any_collection = FALSE, + delete_any_collection = FALSE +WHERE atype IN (3, 4) + AND access_all = FALSE + AND create_new_collections = FALSE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE + AND EXISTS (SELECT 1 FROM __vw_custom_role_same_run_0716 WHERE marker = 1) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN "groups" AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = users_organizations.uuid + AND g.organizations_uuid = users_organizations.org_uuid + AND g.access_all = TRUE + ); + +-- A remaining 0/1/1 pattern may be either an intentional direct grant or an older derived grant +-- whose source group has already been removed. Do not guess which one it is. +CREATE TEMPORARY TABLE __vw_legacy_group_access_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_group_access_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_group_access_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype IN (3, 4) + AND access_all = FALSE + AND create_new_collections = FALSE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE +LIMIT 1; +DROP TABLE __vw_legacy_group_access_guard; + +-- Membership access_all on a legacy Manager/Custom represented all three collection capabilities. +-- Set only TRUE values so this repair never removes independently configured permissions. +UPDATE users_organizations +SET create_new_collections = TRUE, + edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype IN (3, 4) + AND access_all = TRUE; + +-- Convert only after the legacy bit has been copied. +UPDATE users_organizations SET atype = 4 WHERE atype = 3; + +-- Clear the same-run marker only after every guard and permission update succeeds. +DELETE FROM __vw_custom_role_same_run_0716 WHERE marker = 1; diff --git a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql new file mode 100644 index 00000000..4eb19e97 --- /dev/null +++ b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -0,0 +1,7 @@ +-- Nine independent Custom-role permissions cannot be represented losslessly by the legacy +-- role/access_all schema. Always stop before any older down migration removes permission data. +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); diff --git a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql new file mode 100644 index 00000000..af5fed1b --- /dev/null +++ b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -0,0 +1,3 @@ +-- Forward migration marker. Its down migration intentionally blocks an automatic lossy downgrade +-- before any granular permission column is removed. +SELECT 1; diff --git a/src/api/admin.rs b/src/api/admin.rs index b03946af..5989efdb 100644 --- a/src/api/admin.rs +++ b/src/api/admin.rs @@ -557,6 +557,19 @@ fn apply_membership_type_change(membership: &mut Membership, new_type: Membershi membership.atype = new_type as i32; } +fn parse_admin_membership_type(user_type: NumberOrString) -> Option { + let raw_type = user_type.into_string(); + + // The public API still accepts the legacy Manager representation for compatibility and folds + // it into Custom. The admin panel must not do that: treating an apparent Manager demotion as a + // Custom-to-Custom update would preserve the member's existing granular permissions. + if matches!(raw_type.as_str(), "3" | "Manager") { + return None; + } + + MembershipType::from_str(&raw_type) +} + #[post("/users/org_type", format = "application/json", data = "")] async fn update_membership_type(data: Json, token: AdminToken, conn: DbConn) -> EmptyResult { let data: MembershipTypeData = data.into_inner(); @@ -566,7 +579,7 @@ async fn update_membership_type(data: Json, token: AdminToke err!("The specified user isn't member of the organization") }; - let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) else { + let Some(new_type) = parse_admin_membership_type(data.user_type) else { err!("Invalid type") }; @@ -955,4 +968,16 @@ mod tests { assert_eq!(promo.atype, MembershipType::Admin as i32); assert!(!promo.edit_any_collection); } + + #[test] + fn admin_type_parser_rejects_legacy_manager_before_normalization() { + assert!(parse_admin_membership_type(NumberOrString::Number(3)).is_none()); + assert!(parse_admin_membership_type(NumberOrString::String("3".to_owned())).is_none()); + assert!(parse_admin_membership_type(NumberOrString::String("Manager".to_owned())).is_none()); + + assert!(parse_admin_membership_type(NumberOrString::Number(4)) == Some(MembershipType::Custom)); + assert!( + parse_admin_membership_type(NumberOrString::String("Custom".to_owned())) == Some(MembershipType::Custom) + ); + } } diff --git a/src/api/core/events.rs b/src/api/core/events.rs index 012be88f..b856176c 100644 --- a/src/api/core/events.rs +++ b/src/api/core/events.rs @@ -10,9 +10,12 @@ use crate::{ auth::{AccessEventLogsHeaders, Headers}, db::{ DbConn, DbPool, - models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId}, + models::{ + Cipher, CipherId, Event, EventType, Membership, MembershipId, MembershipStatus, MembershipType, + OrganizationId, UserId, + }, }, - util::parse_date, + util::try_parse_date, }; /// ############################################################################################################### @@ -29,6 +32,28 @@ struct EventRange { continuation_token: Option, } +fn parse_event_date(date: &str, field: &str) -> Result { + try_parse_date(date) + .map_err(|error| crate::Error::new("Invalid event date", format!("Invalid RFC 3339 {field}: {error}"))) +} + +fn parse_event_range(data: &EventRange) -> Result<(NaiveDateTime, NaiveDateTime), crate::Error> { + let start_date = parse_event_date(&data.start, "start date")?; + + let end_date = if let Some(continuation_token) = &data.continuation_token { + try_parse_date(continuation_token).map_err(|error| { + crate::Error::new( + "Invalid continuation token", + format!("Continuation token is not a valid RFC 3339 date: {error}"), + ) + })? + } else { + parse_event_date(&data.end, "end date")? + }; + + Ok((start_date, end_date)) +} + // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/EventsController.cs#L87 #[get("/organizations//events?")] async fn get_org_events( @@ -44,12 +69,7 @@ async fn get_org_events( // Return an empty vec when we org events are disabled. // This prevents client errors let events_json: Vec = if CONFIG.org_events_enabled() { - let start_date = parse_date(&data.start); - let end_date = if let Some(before_date) = &data.continuation_token { - parse_date(before_date) - } else { - parse_date(&data.end) - }; + let (start_date, end_date) = parse_event_range(&data)?; Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &conn) .await @@ -67,21 +87,70 @@ async fn get_org_events( }))) } +#[derive(Debug, Eq, PartialEq)] +enum CipherEventScope { + Organization(OrganizationId), + Personal, +} + +impl CipherEventScope { + fn includes(&self, event: &Event) -> bool { + match self { + Self::Organization(org_id) => event.org_uuid.as_ref() == Some(org_id), + Self::Personal => event.org_uuid.is_none(), + } + } +} + +fn membership_can_access_event_logs(membership: &Membership) -> bool { + membership.has_status(MembershipStatus::Confirmed) + && (membership.atype >= MembershipType::Admin || membership.has_access_event_logs()) +} + +fn cipher_event_scope(cipher: &Cipher, user_id: &UserId, membership: Option<&Membership>) -> Option { + match &cipher.organization_uuid { + Some(org_id) + if membership.is_some_and(|membership| { + membership.user_uuid == *user_id + && membership.org_uuid == *org_id + && membership_can_access_event_logs(membership) + }) => + { + Some(CipherEventScope::Organization(org_id.clone())) + } + None if cipher.is_owned_by_user(user_id) => Some(CipherEventScope::Personal), + _ => None, + } +} + #[get("/ciphers//events?")] async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Headers, conn: DbConn) -> JsonResult { // Return an empty vec when org events are disabled. // This prevents client errors - let events_json: Vec = if CONFIG.org_events_enabled() - && Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await - { - let start_date = parse_date(&data.start); - let end_date = if let Some(before_date) = &data.continuation_token { - parse_date(before_date) + let events_json: Vec = if CONFIG.org_events_enabled() { + let (start_date, end_date) = parse_event_range(&data)?; + + let scope = if let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await { + let membership = if let Some(org_id) = &cipher.organization_uuid { + Membership::find_by_user_and_org(&headers.user.uuid, org_id, &conn).await + } else { + None + }; + cipher_event_scope(&cipher, &headers.user.uuid, membership.as_ref()) } else { - parse_date(&data.end) + None }; - Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn).await.iter().map(Event::to_json).collect() + if let Some(scope) = scope { + Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn) + .await + .iter() + .filter(|event| scope.includes(event)) + .map(Event::to_json) + .collect() + } else { + Vec::new() + } } else { Vec::new() }; @@ -104,15 +173,11 @@ async fn get_user_events( if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } + // Return an empty vec when we org events are disabled. // This prevents client errors let events_json: Vec = if CONFIG.org_events_enabled() { - let start_date = parse_date(&data.start); - let end_date = if let Some(before_date) = &data.continuation_token { - parse_date(before_date) - } else { - parse_date(&data.end) - }; + let (start_date, end_date) = parse_event_range(&data)?; Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &conn) .await @@ -163,6 +228,48 @@ struct EventCollection { organization_id: Option, } +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +enum ClientEventKind { + User, + Cipher, + Organization, +} + +const MAX_CLIENT_EVENT_BATCH_SIZE: usize = 1_000; + +fn validate_client_event_batch_size(event_count: usize) -> Result<(), crate::Error> { + if event_count > MAX_CLIENT_EVENT_BATCH_SIZE { + return Err(crate::Error::new( + "Event batch is too large", + format!("At most {MAX_CLIENT_EVENT_BATCH_SIZE} events are accepted per request"), + )); + } + Ok(()) +} + +fn client_event_kind(event_type: i32) -> Option { + match event_type { + event_type if event_type == EventType::UserClientExportedVault as i32 => Some(ClientEventKind::User), + event_type + if event_type == EventType::CipherClientViewed as i32 + || event_type == EventType::CipherClientToggledPasswordVisible as i32 + || event_type == EventType::CipherClientToggledHiddenFieldVisible as i32 + || event_type == EventType::CipherClientToggledCardCodeVisible as i32 + || event_type == EventType::CipherClientCopiedPassword as i32 + || event_type == EventType::CipherClientCopiedHiddenField as i32 + || event_type == EventType::CipherClientCopiedCardCode as i32 + || event_type == EventType::CipherClientAutofilled as i32 + || event_type == EventType::CipherClientToggledCardNumberVisible as i32 => + { + Some(ClientEventKind::Cipher) + } + event_type if event_type == EventType::OrganizationClientExportedVault as i32 => { + Some(ClientEventKind::Organization) + } + _ => None, + } +} + // Upstream: // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Events/Controllers/CollectController.cs // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Services/Implementations/EventService.cs @@ -172,10 +279,25 @@ async fn post_events_collect(data: Json>, headers: Headers, return Ok(()); } + // Official clients normally submit small batches (upstream explicitly exercises batches of + // 100). Keep ample headroom while preventing one authenticated request from causing an + // effectively unbounded sequence of database reads and writes under the shared 20 MiB JSON + // limit. + validate_client_event_batch_size(data.len())?; + + // Validate all accepted client events before writing any of them. Unsupported event types are + // ignored, matching upstream, while malformed dates on accepted events produce a controlled + // 400 response instead of panicking after a partially processed batch. + let mut accepted_events = Vec::new(); for event in data.iter() { - let event_date = parse_date(&event.date); - match event.r#type { - 1000..=1099 => { + if let Some(kind) = client_event_kind(event.r#type) { + accepted_events.push((event, kind, parse_event_date(&event.date, "event date")?)); + } + } + + for (event, kind, event_date) in accepted_events { + match kind { + ClientEventKind::User => { log_user_event_impl( event.r#type, &headers.user.uuid, @@ -186,7 +308,7 @@ async fn post_events_collect(data: Json>, headers: Headers, ) .await; } - 1600..=1699 => { + ClientEventKind::Organization => { // Only allow logging events for an organization the user is actually a member of. if let Some(org_id) = &event.organization_id && Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await.is_some() @@ -204,7 +326,7 @@ async fn post_events_collect(data: Json>, headers: Headers, .await; } } - _ => { + ClientEventKind::Cipher => { // The cipher determines the organization the event is logged to, so make sure the // user can actually access it instead of trusting the provided cipher uuid. if let Some(cipher_uuid) = &event.cipher_id @@ -230,6 +352,158 @@ async fn post_events_collect(data: Json>, headers: Headers, Ok(()) } +#[cfg(test)] +mod tests { + use super::*; + + fn membership(member_type: MembershipType, status: MembershipStatus) -> Membership { + let mut membership = Membership::new("test-user".to_owned().into(), "test-org".to_owned().into(), None); + membership.atype = member_type as i32; + membership.status = status as i32; + membership + } + + #[test] + fn cipher_event_access_requires_confirmed_admin_or_access_event_logs() { + for member_type in [MembershipType::Owner, MembershipType::Admin] { + assert!(membership_can_access_event_logs(&membership(member_type, MembershipStatus::Confirmed))); + assert!(!membership_can_access_event_logs(&membership(member_type, MembershipStatus::Invited))); + assert!(!membership_can_access_event_logs(&membership(member_type, MembershipStatus::Accepted))); + assert!(!membership_can_access_event_logs(&membership(member_type, MembershipStatus::Revoked))); + } + + let mut custom = membership(MembershipType::Custom, MembershipStatus::Confirmed); + assert!(!membership_can_access_event_logs(&custom)); + custom.access_event_logs = true; + assert!(membership_can_access_event_logs(&custom)); + + custom.status = MembershipStatus::Revoked as i32; + assert!(!membership_can_access_event_logs(&custom)); + assert!(!membership_can_access_event_logs(&membership(MembershipType::User, MembershipStatus::Confirmed))); + } + + #[test] + fn cipher_event_scope_is_bound_to_cipher_org_or_personal_owner() { + let user_id: UserId = "test-user".to_owned().into(); + let org_id: OrganizationId = "test-org".to_owned().into(); + let mut cipher = Cipher::new(1, "test-cipher".to_owned()); + cipher.organization_uuid = Some(org_id.clone()); + + let admin = membership(MembershipType::Admin, MembershipStatus::Confirmed); + assert_eq!( + cipher_event_scope(&cipher, &user_id, Some(&admin)), + Some(CipherEventScope::Organization(org_id.clone())) + ); + + let accepted_admin = membership(MembershipType::Admin, MembershipStatus::Accepted); + assert_eq!(cipher_event_scope(&cipher, &user_id, Some(&accepted_admin)), None); + + let mut foreign_membership = membership(MembershipType::Admin, MembershipStatus::Confirmed); + foreign_membership.org_uuid = "other-org".to_owned().into(); + assert_eq!(cipher_event_scope(&cipher, &user_id, Some(&foreign_membership)), None); + + cipher.organization_uuid = None; + cipher.user_uuid = Some(user_id.clone()); + assert_eq!(cipher_event_scope(&cipher, &user_id, None), Some(CipherEventScope::Personal)); + assert_eq!(cipher_event_scope(&cipher, &"other-user".to_owned().into(), None), None); + } + + #[test] + fn cipher_event_rows_must_match_the_authorized_scope() { + let org_id: OrganizationId = "test-org".to_owned().into(); + let mut event = Event::new(EventType::CipherClientViewed as i32, None); + + assert!(CipherEventScope::Personal.includes(&event)); + event.org_uuid = Some(org_id.clone()); + assert!(!CipherEventScope::Personal.includes(&event)); + assert!(CipherEventScope::Organization(org_id).includes(&event)); + assert!(!CipherEventScope::Organization("other-org".to_owned().into()).includes(&event)); + } + + #[test] + fn event_range_rejects_invalid_dates_and_continuation_tokens() { + let valid = EventRange { + start: "2026-07-25T10:00:00Z".to_owned(), + end: "2026-07-25T11:00:00Z".to_owned(), + continuation_token: None, + }; + assert!(parse_event_range(&valid).is_ok()); + + let invalid_start = EventRange { + start: "not-a-date".to_owned(), + ..valid + }; + assert!(parse_event_range(&invalid_start).is_err()); + + let invalid_end = EventRange { + start: "2026-07-25T10:00:00Z".to_owned(), + end: "not-a-date".to_owned(), + continuation_token: None, + }; + assert!(parse_event_range(&invalid_end).is_err()); + + let invalid_token = EventRange { + start: "2026-07-25T10:00:00Z".to_owned(), + end: "2026-07-25T11:00:00Z".to_owned(), + continuation_token: Some("not-a-date".to_owned()), + }; + assert!(parse_event_range(&invalid_token).is_err()); + + let token_supersedes_end = EventRange { + start: "2026-07-25T10:00:00Z".to_owned(), + end: "legacy-client-value-that-is-not-used".to_owned(), + continuation_token: Some("2026-07-25T10:30:00Z".to_owned()), + }; + assert!(parse_event_range(&token_supersedes_end).is_ok()); + } + + #[test] + fn collect_accepts_only_official_client_generated_event_types() { + assert_eq!(client_event_kind(EventType::UserClientExportedVault as i32), Some(ClientEventKind::User)); + for event_type in [ + EventType::CipherClientViewed, + EventType::CipherClientToggledPasswordVisible, + EventType::CipherClientToggledHiddenFieldVisible, + EventType::CipherClientToggledCardCodeVisible, + EventType::CipherClientCopiedPassword, + EventType::CipherClientCopiedHiddenField, + EventType::CipherClientCopiedCardCode, + EventType::CipherClientAutofilled, + EventType::CipherClientToggledCardNumberVisible, + ] { + assert_eq!(client_event_kind(event_type as i32), Some(ClientEventKind::Cipher)); + } + assert_eq!( + client_event_kind(EventType::OrganizationClientExportedVault as i32), + Some(ClientEventKind::Organization) + ); + + for event_type in [ + EventType::UserLoggedIn, + EventType::UserChangedPassword, + EventType::CipherCreated, + EventType::CipherUpdated, + EventType::CipherDeleted, + EventType::OrganizationUpdated, + EventType::OrganizationPurgedVault, + EventType::PolicyUpdated, + ] { + assert_eq!(client_event_kind(event_type as i32), None); + } + assert_eq!(client_event_kind(1099), None); + assert_eq!(client_event_kind(1199), None); + assert_eq!(client_event_kind(1699), None); + } + + #[test] + fn collect_batch_limit_preserves_normal_batches_and_rejects_excess() { + assert!(validate_client_event_batch_size(0).is_ok()); + assert!(validate_client_event_batch_size(100).is_ok()); + assert!(validate_client_event_batch_size(MAX_CLIENT_EVENT_BATCH_SIZE).is_ok()); + assert!(validate_client_event_batch_size(MAX_CLIENT_EVENT_BATCH_SIZE + 1).is_err()); + } +} + pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) { if !CONFIG.org_events_enabled() { return; diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 50754dd8..7d05787c 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -564,26 +564,25 @@ async fn post_organization_collections( let collection = Collection::new(org_id.clone(), data.name, data.external_id); collection.save(&conn).await?; - log_event( - EventType::CollectionCreated as i32, - &collection.uuid, - &org_id, - &headers.user.uuid, - headers.device.atype, - &headers.ip.ip, - &conn, - ) - .await; - // Security (F-3): a `manage` grant carries collection *delete*/administer authority // (`has_explicit_collection_manage_access` -> CollectionDeleteHeaders/ManagerHeaders), so only a // caller who could delete this collection may confer it — the same rule the collection-update and // bulk-access endpoints apply. Create is deliberately independent from Edit/Delete, so a Custom // member holding only `create_new_collections` must not be able to hand a manage row to another - // member or to a group (nor to itself) while creating the collection. For such callers the - // requested `manage` is forced to false; Admin/Owner and Custom-with-`delete_any_collection` - // keep it. Evaluated after the collection exists so the per-collection lookup sees it. + // member or to a group while creating the collection. For such callers the requested `manage` + // is forced to false; Admin/Owner and Custom-with-`delete_any_collection` keep it. The creator's + // own object-scoped ownership is added separately below. Evaluated after the collection exists + // so the per-collection lookup sees it. let may_grant_manage = caller_may_grant_collection_manage(&headers.membership, &collection.uuid, &conn).await; + let creator_needs_assignment = !headers.membership.has_full_access(); + + // Persist the creator's object-scoped ownership before secondary assignments. If a later + // assignment write fails, the otherwise non-transactional create path still leaves the new + // collection recoverably manageable by its creator. An explicit self-assignment below is + // skipped so it cannot weaken this grant. + if creator_needs_assignment { + CollectionUser::save(&headers.membership.user_uuid, &collection.uuid, false, false, true, &conn).await?; + } for group in data.groups { CollectionGroup::new( @@ -605,6 +604,9 @@ async fn post_organization_collections( if member.grants_access_to_all_collections() { continue; } + if member.user_uuid == headers.membership.user_uuid && creator_needs_assignment { + continue; + } CollectionUser::save( &member.user_uuid, @@ -617,6 +619,19 @@ async fn post_organization_collections( .await?; } + // Emit the success event only after all requested assignments and the creator's object-scoped + // manage grant have been persisted. A later write failure must not leave a false audit record. + log_event( + EventType::CollectionCreated as i32, + &collection.uuid, + &org_id, + &headers.user.uuid, + headers.device.atype, + &headers.ip.ip, + &conn, + ) + .await; + Ok(Json(collection.to_json_details(&headers.membership.user_uuid, None, &conn).await)) } @@ -1139,10 +1154,6 @@ async fn get_members( err!("Organization not found", "Organization id's do not match"); } - if !headers.membership.has_full_access() { - err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code); - } - let mut users_json = Vec::new(); for u in Membership::find_by_org(&org_id, &conn).await { users_json.push( @@ -1226,7 +1237,9 @@ impl CustomRolePermissions { delete_any_collection: enabled("deleteAnyCollection"), access_event_logs: enabled("accessEventLogs"), access_import_export: enabled("accessImportExport"), - access_reports: enabled("accessReports"), + // Vaultwarden has no report endpoints yet. Keep the compatibility field in the + // database/DTO, but never accept a permission that cannot be enforced server-side. + access_reports: false, } } @@ -1238,6 +1251,34 @@ impl CustomRolePermissions { member_type >= MembershipType::Admin || (member_type == MembershipType::Custom && self.edit_any_collection) } + /// Parse permissions for an existing member without treating an omitted permissions object as + /// an instruction to clear every Custom-role grant. Older clients send legacy role value `3` + /// without the modern object; that value is normalized to Custom for compatibility. + fn from_edit_request( + member_type: MembershipType, + permissions: Option<&HashMap>, + membership: &Membership, + ) -> Self { + match permissions { + Some(permissions) => Self::from_request(member_type, permissions), + None if member_type == MembershipType::Custom && membership.atype == MembershipType::Custom as i32 => { + Self { + manage_users: membership.manage_users, + manage_groups: membership.manage_groups, + manage_policies: membership.manage_policies, + create_new_collections: membership.create_new_collections, + edit_any_collection: membership.edit_any_collection, + delete_any_collection: membership.delete_any_collection, + access_event_logs: membership.access_event_logs, + access_import_export: membership.access_import_export, + // Reports are unsupported and therefore never preserved as an active grant. + access_reports: false, + } + } + None => Self::default(), + } + } + fn differs_from(self, membership: &Membership) -> bool { self.manage_users != membership.manage_users || self.manage_groups != membership.manage_groups @@ -1247,7 +1288,6 @@ impl CustomRolePermissions { || self.delete_any_collection != membership.delete_any_collection || self.access_event_logs != membership.access_event_logs || self.access_import_export != membership.access_import_export - || self.access_reports != membership.access_reports } fn apply_to(self, membership: &mut Membership) { @@ -1310,8 +1350,8 @@ async fn send_invite( err!("Invalid type") }; - if new_type != MembershipType::User && headers.membership_type != MembershipType::Owner { - err!("Only Owners can invite Admins, Owners or Custom members") + if !may_manage_member_type(headers.membership_type, new_type) { + err!("You don't have permission to invite this role") } // manageAllCollections is a client-only aggregate. Persist its three children independently. @@ -1487,7 +1527,7 @@ async fn bulk_reinvite_members( let mut bulk_response = Vec::new(); for member_id in data.ids { - let err_msg = match reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn).await { + let err_msg = match reinvite_member_impl(&org_id, &member_id, &headers, &conn).await { Ok(()) => String::new(), Err(e) => format!("{e:?}"), }; @@ -1518,19 +1558,23 @@ async fn reinvite_member( if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); } - reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn).await + reinvite_member_impl(&org_id, &member_id, &headers, &conn).await } async fn reinvite_member_impl( org_id: &OrganizationId, member_id: &MembershipId, - invited_by_email: &str, + headers: &ManageUsersHeaders, conn: &DbConn, ) -> EmptyResult { let Some(member) = Membership::find_by_uuid_and_org(member_id, org_id, conn).await else { err!("The user hasn't been invited to the organization.") }; + if !may_manage_stored_member_type(headers.membership_type, member.atype) { + err!("You don't have permission to reinvite this user") + } + if member.status != MembershipStatus::Invited as i32 { err!("The user is already accepted or confirmed to the organization") } @@ -1550,7 +1594,7 @@ async fn reinvite_member_impl( }; if CONFIG.mail_enabled() { - mail::send_invite(&user, org_id.clone(), member.uuid, &org_name, Some(invited_by_email.to_owned())).await?; + mail::send_invite(&user, org_id.clone(), member.uuid, &org_name, Some(headers.user.email.clone())).await?; } else if user.password_hash.is_empty() { let invitation = Invitation::new(&user.email); invitation.save(conn).await?; @@ -1715,8 +1759,8 @@ async fn confirm_invite_impl( err!("The specified user isn't a member of the organization") }; - if member_to_confirm.atype != MembershipType::User && headers.membership_type != MembershipType::Owner { - err!("Only Owners can confirm Admins, Owners or Custom members") + if !may_manage_stored_member_type(headers.membership_type, member_to_confirm.atype) { + err!("You don't have permission to confirm this user") } if member_to_confirm.status != MembershipStatus::Accepted as i32 { @@ -1807,8 +1851,7 @@ struct EditUserData { r#type: NumberOrString, collections: Option>, groups: Option>, - #[serde(default)] - permissions: HashMap, + permissions: Option>, } #[put("/organizations//users/", data = "", rank = 1)] @@ -1840,13 +1883,14 @@ async fn edit_member( err!("Invalid type") }; - let custom_permissions = CustomRolePermissions::from_request(new_type, &data.permissions); - let grants_full_access = custom_permissions.grants_full_collection_access(new_type); - let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else { err!("The specified user isn't member of the organization") }; + let custom_permissions = + CustomRolePermissions::from_edit_request(new_type, data.permissions.as_ref(), &member_to_edit); + let grants_full_access = custom_permissions.grants_full_collection_access(new_type); + if new_type != member_to_edit.atype && (member_to_edit.atype >= MembershipType::Admin || new_type >= MembershipType::Admin) && headers.membership_type != MembershipType::Owner @@ -1855,13 +1899,12 @@ async fn edit_member( } // Security: only Admins and Owners may change a member's role type at all. A Custom member - // with manage_users must not change roles: raising a member to Custom grants collection-"manage" - // on every collection they can already write (see the `atype >= Custom` branch in - // `Collection`/`Membership` json), and lowering it revokes that access — both are collection- - // access changes this caller is not entitled to make, even though the custom permission flags - // are already gated below. Requests that leave the role unchanged are allowed, so such members - // can still use the regular edit dialog. The Admin/Owner guard above still governs Admin/Owner - // transitions for Owners. + // with manage_users must not change roles: raising a member to Custom can activate existing + // explicit collection-Manage assignments and other Custom-only authorization paths, while + // lowering it revokes them. Those authority changes are outside Manage Users even though + // granular permission changes are independently gated below. Requests that leave the role + // unchanged are allowed, so such members can still use the regular edit dialog. The + // Admin/Owner guard above still governs Admin/Owner transitions for Owners. if !may_change_member_type(headers.membership_type, member_to_edit.atype, new_type) { err!("Only Admins or Owners can change a member's role") } @@ -2081,8 +2124,8 @@ async fn delete_member_impl( err!("User to delete isn't member of the organization") }; - if member_to_delete.atype != MembershipType::User && headers.membership_type != MembershipType::Owner { - err!("Only Owners can delete Admins or Owners") + if !may_manage_stored_member_type(headers.membership_type, member_to_delete.atype) { + err!("You don't have permission to delete this user") } if member_to_delete.atype == MembershipType::Owner && member_to_delete.status == MembershipStatus::Confirmed as i32 @@ -2751,15 +2794,9 @@ async fn revoke_member_impl( if member.user_uuid == headers.user.uuid { err!("You cannot revoke yourself") } - // Security: a Custom user with manage_users must not be able to revoke Admins or - // Owners. Mirrors the restriction in delete_member_impl; the Owner-specific check - // below still guards Admin-vs-Owner actions. - if member.atype != MembershipType::User && headers.membership_type < MembershipType::Admin { + if !may_manage_stored_member_type(headers.membership_type, member.atype) { err!("You don't have permission to revoke this user") } - if member.atype == MembershipType::Owner && headers.membership_type != MembershipType::Owner { - err!("Only owners can revoke other owners") - } if member.atype == MembershipType::Owner && Membership::count_confirmed_by_org_and_type(org_id, MembershipType::Owner, conn).await <= 1 { @@ -2857,15 +2894,9 @@ async fn restore_member_impl( if member.user_uuid == headers.user.uuid { err!("You cannot restore yourself") } - // Security: a Custom user with manage_users must not be able to restore Admins or - // Owners. Mirrors the restriction in delete_member_impl; the Owner-specific check - // below still guards Admin-vs-Owner actions. - if member.atype != MembershipType::User && headers.membership_type < MembershipType::Admin { + if !may_manage_stored_member_type(headers.membership_type, member.atype) { err!("You don't have permission to restore this user") } - if member.atype == MembershipType::Owner && headers.membership_type != MembershipType::Owner { - err!("Only owners can restore other owners") - } member.restore(); // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type @@ -3179,17 +3210,32 @@ fn may_change_group_membership(caller_can_manage_collections: bool, group_confer /// Whether a caller of `edit_member` may change a member's role type. /// /// Only Admins and Owners may change a member's role at all. A Custom member with `manage_users` -/// must not, because the role type has collection-access side effects: a member of type -/// `Manager`/`Custom` gains collection-"manage" on every collection they can write (the -/// `atype >= Manager` branches in `Collection`/`Membership`), so promoting grants that access and -/// demoting revokes it. `manage_users` covers the user lifecycle, not the data plane, so role -/// changes are reserved for Admins/Owners. Leaving the role unchanged is always allowed so +/// must not, because the role type changes organization-wide collection reach and which granular +/// permissions are effective. `manage_users` covers the user lifecycle, not the data plane, so +/// role changes are reserved for Admins/Owners. Leaving the role unchanged is always allowed so /// `manage_users` members can still use the regular edit dialog. Admin/Owner transitions are /// additionally governed by the dedicated Owner-only guard in `edit_member`. fn may_change_member_type(caller_type: MembershipType, current_atype: i32, new_type: MembershipType) -> bool { caller_type >= MembershipType::Admin || new_type == current_atype } +/// Whether a caller with user-management access may perform lifecycle actions on a target role. +/// +/// Owners may manage every role. Admins may manage Admin, Custom, and User memberships, but never +/// Owners. Custom members holding `manage_users` are limited to ordinary Users. +fn may_manage_member_type(caller_type: MembershipType, target_type: MembershipType) -> bool { + match caller_type { + MembershipType::Owner => true, + MembershipType::Admin => target_type != MembershipType::Owner, + MembershipType::Custom => target_type == MembershipType::User, + MembershipType::User => false, + } +} + +fn may_manage_stored_member_type(caller_type: MembershipType, target_atype: i32) -> bool { + MembershipType::from_i32(target_atype).is_some_and(|target_type| may_manage_member_type(caller_type, target_type)) +} + /// Returns true if being a member of `group_id` confers collection access — either because the /// group has `access_all` set, or because it has collections assigned. async fn group_confers_collection_access(group_id: &GroupId, org_id: &OrganizationId, conn: &DbConn) -> bool { @@ -3965,7 +4011,8 @@ mod tests { use super::{ CustomRolePermissions, caller_manage_grant_role_check, filter_ciphers_for_organization, - may_change_group_membership, may_change_member_type, may_export_entire_organization, + may_change_group_membership, may_change_member_type, may_export_entire_organization, may_manage_member_type, + may_manage_stored_member_type, }; use crate::db::models::{Cipher, Membership, MembershipStatus, MembershipType, OrganizationId}; @@ -4072,13 +4119,39 @@ mod tests { assert!(may_change_member_type(MembershipType::Custom, custom, MembershipType::Custom)); // REGRESSION (privilege escalation, PR #7397 / finding F1): a caller below Admin must NOT - // be able to change a member's role. Promoting User -> Custom grants that member - // collection-"manage" on their writable collections (atype >= Custom), and demoting - // revokes it — collection-access changes a manage_users caller is not entitled to make. + // be able to change a member's role. Promoting User -> Custom can activate explicit + // collection-Manage assignments and Custom-only authorization paths; demoting revokes + // them. A manage_users caller is not entitled to either authority change. assert!(!may_change_member_type(MembershipType::Custom, user, MembershipType::Custom)); assert!(!may_change_member_type(MembershipType::Custom, custom, MembershipType::User)); } + #[test] + fn member_lifecycle_permissions_follow_the_role_hierarchy() { + let roles = [MembershipType::Owner, MembershipType::Admin, MembershipType::Custom, MembershipType::User]; + + for target in roles { + assert!(may_manage_member_type(MembershipType::Owner, target)); + } + + assert!(!may_manage_member_type(MembershipType::Admin, MembershipType::Owner)); + assert!(may_manage_member_type(MembershipType::Admin, MembershipType::Admin)); + assert!(may_manage_member_type(MembershipType::Admin, MembershipType::Custom)); + assert!(may_manage_member_type(MembershipType::Admin, MembershipType::User)); + + assert!(!may_manage_member_type(MembershipType::Custom, MembershipType::Owner)); + assert!(!may_manage_member_type(MembershipType::Custom, MembershipType::Admin)); + assert!(!may_manage_member_type(MembershipType::Custom, MembershipType::Custom)); + assert!(may_manage_member_type(MembershipType::Custom, MembershipType::User)); + + for target in roles { + assert!(!may_manage_member_type(MembershipType::User, target)); + } + + assert!(may_manage_stored_member_type(MembershipType::Admin, MembershipType::Custom as i32)); + assert!(!may_manage_stored_member_type(MembershipType::Owner, i32::MAX)); + } + #[test] fn manage_groups_caller_cannot_grant_collection_access_via_groups() { // A caller who can manage collections may change membership of any group. @@ -4141,7 +4214,7 @@ mod tests { assert!(custom.delete_any_collection); assert!(custom.access_event_logs); assert!(custom.access_import_export); - assert!(custom.access_reports); + assert!(!custom.access_reports, "unsupported report access must remain fail-closed"); let user = CustomRolePermissions::from_request(MembershipType::User, &permissions); assert_eq!(user, CustomRolePermissions::default()); @@ -4164,7 +4237,6 @@ mod tests { delete_any_collection: true, access_event_logs: true, access_import_export: true, - access_reports: true, ..CustomRolePermissions::default() }; @@ -4176,6 +4248,45 @@ mod tests { assert!(membership.delete_any_collection); assert!(membership.access_event_logs); assert!(membership.access_import_export); - assert!(membership.access_reports); + assert!(!membership.access_reports); + } + + #[test] + fn omitted_edit_permissions_preserve_supported_custom_grants() { + let mut membership = confirmed_member(MembershipType::Custom); + membership.manage_users = true; + membership.manage_groups = true; + membership.manage_policies = true; + membership.create_new_collections = true; + membership.edit_any_collection = true; + membership.delete_any_collection = true; + membership.access_event_logs = true; + membership.access_import_export = true; + membership.access_reports = true; + + let preserved = CustomRolePermissions::from_edit_request(MembershipType::Custom, None, &membership); + assert!(preserved.manage_users); + assert!(preserved.manage_groups); + assert!(preserved.manage_policies); + assert!(preserved.create_new_collections); + assert!(preserved.edit_any_collection); + assert!(preserved.delete_any_collection); + assert!(preserved.access_event_logs); + assert!(preserved.access_import_export); + assert!(!preserved.access_reports); + assert!( + !preserved.differs_from(&membership), + "a stale unsupported reports bit must not block an otherwise unchanged legacy-client update" + ); + + let explicit_reset = HashMap::new(); + assert_eq!( + CustomRolePermissions::from_edit_request(MembershipType::Custom, Some(&explicit_reset), &membership), + CustomRolePermissions::default() + ); + assert_eq!( + CustomRolePermissions::from_edit_request(MembershipType::User, None, &membership), + CustomRolePermissions::default() + ); } } diff --git a/src/db/mod.rs b/src/db/mod.rs index 2eae3f3c..4f57147b 100644 --- a/src/db/mod.rs +++ b/src/db/mod.rs @@ -468,6 +468,169 @@ impl<'r> FromRequest<'r> for DbConn { } } +const CUSTOM_ROLE_REPAIR_MIGRATION: &str = "20260723120000"; +const CUSTOM_COLLECTION_PERMISSIONS_MIGRATION: &str = "20260716120000"; +const DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION: &str = "20260724120000"; +const CUSTOM_ROLE_SAME_RUN_MARKER_TABLE: &str = "__vw_custom_role_same_run_0716"; +const CUSTOM_ROLE_MIGRATION_RECOVERY_DOC: &str = "docs/custom-role-migration-recovery.md"; + +#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)] +#[expect( + clippy::struct_excessive_bools, + reason = "These are independent facts read from a historical database schema and migration ledger" +)] +struct CustomRoleMigrationFacts { + memberships_table_exists: bool, + migration_table_exists: bool, + access_all_column_exists: bool, + collection_permission_columns: i64, + collection_permissions_migration_applied: bool, + repair_migration_applied: bool, + access_all_drop_migration_applied: bool, + legacy_user_access_all_count: i64, + ambiguous_direct_permission_count: i64, + same_run_0716_marker: bool, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +enum CustomRolePreflightDecision { + Proceed, + CompleteMysqlCollectionMigration, + RefuseAlreadyDropped, + RefuseMissingAccessAll, + RefuseMissingMigrationLedger, + RefuseLegacyUserAccessAll, + RefuseAmbiguousDirectPermissions, + RefusePartialCollectionSchema, + RefuseCollectionLedgerMismatch, +} + +fn custom_role_preflight_decision( + facts: CustomRoleMigrationFacts, + can_complete_mysql_partial_migration: bool, +) -> CustomRolePreflightDecision { + if !facts.memberships_table_exists || facts.repair_migration_applied { + return CustomRolePreflightDecision::Proceed; + } + if !facts.migration_table_exists { + return CustomRolePreflightDecision::RefuseMissingMigrationLedger; + } + + // Once access_all has been dropped, its former value and the provenance of 0/1/1 + // collection permissions can no longer be reconstructed. Never guess at either. + if facts.access_all_drop_migration_applied { + return CustomRolePreflightDecision::RefuseAlreadyDropped; + } + if !facts.access_all_column_exists { + return CustomRolePreflightDecision::RefuseMissingAccessAll; + } + + if facts.legacy_user_access_all_count != 0 { + return CustomRolePreflightDecision::RefuseLegacyUserAccessAll; + } + if facts.ambiguous_direct_permission_count != 0 && !facts.same_run_0716_marker { + return CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions; + } + + match (facts.collection_permission_columns, facts.collection_permissions_migration_applied) { + (0, false) | (3, true) => CustomRolePreflightDecision::Proceed, + (3, false) if can_complete_mysql_partial_migration => { + CustomRolePreflightDecision::CompleteMysqlCollectionMigration + } + (_, true) => CustomRolePreflightDecision::RefuseCollectionLedgerMismatch, + _ => CustomRolePreflightDecision::RefusePartialCollectionSchema, + } +} + +fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: CustomRoleMigrationFacts) -> Error { + let detail = match decision { + CustomRolePreflightDecision::RefuseAlreadyDropped => format!( + "The membership access_all column was already dropped by migration \ + {DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION}, but the required repair migration \ + {CUSTOM_ROLE_REPAIR_MIGRATION} is not recorded. The former permission values cannot \ + be reconstructed safely." + ), + CustomRolePreflightDecision::RefuseMissingAccessAll => format!( + "The membership access_all column is missing before repair migration \ + {CUSTOM_ROLE_REPAIR_MIGRATION}; refusing to infer deleted permissions." + ), + CustomRolePreflightDecision::RefuseMissingMigrationLedger => { + "The users_organizations table exists, but the Diesel migration ledger does not. \ + Refusing to guess which schema and data migrations were previously applied." + .to_owned() + } + CustomRolePreflightDecision::RefuseLegacyUserAccessAll => format!( + "{} legacy User membership(s) still have membership access_all=true. Mapping these \ + records to Custom/EditAny would add management authority, while clearing the bit \ + would remove existing vault access.", + facts.legacy_user_access_all_count + ), + CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions => format!( + "Found {} membership(s) with an ambiguous 0/1/1 collection-permission pattern. It is \ + not possible to distinguish an older group-derived backfill from an intentional \ + direct Edit+Delete assignment.", + facts.ambiguous_direct_permission_count + ), + CustomRolePreflightDecision::RefusePartialCollectionSchema => format!( + "Found {} of the three custom collection-permission columns without a completed \ + {CUSTOM_COLLECTION_PERMISSIONS_MIGRATION} migration. This is not an automatically \ + recoverable state for this database backend.", + facts.collection_permission_columns + ), + CustomRolePreflightDecision::RefuseCollectionLedgerMismatch => format!( + "Migration {CUSTOM_COLLECTION_PERMISSIONS_MIGRATION} is recorded, but only {} of its \ + three collection-permission columns exist.", + facts.collection_permission_columns + ), + CustomRolePreflightDecision::Proceed | CustomRolePreflightDecision::CompleteMysqlCollectionMigration => { + unreachable!("successful preflight decisions do not produce errors") + } + }; + + std::io::Error::other(format!( + "Custom-role migration preflight stopped startup: {detail} Back up the database and follow \ + {CUSTOM_ROLE_MIGRATION_RECOVERY_DOC}." + )) + .into() +} + +#[cfg(any(mysql, test))] +fn mysql_partial_unexpected_values_query(allow_same_run_group_derived: bool) -> String { + let same_run_group_derived = if allow_same_run_group_derived { + " OR \ + (atype = 4 \ + AND access_all = FALSE \ + AND create_new_collections = FALSE \ + AND edit_any_collection = TRUE \ + AND delete_any_collection = TRUE \ + AND EXISTS ( \ + SELECT 1 \ + FROM groups_users AS gu \ + INNER JOIN `groups` AS g ON g.uuid = gu.groups_uuid \ + WHERE gu.users_organizations_uuid = users_organizations.uuid \ + AND g.organizations_uuid = users_organizations.org_uuid \ + AND g.access_all = TRUE \ + ))" + } else { + "" + }; + + format!( + "SELECT COUNT(*) AS count FROM users_organizations \ + WHERE NOT ( \ + (create_new_collections = FALSE \ + AND edit_any_collection = FALSE \ + AND delete_any_collection = FALSE) \ + OR \ + (atype = 4 \ + AND create_new_collections = access_all \ + AND edit_any_collection = access_all \ + AND delete_any_collection = access_all) \ + {same_run_group_derived} \ + )" + ) +} + // Embed the migrations from the migrations folder into the application // This way, the program automatically migrates the database to the latest version // https://docs.rs/diesel_migrations/*/diesel_migrations/macro.embed_migrations.html @@ -477,11 +640,130 @@ mod sqlite_migrations { use diesel_migrations::{EmbeddedMigrations, MigrationHarness}; pub const MIGRATIONS: EmbeddedMigrations = embed_migrations!("migrations/sqlite"); + #[derive(diesel::QueryableByName)] + struct Count { + #[diesel(sql_type = diesel::sql_types::BigInt)] + count: i64, + } + + fn count( + connection: &mut diesel::sqlite::SqliteConnection, + query: impl Into, + ) -> Result { + diesel::sql_query(query).get_result::(connection).map(|row| row.count) + } + + fn table_exists( + connection: &mut diesel::sqlite::SqliteConnection, + table: &str, + ) -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM sqlite_master \ + WHERE type = 'table' AND name = '{table}'" + ), + ) + .map(|value| value != 0) + } + + fn migration_applied( + connection: &mut diesel::sqlite::SqliteConnection, + version: &str, + ) -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM __diesel_schema_migrations \ + WHERE version = '{version}'" + ), + ) + .map(|value| value != 0) + } + + fn preflight(connection: &mut diesel::sqlite::SqliteConnection) -> Result<(), super::Error> { + let memberships_table_exists = table_exists(connection, "users_organizations")?; + if !memberships_table_exists { + return Ok(()); + } + + let migration_table_exists = table_exists(connection, "__diesel_schema_migrations")?; + let access_all_column_exists = count( + connection, + "SELECT COUNT(*) AS count FROM pragma_table_info('users_organizations') \ + WHERE name = 'access_all'", + )? != 0; + let collection_permission_columns = count( + connection, + "SELECT COUNT(*) AS count FROM pragma_table_info('users_organizations') \ + WHERE name IN ('create_new_collections', 'edit_any_collection', 'delete_any_collection')", + )?; + + let collection_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION)?; + let repair_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_REPAIR_MIGRATION)?; + let access_all_drop_migration_applied = + migration_table_exists && migration_applied(connection, super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION)?; + let same_run_marker_table_exists = table_exists(connection, super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE)?; + let same_run_0716_marker = same_run_marker_table_exists + && count( + connection, + format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), + )? != 0; + + let legacy_user_access_all_count = if access_all_column_exists { + count( + connection, + "SELECT COUNT(*) AS count FROM users_organizations \ + WHERE atype = 2 AND access_all = TRUE", + )? + } else { + 0 + }; + + let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { + count( + connection, + "SELECT COUNT(*) AS count FROM users_organizations \ + WHERE atype IN (3, 4) \ + AND access_all = FALSE \ + AND create_new_collections = FALSE \ + AND edit_any_collection = TRUE \ + AND delete_any_collection = TRUE", + )? + } else { + 0 + }; + + let facts = super::CustomRoleMigrationFacts { + memberships_table_exists, + migration_table_exists, + access_all_column_exists, + collection_permission_columns, + collection_permissions_migration_applied, + repair_migration_applied, + access_all_drop_migration_applied, + legacy_user_access_all_count, + ambiguous_direct_permission_count, + same_run_0716_marker, + }; + + let decision = super::custom_role_preflight_decision(facts, false); + if decision == super::CustomRolePreflightDecision::Proceed { + Ok(()) + } else { + Err(super::custom_role_preflight_error(decision, facts)) + } + } + pub fn run_migrations(db_url: &str) -> Result<(), super::Error> { // Establish a connection to the sqlite database (this will create a new one, if it does // not exist, and exit if there is an error). let mut connection = diesel::sqlite::SqliteConnection::establish(db_url)?; + preflight(&mut connection)?; + // Run the migrations after successfully establishing a connection // Disable Foreign Key Checks during migration // Scoped to a connection. @@ -505,10 +787,194 @@ mod mysql_migrations { use diesel_migrations::{EmbeddedMigrations, MigrationHarness}; pub const MIGRATIONS: EmbeddedMigrations = embed_migrations!("migrations/mysql"); + #[derive(diesel::QueryableByName)] + struct Count { + #[diesel(sql_type = diesel::sql_types::BigInt)] + count: i64, + } + + fn count( + connection: &mut diesel::mysql::MysqlConnection, + query: impl Into, + ) -> Result { + diesel::sql_query(query).get_result::(connection).map(|row| row.count) + } + + fn table_exists( + connection: &mut diesel::mysql::MysqlConnection, + table: &str, + ) -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM information_schema.tables \ + WHERE table_schema = DATABASE() AND table_name = '{table}'" + ), + ) + .map(|value| value != 0) + } + + fn migration_applied( + connection: &mut diesel::mysql::MysqlConnection, + version: &str, + ) -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM __diesel_schema_migrations \ + WHERE version = '{version}'" + ), + ) + .map(|value| value != 0) + } + + fn complete_partial_collection_migration( + connection: &mut diesel::mysql::MysqlConnection, + allow_same_run_group_derived: bool, + ) -> Result<(), super::Error> { + // MySQL implicitly committed the three historical ALTER TABLE statements before the + // unquoted `groups` identifier made the migration fail. Complete that exact, known state + // without dropping columns or inventing values. + let matching_column_definitions = count( + connection, + "SELECT COUNT(*) AS count FROM information_schema.columns \ + WHERE table_schema = DATABASE() \ + AND table_name = 'users_organizations' \ + AND column_name IN \ + ('create_new_collections', 'edit_any_collection', 'delete_any_collection') \ + AND data_type = 'tinyint' \ + AND is_nullable = 'NO' \ + AND LOWER(COALESCE(CAST(column_default AS CHAR), '')) IN ('0', 'false')", + )?; + let unexpected_values = + count(connection, super::mysql_partial_unexpected_values_query(allow_same_run_group_derived))?; + + if matching_column_definitions != 3 || unexpected_values != 0 { + return Err(std::io::Error::other(format!( + "Custom-role migration preflight found the historical MySQL partial \ + {version} schema, but its column definitions or data were modified \ + (matching columns: {matching_column_definitions}/3, unexpected rows: \ + {unexpected_values}). Refusing automatic recovery. Back up the database and \ + follow {doc}.", + version = super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION, + doc = super::CUSTOM_ROLE_MIGRATION_RECOVERY_DOC, + )) + .into()); + } + + connection.transaction::<(), diesel::result::Error, _>(|connection| { + // This is the first data statement from the canonical migration. It also resets an + // exact, same-run group-derived 0/1/1 row to 0/0/0; that authority remains dynamically + // derived from the group, and the separate 07-23 repair then reconciles the role. + diesel::sql_query( + "UPDATE users_organizations \ + SET create_new_collections = access_all, \ + edit_any_collection = access_all, \ + delete_any_collection = access_all \ + WHERE atype = 4", + ) + .execute(connection)?; + + diesel::sql_query(format!( + "INSERT INTO __diesel_schema_migrations (version) \ + VALUES ('{}')", + super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION + )) + .execute(connection)?; + Ok(()) + })?; + + Ok(()) + } + + fn preflight(connection: &mut diesel::mysql::MysqlConnection) -> Result<(), super::Error> { + let memberships_table_exists = table_exists(connection, "users_organizations")?; + if !memberships_table_exists { + return Ok(()); + } + + let migration_table_exists = table_exists(connection, "__diesel_schema_migrations")?; + let access_all_column_exists = count( + connection, + "SELECT COUNT(*) AS count FROM information_schema.columns \ + WHERE table_schema = DATABASE() \ + AND table_name = 'users_organizations' \ + AND column_name = 'access_all'", + )? != 0; + let collection_permission_columns = count( + connection, + "SELECT COUNT(*) AS count FROM information_schema.columns \ + WHERE table_schema = DATABASE() \ + AND table_name = 'users_organizations' \ + AND column_name IN \ + ('create_new_collections', 'edit_any_collection', 'delete_any_collection')", + )?; + + let collection_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION)?; + let repair_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_REPAIR_MIGRATION)?; + let access_all_drop_migration_applied = + migration_table_exists && migration_applied(connection, super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION)?; + let same_run_marker_table_exists = table_exists(connection, super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE)?; + let same_run_0716_marker = same_run_marker_table_exists + && count( + connection, + format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), + )? != 0; + + let legacy_user_access_all_count = if access_all_column_exists { + count( + connection, + "SELECT COUNT(*) AS count FROM users_organizations \ + WHERE atype = 2 AND access_all = TRUE", + )? + } else { + 0 + }; + + let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { + count( + connection, + "SELECT COUNT(*) AS count FROM users_organizations \ + WHERE atype IN (3, 4) \ + AND access_all = FALSE \ + AND create_new_collections = FALSE \ + AND edit_any_collection = TRUE \ + AND delete_any_collection = TRUE", + )? + } else { + 0 + }; + + let facts = super::CustomRoleMigrationFacts { + memberships_table_exists, + migration_table_exists, + access_all_column_exists, + collection_permission_columns, + collection_permissions_migration_applied, + repair_migration_applied, + access_all_drop_migration_applied, + legacy_user_access_all_count, + ambiguous_direct_permission_count, + same_run_0716_marker, + }; + + match super::custom_role_preflight_decision(facts, true) { + super::CustomRolePreflightDecision::Proceed => Ok(()), + super::CustomRolePreflightDecision::CompleteMysqlCollectionMigration => { + complete_partial_collection_migration(connection, same_run_0716_marker) + } + decision => Err(super::custom_role_preflight_error(decision, facts)), + } + } + pub fn run_migrations(db_url: &str) -> Result<(), super::Error> { // Make sure the database is up to date (create if it doesn't exist, or run the migrations) let mut connection = diesel::mysql::MysqlConnection::establish(db_url)?; + preflight(&mut connection)?; + // Disable Foreign Key Checks during migration // Scoped to a connection/session. diesel::sql_query("SET FOREIGN_KEY_CHECKS = 0") @@ -522,15 +988,315 @@ mod mysql_migrations { #[cfg(postgresql)] mod postgresql_migrations { - use diesel::Connection; + use diesel::{Connection, RunQueryDsl}; use diesel_migrations::{EmbeddedMigrations, MigrationHarness}; pub const MIGRATIONS: EmbeddedMigrations = embed_migrations!("migrations/postgresql"); + #[derive(diesel::QueryableByName)] + struct Count { + #[diesel(sql_type = diesel::sql_types::BigInt)] + count: i64, + } + + fn count( + connection: &mut diesel::pg::PgConnection, + query: impl Into, + ) -> Result { + diesel::sql_query(query).get_result::(connection).map(|row| row.count) + } + + fn table_exists(connection: &mut diesel::pg::PgConnection, table: &str) -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM information_schema.tables \ + WHERE table_schema = current_schema() AND table_name = '{table}'" + ), + ) + .map(|value| value != 0) + } + + fn migration_applied( + connection: &mut diesel::pg::PgConnection, + version: &str, + ) -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM __diesel_schema_migrations \ + WHERE version = '{version}'" + ), + ) + .map(|value| value != 0) + } + + fn preflight(connection: &mut diesel::pg::PgConnection) -> Result<(), super::Error> { + let memberships_table_exists = table_exists(connection, "users_organizations")?; + if !memberships_table_exists { + return Ok(()); + } + + let migration_table_exists = table_exists(connection, "__diesel_schema_migrations")?; + let access_all_column_exists = count( + connection, + "SELECT COUNT(*) AS count FROM information_schema.columns \ + WHERE table_schema = current_schema() \ + AND table_name = 'users_organizations' \ + AND column_name = 'access_all'", + )? != 0; + let collection_permission_columns = count( + connection, + "SELECT COUNT(*) AS count FROM information_schema.columns \ + WHERE table_schema = current_schema() \ + AND table_name = 'users_organizations' \ + AND column_name IN \ + ('create_new_collections', 'edit_any_collection', 'delete_any_collection')", + )?; + + let collection_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION)?; + let repair_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_REPAIR_MIGRATION)?; + let access_all_drop_migration_applied = + migration_table_exists && migration_applied(connection, super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION)?; + let same_run_marker_table_exists = table_exists(connection, super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE)?; + let same_run_0716_marker = same_run_marker_table_exists + && count( + connection, + format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), + )? != 0; + + let legacy_user_access_all_count = if access_all_column_exists { + count( + connection, + "SELECT COUNT(*) AS count FROM users_organizations \ + WHERE atype = 2 AND access_all = TRUE", + )? + } else { + 0 + }; + + let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { + count( + connection, + "SELECT COUNT(*) AS count FROM users_organizations \ + WHERE atype IN (3, 4) \ + AND access_all = FALSE \ + AND create_new_collections = FALSE \ + AND edit_any_collection = TRUE \ + AND delete_any_collection = TRUE", + )? + } else { + 0 + }; + + let facts = super::CustomRoleMigrationFacts { + memberships_table_exists, + migration_table_exists, + access_all_column_exists, + collection_permission_columns, + collection_permissions_migration_applied, + repair_migration_applied, + access_all_drop_migration_applied, + legacy_user_access_all_count, + ambiguous_direct_permission_count, + same_run_0716_marker, + }; + + let decision = super::custom_role_preflight_decision(facts, false); + if decision == super::CustomRolePreflightDecision::Proceed { + Ok(()) + } else { + Err(super::custom_role_preflight_error(decision, facts)) + } + } + pub fn run_migrations(db_url: &str) -> Result<(), super::Error> { // Make sure the database is up to date (create if it doesn't exist, or run the migrations) let mut connection = diesel::pg::PgConnection::establish(db_url)?; + preflight(&mut connection)?; + connection.run_pending_migrations(MIGRATIONS).expect("Error running migrations"); Ok(()) } } + +#[cfg(test)] +mod custom_role_migration_preflight_tests { + use super::{ + CustomRoleMigrationFacts as Facts, CustomRolePreflightDecision as Decision, custom_role_preflight_decision, + mysql_partial_unexpected_values_query, + }; + + fn pending_repair() -> Facts { + Facts { + memberships_table_exists: true, + migration_table_exists: true, + access_all_column_exists: true, + ..Facts::default() + } + } + + #[test] + fn empty_database_can_run_normal_migrations() { + assert_eq!(custom_role_preflight_decision(Facts::default(), false), Decision::Proceed); + } + + #[test] + fn existing_schema_without_a_ledger_is_not_guessed() { + assert_eq!( + custom_role_preflight_decision( + Facts { + memberships_table_exists: true, + access_all_column_exists: true, + ..Facts::default() + }, + false, + ), + Decision::RefuseMissingMigrationLedger + ); + } + + #[test] + fn repair_marker_makes_completed_state_idempotent() { + assert_eq!( + custom_role_preflight_decision( + Facts { + memberships_table_exists: true, + migration_table_exists: true, + repair_migration_applied: true, + access_all_drop_migration_applied: true, + collection_permission_columns: 3, + ..Facts::default() + }, + false, + ), + Decision::Proceed + ); + } + + #[test] + fn a_historical_drop_without_the_repair_is_refused() { + assert_eq!( + custom_role_preflight_decision( + Facts { + access_all_drop_migration_applied: true, + access_all_column_exists: false, + ..pending_repair() + }, + false, + ), + Decision::RefuseAlreadyDropped + ); + } + + #[test] + fn legacy_user_access_all_requires_an_operator_decision() { + assert_eq!( + custom_role_preflight_decision( + Facts { + legacy_user_access_all_count: 1, + ..pending_repair() + }, + false, + ), + Decision::RefuseLegacyUserAccessAll + ); + } + + #[test] + fn group_derived_zero_permissions_are_safe_but_ambiguous_direct_permissions_are_refused() { + assert_eq!(custom_role_preflight_decision(pending_repair(), false), Decision::Proceed); + assert_eq!( + custom_role_preflight_decision( + Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + ..pending_repair() + }, + false, + ), + Decision::Proceed + ); + assert_eq!( + custom_role_preflight_decision( + Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + ambiguous_direct_permission_count: 1, + ..pending_repair() + }, + false, + ), + Decision::RefuseAmbiguousDirectPermissions + ); + assert_eq!( + custom_role_preflight_decision( + Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + ambiguous_direct_permission_count: 1, + same_run_0716_marker: true, + ..pending_repair() + }, + false, + ), + Decision::Proceed + ); + } + + #[test] + fn exact_mysql_partial_schema_uses_only_the_mysql_completion_path() { + let facts = Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: false, + ..pending_repair() + }; + assert_eq!(custom_role_preflight_decision(facts, true), Decision::CompleteMysqlCollectionMigration); + assert_eq!(custom_role_preflight_decision(facts, false), Decision::RefusePartialCollectionSchema); + } + + #[test] + fn historical_mysql_partial_query_does_not_require_the_new_marker_table() { + let query = mysql_partial_unexpected_values_query(false); + assert!(!query.contains(super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE)); + assert!(!query.contains("groups_users")); + } + + #[test] + fn same_run_mysql_partial_query_requires_the_current_group_source() { + let query = mysql_partial_unexpected_values_query(true); + assert!(query.contains("access_all = FALSE")); + assert!(query.contains("edit_any_collection = TRUE")); + assert!(query.contains("delete_any_collection = TRUE")); + assert!(query.contains("INNER JOIN `groups` AS g")); + assert!(query.contains("g.organizations_uuid = users_organizations.org_uuid")); + assert!(query.contains("g.access_all = TRUE")); + } + + #[test] + fn incomplete_columns_and_ledger_mismatch_are_refused() { + assert_eq!( + custom_role_preflight_decision( + Facts { + collection_permission_columns: 2, + ..pending_repair() + }, + true, + ), + Decision::RefusePartialCollectionSchema + ); + assert_eq!( + custom_role_preflight_decision( + Facts { + collection_permission_columns: 2, + collection_permissions_migration_applied: true, + ..pending_repair() + }, + true, + ), + Decision::RefuseCollectionLedgerMismatch + ); + } +} diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index 6983a4f2..17dfa090 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -1,5 +1,6 @@ use derive_more::{AsRef, Deref, Display, From}; use diesel::prelude::*; +use num_traits::FromPrimitive; use serde_json::Value; use crate::{ @@ -52,6 +53,16 @@ pub struct CollectionCipher { pub collection_uuid: CollectionId, } +/// Serialize the assignment-level `manage` capability using the same role boundary as the +/// collection mutation guards. Read/write access is deliberately not management authority. +pub(super) fn assignment_manage_for_member(membership_type: i32, stored_manage: bool) -> bool { + match MembershipType::from_i32(membership_type) { + Some(MembershipType::Owner | MembershipType::Admin) => true, + Some(MembershipType::Custom) => stored_manage, + Some(MembershipType::User) | None => false, + } +} + /// Local methods impl Collection { pub fn new(org_uuid: OrganizationId, name: String, external_id: Option) -> Self { @@ -104,25 +115,14 @@ impl Collection { ) -> Value { let (read_only, hide_passwords, manage) = if let Some(cipher_sync_data) = cipher_sync_data { match cipher_sync_data.members.get(&self.org_uuid) { - // Only for manager-level (Custom) members does Bitwarden return true for the manage - // option. Owners and Admins always have true. Users cannot have full access. - Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Custom), + // Full collection visibility is not collection-management authority. Admins and + // Owners manage implicitly; Custom members still need an explicit stored grant. + Some(m) if m.has_full_access() => (false, false, assignment_manage_for_member(m.atype, false)), Some(m) => { - // Only let a manager-level (Custom) member manage collections - // when they have full read/write access - let is_manager = m.atype >= MembershipType::Custom; if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) { - ( - cu.read_only, - cu.hide_passwords, - is_manager && (cu.manage || (!cu.read_only && !cu.hide_passwords)), - ) + (cu.read_only, cu.hide_passwords, assignment_manage_for_member(m.atype, cu.manage)) } else if let Some(cg) = cipher_sync_data.user_collections_groups.get(&self.uuid) { - ( - cg.read_only, - cg.hide_passwords, - is_manager && (cg.manage || (!cg.read_only && !cg.hide_passwords)), - ) + (cg.read_only, cg.hide_passwords, assignment_manage_for_member(m.atype, cg.manage)) } else { (false, false, false) } @@ -131,15 +131,17 @@ impl Collection { } } else { match Membership::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await { - Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Custom), - Some(m) if m.atype >= MembershipType::Custom && self.is_manageable_by_user(user_uuid, conn).await => { + Some(m) if m.has_full_access() => (false, false, assignment_manage_for_member(m.atype, false)), + Some(m) + if m.atype >= MembershipType::Custom + && m.has_explicit_collection_manage_access(&self.uuid, conn).await => + { (false, false, true) } - Some(m) => { - let is_manager = m.atype >= MembershipType::Custom; + Some(_) => { let read_only = !self.is_writable_by_user(user_uuid, conn).await; let hide_passwords = self.hide_passwords_for_user(user_uuid, conn).await; - (read_only, hide_passwords, is_manager && !read_only && !hide_passwords) + (read_only, hide_passwords, false) } _ => (true, true, false), } @@ -576,71 +578,8 @@ impl Collection { .await } - pub async fn is_coll_manageable_by_user(uuid: &CollectionId, user_uuid: &UserId, conn: &DbConn) -> bool { - let uuid = uuid.to_string(); - let user_uuid = user_uuid.to_string(); - conn.run(move |conn| { - collections::table - .left_join( - users_collections::table.on(users_collections::collection_uuid - .eq(collections::uuid) - .and(users_collections::user_uuid.eq(user_uuid.clone()))), - ) - .left_join( - users_organizations::table.on(collections::org_uuid - .eq(users_organizations::org_uuid) - .and(users_organizations::user_uuid.eq(user_uuid))), - ) - .left_join(groups_users::table.on(groups_users::users_organizations_uuid.eq(users_organizations::uuid))) - .left_join( - groups::table.on(groups::uuid - .eq(groups_users::groups_uuid) - .and(groups::organizations_uuid.eq(users_organizations::org_uuid))), - ) - .left_join( - collections_groups::table.on(collections_groups::groups_uuid - .eq(groups_users::groups_uuid) - .and(collections_groups::collections_uuid.eq(collections::uuid))), - ) - .filter(collections::uuid.eq(&uuid)) - .filter( - users_collections::collection_uuid - .eq(&uuid) - .and(users_collections::manage.eq(true)) - .or( - // Directly accessed collection - users_organizations::edit_any_collection.eq(true).or( - // Custom "Edit any collection" or org admin/owner (successor of access_all) - users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner - ), - ) - .or( - groups::access_all.eq(true), // access_all in groups - ) - .or( - // access via groups - groups_users::users_organizations_uuid.eq(users_organizations::uuid).and( - collections_groups::collections_uuid - .is_not_null() - .and(collections_groups::manage.eq(true)), - ), - ), - ) - .count() - .first::(conn) - .ok() - .unwrap_or(0) - != 0 - }) - .await - } - - pub async fn is_manageable_by_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool { - Self::is_coll_manageable_by_user(&self.uuid, user_uuid, conn).await - } - // Whether the user has manage access to at least one collection in the org, directly or via a - // group. Org-scoped counterpart of is_coll_manageable_by_user. + // group. pub async fn has_manageable_collection_by_user( org_uuid: &OrganizationId, user_uuid: &UserId, @@ -667,6 +606,8 @@ impl Collection { .and(collections_groups::collections_uuid.eq(collections::uuid))), ) .filter(collections::org_uuid.eq(&org_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) + .filter(users_organizations::atype.eq(MembershipType::Custom as i32)) .filter( // Manage permission on a collection assigned directly or via a group. users_collections::manage.eq(true).or(collections_groups::manage.eq(true)), @@ -999,11 +940,7 @@ impl CollectionMembership { "id": self.membership_uuid, "readOnly": self.read_only, "hidePasswords": self.hide_passwords, - "manage": membership_type >= MembershipType::Admin - || self.manage - || (membership_type >= MembershipType::Custom - && !self.read_only - && !self.hide_passwords), + "manage": assignment_manage_for_member(membership_type, self.manage), }) } } @@ -1037,3 +974,21 @@ impl From for CollectionMembership { UuidFromParam, )] pub struct CollectionId(String); + +#[cfg(test)] +mod tests { + use super::assignment_manage_for_member; + use crate::db::models::MembershipType; + + #[test] + fn assignment_manage_matches_collection_guard_role_boundaries() { + for role in [MembershipType::Owner, MembershipType::Admin] { + assert!(assignment_manage_for_member(role as i32, false)); + } + + assert!(assignment_manage_for_member(MembershipType::Custom as i32, true)); + assert!(!assignment_manage_for_member(MembershipType::Custom as i32, false)); + assert!(!assignment_manage_for_member(MembershipType::User as i32, true)); + assert!(!assignment_manage_for_member(i32::MAX, true)); + } +} diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 066f3574..410ba7d0 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -25,7 +25,7 @@ use macros::UuidFromParam; use super::{ Cipher, CipherId, Collection, CollectionGroup, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, - OrgPolicyType, TwoFactor, User, UserId, + OrgPolicyType, TwoFactor, User, UserId, collection::assignment_manage_for_member as assignment_manage, }; #[derive(Identifiable, Queryable, Insertable, AsChangeset)] @@ -469,7 +469,9 @@ impl Membership { let permissions = json!({ "accessEventLogs": membership_type == MembershipType::Custom as i32 && self.access_event_logs, "accessImportExport": membership_type == MembershipType::Custom as i32 && self.access_import_export, - "accessReports": membership_type == MembershipType::Custom as i32 && self.access_reports, + // Reports are not implemented server-side. Advertising a stored bit as usable + // would make the permission contract misleading, so this stays fail-closed. + "accessReports": false, "createNewCollections": membership_type == MembershipType::Custom as i32 && self.create_new_collections, "editAnyCollection": membership_type == MembershipType::Custom as i32 && self.edit_any_collection, "deleteAnyCollection": membership_type == MembershipType::Custom as i32 && self.delete_any_collection, @@ -584,55 +586,50 @@ impl Membership { CONFIG.org_groups_enabled() && Group::is_in_full_access_group(&self.user_uuid, &self.org_uuid, conn).await; // If collections are to be included, only include them if the user does not have full access via a group or defined to the user it self - let collections: Vec = if include_collections - && !(full_access_group || self.grants_access_to_all_collections()) - { - // Get all collections for the user here already to prevent more queries - let cu: HashMap = - CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn) + let collections: Vec = + if include_collections && !(full_access_group || self.grants_access_to_all_collections()) { + // Get all collections for the user here already to prevent more queries + let cu: HashMap = + CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn) + .await + .into_iter() + .map(|cu| (cu.collection_uuid.clone(), cu)) + .collect(); + + // Get all collection groups for this user to prevent there inclusion + let cg: HashSet = CollectionGroup::find_by_user(&self.user_uuid, conn) .await .into_iter() - .map(|cu| (cu.collection_uuid.clone(), cu)) + .map(|cg| cg.collections_uuid) .collect(); - // Get all collection groups for this user to prevent there inclusion - let cg: HashSet = CollectionGroup::find_by_user(&self.user_uuid, conn) - .await - .into_iter() - .map(|cg| cg.collections_uuid) - .collect(); - - Collection::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn) - .await - .into_iter() - .filter_map(|c| { - let (read_only, hide_passwords, manage) = if self.has_full_access() { - (false, false, self.atype >= MembershipType::Custom) - } else if let Some(cu) = cu.get(&c.uuid) { - ( - cu.read_only, - cu.hide_passwords, - cu.manage || (self.atype >= MembershipType::Custom && !cu.read_only && !cu.hide_passwords), - ) - // If previous checks failed it might be that this user has access via a group, but we should not return those elements here - // Those are returned via a special group endpoint - } else if cg.contains(&c.uuid) { - return None; - } else { - (true, true, false) - }; - - Some(json!({ - "id": c.uuid, - "readOnly": read_only, - "hidePasswords": hide_passwords, - "manage": manage, - })) - }) - .collect() - } else { - Vec::new() - }; + Collection::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn) + .await + .into_iter() + .filter_map(|c| { + let (read_only, hide_passwords, manage) = if self.has_full_access() { + (false, false, assignment_manage(self.atype, false)) + } else if let Some(cu) = cu.get(&c.uuid) { + (cu.read_only, cu.hide_passwords, assignment_manage(self.atype, cu.manage)) + // If previous checks failed it might be that this user has access via a group, but we should not return those elements here + // Those are returned via a special group endpoint + } else if cg.contains(&c.uuid) { + return None; + } else { + (true, true, false) + }; + + Some(json!({ + "id": c.uuid, + "readOnly": read_only, + "hidePasswords": hide_passwords, + "manage": manage, + })) + }) + .collect() + } else { + Vec::new() + }; let membership_type = self.atype; @@ -642,7 +639,7 @@ impl Membership { json!({ "accessEventLogs": self.access_event_logs, "accessImportExport": self.access_import_export, - "accessReports": self.access_reports, + "accessReports": false, "createNewCollections": self.create_new_collections, "editAnyCollection": self.edit_any_collection, "deleteAnyCollection": self.delete_any_collection, @@ -888,10 +885,6 @@ impl Membership { self.has_type(MembershipType::Custom) && self.access_import_export } - pub fn has_access_reports(&self) -> bool { - self.has_type(MembershipType::Custom) && self.access_reports - } - /// Check for an explicit per-collection Manage grant without treating any `access_all` value /// as such a grant. Custom-role collection guards use this instead of the legacy broad helper, /// because membership/group `access_all` must not manufacture a per-collection Manage grant. @@ -915,6 +908,7 @@ impl Membership { .filter(users_organizations::user_uuid.eq(user_uuid.clone())) .filter(users_organizations::org_uuid.eq(org_uuid.clone())) .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) + .filter(users_organizations::atype.eq(MembershipType::Custom as i32)) .filter(collections::uuid.eq(collection_uuid.clone())) .filter(users_collections::manage.eq(true)) .count() @@ -945,6 +939,7 @@ impl Membership { .filter(users_organizations::user_uuid.eq(user_uuid)) .filter(users_organizations::org_uuid.eq(org_uuid)) .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) + .filter(users_organizations::atype.eq(MembershipType::Custom as i32)) .filter(collections::uuid.eq(collection_uuid)) .filter(collections_groups::manage.eq(true)) .count() @@ -1577,12 +1572,10 @@ mod tests { member.access_event_logs = true; assert!(member.has_access_event_logs()); assert!(!member.has_access_import_export()); - assert!(!member.has_access_reports()); member.access_import_export = true; member.access_reports = true; assert!(member.has_access_import_export()); - assert!(member.has_access_reports()); // None of them imply collection or management capabilities. assert!(!member.has_full_access()); assert!(!member.has_manage_users()); @@ -1591,6 +1584,5 @@ mod tests { member.atype = MembershipType::User as i32; assert!(!member.has_access_event_logs()); assert!(!member.has_access_import_export()); - assert!(!member.has_access_reports()); } } diff --git a/src/static/scripts/admin_users.js b/src/static/scripts/admin_users.js index 1bae0aa3..03ec9712 100644 --- a/src/static/scripts/admin_users.js +++ b/src/static/scripts/admin_users.js @@ -174,10 +174,6 @@ const ORG_TYPES = { "name": "User", "bg": "blue" }, - "3": { - "name": "Manager", - "bg": "green" - }, "4": { "name": "Custom", "bg": "teal" @@ -215,12 +211,13 @@ jQuery.extend(jQuery.fn.dataTableExt.oSort, { const userOrgTypeDialog = document.getElementById("userOrgTypeDialog"); // Fill the form and title userOrgTypeDialog.addEventListener("show.bs.modal", function(event) { + document.getElementById("userOrgTypeForm").reset(); + // Get shared values const userEmail = event.relatedTarget.parentNode.dataset.vwUserEmail; const userUuid = event.relatedTarget.parentNode.dataset.vwUserUuid; // Get org specific values const userOrgType = event.relatedTarget.dataset.vwOrgType; - const userOrgTypeName = ORG_TYPES[userOrgType]["name"]; const orgName = event.relatedTarget.dataset.vwOrgName; const orgUuid = event.relatedTarget.dataset.vwOrgUuid; @@ -228,7 +225,9 @@ userOrgTypeDialog.addEventListener("show.bs.modal", function(event) { document.getElementById("userOrgTypeDialogUserEmail").textContent = userEmail; document.getElementById("userOrgTypeUserUuid").value = userUuid; document.getElementById("userOrgTypeOrgUuid").value = orgUuid; - document.getElementById(`userOrgType${userOrgTypeName}`).checked = true; + if (ORG_TYPES[userOrgType] !== undefined) { + document.getElementById(`userOrgType${ORG_TYPES[userOrgType].name}`).checked = true; + } }, false); // Prevent accidental submission of the form with valid elements after the modal has been hidden. @@ -255,7 +254,10 @@ function updateUserOrgType(event) { function initUserTable() { // Color all the org buttons per type document.querySelectorAll("button[data-vw-org-type]").forEach(function(e) { - const orgType = ORG_TYPES[e.dataset.vwOrgType]; + const orgType = ORG_TYPES[e.dataset.vwOrgType] ?? { + "name": "Unknown membership type", + "bg": "gray" + }; e.style.backgroundColor = orgType.bg; if (orgType.font !== undefined) { e.style.color = orgType.font; diff --git a/src/static/templates/admin/users.hbs b/src/static/templates/admin/users.hbs index 3bd63446..d848d894 100644 --- a/src/static/templates/admin/users.hbs +++ b/src/static/templates/admin/users.hbs @@ -130,10 +130,7 @@
- -
-
- +
diff --git a/src/static/templates/scss/vaultwarden.scss.hbs b/src/static/templates/scss/vaultwarden.scss.hbs index 11bcbad6..893829e1 100644 --- a/src/static/templates/scss/vaultwarden.scss.hbs +++ b/src/static/templates/scss/vaultwarden.scss.hbs @@ -116,9 +116,9 @@ app-security > app-two-factor-setup > form { } /* Hide unsupported Custom Role options */ -/* The collection permission group plus manageUsers, manageGroups, managePolicies are supported - by Vaultwarden and are intentionally not hidden here. */ -:is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"]), +/* Collection permissions, manageUsers, manageGroups, managePolicies, accessEventLogs and + accessImportExport are supported by Vaultwarden and are intentionally not hidden here. */ +:is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="accessReports"]), :is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageSso"]), :is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageResetPassword"]) { @extend %vw-hide; diff --git a/src/util.rs b/src/util.rs index 91f075d1..4a12d080 100644 --- a/src/util.rs +++ b/src/util.rs @@ -484,8 +484,16 @@ pub fn format_datetime_http(dt: &DateTime) -> String { expiry_time.to_rfc2822().replace("+0000", "GMT") } +pub fn try_parse_date(date: &str) -> Result { + DateTime::parse_from_rfc3339(date).map(|date| date.naive_utc()) +} + +/// Parse an RFC 3339 date which is known to be valid. +/// +/// Request data should use [`try_parse_date`] so malformed input can be returned as a controlled +/// client error instead of panicking. pub fn parse_date(date: &str) -> NaiveDateTime { - DateTime::parse_from_rfc3339(date).unwrap().naive_utc() + try_parse_date(date).expect("trusted date must be valid RFC 3339") } /// Returns true or false if an email address is valid or not From af2e180e0223d317c97739fae69f72927dc742a7 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sun, 26 Jul 2026 01:01:17 +0200 Subject: [PATCH 30/42] Remove custom-role recovery document --- docs/custom-role-migration-recovery.md | 200 ------------------------- src/db/mod.rs | 8 +- 2 files changed, 3 insertions(+), 205 deletions(-) delete mode 100644 docs/custom-role-migration-recovery.md diff --git a/docs/custom-role-migration-recovery.md b/docs/custom-role-migration-recovery.md deleted file mode 100644 index 64fad205..00000000 --- a/docs/custom-role-migration-recovery.md +++ /dev/null @@ -1,200 +0,0 @@ -# Custom-role migration recovery - -Vaultwarden deliberately stops the Custom-role migration when the old database state cannot be -translated without either removing access or adding new management authority. A failed preflight -does not authorize Vaultwarden to choose between those outcomes. - -## Before doing anything - -1. Stop every Vaultwarden instance that uses the database. Do not perform this migration during a - rolling deployment. -2. Take and verify a full database backup. -3. Keep the complete startup error. It identifies the state that needs review. -4. Do not add or delete rows in `__diesel_schema_migrations` merely to bypass the preflight. - -The relevant versions are: - -| Version | Purpose | -|---|---| -| `2026-07-15-120000` | Mark that `2026-07-16` is pending in the same migration sequence | -| `2026-07-16-120000` | Add the three collection-permission columns | -| `2026-07-23-120000` | Reconcile legacy Manager/Custom membership permissions | -| `2026-07-24-120000` | Drop membership-level `access_all` | -| `2026-07-24-130000` | Add the three Custom Access permissions | -| `2026-07-24-140000` | Refuse a lossy Custom-role downgrade | - -Diesel stores these directory versions without punctuation in `__diesel_schema_migrations` (for -example, `2026-07-16-120000` is stored as `20260716120000`). -The immutable `2026-06-30-120000` migration is an earlier prerequisite; this table focuses on the -new marker/repair/drop/downgrade safety sequence. - -## Legacy User with membership `access_all` - -Find the affected memberships before the source column is dropped: - -```sql -SELECT uuid, user_uuid, org_uuid, status -FROM users_organizations -WHERE atype = 2 AND access_all = TRUE; -``` - -This state was accepted by older Vaultwarden versions. It has no exact representation in the new -nine-bit Custom-role model: - -- clearing `access_all` keeps the User role but removes organization-wide vault access; -- changing the member to Custom with all three collection permissions preserves broad vault access, - but also grants collection-management capabilities the old User role did not have. - -An organization owner must decide the intended role and permissions for each result. Make that -change on the backed-up pre-drop database and record the decision: - -- to keep the member a normal User, set that membership's `access_all` to false; -- to intentionally promote the member to Custom with Create/Edit/Delete-any authority, set that - membership's `atype` to the legacy Manager value `3` and keep `access_all` true. The repair copies - the bit to all three collection permissions before converting `atype` to `4`. - -Apply either change by exact membership UUID while all Vaultwarden instances are stopped. Do not -bulk-promote these records automatically. - -## Group-derived legacy collection management - -An organization-local `groups.access_all` relationship is safe when the membership has no direct -collection permissions. During a normal upgrade, the older `2026-07-16` migration temporarily -copies that relationship to the exact direct `create/edit/delete = 0/1/1` pattern. The new repair -recognizes the still-present, organization-bound source and deterministically resets the direct -Edit/Delete bits to false **only** when the durable `2026-07-15` marker proves that `2026-07-16` was -pending in the same migration sequence. Vault access remains group-derived, so removing the member -from the group also removes that access. - -The marker survives a process failure between `2026-07-16` and `2026-07-23`, allowing the next -startup to finish the deterministic repair. `2026-07-23` transactionally clears the marker row only -after all guards and data updates succeed. The empty internal bookkeeping table is intentionally -retained so MySQL does not introduce a DDL commit boundary. Do not create, remove, or populate -`__vw_custom_role_same_run_0716` manually. - -The preflight stops only when the three columns already exist and it finds a `0/1/1` pattern. At -that point the values may be either an intentional direct Edit+Delete grant or an older group -backfill whose source group was removed; the database has no provenance bit that can distinguish -them. - -For each stopped `0/1/1` membership, the owner must choose one of these executable outcomes: - -- **Group-derived or obsolete:** set `edit_any_collection` and `delete_any_collection` to false for - that exact membership. Leave the intended group relationship in place if access should remain - group-derived. The next preflight can then proceed. -- **Intentionally direct Edit+Delete:** while every server is stopped, temporarily set - `create_new_collections` to true for that exact membership. The unambiguous `1/1/1` state passes - the repair and is not treated as a group backfill. Run the migration in a maintenance instance - that is not reachable by clients, stop it as soon as all six recovery-sequence versions listed - above are recorded, then set `create_new_collections` back to false before normal service resumes. - This restores the explicitly reviewed direct `0/1/1` state after the repair marker exists. - -The organization boundary used to identify a current group source is: - -```sql -SELECT DISTINCT uo.uuid, uo.org_uuid, g.uuid AS group_uuid -FROM users_organizations AS uo -INNER JOIN groups_users AS gu ON gu.users_organizations_uuid = uo.uuid -INNER JOIN groups AS g ON g.uuid = gu.groups_uuid -WHERE uo.atype IN (3, 4) - AND uo.access_all = FALSE - AND g.organizations_uuid = uo.org_uuid - AND g.access_all = TRUE; -``` - -On MySQL, quote the table as `` `groups` ``. Review direct `0/1/1` records separately: - -```sql -SELECT uuid, user_uuid, org_uuid -FROM users_organizations -WHERE atype IN (3, 4) - AND access_all = FALSE - AND create_new_collections = FALSE - AND edit_any_collection = TRUE - AND delete_any_collection = TRUE; -``` - -Because an explicit Edit+Delete assignment has the same stored values as the historical derived -state, Vaultwarden cannot classify those records automatically. Never use the temporary Create bit -while a server is accepting client traffic. - -## The `access_all` column was already dropped - -If `2026-07-24-120000` is recorded but `2026-07-23-120000` is not, restore a backup from before the -drop and migrate again after resolving the cases above. The old membership bit is no longer present, -so a later migration cannot prove which members had it. - -If no such backup exists, perform a membership-by-membership authorization review using -administrative records before changing roles or flags. Only after the final state has been reviewed -may an operator mark the repair version as resolved. Vaultwarden intentionally provides no automatic -command for this irreversible case. - -## Historical MySQL partial `2026-07-16` migration - -An older branch revision could fail on the unquoted `groups` identifier after MySQL had already -committed all three `ADD COLUMN` statements. The migration version was not recorded, so a normal -retry then failed on duplicate columns. - -Vaultwarden automatically completes this state only when all of the following are true: - -- `2026-07-16-120000` is absent from the ledger; -- all three expected columns exist, are non-null booleans, and default to false; -- `access_all` still exists and `2026-07-24-120000` has not run; -- the stored values are either the untouched false defaults, the values produced by the canonical - membership-`access_all` copy, or exact `0/1/1` values accompanied by both the durable same-run - marker and a current same-organization `groups.access_all` source; and -- neither a legacy User/access-all case nor ambiguous group provenance exists. - -It then reapplies the canonical membership data copy and inserts the ledger row in one transaction. -For the narrowly accepted same-run `0/1/1` crash state, that copy first reconstructs `0/0/0`; the -pending canonical group backfill and `2026-07-23` repair then run normally. A missing group source, -any other partial column set, changed definition, or unexpected value stops startup. Preserve that -database and repair it manually from the verified backup; do not drop columns that may contain -independently changed permissions. - -## Verification after recovery - -After a successful start, verify: - -```sql -SELECT version -FROM __diesel_schema_migrations -WHERE version IN ( - '20260715120000', - '20260716120000', - '20260723120000', - '20260724120000', - '20260724130000', - '20260724140000' -) -ORDER BY version; - -SELECT COUNT(*) AS invalid_manager_types -FROM users_organizations -WHERE atype = 3; -``` - -All six versions must be present and `invalid_manager_types` must be zero. Then test a fresh login, -sync, collection read/edit/delete, and group removal for every membership that was reviewed. - -## Downgrade guard - -The old schema cannot encode nine independent permissions in its single membership `access_all` -bit. Even a state that currently happens to use only `0/0/0` or `1/1/1` could be changed after a -one-step guard was reverted and before a later incremental downgrade. A conditional guard would -therefore create false confidence. - -The newest migration always stops an automatic downgrade with a duplicate-key error in the -`__vw_custom_role_downgrade_guard` temporary table, before any production permission column or -migration-ledger row is removed. This mechanism is enforced by primary keys on SQLite, PostgreSQL, -MySQL 5.7+, and MariaDB; it does not rely on historically ignored MySQL `CHECK` constraints. This is -intentional. - -Rollback requires either: - -- restoring a verified database backup taken before the Custom-role upgrade; or -- an explicit offline transformation plan that exports all permissions, defines the accepted - semantic loss or role changes membership by membership, and is tested against a disposable copy - on the same database backend. - -Do not delete the `20260724140000` ledger row merely to bypass this protection. diff --git a/src/db/mod.rs b/src/db/mod.rs index 4f57147b..f5177c4e 100644 --- a/src/db/mod.rs +++ b/src/db/mod.rs @@ -472,7 +472,6 @@ const CUSTOM_ROLE_REPAIR_MIGRATION: &str = "20260723120000"; const CUSTOM_COLLECTION_PERMISSIONS_MIGRATION: &str = "20260716120000"; const DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION: &str = "20260724120000"; const CUSTOM_ROLE_SAME_RUN_MARKER_TABLE: &str = "__vw_custom_role_same_run_0716"; -const CUSTOM_ROLE_MIGRATION_RECOVERY_DOC: &str = "docs/custom-role-migration-recovery.md"; #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)] #[expect( @@ -588,8 +587,8 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus }; std::io::Error::other(format!( - "Custom-role migration preflight stopped startup: {detail} Back up the database and follow \ - {CUSTOM_ROLE_MIGRATION_RECOVERY_DOC}." + "Custom-role migration preflight stopped startup: {detail} Back up the database and resolve \ + the legacy membership state manually before restarting." )) .into() } @@ -855,9 +854,8 @@ mod mysql_migrations { {version} schema, but its column definitions or data were modified \ (matching columns: {matching_column_definitions}/3, unexpected rows: \ {unexpected_values}). Refusing automatic recovery. Back up the database and \ - follow {doc}.", + resolve the partial migration manually before restarting.", version = super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION, - doc = super::CUSTOM_ROLE_MIGRATION_RECOVERY_DOC, )) .into()); } From 3c5b846d038ca66f49b1e684dc0ab7712ae21d63 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sun, 26 Jul 2026 21:40:02 +0200 Subject: [PATCH 31/42] Implement accessReports custom permission --- src/api/core/organizations.rs | 20 ++++++++------------ src/auth.rs | 9 +++++++++ src/db/models/organization.rs | 10 ++++++---- 3 files changed, 23 insertions(+), 16 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 7d05787c..ae7429ef 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1237,9 +1237,7 @@ impl CustomRolePermissions { delete_any_collection: enabled("deleteAnyCollection"), access_event_logs: enabled("accessEventLogs"), access_import_export: enabled("accessImportExport"), - // Vaultwarden has no report endpoints yet. Keep the compatibility field in the - // database/DTO, but never accept a permission that cannot be enforced server-side. - access_reports: false, + access_reports: enabled("accessReports"), } } @@ -1271,8 +1269,7 @@ impl CustomRolePermissions { delete_any_collection: membership.delete_any_collection, access_event_logs: membership.access_event_logs, access_import_export: membership.access_import_export, - // Reports are unsupported and therefore never preserved as an active grant. - access_reports: false, + access_reports: membership.access_reports, } } None => Self::default(), @@ -1288,6 +1285,7 @@ impl CustomRolePermissions { || self.delete_any_collection != membership.delete_any_collection || self.access_event_logs != membership.access_event_logs || self.access_import_export != membership.access_import_export + || self.access_reports != membership.access_reports } fn apply_to(self, membership: &mut Membership) { @@ -4214,7 +4212,7 @@ mod tests { assert!(custom.delete_any_collection); assert!(custom.access_event_logs); assert!(custom.access_import_export); - assert!(!custom.access_reports, "unsupported report access must remain fail-closed"); + assert!(custom.access_reports); let user = CustomRolePermissions::from_request(MembershipType::User, &permissions); assert_eq!(user, CustomRolePermissions::default()); @@ -4237,6 +4235,7 @@ mod tests { delete_any_collection: true, access_event_logs: true, access_import_export: true, + access_reports: true, ..CustomRolePermissions::default() }; @@ -4248,7 +4247,7 @@ mod tests { assert!(membership.delete_any_collection); assert!(membership.access_event_logs); assert!(membership.access_import_export); - assert!(!membership.access_reports); + assert!(membership.access_reports); } #[test] @@ -4273,11 +4272,8 @@ mod tests { assert!(preserved.delete_any_collection); assert!(preserved.access_event_logs); assert!(preserved.access_import_export); - assert!(!preserved.access_reports); - assert!( - !preserved.differs_from(&membership), - "a stale unsupported reports bit must not block an otherwise unchanged legacy-client update" - ); + assert!(preserved.access_reports); + assert!(!preserved.differs_from(&membership)); let explicit_reset = HashMap::new(); assert_eq!( diff --git a/src/auth.rs b/src/auth.rs index 49b72495..d008543d 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -766,6 +766,10 @@ impl OrgHeaders { self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_access_import_export()) } + + fn can_access_reports(&self) -> bool { + self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_access_reports()) + } } // org_id is usually the second path param ("/organizations/"), @@ -966,6 +970,11 @@ generate_manage_headers!( can_access_import_export, "You need the 'Access Import/Export' permission, or to be an Admin or Owner, to call this endpoint" ); +generate_manage_headers!( + AccessReportsHeaders, + can_access_reports, + "You need the 'Access Reports' permission, or to be an Admin or Owner, to call this endpoint" +); // col_id is usually the fourth path param ("/organizations//collections/"), // but there could be cases where it is a query value. diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 410ba7d0..6922c56e 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -469,9 +469,7 @@ impl Membership { let permissions = json!({ "accessEventLogs": membership_type == MembershipType::Custom as i32 && self.access_event_logs, "accessImportExport": membership_type == MembershipType::Custom as i32 && self.access_import_export, - // Reports are not implemented server-side. Advertising a stored bit as usable - // would make the permission contract misleading, so this stays fail-closed. - "accessReports": false, + "accessReports": membership_type == MembershipType::Custom as i32 && self.access_reports, "createNewCollections": membership_type == MembershipType::Custom as i32 && self.create_new_collections, "editAnyCollection": membership_type == MembershipType::Custom as i32 && self.edit_any_collection, "deleteAnyCollection": membership_type == MembershipType::Custom as i32 && self.delete_any_collection, @@ -639,7 +637,7 @@ impl Membership { json!({ "accessEventLogs": self.access_event_logs, "accessImportExport": self.access_import_export, - "accessReports": false, + "accessReports": self.access_reports, "createNewCollections": self.create_new_collections, "editAnyCollection": self.edit_any_collection, "deleteAnyCollection": self.delete_any_collection, @@ -885,6 +883,10 @@ impl Membership { self.has_type(MembershipType::Custom) && self.access_import_export } + pub fn has_access_reports(&self) -> bool { + self.has_type(MembershipType::Custom) && self.access_reports + } + /// Check for an explicit per-collection Manage grant without treating any `access_all` value /// as such a grant. Custom-role collection guards use this instead of the legacy broad helper, /// because membership/group `access_all` must not manufacture a per-collection Manage grant. From 222f662e0bc1b1c11bc41422977868bb8ad48a1c Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sun, 26 Jul 2026 22:00:21 +0200 Subject: [PATCH 32/42] Show accessReports custom permission in web vault --- src/static/templates/scss/vaultwarden.scss.hbs | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/static/templates/scss/vaultwarden.scss.hbs b/src/static/templates/scss/vaultwarden.scss.hbs index 893829e1..e9a5a514 100644 --- a/src/static/templates/scss/vaultwarden.scss.hbs +++ b/src/static/templates/scss/vaultwarden.scss.hbs @@ -116,9 +116,8 @@ app-security > app-two-factor-setup > form { } /* Hide unsupported Custom Role options */ -/* Collection permissions, manageUsers, manageGroups, managePolicies, accessEventLogs and - accessImportExport are supported by Vaultwarden and are intentionally not hidden here. */ -:is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="accessReports"]), +/* Collection permissions, manageUsers, manageGroups, managePolicies, accessEventLogs, + accessImportExport and accessReports are supported by Vaultwarden and are intentionally not hidden here. */ :is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageSso"]), :is(bit-dialog, [bit-dialog]) bit-form-control:has(input[formcontrolname="manageResetPassword"]) { @extend %vw-hide; From df6087f94a7accb0acc8825e2f3702999416cffa Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sun, 26 Jul 2026 22:31:22 +0200 Subject: [PATCH 33/42] Allow accessReports users to load organization ciphers --- src/api/core/organizations.rs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index ae7429ef..f4975672 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1075,8 +1075,12 @@ async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: Db err_code!("Resource not found.", "Organization id's do not match", rocket::http::Status::NotFound.code); } - if !headers.membership.has_full_access() { - err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code); + if !headers.membership.has_full_access() && !headers.membership.has_access_reports() { + err_code!( + "Resource not found.", + "User does not have permission to access all organization ciphers", + rocket::http::Status::NotFound.code + ); } Ok(Json(json!({ From 52c02ce416434f52015be5cdd71a18f4818e7315 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Mon, 27 Jul 2026 00:10:37 +0200 Subject: [PATCH 34/42] Document accessReports scope and drop the unused reports guard Clippy (with --all-targets) reported two issues introduced by this branch: events.rs:356 items_after_test_module events.rs:395 redundant_clone Move the test module to the end of the file and drop the redundant clone. The relocation is content-identical; the only semantic change is the removed `org_id.clone()`, which was the last use of the binding. Note that CI runs clippy without --all-targets, so neither of these was failing the pipeline. Remove `AccessReportsHeaders` and its `can_access_reports` helper. The guard was never applied to any route and could not be: Vaultwarden has no server-side report endpoints, because the clients compute every report locally from the organization cipher list. `accessReports` is therefore enforced inline in `get_org_details`, where that list is actually served. A note at both former sites records this, so the guard is not reintroduced and an endpoint is not gated on "may call reports" instead of "may read these ciphers". Document the resulting authorization semantics above `get_org_details`: the endpoint serializes with CipherSyncType::Organization, which skips the per-cipher access restrictions, so readOnly/hidePasswords are not applied and collection assignments are ignored. `accessReports` is by design a full organization read permission. This matches Bitwarden's CanAccessAllCiphersAsync, which admits Owner/Admin plus Custom members holding AccessImportExport, EditAnyCollection or AccessReports. We stay deliberately stricter than Bitwarden for accessImportExport: it does not open this endpoint, and get_org_export scopes its output to the caller's own collections, so "may export" never widens what a member can read. No behavioural change. --- src/api/core/events.rs | 239 +++++++++++++++++----------------- src/api/core/organizations.rs | 20 +++ src/auth.rs | 16 +-- 3 files changed, 145 insertions(+), 130 deletions(-) diff --git a/src/api/core/events.rs b/src/api/core/events.rs index b856176c..ba859d31 100644 --- a/src/api/core/events.rs +++ b/src/api/core/events.rs @@ -352,6 +352,123 @@ async fn post_events_collect(data: Json>, headers: Headers, Ok(()) } +pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) { + if !CONFIG.org_events_enabled() { + return; + } + log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await; +} + +async fn log_user_event_impl( + event_type: i32, + user_id: &UserId, + device_type: i32, + event_date: Option, + ip: &IpAddr, + conn: &DbConn, +) { + let memberships = Membership::find_confirmed_by_user(user_id, conn).await; + let mut events: Vec = Vec::with_capacity(memberships.len() + 1); // We need an event per org and one without an org + + // Upstream saves the event also without any org_id. + let mut event = Event::new(event_type, event_date); + event.user_uuid = Some(user_id.clone()); + event.act_user_uuid = Some(user_id.clone()); + event.device_type = Some(device_type); + event.ip_address = Some(ip.to_string()); + events.push(event); + + // For each org a user is a member of store these events per org + for membership in memberships { + let mut event = Event::new(event_type, event_date); + event.user_uuid = Some(user_id.clone()); + event.org_uuid = Some(membership.org_uuid); + event.org_user_uuid = Some(membership.uuid); + event.act_user_uuid = Some(user_id.clone()); + event.device_type = Some(device_type); + event.ip_address = Some(ip.to_string()); + events.push(event); + } + + Event::save_user_event(events, conn).await.unwrap_or(()); +} + +pub async fn log_event( + event_type: i32, + source_uuid: &str, + org_id: &OrganizationId, + act_user_id: &UserId, + device_type: i32, + ip: &IpAddr, + conn: &DbConn, +) { + if !CONFIG.org_events_enabled() { + return; + } + log_event_impl(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await; +} + +#[expect(clippy::too_many_arguments)] +async fn log_event_impl( + event_type: i32, + source_uuid: &str, + org_id: &OrganizationId, + act_user_id: &UserId, + device_type: i32, + event_date: Option, + ip: &IpAddr, + conn: &DbConn, +) { + // Create a new empty event + let mut event = Event::new(event_type, event_date); + match event_type { + // 1000..=1099 Are user events, they need to be logged via log_user_event() + // Cipher Events + 1100..=1199 => { + event.cipher_uuid = Some(source_uuid.to_owned().into()); + } + // Collection Events + 1300..=1399 => { + event.collection_uuid = Some(source_uuid.to_owned().into()); + } + // Group Events + 1400..=1499 => { + event.group_uuid = Some(source_uuid.to_owned().into()); + } + // Org User Events + 1500..=1599 => { + event.org_user_uuid = Some(source_uuid.to_owned().into()); + } + // 1600..=1699 Are organizational events, and they do not need the source_uuid + // Policy Events + 1700..=1799 => { + event.policy_uuid = Some(source_uuid.to_owned().into()); + } + // Ignore others + _ => {} + } + + event.org_uuid = Some(org_id.clone()); + event.act_user_uuid = Some(act_user_id.clone()); + event.device_type = Some(device_type); + event.ip_address = Some(ip.to_string()); + event.save(conn).await.unwrap_or(()); +} + +pub async fn event_cleanup_job(pool: DbPool) { + debug!("Start events cleanup job"); + if CONFIG.events_days_retain().is_none() { + debug!("events_days_retain is not configured, abort"); + return; + } + + if let Ok(conn) = pool.get().await { + Event::clean_events(&conn).await.ok(); + } else { + error!("Failed to get DB connection while trying to cleanup the events table"); + } +} + #[cfg(test)] mod tests { use super::*; @@ -390,10 +507,7 @@ mod tests { cipher.organization_uuid = Some(org_id.clone()); let admin = membership(MembershipType::Admin, MembershipStatus::Confirmed); - assert_eq!( - cipher_event_scope(&cipher, &user_id, Some(&admin)), - Some(CipherEventScope::Organization(org_id.clone())) - ); + assert_eq!(cipher_event_scope(&cipher, &user_id, Some(&admin)), Some(CipherEventScope::Organization(org_id))); let accepted_admin = membership(MembershipType::Admin, MembershipStatus::Accepted); assert_eq!(cipher_event_scope(&cipher, &user_id, Some(&accepted_admin)), None); @@ -503,120 +617,3 @@ mod tests { assert!(validate_client_event_batch_size(MAX_CLIENT_EVENT_BATCH_SIZE + 1).is_err()); } } - -pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) { - if !CONFIG.org_events_enabled() { - return; - } - log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await; -} - -async fn log_user_event_impl( - event_type: i32, - user_id: &UserId, - device_type: i32, - event_date: Option, - ip: &IpAddr, - conn: &DbConn, -) { - let memberships = Membership::find_confirmed_by_user(user_id, conn).await; - let mut events: Vec = Vec::with_capacity(memberships.len() + 1); // We need an event per org and one without an org - - // Upstream saves the event also without any org_id. - let mut event = Event::new(event_type, event_date); - event.user_uuid = Some(user_id.clone()); - event.act_user_uuid = Some(user_id.clone()); - event.device_type = Some(device_type); - event.ip_address = Some(ip.to_string()); - events.push(event); - - // For each org a user is a member of store these events per org - for membership in memberships { - let mut event = Event::new(event_type, event_date); - event.user_uuid = Some(user_id.clone()); - event.org_uuid = Some(membership.org_uuid); - event.org_user_uuid = Some(membership.uuid); - event.act_user_uuid = Some(user_id.clone()); - event.device_type = Some(device_type); - event.ip_address = Some(ip.to_string()); - events.push(event); - } - - Event::save_user_event(events, conn).await.unwrap_or(()); -} - -pub async fn log_event( - event_type: i32, - source_uuid: &str, - org_id: &OrganizationId, - act_user_id: &UserId, - device_type: i32, - ip: &IpAddr, - conn: &DbConn, -) { - if !CONFIG.org_events_enabled() { - return; - } - log_event_impl(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await; -} - -#[expect(clippy::too_many_arguments)] -async fn log_event_impl( - event_type: i32, - source_uuid: &str, - org_id: &OrganizationId, - act_user_id: &UserId, - device_type: i32, - event_date: Option, - ip: &IpAddr, - conn: &DbConn, -) { - // Create a new empty event - let mut event = Event::new(event_type, event_date); - match event_type { - // 1000..=1099 Are user events, they need to be logged via log_user_event() - // Cipher Events - 1100..=1199 => { - event.cipher_uuid = Some(source_uuid.to_owned().into()); - } - // Collection Events - 1300..=1399 => { - event.collection_uuid = Some(source_uuid.to_owned().into()); - } - // Group Events - 1400..=1499 => { - event.group_uuid = Some(source_uuid.to_owned().into()); - } - // Org User Events - 1500..=1599 => { - event.org_user_uuid = Some(source_uuid.to_owned().into()); - } - // 1600..=1699 Are organizational events, and they do not need the source_uuid - // Policy Events - 1700..=1799 => { - event.policy_uuid = Some(source_uuid.to_owned().into()); - } - // Ignore others - _ => {} - } - - event.org_uuid = Some(org_id.clone()); - event.act_user_uuid = Some(act_user_id.clone()); - event.device_type = Some(device_type); - event.ip_address = Some(ip.to_string()); - event.save(conn).await.unwrap_or(()); -} - -pub async fn event_cleanup_job(pool: DbPool) { - debug!("Start events cleanup job"); - if CONFIG.events_days_retain().is_none() { - debug!("events_days_retain is not configured, abort"); - return; - } - - if let Ok(conn) = pool.get().await { - Event::clean_events(&conn).await.ok(); - } else { - error!("Failed to get DB connection while trying to cleanup the events table"); - } -} diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index f4975672..8e7c8057 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1069,6 +1069,26 @@ async fn get_assigned_org_details(data: OrgIdData, headers: Headers, conn: DbCon }))) } +// Returns every cipher in the organization, serialized with `CipherSyncType::Organization` — which +// deliberately skips the per-cipher access restrictions, so `readOnly`/`hidePasswords` are not +// applied and collection assignments are ignored. Whoever passes the check below reads the whole +// organization vault. +// +// `accessReports` is therefore, by design, a full organization *read* permission and not merely +// "may open the reports screen". Vaultwarden implements no server-side reports: the clients fetch +// this list and compute Exposed/Reused/Weak Passwords, Unsecured Websites, Inactive 2FA etc. +// locally, so the permission cannot be satisfied with less data. +// +// This matches Bitwarden upstream, which grants the same endpoint to Owner/Admin and to Custom +// members holding AccessImportExport, EditAnyCollection *or* AccessReports: +// https://github.com/bitwarden/server/blob/main/src/Api/Vault/Controllers/CiphersController.cs +// (`CanAccessAllCiphersAsync`) +// +// We are intentionally *stricter* than Bitwarden for `accessImportExport`: it does not open this +// endpoint, and `get_org_export` scopes its output to the caller's own collections, so +// "may export" never widens what a member can read. Granting `accessReports` does widen it — that +// is the documented trade-off of staying Bitwarden-compatible, and administrators must treat +// `accessReports` as equivalent to read access to every collection in the organization. #[get("/ciphers/organization-details?")] async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { if data.organization_id != headers.membership.org_uuid { diff --git a/src/auth.rs b/src/auth.rs index d008543d..39533abd 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -766,10 +766,11 @@ impl OrgHeaders { self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_access_import_export()) } - - fn can_access_reports(&self) -> bool { - self.is_confirmed() && (self.membership_type >= MembershipType::Admin || self.membership.has_access_reports()) - } + // NOTE: there is deliberately no `can_access_reports` guard helper. Vaultwarden has no + // server-side report endpoints — the clients compute every report locally from the + // organization cipher list — so `accessReports` is enforced inline where that list is served + // (`get_org_details`), not through a request guard. A guard here would be dead code that + // invites gating an endpoint on "may call reports" instead of "may read these ciphers". } // org_id is usually the second path param ("/organizations/"), @@ -970,11 +971,8 @@ generate_manage_headers!( can_access_import_export, "You need the 'Access Import/Export' permission, or to be an Admin or Owner, to call this endpoint" ); -generate_manage_headers!( - AccessReportsHeaders, - can_access_reports, - "You need the 'Access Reports' permission, or to be an Admin or Owner, to call this endpoint" -); +// NOTE: no `AccessReportsHeaders`. See the note next to `can_access_import_export` above: +// `accessReports` guards data (the organization cipher list), not a dedicated endpoint. // col_id is usually the fourth path param ("/organizations//collections/"), // but there could be cases where it is a query value. From ceeba0bf35548613a43c00822ba9babb27bdd81b Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 30 Jul 2026 19:52:35 +0200 Subject: [PATCH 35/42] Fix custom-role audit findings Type-gate edit-any queries and add legacy access_all recovery SQL. --- src/db/mod.rs | 68 ++++++++++++++++++++++++++++------- src/db/models/cipher.rs | 21 +++++------ src/db/models/collection.rs | 18 +++++----- src/db/models/organization.rs | 52 +++++++++++++++++++++++---- 4 files changed, 117 insertions(+), 42 deletions(-) diff --git a/src/db/mod.rs b/src/db/mod.rs index f5177c4e..622235a2 100644 --- a/src/db/mod.rs +++ b/src/db/mod.rs @@ -472,6 +472,26 @@ const CUSTOM_ROLE_REPAIR_MIGRATION: &str = "20260723120000"; const CUSTOM_COLLECTION_PERMISSIONS_MIGRATION: &str = "20260716120000"; const DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION: &str = "20260724120000"; const CUSTOM_ROLE_SAME_RUN_MARKER_TABLE: &str = "__vw_custom_role_same_run_0716"; +const LEGACY_USER_ACCESS_ALL_RECOVERY_SQL: &str = concat!( + "\n\nReview every affected membership with this SQLite/MySQL/PostgreSQL-compatible query:\n", + "SELECT uuid, user_uuid, org_uuid, status\n", + "FROM users_organizations\n", + "WHERE atype = 2 AND access_all = TRUE;\n\n", + "After an organization owner has decided the intended outcome, replace and run exactly one ", + "guarded statement for that membership while every Vaultwarden instance is stopped. Do not bulk-promote these ", + "records.\n\n", + "Keep the User role and revoke organization-wide vault access:\n", + "UPDATE users_organizations\n", + "SET access_all = FALSE\n", + "WHERE uuid = '' AND atype = 2 AND access_all = TRUE;\n\n", + "Preserve organization-wide vault access by intentionally granting Custom Create/Edit/Delete-any collection ", + "authority:\n", + "UPDATE users_organizations\n", + "SET atype = 3\n", + "WHERE uuid = '' AND atype = 2 AND access_all = TRUE;\n\n", + "The second statement deliberately adds collection-management authority: the repair migration copies the retained ", + "access_all value to all three collection permissions before converting legacy role 3 to Custom role 4." +); #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)] #[expect( @@ -585,10 +605,15 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus unreachable!("successful preflight decisions do not produce errors") } }; + let recovery = if decision == CustomRolePreflightDecision::RefuseLegacyUserAccessAll { + LEGACY_USER_ACCESS_ALL_RECOVERY_SQL + } else { + "" + }; std::io::Error::other(format!( "Custom-role migration preflight stopped startup: {detail} Back up the database and resolve \ - the legacy membership state manually before restarting." + the legacy membership state manually before restarting.{recovery}" )) .into() } @@ -1122,9 +1147,11 @@ mod postgresql_migrations { #[cfg(test)] mod custom_role_migration_preflight_tests { + use std::error::Error as _; + use super::{ CustomRoleMigrationFacts as Facts, CustomRolePreflightDecision as Decision, custom_role_preflight_decision, - mysql_partial_unexpected_values_query, + custom_role_preflight_error, mysql_partial_unexpected_values_query, }; fn pending_repair() -> Facts { @@ -1191,16 +1218,33 @@ mod custom_role_migration_preflight_tests { #[test] fn legacy_user_access_all_requires_an_operator_decision() { - assert_eq!( - custom_role_preflight_decision( - Facts { - legacy_user_access_all_count: 1, - ..pending_repair() - }, - false, - ), - Decision::RefuseLegacyUserAccessAll - ); + let facts = Facts { + legacy_user_access_all_count: 1, + ..pending_repair() + }; + let decision = custom_role_preflight_decision(facts, false); + assert_eq!(decision, Decision::RefuseLegacyUserAccessAll); + + let error = custom_role_preflight_error(decision, facts); + let message = error.source().expect("preflight error should retain its I/O error source").to_string(); + assert!(message.contains("1 legacy User membership(s)")); + assert!(message.contains( + "SELECT uuid, user_uuid, org_uuid, status\n\ + FROM users_organizations\n\ + WHERE atype = 2 AND access_all = TRUE;" + )); + assert!(message.contains( + "SET access_all = FALSE\n\ + WHERE uuid = '' AND atype = 2 AND access_all = TRUE;" + )); + assert!(message.contains( + "SET atype = 3\n\ + WHERE uuid = '' AND atype = 2 AND access_all = TRUE;" + )); + assert!(message.contains("run exactly one guarded statement")); + assert!(message.contains("Do not bulk-promote")); + assert!(message.contains("converting legacy role 3 to Custom role 4")); + assert!(!message.contains("SET atype = 4")); } #[test] diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs index ad27f3c3..2c58ed66 100644 --- a/src/db/models/cipher.rs +++ b/src/db/models/cipher.rs @@ -26,6 +26,7 @@ use macros::UuidFromParam; use super::{ Archive, Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership, MembershipStatus, MembershipType, OrganizationId, User, UserId, + organization::custom_membership_with_edit_any_collection, }; #[derive(Identifiable, Queryable, Insertable, AsChangeset)] @@ -891,8 +892,7 @@ impl Cipher { .filter(ciphers::user_uuid.eq(user_uuid)) // Cipher owner // Edit any collection (Custom) or org admin/owner — the successor of access_all .or_filter( - users_organizations::edit_any_collection - .eq(true) + custom_membership_with_edit_any_collection() .or(users_organizations::atype.le(MembershipType::Admin as i32)), ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // Access to collection @@ -933,8 +933,7 @@ impl Cipher { .filter(ciphers::user_uuid.eq(user_uuid)) // Cipher owner // Edit any collection (Custom) or org admin/owner — the successor of access_all .or_filter( - users_organizations::edit_any_collection - .eq(true) + custom_membership_with_edit_any_collection() .or(users_organizations::atype.le(MembershipType::Admin as i32)), ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // Access to collection @@ -1059,8 +1058,7 @@ impl Cipher { .and(collections_groups::groups_uuid.eq(groups::uuid))), ) .filter( - users_organizations::edit_any_collection - .eq(true) // Custom "Edit any collection" (successor of access_all) + custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection @@ -1091,8 +1089,7 @@ impl Cipher { .and(users_collections::user_uuid.eq(user_uuid.clone()))), ) .filter( - users_organizations::edit_any_collection - .eq(true) // Custom "Edit any collection" (successor of access_all) + custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection @@ -1136,8 +1133,7 @@ impl Cipher { .and(collections_groups::groups_uuid.eq(groups::uuid))), ) .filter( - users_organizations::edit_any_collection - .eq(true) // Custom "Edit any collection" (successor of access_all) + custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection @@ -1169,8 +1165,7 @@ impl Cipher { .and(users_collections::user_uuid.eq(user_uuid.clone()))), ) .filter( - users_organizations::edit_any_collection - .eq(true) // Custom "Edit any collection" (successor of access_all) + custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection @@ -1216,7 +1211,7 @@ impl Cipher { .and(collections_groups::groups_uuid.eq(groups::uuid))), ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection - .or_filter(users_organizations::edit_any_collection.eq(true)) // Custom "Edit any collection" (successor of access_all) + .or_filter(custom_membership_with_edit_any_collection()) // Custom "Edit any collection" (successor of access_all) .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner .or_filter(groups::access_all.eq(true)) //Access via group .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index 17dfa090..cdea34d6 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -19,7 +19,7 @@ use macros::UuidFromParam; use super::{ CipherId, CollectionGroup, GroupUser, Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, - User, UserId, + User, UserId, organization::custom_membership_with_edit_any_collection, }; // See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/AdminConsole/Entities/Collection.cs @@ -265,8 +265,7 @@ impl Collection { .or( // Full-access member: Custom "Edit any collection" or org admin/owner // (successor of the removed membership access_all) - users_organizations::edit_any_collection - .eq(true) + custom_membership_with_edit_any_collection() .or(users_organizations::atype.le(MembershipType::Admin as i32)), ) .or( @@ -303,8 +302,7 @@ impl Collection { users_collections::user_uuid.eq(user_uuid).or( // Full-access member: Custom "Edit any collection" or org admin/owner // (successor of the removed membership access_all) - users_organizations::edit_any_collection - .eq(true) + custom_membership_with_edit_any_collection() .or(users_organizations::atype.le(MembershipType::Admin as i32)), ), ) @@ -391,7 +389,7 @@ impl Collection { .eq(uuid) .or( // Directly accessed collection - users_organizations::edit_any_collection.eq(true).or( + custom_membership_with_edit_any_collection().or( // Custom "Edit any collection" or org admin/owner (successor of access_all) users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner ), @@ -427,7 +425,7 @@ impl Collection { .filter(collections::uuid.eq(uuid)) .filter(users_collections::collection_uuid.eq(uuid).or( // Directly accessed collection - users_organizations::edit_any_collection.eq(true).or( + custom_membership_with_edit_any_collection().or( // Custom "Edit any collection" or org admin/owner (successor of access_all) users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner ), @@ -472,7 +470,7 @@ impl Collection { .filter( users_organizations::atype .le(MembershipType::Admin as i32) // Org admin or owner - .or(users_organizations::edit_any_collection.eq(true)) // Custom "Edit any collection" (successor of access_all) + .or(custom_membership_with_edit_any_collection()) // Custom "Edit any collection" (successor of access_all) .or(users_collections::collection_uuid .eq(&self.uuid) // write access given to collection .and(users_collections::read_only.eq(false))) @@ -505,7 +503,7 @@ impl Collection { .filter( users_organizations::atype .le(MembershipType::Admin as i32) // Org admin or owner - .or(users_organizations::edit_any_collection.eq(true)) // Custom "Edit any collection" (successor of access_all) + .or(custom_membership_with_edit_any_collection()) // Custom "Edit any collection" (successor of access_all) .or(users_collections::collection_uuid .eq(&self.uuid) // write access given to collection .and(users_collections::read_only.eq(false))), @@ -552,7 +550,7 @@ impl Collection { .and(users_collections::hide_passwords.eq(true)) .or( // Directly accessed collection - users_organizations::edit_any_collection.eq(true).or( + custom_membership_with_edit_any_collection().or( // Custom "Edit any collection" or org admin/owner (successor of access_all) users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner ), diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 6922c56e..4e63b2bc 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -68,6 +68,17 @@ pub struct Membership { pub access_reports: bool, } +/// Diesel equivalent of [`Membership::has_edit_any_collection`]. +/// +/// Keep the role check in this shared predicate so a stale flag on any non-Custom membership +/// remains inert in every collection-access query. +pub(super) fn custom_membership_with_edit_any_collection() -> diesel::dsl::And< + diesel::dsl::Eq, + diesel::dsl::Eq, +> { + users_organizations::atype.eq(MembershipType::Custom as i32).and(users_organizations::edit_any_collection.eq(true)) +} + #[derive(Identifiable, Queryable, Insertable, AsChangeset)] #[diesel(table_name = organization_api_key)] #[diesel(primary_key(uuid, org_uuid))] @@ -1112,9 +1123,7 @@ impl Membership { .filter( users_organizations::atype .eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]) - .or(users_organizations::atype - .eq(MembershipType::Custom as i32) - .and(users_organizations::edit_any_collection.eq(true))), + .or(custom_membership_with_edit_any_collection()), ) .load::(conn) .unwrap_or_default() @@ -1239,8 +1248,7 @@ impl Membership { .and(ciphers_collections::cipher_uuid.eq(&cipher_uuid))), ) .filter( - users_organizations::edit_any_collection - .eq(true) // Custom "Edit any collection" (successor of access_all) + custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(ciphers_collections::cipher_uuid.eq(&cipher_uuid)), // ..or access to collection with cipher ) @@ -1317,8 +1325,7 @@ impl Membership { .filter(users_organizations::org_uuid.eq(org_uuid)) .left_join(users_collections::table.on(users_collections::user_uuid.eq(users_organizations::user_uuid))) .filter( - users_organizations::edit_any_collection - .eq(true) // Custom "Edit any collection" (successor of access_all) + custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner .or(users_collections::collection_uuid.eq(&collection_uuid)), // ..or access to collection ) @@ -1509,6 +1516,37 @@ mod tests { assert!(!member.has_full_access()); } + #[cfg(sqlite)] + #[test] + fn diesel_edit_any_collection_predicate_is_custom_type_gated() { + use diesel::{Connection, connection::SimpleConnection, sqlite::SqliteConnection}; + + let mut conn = SqliteConnection::establish(":memory:").unwrap(); + conn.batch_execute( + "CREATE TABLE users_organizations ( + atype INTEGER NOT NULL, + edit_any_collection BOOLEAN NOT NULL + ); + INSERT INTO users_organizations (atype, edit_any_collection) VALUES + (0, TRUE), + (1, TRUE), + (2, TRUE), + (3, TRUE), + (4, FALSE), + (4, TRUE), + (5, TRUE);", + ) + .unwrap(); + + let matching_types = users_organizations::table + .select(users_organizations::atype) + .filter(custom_membership_with_edit_any_collection()) + .load::(&mut conn) + .unwrap(); + + assert_eq!(matching_types, vec![MembershipType::Custom as i32]); + } + #[test] fn edit_any_collection_does_not_imply_create_or_delete() { let mut custom = membership(MembershipType::Custom); From a1abd7d0ff9b2a8159d3c26dda794ef39f605dfa Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Thu, 30 Jul 2026 22:23:57 +0200 Subject: [PATCH 36/42] Fix custom-role review follow-ups Align edit_member with the other member endpoints, reject collection and group assignments the caller may not make, and add migration recovery hints. --- src/api/core/organizations.rs | 159 ++++++++++++++++++++++++++-------- src/db/mod.rs | 87 ++++++++++++++++++- 2 files changed, 208 insertions(+), 38 deletions(-) diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 8e7c8057..045fa562 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -1382,6 +1382,33 @@ async fn send_invite( let custom_permissions = CustomRolePermissions::from_request(new_type, &data.permissions); let grants_full_access = custom_permissions.grants_full_collection_access(new_type); + // Security: only callers who can manage collections (Admins/Owners, or users with full access) + // may assign collection access when inviting. A custom user with only manage_users can invite + // members, but cannot grant them collection access. Assigning groups is gated separately, + // because a collection-bearing group grants that access indirectly. + let caller = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await; + let caller_can_manage_collections = + headers.membership_type >= MembershipType::Admin || caller.as_ref().is_some_and(Membership::has_full_access); + let caller_can_manage_groups = + headers.membership_type >= MembershipType::Admin || caller.as_ref().is_some_and(Membership::has_manage_groups); + + // API consistency: these fields used to be dropped silently while the invite still reported + // success, so the caller believed access had been granted. Reject the request instead, and do it + // before the loop below creates any user, invitation or membership row. + if !grants_full_access && !caller_can_manage_collections && data.collections.iter().flatten().next().is_some() { + err!("You don't have permission to assign collections to invited members") + } + if !caller_can_manage_groups && !data.groups.is_empty() { + err!("You don't have permission to assign groups to invited members") + } + if !caller_can_manage_collections { + for group_id in &data.groups { + if group_confers_collection_access(group_id, &org_id, &conn).await { + err!("You don't have permission to assign a group that grants collection access") + } + } + } + let mut user_created: bool = false; for email in &data.emails { let mut member_status = MembershipStatus::Invited as i32; @@ -1465,23 +1492,12 @@ async fn send_invite( ) .await; - // Security: only callers who can manage collections (Admins/Owners, or users with full - // access) may assign collection access when inviting. A custom user with only manage_users - // can invite members, but cannot grant them collection access. - let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin - || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { - Some(m) => m.has_full_access(), - None => false, - }; - // If the member does not already reach every collection, add the collections received if !grants_full_access && caller_can_manage_collections { // Security (F-1): a per-collection `manage` grant carries delete authority, so the // caller may only confer it on collections they could delete themselves. Otherwise a // caller acting via Edit-any-collection could invite an account they control with a // `manage` row and reach Delete-any-collection through it. - let caller = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await; - for col in data.collections.iter().flatten() { match Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await { None => err!("Collection not found in Organization"), @@ -1505,27 +1521,11 @@ async fn send_invite( } } - // Security: assigning groups can indirectly grant collection access via the groups' - // collections. Only callers who may manage groups (Admins/Owners or users with - // manage_groups) are allowed to assign groups when inviting. // NOTE: every requested group was already validated against this organization in - // `InviteData::validate` above, before any record was created. - let caller_can_manage_groups = headers.membership_type >= MembershipType::Admin - || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { - Some(m) => m.has_manage_groups(), - None => false, - }; - + // `InviteData::validate`, and both the manage_groups permission and the collection-bearing + // group restriction were rejected up front, before any record was created. if caller_can_manage_groups { for group_id in &data.groups { - // Security: a caller who cannot manage collections must not grant collection - // access to the invitee by placing them into a collection-bearing group. - if !may_change_group_membership( - caller_can_manage_collections, - group_confers_collection_access(group_id, &org_id, &conn).await, - ) { - continue; - } let mut group_entry = GroupUser::new(group_id.clone(), new_member.uuid.clone()); group_entry.save(&conn).await?; } @@ -1935,6 +1935,14 @@ async fn edit_member( err!("Only Owners can edit Owner users") } + // Security: apply the same actor/target role matrix as every other member endpoint (reinvite, + // confirm, revoke, restore, delete). Without it `edit_member` was the only path on which a + // Custom member holding manage_users could aim at an Admin or at a fellow Custom membership, as + // long as the request left the role unchanged. + if !may_manage_stored_member_type(headers.membership_type, member_to_edit.atype) { + err!("You don't have permission to edit this member") + } + if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner && member_to_edit.status == MembershipStatus::Confirmed as i32 @@ -1964,6 +1972,24 @@ async fn edit_member( None => false, }; + // API consistency: dropping these fields silently while still answering 200 let client and + // server drift apart after an apparently saved change. Reject the request instead — but only + // when it would actually add or remove an assignment, because the regular edit dialog echoes the + // current assignments back and has to keep working. Flag-only differences (readOnly, + // hidePasswords, manage) remain ignored for these callers. + if !caller_can_manage_collections && !grants_full_access { + let requested: HashSet = data.collections.iter().flatten().map(|c| c.id.clone()).collect(); + let current: HashSet = + CollectionUser::find_by_organization_and_user_uuid(&org_id, &member_to_edit.user_uuid, &conn) + .await + .into_iter() + .map(|c| c.collection_uuid) + .collect(); + if requested != current { + err!("You don't have permission to change this member's collection assignments") + } + } + // Edit any collection (the successor of the removed access_all flag) grants full access to // every collection. It is part of the granular custom permissions applied here, and the // differs_from guard above already prevents a non-Admin caller from changing it — so a Custom @@ -2021,6 +2047,26 @@ async fn edit_member( None => false, }; + // API consistency, as for the collection assignments above: reject group changes this caller may + // not make instead of silently dropping them. + let requested_groups: HashSet = data.groups.iter().flatten().cloned().collect(); + let current_groups: HashSet = + GroupUser::find_by_member(&member_to_edit.uuid, &conn).await.into_iter().map(|gu| gu.groups_uuid).collect(); + if !caller_can_manage_groups && requested_groups != current_groups { + err!("You don't have permission to change this member's group assignments") + } + if caller_can_manage_groups && !caller_can_manage_collections { + let mut collection_bearing: HashSet = HashSet::new(); + for group_id in requested_groups.union(¤t_groups) { + if group_confers_collection_access(group_id, &org_id, &conn).await { + collection_bearing.insert(group_id.clone()); + } + } + if !collection_bearing_membership_unchanged(&requested_groups, ¤t_groups, &collection_bearing) { + err!("You don't have permission to change memberships in groups that grant collection access") + } + } + if caller_can_manage_groups { // Security (audit H-2): validate that every requested group belongs to this organization // *before* mutating any group membership. Otherwise a caller could link the member to a @@ -3229,6 +3275,21 @@ fn may_change_group_membership(caller_can_manage_collections: bool, group_confer caller_can_manage_collections || !group_confers_collection_access } +/// Whether `requested` and `current` agree on every group that confers collection access. +/// +/// A caller who may manage groups but not collections may only change memberships in groups that +/// confer no collection access. Anything else has to be rejected with an error rather than skipped +/// silently, so a save that appears to succeed never means something different on the server. +fn collection_bearing_membership_unchanged( + requested: &HashSet, + current: &HashSet, + collection_bearing: &HashSet, +) -> bool { + let restrict = + |set: &HashSet| -> HashSet { set.intersection(collection_bearing).cloned().collect() }; + restrict(requested) == restrict(current) +} + /// Whether a caller of `edit_member` may change a member's role type. /// /// Only Admins and Owners may change a member's role at all. A Custom member with `manage_users` @@ -4027,16 +4088,16 @@ async fn rotate_api_key( #[cfg(test)] mod tests { - use std::collections::HashMap; + use std::collections::{HashMap, HashSet}; use serde_json::{Value, json}; use super::{ - CustomRolePermissions, caller_manage_grant_role_check, filter_ciphers_for_organization, - may_change_group_membership, may_change_member_type, may_export_entire_organization, may_manage_member_type, - may_manage_stored_member_type, + CustomRolePermissions, caller_manage_grant_role_check, collection_bearing_membership_unchanged, + filter_ciphers_for_organization, may_change_group_membership, may_change_member_type, + may_export_entire_organization, may_manage_member_type, may_manage_stored_member_type, }; - use crate::db::models::{Cipher, Membership, MembershipStatus, MembershipType, OrganizationId}; + use crate::db::models::{Cipher, GroupId, Membership, MembershipStatus, MembershipType, OrganizationId}; fn confirmed_member(member_type: MembershipType) -> Membership { let mut m = Membership::new("test-user".to_owned().into(), "test-org".to_owned().into(), None); @@ -4172,6 +4233,36 @@ mod tests { assert!(may_manage_stored_member_type(MembershipType::Admin, MembershipType::Custom as i32)); assert!(!may_manage_stored_member_type(MembershipType::Owner, i32::MAX)); + + // edit_member applies the same matrix as reinvite/confirm/revoke/restore/delete, so a + // Custom caller cannot target an Admin or a fellow Custom member even when the requested + // role equals the stored one. + for target in [MembershipType::Owner, MembershipType::Admin, MembershipType::Custom] { + assert!(may_change_member_type(MembershipType::Custom, target as i32, target)); + assert!(!may_manage_stored_member_type(MembershipType::Custom, target as i32)); + } + assert!(may_manage_stored_member_type(MembershipType::Custom, MembershipType::User as i32)); + } + + #[test] + fn only_collection_bearing_group_changes_are_rejected() { + let plain: GroupId = "plain".to_owned().into(); + let bearing: GroupId = "bearing".to_owned().into(); + let collection_bearing = HashSet::from([bearing.clone()]); + + let set = |ids: &[&GroupId]| -> HashSet { ids.iter().map(|id| (*id).clone()).collect() }; + + // Adding, removing or keeping a group without collections is fine. + for (requested, current) in + [(set(&[&plain]), set(&[])), (set(&[]), set(&[&plain])), (set(&[&plain, &bearing]), set(&[&bearing]))] + { + assert!(collection_bearing_membership_unchanged(&requested, ¤t, &collection_bearing)); + } + + // Adding or removing a collection-bearing group is not. + for (requested, current) in [(set(&[&bearing]), set(&[])), (set(&[&plain]), set(&[&plain, &bearing]))] { + assert!(!collection_bearing_membership_unchanged(&requested, ¤t, &collection_bearing)); + } } #[test] diff --git a/src/db/mod.rs b/src/db/mod.rs index 622235a2..75c07d2c 100644 --- a/src/db/mod.rs +++ b/src/db/mod.rs @@ -493,6 +493,49 @@ const LEGACY_USER_ACCESS_ALL_RECOVERY_SQL: &str = concat!( "access_all value to all three collection permissions before converting legacy role 3 to Custom role 4." ); +const AMBIGUOUS_DIRECT_PERMISSIONS_RECOVERY_SQL: &str = concat!( + "\n\nList every affected membership with this SQLite/MySQL/PostgreSQL-compatible query:\n", + "SELECT uuid, user_uuid, org_uuid, atype, status\n", + "FROM users_organizations\n", + "WHERE atype IN (3, 4)\n", + " AND access_all = FALSE\n", + " AND create_new_collections = FALSE\n", + " AND edit_any_collection = TRUE\n", + " AND delete_any_collection = TRUE;\n\n", + "To see which of them still have an organization-local full-access group as a plausible source of the pattern, ", + "run the query below. On MySQL/MariaDB the reserved word `groups` has to be quoted with backticks:\n", + "SELECT uo.uuid, uo.org_uuid, g.uuid AS group_uuid, g.name AS group_name\n", + "FROM users_organizations uo\n", + "INNER JOIN groups_users gu ON gu.users_organizations_uuid = uo.uuid\n", + "INNER JOIN groups g ON g.uuid = gu.groups_uuid AND g.organizations_uuid = uo.org_uuid\n", + "WHERE g.access_all = TRUE\n", + " AND uo.atype IN (3, 4)\n", + " AND uo.access_all = FALSE\n", + " AND uo.create_new_collections = FALSE\n", + " AND uo.edit_any_collection = TRUE\n", + " AND uo.delete_any_collection = TRUE;\n\n", + "An organization owner has to decide per membership which of the two meanings applies. Replace ", + " and run exactly one guarded statement for that membership while every Vaultwarden instance is ", + "stopped. Do not bulk-apply either statement.\n\n", + "The pattern was a group-derived copy, or the authority is no longer wanted: drop it and let the group (if any) ", + "remain the only source of access.\n", + "UPDATE users_organizations\n", + "SET edit_any_collection = FALSE,\n", + " delete_any_collection = FALSE\n", + "WHERE uuid = '' AND access_all = FALSE AND create_new_collections = FALSE;\n\n", + "The pattern was an intentional direct grant that has to survive: make it unambiguous so the migration can pass.\n", + "UPDATE users_organizations\n", + "SET create_new_collections = TRUE\n", + "WHERE uuid = '' AND access_all = FALSE AND edit_any_collection = TRUE;\n\n", + "Note that the second statement also grants Create-any-collection, because a 0/1/1 pattern is exactly the state ", + "the migration cannot attribute. If that member must not be able to create collections, start the server once so ", + "the migration completes, then set create_new_collections back to FALSE for that membership." +); +const ALREADY_DROPPED_RECOVERY: &str = concat!( + "\n\nThe permission values cannot be recomputed from the current schema. Restore the database backup taken ", + "before the upgrade and run the upgrade again against that restored copy." +); + #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)] #[expect( clippy::struct_excessive_bools, @@ -605,10 +648,11 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus unreachable!("successful preflight decisions do not produce errors") } }; - let recovery = if decision == CustomRolePreflightDecision::RefuseLegacyUserAccessAll { - LEGACY_USER_ACCESS_ALL_RECOVERY_SQL - } else { - "" + let recovery = match decision { + CustomRolePreflightDecision::RefuseLegacyUserAccessAll => LEGACY_USER_ACCESS_ALL_RECOVERY_SQL, + CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions => AMBIGUOUS_DIRECT_PERMISSIONS_RECOVERY_SQL, + CustomRolePreflightDecision::RefuseAlreadyDropped => ALREADY_DROPPED_RECOVERY, + _ => "", }; std::io::Error::other(format!( @@ -1216,6 +1260,41 @@ mod custom_role_migration_preflight_tests { ); } + #[test] + fn ambiguous_direct_permissions_error_carries_a_recovery_path() { + let facts = Facts { + ambiguous_direct_permission_count: 2, + ..pending_repair() + }; + let decision = custom_role_preflight_decision(facts, false); + assert_eq!(decision, Decision::RefuseAmbiguousDirectPermissions); + + let error = custom_role_preflight_error(decision, facts); + let message = error.source().expect("preflight error should retain its I/O error source").to_string(); + assert!(message.contains("2 membership(s)")); + // The operator needs the affected memberships and their possible group source ... + assert!(message.contains("SELECT uuid, user_uuid, org_uuid, atype, status")); + assert!(message.contains("WHERE g.access_all = TRUE")); + // ... plus both decisions, and the note that keeping the grant also grants Create. + assert!(message.contains("SET edit_any_collection = FALSE,\n delete_any_collection = FALSE")); + assert!(message.contains("SET create_new_collections = TRUE")); + assert!(message.contains("also grants Create-any-collection")); + } + + #[test] + fn already_dropped_error_points_at_the_backup() { + let facts = Facts { + access_all_drop_migration_applied: true, + ..pending_repair() + }; + let decision = custom_role_preflight_decision(facts, false); + assert_eq!(decision, Decision::RefuseAlreadyDropped); + + let error = custom_role_preflight_error(decision, facts); + let message = error.source().expect("preflight error should retain its I/O error source").to_string(); + assert!(message.contains("Restore the database backup")); + } + #[test] fn legacy_user_access_all_requires_an_operator_decision() { let facts = Facts { From 35f54d76fb91e76faa017325466989be1deef501 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sat, 1 Aug 2026 15:40:30 +0200 Subject: [PATCH 37/42] Fix client event whitelist and stored collection manage serialization The client event whitelist no longer drops the newer Bitwarden item-type and organization events that the previous range check still logged. The admin console collection lists echo a plain User's stored users_collections.manage bit again, so saving an unrelated dialog no longer strips it. --- src/api/core/events.rs | 61 +++++++++++++++++++++++++++++++---- src/db/models/collection.rs | 35 ++++++++++++++++++-- src/db/models/event.rs | 20 ++++++++++++ src/db/models/organization.rs | 5 +-- 4 files changed, 111 insertions(+), 10 deletions(-) diff --git a/src/api/core/events.rs b/src/api/core/events.rs index ba859d31..6aa6b954 100644 --- a/src/api/core/events.rs +++ b/src/api/core/events.rs @@ -247,6 +247,11 @@ fn validate_client_event_batch_size(event_count: usize) -> Result<(), crate::Err Ok(()) } +/// The client-generated event types upstream's `/events/collect` accepts. Anything else is ignored, +/// so that an authenticated client cannot write arbitrary event types into an organization's audit +/// log. Keep this in sync with upstream's `CollectController`: a type missing here is silently not +/// logged, which is why the newer item-type events below are listed explicitly rather than matched +/// by range. fn client_event_kind(event_type: i32) -> Option { match event_type { event_type if event_type == EventType::UserClientExportedVault as i32 => Some(ClientEventKind::User), @@ -259,11 +264,32 @@ fn client_event_kind(event_type: i32) -> Option { || event_type == EventType::CipherClientCopiedHiddenField as i32 || event_type == EventType::CipherClientCopiedCardCode as i32 || event_type == EventType::CipherClientAutofilled as i32 - || event_type == EventType::CipherClientToggledCardNumberVisible as i32 => + || event_type == EventType::CipherClientToggledCardNumberVisible as i32 + || event_type == EventType::CipherClientCopiedBankAccountNumber as i32 + || event_type == EventType::CipherClientCopiedBankAccountPin as i32 + || event_type == EventType::CipherClientToggledBankAccountNumberVisible as i32 + || event_type == EventType::CipherClientToggledBankAccountPinVisible as i32 + || event_type == EventType::CipherClientCopiedLicenseNumber as i32 + || event_type == EventType::CipherClientToggledLicenseNumberVisible as i32 + || event_type == EventType::CipherClientCopiedPassportNumber as i32 + || event_type == EventType::CipherClientToggledPassportNumberVisible as i32 + || event_type == EventType::CipherClientCopiedSwiftCode as i32 + || event_type == EventType::CipherClientToggledSwiftCodeVisible as i32 + || event_type == EventType::CipherClientCopiedIban as i32 + || event_type == EventType::CipherClientToggledIbanVisible as i32 + || event_type == EventType::CipherClientCopiedNationalIdentificationNumber as i32 + || event_type == EventType::CipherClientToggledNationalIdentificationNumberVisible as i32 => { Some(ClientEventKind::Cipher) } - event_type if event_type == EventType::OrganizationClientExportedVault as i32 => { + event_type + if event_type == EventType::OrganizationClientExportedVault as i32 + || event_type == EventType::OrganizationItemOrganizationAccepted as i32 + || event_type == EventType::OrganizationItemOrganizationDeclined as i32 + || event_type == EventType::OrganizationAutoConfirmEnabledAdmin as i32 + || event_type == EventType::OrganizationAutoConfirmDisabledAdmin as i32 + || event_type == EventType::OrganizationInviteLinkClientCopied as i32 => + { Some(ClientEventKind::Organization) } _ => None, @@ -584,13 +610,36 @@ mod tests { EventType::CipherClientCopiedCardCode, EventType::CipherClientAutofilled, EventType::CipherClientToggledCardNumberVisible, + EventType::CipherClientCopiedBankAccountNumber, + EventType::CipherClientCopiedBankAccountPin, + EventType::CipherClientToggledBankAccountNumberVisible, + EventType::CipherClientToggledBankAccountPinVisible, + EventType::CipherClientCopiedLicenseNumber, + EventType::CipherClientToggledLicenseNumberVisible, + EventType::CipherClientCopiedPassportNumber, + EventType::CipherClientToggledPassportNumberVisible, + EventType::CipherClientCopiedSwiftCode, + EventType::CipherClientToggledSwiftCodeVisible, + EventType::CipherClientCopiedIban, + EventType::CipherClientToggledIbanVisible, + EventType::CipherClientCopiedNationalIdentificationNumber, + EventType::CipherClientToggledNationalIdentificationNumberVisible, ] { assert_eq!(client_event_kind(event_type as i32), Some(ClientEventKind::Cipher)); } - assert_eq!( - client_event_kind(EventType::OrganizationClientExportedVault as i32), - Some(ClientEventKind::Organization) - ); + for event_type in [ + EventType::OrganizationClientExportedVault, + EventType::OrganizationItemOrganizationAccepted, + EventType::OrganizationItemOrganizationDeclined, + EventType::OrganizationAutoConfirmEnabledAdmin, + EventType::OrganizationAutoConfirmDisabledAdmin, + EventType::OrganizationInviteLinkClientCopied, + ] { + assert_eq!(client_event_kind(event_type as i32), Some(ClientEventKind::Organization)); + } + + // Upstream does not accept the TOTP seed toggle from clients either. + assert_eq!(client_event_kind(1118), None); for event_type in [ EventType::UserLoggedIn, diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index cdea34d6..e61e9bfc 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -55,6 +55,10 @@ pub struct CollectionCipher { /// Serialize the assignment-level `manage` capability using the same role boundary as the /// collection mutation guards. Read/write access is deliberately not management authority. +/// +/// This answers "may this member manage this collection?" and therefore belongs on the objects a +/// member receives about themselves. For the administrative lists that echo a *stored* grant back +/// to the client, use `stored_assignment_manage` instead. pub(super) fn assignment_manage_for_member(membership_type: i32, stored_manage: bool) -> bool { match MembershipType::from_i32(membership_type) { Some(MembershipType::Owner | MembershipType::Admin) => true, @@ -63,6 +67,18 @@ pub(super) fn assignment_manage_for_member(membership_type: i32, stored_manage: } } +/// Serialize a *stored* per-collection assignment row for the admin-console access lists. +/// +/// These lists describe the grant an administrator configured, and the client writes the very same +/// value back when the dialog is saved. Reporting anything other than the persisted bit would make +/// an unrelated save silently strip it — for a plain User that would also revoke the cipher write +/// access `users_collections.manage` still grants (see `Cipher::get_access_restrictions`). Admins +/// and Owners manage implicitly, so they are reported as managing regardless of the stored row. +pub(super) fn stored_assignment_manage(membership_type: i32, stored_manage: bool) -> bool { + matches!(MembershipType::from_i32(membership_type), Some(MembershipType::Owner | MembershipType::Admin)) + || stored_manage +} + /// Local methods impl Collection { pub fn new(org_uuid: OrganizationId, name: String, external_id: Option) -> Self { @@ -938,7 +954,7 @@ impl CollectionMembership { "id": self.membership_uuid, "readOnly": self.read_only, "hidePasswords": self.hide_passwords, - "manage": assignment_manage_for_member(membership_type, self.manage), + "manage": stored_assignment_manage(membership_type, self.manage), }) } } @@ -975,9 +991,24 @@ pub struct CollectionId(String); #[cfg(test)] mod tests { - use super::assignment_manage_for_member; + use super::{assignment_manage_for_member, stored_assignment_manage}; use crate::db::models::MembershipType; + // A stored `users_collections.manage` row must survive being listed in the admin console and + // written back unchanged. Reporting `false` for a plain User made an unrelated save strip the + // grant, which also revoked the cipher write access the row still confers. + #[test] + fn stored_assignment_manage_echoes_the_persisted_grant() { + for role in [MembershipType::Owner, MembershipType::Admin] { + assert!(stored_assignment_manage(role as i32, false)); + } + + for role in [MembershipType::Custom, MembershipType::User] { + assert!(stored_assignment_manage(role as i32, true)); + assert!(!stored_assignment_manage(role as i32, false)); + } + } + #[test] fn assignment_manage_matches_collection_guard_role_boundaries() { for role in [MembershipType::Owner, MembershipType::Admin] { diff --git a/src/db/models/event.rs b/src/db/models/event.rs index 3a6b610c..2554ddda 100644 --- a/src/db/models/event.rs +++ b/src/db/models/event.rs @@ -79,6 +79,21 @@ pub enum EventType { CipherSoftDeleted = 1115, CipherRestored = 1116, CipherClientToggledCardNumberVisible = 1117, + // CipherClientToggledTOTPSeedVisible = 1118, // Not accepted from clients by upstream either + CipherClientCopiedBankAccountNumber = 1119, + CipherClientCopiedBankAccountPin = 1120, + CipherClientToggledBankAccountNumberVisible = 1121, + CipherClientToggledBankAccountPinVisible = 1122, + CipherClientCopiedLicenseNumber = 1123, + CipherClientToggledLicenseNumberVisible = 1124, + CipherClientCopiedPassportNumber = 1125, + CipherClientToggledPassportNumberVisible = 1126, + CipherClientCopiedSwiftCode = 1127, + CipherClientToggledSwiftCodeVisible = 1128, + CipherClientCopiedIban = 1129, + CipherClientToggledIbanVisible = 1130, + CipherClientCopiedNationalIdentificationNumber = 1131, + CipherClientToggledNationalIdentificationNumberVisible = 1132, // Collection CollectionCreated = 1300, @@ -120,6 +135,11 @@ pub enum EventType { // OrganizationDisabledKeyConnector = 1607, // Not supported // OrganizationSponsorshipsSynced = 1608, // Not supported // OrganizationCollectionManagementUpdated = 1609, // Not supported + OrganizationItemOrganizationAccepted = 1618, + OrganizationItemOrganizationDeclined = 1619, + OrganizationAutoConfirmEnabledAdmin = 1620, + OrganizationAutoConfirmDisabledAdmin = 1621, + OrganizationInviteLinkClientCopied = 1627, // Policy PolicyUpdated = 1700, diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 4e63b2bc..3630baaf 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -25,7 +25,8 @@ use macros::UuidFromParam; use super::{ Cipher, CipherId, Collection, CollectionGroup, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, - OrgPolicyType, TwoFactor, User, UserId, collection::assignment_manage_for_member as assignment_manage, + OrgPolicyType, TwoFactor, User, UserId, + collection::{assignment_manage_for_member as assignment_manage, stored_assignment_manage}, }; #[derive(Identifiable, Queryable, Insertable, AsChangeset)] @@ -619,7 +620,7 @@ impl Membership { let (read_only, hide_passwords, manage) = if self.has_full_access() { (false, false, assignment_manage(self.atype, false)) } else if let Some(cu) = cu.get(&c.uuid) { - (cu.read_only, cu.hide_passwords, assignment_manage(self.atype, cu.manage)) + (cu.read_only, cu.hide_passwords, stored_assignment_manage(self.atype, cu.manage)) // If previous checks failed it might be that this user has access via a group, but we should not return those elements here // Those are returned via a special group endpoint } else if cg.contains(&c.uuid) { From f61e4fe7273e62147284e81c78f67cba8263f360 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 5 Aug 2026 21:13:23 +0200 Subject: [PATCH 38/42] Address custom-role review findings - Migrate legacy `access_all` Users losslessly into per-collection assignments instead of refusing to start the server. - Keep provisioning of Admin/Owner memberships Owner-only (invite, confirm, delete); state changes stay as they were. - Drop the new organization-import gate; the import stays authorized per target collection, and now requires a confirmed membership. - Scope `accessReports` to the caller's own collections instead of handing out every cipher in the organization. - Let `createNewCollections` read the collection list it needs. - Reject group changes a caller may not make instead of silently dropping them. - Detect partially applied permission-column migrations on MySQL. - Drop the migration bookkeeping table and remove dead code. --- .../up.sql | 40 +- .../down.sql | 11 +- .../up.sql | 8 +- .../up.sql | 41 +- .../down.sql | 11 +- .../up.sql | 8 +- .../up.sql | 40 +- .../down.sql | 11 +- .../up.sql | 8 +- src/api/core/organizations.rs | 252 +++++++++--- src/db/mod.rs | 380 ++++++++++++------ src/db/models/organization.rs | 23 +- 12 files changed, 572 insertions(+), 261 deletions(-) diff --git a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index 3186fe6a..a20f7543 100644 --- a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -1,15 +1,33 @@ --- A normal User with the historical membership-level access_all bit cannot be mapped to the --- Custom role without adding collection-management authority. Stop before dropping the source bit. -CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( - blocked INTEGER NOT NULL PRIMARY KEY +-- A normal User with the historical membership-level access_all bit reached every collection of the +-- organization with full read/write, but held no collection-management authority. Mapping that onto +-- the Custom role would add authority, clearing the bit would remove existing access — so instead, +-- materialize the reach as explicit per-collection assignments while the source bit still exists. +-- `manage` stays FALSE, so no management authority is invented. This is the same approach Bitwarden +-- took when it retired `accessAll`; the one behavioral difference is that the access is no longer +-- dynamic, i.e. collections created later are not added automatically. +-- +-- Step 1: a pre-existing assignment was overridden by access_all (full read/write regardless of +-- read_only/hide_passwords), so relax it to match what the member actually had. +UPDATE users_collections +SET read_only = FALSE, + hide_passwords = FALSE +WHERE EXISTS ( + SELECT 1 + FROM users_organizations AS uo + INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid + WHERE uo.atype = 2 + AND uo.access_all = TRUE + AND uo.user_uuid = users_collections.user_uuid + AND c.uuid = users_collections.collection_uuid ); -INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); -INSERT INTO __vw_legacy_user_access_all_guard (blocked) -SELECT 1 -FROM users_organizations -WHERE atype = 2 AND access_all = TRUE -LIMIT 1; -DROP TEMPORARY TABLE __vw_legacy_user_access_all_guard; + +-- Step 2: add the assignments that did not exist yet. Existing rows are left to step 1. +INSERT IGNORE INTO users_collections (user_uuid, collection_uuid, read_only, hide_passwords, manage) +SELECT uo.user_uuid, c.uuid, FALSE, FALSE, FALSE +FROM users_organizations AS uo +INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid +WHERE uo.atype = 2 + AND uo.access_all = TRUE; -- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the -- exact direct 0/1/1 pattern. While the same organization-local source group is still present, diff --git a/migrations/mysql/2026-07-24-120000_drop_membership_access_all/down.sql b/migrations/mysql/2026-07-24-120000_drop_membership_access_all/down.sql index 01295bf5..a2035691 100644 --- a/migrations/mysql/2026-07-24-120000_drop_membership_access_all/down.sql +++ b/migrations/mysql/2026-07-24-120000_drop_membership_access_all/down.sql @@ -1,6 +1,13 @@ -- Recreate the column and repopulate it from the role/permission model that replaced it, restoring --- the invariant older server versions rely on: access_all == access to every collection. That is --- exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +-- the invariant the immediately preceding schema relies on: access_all == access to every collection. +-- That is exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +-- +-- NOTE: this only holds for reverting *this* migration. Reverting further down the chain, +-- 2026-07-16 deliberately recomputes access_all as (create AND edit AND delete) for Custom members, +-- because in that older schema access_all also meant the legacy Manager "Manage all collections" +-- authority -- so a member who only held `edit_any_collection` comes out as a Manager *without* +-- access_all rather than silently gaining collection deletion. That is intentional and fail-closed; +-- the full rollback is blocked by 2026-07-24-140000/down.sql anyway. ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); UPDATE users_organizations SET access_all = TRUE WHERE atype = 4 AND edit_any_collection = TRUE; diff --git a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql index af5fed1b..f3f3a7a7 100644 --- a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql +++ b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -1,3 +1,7 @@ --- Forward migration marker. Its down migration intentionally blocks an automatic lossy downgrade +-- Forward migration marker: its down migration intentionally blocks an automatic lossy downgrade -- before any granular permission column is removed. -SELECT 1; +-- +-- It also cleans up after 2026-07-15: the same-run bookkeeping table has served its purpose by now +-- (2026-07-23 consumed the marker), so it is not left behind in every database. A single DDL +-- statement is safe even on MySQL, where DDL commits implicitly -- re-running it is a no-op. +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; diff --git a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index 6d75889c..e75897fa 100644 --- a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -1,15 +1,34 @@ --- A normal User with the historical membership-level access_all bit cannot be mapped to the --- Custom role without adding collection-management authority. Stop before dropping the source bit. -CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( - blocked INTEGER NOT NULL PRIMARY KEY +-- A normal User with the historical membership-level access_all bit reached every collection of the +-- organization with full read/write, but held no collection-management authority. Mapping that onto +-- the Custom role would add authority, clearing the bit would remove existing access — so instead, +-- materialize the reach as explicit per-collection assignments while the source bit still exists. +-- `manage` stays FALSE, so no management authority is invented. This is the same approach Bitwarden +-- took when it retired `accessAll`; the one behavioral difference is that the access is no longer +-- dynamic, i.e. collections created later are not added automatically. +-- +-- Step 1: a pre-existing assignment was overridden by access_all (full read/write regardless of +-- read_only/hide_passwords), so relax it to match what the member actually had. +UPDATE users_collections +SET read_only = FALSE, + hide_passwords = FALSE +WHERE EXISTS ( + SELECT 1 + FROM users_organizations AS uo + INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid + WHERE uo.atype = 2 + AND uo.access_all = TRUE + AND uo.user_uuid = users_collections.user_uuid + AND c.uuid = users_collections.collection_uuid ); -INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); -INSERT INTO __vw_legacy_user_access_all_guard (blocked) -SELECT 1 -FROM users_organizations -WHERE atype = 2 AND access_all = TRUE -LIMIT 1; -DROP TABLE __vw_legacy_user_access_all_guard; + +-- Step 2: add the assignments that did not exist yet. Existing rows are left to step 1. +INSERT INTO users_collections (user_uuid, collection_uuid, read_only, hide_passwords, manage) +SELECT uo.user_uuid, c.uuid, FALSE, FALSE, FALSE +FROM users_organizations AS uo +INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid +WHERE uo.atype = 2 + AND uo.access_all = TRUE +ON CONFLICT (user_uuid, collection_uuid) DO NOTHING; -- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the -- exact direct 0/1/1 pattern. While the same organization-local source group is still present, diff --git a/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/down.sql b/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/down.sql index 01295bf5..a2035691 100644 --- a/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/down.sql +++ b/migrations/postgresql/2026-07-24-120000_drop_membership_access_all/down.sql @@ -1,6 +1,13 @@ -- Recreate the column and repopulate it from the role/permission model that replaced it, restoring --- the invariant older server versions rely on: access_all == access to every collection. That is --- exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +-- the invariant the immediately preceding schema relies on: access_all == access to every collection. +-- That is exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +-- +-- NOTE: this only holds for reverting *this* migration. Reverting further down the chain, +-- 2026-07-16 deliberately recomputes access_all as (create AND edit AND delete) for Custom members, +-- because in that older schema access_all also meant the legacy Manager "Manage all collections" +-- authority -- so a member who only held `edit_any_collection` comes out as a Manager *without* +-- access_all rather than silently gaining collection deletion. That is intentional and fail-closed; +-- the full rollback is blocked by 2026-07-24-140000/down.sql anyway. ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); UPDATE users_organizations SET access_all = TRUE WHERE atype = 4 AND edit_any_collection = TRUE; diff --git a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql index af5fed1b..f3f3a7a7 100644 --- a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql +++ b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -1,3 +1,7 @@ --- Forward migration marker. Its down migration intentionally blocks an automatic lossy downgrade +-- Forward migration marker: its down migration intentionally blocks an automatic lossy downgrade -- before any granular permission column is removed. -SELECT 1; +-- +-- It also cleans up after 2026-07-15: the same-run bookkeeping table has served its purpose by now +-- (2026-07-23 consumed the marker), so it is not left behind in every database. A single DDL +-- statement is safe even on MySQL, where DDL commits implicitly -- re-running it is a no-op. +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; diff --git a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index 6d75889c..6a66682a 100644 --- a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -1,15 +1,33 @@ --- A normal User with the historical membership-level access_all bit cannot be mapped to the --- Custom role without adding collection-management authority. Stop before dropping the source bit. -CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( - blocked INTEGER NOT NULL PRIMARY KEY +-- A normal User with the historical membership-level access_all bit reached every collection of the +-- organization with full read/write, but held no collection-management authority. Mapping that onto +-- the Custom role would add authority, clearing the bit would remove existing access — so instead, +-- materialize the reach as explicit per-collection assignments while the source bit still exists. +-- `manage` stays FALSE, so no management authority is invented. This is the same approach Bitwarden +-- took when it retired `accessAll`; the one behavioral difference is that the access is no longer +-- dynamic, i.e. collections created later are not added automatically. +-- +-- Step 1: a pre-existing assignment was overridden by access_all (full read/write regardless of +-- read_only/hide_passwords), so relax it to match what the member actually had. +UPDATE users_collections +SET read_only = FALSE, + hide_passwords = FALSE +WHERE EXISTS ( + SELECT 1 + FROM users_organizations AS uo + INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid + WHERE uo.atype = 2 + AND uo.access_all = TRUE + AND uo.user_uuid = users_collections.user_uuid + AND c.uuid = users_collections.collection_uuid ); -INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); -INSERT INTO __vw_legacy_user_access_all_guard (blocked) -SELECT 1 -FROM users_organizations -WHERE atype = 2 AND access_all = TRUE -LIMIT 1; -DROP TABLE __vw_legacy_user_access_all_guard; + +-- Step 2: add the assignments that did not exist yet. Existing rows are left to step 1. +INSERT OR IGNORE INTO users_collections (user_uuid, collection_uuid, read_only, hide_passwords, manage) +SELECT uo.user_uuid, c.uuid, FALSE, FALSE, FALSE +FROM users_organizations AS uo +INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid +WHERE uo.atype = 2 + AND uo.access_all = TRUE; -- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the -- exact direct 0/1/1 pattern. While the same organization-local source group is still present, diff --git a/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql b/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql index 01295bf5..a2035691 100644 --- a/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql +++ b/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql @@ -1,6 +1,13 @@ -- Recreate the column and repopulate it from the role/permission model that replaced it, restoring --- the invariant older server versions rely on: access_all == access to every collection. That is --- exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +-- the invariant the immediately preceding schema relies on: access_all == access to every collection. +-- That is exactly Owners/Admins, plus Custom members holding `edit_any_collection`. +-- +-- NOTE: this only holds for reverting *this* migration. Reverting further down the chain, +-- 2026-07-16 deliberately recomputes access_all as (create AND edit AND delete) for Custom members, +-- because in that older schema access_all also meant the legacy Manager "Manage all collections" +-- authority -- so a member who only held `edit_any_collection` comes out as a Manager *without* +-- access_all rather than silently gaining collection deletion. That is intentional and fail-closed; +-- the full rollback is blocked by 2026-07-24-140000/down.sql anyway. ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); UPDATE users_organizations SET access_all = TRUE WHERE atype = 4 AND edit_any_collection = TRUE; diff --git a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql index af5fed1b..f3f3a7a7 100644 --- a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql +++ b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -1,3 +1,7 @@ --- Forward migration marker. Its down migration intentionally blocks an automatic lossy downgrade +-- Forward migration marker: its down migration intentionally blocks an automatic lossy downgrade -- before any granular permission column is removed. -SELECT 1; +-- +-- It also cleans up after 2026-07-15: the same-run bookkeeping table has served its purpose by now +-- (2026-07-23 consumed the marker), so it is not left behind in every database. A single DDL +-- statement is safe even on MySQL, where DDL commits implicitly -- re-running it is a no-op. +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 045fa562..72a57e22 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -400,7 +400,10 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos let can_read_collection_list = headers.membership.has_full_access() || headers.membership.has_manage_users() || headers.membership.has_manage_groups() - || headers.membership.has_delete_any_collection(); + || headers.membership.has_delete_any_collection() + // Create new collections needs the list too: the client resolves the parent of a nested + // collection against it and refreshes it after a create. + || headers.membership.has_create_new_collections(); if !can_read_collection_list { err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code); } @@ -437,8 +440,10 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea // (metadata only) so the web client can render member/group collection assignments // without crashing on collections it can't otherwise see. This exposes names/ids // only, never cipher contents. manage_policies does not need the collection list. - let can_read_collection_list = - member.has_manage_users() || member.has_manage_groups() || member.has_delete_any_collection(); + let can_read_collection_list = member.has_manage_users() + || member.has_manage_groups() + || member.has_delete_any_collection() + || member.has_create_new_collections(); // Delete any collection can reveal collection access metadata, matching Bitwarden's // ReadAllWithAccess behavior, but still does not grant cipher access. Manage Users/Groups // retain the narrower metadata-only view introduced by the base PR. @@ -1047,64 +1052,78 @@ async fn get_assigned_org_details(data: OrgIdData, headers: Headers, conn: DbCon ); } - let ciphers = filter_ciphers_for_organization( - Cipher::find_by_user_visible(&headers.user.uuid, &conn).await, - &data.organization_id, - ); - let cipher_sync_data = CipherSyncData::new(&headers.user.uuid, CipherSyncType::User, &conn).await; + Ok(Json(json!({ + "data": assigned_org_ciphers_json(&data.organization_id, &headers.host, &headers.user.uuid, &conn).await?, + "object": "list", + "continuationToken": null, + }))) +} + +// Serialize exactly the organization ciphers the user is actually assigned to, directly or via a +// group. `CipherSyncType::User` keeps the per-cipher access restrictions in place, so nothing outside +// the caller's own collections is returned and every cipher carries its real `edit`/`viewPassword` +// flags. +// +// NOTE: as everywhere else in Vaultwarden (and in Bitwarden), a `hidePasswords` assignment is +// reported to the client as `viewPassword: false` rather than redacted server-side. This therefore +// returns exactly what the same member already receives from `/api/sync` — never more. +async fn assigned_org_ciphers_json( + org_id: &OrganizationId, + host: &str, + user_id: &UserId, + conn: &DbConn, +) -> Result { + let ciphers = filter_ciphers_for_organization(Cipher::find_by_user_visible(user_id, conn).await, org_id); + let cipher_sync_data = CipherSyncData::new(user_id, CipherSyncType::User, conn).await; let mut ciphers_json = Vec::with_capacity(ciphers.len()); for cipher in ciphers { - ciphers_json.push( - cipher - .to_json(&headers.host, &headers.user.uuid, Some(&cipher_sync_data), CipherSyncType::User, &conn) - .await?, - ); + ciphers_json.push(cipher.to_json(host, user_id, Some(&cipher_sync_data), CipherSyncType::User, conn).await?); } - Ok(Json(json!({ - "data": ciphers_json, - "object": "list", - "continuationToken": null, - }))) + Ok(Value::Array(ciphers_json)) } -// Returns every cipher in the organization, serialized with `CipherSyncType::Organization` — which -// deliberately skips the per-cipher access restrictions, so `readOnly`/`hidePasswords` are not -// applied and collection assignments are ignored. Whoever passes the check below reads the whole -// organization vault. +// The organization cipher list the clients use for the admin vault view and for computing every +// report (Exposed/Reused/Weak Passwords, Unsecured Websites, Inactive 2FA, ...) locally — Vaultwarden +// has no server-side reports. +// +// Two different answers, depending on how much the caller may actually read: // -// `accessReports` is therefore, by design, a full organization *read* permission and not merely -// "may open the reports screen". Vaultwarden implements no server-side reports: the clients fetch -// this list and compute Exposed/Reused/Weak Passwords, Unsecured Websites, Inactive 2FA etc. -// locally, so the permission cannot be satisfied with less data. +// * Members who already reach every collection (Admin/Owner, or Custom + `editAnyCollection`) get +// the whole organization, serialized with `CipherSyncType::Organization` which deliberately skips +// the per-cipher access restrictions. This is unchanged behavior. // -// This matches Bitwarden upstream, which grants the same endpoint to Owner/Admin and to Custom -// members holding AccessImportExport, EditAnyCollection *or* AccessReports: -// https://github.com/bitwarden/server/blob/main/src/Api/Vault/Controllers/CiphersController.cs -// (`CanAccessAllCiphersAsync`) +// * `accessReports` opens the endpoint *without* widening what may be read: the response is built +// from the caller's own assignments with `CipherSyncType::User`, so `readOnly`/`hidePasswords` +// still apply and collections the member is not assigned to never appear. Their reports therefore +// cover exactly their own collections. // -// We are intentionally *stricter* than Bitwarden for `accessImportExport`: it does not open this -// endpoint, and `get_org_export` scopes its output to the caller's own collections, so -// "may export" never widens what a member can read. Granting `accessReports` does widen it — that -// is the documented trade-off of staying Bitwarden-compatible, and administrators must treat -// `accessReports` as equivalent to read access to every collection in the organization. +// This mirrors `accessImportExport`/`get_org_export`: a permission decides *whether* a member may use +// a feature, never *what* they may read. Bitwarden upstream is more permissive here (its +// `CanAccessAllCiphersAsync` grants the full organization to AccessReports as well); we deliberately +// deviate so that ticking "Access reports" cannot hand out read access to every password in the +// organization. #[get("/ciphers/organization-details?")] async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { if data.organization_id != headers.membership.org_uuid { err_code!("Resource not found.", "Organization id's do not match", rocket::http::Status::NotFound.code); } - if !headers.membership.has_full_access() && !headers.membership.has_access_reports() { + let ciphers_json = if headers.membership.has_full_access() { + get_org_details_impl(&data.organization_id, &headers.host, &headers.user.uuid, &conn).await? + } else if headers.membership.has_access_reports() { + assigned_org_ciphers_json(&data.organization_id, &headers.host, &headers.user.uuid, &conn).await? + } else { err_code!( "Resource not found.", - "User does not have permission to access all organization ciphers", + "User does not have permission to read the organization ciphers", rocket::http::Status::NotFound.code ); - } + }; Ok(Json(json!({ - "data": get_org_details_impl(&data.organization_id, &headers.host, &headers.user.uuid, &conn).await?, + "data": ciphers_json, "object": "list", "continuationToken": null, }))) @@ -1372,7 +1391,7 @@ async fn send_invite( err!("Invalid type") }; - if !may_manage_member_type(headers.membership_type, new_type) { + if !may_provision_member_type(headers.membership_type, new_type) { err!("You don't have permission to invite this role") } @@ -1781,7 +1800,7 @@ async fn confirm_invite_impl( err!("The specified user isn't a member of the organization") }; - if !may_manage_stored_member_type(headers.membership_type, member_to_confirm.atype) { + if !may_provision_stored_member_type(headers.membership_type, member_to_confirm.atype) { err!("You don't have permission to confirm this user") } @@ -2192,7 +2211,7 @@ async fn delete_member_impl( err!("User to delete isn't member of the organization") }; - if !may_manage_stored_member_type(headers.membership_type, member_to_delete.atype) { + if !may_provision_stored_member_type(headers.membership_type, member_to_delete.atype) { err!("You don't have permission to delete this user") } @@ -2305,17 +2324,19 @@ async fn post_org_import( err!("Organization not found", "Organization id's do not match"); } - // accessImportExport: importing into the organization requires the permission (or Admin/Owner), - // mirroring the export endpoint and the Bitwarden permission model. The web-vault only offers org - // import to members holding this permission; enforcing it server-side keeps the two consistent. - // NOTE: this tightens the previous member-level behaviour (any confirmed member could import into - // collections they could write) — see the branch notes. - if !(headers.membership.has_status(MembershipStatus::Confirmed) - && (headers.membership.atype >= MembershipType::Admin || headers.membership.has_access_import_export())) - { - err!( - "You need the 'Access Import/Export' permission, or to be an Admin or Owner, to import into this organization" - ) + // NOTE: no `accessImportExport` gate here on purpose. Bitwarden requires that permission for an + // organization import, but Vaultwarden has always authorized this endpoint per target collection, + // and adding an up-front role check would take a capability away from ordinary members that they + // have today. The real boundary is enforced below and is unchanged: an existing collection must be + // writable for the caller (`Collection::is_writable_by_user`), and creating a new one requires the + // independent `createNewCollections` permission. `accessImportExport` therefore governs the export + // side only. + // + // A confirmed membership is required though: both checks below are confirmed-gated, so an + // invited/accepted member could otherwise only import ciphers without any collection — which lands + // unreachable, unmanaged ciphers in the organization. + if !headers.membership.has_status(MembershipStatus::Confirmed) { + err!("You need to be a confirmed member of this organization to import into it") } let data: ImportData = data.into_inner(); @@ -3154,14 +3175,25 @@ async fn post_groups( None => false, }; - let mut group = group_request.to_group(&org_id); // Security: `access_all` grants the group access to every collection, so it is a // collection-access grant just like assigning collections. A custom user without // collection-management rights must not be able to create an access_all group. + // + // API consistency: reject instead of silently creating a group without the requested access, so a + // caller never believes it granted something the server dropped. A request that grants nothing + // (no access_all, no collections) is still accepted, which is what the plain "new group" dialog + // sends for such a caller. if !caller_can_manage_collections { - group.access_all = false; + if group_request.access_all { + err!("You don't have permission to create a group with access to all collections") + } + if !group_request.collections.is_empty() { + err!("You don't have permission to assign collections to a group") + } } + let group = group_request.to_group(&org_id); + log_event( EventType::GroupCreated as i32, &group.uuid, @@ -3215,22 +3247,36 @@ async fn put_group( // Security: only callers who can actually manage collections (Admins/Owners, or users with // full access) may change a group's collection assignments. A custom user with only - // manage_groups must not be able to add/remove collection access. For them we keep the - // group's existing collection assignments untouched (neither cleared nor overwritten). + // manage_groups must not be able to add/remove collection access. let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { Some(m) => m.has_full_access(), None => false, }; - // Preserve the current `access_all` grant for callers who can't manage collections, so a - // manage_groups-only user cannot turn a group into an access_all (all-collections) grant. - let previous_access_all = group.access_all; - let mut updated_group = group_request.update_group(group); + // API consistency: reject a collection-access change this caller may not make instead of + // answering 200 and silently keeping the old value — the same rule `edit_member` and + // `send_invite` follow. Only an actual difference is rejected (the regular group dialog echoes + // the current assignments back and has to keep working), and per-assignment flag differences + // (readOnly, hidePasswords, manage) stay ignored, exactly as for a member's assignments. if !caller_can_manage_collections { - updated_group.access_all = previous_access_all; + if group_request.access_all != group.access_all { + err!("You don't have permission to change a group's access to all collections") + } + + let requested: HashSet = group_request.collections.iter().map(|c| c.id.clone()).collect(); + let current: HashSet = CollectionGroup::find_by_group(&group_id, &org_id, &conn) + .await + .into_iter() + .map(|cg| cg.collections_uuid) + .collect(); + if requested != current { + err!("You don't have permission to change this group's collection assignments") + } } + let updated_group = group_request.update_group(group); + if caller_can_manage_collections { CollectionGroup::delete_all_by_group(&group_id, &org_id, &conn).await?; } @@ -3319,6 +3365,30 @@ fn may_manage_stored_member_type(caller_type: MembershipType, target_atype: i32) MembershipType::from_i32(target_atype).is_some_and(|target_type| may_manage_member_type(caller_type, target_type)) } +/// Whether a caller may *provision* a membership of `target_type` — create it (invite), activate it +/// (confirm) or remove it (delete). +/// +/// This is deliberately stricter than [`may_manage_member_type`] and preserves the pre-existing +/// Vaultwarden rule that only Owners bring Admin (or Owner) memberships into or out of existence +/// ("Only Owners can invite Managers, Admins or Owners" / "Only Owners can delete Admins or Owners"). +/// `edit_member` keeps that boundary too, via its dedicated Owner-only guard on Admin/Owner role +/// transitions, so an Admin must not be able to route around it by inviting a fresh Admin instead. +/// State changes that leave the membership in place (reinvite, revoke, restore, edit) keep using +/// [`may_manage_member_type`], which is what Vaultwarden allowed for them before this feature. +fn may_provision_member_type(caller_type: MembershipType, target_type: MembershipType) -> bool { + match caller_type { + MembershipType::Owner => true, + MembershipType::Admin => target_type < MembershipType::Admin, + MembershipType::Custom => target_type == MembershipType::User, + MembershipType::User => false, + } +} + +fn may_provision_stored_member_type(caller_type: MembershipType, target_atype: i32) -> bool { + MembershipType::from_i32(target_atype) + .is_some_and(|target_type| may_provision_member_type(caller_type, target_type)) +} + /// Returns true if being a member of `group_id` confers collection access — either because the /// group has `access_all` set, or because it has collections assigned. async fn group_confers_collection_access(group_id: &GroupId, org_id: &OrganizationId, conn: &DbConn) -> bool { @@ -3400,6 +3470,26 @@ async fn add_update_group( conn: &DbConn, caller_can_manage_collections: bool, ) -> JsonResult { + // Security: assigning members to a group that grants collection access (via `access_all` or + // assigned collections) would indirectly grant those members access to the collections' contents, + // and removing them would revoke it. Only callers who can manage collections may change the + // membership of such a group. + // + // API consistency: reject a membership change this caller may not make instead of answering 200 + // and keeping the old membership — same rule as `edit_member`/`send_invite`. Checked before the + // first write so a rejected request leaves nothing behind. On create the group is brand new, so + // it grants no collection access yet and this never triggers. + if !caller_can_manage_collections + && (group.access_all || !CollectionGroup::find_by_group(&group.uuid, &org_id, conn).await.is_empty()) + { + let requested: HashSet<&MembershipId> = members.iter().collect(); + let current_members = GroupUser::find_by_group(&group.uuid, &org_id, conn).await; + let current: HashSet<&MembershipId> = current_members.iter().map(|gu| &gu.users_organizations_uuid).collect(); + if requested != current { + err!("You don't have permission to change the membership of a group that grants collection access") + } + } + group.save(conn).await?; // Security (F-1): a `collections_groups.manage` grant carries collection delete authority, so a @@ -4096,6 +4186,7 @@ mod tests { CustomRolePermissions, caller_manage_grant_role_check, collection_bearing_membership_unchanged, filter_ciphers_for_organization, may_change_group_membership, may_change_member_type, may_export_entire_organization, may_manage_member_type, may_manage_stored_member_type, + may_provision_member_type, may_provision_stored_member_type, }; use crate::db::models::{Cipher, GroupId, Membership, MembershipStatus, MembershipType, OrganizationId}; @@ -4244,6 +4335,43 @@ mod tests { assert!(may_manage_stored_member_type(MembershipType::Custom, MembershipType::User as i32)); } + #[test] + fn only_owners_provision_admin_memberships() { + // REGRESSION: bringing an Admin (or Owner) membership into or out of existence stays + // Owner-only, exactly as before this feature ("Only Owners can invite Managers, Admins or + // Owners" / "Only Owners can delete Admins or Owners"). Otherwise an Admin could route around + // the Owner-only role-change guard in `edit_member` by inviting a fresh Admin instead. + for target in [MembershipType::Owner, MembershipType::Admin, MembershipType::Custom, MembershipType::User] { + assert!(may_provision_member_type(MembershipType::Owner, target)); + } + + assert!(!may_provision_member_type(MembershipType::Admin, MembershipType::Owner)); + assert!(!may_provision_member_type(MembershipType::Admin, MembershipType::Admin)); + assert!(may_provision_member_type(MembershipType::Admin, MembershipType::Custom)); + assert!(may_provision_member_type(MembershipType::Admin, MembershipType::User)); + + // A Custom member with manage_users stays limited to ordinary Users, as for every other + // lifecycle action. + assert!(may_provision_member_type(MembershipType::Custom, MembershipType::User)); + for target in [MembershipType::Owner, MembershipType::Admin, MembershipType::Custom] { + assert!(!may_provision_member_type(MembershipType::Custom, target)); + } + for target in [MembershipType::Owner, MembershipType::Admin, MembershipType::Custom, MembershipType::User] { + assert!(!may_provision_member_type(MembershipType::User, target)); + } + + // Provisioning is strictly narrower than the state-change matrix: an Admin may still revoke, + // restore or edit a peer Admin (which Vaultwarden allowed before), but no longer create, + // confirm or delete one. + assert!(may_manage_member_type(MembershipType::Admin, MembershipType::Admin)); + assert!(!may_provision_member_type(MembershipType::Admin, MembershipType::Admin)); + + assert!(may_provision_stored_member_type(MembershipType::Admin, MembershipType::User as i32)); + assert!(!may_provision_stored_member_type(MembershipType::Admin, MembershipType::Admin as i32)); + // An unknown stored role never qualifies. + assert!(!may_provision_stored_member_type(MembershipType::Owner, i32::MAX)); + } + #[test] fn only_collection_bearing_group_changes_are_rejected() { let plain: GroupId = "plain".to_owned().into(); diff --git a/src/db/mod.rs b/src/db/mod.rs index 75c07d2c..65b39eab 100644 --- a/src/db/mod.rs +++ b/src/db/mod.rs @@ -471,26 +471,67 @@ impl<'r> FromRequest<'r> for DbConn { const CUSTOM_ROLE_REPAIR_MIGRATION: &str = "20260723120000"; const CUSTOM_COLLECTION_PERMISSIONS_MIGRATION: &str = "20260716120000"; const DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION: &str = "20260724120000"; +const CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION: &str = "20260630120000"; +const CUSTOM_ACCESS_PERMISSIONS_MIGRATION: &str = "20260724130000"; const CUSTOM_ROLE_SAME_RUN_MARKER_TABLE: &str = "__vw_custom_role_same_run_0716"; -const LEGACY_USER_ACCESS_ALL_RECOVERY_SQL: &str = concat!( - "\n\nReview every affected membership with this SQLite/MySQL/PostgreSQL-compatible query:\n", - "SELECT uuid, user_uuid, org_uuid, status\n", - "FROM users_organizations\n", - "WHERE atype = 2 AND access_all = TRUE;\n\n", - "After an organization owner has decided the intended outcome, replace and run exactly one ", - "guarded statement for that membership while every Vaultwarden instance is stopped. Do not bulk-promote these ", - "records.\n\n", - "Keep the User role and revoke organization-wide vault access:\n", - "UPDATE users_organizations\n", - "SET access_all = FALSE\n", - "WHERE uuid = '' AND atype = 2 AND access_all = TRUE;\n\n", - "Preserve organization-wide vault access by intentionally granting Custom Create/Edit/Delete-any collection ", - "authority:\n", - "UPDATE users_organizations\n", - "SET atype = 3\n", - "WHERE uuid = '' AND atype = 2 AND access_all = TRUE;\n\n", - "The second statement deliberately adds collection-management authority: the repair migration copies the retained ", - "access_all value to all three collection permissions before converting legacy role 3 to Custom role 4." + +/// One of the three groups of granular permission columns, each added by its own migration. +/// +/// A partially present group means the migration was interrupted between its `ALTER TABLE` +/// statements. On MySQL/MariaDB that is reachable because DDL commits implicitly, so the ledger entry +/// can be missing while some columns already exist; re-running the migration then fails forever with +/// `Duplicate column name`. Detect it and hand the operator an unambiguous fix instead. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +enum PermissionColumnGroup { + Manage, + Collection, + Access, +} + +impl PermissionColumnGroup { + const fn migration(self) -> &'static str { + match self { + Self::Manage => CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION, + Self::Collection => CUSTOM_COLLECTION_PERMISSIONS_MIGRATION, + Self::Access => CUSTOM_ACCESS_PERMISSIONS_MIGRATION, + } + } + + /// SQL list literal of the group's column names, for the `IN (...)` lookups. + const fn column_list(self) -> &'static str { + match self { + Self::Manage => "'manage_users', 'manage_groups', 'manage_policies'", + Self::Collection => "'create_new_collections', 'edit_any_collection', 'delete_any_collection'", + Self::Access => "'access_event_logs', 'access_import_export', 'access_reports'", + } + } + + const fn description(self) -> &'static str { + match self { + Self::Manage => "custom management-permission", + Self::Collection => "custom collection-permission", + Self::Access => "custom access-permission", + } + } +} + +const PARTIAL_PERMISSION_COLUMNS_RECOVERY: &str = concat!( + "\n\nThis happens when a migration was interrupted between its ALTER TABLE statements (on ", + "MySQL/MariaDB every DDL statement commits on its own, so columns can exist without the ledger ", + "entry). The leftover columns only ever hold their FALSE default at this point, so dropping them ", + "loses nothing and lets the migration run again from a clean state.\n\n", + "List the columns that are already present:\n", + "SELECT column_name\n", + "FROM information_schema.columns\n", + "WHERE table_name = 'users_organizations'\n", + " AND column_name IN ('manage_users', 'manage_groups', 'manage_policies',\n", + " 'create_new_collections', 'edit_any_collection', 'delete_any_collection',\n", + " 'access_event_logs', 'access_import_export', 'access_reports');\n\n", + "(On SQLite: SELECT name FROM pragma_table_info('users_organizations');)\n\n", + "Then, with every Vaultwarden instance stopped and a backup taken, drop exactly the columns of ", + "the affected group that the message above names, e.g.:\n", + "ALTER TABLE users_organizations DROP COLUMN ;\n\n", + "Afterwards restart Vaultwarden so the migration applies the whole group in one go." ); const AMBIGUOUS_DIRECT_PERMISSIONS_RECOVERY_SQL: &str = concat!( @@ -545,15 +586,35 @@ struct CustomRoleMigrationFacts { memberships_table_exists: bool, migration_table_exists: bool, access_all_column_exists: bool, + manage_permission_columns: i64, + manage_permissions_migration_applied: bool, collection_permission_columns: i64, collection_permissions_migration_applied: bool, + access_permission_columns: i64, + access_permissions_migration_applied: bool, repair_migration_applied: bool, access_all_drop_migration_applied: bool, - legacy_user_access_all_count: i64, ambiguous_direct_permission_count: i64, same_run_0716_marker: bool, } +impl CustomRoleMigrationFacts { + /// `(columns present, migration recorded)` for one permission column group. + const fn permission_columns(self, group: PermissionColumnGroup) -> (i64, bool) { + match group { + PermissionColumnGroup::Manage => { + (self.manage_permission_columns, self.manage_permissions_migration_applied) + } + PermissionColumnGroup::Collection => { + (self.collection_permission_columns, self.collection_permissions_migration_applied) + } + PermissionColumnGroup::Access => { + (self.access_permission_columns, self.access_permissions_migration_applied) + } + } + } +} + #[derive(Clone, Copy, Debug, Eq, PartialEq)] enum CustomRolePreflightDecision { Proceed, @@ -561,10 +622,9 @@ enum CustomRolePreflightDecision { RefuseAlreadyDropped, RefuseMissingAccessAll, RefuseMissingMigrationLedger, - RefuseLegacyUserAccessAll, RefuseAmbiguousDirectPermissions, - RefusePartialCollectionSchema, - RefuseCollectionLedgerMismatch, + RefusePartialPermissionSchema(PermissionColumnGroup), + RefusePermissionLedgerMismatch(PermissionColumnGroup), } fn custom_role_preflight_decision( @@ -587,21 +647,27 @@ fn custom_role_preflight_decision( return CustomRolePreflightDecision::RefuseMissingAccessAll; } - if facts.legacy_user_access_all_count != 0 { - return CustomRolePreflightDecision::RefuseLegacyUserAccessAll; - } if facts.ambiguous_direct_permission_count != 0 && !facts.same_run_0716_marker { return CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions; } - match (facts.collection_permission_columns, facts.collection_permissions_migration_applied) { - (0, false) | (3, true) => CustomRolePreflightDecision::Proceed, - (3, false) if can_complete_mysql_partial_migration => { - CustomRolePreflightDecision::CompleteMysqlCollectionMigration + // Every permission column group must be either completely absent (its migration is still pending) + // or completely present with its ledger entry. Anything else is an interrupted migration whose + // re-run would fail with `Duplicate column name`, so refuse with an actionable message. The single + // historical exception is the collection group on MySQL, where the known-good partial state is + // completed in place. + for group in [PermissionColumnGroup::Manage, PermissionColumnGroup::Collection, PermissionColumnGroup::Access] { + match facts.permission_columns(group) { + (0, false) | (3, true) => {} + (3, false) if group == PermissionColumnGroup::Collection && can_complete_mysql_partial_migration => { + return CustomRolePreflightDecision::CompleteMysqlCollectionMigration; + } + (_, true) => return CustomRolePreflightDecision::RefusePermissionLedgerMismatch(group), + _ => return CustomRolePreflightDecision::RefusePartialPermissionSchema(group), } - (_, true) => CustomRolePreflightDecision::RefuseCollectionLedgerMismatch, - _ => CustomRolePreflightDecision::RefusePartialCollectionSchema, } + + CustomRolePreflightDecision::Proceed } fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: CustomRoleMigrationFacts) -> Error { @@ -621,36 +687,35 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus Refusing to guess which schema and data migrations were previously applied." .to_owned() } - CustomRolePreflightDecision::RefuseLegacyUserAccessAll => format!( - "{} legacy User membership(s) still have membership access_all=true. Mapping these \ - records to Custom/EditAny would add management authority, while clearing the bit \ - would remove existing vault access.", - facts.legacy_user_access_all_count - ), CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions => format!( "Found {} membership(s) with an ambiguous 0/1/1 collection-permission pattern. It is \ not possible to distinguish an older group-derived backfill from an intentional \ direct Edit+Delete assignment.", facts.ambiguous_direct_permission_count ), - CustomRolePreflightDecision::RefusePartialCollectionSchema => format!( - "Found {} of the three custom collection-permission columns without a completed \ - {CUSTOM_COLLECTION_PERMISSIONS_MIGRATION} migration. This is not an automatically \ - recoverable state for this database backend.", - facts.collection_permission_columns + CustomRolePreflightDecision::RefusePartialPermissionSchema(group) => format!( + "Found {} of the three {} columns ({}) without a completed {} migration. The migration \ + was interrupted between its ALTER TABLE statements.", + facts.permission_columns(group).0, + group.description(), + group.column_list(), + group.migration() ), - CustomRolePreflightDecision::RefuseCollectionLedgerMismatch => format!( - "Migration {CUSTOM_COLLECTION_PERMISSIONS_MIGRATION} is recorded, but only {} of its \ - three collection-permission columns exist.", - facts.collection_permission_columns + CustomRolePreflightDecision::RefusePermissionLedgerMismatch(group) => format!( + "Migration {} is recorded, but only {} of its three {} columns ({}) exist.", + group.migration(), + facts.permission_columns(group).0, + group.description(), + group.column_list() ), CustomRolePreflightDecision::Proceed | CustomRolePreflightDecision::CompleteMysqlCollectionMigration => { unreachable!("successful preflight decisions do not produce errors") } }; let recovery = match decision { - CustomRolePreflightDecision::RefuseLegacyUserAccessAll => LEGACY_USER_ACCESS_ALL_RECOVERY_SQL, CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions => AMBIGUOUS_DIRECT_PERMISSIONS_RECOVERY_SQL, + CustomRolePreflightDecision::RefusePartialPermissionSchema(_) + | CustomRolePreflightDecision::RefusePermissionLedgerMismatch(_) => PARTIAL_PERMISSION_COLUMNS_RECOVERY, CustomRolePreflightDecision::RefuseAlreadyDropped => ALREADY_DROPPED_RECOVERY, _ => "", }; @@ -761,14 +826,28 @@ mod sqlite_migrations { "SELECT COUNT(*) AS count FROM pragma_table_info('users_organizations') \ WHERE name = 'access_all'", )? != 0; - let collection_permission_columns = count( - connection, - "SELECT COUNT(*) AS count FROM pragma_table_info('users_organizations') \ - WHERE name IN ('create_new_collections', 'edit_any_collection', 'delete_any_collection')", - )?; + let permission_columns = |connection: &mut diesel::sqlite::SqliteConnection, + group: super::PermissionColumnGroup| + -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM pragma_table_info('users_organizations') \ + WHERE name IN ({})", + group.column_list() + ), + ) + }; + let manage_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Manage)?; + let collection_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Collection)?; + let access_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Access)?; + let manage_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION)?; let collection_permissions_migration_applied = migration_table_exists && migration_applied(connection, super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION)?; + let access_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ACCESS_PERMISSIONS_MIGRATION)?; let repair_migration_applied = migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_REPAIR_MIGRATION)?; let access_all_drop_migration_applied = @@ -780,16 +859,6 @@ mod sqlite_migrations { format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), )? != 0; - let legacy_user_access_all_count = if access_all_column_exists { - count( - connection, - "SELECT COUNT(*) AS count FROM users_organizations \ - WHERE atype = 2 AND access_all = TRUE", - )? - } else { - 0 - }; - let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { count( connection, @@ -808,11 +877,14 @@ mod sqlite_migrations { memberships_table_exists, migration_table_exists, access_all_column_exists, + manage_permission_columns, + manage_permissions_migration_applied, collection_permission_columns, collection_permissions_migration_applied, + access_permission_columns, + access_permissions_migration_applied, repair_migration_applied, access_all_drop_migration_applied, - legacy_user_access_all_count, ambiguous_direct_permission_count, same_run_0716_marker, }; @@ -968,17 +1040,27 @@ mod mysql_migrations { AND table_name = 'users_organizations' \ AND column_name = 'access_all'", )? != 0; - let collection_permission_columns = count( - connection, - "SELECT COUNT(*) AS count FROM information_schema.columns \ - WHERE table_schema = DATABASE() \ - AND table_name = 'users_organizations' \ - AND column_name IN \ - ('create_new_collections', 'edit_any_collection', 'delete_any_collection')", - )?; + let permission_columns = |connection: &mut diesel::mysql::MysqlConnection, + group: super::PermissionColumnGroup| + -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = 'users_organizations' AND column_name IN ({})", + group.column_list() + ), + ) + }; + let manage_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Manage)?; + let collection_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Collection)?; + let access_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Access)?; + let manage_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION)?; let collection_permissions_migration_applied = migration_table_exists && migration_applied(connection, super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION)?; + let access_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ACCESS_PERMISSIONS_MIGRATION)?; let repair_migration_applied = migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_REPAIR_MIGRATION)?; let access_all_drop_migration_applied = @@ -990,16 +1072,6 @@ mod mysql_migrations { format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), )? != 0; - let legacy_user_access_all_count = if access_all_column_exists { - count( - connection, - "SELECT COUNT(*) AS count FROM users_organizations \ - WHERE atype = 2 AND access_all = TRUE", - )? - } else { - 0 - }; - let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { count( connection, @@ -1018,11 +1090,14 @@ mod mysql_migrations { memberships_table_exists, migration_table_exists, access_all_column_exists, + manage_permission_columns, + manage_permissions_migration_applied, collection_permission_columns, collection_permissions_migration_applied, + access_permission_columns, + access_permissions_migration_applied, repair_migration_applied, access_all_drop_migration_applied, - legacy_user_access_all_count, ambiguous_direct_permission_count, same_run_0716_marker, }; @@ -1111,17 +1186,27 @@ mod postgresql_migrations { AND table_name = 'users_organizations' \ AND column_name = 'access_all'", )? != 0; - let collection_permission_columns = count( - connection, - "SELECT COUNT(*) AS count FROM information_schema.columns \ - WHERE table_schema = current_schema() \ - AND table_name = 'users_organizations' \ - AND column_name IN \ - ('create_new_collections', 'edit_any_collection', 'delete_any_collection')", - )?; + let permission_columns = |connection: &mut diesel::pg::PgConnection, + group: super::PermissionColumnGroup| + -> Result { + count( + connection, + format!( + "SELECT COUNT(*) AS count FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = 'users_organizations' AND column_name IN ({})", + group.column_list() + ), + ) + }; + let manage_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Manage)?; + let collection_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Collection)?; + let access_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Access)?; + let manage_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION)?; let collection_permissions_migration_applied = migration_table_exists && migration_applied(connection, super::CUSTOM_COLLECTION_PERMISSIONS_MIGRATION)?; + let access_permissions_migration_applied = + migration_table_exists && migration_applied(connection, super::CUSTOM_ACCESS_PERMISSIONS_MIGRATION)?; let repair_migration_applied = migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_REPAIR_MIGRATION)?; let access_all_drop_migration_applied = @@ -1133,16 +1218,6 @@ mod postgresql_migrations { format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), )? != 0; - let legacy_user_access_all_count = if access_all_column_exists { - count( - connection, - "SELECT COUNT(*) AS count FROM users_organizations \ - WHERE atype = 2 AND access_all = TRUE", - )? - } else { - 0 - }; - let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { count( connection, @@ -1161,11 +1236,14 @@ mod postgresql_migrations { memberships_table_exists, migration_table_exists, access_all_column_exists, + manage_permission_columns, + manage_permissions_migration_applied, collection_permission_columns, collection_permissions_migration_applied, + access_permission_columns, + access_permissions_migration_applied, repair_migration_applied, access_all_drop_migration_applied, - legacy_user_access_all_count, ambiguous_direct_permission_count, same_run_0716_marker, }; @@ -1295,35 +1373,70 @@ mod custom_role_migration_preflight_tests { assert!(message.contains("Restore the database backup")); } + // REGRESSION: a legacy `User` membership with the historical access_all bit must NOT stop the + // upgrade. The 2026-07-23 migration materializes that reach as explicit per-collection + // assignments, so the preflight has nothing left to decide and every other fact stays untouched. #[test] - fn legacy_user_access_all_requires_an_operator_decision() { - let facts = Facts { - legacy_user_access_all_count: 1, - ..pending_repair() - }; - let decision = custom_role_preflight_decision(facts, false); - assert_eq!(decision, Decision::RefuseLegacyUserAccessAll); + fn legacy_user_access_all_no_longer_blocks_the_upgrade() { + assert_eq!(custom_role_preflight_decision(pending_repair(), false), Decision::Proceed); + assert_eq!( + custom_role_preflight_decision( + Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + manage_permission_columns: 3, + manage_permissions_migration_applied: true, + ..pending_repair() + }, + false, + ), + Decision::Proceed + ); + } - let error = custom_role_preflight_error(decision, facts); - let message = error.source().expect("preflight error should retain its I/O error source").to_string(); - assert!(message.contains("1 legacy User membership(s)")); - assert!(message.contains( - "SELECT uuid, user_uuid, org_uuid, status\n\ - FROM users_organizations\n\ - WHERE atype = 2 AND access_all = TRUE;" - )); - assert!(message.contains( - "SET access_all = FALSE\n\ - WHERE uuid = '' AND atype = 2 AND access_all = TRUE;" - )); - assert!(message.contains( - "SET atype = 3\n\ - WHERE uuid = '' AND atype = 2 AND access_all = TRUE;" - )); - assert!(message.contains("run exactly one guarded statement")); - assert!(message.contains("Do not bulk-promote")); - assert!(message.contains("converting legacy role 3 to Custom role 4")); - assert!(!message.contains("SET atype = 4")); + #[test] + fn a_partial_permission_column_group_is_refused_with_an_actionable_message() { + // Every group is checked, not just the collection one: an interrupted MySQL migration can + // leave `manage_*` or `access_*` columns behind, and re-running it would fail forever with + // `Duplicate column name`. + for (facts, group, expected) in [ + ( + Facts { + manage_permission_columns: 2, + ..pending_repair() + }, + "manage_users", + Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Manage), + ), + ( + Facts { + manage_permission_columns: 3, + manage_permissions_migration_applied: true, + access_permission_columns: 3, + ..pending_repair() + }, + "access_event_logs", + Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Access), + ), + ( + Facts { + manage_permission_columns: 1, + manage_permissions_migration_applied: true, + ..pending_repair() + }, + "manage_users", + Decision::RefusePermissionLedgerMismatch(super::PermissionColumnGroup::Manage), + ), + ] { + // `true` = MySQL: only the historical collection-group state is auto-completed, never these. + assert_eq!(custom_role_preflight_decision(facts, true), expected); + assert_eq!(custom_role_preflight_decision(facts, false), expected); + + let error = custom_role_preflight_error(expected, facts); + let message = error.source().expect("preflight error should retain its I/O error source").to_string(); + assert!(message.contains(group), "message should name the affected columns: {message}"); + assert!(message.contains("ALTER TABLE users_organizations DROP COLUMN")); + } } #[test] @@ -1375,7 +1488,10 @@ mod custom_role_migration_preflight_tests { ..pending_repair() }; assert_eq!(custom_role_preflight_decision(facts, true), Decision::CompleteMysqlCollectionMigration); - assert_eq!(custom_role_preflight_decision(facts, false), Decision::RefusePartialCollectionSchema); + assert_eq!( + custom_role_preflight_decision(facts, false), + Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Collection) + ); } #[test] @@ -1406,7 +1522,7 @@ mod custom_role_migration_preflight_tests { }, true, ), - Decision::RefusePartialCollectionSchema + Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Collection) ); assert_eq!( custom_role_preflight_decision( @@ -1417,7 +1533,7 @@ mod custom_role_migration_preflight_tests { }, true, ), - Decision::RefuseCollectionLedgerMismatch + Decision::RefusePermissionLedgerMismatch(super::PermissionColumnGroup::Collection) ); } } diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 3630baaf..f74e0aca 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -15,7 +15,7 @@ use crate::{ db::{ DbConn, schema::{ - ciphers, ciphers_collections, collections, collections_groups, groups, groups_users, org_policies, + ciphers_collections, collections, collections_groups, groups, groups_users, org_policies, organization_api_key, organizations, users, users_collections, users_organizations, }, }, @@ -1295,27 +1295,6 @@ impl Membership { .await } - pub async fn user_has_ge_admin_access_to_cipher(user_uuid: &UserId, cipher_uuid: &CipherId, conn: &DbConn) -> bool { - conn.run(move |conn| { - users_organizations::table - .inner_join( - ciphers::table.on(ciphers::uuid - .eq(cipher_uuid) - .and(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable()))), - ) - .filter(users_organizations::user_uuid.eq(user_uuid)) - .filter( - users_organizations::atype.eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]), - ) - .count() - .first::(conn) - .ok() - .unwrap_or(0) - != 0 - }) - .await - } - pub async fn find_by_collection_and_org( collection_uuid: &CollectionId, org_uuid: &OrganizationId, From 634d9b2bd311c1d581e07c19374f30374d1ab252 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sat, 8 Aug 2026 18:01:23 +0200 Subject: [PATCH 39/42] Fix migration portability and preserve legacy group collection authority - SQLite: the access_all drop used ALTER TABLE ... DROP COLUMN, which needs SQLite 3.35 while a sqlite_system build links whatever the host provides and libsqlite3-sys accepts 3.34.1. Use the portable table rebuild instead. - Preflight: it returned Proceed for every database carrying the repair migration. Both the access_all drop and the access-permission columns run after that repair, so their interrupted MySQL/MariaDB states went undetected and every restart failed with 1091/1060. Check schema and ledger after the repair too, complete a recorded-drop-without-ledger in place, and refuse the remaining states with a recovery path. - Keep deriving a legacy Manager's collection edit/delete from the organization-local access_all group it came from, rather than dropping the authority when the repair removes its 0/1/1 copy. Stays revocable with the group; collection creation remains the independent permission. - post_org_import: Bitwarden does not require accessImportExport either, it authorizes on that permission *or* per-collection create/import authority. --- .../up.sql | 4 +- .../up.sql | 4 +- .../up.sql | 4 +- .../up.sql | 43 +++- src/api/core/organizations.rs | 26 ++- src/auth.rs | 16 +- src/db/mod.rs | 219 ++++++++++++++++-- src/db/models/collection.rs | 22 +- src/db/models/organization.rs | 55 +++++ 9 files changed, 349 insertions(+), 44 deletions(-) diff --git a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index a20f7543..b7d93cdc 100644 --- a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -31,7 +31,9 @@ WHERE uo.atype = 2 -- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the -- exact direct 0/1/1 pattern. While the same organization-local source group is still present, --- remove that deterministic copy so later group removal also revokes the authority. +-- remove that deterministic copy so later group removal also revokes the authority. The runtime +-- keeps deriving edit/delete from that group -- see +-- `Membership::has_legacy_group_collection_manage_access` -- so nothing is lost here. UPDATE users_organizations SET edit_any_collection = FALSE, delete_any_collection = FALSE diff --git a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index e75897fa..aca9d21d 100644 --- a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -32,7 +32,9 @@ ON CONFLICT (user_uuid, collection_uuid) DO NOTHING; -- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the -- exact direct 0/1/1 pattern. While the same organization-local source group is still present, --- remove that deterministic copy so later group removal also revokes the authority. +-- remove that deterministic copy so later group removal also revokes the authority. The runtime +-- keeps deriving edit/delete from that group -- see +-- `Membership::has_legacy_group_collection_manage_access` -- so nothing is lost here. UPDATE users_organizations SET edit_any_collection = FALSE, delete_any_collection = FALSE diff --git a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index 6a66682a..404f9fd9 100644 --- a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -31,7 +31,9 @@ WHERE uo.atype = 2 -- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the -- exact direct 0/1/1 pattern. While the same organization-local source group is still present, --- remove that deterministic copy so later group removal also revokes the authority. +-- remove that deterministic copy so later group removal also revokes the authority. The runtime +-- keeps deriving edit/delete from that group -- see +-- `Membership::has_legacy_group_collection_manage_access` -- so nothing is lost here. UPDATE users_organizations SET edit_any_collection = FALSE, delete_any_collection = FALSE diff --git a/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql b/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql index e11fb611..3638bc7a 100644 --- a/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql +++ b/migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql @@ -2,4 +2,45 @@ -- reach every collection". It is now fully represented by the role model: Owners/Admins hold it -- implicitly, and a Custom member holds it via `edit_any_collection`. Drop the redundant column. -- This only concerns users_organizations; groups.access_all is a separate, still-supported feature. -ALTER TABLE users_organizations DROP COLUMN access_all; +-- +-- `ALTER TABLE ... DROP COLUMN` is deliberately NOT used here: it only exists since SQLite 3.35.0, +-- while a `sqlite_system` build links whatever the host provides and libsqlite3-sys accepts 3.34.1 +-- (which is what Debian 11 ships). Forward migrations have to run on every supported build, so use +-- the portable table rebuild instead -- the same pattern as +-- 2022-03-02-210038_update_devices_primary_key. Vaultwarden runs SQLite migrations with +-- `PRAGMA foreign_keys = OFF`, so dropping the old table does not cascade into groups_users. +CREATE TABLE users_organizations_new ( + uuid TEXT NOT NULL PRIMARY KEY, + user_uuid TEXT NOT NULL REFERENCES users (uuid), + org_uuid TEXT NOT NULL REFERENCES organizations (uuid), + + akey TEXT NOT NULL, + status INTEGER NOT NULL, + atype INTEGER NOT NULL, + reset_password_key TEXT, + external_id TEXT, + invited_by_email TEXT DEFAULT NULL, + manage_users BOOLEAN NOT NULL DEFAULT FALSE, + manage_groups BOOLEAN NOT NULL DEFAULT FALSE, + manage_policies BOOLEAN NOT NULL DEFAULT FALSE, + create_new_collections BOOLEAN NOT NULL DEFAULT FALSE, + edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE, + delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE, + + UNIQUE (user_uuid, org_uuid) +); + +INSERT INTO users_organizations_new ( + uuid, user_uuid, org_uuid, akey, status, atype, reset_password_key, external_id, + invited_by_email, manage_users, manage_groups, manage_policies, + create_new_collections, edit_any_collection, delete_any_collection +) +SELECT + uuid, user_uuid, org_uuid, akey, status, atype, reset_password_key, external_id, + invited_by_email, manage_users, manage_groups, manage_policies, + create_new_collections, edit_any_collection, delete_any_collection +FROM users_organizations; + +DROP TABLE users_organizations; + +ALTER TABLE users_organizations_new RENAME TO users_organizations; diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 72a57e22..13c915c5 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -2324,13 +2324,15 @@ async fn post_org_import( err!("Organization not found", "Organization id's do not match"); } - // NOTE: no `accessImportExport` gate here on purpose. Bitwarden requires that permission for an - // organization import, but Vaultwarden has always authorized this endpoint per target collection, - // and adding an up-front role check would take a capability away from ordinary members that they - // have today. The real boundary is enforced below and is unchanged: an existing collection must be - // writable for the caller (`Collection::is_writable_by_user`), and creating a new one requires the - // independent `createNewCollections` permission. `accessImportExport` therefore governs the export - // side only. + // NOTE: no `accessImportExport` gate here on purpose. Bitwarden does not require the permission + // either — `ImportCiphersController.CheckOrgImportPermissionAsync` authorizes an organization + // import on `AccessImportExport` *or* per-collection Create/ImportCiphers authority. Vaultwarden + // has always authorized this endpoint per target collection, so an up-front role check would take + // a capability away from ordinary members that they have today. The real boundary is enforced + // below and is unchanged: an existing collection must be writable for the caller + // (`Collection::is_writable_by_user`), and creating a new one requires the independent + // `createNewCollections` permission. The one deliberate difference from Bitwarden is that + // `accessImportExport` alone does not open the endpoint here; it governs the export side only. // // A confirmed membership is required though: both checks below are confirmed-gated, so an // invited/accepted member could otherwise only import ciphers without any collection — which lands @@ -3418,11 +3420,13 @@ async fn caller_may_grant_collection_manage(caller: &Membership, col_id: &Collec match caller_manage_grant_role_check(caller) { // Role alone decides it (Admin/Owner or delete_any -> yes; User/unknown/unconfirmed -> no). Some(decision) => decision, - // Custom without delete_any: the answer is per-collection and must reflect a *real* manage - // grant. A Custom member must prove a real users_collections.manage / - // collections_groups.manage grant; Edit any collection deliberately does not count here. + // Custom without delete_any: the answer is per-collection and must mirror + // `collection_delete_access` exactly, so it can never hand out a right the caller lacks — + // a real users_collections.manage / collections_groups.manage grant, or the legacy + // organization-local `access_all` group that also confers deletion. Edit any collection + // deliberately does not count here. None => match MembershipType::from_i32(caller.atype) { - Some(MembershipType::Custom) => caller.has_explicit_collection_manage_access(col_id, conn).await, + Some(MembershipType::Custom) => caller.has_collection_manage_authority(col_id, conn).await, _ => false, }, } diff --git a/src/auth.rs b/src/auth.rs index 39533abd..ceb57816 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -1008,8 +1008,9 @@ fn collection_access_by_role(membership: &Membership, custom_has_any_access: boo match MembershipType::from_i32(membership.atype) { Some(MembershipType::Owner | MembershipType::Admin) => CollectionManageAccess::Any, Some(MembershipType::Custom) if custom_has_any_access => CollectionManageAccess::Any, - // A Custom member must prove an actual users_collections.manage or - // collections_groups.manage assignment. In particular, groups.access_all is not Manage. + // A Custom member must prove an actual users_collections.manage / collections_groups.manage + // assignment, or the legacy organization-local `access_all` group a Manager's authority used + // to come from. Membership-level `access_all` is gone and never counted here. Some(MembershipType::Custom) => CollectionManageAccess::ExplicitManage, Some(MembershipType::User) | None => CollectionManageAccess::Denied, } @@ -1039,7 +1040,7 @@ async fn can_manage_collection( match access { CollectionManageAccess::Any => true, CollectionManageAccess::ExplicitManage => { - membership.has_explicit_collection_manage_access(collection_uuid, conn).await + membership.has_collection_manage_authority(collection_uuid, conn).await } CollectionManageAccess::Denied => false, } @@ -1695,10 +1696,11 @@ mod tests { #[test] fn flagless_custom_requires_explicit_manage_for_edit_read_and_delete() { - // A flagless Custom member (this is what a migrated legacy Manager becomes) must prove a - // real per-collection Manage grant for every collection operation. ExplicitManage invokes - // the database helper that only accepts users_collections.manage / collections_groups.manage - // — an external groups.access_all grant deliberately does not switch to a broad helper. + // A flagless Custom member (this is what a migrated legacy Manager becomes) never gets + // blanket collection authority from its role alone: every collection operation has to be + // answered per collection. ExplicitManage invokes the database helper that accepts a real + // users_collections.manage / collections_groups.manage grant, or the legacy + // organization-local access_all group — never the membership-level access_all that is gone. let custom = membership(MembershipType::Custom); assert_eq!(collection_edit_access(&custom), CollectionManageAccess::ExplicitManage); assert_eq!(collection_read_access(&custom), CollectionManageAccess::ExplicitManage); diff --git a/src/db/mod.rs b/src/db/mod.rs index 65b39eab..6261c1c4 100644 --- a/src/db/mod.rs +++ b/src/db/mod.rs @@ -572,6 +572,24 @@ const AMBIGUOUS_DIRECT_PERMISSIONS_RECOVERY_SQL: &str = concat!( "the migration cannot attribute. If that member must not be able to create collections, start the server once so ", "the migration completes, then set create_new_collections back to FALSE for that membership." ); +const INTERRUPTED_ACCESS_ALL_DROP_RECOVERY: &str = concat!( + "\n\nThe drop itself carries no data, so the schema is already in its intended final state and ", + "only the ledger entry is missing. Vaultwarden completes this automatically on MySQL/MariaDB, ", + "where it is reachable because DDL commits implicitly. On this backend DDL is transactional, so ", + "the state points at a manual schema change. With every Vaultwarden instance stopped and a ", + "backup taken, record the migration:\n", + "INSERT INTO __diesel_schema_migrations (version) VALUES ('20260724120000');\n\n", + "Afterwards restart Vaultwarden so the remaining migrations run." +); + +const ACCESS_ALL_DROP_MISMATCH_RECOVERY: &str = concat!( + "\n\nThis state cannot arise from a normal upgrade -- the column is removed before the migration ", + "is recorded. Verify whether the column was re-added manually. If it was, and its values are no ", + "longer needed, drop it again with every Vaultwarden instance stopped and a backup taken:\n", + "ALTER TABLE users_organizations DROP COLUMN access_all;\n\n", + "Otherwise restore the database backup taken before the upgrade and run the upgrade again." +); + const ALREADY_DROPPED_RECOVERY: &str = concat!( "\n\nThe permission values cannot be recomputed from the current schema. Restore the database backup taken ", "before the upgrade and run the upgrade again against that restored copy." @@ -619,10 +637,13 @@ impl CustomRoleMigrationFacts { enum CustomRolePreflightDecision { Proceed, CompleteMysqlCollectionMigration, + CompleteInterruptedAccessAllDrop, RefuseAlreadyDropped, RefuseMissingAccessAll, RefuseMissingMigrationLedger, RefuseAmbiguousDirectPermissions, + RefuseInterruptedAccessAllDrop, + RefuseAccessAllDropLedgerMismatch, RefusePartialPermissionSchema(PermissionColumnGroup), RefusePermissionLedgerMismatch(PermissionColumnGroup), } @@ -631,24 +652,48 @@ fn custom_role_preflight_decision( facts: CustomRoleMigrationFacts, can_complete_mysql_partial_migration: bool, ) -> CustomRolePreflightDecision { - if !facts.memberships_table_exists || facts.repair_migration_applied { + if !facts.memberships_table_exists { return CustomRolePreflightDecision::Proceed; } if !facts.migration_table_exists { return CustomRolePreflightDecision::RefuseMissingMigrationLedger; } - // Once access_all has been dropped, its former value and the provenance of 0/1/1 - // collection permissions can no longer be reconstructed. Never guess at either. - if facts.access_all_drop_migration_applied { - return CustomRolePreflightDecision::RefuseAlreadyDropped; - } - if !facts.access_all_column_exists { - return CustomRolePreflightDecision::RefuseMissingAccessAll; - } + // The legacy reconstruction below only makes sense while the repair migration is still ahead of + // us. Everything *after* it -- the access_all drop and the third permission column group -- still + // has to be checked on every start: both run after the repair, and on MySQL/MariaDB each DDL + // statement commits on its own, so a crash between the statement and Diesel's ledger insert + // leaves a durable partial state. Returning early for every repaired database would hide exactly + // those states, and the generic Diesel retry then fails on every following start with + // `Unknown column` (1091) or `Duplicate column name` (1060). + if facts.repair_migration_applied { + // The drop is a single statement with no data component, so it is all-or-nothing: either the + // column is still there and the migration is pending, or the column is gone and the + // migration is recorded. + if facts.access_all_column_exists == facts.access_all_drop_migration_applied { + return if facts.access_all_drop_migration_applied { + CustomRolePreflightDecision::RefuseAccessAllDropLedgerMismatch + } else if can_complete_mysql_partial_migration { + // Only reachable on MySQL/MariaDB, and the schema is already in its intended final + // state -- just record the migration instead of stopping the operator. + CustomRolePreflightDecision::CompleteInterruptedAccessAllDrop + } else { + CustomRolePreflightDecision::RefuseInterruptedAccessAllDrop + }; + } + } else { + // Once access_all has been dropped, its former value and the provenance of 0/1/1 + // collection permissions can no longer be reconstructed. Never guess at either. + if facts.access_all_drop_migration_applied { + return CustomRolePreflightDecision::RefuseAlreadyDropped; + } + if !facts.access_all_column_exists { + return CustomRolePreflightDecision::RefuseMissingAccessAll; + } - if facts.ambiguous_direct_permission_count != 0 && !facts.same_run_0716_marker { - return CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions; + if facts.ambiguous_direct_permission_count != 0 && !facts.same_run_0716_marker { + return CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions; + } } // Every permission column group must be either completely absent (its migration is still pending) @@ -708,7 +753,18 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus group.description(), group.column_list() ), - CustomRolePreflightDecision::Proceed | CustomRolePreflightDecision::CompleteMysqlCollectionMigration => { + CustomRolePreflightDecision::RefuseInterruptedAccessAllDrop => format!( + "The membership access_all column is already gone, but migration \ + {DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION} is not recorded. The column was dropped without \ + its ledger entry, so re-running the migration would fail on every start." + ), + CustomRolePreflightDecision::RefuseAccessAllDropLedgerMismatch => format!( + "Migration {DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION} is recorded, but the membership \ + access_all column still exists. Schema and migration ledger disagree." + ), + CustomRolePreflightDecision::Proceed + | CustomRolePreflightDecision::CompleteMysqlCollectionMigration + | CustomRolePreflightDecision::CompleteInterruptedAccessAllDrop => { unreachable!("successful preflight decisions do not produce errors") } }; @@ -717,6 +773,8 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus CustomRolePreflightDecision::RefusePartialPermissionSchema(_) | CustomRolePreflightDecision::RefusePermissionLedgerMismatch(_) => PARTIAL_PERMISSION_COLUMNS_RECOVERY, CustomRolePreflightDecision::RefuseAlreadyDropped => ALREADY_DROPPED_RECOVERY, + CustomRolePreflightDecision::RefuseInterruptedAccessAllDrop => INTERRUPTED_ACCESS_ALL_DROP_RECOVERY, + CustomRolePreflightDecision::RefuseAccessAllDropLedgerMismatch => ACCESS_ALL_DROP_MISMATCH_RECOVERY, _ => "", }; @@ -1026,6 +1084,23 @@ mod mysql_migrations { Ok(()) } + fn complete_interrupted_access_all_drop( + connection: &mut diesel::mysql::MysqlConnection, + ) -> Result<(), super::Error> { + // MySQL/MariaDB commit DDL implicitly, so the single `ALTER TABLE ... DROP COLUMN access_all` + // can be durable while Diesel's ledger insert that follows it is not. Re-running the + // migration would then fail with error 1091 (Unknown column) on every start. The statement + // has no data component and the preflight has just confirmed the column is gone, so the + // schema already is what the migration wanted: record it and let the rest of the chain run. + diesel::sql_query(format!( + "INSERT INTO __diesel_schema_migrations (version) VALUES ('{}')", + super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION + )) + .execute(connection)?; + + Ok(()) + } + fn preflight(connection: &mut diesel::mysql::MysqlConnection) -> Result<(), super::Error> { let memberships_table_exists = table_exists(connection, "users_organizations")?; if !memberships_table_exists { @@ -1107,6 +1182,9 @@ mod mysql_migrations { super::CustomRolePreflightDecision::CompleteMysqlCollectionMigration => { complete_partial_collection_migration(connection, same_run_0716_marker) } + super::CustomRolePreflightDecision::CompleteInterruptedAccessAllDrop => { + complete_interrupted_access_all_drop(connection) + } decision => Err(super::custom_role_preflight_error(decision, facts)), } } @@ -1305,17 +1383,107 @@ mod custom_role_migration_preflight_tests { ); } + /// A database on which the whole chain has already run. + fn fully_migrated() -> Facts { + Facts { + memberships_table_exists: true, + migration_table_exists: true, + access_all_column_exists: false, + manage_permission_columns: 3, + manage_permissions_migration_applied: true, + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + access_permission_columns: 3, + access_permissions_migration_applied: true, + repair_migration_applied: true, + access_all_drop_migration_applied: true, + ambiguous_direct_permission_count: 0, + same_run_0716_marker: false, + } + } + #[test] fn repair_marker_makes_completed_state_idempotent() { + assert_eq!(custom_role_preflight_decision(fully_migrated(), false), Decision::Proceed); + } + + /// The repair migration runs *before* the access_all drop and the third permission column group, + /// so a partial state of either always carries `repair_migration_applied`. Skipping the schema + /// checks for repaired databases would make them unreachable in exactly the situation they were + /// written for. + #[test] + fn interrupted_migrations_after_the_repair_are_still_detected() { + // Crash after `DROP COLUMN access_all`, before the ledger insert. MySQL/MariaDB commit DDL + // implicitly, so the column is gone for good; a retry would fail with 1091. + let interrupted_drop = Facts { + access_all_drop_migration_applied: false, + access_permission_columns: 0, + access_permissions_migration_applied: false, + ..fully_migrated() + }; + assert_eq!( + custom_role_preflight_decision(interrupted_drop, true), + Decision::CompleteInterruptedAccessAllDrop, + "MySQL/MariaDB can complete this in place" + ); + assert_eq!( + custom_role_preflight_decision(interrupted_drop, false), + Decision::RefuseInterruptedAccessAllDrop, + "backends with transactional DDL cannot reach this state by themselves" + ); + + // Crash after one of the three `ADD COLUMN` statements of the access group, before the + // ledger insert. A retry would fail with 1060. + for present in [1, 2] { + assert_eq!( + custom_role_preflight_decision( + Facts { + access_permission_columns: present, + access_permissions_migration_applied: false, + ..fully_migrated() + }, + true, + ), + Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Access) + ); + } + + // Ledger recorded, columns missing. assert_eq!( custom_role_preflight_decision( Facts { - memberships_table_exists: true, - migration_table_exists: true, - repair_migration_applied: true, - access_all_drop_migration_applied: true, - collection_permission_columns: 3, - ..Facts::default() + access_permission_columns: 2, + ..fully_migrated() + }, + true + ), + Decision::RefusePermissionLedgerMismatch(super::PermissionColumnGroup::Access) + ); + + // Drop recorded, but the column is back: schema and ledger disagree. + assert_eq!( + custom_role_preflight_decision( + Facts { + access_all_column_exists: true, + ..fully_migrated() + }, + true + ), + Decision::RefuseAccessAllDropLedgerMismatch + ); + } + + #[test] + fn a_pending_drop_after_the_repair_proceeds() { + // The repair ran, the drop is simply next in line: column present, migration not recorded. + assert_eq!( + custom_role_preflight_decision( + Facts { + access_all_column_exists: true, + access_all_drop_migration_applied: false, + access_permission_columns: 0, + access_permissions_migration_applied: false, + ..fully_migrated() }, false, ), @@ -1323,6 +1491,21 @@ mod custom_role_migration_preflight_tests { ); } + #[test] + fn interrupted_access_all_drop_error_names_the_ledger_fix() { + let facts = Facts { + access_all_drop_migration_applied: false, + access_permission_columns: 0, + access_permissions_migration_applied: false, + ..fully_migrated() + }; + let decision = custom_role_preflight_decision(facts, false); + let error = custom_role_preflight_error(decision, facts); + let message = error.source().expect("preflight error should retain its I/O error source").to_string(); + assert!(message.contains(super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION)); + assert!(message.contains("INSERT INTO __diesel_schema_migrations")); + } + #[test] fn a_historical_drop_without_the_repair_is_refused() { assert_eq!( diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index e61e9bfc..9b33dd43 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -135,12 +135,26 @@ impl Collection { // Owners manage implicitly; Custom members still need an explicit stored grant. Some(m) if m.has_full_access() => (false, false, assignment_manage_for_member(m.atype, false)), Some(m) => { + // A legacy organization-local `access_all` group confers collection management + // on its Custom members (see `has_legacy_group_collection_manage_access`), and + // reaches every collection without a `collections_groups` row that could carry + // the `manage` bit — so it has to be answered from the membership side. + let legacy_group_manage = m.has_type(MembershipType::Custom) + && cipher_sync_data.user_group_full_access_for_organizations.contains(&self.org_uuid); if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) { - (cu.read_only, cu.hide_passwords, assignment_manage_for_member(m.atype, cu.manage)) + ( + cu.read_only, + cu.hide_passwords, + legacy_group_manage || assignment_manage_for_member(m.atype, cu.manage), + ) } else if let Some(cg) = cipher_sync_data.user_collections_groups.get(&self.uuid) { - (cg.read_only, cg.hide_passwords, assignment_manage_for_member(m.atype, cg.manage)) + ( + cg.read_only, + cg.hide_passwords, + legacy_group_manage || assignment_manage_for_member(m.atype, cg.manage), + ) } else { - (false, false, false) + (false, false, legacy_group_manage) } } _ => (true, true, false), @@ -150,7 +164,7 @@ impl Collection { Some(m) if m.has_full_access() => (false, false, assignment_manage_for_member(m.atype, false)), Some(m) if m.atype >= MembershipType::Custom - && m.has_explicit_collection_manage_access(&self.uuid, conn).await => + && m.has_collection_manage_authority(&self.uuid, conn).await => { (false, false, true) } diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index f74e0aca..60082bc2 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -964,6 +964,61 @@ impl Membership { .await } + /// Legacy collection-management authority derived from an organization-local `access_all` group. + /// + /// Before this role model existed, a Manager who reached every collection through such a group + /// could edit and delete all of them — `Collection::is_coll_manageable_by_user` accepted + /// `groups.access_all` outright. Managers are Custom members now, so that authority has to keep + /// coming from the same place, or the upgrade would silently strip a capability from members who + /// hold no explicit per-collection grant. Deriving it live (instead of copying it into the + /// permission columns during the migration) is what keeps it revocable: remove the member from + /// the group, or clear the group's `access_all`, and the authority is gone with it. + /// + /// Deliberately not collection *creation*: that historically required membership-level + /// `access_all` and is now the independent `create_new_collections` permission. + pub async fn has_legacy_group_collection_manage_access( + &self, + collection_uuid: &CollectionId, + conn: &DbConn, + ) -> bool { + let membership_uuid = self.uuid.clone(); + let user_uuid = self.user_uuid.clone(); + let org_uuid = self.org_uuid.clone(); + let collection_uuid = collection_uuid.clone(); + + conn.run(move |conn| { + users_organizations::table + .inner_join( + groups_users::table.on(groups_users::users_organizations_uuid.eq(users_organizations::uuid)), + ) + .inner_join( + groups::table.on(groups::uuid + .eq(groups_users::groups_uuid) + .and(groups::organizations_uuid.eq(users_organizations::org_uuid))), + ) + .inner_join(collections::table.on(collections::org_uuid.eq(users_organizations::org_uuid))) + .filter(users_organizations::uuid.eq(membership_uuid)) + .filter(users_organizations::user_uuid.eq(user_uuid)) + .filter(users_organizations::org_uuid.eq(org_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) + .filter(users_organizations::atype.eq(MembershipType::Custom as i32)) + .filter(collections::uuid.eq(collection_uuid)) + .filter(groups::access_all.eq(true)) + .count() + .first::(conn) + .unwrap_or(0) + != 0 + }) + .await + } + + /// Whether this member may manage `collection_uuid` without holding a blanket collection + /// permission: either a real stored per-collection grant, or the legacy full-access group. + pub async fn has_collection_manage_authority(&self, collection_uuid: &CollectionId, conn: &DbConn) -> bool { + self.has_explicit_collection_manage_access(collection_uuid, conn).await + || self.has_legacy_group_collection_manage_access(collection_uuid, conn).await + } + /// `manageAllCollections` is a client-side aggregate checkbox, not a separately persisted /// Bitwarden permission. It is selected exactly when all three child permissions are selected. pub fn has_manage_all_collections(&self) -> bool { From 7542f3d4e99cfebf98c1ec7c304550a8cf7bb8dd Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sat, 8 Aug 2026 18:34:58 +0200 Subject: [PATCH 40/42] Provide a supported rollback path for the Custom-role change Vaultwarden only ever applies pending migrations, so putting an older image back leaves it facing a schema whose `access_all` column is gone -- and it refuses to start. The downgrade guard did not help there either: it only ever blocked `diesel migration revert`, which a self-hosted install cannot run. - tools/custom_role_rollback/ holds a self-contained script per backend that restores the pre-PR schema, folds Custom back onto Manager, and drops the seven ledger rows, so the older version starts again. SQLite rebuilds the table instead of using DROP COLUMN, for the same 3.35 reason as the forward migration. - The guard now states its terms instead of being a dead end: create __vw_allow_custom_role_downgrade and the revert goes through, so the data loss is acknowledged rather than merely prevented. - README documents what the old schema cannot represent, including the two values that cannot be reconstructed: Owner/Admin return with access_all set, and a plain User's former access_all stays materialized as the per-collection assignments the upgrade wrote. --- .../down.sql | 20 ++++- .../down.sql | 17 +++- .../down.sql | 20 ++++- tools/custom_role_rollback/README.md | 77 +++++++++++++++++++ tools/custom_role_rollback/mysql.sql | 50 ++++++++++++ tools/custom_role_rollback/postgresql.sql | 54 +++++++++++++ tools/custom_role_rollback/sqlite.sql | 73 ++++++++++++++++++ 7 files changed, 305 insertions(+), 6 deletions(-) create mode 100644 tools/custom_role_rollback/README.md create mode 100644 tools/custom_role_rollback/mysql.sql create mode 100644 tools/custom_role_rollback/postgresql.sql create mode 100644 tools/custom_role_rollback/sqlite.sql diff --git a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql index 4eb19e97..29b831e3 100644 --- a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -1,7 +1,23 @@ -- Nine independent Custom-role permissions cannot be represented losslessly by the legacy --- role/access_all schema. Always stop before any older down migration removes permission data. +-- role/access_all schema, so a revert is blocked here -- before any older down migration removes +-- permission data. +-- +-- It is an explicit, acknowledged decision though, not a dead end. Create the marker table below +-- while every Vaultwarden instance is stopped and this guard lets the revert through: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +-- +-- Operators who only need the old server version to start again do not need Diesel at all -- +-- tools/custom_role_rollback/ has a self-contained script per backend. CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( blocked INTEGER NOT NULL PRIMARY KEY ); INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); -INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_allow_custom_role_downgrade' +); +DROP TABLE __vw_custom_role_downgrade_guard; diff --git a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql index 4eb19e97..24760fc4 100644 --- a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -1,7 +1,20 @@ -- Nine independent Custom-role permissions cannot be represented losslessly by the legacy --- role/access_all schema. Always stop before any older down migration removes permission data. +-- role/access_all schema, so a revert is blocked here -- before any older down migration removes +-- permission data. +-- +-- It is an explicit, acknowledged decision though, not a dead end. Create the marker table below +-- while every Vaultwarden instance is stopped and this guard lets the revert through: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +-- +-- Operators who only need the old server version to start again do not need Diesel at all -- +-- tools/custom_role_rollback/ has a self-contained script per backend. CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( blocked INTEGER NOT NULL PRIMARY KEY ); INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); -INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 +WHERE to_regclass('__vw_allow_custom_role_downgrade') IS NULL; +DROP TABLE __vw_custom_role_downgrade_guard; diff --git a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql index 4eb19e97..8d149ae3 100644 --- a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -1,7 +1,23 @@ -- Nine independent Custom-role permissions cannot be represented losslessly by the legacy --- role/access_all schema. Always stop before any older down migration removes permission data. +-- role/access_all schema, so a revert is blocked here -- before any older down migration removes +-- permission data. +-- +-- It is an explicit, acknowledged decision though, not a dead end. Create the marker table below +-- while every Vaultwarden instance is stopped and this guard lets the revert through: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +-- +-- Operators who only need the old server version to start again do not need Diesel at all -- +-- tools/custom_role_rollback/ has a self-contained script per backend. CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( blocked INTEGER NOT NULL PRIMARY KEY ); INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); -INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_allow_custom_role_downgrade' +); +DROP TABLE __vw_custom_role_downgrade_guard; diff --git a/tools/custom_role_rollback/README.md b/tools/custom_role_rollback/README.md new file mode 100644 index 00000000..e475ff5f --- /dev/null +++ b/tools/custom_role_rollback/README.md @@ -0,0 +1,77 @@ +# Rolling back the Custom-role change + +The Custom-role change removes the membership `access_all` column and adds nine permission columns. +A Vaultwarden version from before that change cannot start against the new schema, because its +`schema.rs` still expects `access_all` to exist. + +Vaultwarden only ever applies *pending* migrations — it never reverts one on its own — so putting +the old image back is not enough. Run the script for your backend once and the old version starts +again. + +## What is lost + +The old schema has nowhere to store the nine permissions, so they are dropped: + +| Before the rollback | After | +|---|---| +| Owner / Admin | Owner / Admin with `access_all = TRUE` | +| Custom with **all three** collection permissions | Manager with `access_all = TRUE` | +| Custom with only some collection permissions | Manager with `access_all = FALSE` | +| Custom with `manageUsers` / `manageGroups` / `managePolicies` | Manager — those permissions are gone | +| Custom with `accessEventLogs` / `accessImportExport` / `accessReports` | Manager — those permissions are gone | +| plain User | plain User with `access_all = FALSE` | + +Per-collection assignments (`users_collections`, `collections_groups`) and `groups.access_all` are +untouched. Only `users_organizations` changes. + +Two of those rows do not come back byte-identical to what the database held before the *upgrade*, +because the information no longer exists to reconstruct them: + +- **Owner/Admin always come back with `access_all = TRUE`**, even if the flag was `FALSE` for them + before. The upgrade dropped the column precisely because Owners and Admins reach every collection + through their role, so the original value is unknown afterwards. It grants them nothing they did + not already have as Owner/Admin; the visible difference is that unassigned collections show up in + their personal vault view again. +- **A plain User that carried `access_all` comes back with `access_all = FALSE`.** The upgrade wrote + that member's reach out as explicit per-collection assignments before dropping the bit, and those + rows are left untouched here — so the member keeps access to the collections that existed at + upgrade time, just not automatically to ones created afterwards. + +Edit-any-collection deliberately does **not** become `access_all` on its own: in the old schema that +flag also carried the legacy "manage all collections" authority including deletion, so a member who +only held Edit must not come back with delete rights. + +## How to run it + +Stop every Vaultwarden instance and take a backup first. Then: + +```bash +# SQLite +sqlite3 /path/to/data/db.sqlite3 < tools/custom_role_rollback/sqlite.sql + +# MySQL / MariaDB +mysql -u -p < tools/custom_role_rollback/mysql.sql + +# PostgreSQL +psql -U -d -v ON_ERROR_STOP=1 -f tools/custom_role_rollback/postgresql.sql +``` + +Run it exactly once — a second run fails because the permission columns are already gone. On +MySQL/MariaDB the statements cannot be wrapped in a transaction (DDL commits implicitly there); if +the script is interrupted, restore the backup and start over. SQLite and PostgreSQL apply the whole +script atomically. + +Afterwards start the older Vaultwarden version. Upgrading again later re-applies the seven +migrations from a clean state. + +## Reverting with the Diesel CLI instead + +For development checkouts the down migrations do the same thing step by step. The newest one refuses +by default so an accidental revert cannot silently destroy the permission data; acknowledge it +explicitly first: + +```sql +CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +``` + +Then `diesel migration revert` works as usual. The rollback scripts above drop that table again. diff --git a/tools/custom_role_rollback/mysql.sql b/tools/custom_role_rollback/mysql.sql new file mode 100644 index 00000000..c72bd8ec --- /dev/null +++ b/tools/custom_role_rollback/mysql.sql @@ -0,0 +1,50 @@ +-- Roll a MySQL/MariaDB database back to the schema the Vaultwarden version *before* the Custom-role +-- change expects, so that older binary starts again. Read README.md in this directory first -- +-- it lists exactly what is lost and how to run this safely. +-- +-- NOTE: MySQL/MariaDB commit every DDL statement implicitly, so this script cannot be wrapped in a +-- transaction. Take a backup before running it; if it is interrupted, restore and start over. + +ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; + +-- The legacy flag is recomputed with the same mapping the down migrations use: everyone who +-- reached every collection keeps that reach, and a Custom member has to hold all three collection +-- permissions -- Edit-only must not silently turn into the legacy "manage all collections" +-- authority, which in that older schema also carried collection deletion. +UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); +UPDATE users_organizations +SET access_all = TRUE +WHERE atype = 4 + AND create_new_collections = TRUE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE; + +-- The old server cannot load type 4; Custom members were stored as Manager back then. +UPDATE users_organizations SET atype = 3 WHERE atype = 4; + +ALTER TABLE users_organizations DROP COLUMN manage_users; +ALTER TABLE users_organizations DROP COLUMN manage_groups; +ALTER TABLE users_organizations DROP COLUMN manage_policies; +ALTER TABLE users_organizations DROP COLUMN create_new_collections; +ALTER TABLE users_organizations DROP COLUMN edit_any_collection; +ALTER TABLE users_organizations DROP COLUMN delete_any_collection; +ALTER TABLE users_organizations DROP COLUMN access_event_logs; +ALTER TABLE users_organizations DROP COLUMN access_import_export; +ALTER TABLE users_organizations DROP COLUMN access_reports; + +-- Bookkeeping tables this feature may have left behind. +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; + +-- Finally forget the seven migrations, so the older binary does not see a ledger from the future +-- and a later upgrade applies them again from a clean state. +DELETE FROM __diesel_schema_migrations +WHERE version IN ( + '20260630120000', + '20260715120000', + '20260716120000', + '20260723120000', + '20260724120000', + '20260724130000', + '20260724140000' +); diff --git a/tools/custom_role_rollback/postgresql.sql b/tools/custom_role_rollback/postgresql.sql new file mode 100644 index 00000000..1484c862 --- /dev/null +++ b/tools/custom_role_rollback/postgresql.sql @@ -0,0 +1,54 @@ +-- Roll a PostgreSQL database back to the schema the Vaultwarden version *before* the Custom-role +-- change expects, so that older binary starts again. Read README.md in this directory first -- +-- it lists exactly what is lost and how to run this safely. +-- +-- PostgreSQL DDL is transactional, so this whole script either applies or it does not. + +BEGIN; + +ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; + +-- The legacy flag is recomputed with the same mapping the down migrations use: everyone who +-- reached every collection keeps that reach, and a Custom member has to hold all three collection +-- permissions -- Edit-only must not silently turn into the legacy "manage all collections" +-- authority, which in that older schema also carried collection deletion. +UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); +UPDATE users_organizations +SET access_all = TRUE +WHERE atype = 4 + AND create_new_collections = TRUE + AND edit_any_collection = TRUE + AND delete_any_collection = TRUE; + +-- The old server cannot load type 4; Custom members were stored as Manager back then. +UPDATE users_organizations SET atype = 3 WHERE atype = 4; + +ALTER TABLE users_organizations + DROP COLUMN manage_users, + DROP COLUMN manage_groups, + DROP COLUMN manage_policies, + DROP COLUMN create_new_collections, + DROP COLUMN edit_any_collection, + DROP COLUMN delete_any_collection, + DROP COLUMN access_event_logs, + DROP COLUMN access_import_export, + DROP COLUMN access_reports; + +-- Bookkeeping tables this feature may have left behind. +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; + +-- Finally forget the seven migrations, so the older binary does not see a ledger from the future +-- and a later upgrade applies them again from a clean state. +DELETE FROM __diesel_schema_migrations +WHERE version IN ( + '20260630120000', + '20260715120000', + '20260716120000', + '20260723120000', + '20260724120000', + '20260724130000', + '20260724140000' +); + +COMMIT; diff --git a/tools/custom_role_rollback/sqlite.sql b/tools/custom_role_rollback/sqlite.sql new file mode 100644 index 00000000..e95a1cee --- /dev/null +++ b/tools/custom_role_rollback/sqlite.sql @@ -0,0 +1,73 @@ +-- Roll a SQLite database back to the schema the Vaultwarden version *before* the Custom-role +-- change expects, so that older binary starts again. Read README.md in this directory first -- +-- it lists exactly what is lost and how to run this safely. +-- +-- `ALTER TABLE ... DROP COLUMN` is avoided on purpose: it only exists since SQLite 3.35, and this +-- script has to work on the same older system SQLite the forward migrations support. Rebuilding the +-- table also recreates `access_all` and drops all nine permission columns in one step. + +PRAGMA foreign_keys = OFF; + +BEGIN; + +CREATE TABLE users_organizations_rollback ( + uuid TEXT NOT NULL PRIMARY KEY, + user_uuid TEXT NOT NULL REFERENCES users (uuid), + org_uuid TEXT NOT NULL REFERENCES organizations (uuid), + access_all BOOLEAN NOT NULL DEFAULT 0, + akey TEXT NOT NULL, + status INTEGER NOT NULL, + atype INTEGER NOT NULL, + reset_password_key TEXT, + external_id TEXT, + invited_by_email TEXT DEFAULT NULL, + + UNIQUE (user_uuid, org_uuid) +); + +-- The legacy flag is recomputed with the same mapping the down migrations use: everyone who +-- reached every collection keeps that reach, and a Custom member has to hold all three collection +-- permissions -- Edit-only must not silently turn into the legacy "manage all collections" +-- authority, which in that older schema also carried collection deletion. +INSERT INTO users_organizations_rollback ( + uuid, user_uuid, org_uuid, access_all, akey, status, atype, + reset_password_key, external_id, invited_by_email +) +SELECT + uuid, user_uuid, org_uuid, + CASE + WHEN atype IN (0, 1) THEN 1 + WHEN atype = 4 + AND create_new_collections = 1 + AND edit_any_collection = 1 + AND delete_any_collection = 1 THEN 1 + ELSE 0 + END, + akey, status, + -- The old server cannot load type 4; Custom members were stored as Manager back then. + CASE WHEN atype = 4 THEN 3 ELSE atype END, + reset_password_key, external_id, invited_by_email +FROM users_organizations; + +DROP TABLE users_organizations; + +ALTER TABLE users_organizations_rollback RENAME TO users_organizations; + +-- Bookkeeping tables this feature may have left behind. +DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; + +-- Finally forget the seven migrations, so the older binary does not see a ledger from the future +-- and a later upgrade applies them again from a clean state. +DELETE FROM __diesel_schema_migrations +WHERE version IN ( + '20260630120000', + '20260715120000', + '20260716120000', + '20260723120000', + '20260724120000', + '20260724130000', + '20260724140000' +); + +COMMIT; From 8136691ad32623c949287459cb0006c499cc0c59 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Sat, 8 Aug 2026 20:19:08 +0200 Subject: [PATCH 41/42] Close a manage-grant laundering path and harden the rollback tooling Follow-up to the previous two commits, all four issues were introduced by them: - The legacy `access_all`-group authority was accepted by `caller_may_grant_collection_manage`, so a Custom member with manageGroups + editAnyCollection could create an access_all group holding itself, use the derived authority to persist `collections_groups.manage`, then leave the group and keep collection deletion without ever holding deleteAnyCollection. The clamp now takes only a real stored grant again, and the legacy exception is limited to members holding none of the three collection permissions -- which is the shape the migration leaves a group-derived Manager in, and never a member who can create such a group in the first place. - `Collection::to_json_details` reported `manage: false` for a member reaching every collection even when a real grant existed, so the client rendered controls that disagree with the guards. Both the cached and the uncached path now read the effective grant. - The SQLite rollback script continued after a failed statement, so a second run dropped `users_organizations` and committed an empty replacement. It now sets `.bail on`, refuses up front unless the permission columns are present, and the README documents `-bail` instead of claiming the run is atomic regardless. - The downgrade acknowledgement was never consumed, so one approval authorized every later revert. It is now dropped by the revert it permits and cleared again on re-upgrade. --- .../down.sql | 4 ++ .../up.sql | 4 ++ .../down.sql | 4 ++ .../up.sql | 4 ++ .../down.sql | 4 ++ .../up.sql | 4 ++ src/api/core/organizations.rs | 13 ++--- src/db/models/collection.rs | 51 ++++++++++++------- src/db/models/organization.rs | 11 ++++ tools/custom_role_rollback/README.md | 18 +++++-- tools/custom_role_rollback/sqlite.sql | 20 ++++++++ 11 files changed, 108 insertions(+), 29 deletions(-) diff --git a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql index 29b831e3..93358747 100644 --- a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -21,3 +21,7 @@ WHERE NOT EXISTS ( WHERE table_schema = DATABASE() AND table_name = '__vw_allow_custom_role_downgrade' ); DROP TABLE __vw_custom_role_downgrade_guard; + +-- Consume the acknowledgement: it authorized *this* revert, not every future one. After a +-- re-upgrade the next revert has to be acknowledged again. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; diff --git a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql index f3f3a7a7..9079f661 100644 --- a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql +++ b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -5,3 +5,7 @@ -- (2026-07-23 consumed the marker), so it is not left behind in every database. A single DDL -- statement is safe even on MySQL, where DDL commits implicitly -- re-running it is a no-op. DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; + +-- Also clear a downgrade acknowledgement left over from an earlier revert, so consent is +-- never inherited across an upgrade. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; diff --git a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql index 24760fc4..787d60dc 100644 --- a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -18,3 +18,7 @@ INSERT INTO __vw_custom_role_downgrade_guard (blocked) SELECT 1 WHERE to_regclass('__vw_allow_custom_role_downgrade') IS NULL; DROP TABLE __vw_custom_role_downgrade_guard; + +-- Consume the acknowledgement: it authorized *this* revert, not every future one. After a +-- re-upgrade the next revert has to be acknowledged again. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; diff --git a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql index f3f3a7a7..9079f661 100644 --- a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql +++ b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -5,3 +5,7 @@ -- (2026-07-23 consumed the marker), so it is not left behind in every database. A single DDL -- statement is safe even on MySQL, where DDL commits implicitly -- re-running it is a no-op. DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; + +-- Also clear a downgrade acknowledgement left over from an earlier revert, so consent is +-- never inherited across an upgrade. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; diff --git a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql index 8d149ae3..b6fb06ac 100644 --- a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -21,3 +21,7 @@ WHERE NOT EXISTS ( WHERE type = 'table' AND name = '__vw_allow_custom_role_downgrade' ); DROP TABLE __vw_custom_role_downgrade_guard; + +-- Consume the acknowledgement: it authorized *this* revert, not every future one. After a +-- re-upgrade the next revert has to be acknowledged again. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; diff --git a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql index f3f3a7a7..9079f661 100644 --- a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql +++ b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -5,3 +5,7 @@ -- (2026-07-23 consumed the marker), so it is not left behind in every database. A single DDL -- statement is safe even on MySQL, where DDL commits implicitly -- re-running it is a no-op. DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; + +-- Also clear a downgrade acknowledgement left over from an earlier revert, so consent is +-- never inherited across an upgrade. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 13c915c5..fa4e7a4b 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -3420,13 +3420,14 @@ async fn caller_may_grant_collection_manage(caller: &Membership, col_id: &Collec match caller_manage_grant_role_check(caller) { // Role alone decides it (Admin/Owner or delete_any -> yes; User/unknown/unconfirmed -> no). Some(decision) => decision, - // Custom without delete_any: the answer is per-collection and must mirror - // `collection_delete_access` exactly, so it can never hand out a right the caller lacks — - // a real users_collections.manage / collections_groups.manage grant, or the legacy - // organization-local `access_all` group that also confers deletion. Edit any collection - // deliberately does not count here. + // Custom without delete_any: the answer is per-collection and must reflect a *real* stored + // manage grant. Edit any collection deliberately does not count here, and neither does the + // legacy `access_all`-group authority: that one is derived from a group membership that can + // be taken away again, while a `manage` row written here outlives it. Accepting it would let + // temporary authority be laundered into a permanent grant — and with it collection deletion + // — which is exactly the escalation this clamp exists to prevent. None => match MembershipType::from_i32(caller.atype) { - Some(MembershipType::Custom) => caller.has_collection_manage_authority(col_id, conn).await, + Some(MembershipType::Custom) => caller.has_explicit_collection_manage_access(col_id, conn).await, _ => false, }, } diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index 9b33dd43..e6f74557 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -131,37 +131,52 @@ impl Collection { ) -> Value { let (read_only, hide_passwords, manage) = if let Some(cipher_sync_data) = cipher_sync_data { match cipher_sync_data.members.get(&self.org_uuid) { - // Full collection visibility is not collection-management authority. Admins and - // Owners manage implicitly; Custom members still need an explicit stored grant. - Some(m) if m.has_full_access() => (false, false, assignment_manage_for_member(m.atype, false)), Some(m) => { + // What the client is told here has to match what the collection guards actually + // allow, or it renders the wrong controls. A stored grant therefore counts even + // for a member who already reaches every collection: full visibility is not + // management authority, but it does not cancel out a real grant either. + // // A legacy organization-local `access_all` group confers collection management // on its Custom members (see `has_legacy_group_collection_manage_access`), and // reaches every collection without a `collections_groups` row that could carry // the `manage` bit — so it has to be answered from the membership side. let legacy_group_manage = m.has_type(MembershipType::Custom) + && !m.has_create_new_collections() + && !m.has_edit_any_collection() + && !m.has_delete_any_collection() && cipher_sync_data.user_group_full_access_for_organizations.contains(&self.org_uuid); - if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) { - ( - cu.read_only, - cu.hide_passwords, - legacy_group_manage || assignment_manage_for_member(m.atype, cu.manage), - ) - } else if let Some(cg) = cipher_sync_data.user_collections_groups.get(&self.uuid) { - ( - cg.read_only, - cg.hide_passwords, - legacy_group_manage || assignment_manage_for_member(m.atype, cg.manage), - ) - } else { - (false, false, legacy_group_manage) + let assignment = cipher_sync_data + .user_collections + .get(&self.uuid) + .map(|cu| (cu.read_only, cu.hide_passwords, cu.manage)) + .or_else(|| { + cipher_sync_data + .user_collections_groups + .get(&self.uuid) + .map(|cg| (cg.read_only, cg.hide_passwords, cg.manage)) + }); + let stored_manage = assignment.is_some_and(|(_, _, manage)| manage); + let manage = legacy_group_manage || assignment_manage_for_member(m.atype, stored_manage); + match assignment { + Some((read_only, hide_passwords, _)) if !m.has_full_access() => { + (read_only, hide_passwords, manage) + } + // Reaching every collection means nothing is read-only or hidden here. + _ => (false, false, manage), } } _ => (true, true, false), } } else { match Membership::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await { - Some(m) if m.has_full_access() => (false, false, assignment_manage_for_member(m.atype, false)), + // Same rule as the cached branch above: a member who reaches every collection still + // reports a real stored grant, so the serialized value matches the guards. + Some(m) if m.has_full_access() => ( + false, + false, + assignment_manage_for_member(m.atype, m.has_collection_manage_authority(&self.uuid, conn).await), + ), Some(m) if m.atype >= MembershipType::Custom && m.has_collection_manage_authority(&self.uuid, conn).await => diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index 60082bc2..d33e9b90 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -976,11 +976,22 @@ impl Membership { /// /// Deliberately not collection *creation*: that historically required membership-level /// `access_all` and is now the independent `create_new_collections` permission. + /// + /// Security: the exception is limited to members holding *none* of the three collection + /// permissions, which is exactly the shape the migration leaves a group-derived legacy Manager + /// in. Without that limit it would also cover a Custom member holding `edit_any_collection` — + /// and since `edit_any_collection` is what lets a caller create an `access_all` group in the + /// first place, such a member could grant themselves this authority and use it to persist a + /// real `collections_groups.manage` row, keeping collection deletion after leaving the group. pub async fn has_legacy_group_collection_manage_access( &self, collection_uuid: &CollectionId, conn: &DbConn, ) -> bool { + if self.create_new_collections || self.edit_any_collection || self.delete_any_collection { + return false; + } + let membership_uuid = self.uuid.clone(); let user_uuid = self.user_uuid.clone(); let org_uuid = self.org_uuid.clone(); diff --git a/tools/custom_role_rollback/README.md b/tools/custom_role_rollback/README.md index e475ff5f..7e47a8f4 100644 --- a/tools/custom_role_rollback/README.md +++ b/tools/custom_role_rollback/README.md @@ -47,7 +47,7 @@ Stop every Vaultwarden instance and take a backup first. Then: ```bash # SQLite -sqlite3 /path/to/data/db.sqlite3 < tools/custom_role_rollback/sqlite.sql +sqlite3 -bail /path/to/data/db.sqlite3 < tools/custom_role_rollback/sqlite.sql # MySQL / MariaDB mysql -u -p < tools/custom_role_rollback/mysql.sql @@ -56,10 +56,18 @@ mysql -u -p < tools/custom_role_rollback/mysql.sql psql -U -d -v ON_ERROR_STOP=1 -f tools/custom_role_rollback/postgresql.sql ``` -Run it exactly once — a second run fails because the permission columns are already gone. On -MySQL/MariaDB the statements cannot be wrapped in a transaction (DDL commits implicitly there); if -the script is interrupted, restore the backup and start over. SQLite and PostgreSQL apply the whole -script atomically. +Each script stops on its own if the database is not in the state it converts from, so running one +twice is refused rather than half-applied. + +**Do not drop the `-bail` / `ON_ERROR_STOP=1` flags, and do not run these through a client that +keeps going after a failed statement.** The sqlite3 shell continues after errors by default; the +script sets `.bail on` itself, but that is a shell command a different runner will ignore. A runner +that carries on past the failing statement would reach the `DROP TABLE` and commit an empty +`users_organizations`. + +SQLite and PostgreSQL apply the script in a single transaction, so an aborted run leaves the +database untouched. On MySQL/MariaDB the statements cannot be wrapped in a transaction (DDL commits +implicitly there); if the script is interrupted, restore the backup and start over. Afterwards start the older Vaultwarden version. Upgrading again later re-applies the seven migrations from a clean state. diff --git a/tools/custom_role_rollback/sqlite.sql b/tools/custom_role_rollback/sqlite.sql index e95a1cee..54cb237b 100644 --- a/tools/custom_role_rollback/sqlite.sql +++ b/tools/custom_role_rollback/sqlite.sql @@ -6,10 +6,30 @@ -- script has to work on the same older system SQLite the forward migrations support. Rebuilding the -- table also recreates `access_all` and drops all nine permission columns in one step. +-- Stop at the first error. Without this the sqlite3 shell keeps going after a failed statement, +-- and a second run -- where the SELECT below can no longer see the permission columns -- would +-- still reach DROP TABLE and commit an empty users_organizations. `.bail on` is a shell command; +-- a runner that is not the sqlite3 CLI has to abort on the first error and roll back by itself. +.bail on + PRAGMA foreign_keys = OFF; BEGIN; +-- Refuse to start at all unless the database is in the state this script converts *from*. A repeat +-- run would otherwise only fail somewhere in the middle. The failing CHECK names the reason. +CREATE TEMPORARY TABLE __vw_rollback_precondition ( + ok INTEGER NOT NULL CONSTRAINT + this_database_has_no_custom_role_permission_columns_to_roll_back CHECK (ok = 1) +); +INSERT INTO __vw_rollback_precondition (ok) +SELECT CASE + WHEN EXISTS (SELECT 1 FROM pragma_table_info('users_organizations') WHERE name = 'create_new_collections') + THEN 1 + ELSE 0 +END; +DROP TABLE __vw_rollback_precondition; + CREATE TABLE users_organizations_rollback ( uuid TEXT NOT NULL PRIMARY KEY, user_uuid TEXT NOT NULL REFERENCES users (uuid), From 570c385cb52e446b9bad7932fc66a599a05aab03 Mon Sep 17 00:00:00 2001 From: tom27052006 <83423411+tom27052006@users.noreply.github.com> Date: Wed, 12 Aug 2026 19:20:06 +0200 Subject: [PATCH 42/42] Apply custom-role review follow-ups --- .../down.sql | 81 +- .../up.sql | 28 + .../down.sql | 31 +- .../up.sql | 45 +- .../down.sql | 5 +- .../up.sql | 130 +- .../down.sql | 31 +- .../down.sql | 55 +- .../up.sql | 4 +- .../down.sql | 4 + .../up.sql | 111 + .../down.sql | 4 + .../up.sql | 121 + .../down.sql | 65 +- .../up.sql | 29 + .../down.sql | 16 + .../up.sql | 39 +- .../down.sql | 5 +- .../up.sql | 130 +- .../down.sql | 16 + .../down.sql | 21 +- .../down.sql | 4 + .../up.sql | 103 + .../down.sql | 4 + .../up.sql | 111 + .../down.sql | 68 +- .../up.sql | 28 + .../down.sql | 19 + .../up.sql | 42 +- .../down.sql | 5 +- .../up.sql | 131 +- .../down.sql | 19 + .../down.sql | 24 +- .../down.sql | 4 + .../up.sql | 107 + .../down.sql | 4 + .../up.sql | 117 + src/api/core/ciphers.rs | 54 +- src/api/core/events.rs | 19 +- src/api/core/organizations.rs | 593 ++-- src/auth.rs | 154 +- src/db/mod.rs | 2691 +++++++++++++++-- src/db/models/cipher.rs | 26 +- src/db/models/collection.rs | 38 +- src/db/models/event.rs | 101 +- src/db/models/organization.rs | 161 +- tools/custom_role_rollback/README.md | 252 +- tools/custom_role_rollback/mysql.sql | 305 +- tools/custom_role_rollback/postgresql.sql | 277 +- tools/custom_role_rollback/sqlite.sql | 203 +- 50 files changed, 5639 insertions(+), 996 deletions(-) create mode 100644 migrations/mysql/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql create mode 100644 migrations/mysql/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql create mode 100644 migrations/mysql/2026-08-10-120000_confirm_permanent_collection_authority/down.sql create mode 100644 migrations/mysql/2026-08-10-120000_confirm_permanent_collection_authority/up.sql create mode 100644 migrations/postgresql/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql create mode 100644 migrations/postgresql/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql create mode 100644 migrations/postgresql/2026-08-10-120000_confirm_permanent_collection_authority/down.sql create mode 100644 migrations/postgresql/2026-08-10-120000_confirm_permanent_collection_authority/up.sql create mode 100644 migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql create mode 100644 migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql create mode 100644 migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/down.sql create mode 100644 migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/up.sql diff --git a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql index 9ac54bfb..7b3c05be 100644 --- a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql +++ b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -1,6 +1,75 @@ --- Convert Custom members back to Manager, the representation older server versions --- expect (they masquerade Manager as Custom in API responses and cannot load type 4). -UPDATE users_organizations SET atype = 3 WHERE atype = 4; -ALTER TABLE users_organizations DROP COLUMN manage_users; -ALTER TABLE users_organizations DROP COLUMN manage_groups; -ALTER TABLE users_organizations DROP COLUMN manage_policies; +-- Lossy revert: this removes the three Custom management permissions and the Custom role itself, +-- which the legacy role/access_all schema cannot represent. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_allow_custom_role_downgrade' +); +-- `DROP TEMPORARY TABLE`, not `DROP TABLE`: the latter is one more statement that commits +-- implicitly on MySQL/MariaDB, and it would happily drop a permanent table of the same name. +DROP TEMPORARY TABLE __vw_custom_role_downgrade_guard; + +-- Convert Custom members back to a role the older server can load -- it cannot represent type 4 and +-- masquerades Manager as Custom in API responses. Which role each one gets is a decision about its +-- authority *now*, and it is not symmetric with the upgrade. +-- +-- Deliberately not driven by `__vw_custom_role_legacy_manager`. That records who held the Manager +-- role before the *first* upgrade and is never updated afterwards, so a member whose Manager powers +-- an owner has since reduced -- or who was demoted to User and later re-created as a limited Custom +-- member -- would be handed the whole legacy role back. Historical provenance is evidence, not +-- authorization. Use a list written for this downgrade instead. +-- +-- Absent, or empty, means "nobody", and everything below becomes a plain User. That is the safe +-- direction: the legacy Manager role is not a subset of what a Custom member holds -- it manages, and +-- deletes, every collection reachable through `users_collections.manage`, +-- `collections_groups.manage` or `groups.access_all`, and reads member and collection ACL details +-- through `ManagerHeadersLoose`, none of which needs a permission flag in the old schema. To keep the +-- historical mapping, copy it over deliberately before reverting: +-- +-- CREATE TABLE __vw_rollback_manager_allowlist (users_organizations_uuid CHAR(36) NOT NULL PRIMARY KEY); +-- INSERT INTO __vw_rollback_manager_allowlist (users_organizations_uuid) +-- SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager; +CREATE TABLE IF NOT EXISTS __vw_rollback_manager_allowlist ( + users_organizations_uuid CHAR(36) NOT NULL PRIMARY KEY +); + +UPDATE users_organizations SET atype = 3 +WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist); + +-- Everything still on the Custom role becomes a plain User, and `access_all` has to be cleared with +-- it. 2026-07-16-120000/down.sql sets that flag for every Custom member holding all three collection +-- permissions, on the assumption they are about to become a Manager; left behind on a User it +-- produces `User + access_all`, the one legacy state the upgrade refuses outright -- which would +-- leave the database unable to move forward again. `users_collections` and `collections_groups` are +-- untouched, so these members keep every per-collection grant and lose only the organization-wide +-- powers the old schema cannot express. +UPDATE users_organizations SET atype = 2, access_all = FALSE WHERE atype = 4; + +-- One ALTER, not three. Each `ALTER TABLE` commits implicitly on MySQL/MariaDB, so three statements +-- mean two intermediate states that survive a failure while Diesel still considers the migration +-- unapplied; one statement is the closest this backend gets to all-or-nothing. +ALTER TABLE users_organizations + DROP COLUMN manage_users, + DROP COLUMN manage_groups, + DROP COLUMN manage_policies; + +-- Oldest lossy step of the chain: nothing below this can lose Custom-role data any more, so the +-- acknowledgement is consumed here. It authorized *this* downgrade, not every future one. The +-- Custom-role bookkeeping goes with it -- the roles it describes are back, and a later re-upgrade +-- rebuilds all of it from the restored `atype = 3` rows. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +DROP TABLE IF EXISTS __vw_allow_unresumable_mysql_downgrade; +DROP TABLE IF EXISTS __vw_rollback_manager_allowlist; +DROP TABLE IF EXISTS __vw_custom_role_legacy_manager; +DROP TABLE IF EXISTS __vw_custom_role_history_verified; diff --git a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql index 6ffdca13..09451eca 100644 --- a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql +++ b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -1,6 +1,34 @@ ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; +-- Record which memberships were legacy Managers *before* anything converts them. +-- +-- This is the only moment at which that is knowable. `atype = 3` means Manager here and Custom +-- afterwards -- the conversion below reuses the value -- so once it has run, a genuine legacy +-- Manager and a Custom member created later are byte-identical. Every later step that has to reason +-- about legacy authority (2026-07-23, 2026-08-09 and tools/custom_role_rollback/) reads this table +-- instead of guessing, which is what stops them from handing legacy privileges to modern members. +-- +-- Deliberately not a Diesel model and not in schema.rs: no runtime code reads it. It is +-- migration/rollback bookkeeping, and it carries no foreign key so that 2026-07-24-120000's table +-- rebuild does not have to care about it. +CREATE TABLE IF NOT EXISTS __vw_custom_role_legacy_manager ( + users_organizations_uuid CHAR(36) NOT NULL PRIMARY KEY +); +INSERT IGNORE INTO __vw_custom_role_legacy_manager (users_organizations_uuid) +SELECT uuid FROM users_organizations WHERE atype = 3; + +-- Separately, mark that this database's Custom-role history is accounted for -- it was produced by +-- the migrations that ship today. Nothing else creates this table, which is what lets the startup +-- preflight treat its absence as proof that an earlier revision of this chain ran instead. +-- +-- Deliberately not the record table above: that one holds data an operator has to be able to write +-- during recovery, so its existence cannot also stand for "the history behind this data was +-- reviewed" -- creating it empty to silence an error would otherwise pass as the audit it asks for. +CREATE TABLE IF NOT EXISTS __vw_custom_role_history_verified ( + verified INTEGER NOT NULL PRIMARY KEY +); + -- Previously the server stored members created with the Custom role as Manager (3) and -- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted -- type, convert those members so clients (which no longer know the Manager role) keep diff --git a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/down.sql b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/down.sql index 6506059d..b6f97540 100644 --- a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/down.sql +++ b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/down.sql @@ -1,9 +1,34 @@ +-- Lossy revert: this removes the three independent Custom collection permissions, which the legacy +-- role/access_all schema cannot represent -- it only knows all three together. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_allow_custom_role_downgrade' +); +-- `DROP TEMPORARY TABLE`, not `DROP TABLE`: the latter is one more statement that commits +-- implicitly on MySQL/MariaDB, and it would happily drop a permanent table of the same name. +DROP TEMPORARY TABLE __vw_custom_role_downgrade_guard; + -- The previous schema exposes access_all as the three collection permissions together. Avoid -- turning Edit-only memberships into Create/Edit/Delete grants when rolling back. UPDATE users_organizations SET access_all = create_new_collections AND edit_any_collection AND delete_any_collection WHERE atype = 4; -ALTER TABLE users_organizations DROP COLUMN create_new_collections; -ALTER TABLE users_organizations DROP COLUMN edit_any_collection; -ALTER TABLE users_organizations DROP COLUMN delete_any_collection; +-- One ALTER, not three. Each `ALTER TABLE` commits implicitly on MySQL/MariaDB, so three statements +-- mean two intermediate states that survive a failure while Diesel still considers the migration +-- unapplied; one statement is the closest this backend gets to all-or-nothing. +ALTER TABLE users_organizations + DROP COLUMN create_new_collections, + DROP COLUMN edit_any_collection, + DROP COLUMN delete_any_collection; diff --git a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql index d247d1e9..487da5f8 100644 --- a/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql +++ b/migrations/mysql/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -1,22 +1,61 @@ +-- The legacy-Manager record has to exist before anything below runs: 2026-06-30-120000 writes it, +-- and the group-derived step at the end of this file reads it. Checked *before* the ALTER TABLE so a +-- refusal leaves no half-added column group behind -- every ALTER commits implicitly here, and a +-- partial group is what the startup preflight then has to recover from. +-- +-- `CREATE TEMPORARY TABLE` / `DROP TEMPORARY TABLE` do not commit implicitly, so this whole check is +-- free of durable side effects. +-- +-- Creating the record here instead would manufacture an empty, apparently valid history for exactly +-- the databases that need an operator to look at them; see 2026-07-23-120000 for the full reasoning. +-- This guard exists for a bare migration runner that never consulted the startup preflight. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_custom_role_legacy_manager' +); +DROP TEMPORARY TABLE __vw_legacy_manager_record_guard; + ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE; -- Before these permissions were persisted independently, access_all represented the legacy -- "Manage all collections" checkbox. Preserve that capability for existing Custom members. +-- +-- Driven by the stored value rather than by the membership's shape, so it needs no provenance: a +-- member carrying access_all held exactly this capability, whenever the row was created. UPDATE users_organizations SET create_new_collections = access_all, edit_any_collection = access_all, delete_any_collection = access_all WHERE atype = 4; --- A legacy Manager also managed every collection when one of their groups had access_all, --- even if the membership itself did not. Preserve that existing edit/delete capability without --- granting collection creation, which historically still required membership access_all. +-- A legacy Manager also managed every collection when one of their groups had access_all, even if +-- the membership itself did not. Preserve that existing edit/delete capability without granting +-- collection creation, which historically still required membership access_all. +-- +-- Restricted to memberships recorded as legacy Managers, exactly like 2026-07-23-120000 and +-- 2026-08-09-120000. Role and group membership alone are *not* evidence of legacy authority: +-- "Custom, member of an access_all group" is also the shape of every modern Custom member who was +-- simply put into an ordinary access_all group, and granting on that shape hands them +-- organization-wide collection edit and delete -- which, through edit_any_collection, also satisfies +-- has_full_access() and therefore reaches every cipher in the organization. +-- +-- On the normal upgrade path this changes nothing: 2026-06-30-120000 runs first and records every +-- `atype = 3` row, which at this point is every Custom member there is. UPDATE users_organizations SET edit_any_collection = TRUE, delete_any_collection = TRUE WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND EXISTS ( SELECT 1 FROM groups_users diff --git a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql index b9d4e9e6..4188886b 100644 --- a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql +++ b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql @@ -1,3 +1,4 @@ --- This is an idempotent data repair. Reverting it must not remove permissions or recreate the --- invalid persisted Manager type; the older-schema migration performs its own safe conversion. +-- This is an idempotent data repair, and it creates no rows: reverting it must not remove permissions +-- or recreate the invalid persisted Manager type. The older-schema migration performs its own safe +-- conversion. SELECT 1; diff --git a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index b7d93cdc..bf20cf2c 100644 --- a/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/mysql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -1,48 +1,76 @@ --- A normal User with the historical membership-level access_all bit reached every collection of the --- organization with full read/write, but held no collection-management authority. Mapping that onto --- the Custom role would add authority, clearing the bit would remove existing access — so instead, --- materialize the reach as explicit per-collection assignments while the source bit still exists. --- `manage` stays FALSE, so no management authority is invented. This is the same approach Bitwarden --- took when it retired `accessAll`; the one behavioral difference is that the access is no longer --- dynamic, i.e. collections created later are not added automatically. +-- Repair the legacy role/permission state while membership `access_all` still exists. -- --- Step 1: a pre-existing assignment was overridden by access_all (full read/write regardless of --- read_only/hide_passwords), so relax it to match what the member actually had. -UPDATE users_collections -SET read_only = FALSE, - hide_passwords = FALSE -WHERE EXISTS ( - SELECT 1 - FROM users_organizations AS uo - INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid - WHERE uo.atype = 2 - AND uo.access_all = TRUE - AND uo.user_uuid = users_collections.user_uuid - AND c.uuid = users_collections.collection_uuid +-- A plain User carrying the historical membership-level `access_all` bit is deliberately not +-- converted: that state grants dynamic reach over every collection *without* management authority, +-- and the new model has no equivalent. It is refused instead -- and refused *here*, not only in Rust: +-- Vaultwarden's startup preflight already stops such a database before any migration runs and prints +-- the two explicit choices (`RefuseLegacyUserAccessAll` in `src/db/mod.rs`), but a migration run +-- outside that wrapper -- `diesel migration run`, a bare `MigrationHarness`, any other SQL runner +-- -- would not consult it, and 2026-07-24-120000 removes the only source of that reach a few +-- statements later. Repeating the check before this file's first mutation is what makes the silent +-- loss impossible rather than unlikely. +-- +-- The duplicate key aborts the migration. It is only inserted when such a membership exists. +CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype = 2 + AND access_all = TRUE +LIMIT 1; +DROP TEMPORARY TABLE __vw_legacy_user_access_all_guard; + +-- The legacy-Manager record has to exist already: 2026-06-30-120000 writes it, and the startup +-- preflight refuses a database whose ledger carries that version without it. Creating it here would +-- manufacture an empty, apparently valid history for precisely the databases that need an operator +-- to look at them, so refuse instead -- this guard exists for a bare migration runner that never +-- consulted the preflight. Refusing also keeps this file free of DDL, which on MySQL/MariaDB would +-- commit implicitly and break this migration out of its transaction. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_custom_role_legacy_manager' ); +DROP TEMPORARY TABLE __vw_legacy_manager_record_guard; --- Step 2: add the assignments that did not exist yet. Existing rows are left to step 1. -INSERT IGNORE INTO users_collections (user_uuid, collection_uuid, read_only, hide_passwords, manage) -SELECT uo.user_uuid, c.uuid, FALSE, FALSE, FALSE -FROM users_organizations AS uo -INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid -WHERE uo.atype = 2 - AND uo.access_all = TRUE; +-- A database that reaches this file with memberships still at `atype = 3` never ran the rewritten +-- 2026-06-30-120000 -- for instance because a runner applied the files out of order. Those rows are +-- unambiguously legacy Managers *right now*, so record them before the conversion at the end of this +-- file makes them indistinguishable from modern Custom members. Idempotent, and a no-op on the +-- normal path. +INSERT IGNORE INTO __vw_custom_role_legacy_manager (users_organizations_uuid) +SELECT uuid FROM users_organizations WHERE atype = 3; --- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the --- exact direct 0/1/1 pattern. While the same organization-local source group is still present, --- remove that deterministic copy so later group removal also revokes the authority. The runtime --- keeps deriving edit/delete from that group -- see --- `Membership::has_legacy_group_collection_manage_access` -- so nothing is lost here. +-- Step 1: a legacy Manager who managed every collection through an organization-local group with +-- `access_all` keeps that authority, materialized into the permission columns it now lives in. +-- +-- Restricted to memberships recorded as legacy Managers. Matching on role and group membership +-- alone -- which an earlier revision did -- also matches every *modern* flagless Custom member who +-- happens to sit in an ordinary `access_all` group, because the two states are the same shape, and +-- would hand them organization-wide collection edit and delete. +-- +-- Earlier revisions derived this authority live from the group at request time instead, which was +-- unsound for exactly that reason. Materializing it makes it visible to an owner in the member's +-- permission list and revocable by clearing a checkbox. It is deliberately a one-time snapshot: the +-- permission no longer lapses when the source group does. See tools/custom_role_rollback/README.md. +-- +-- Deliberately not `create_new_collections`: creating collections historically required +-- membership-level `access_all`, and it is an independent permission now. UPDATE users_organizations -SET edit_any_collection = FALSE, - delete_any_collection = FALSE +SET edit_any_collection = TRUE, + delete_any_collection = TRUE WHERE atype IN (3, 4) - AND access_all = FALSE - AND create_new_collections = FALSE - AND edit_any_collection = TRUE - AND delete_any_collection = TRUE - AND EXISTS (SELECT 1 FROM __vw_custom_role_same_run_0716 WHERE marker = 1) + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND EXISTS ( SELECT 1 FROM groups_users AS gu @@ -52,30 +80,16 @@ WHERE atype IN (3, 4) AND g.access_all = TRUE ); --- A remaining 0/1/1 pattern may be either an intentional direct grant or an older derived grant --- whose source group has already been removed. Do not guess which one it is. -CREATE TEMPORARY TABLE __vw_legacy_group_access_guard ( - blocked INTEGER NOT NULL PRIMARY KEY -); -INSERT INTO __vw_legacy_group_access_guard (blocked) VALUES (1); -INSERT INTO __vw_legacy_group_access_guard (blocked) -SELECT 1 -FROM users_organizations -WHERE atype IN (3, 4) - AND access_all = FALSE - AND create_new_collections = FALSE - AND edit_any_collection = TRUE - AND delete_any_collection = TRUE -LIMIT 1; -DROP TEMPORARY TABLE __vw_legacy_group_access_guard; - --- Membership access_all on a legacy Manager/Custom represented all three collection capabilities. --- Set only TRUE values so this repair never removes independently configured permissions. +-- Step 2: membership `access_all` on a legacy Manager represented all three collection capabilities. +-- Set only TRUE values so this repair never removes independently configured permissions, and again +-- only for recorded legacy Managers -- an intermediate revision of this feature branch could leave a +-- modern Custom member carrying the old column as well. UPDATE users_organizations SET create_new_collections = TRUE, edit_any_collection = TRUE, delete_any_collection = TRUE WHERE atype IN (3, 4) + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND access_all = TRUE; -- Convert only after the legacy bit has been copied. diff --git a/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/down.sql b/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/down.sql index f276ea5b..39a10e8b 100644 --- a/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/down.sql +++ b/migrations/mysql/2026-07-24-130000_add_custom_access_permissions/down.sql @@ -1,3 +1,28 @@ -ALTER TABLE users_organizations DROP COLUMN access_event_logs; -ALTER TABLE users_organizations DROP COLUMN access_import_export; -ALTER TABLE users_organizations DROP COLUMN access_reports; +-- Lossy revert: this removes the three Custom access permissions, which the legacy schema cannot +-- represent at all. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_allow_custom_role_downgrade' +); +-- `DROP TEMPORARY TABLE`, not `DROP TABLE`: the latter is one more statement that commits +-- implicitly on MySQL/MariaDB, and it would happily drop a permanent table of the same name. +DROP TEMPORARY TABLE __vw_custom_role_downgrade_guard; + +-- One ALTER, not three. Each `ALTER TABLE` commits implicitly on MySQL/MariaDB, so three statements +-- mean two intermediate states that survive a failure while Diesel still considers the migration +-- unapplied; one statement is the closest this backend gets to all-or-nothing. +ALTER TABLE users_organizations + DROP COLUMN access_event_logs, + DROP COLUMN access_import_export, + DROP COLUMN access_reports; diff --git a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql index 93358747..6db91a70 100644 --- a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -1,12 +1,13 @@ --- Nine independent Custom-role permissions cannot be represented losslessly by the legacy --- role/access_all schema, so a revert is blocked here -- before any older down migration removes --- permission data. --- --- It is an explicit, acknowledged decision though, not a dead end. Create the marker table below --- while every Vaultwarden instance is stopped and this guard lets the revert through: +-- Downgrade guard. Reverting this migration destroys Custom-role permission data that the legacy +-- role/access_all schema cannot represent, so it only runs with an explicit acknowledgement. Create +-- the marker table below while every Vaultwarden instance is stopped: -- -- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); -- +-- The acknowledgement stays valid for the rest of the revert chain and is consumed by the oldest +-- lossy migration (2026-06-30-120000), so one decision covers one downgrade -- and a re-upgrade +-- clears it again (2026-07-24-140000/up.sql), so consent is never inherited. +-- -- Operators who only need the old server version to start again do not need Diesel at all -- -- tools/custom_role_rollback/ has a self-contained script per backend. CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( @@ -18,10 +19,42 @@ INSERT INTO __vw_custom_role_downgrade_guard (blocked) SELECT 1 FROM DUAL WHERE NOT EXISTS ( SELECT 1 FROM information_schema.tables - WHERE table_schema = DATABASE() AND table_name = '__vw_allow_custom_role_downgrade' + WHERE table_schema = DATABASE() AND table_name = '__vw_allow_custom_role_downgrade'); +-- `DROP TEMPORARY TABLE`, not `DROP TABLE`: the latter is one more statement that commits +-- implicitly on MySQL/MariaDB, and it would happily drop a permanent table of the same name. +DROP TEMPORARY TABLE __vw_custom_role_downgrade_guard; + +-- Second, MySQL/MariaDB-only guard: this revert chain cannot be resumed here. +-- +-- Every `ALTER TABLE` in it commits on its own, while Diesel deletes the ledger row in a separate +-- statement afterwards. A crash in between leaves the columns gone and the migration still recorded +-- as applied, and re-running it fails forever with `Unknown column` (1091) -- the startup preflight +-- then refuses the database, correctly, and the only way out is the backup. Making it resumable +-- needs conditional DDL, i.e. a stored procedure built before the checks have run; the standalone +-- script in tools/custom_role_rollback/mysql.sql does the whole downgrade in one audited pass +-- instead, and is what operators should use. +-- +-- So this is supported for development checkouts only, and it says so. Acknowledge separately from +-- the data-loss marker above -- that one is about what a downgrade discards, this one is about what +-- an interrupted downgrade cannot repair: +-- +-- CREATE TABLE __vw_allow_unresumable_mysql_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +-- +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +CREATE TEMPORARY TABLE __vw_mysql_resume_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_mysql_resume_guard (blocked) VALUES (1); +INSERT INTO __vw_mysql_resume_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_allow_unresumable_mysql_downgrade' ); -DROP TABLE __vw_custom_role_downgrade_guard; +DROP TEMPORARY TABLE __vw_mysql_resume_guard; --- Consume the acknowledgement: it authorized *this* revert, not every future one. After a --- re-upgrade the next revert has to be acknowledged again. -DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +-- Nothing else to undo: the acknowledgement deliberately survives this step. It has to still be here +-- when the next revert removes the first permission column, which is what this guard exists to +-- announce -- checking and dropping it in the same step would leave every following lossy revert +-- unguarded. +SELECT 1; diff --git a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql index 9079f661..1d0d86d3 100644 --- a/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql +++ b/migrations/mysql/2026-07-24-140000_guard_custom_role_downgrade/up.sql @@ -7,5 +7,7 @@ DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; -- Also clear a downgrade acknowledgement left over from an earlier revert, so consent is --- never inherited across an upgrade. +-- never inherited across an upgrade. Both of them: this backend's revert chain needs a second one, +-- acknowledging that it cannot be resumed after a crash between a committed ALTER and the ledger. DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +DROP TABLE IF EXISTS __vw_allow_unresumable_mysql_downgrade; diff --git a/migrations/mysql/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql b/migrations/mysql/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql new file mode 100644 index 00000000..613cc7e7 --- /dev/null +++ b/migrations/mysql/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql @@ -0,0 +1,4 @@ +-- Nothing to undo: this migration only re-applies permissions that 2026-07-23-120000 also sets, and +-- the original values are not recoverable. The permission columns themselves are removed further down +-- the chain by 2026-07-16-120000/down.sql, which is guarded. +SELECT 1; \ No newline at end of file diff --git a/migrations/mysql/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql b/migrations/mysql/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql new file mode 100644 index 00000000..4586bfdf --- /dev/null +++ b/migrations/mysql/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql @@ -0,0 +1,111 @@ +-- Follow-up repair for databases that already recorded 2026-07-23-120000. +-- +-- That migration originally *removed* the direct 0/1/1 collection permissions of a legacy Manager +-- whose authority came from an organization-local `access_all` group, because the runtime derived the +-- authority from the group instead. Deriving it turned out to be unsound -- "Custom, none of the three +-- collection permissions, member of such a group" is also the shape of every newly created flagless +-- Custom member -- so the runtime fallback is gone and 2026-07-23-120000 now materializes the +-- authority into the permission columns. +-- +-- Rewriting that file is not enough on its own: a database whose ledger already carries +-- 20260723120000 never runs it again, and would silently lose the capability. Repeat the +-- materialization here, in its own version, so both paths converge on the same state. +-- +-- Unlike an earlier revision of this file, the repair is driven by the legacy-Manager record written +-- by 2026-06-30-120000 rather than by role and group membership alone. Those two are the same shape, +-- so matching on them blanket-granted organization-wide collection edit and delete to modern Custom +-- members -- turning Create-only into Create+Edit+Delete, Edit-only into Edit+Delete, and a flagless +-- Custom into Edit+Delete, the last of which also implies `has_full_access()`. +-- +-- What this materialization *means* -- a group-bound capability becoming a permanent membership +-- permission -- is confirmed by an owner in 2026-08-10-120000, which runs immediately after it. +-- +-- Idempotent: on a database that ran the rewritten 2026-07-23-120000 every affected row already +-- holds these values. It only reads `groups` / `groups_users` and the record table and writes the two +-- permission columns, so it is also safe after `access_all` has been dropped. +-- +-- Deliberately not `create_new_collections`: collection creation historically required +-- membership-level `access_all`. +-- +-- Every statement here is DML or TEMPORARY-table bookkeeping, so nothing commits implicitly and the +-- repair either lands with the ledger insert or not at all. + +-- The legacy-Manager record has to exist already; see 2026-07-23-120000 for why this refuses rather +-- than creating it. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_custom_role_legacy_manager' +); +DROP TEMPORARY TABLE __vw_legacy_manager_record_guard; + +-- Fail closed on a database whose legacy provenance was never recorded. +-- +-- If a Custom member sits in an organization-local `access_all` group but is not on record as a +-- legacy Manager, one of two things is true and this file cannot tell them apart: either the +-- membership really is a converted legacy Manager whose record was never written (a ledger from an +-- earlier revision of this feature branch), or it is an ordinary modern Custom member who must not +-- gain anything. Granting is a silent privilege escalation; skipping silently drops a real +-- capability. +-- +-- `__vw_custom_role_history_verified` settles it: 2026-06-30-120000 creates it, and an operator +-- creates it after auditing an older history, so its presence means the unrecorded memberships below +-- are unrecorded *on purpose*. Its absence means nobody has looked, and this stops. The startup +-- preflight refuses that state before any migration runs; this guard is the backstop for a bare +-- migration runner. `src/db/mod.rs` prints the full recovery, which lists these memberships: +-- +-- SELECT uo.uuid, uo.org_uuid, uo.status, +-- uo.create_new_collections, uo.edit_any_collection, uo.delete_any_collection +-- FROM users_organizations uo +-- INNER JOIN groups_users gu ON gu.users_organizations_uuid = uo.uuid +-- INNER JOIN `groups` g ON g.uuid = gu.groups_uuid AND g.organizations_uuid = uo.org_uuid +-- WHERE uo.atype = 4 AND g.access_all = 1 +-- AND uo.uuid NOT IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager); +-- +-- The marker never grants anything by itself: the update below is always driven by the record table, +-- so an unrecorded membership keeps exactly the permissions it has. +CREATE TEMPORARY TABLE __vw_legacy_group_authority_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_group_authority_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_group_authority_guard (blocked) +SELECT 1 +FROM users_organizations AS uo +WHERE uo.atype = 4 + AND uo.uuid NOT IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN `groups` AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = uo.uuid + AND g.organizations_uuid = uo.org_uuid + AND g.access_all = TRUE + ) + AND NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() + AND table_name = '__vw_custom_role_history_verified' + ) +LIMIT 1; +DROP TEMPORARY TABLE __vw_legacy_group_authority_guard; + +UPDATE users_organizations +SET edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN `groups` AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = users_organizations.uuid + AND g.organizations_uuid = users_organizations.org_uuid + AND g.access_all = TRUE + ); diff --git a/migrations/mysql/2026-08-10-120000_confirm_permanent_collection_authority/down.sql b/migrations/mysql/2026-08-10-120000_confirm_permanent_collection_authority/down.sql new file mode 100644 index 00000000..6fcda697 --- /dev/null +++ b/migrations/mysql/2026-08-10-120000_confirm_permanent_collection_authority/down.sql @@ -0,0 +1,4 @@ +-- Nothing to undo: this migration only asks for a decision, it never writes permissions. The +-- acknowledgement it consumes is deliberately not recreated -- a revert is not consent, and the next +-- upgrade has to ask again. +SELECT 1; diff --git a/migrations/mysql/2026-08-10-120000_confirm_permanent_collection_authority/up.sql b/migrations/mysql/2026-08-10-120000_confirm_permanent_collection_authority/up.sql new file mode 100644 index 00000000..151b0812 --- /dev/null +++ b/migrations/mysql/2026-08-10-120000_confirm_permanent_collection_authority/up.sql @@ -0,0 +1,121 @@ +-- Make the one semantic change this feature cannot express an owner's decision instead of a default. +-- +-- Before the Custom role, a Manager who reached every collection through an organization-local group +-- with `access_all` held that authority *while* the group relationship lasted. It ended when the +-- group was deleted, when its `accessAll` was switched off, when the member left it, and it was inert +-- whenever `ORG_GROUPS_ENABLED` was false. Nothing in the new model expresses a permission bound to a +-- group like that: `edit_any_collection` and `delete_any_collection` live on the membership. +-- +-- So the earlier migrations in this chain write the authority onto the membership, and the result is +-- deliberately not identical to what it replaces: +-- +-- * it no longer lapses when the last qualifying group disappears, or when `accessAll` is cleared; +-- * it applies even with the groups feature switched off; +-- * `edit_any_collection` additionally satisfies `has_full_access()`, so the member reaches every +-- collection of the organization directly rather than through the group. +-- +-- Materializing it silently would be a migration that grants durable organization-wide collection +-- edit and delete on its own authority. Dropping it silently would take a capability away. Neither is +-- ours to choose, so this migration stops and hands the decision to an owner. It grants nothing and +-- revokes nothing itself. +-- +-- On a database with no Custom membership that both has edit/delete authority and belongs to an +-- organization-local `access_all` group, there is nothing to decide and this is a no-op. +-- +-- Vaultwarden's startup preflight looks ahead for exactly the condition below and refuses with the +-- full text (`RefuseUnconfirmedPermanentCollectionAuthority` in `src/db/mod.rs`), from the legacy +-- schema as well, so an operator normally never reaches the abort here. Diesel reports only the +-- driver error, so on this path the question would arrive as `Duplicate entry '1' for key 'PRIMARY'` +-- and nothing else. Keep the two predicates identical. +-- +-- Review the affected memberships: +-- +-- SELECT uo.uuid, uo.user_uuid, uo.org_uuid, uo.status, +-- uo.create_new_collections, uo.edit_any_collection, uo.delete_any_collection, +-- (uo.uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager)) +-- AS was_legacy_manager +-- FROM users_organizations uo +-- WHERE uo.atype = 4 +-- AND (uo.edit_any_collection = 1 OR uo.delete_any_collection = 1) +-- AND EXISTS ( +-- SELECT 1 FROM groups_users gu +-- INNER JOIN `groups` g ON g.uuid = gu.groups_uuid +-- WHERE gu.users_organizations_uuid = uo.uuid +-- AND g.organizations_uuid = uo.org_uuid +-- AND g.access_all = 1); +-- +-- Reading the result: +-- +-- * `was_legacy_manager = 1` -- a converted Manager. Review it even when +-- `create_new_collections = 1`: that independent permission can be changed after an earlier +-- revision materialized group-derived edit/delete, so its current value cannot prove where those +-- two permissions came from. A membership whose own legacy `access_all` supplied all three may +-- therefore be listed conservatively even though its authority was already permanent. +-- * `was_legacy_manager = 0` -- never a Manager. On a database first upgraded by revision bf54088c +-- they may carry permissions that revision's 2026-08-09-120000 granted in bulk, which nothing can +-- distinguish from a deliberate grant any more -- check them against what you intended. +-- +-- An invited or revoked membership is listed too, and deliberately so. It holds no authority today -- +-- every guard requires a confirmed membership, and `MembershipStatus::from_i32` rejects the revoked +-- value outright -- but the permission is what it would come back with if it is ever restored, and +-- by then the group it came from may be gone. Status is therefore not part of the predicate. +-- +-- Clear whatever you do not want to keep, for example: +-- +-- UPDATE users_organizations +-- SET edit_any_collection = 0, delete_any_collection = 0 +-- WHERE uuid = ''; +-- +-- Then record the decision once, with every Vaultwarden instance stopped: +-- +-- CREATE TABLE __vw_ack_permanent_collection_authority (acknowledged INTEGER NOT NULL PRIMARY KEY); +-- +-- The acknowledgement is consumed at the end of this file, so one decision covers one upgrade. +-- +-- The legacy-Manager record has to exist already: the chain and supported rollback use it as the +-- immutable role-provenance record. Refuse a damaged history here too; see 2026-07-23-120000 for why +-- this never creates it. +-- +-- `CREATE TEMPORARY TABLE` / `DROP TEMPORARY TABLE` do not commit implicitly, so this check is free +-- of durable side effects. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 FROM DUAL +WHERE NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() AND table_name = '__vw_custom_role_legacy_manager' +); +DROP TEMPORARY TABLE __vw_legacy_manager_record_guard; + +-- The duplicate key aborts the migration. It is only inserted while an unconfirmed membership exists. +CREATE TEMPORARY TABLE __vw_permanent_authority_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_permanent_authority_guard (blocked) VALUES (1); +INSERT INTO __vw_permanent_authority_guard (blocked) +SELECT 1 +FROM users_organizations AS uo +WHERE uo.atype = 4 + AND (uo.edit_any_collection = TRUE OR uo.delete_any_collection = TRUE) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN `groups` AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = uo.uuid + AND g.organizations_uuid = uo.org_uuid + AND g.access_all = TRUE + ) + AND NOT EXISTS ( + SELECT 1 FROM information_schema.tables + WHERE table_schema = DATABASE() + AND table_name = '__vw_ack_permanent_collection_authority' + ) +LIMIT 1; +DROP TEMPORARY TABLE __vw_permanent_authority_guard; + +DROP TABLE IF EXISTS __vw_ack_permanent_collection_authority; diff --git a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql index 9ac54bfb..3879f340 100644 --- a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql +++ b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -1,6 +1,65 @@ --- Convert Custom members back to Manager, the representation older server versions --- expect (they masquerade Manager as Custom in API responses and cannot load type 4). -UPDATE users_organizations SET atype = 3 WHERE atype = 4; +-- Lossy revert: this removes the three Custom management permissions and the Custom role itself, +-- which the legacy role/access_all schema cannot represent. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 +WHERE to_regclass('__vw_allow_custom_role_downgrade') IS NULL; +DROP TABLE __vw_custom_role_downgrade_guard; + +-- Convert Custom members back to a role the older server can load -- it cannot represent type 4 and +-- masquerades Manager as Custom in API responses. Which role each one gets is a decision about its +-- authority *now*, and it is not symmetric with the upgrade. +-- +-- Deliberately not driven by `__vw_custom_role_legacy_manager`. That records who held the Manager +-- role before the *first* upgrade and is never updated afterwards, so a member whose Manager powers +-- an owner has since reduced -- or who was demoted to User and later re-created as a limited Custom +-- member -- would be handed the whole legacy role back. Historical provenance is evidence, not +-- authorization. Use a list written for this downgrade instead. +-- +-- Absent, or empty, means "nobody", and everything below becomes a plain User. That is the safe +-- direction: the legacy Manager role is not a subset of what a Custom member holds -- it manages, and +-- deletes, every collection reachable through `users_collections.manage`, +-- `collections_groups.manage` or `groups.access_all`, and reads member and collection ACL details +-- through `ManagerHeadersLoose`, none of which needs a permission flag in the old schema. To keep the +-- historical mapping, copy it over deliberately before reverting: +-- +-- CREATE TABLE __vw_rollback_manager_allowlist (users_organizations_uuid CHAR(36) NOT NULL PRIMARY KEY); +-- INSERT INTO __vw_rollback_manager_allowlist (users_organizations_uuid) +-- SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager; +CREATE TABLE IF NOT EXISTS __vw_rollback_manager_allowlist ( + users_organizations_uuid CHAR(36) NOT NULL PRIMARY KEY +); + +UPDATE users_organizations SET atype = 3 +WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist); + +-- Everything still on the Custom role becomes a plain User, and `access_all` has to be cleared with +-- it. 2026-07-16-120000/down.sql sets that flag for every Custom member holding all three collection +-- permissions, on the assumption they are about to become a Manager; left behind on a User it +-- produces `User + access_all`, the one legacy state the upgrade refuses outright -- which would +-- leave the database unable to move forward again. `users_collections` and `collections_groups` are +-- untouched, so these members keep every per-collection grant and lose only the organization-wide +-- powers the old schema cannot express. +UPDATE users_organizations SET atype = 2, access_all = FALSE WHERE atype = 4; + ALTER TABLE users_organizations DROP COLUMN manage_users; ALTER TABLE users_organizations DROP COLUMN manage_groups; ALTER TABLE users_organizations DROP COLUMN manage_policies; + +-- Oldest lossy step of the chain: nothing below this can lose Custom-role data any more, so the +-- acknowledgement is consumed here. It authorized *this* downgrade, not every future one. The +-- Custom-role bookkeeping goes with it -- the roles it describes are back, and a later re-upgrade +-- rebuilds all of it from the restored `atype = 3` rows. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +DROP TABLE IF EXISTS __vw_rollback_manager_allowlist; +DROP TABLE IF EXISTS __vw_custom_role_legacy_manager; +DROP TABLE IF EXISTS __vw_custom_role_history_verified; diff --git a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql index 6ffdca13..4096fc6d 100644 --- a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql +++ b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -1,6 +1,35 @@ ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; +-- Record which memberships were legacy Managers *before* anything converts them. +-- +-- This is the only moment at which that is knowable. `atype = 3` means Manager here and Custom +-- afterwards -- the conversion below reuses the value -- so once it has run, a genuine legacy +-- Manager and a Custom member created later are byte-identical. Every later step that has to reason +-- about legacy authority (2026-07-23, 2026-08-09 and tools/custom_role_rollback/) reads this table +-- instead of guessing, which is what stops them from handing legacy privileges to modern members. +-- +-- Deliberately not a Diesel model and not in schema.rs: no runtime code reads it. It is +-- migration/rollback bookkeeping, and it carries no foreign key so that 2026-07-24-120000's table +-- rebuild does not have to care about it. +CREATE TABLE IF NOT EXISTS __vw_custom_role_legacy_manager ( + users_organizations_uuid CHAR(36) NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_legacy_manager (users_organizations_uuid) +SELECT uuid FROM users_organizations WHERE atype = 3 +ON CONFLICT DO NOTHING; + +-- Separately, mark that this database's Custom-role history is accounted for -- it was produced by +-- the migrations that ship today. Nothing else creates this table, which is what lets the startup +-- preflight treat its absence as proof that an earlier revision of this chain ran instead. +-- +-- Deliberately not the record table above: that one holds data an operator has to be able to write +-- during recovery, so its existence cannot also stand for "the history behind this data was +-- reviewed" -- creating it empty to silence an error would otherwise pass as the audit it asks for. +CREATE TABLE IF NOT EXISTS __vw_custom_role_history_verified ( + verified INTEGER NOT NULL PRIMARY KEY +); + -- Previously the server stored members created with the Custom role as Manager (3) and -- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted -- type, convert those members so clients (which no longer know the Manager role) keep diff --git a/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/down.sql b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/down.sql index 6506059d..c278fa8e 100644 --- a/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/down.sql +++ b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/down.sql @@ -1,3 +1,19 @@ +-- Lossy revert: this removes the three independent Custom collection permissions, which the legacy +-- role/access_all schema cannot represent -- it only knows all three together. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 +WHERE to_regclass('__vw_allow_custom_role_downgrade') IS NULL; +DROP TABLE __vw_custom_role_downgrade_guard; + -- The previous schema exposes access_all as the three collection permissions together. Avoid -- turning Edit-only memberships into Create/Edit/Delete grants when rolling back. UPDATE users_organizations diff --git a/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql index da66070a..aab5f0cd 100644 --- a/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql +++ b/migrations/postgresql/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -1,22 +1,55 @@ +-- The legacy-Manager record has to exist before anything below runs: 2026-06-30-120000 writes it, +-- and the group-derived step at the end of this file reads it. Checked *before* the ALTER TABLE statements so +-- the refusal is symmetrical with the other backends -- PostgreSQL DDL is transactional, so nothing +-- would be left behind either way. +-- +-- Creating the record here instead would manufacture an empty, apparently valid history for exactly +-- the databases that need an operator to look at them; see 2026-07-23-120000 for the full reasoning. +-- This guard exists for a bare migration runner that never consulted the startup preflight. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 +WHERE to_regclass('__vw_custom_role_legacy_manager') IS NULL; +DROP TABLE __vw_legacy_manager_record_guard; + ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE; -- Before these permissions were persisted independently, access_all represented the legacy -- "Manage all collections" checkbox. Preserve that capability for existing Custom members. +-- +-- Driven by the stored value rather than by the membership's shape, so it needs no provenance: a +-- member carrying access_all held exactly this capability, whenever the row was created. UPDATE users_organizations SET create_new_collections = access_all, edit_any_collection = access_all, delete_any_collection = access_all WHERE atype = 4; --- A legacy Manager also managed every collection when one of their groups had access_all, --- even if the membership itself did not. Preserve that existing edit/delete capability without --- granting collection creation, which historically still required membership access_all. +-- A legacy Manager also managed every collection when one of their groups had access_all, even if +-- the membership itself did not. Preserve that existing edit/delete capability without granting +-- collection creation, which historically still required membership access_all. +-- +-- Restricted to memberships recorded as legacy Managers, exactly like 2026-07-23-120000 and +-- 2026-08-09-120000. Role and group membership alone are *not* evidence of legacy authority: +-- "Custom, member of an access_all group" is also the shape of every modern Custom member who was +-- simply put into an ordinary access_all group, and granting on that shape hands them +-- organization-wide collection edit and delete -- which, through edit_any_collection, also satisfies +-- has_full_access() and therefore reaches every cipher in the organization. +-- +-- On the normal upgrade path this changes nothing: 2026-06-30-120000 runs first and records every +-- `atype = 3` row, which at this point is every Custom member there is. UPDATE users_organizations SET edit_any_collection = TRUE, delete_any_collection = TRUE WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND EXISTS ( SELECT 1 FROM groups_users diff --git a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql index b9d4e9e6..4188886b 100644 --- a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql +++ b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql @@ -1,3 +1,4 @@ --- This is an idempotent data repair. Reverting it must not remove permissions or recreate the --- invalid persisted Manager type; the older-schema migration performs its own safe conversion. +-- This is an idempotent data repair, and it creates no rows: reverting it must not remove permissions +-- or recreate the invalid persisted Manager type. The older-schema migration performs its own safe +-- conversion. SELECT 1; diff --git a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index aca9d21d..7b9ad6b3 100644 --- a/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/postgresql/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -1,49 +1,73 @@ --- A normal User with the historical membership-level access_all bit reached every collection of the --- organization with full read/write, but held no collection-management authority. Mapping that onto --- the Custom role would add authority, clearing the bit would remove existing access — so instead, --- materialize the reach as explicit per-collection assignments while the source bit still exists. --- `manage` stays FALSE, so no management authority is invented. This is the same approach Bitwarden --- took when it retired `accessAll`; the one behavioral difference is that the access is no longer --- dynamic, i.e. collections created later are not added automatically. +-- Repair the legacy role/permission state while membership `access_all` still exists. -- --- Step 1: a pre-existing assignment was overridden by access_all (full read/write regardless of --- read_only/hide_passwords), so relax it to match what the member actually had. -UPDATE users_collections -SET read_only = FALSE, - hide_passwords = FALSE -WHERE EXISTS ( - SELECT 1 - FROM users_organizations AS uo - INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid - WHERE uo.atype = 2 - AND uo.access_all = TRUE - AND uo.user_uuid = users_collections.user_uuid - AND c.uuid = users_collections.collection_uuid +-- A plain User carrying the historical membership-level `access_all` bit is deliberately not +-- converted: that state grants dynamic reach over every collection *without* management authority, +-- and the new model has no equivalent. It is refused instead -- and refused *here*, not only in Rust: +-- Vaultwarden's startup preflight already stops such a database before any migration runs and prints +-- the two explicit choices (`RefuseLegacyUserAccessAll` in `src/db/mod.rs`), but a migration run +-- outside that wrapper -- `diesel migration run`, a bare `MigrationHarness`, any other SQL runner +-- -- would not consult it, and 2026-07-24-120000 removes the only source of that reach a few +-- statements later. Repeating the check before this file's first mutation is what makes the silent +-- loss impossible rather than unlikely. +-- +-- The duplicate key aborts the migration. It is only inserted when such a membership exists. +CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( + blocked INTEGER NOT NULL PRIMARY KEY ); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype = 2 + AND access_all = TRUE +LIMIT 1; +DROP TABLE __vw_legacy_user_access_all_guard; + +-- The legacy-Manager record has to exist already: 2026-06-30-120000 writes it, and the startup +-- preflight refuses a database whose ledger carries that version without it. Creating it here would +-- manufacture an empty, apparently valid history for precisely the databases that need an operator +-- to look at them, so refuse instead -- this guard exists for a bare migration runner that never +-- consulted the preflight. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 +WHERE to_regclass('__vw_custom_role_legacy_manager') IS NULL; +DROP TABLE __vw_legacy_manager_record_guard; --- Step 2: add the assignments that did not exist yet. Existing rows are left to step 1. -INSERT INTO users_collections (user_uuid, collection_uuid, read_only, hide_passwords, manage) -SELECT uo.user_uuid, c.uuid, FALSE, FALSE, FALSE -FROM users_organizations AS uo -INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid -WHERE uo.atype = 2 - AND uo.access_all = TRUE -ON CONFLICT (user_uuid, collection_uuid) DO NOTHING; +-- A database that reaches this file with memberships still at `atype = 3` never ran the rewritten +-- 2026-06-30-120000 -- for instance because a runner applied the files out of order. Those rows are +-- unambiguously legacy Managers *right now*, so record them before the conversion at the end of this +-- file makes them indistinguishable from modern Custom members. Idempotent, and a no-op on the +-- normal path. +INSERT INTO __vw_custom_role_legacy_manager (users_organizations_uuid) +SELECT uuid FROM users_organizations WHERE atype = 3 +ON CONFLICT DO NOTHING; --- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the --- exact direct 0/1/1 pattern. While the same organization-local source group is still present, --- remove that deterministic copy so later group removal also revokes the authority. The runtime --- keeps deriving edit/delete from that group -- see --- `Membership::has_legacy_group_collection_manage_access` -- so nothing is lost here. +-- Step 1: a legacy Manager who managed every collection through an organization-local group with +-- `access_all` keeps that authority, materialized into the permission columns it now lives in. +-- +-- Restricted to memberships recorded as legacy Managers. Matching on role and group membership +-- alone -- which an earlier revision did -- also matches every *modern* flagless Custom member who +-- happens to sit in an ordinary `access_all` group, because the two states are the same shape, and +-- would hand them organization-wide collection edit and delete. +-- +-- Earlier revisions derived this authority live from the group at request time instead, which was +-- unsound for exactly that reason. Materializing it makes it visible to an owner in the member's +-- permission list and revocable by clearing a checkbox. It is deliberately a one-time snapshot: the +-- permission no longer lapses when the source group does. See tools/custom_role_rollback/README.md. +-- +-- Deliberately not `create_new_collections`: creating collections historically required +-- membership-level `access_all`, and it is an independent permission now. UPDATE users_organizations -SET edit_any_collection = FALSE, - delete_any_collection = FALSE +SET edit_any_collection = TRUE, + delete_any_collection = TRUE WHERE atype IN (3, 4) - AND access_all = FALSE - AND create_new_collections = FALSE - AND edit_any_collection = TRUE - AND delete_any_collection = TRUE - AND EXISTS (SELECT 1 FROM __vw_custom_role_same_run_0716 WHERE marker = 1) + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND EXISTS ( SELECT 1 FROM groups_users AS gu @@ -53,34 +77,20 @@ WHERE atype IN (3, 4) AND g.access_all = TRUE ); --- A remaining 0/1/1 pattern may be either an intentional direct grant or an older derived grant --- whose source group has already been removed. Do not guess which one it is. -CREATE TEMPORARY TABLE __vw_legacy_group_access_guard ( - blocked INTEGER NOT NULL PRIMARY KEY -); -INSERT INTO __vw_legacy_group_access_guard (blocked) VALUES (1); -INSERT INTO __vw_legacy_group_access_guard (blocked) -SELECT 1 -FROM users_organizations -WHERE atype IN (3, 4) - AND access_all = FALSE - AND create_new_collections = FALSE - AND edit_any_collection = TRUE - AND delete_any_collection = TRUE -LIMIT 1; -DROP TABLE __vw_legacy_group_access_guard; - --- Membership access_all on a legacy Manager/Custom represented all three collection capabilities. --- Set only TRUE values so this repair never removes independently configured permissions. +-- Step 2: membership `access_all` on a legacy Manager represented all three collection capabilities. +-- Set only TRUE values so this repair never removes independently configured permissions, and again +-- only for recorded legacy Managers -- an intermediate revision of this feature branch could leave a +-- modern Custom member carrying the old column as well. UPDATE users_organizations SET create_new_collections = TRUE, edit_any_collection = TRUE, delete_any_collection = TRUE WHERE atype IN (3, 4) + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND access_all = TRUE; -- Convert only after the legacy bit has been copied. UPDATE users_organizations SET atype = 4 WHERE atype = 3; --- Clear the same-run marker only after every guard and permission update succeeds. +-- Clear the same-run marker only after every permission update succeeds. DELETE FROM __vw_custom_role_same_run_0716 WHERE marker = 1; diff --git a/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/down.sql b/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/down.sql index f276ea5b..c9d1c95e 100644 --- a/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/down.sql +++ b/migrations/postgresql/2026-07-24-130000_add_custom_access_permissions/down.sql @@ -1,3 +1,19 @@ +-- Lossy revert: this removes the three Custom access permissions, which the legacy schema cannot +-- represent at all. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 +WHERE to_regclass('__vw_allow_custom_role_downgrade') IS NULL; +DROP TABLE __vw_custom_role_downgrade_guard; + ALTER TABLE users_organizations DROP COLUMN access_event_logs; ALTER TABLE users_organizations DROP COLUMN access_import_export; ALTER TABLE users_organizations DROP COLUMN access_reports; diff --git a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql index 787d60dc..d5a54d49 100644 --- a/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/postgresql/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -1,12 +1,13 @@ --- Nine independent Custom-role permissions cannot be represented losslessly by the legacy --- role/access_all schema, so a revert is blocked here -- before any older down migration removes --- permission data. --- --- It is an explicit, acknowledged decision though, not a dead end. Create the marker table below --- while every Vaultwarden instance is stopped and this guard lets the revert through: +-- Downgrade guard. Reverting this migration destroys Custom-role permission data that the legacy +-- role/access_all schema cannot represent, so it only runs with an explicit acknowledgement. Create +-- the marker table below while every Vaultwarden instance is stopped: -- -- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); -- +-- The acknowledgement stays valid for the rest of the revert chain and is consumed by the oldest +-- lossy migration (2026-06-30-120000), so one decision covers one downgrade -- and a re-upgrade +-- clears it again (2026-07-24-140000/up.sql), so consent is never inherited. +-- -- Operators who only need the old server version to start again do not need Diesel at all -- -- tools/custom_role_rollback/ has a self-contained script per backend. CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( @@ -19,6 +20,8 @@ SELECT 1 WHERE to_regclass('__vw_allow_custom_role_downgrade') IS NULL; DROP TABLE __vw_custom_role_downgrade_guard; --- Consume the acknowledgement: it authorized *this* revert, not every future one. After a --- re-upgrade the next revert has to be acknowledged again. -DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +-- Nothing else to undo: the acknowledgement deliberately survives this step. It has to still be here +-- when the next revert removes the first permission column, which is what this guard exists to +-- announce -- checking and dropping it in the same step would leave every following lossy revert +-- unguarded. +SELECT 1; diff --git a/migrations/postgresql/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql b/migrations/postgresql/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql new file mode 100644 index 00000000..613cc7e7 --- /dev/null +++ b/migrations/postgresql/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql @@ -0,0 +1,4 @@ +-- Nothing to undo: this migration only re-applies permissions that 2026-07-23-120000 also sets, and +-- the original values are not recoverable. The permission columns themselves are removed further down +-- the chain by 2026-07-16-120000/down.sql, which is guarded. +SELECT 1; \ No newline at end of file diff --git a/migrations/postgresql/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql b/migrations/postgresql/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql new file mode 100644 index 00000000..821a5314 --- /dev/null +++ b/migrations/postgresql/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql @@ -0,0 +1,103 @@ +-- Follow-up repair for databases that already recorded 2026-07-23-120000. +-- +-- That migration originally *removed* the direct 0/1/1 collection permissions of a legacy Manager +-- whose authority came from an organization-local `access_all` group, because the runtime derived the +-- authority from the group instead. Deriving it turned out to be unsound -- "Custom, none of the three +-- collection permissions, member of such a group" is also the shape of every newly created flagless +-- Custom member -- so the runtime fallback is gone and 2026-07-23-120000 now materializes the +-- authority into the permission columns. +-- +-- Rewriting that file is not enough on its own: a database whose ledger already carries +-- 20260723120000 never runs it again, and would silently lose the capability. Repeat the +-- materialization here, in its own version, so both paths converge on the same state. +-- +-- Unlike an earlier revision of this file, the repair is driven by the legacy-Manager record written +-- by 2026-06-30-120000 rather than by role and group membership alone. Those two are the same shape, +-- so matching on them blanket-granted organization-wide collection edit and delete to modern Custom +-- members -- turning Create-only into Create+Edit+Delete, Edit-only into Edit+Delete, and a flagless +-- Custom into Edit+Delete, the last of which also implies `has_full_access()`. +-- +-- What this materialization *means* -- a group-bound capability becoming a permanent membership +-- permission -- is confirmed by an owner in 2026-08-10-120000, which runs immediately after it. +-- +-- Idempotent: on a database that ran the rewritten 2026-07-23-120000 every affected row already +-- holds these values. It only reads `groups` / `groups_users` and the record table and writes the two +-- permission columns, so it is also safe after `access_all` has been dropped. +-- +-- Deliberately not `create_new_collections`: collection creation historically required +-- membership-level `access_all`. +DO $$ +DECLARE + undecidable int := 0; +BEGIN + -- The legacy-Manager record has to exist already; see 2026-07-23-120000 for why this refuses + -- rather than creating it. + IF to_regclass('__vw_custom_role_legacy_manager') IS NULL THEN + RAISE EXCEPTION + 'Upgrade refused, nothing was changed: __vw_custom_role_legacy_manager does not exist, ' + 'so which memberships were legacy Managers before the upgrade is unknown. Start ' + 'Vaultwarden once to get the full recovery instructions, or see ' + 'tools/custom_role_rollback/README.md.'; + END IF; + + -- Fail closed on a database whose legacy provenance was never recorded. + -- + -- If a Custom member sits in an organization-local `access_all` group but is not on record as a + -- legacy Manager, one of two things is true and this file cannot tell them apart: either the + -- membership really is a converted legacy Manager whose record was never written (a ledger from + -- an earlier revision of this feature branch), or it is an ordinary modern Custom member who must + -- not gain anything. Granting is a silent privilege escalation; skipping silently drops a real + -- capability. + -- + -- `__vw_custom_role_history_verified` settles it: 2026-06-30-120000 creates it, and an operator + -- creates it after auditing an older history, so its presence means the unrecorded memberships + -- are unrecorded *on purpose*. Its absence means nobody has looked, and this stops. The startup + -- preflight refuses that state before any migration runs; this is the backstop for a bare + -- migration runner. + -- + -- The marker never grants anything by itself: the update below is always driven by the record + -- table, so an unrecorded membership keeps exactly the permissions it has. + IF to_regclass('__vw_custom_role_history_verified') IS NULL THEN + SELECT count(*) INTO undecidable + FROM users_organizations uo + WHERE uo.atype = 4 + AND uo.uuid NOT IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) + AND EXISTS ( + SELECT 1 + FROM groups_users gu + INNER JOIN "groups" g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = uo.uuid + AND g.organizations_uuid = uo.org_uuid + AND g.access_all = TRUE + ); + END IF; + + IF undecidable <> 0 THEN + RAISE EXCEPTION + 'Upgrade refused, nothing was changed: % Custom membership(s) belong to an access_all ' + 'group but are not on record as legacy Managers, and this database''s Custom-role ' + 'history has never been audited, so a converted legacy Manager cannot be told from an ' + 'ordinary Custom member. Review them with: SELECT uo.uuid, uo.org_uuid, uo.status, ' + 'uo.create_new_collections, uo.edit_any_collection, uo.delete_any_collection FROM ' + 'users_organizations uo JOIN groups_users gu ON gu.users_organizations_uuid = uo.uuid ' + 'JOIN "groups" g ON g.uuid = gu.groups_uuid AND g.organizations_uuid = uo.org_uuid ' + 'WHERE uo.atype = 4 AND g.access_all AND uo.uuid NOT IN (SELECT ' + 'users_organizations_uuid FROM __vw_custom_role_legacy_manager); Start Vaultwarden once ' + 'for the full recovery instructions.', + undecidable; + END IF; +END $$; + +UPDATE users_organizations +SET edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN "groups" AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = users_organizations.uuid + AND g.organizations_uuid = users_organizations.org_uuid + AND g.access_all = TRUE + ); diff --git a/migrations/postgresql/2026-08-10-120000_confirm_permanent_collection_authority/down.sql b/migrations/postgresql/2026-08-10-120000_confirm_permanent_collection_authority/down.sql new file mode 100644 index 00000000..6fcda697 --- /dev/null +++ b/migrations/postgresql/2026-08-10-120000_confirm_permanent_collection_authority/down.sql @@ -0,0 +1,4 @@ +-- Nothing to undo: this migration only asks for a decision, it never writes permissions. The +-- acknowledgement it consumes is deliberately not recreated -- a revert is not consent, and the next +-- upgrade has to ask again. +SELECT 1; diff --git a/migrations/postgresql/2026-08-10-120000_confirm_permanent_collection_authority/up.sql b/migrations/postgresql/2026-08-10-120000_confirm_permanent_collection_authority/up.sql new file mode 100644 index 00000000..929450c3 --- /dev/null +++ b/migrations/postgresql/2026-08-10-120000_confirm_permanent_collection_authority/up.sql @@ -0,0 +1,111 @@ +-- Make the one semantic change this feature cannot express an owner's decision instead of a default. +-- +-- Before the Custom role, a Manager who reached every collection through an organization-local group +-- with `access_all` held that authority *while* the group relationship lasted. It ended when the +-- group was deleted, when its `accessAll` was switched off, when the member left it, and it was inert +-- whenever `ORG_GROUPS_ENABLED` was false. Nothing in the new model expresses a permission bound to a +-- group like that: `edit_any_collection` and `delete_any_collection` live on the membership. +-- +-- So the earlier migrations in this chain write the authority onto the membership, and the result is +-- deliberately not identical to what it replaces: +-- +-- * it no longer lapses when the last qualifying group disappears, or when `accessAll` is cleared; +-- * it applies even with the groups feature switched off; +-- * `edit_any_collection` additionally satisfies `has_full_access()`, so the member reaches every +-- collection of the organization directly rather than through the group. +-- +-- Materializing it silently would be a migration that grants durable organization-wide collection +-- edit and delete on its own authority. Dropping it silently would take a capability away. Neither is +-- ours to choose, so this migration stops and hands the decision to an owner. It grants nothing and +-- revokes nothing itself. +-- +-- On a database with no Custom membership that both has edit/delete authority and belongs to an +-- organization-local `access_all` group, there is nothing to decide and this is a no-op. +-- +-- Vaultwarden's startup preflight looks ahead for exactly the condition below and refuses with the +-- full text (`RefuseUnconfirmedPermanentCollectionAuthority` in `src/db/mod.rs`), from the legacy +-- schema as well, so an operator normally never reaches the abort here. Diesel reports only the +-- driver error, so on this path the question would arrive as a bare duplicate-key violation on +-- `__vw_permanent_authority_guard` and nothing else. Keep the two predicates identical. +-- +-- Review the affected memberships: +-- +-- SELECT uo.uuid, uo.user_uuid, uo.org_uuid, uo.status, +-- uo.create_new_collections, uo.edit_any_collection, uo.delete_any_collection, +-- (uo.uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager)) +-- AS was_legacy_manager +-- FROM users_organizations uo +-- WHERE uo.atype = 4 +-- AND (uo.edit_any_collection OR uo.delete_any_collection) +-- AND EXISTS ( +-- SELECT 1 FROM groups_users gu +-- INNER JOIN "groups" g ON g.uuid = gu.groups_uuid +-- WHERE gu.users_organizations_uuid = uo.uuid +-- AND g.organizations_uuid = uo.org_uuid +-- AND g.access_all); +-- +-- Reading the result: +-- +-- * `was_legacy_manager = t` -- a converted Manager. Review it even when +-- `create_new_collections = t`: that independent permission can be changed after an earlier +-- revision materialized group-derived edit/delete, so its current value cannot prove where those +-- two permissions came from. A membership whose own legacy `access_all` supplied all three may +-- therefore be listed conservatively even though its authority was already permanent. +-- * `was_legacy_manager = f` -- never a Manager. On a database first upgraded by revision bf54088c +-- they may carry permissions that revision's 2026-08-09-120000 granted in bulk, which nothing can +-- distinguish from a deliberate grant any more -- check them against what you intended. +-- +-- An invited or revoked membership is listed too, and deliberately so. It holds no authority today -- +-- every guard requires a confirmed membership, and `MembershipStatus::from_i32` rejects the revoked +-- value outright -- but the permission is what it would come back with if it is ever restored, and +-- by then the group it came from may be gone. Status is therefore not part of the predicate. +-- +-- Clear whatever you do not want to keep, for example: +-- +-- UPDATE users_organizations +-- SET edit_any_collection = FALSE, delete_any_collection = FALSE +-- WHERE uuid = ''; +-- +-- Then record the decision once, with every Vaultwarden instance stopped: +-- +-- CREATE TABLE __vw_ack_permanent_collection_authority (acknowledged INTEGER NOT NULL PRIMARY KEY); +-- +-- The acknowledgement is consumed at the end of this file, so one decision covers one upgrade. +-- +-- The legacy-Manager record has to exist already: the chain and supported rollback use it as the +-- immutable role-provenance record. Refuse a damaged history here too; see 2026-07-23-120000 for why +-- this never creates it. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 +WHERE to_regclass('__vw_custom_role_legacy_manager') IS NULL; +DROP TABLE __vw_legacy_manager_record_guard; + +-- The duplicate key aborts the migration. It is only inserted while an unconfirmed membership exists. +CREATE TEMPORARY TABLE __vw_permanent_authority_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_permanent_authority_guard (blocked) VALUES (1); +INSERT INTO __vw_permanent_authority_guard (blocked) +SELECT 1 +FROM users_organizations AS uo +WHERE uo.atype = 4 + AND (uo.edit_any_collection = TRUE OR uo.delete_any_collection = TRUE) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN "groups" AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = uo.uuid + AND g.organizations_uuid = uo.org_uuid + AND g.access_all = TRUE + ) + AND to_regclass('__vw_ack_permanent_collection_authority') IS NULL +LIMIT 1; +DROP TABLE __vw_permanent_authority_guard; + +DROP TABLE IF EXISTS __vw_ack_permanent_collection_authority; diff --git a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql index 9ac54bfb..a8faf67b 100644 --- a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql +++ b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql @@ -1,6 +1,68 @@ --- Convert Custom members back to Manager, the representation older server versions --- expect (they masquerade Manager as Custom in API responses and cannot load type 4). -UPDATE users_organizations SET atype = 3 WHERE atype = 4; +-- Lossy revert: this removes the three Custom management permissions and the Custom role itself, +-- which the legacy role/access_all schema cannot represent. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_allow_custom_role_downgrade' +); +DROP TABLE __vw_custom_role_downgrade_guard; + +-- Convert Custom members back to a role the older server can load -- it cannot represent type 4 and +-- masquerades Manager as Custom in API responses. Which role each one gets is a decision about its +-- authority *now*, and it is not symmetric with the upgrade. +-- +-- Deliberately not driven by `__vw_custom_role_legacy_manager`. That records who held the Manager +-- role before the *first* upgrade and is never updated afterwards, so a member whose Manager powers +-- an owner has since reduced -- or who was demoted to User and later re-created as a limited Custom +-- member -- would be handed the whole legacy role back. Historical provenance is evidence, not +-- authorization. Use a list written for this downgrade instead. +-- +-- Absent, or empty, means "nobody", and everything below becomes a plain User. That is the safe +-- direction: the legacy Manager role is not a subset of what a Custom member holds -- it manages, and +-- deletes, every collection reachable through `users_collections.manage`, +-- `collections_groups.manage` or `groups.access_all`, and reads member and collection ACL details +-- through `ManagerHeadersLoose`, none of which needs a permission flag in the old schema. To keep the +-- historical mapping, copy it over deliberately before reverting: +-- +-- CREATE TABLE __vw_rollback_manager_allowlist (users_organizations_uuid TEXT NOT NULL PRIMARY KEY); +-- INSERT INTO __vw_rollback_manager_allowlist (users_organizations_uuid) +-- SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager; +CREATE TABLE IF NOT EXISTS __vw_rollback_manager_allowlist ( + users_organizations_uuid TEXT NOT NULL PRIMARY KEY +); + +UPDATE users_organizations SET atype = 3 +WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist); + +-- Everything still on the Custom role becomes a plain User, and `access_all` has to be cleared with +-- it. 2026-07-16-120000/down.sql sets that flag for every Custom member holding all three collection +-- permissions, on the assumption they are about to become a Manager; left behind on a User it +-- produces `User + access_all`, the one legacy state the upgrade refuses outright -- which would +-- leave the database unable to move forward again. `users_collections` and `collections_groups` are +-- untouched, so these members keep every per-collection grant and lose only the organization-wide +-- powers the old schema cannot express. +UPDATE users_organizations SET atype = 2, access_all = FALSE WHERE atype = 4; + ALTER TABLE users_organizations DROP COLUMN manage_users; ALTER TABLE users_organizations DROP COLUMN manage_groups; ALTER TABLE users_organizations DROP COLUMN manage_policies; + +-- Oldest lossy step of the chain: nothing below this can lose Custom-role data any more, so the +-- acknowledgement is consumed here. It authorized *this* downgrade, not every future one. The +-- Custom-role bookkeeping goes with it -- the roles it describes are back, and a later re-upgrade +-- rebuilds all of it from the restored `atype = 3` rows. +DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +DROP TABLE IF EXISTS __vw_rollback_manager_allowlist; +DROP TABLE IF EXISTS __vw_custom_role_legacy_manager; +DROP TABLE IF EXISTS __vw_custom_role_history_verified; diff --git a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql index 6ffdca13..7087c25c 100644 --- a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql +++ b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql @@ -1,6 +1,34 @@ ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE; +-- Record which memberships were legacy Managers *before* anything converts them. +-- +-- This is the only moment at which that is knowable. `atype = 3` means Manager here and Custom +-- afterwards -- the conversion below reuses the value -- so once it has run, a genuine legacy +-- Manager and a Custom member created later are byte-identical. Every later step that has to reason +-- about legacy authority (2026-07-23, 2026-08-09 and tools/custom_role_rollback/) reads this table +-- instead of guessing, which is what stops them from handing legacy privileges to modern members. +-- +-- Deliberately not a Diesel model and not in schema.rs: no runtime code reads it. It is +-- migration/rollback bookkeeping, and it carries no foreign key so that 2026-07-24-120000's table +-- rebuild does not have to care about it. +CREATE TABLE IF NOT EXISTS __vw_custom_role_legacy_manager ( + users_organizations_uuid TEXT NOT NULL PRIMARY KEY +); +INSERT OR IGNORE INTO __vw_custom_role_legacy_manager (users_organizations_uuid) +SELECT uuid FROM users_organizations WHERE atype = 3; + +-- Separately, mark that this database's Custom-role history is accounted for -- it was produced by +-- the migrations that ship today. Nothing else creates this table, which is what lets the startup +-- preflight treat its absence as proof that an earlier revision of this chain ran instead. +-- +-- Deliberately not the record table above: that one holds data an operator has to be able to write +-- during recovery, so its existence cannot also stand for "the history behind this data was +-- reviewed" -- creating it empty to silence an error would otherwise pass as the audit it asks for. +CREATE TABLE IF NOT EXISTS __vw_custom_role_history_verified ( + verified INTEGER NOT NULL PRIMARY KEY +); + -- Previously the server stored members created with the Custom role as Manager (3) and -- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted -- type, convert those members so clients (which no longer know the Manager role) keep diff --git a/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql index 6506059d..41ad950e 100644 --- a/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql +++ b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql @@ -1,3 +1,22 @@ +-- Lossy revert: this removes the three independent Custom collection permissions, which the legacy +-- role/access_all schema cannot represent -- it only knows all three together. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_allow_custom_role_downgrade' +); +DROP TABLE __vw_custom_role_downgrade_guard; + -- The previous schema exposes access_all as the three collection permissions together. Avoid -- turning Edit-only memberships into Create/Edit/Delete grants when rolling back. UPDATE users_organizations diff --git a/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql index da66070a..a819bad8 100644 --- a/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql +++ b/migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql @@ -1,22 +1,58 @@ +-- The legacy-Manager record has to exist before anything below runs: 2026-06-30-120000 writes it, +-- and the group-derived step at the end of this file reads it. Checked *before* the ALTER TABLE statements so +-- a refusal leaves no half-added column group behind -- on MySQL/MariaDB every ALTER commits on its +-- own, and a partial group is what the startup preflight then has to recover from. +-- +-- Creating the record here instead would manufacture an empty, apparently valid history for exactly +-- the databases that need an operator to look at them; see 2026-07-23-120000 for the full reasoning. +-- This guard exists for a bare migration runner that never consulted the startup preflight. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_custom_role_legacy_manager' +); +DROP TABLE __vw_legacy_manager_record_guard; + ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE; ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE; -- Before these permissions were persisted independently, access_all represented the legacy -- "Manage all collections" checkbox. Preserve that capability for existing Custom members. +-- +-- Driven by the stored value rather than by the membership's shape, so it needs no provenance: a +-- member carrying access_all held exactly this capability, whenever the row was created. UPDATE users_organizations SET create_new_collections = access_all, edit_any_collection = access_all, delete_any_collection = access_all WHERE atype = 4; --- A legacy Manager also managed every collection when one of their groups had access_all, --- even if the membership itself did not. Preserve that existing edit/delete capability without --- granting collection creation, which historically still required membership access_all. +-- A legacy Manager also managed every collection when one of their groups had access_all, even if +-- the membership itself did not. Preserve that existing edit/delete capability without granting +-- collection creation, which historically still required membership access_all. +-- +-- Restricted to memberships recorded as legacy Managers, exactly like 2026-07-23-120000 and +-- 2026-08-09-120000. Role and group membership alone are *not* evidence of legacy authority: +-- "Custom, member of an access_all group" is also the shape of every modern Custom member who was +-- simply put into an ordinary access_all group, and granting on that shape hands them +-- organization-wide collection edit and delete -- which, through edit_any_collection, also satisfies +-- has_full_access() and therefore reaches every cipher in the organization. +-- +-- On the normal upgrade path this changes nothing: 2026-06-30-120000 runs first and records every +-- `atype = 3` row, which at this point is every Custom member there is. UPDATE users_organizations SET edit_any_collection = TRUE, delete_any_collection = TRUE WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND EXISTS ( SELECT 1 FROM groups_users diff --git a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql index b9d4e9e6..4188886b 100644 --- a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql +++ b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql @@ -1,3 +1,4 @@ --- This is an idempotent data repair. Reverting it must not remove permissions or recreate the --- invalid persisted Manager type; the older-schema migration performs its own safe conversion. +-- This is an idempotent data repair, and it creates no rows: reverting it must not remove permissions +-- or recreate the invalid persisted Manager type. The older-schema migration performs its own safe +-- conversion. SELECT 1; diff --git a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql index 404f9fd9..81c8e1e5 100644 --- a/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql +++ b/migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql @@ -1,48 +1,75 @@ --- A normal User with the historical membership-level access_all bit reached every collection of the --- organization with full read/write, but held no collection-management authority. Mapping that onto --- the Custom role would add authority, clearing the bit would remove existing access — so instead, --- materialize the reach as explicit per-collection assignments while the source bit still exists. --- `manage` stays FALSE, so no management authority is invented. This is the same approach Bitwarden --- took when it retired `accessAll`; the one behavioral difference is that the access is no longer --- dynamic, i.e. collections created later are not added automatically. +-- Repair the legacy role/permission state while membership `access_all` still exists. -- --- Step 1: a pre-existing assignment was overridden by access_all (full read/write regardless of --- read_only/hide_passwords), so relax it to match what the member actually had. -UPDATE users_collections -SET read_only = FALSE, - hide_passwords = FALSE -WHERE EXISTS ( - SELECT 1 - FROM users_organizations AS uo - INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid - WHERE uo.atype = 2 - AND uo.access_all = TRUE - AND uo.user_uuid = users_collections.user_uuid - AND c.uuid = users_collections.collection_uuid +-- A plain User carrying the historical membership-level `access_all` bit is deliberately not +-- converted: that state grants dynamic reach over every collection *without* management authority, +-- and the new model has no equivalent. It is refused instead -- and refused *here*, not only in Rust: +-- Vaultwarden's startup preflight already stops such a database before any migration runs and prints +-- the two explicit choices (`RefuseLegacyUserAccessAll` in `src/db/mod.rs`), but a migration run +-- outside that wrapper -- `diesel migration run`, a bare `MigrationHarness`, any other SQL runner +-- -- would not consult it, and 2026-07-24-120000 removes the only source of that reach a few +-- statements later. Repeating the check before this file's first mutation is what makes the silent +-- loss impossible rather than unlikely. +-- +-- The duplicate key aborts the migration. It is only inserted when such a membership exists. +CREATE TEMPORARY TABLE __vw_legacy_user_access_all_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_user_access_all_guard (blocked) +SELECT 1 +FROM users_organizations +WHERE atype = 2 + AND access_all = TRUE +LIMIT 1; +DROP TABLE __vw_legacy_user_access_all_guard; + +-- The legacy-Manager record has to exist already: 2026-06-30-120000 writes it, and the startup +-- preflight refuses a database whose ledger carries that version without it. Creating it here would +-- manufacture an empty, apparently valid history for precisely the databases that need an operator +-- to look at them, so refuse instead -- this guard exists for a bare migration runner that never +-- consulted the preflight. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_custom_role_legacy_manager' ); +DROP TABLE __vw_legacy_manager_record_guard; --- Step 2: add the assignments that did not exist yet. Existing rows are left to step 1. -INSERT OR IGNORE INTO users_collections (user_uuid, collection_uuid, read_only, hide_passwords, manage) -SELECT uo.user_uuid, c.uuid, FALSE, FALSE, FALSE -FROM users_organizations AS uo -INNER JOIN collections AS c ON c.org_uuid = uo.org_uuid -WHERE uo.atype = 2 - AND uo.access_all = TRUE; +-- A database that reaches this file with memberships still at `atype = 3` never ran the rewritten +-- 2026-06-30-120000 -- for instance because a runner applied the files out of order. Those rows are +-- unambiguously legacy Managers *right now*, so record them before the conversion at the end of this +-- file makes them indistinguishable from modern Custom members. Idempotent, and a no-op on the +-- normal path where 2026-06-30-120000 already recorded them. +INSERT OR IGNORE INTO __vw_custom_role_legacy_manager (users_organizations_uuid) +SELECT uuid FROM users_organizations WHERE atype = 3; --- The current 2026-07-16 migration copied a legacy full-access group's dynamic authority to the --- exact direct 0/1/1 pattern. While the same organization-local source group is still present, --- remove that deterministic copy so later group removal also revokes the authority. The runtime --- keeps deriving edit/delete from that group -- see --- `Membership::has_legacy_group_collection_manage_access` -- so nothing is lost here. +-- Step 1: a legacy Manager who managed every collection through an organization-local group with +-- `access_all` keeps that authority, materialized into the permission columns it now lives in. +-- +-- Restricted to memberships recorded as legacy Managers. Matching on role and group membership +-- alone -- which an earlier revision did -- also matches every *modern* flagless Custom member who +-- happens to sit in an ordinary `access_all` group, because the two states are the same shape, and +-- would hand them organization-wide collection edit and delete. +-- +-- Earlier revisions derived this authority live from the group at request time instead, which was +-- unsound for exactly that reason. Materializing it makes it visible to an owner in the member's +-- permission list and revocable by clearing a checkbox. It is deliberately a one-time snapshot: the +-- permission no longer lapses when the source group does. See tools/custom_role_rollback/README.md. +-- +-- Deliberately not `create_new_collections`: creating collections historically required +-- membership-level `access_all`, and it is an independent permission now. UPDATE users_organizations -SET edit_any_collection = FALSE, - delete_any_collection = FALSE +SET edit_any_collection = TRUE, + delete_any_collection = TRUE WHERE atype IN (3, 4) - AND access_all = FALSE - AND create_new_collections = FALSE - AND edit_any_collection = TRUE - AND delete_any_collection = TRUE - AND EXISTS (SELECT 1 FROM __vw_custom_role_same_run_0716 WHERE marker = 1) + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND EXISTS ( SELECT 1 FROM groups_users AS gu @@ -52,34 +79,20 @@ WHERE atype IN (3, 4) AND g.access_all = TRUE ); --- A remaining 0/1/1 pattern may be either an intentional direct grant or an older derived grant --- whose source group has already been removed. Do not guess which one it is. -CREATE TEMPORARY TABLE __vw_legacy_group_access_guard ( - blocked INTEGER NOT NULL PRIMARY KEY -); -INSERT INTO __vw_legacy_group_access_guard (blocked) VALUES (1); -INSERT INTO __vw_legacy_group_access_guard (blocked) -SELECT 1 -FROM users_organizations -WHERE atype IN (3, 4) - AND access_all = FALSE - AND create_new_collections = FALSE - AND edit_any_collection = TRUE - AND delete_any_collection = TRUE -LIMIT 1; -DROP TABLE __vw_legacy_group_access_guard; - --- Membership access_all on a legacy Manager/Custom represented all three collection capabilities. --- Set only TRUE values so this repair never removes independently configured permissions. +-- Step 2: membership `access_all` on a legacy Manager represented all three collection capabilities. +-- Set only TRUE values so this repair never removes independently configured permissions, and again +-- only for recorded legacy Managers -- an intermediate revision of this feature branch could leave a +-- modern Custom member carrying the old column as well. UPDATE users_organizations SET create_new_collections = TRUE, edit_any_collection = TRUE, delete_any_collection = TRUE WHERE atype IN (3, 4) + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) AND access_all = TRUE; -- Convert only after the legacy bit has been copied. UPDATE users_organizations SET atype = 4 WHERE atype = 3; --- Clear the same-run marker only after every guard and permission update succeeds. +-- Clear the same-run marker only after every permission update succeeds. DELETE FROM __vw_custom_role_same_run_0716 WHERE marker = 1; diff --git a/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql b/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql index f276ea5b..31101986 100644 --- a/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql +++ b/migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql @@ -1,3 +1,22 @@ +-- Lossy revert: this removes the three Custom access permissions, which the legacy schema cannot +-- represent at all. The revert therefore +-- requires the same acknowledgement as 2026-07-24-140000/down.sql -- which only announces the loss, +-- it does not authorize it. Create the marker table while every Vaultwarden instance is stopped: +-- +-- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_custom_role_downgrade_guard (blocked) VALUES (1); +-- The duplicate key aborts the revert. It is only inserted while the acknowledgement is absent. +INSERT INTO __vw_custom_role_downgrade_guard (blocked) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_allow_custom_role_downgrade' +); +DROP TABLE __vw_custom_role_downgrade_guard; + ALTER TABLE users_organizations DROP COLUMN access_event_logs; ALTER TABLE users_organizations DROP COLUMN access_import_export; ALTER TABLE users_organizations DROP COLUMN access_reports; diff --git a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql index b6fb06ac..4e8f080f 100644 --- a/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql +++ b/migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql @@ -1,12 +1,13 @@ --- Nine independent Custom-role permissions cannot be represented losslessly by the legacy --- role/access_all schema, so a revert is blocked here -- before any older down migration removes --- permission data. --- --- It is an explicit, acknowledged decision though, not a dead end. Create the marker table below --- while every Vaultwarden instance is stopped and this guard lets the revert through: +-- Downgrade guard. Reverting this migration destroys Custom-role permission data that the legacy +-- role/access_all schema cannot represent, so it only runs with an explicit acknowledgement. Create +-- the marker table below while every Vaultwarden instance is stopped: -- -- CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); -- +-- The acknowledgement stays valid for the rest of the revert chain and is consumed by the oldest +-- lossy migration (2026-06-30-120000), so one decision covers one downgrade -- and a re-upgrade +-- clears it again (2026-07-24-140000/up.sql), so consent is never inherited. +-- -- Operators who only need the old server version to start again do not need Diesel at all -- -- tools/custom_role_rollback/ has a self-contained script per backend. CREATE TEMPORARY TABLE __vw_custom_role_downgrade_guard ( @@ -18,10 +19,11 @@ INSERT INTO __vw_custom_role_downgrade_guard (blocked) SELECT 1 WHERE NOT EXISTS ( SELECT 1 FROM sqlite_master - WHERE type = 'table' AND name = '__vw_allow_custom_role_downgrade' -); + WHERE type = 'table' AND name = '__vw_allow_custom_role_downgrade'); DROP TABLE __vw_custom_role_downgrade_guard; --- Consume the acknowledgement: it authorized *this* revert, not every future one. After a --- re-upgrade the next revert has to be acknowledged again. -DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +-- Nothing else to undo: the acknowledgement deliberately survives this step. It has to still be here +-- when the next revert removes the first permission column, which is what this guard exists to +-- announce -- checking and dropping it in the same step would leave every following lossy revert +-- unguarded. +SELECT 1; diff --git a/migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql b/migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql new file mode 100644 index 00000000..613cc7e7 --- /dev/null +++ b/migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql @@ -0,0 +1,4 @@ +-- Nothing to undo: this migration only re-applies permissions that 2026-07-23-120000 also sets, and +-- the original values are not recoverable. The permission columns themselves are removed further down +-- the chain by 2026-07-16-120000/down.sql, which is guarded. +SELECT 1; \ No newline at end of file diff --git a/migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql b/migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql new file mode 100644 index 00000000..43c39b16 --- /dev/null +++ b/migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql @@ -0,0 +1,107 @@ +-- Follow-up repair for databases that already recorded 2026-07-23-120000. +-- +-- That migration originally *removed* the direct 0/1/1 collection permissions of a legacy Manager +-- whose authority came from an organization-local `access_all` group, because the runtime derived the +-- authority from the group instead. Deriving it turned out to be unsound -- "Custom, none of the three +-- collection permissions, member of such a group" is also the shape of every newly created flagless +-- Custom member -- so the runtime fallback is gone and 2026-07-23-120000 now materializes the +-- authority into the permission columns. +-- +-- Rewriting that file is not enough on its own: a database whose ledger already carries +-- 20260723120000 never runs it again, and would silently lose the capability. Repeat the +-- materialization here, in its own version, so both paths converge on the same state. +-- +-- Unlike an earlier revision of this file, the repair is driven by the legacy-Manager record written +-- by 2026-06-30-120000 rather than by role and group membership alone. Those two are the same shape, +-- so matching on them blanket-granted organization-wide collection edit and delete to modern Custom +-- members -- turning Create-only into Create+Edit+Delete, Edit-only into Edit+Delete, and a flagless +-- Custom into Edit+Delete, the last of which also implies `has_full_access()`. +-- +-- What this materialization *means* -- a group-bound capability becoming a permanent membership +-- permission -- is confirmed by an owner in 2026-08-10-120000, which runs immediately after it. +-- +-- Idempotent: on a database that ran the rewritten 2026-07-23-120000 every affected row already +-- holds these values. It only reads `groups` / `groups_users` and the record table and writes the two +-- permission columns, so it is also safe after `access_all` has been dropped. +-- +-- Deliberately not `create_new_collections`: collection creation historically required +-- membership-level `access_all`. + +-- The legacy-Manager record has to exist already; see 2026-07-23-120000 for why this refuses rather +-- than creating it. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_custom_role_legacy_manager' +); +DROP TABLE __vw_legacy_manager_record_guard; + +-- Fail closed on a database whose legacy provenance was never recorded. +-- +-- If a Custom member sits in an organization-local `access_all` group but is not on record as a +-- legacy Manager, one of two things is true and this file cannot tell them apart: either the +-- membership really is a converted legacy Manager whose record was never written (a ledger from an +-- earlier revision of this feature branch), or it is an ordinary modern Custom member who must not +-- gain anything. Granting is a silent privilege escalation; skipping silently drops a real +-- capability. +-- +-- `__vw_custom_role_history_verified` settles it: 2026-06-30-120000 creates it, and an operator +-- creates it after auditing an older history, so its presence means the unrecorded memberships below +-- are unrecorded *on purpose*. Its absence means nobody has looked, and this stops. The startup +-- preflight refuses that state before any migration runs; this guard is the backstop for a bare +-- migration runner. `src/db/mod.rs` prints the full recovery, which lists these memberships: +-- +-- SELECT uo.uuid, uo.org_uuid, uo.status, +-- uo.create_new_collections, uo.edit_any_collection, uo.delete_any_collection +-- FROM users_organizations uo +-- INNER JOIN groups_users gu ON gu.users_organizations_uuid = uo.uuid +-- INNER JOIN "groups" g ON g.uuid = gu.groups_uuid AND g.organizations_uuid = uo.org_uuid +-- WHERE uo.atype = 4 AND g.access_all = 1 +-- AND uo.uuid NOT IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager); +-- +-- The marker never grants anything by itself: the update below is always driven by the record table, +-- so an unrecorded membership keeps exactly the permissions it has. +CREATE TEMPORARY TABLE __vw_legacy_group_authority_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_group_authority_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_group_authority_guard (blocked) +SELECT 1 +FROM users_organizations AS uo +WHERE uo.atype = 4 + AND uo.uuid NOT IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN "groups" AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = uo.uuid + AND g.organizations_uuid = uo.org_uuid + AND g.access_all = TRUE + ) + AND NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_custom_role_history_verified' + ) +LIMIT 1; +DROP TABLE __vw_legacy_group_authority_guard; + +UPDATE users_organizations +SET edit_any_collection = TRUE, + delete_any_collection = TRUE +WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN "groups" AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = users_organizations.uuid + AND g.organizations_uuid = users_organizations.org_uuid + AND g.access_all = TRUE + ); diff --git a/migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/down.sql b/migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/down.sql new file mode 100644 index 00000000..6fcda697 --- /dev/null +++ b/migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/down.sql @@ -0,0 +1,4 @@ +-- Nothing to undo: this migration only asks for a decision, it never writes permissions. The +-- acknowledgement it consumes is deliberately not recreated -- a revert is not consent, and the next +-- upgrade has to ask again. +SELECT 1; diff --git a/migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/up.sql b/migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/up.sql new file mode 100644 index 00000000..8c1a579b --- /dev/null +++ b/migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/up.sql @@ -0,0 +1,117 @@ +-- Make the one semantic change this feature cannot express an owner's decision instead of a default. +-- +-- Before the Custom role, a Manager who reached every collection through an organization-local group +-- with `access_all` held that authority *while* the group relationship lasted. It ended when the +-- group was deleted, when its `accessAll` was switched off, when the member left it, and it was inert +-- whenever `ORG_GROUPS_ENABLED` was false. Nothing in the new model expresses a permission bound to a +-- group like that: `edit_any_collection` and `delete_any_collection` live on the membership. +-- +-- So the earlier migrations in this chain write the authority onto the membership, and the result is +-- deliberately not identical to what it replaces: +-- +-- * it no longer lapses when the last qualifying group disappears, or when `accessAll` is cleared; +-- * it applies even with the groups feature switched off; +-- * `edit_any_collection` additionally satisfies `has_full_access()`, so the member reaches every +-- collection of the organization directly rather than through the group. +-- +-- Materializing it silently would be a migration that grants durable organization-wide collection +-- edit and delete on its own authority. Dropping it silently would take a capability away. Neither is +-- ours to choose, so this migration stops and hands the decision to an owner. It grants nothing and +-- revokes nothing itself. +-- +-- On a database with no Custom membership that both has edit/delete authority and belongs to an +-- organization-local `access_all` group, there is nothing to decide and this is a no-op. +-- +-- Vaultwarden's startup preflight looks ahead for exactly the condition below and refuses with the +-- full text (`RefuseUnconfirmedPermanentCollectionAuthority` in `src/db/mod.rs`), from the legacy +-- schema as well, so an operator normally never reaches the abort here. Diesel reports only the +-- driver error, so on this path the question would arrive as `UNIQUE constraint failed: +-- __vw_permanent_authority_guard.blocked` and nothing else. Keep the two predicates identical. +-- +-- Review the affected memberships: +-- +-- SELECT uo.uuid, uo.user_uuid, uo.org_uuid, uo.status, +-- uo.create_new_collections, uo.edit_any_collection, uo.delete_any_collection, +-- (uo.uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager)) +-- AS was_legacy_manager +-- FROM users_organizations uo +-- WHERE uo.atype = 4 +-- AND (uo.edit_any_collection = 1 OR uo.delete_any_collection = 1) +-- AND EXISTS ( +-- SELECT 1 FROM groups_users gu +-- INNER JOIN "groups" g ON g.uuid = gu.groups_uuid +-- WHERE gu.users_organizations_uuid = uo.uuid +-- AND g.organizations_uuid = uo.org_uuid +-- AND g.access_all = 1); +-- +-- Reading the result: +-- +-- * `was_legacy_manager = 1` -- a converted Manager. Review it even when +-- `create_new_collections = 1`: that independent permission can be changed after an earlier +-- revision materialized group-derived edit/delete, so its current value cannot prove where those +-- two permissions came from. A membership whose own legacy `access_all` supplied all three may +-- therefore be listed conservatively even though its authority was already permanent. +-- * `was_legacy_manager = 0` -- never a Manager. On a database first upgraded by revision bf54088c +-- they may carry permissions that revision's 2026-08-09-120000 granted in bulk, which nothing can +-- distinguish from a deliberate grant any more -- check them against what you intended. +-- +-- An invited or revoked membership is listed too, and deliberately so. It holds no authority today -- +-- every guard requires a confirmed membership, and `MembershipStatus::from_i32` rejects the revoked +-- value outright -- but the permission is what it would come back with if it is ever restored, and +-- by then the group it came from may be gone. Status is therefore not part of the predicate. +-- +-- Clear whatever you do not want to keep, for example: +-- +-- UPDATE users_organizations +-- SET edit_any_collection = 0, delete_any_collection = 0 +-- WHERE uuid = ''; +-- +-- Then record the decision once, with every Vaultwarden instance stopped: +-- +-- CREATE TABLE __vw_ack_permanent_collection_authority (acknowledged INTEGER NOT NULL PRIMARY KEY); +-- +-- The acknowledgement is consumed at the end of this file, so one decision covers one upgrade. +-- +-- The legacy-Manager record has to exist already: the chain and supported rollback use it as the +-- immutable role-provenance record. Refuse a damaged history here too; see 2026-07-23-120000 for why +-- this never creates it. +-- +-- The duplicate key aborts the migration. It is only inserted while the record table is absent. +CREATE TEMPORARY TABLE __vw_legacy_manager_record_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_legacy_manager_record_guard (blocked) VALUES (1); +INSERT INTO __vw_legacy_manager_record_guard (blocked) +SELECT 1 +WHERE NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_custom_role_legacy_manager' +); +DROP TABLE __vw_legacy_manager_record_guard; + +-- The duplicate key aborts the migration. It is only inserted while an unconfirmed membership exists. +CREATE TEMPORARY TABLE __vw_permanent_authority_guard ( + blocked INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_permanent_authority_guard (blocked) VALUES (1); +INSERT INTO __vw_permanent_authority_guard (blocked) +SELECT 1 +FROM users_organizations AS uo +WHERE uo.atype = 4 + AND (uo.edit_any_collection = TRUE OR uo.delete_any_collection = TRUE) + AND EXISTS ( + SELECT 1 + FROM groups_users AS gu + INNER JOIN "groups" AS g ON g.uuid = gu.groups_uuid + WHERE gu.users_organizations_uuid = uo.uuid + AND g.organizations_uuid = uo.org_uuid + AND g.access_all = TRUE + ) + AND NOT EXISTS ( + SELECT 1 FROM sqlite_master + WHERE type = 'table' AND name = '__vw_ack_permanent_collection_authority' + ) +LIMIT 1; +DROP TABLE __vw_permanent_authority_guard; + +DROP TABLE IF EXISTS __vw_ack_permanent_collection_authority; diff --git a/src/api/core/ciphers.rs b/src/api/core/ciphers.rs index 2b51fd0c..785dea1b 100644 --- a/src/api/core/ciphers.rs +++ b/src/api/core/ciphers.rs @@ -392,6 +392,16 @@ async fn enforce_personal_ownership_policy(data: Option<&CipherData>, headers: & Ok(()) } +fn has_prevalidated_organization_write_authority( + allow_direct_organization_write: bool, + shared_to_collections: Option<&Vec>, + member_has_full_access: bool, +) -> bool { + allow_direct_organization_write + || shared_to_collections.is_some_and(|collections| !collections.is_empty()) + || member_has_full_access +} + pub async fn update_cipher_from_data( cipher: &mut Cipher, data: CipherData, @@ -400,6 +410,23 @@ pub async fn update_cipher_from_data( conn: &DbConn, nt: &Notify<'_>, ut: UpdateType, +) -> EmptyResult { + update_cipher_from_data_with_authority(cipher, data, headers, shared_to_collections, false, conn, nt, ut).await +} + +#[expect( + clippy::too_many_arguments, + reason = "The extra flag is a prevalidated route authority and must remain separate from client data" +)] +pub(super) async fn update_cipher_from_data_with_authority( + cipher: &mut Cipher, + data: CipherData, + headers: &Headers, + shared_to_collections: Option>, + allow_direct_organization_write: bool, + conn: &DbConn, + nt: &Notify<'_>, + ut: UpdateType, ) -> EmptyResult { // Cleanup cipher data, like removing the 'Response' key. // This key is somewhere generated during Javascript so no way for us this fix this. @@ -452,9 +479,11 @@ pub async fn update_cipher_from_data( Some(member) => { // A non-empty list of collections implies the caller already validated the user's write // access to them, so we can move the cipher into the organization on that basis. - if shared_to_collections.as_ref().is_some_and(|cols| !cols.is_empty()) - || member.has_full_access() - || cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await + if has_prevalidated_organization_write_authority( + allow_direct_organization_write, + shared_to_collections.as_ref(), + member.has_full_access(), + ) || cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await { cipher.organization_uuid = Some(org_id); // After some discussion in PR #1329 re-added the user_uuid = None again. @@ -577,6 +606,25 @@ pub async fn update_cipher_from_data( Ok(()) } +#[cfg(test)] +mod update_authority_tests { + use super::has_prevalidated_organization_write_authority; + + #[test] + fn direct_organization_write_is_an_explicit_import_authority() { + // Keep the organization-import shortcut independent from the old non-empty-collection + // sentinel. The route may import ciphers without collections when AccessImportExport grants + // organization-wide import authority; every other caller passes false. + let no_collections: Vec = Vec::new(); + assert!(has_prevalidated_organization_write_authority(true, Some(&no_collections), false)); + assert!(!has_prevalidated_organization_write_authority(false, Some(&no_collections), false)); + + let collections = vec!["collection".to_owned().into()]; + assert!(has_prevalidated_organization_write_authority(false, Some(&collections), false)); + assert!(has_prevalidated_organization_write_authority(false, None, true)); + } +} + #[derive(Deserialize)] #[serde(rename_all = "camelCase")] struct ImportData { diff --git a/src/api/core/events.rs b/src/api/core/events.rs index 6aa6b954..3d8d4808 100644 --- a/src/api/core/events.rs +++ b/src/api/core/events.rs @@ -94,10 +94,10 @@ enum CipherEventScope { } impl CipherEventScope { - fn includes(&self, event: &Event) -> bool { + fn organization_id(&self) -> Option<&OrganizationId> { match self { - Self::Organization(org_id) => event.org_uuid.as_ref() == Some(org_id), - Self::Personal => event.org_uuid.is_none(), + Self::Organization(org_id) => Some(org_id), + Self::Personal => None, } } } @@ -142,10 +142,9 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade }; if let Some(scope) = scope { - Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn) + Event::find_by_cipher_uuid(&cipher_id, scope.organization_id(), &start_date, &end_date, &conn) .await .iter() - .filter(|event| scope.includes(event)) .map(Event::to_json) .collect() } else { @@ -549,15 +548,11 @@ mod tests { } #[test] - fn cipher_event_rows_must_match_the_authorized_scope() { + fn cipher_event_scope_selects_the_database_scope_filter() { let org_id: OrganizationId = "test-org".to_owned().into(); - let mut event = Event::new(EventType::CipherClientViewed as i32, None); - assert!(CipherEventScope::Personal.includes(&event)); - event.org_uuid = Some(org_id.clone()); - assert!(!CipherEventScope::Personal.includes(&event)); - assert!(CipherEventScope::Organization(org_id).includes(&event)); - assert!(!CipherEventScope::Organization("other-org".to_owned().into()).includes(&event)); + assert_eq!(CipherEventScope::Personal.organization_id(), None); + assert_eq!(CipherEventScope::Organization(org_id.clone()).organization_id(), Some(&org_id)); } #[test] diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index fa4e7a4b..d4c6fa06 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -14,7 +14,7 @@ use crate::{ auth::{ AccessImportExportHeaders, AdminHeaders, CollectionDeleteHeaders, CollectionReadHeaders, Headers, ManageGroupsHeaders, ManagePoliciesHeaders, ManageUsersHeaders, ManageUsersOrGroupsHeaders, ManagerHeaders, - ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite, + ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, can_read_collection_access, decode_invite, }, db::{ DbConn, @@ -397,19 +397,25 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos // Custom users with a user/group manage permission need to read the collection list // (metadata only) to be able to assign collections to groups/members. This does NOT // expose cipher contents. manage_policies does not need the collection list. - let can_read_collection_list = headers.membership.has_full_access() - || headers.membership.has_manage_users() - || headers.membership.has_manage_groups() - || headers.membership.has_delete_any_collection() - // Create new collections needs the list too: the client resolves the parent of a nested - // collection against it and refreshes it after a create. - || headers.membership.has_create_new_collections(); - if !can_read_collection_list { + let can_read_collection_list = may_read_complete_collection_list(&headers.membership); + let all_collections = Collection::find_by_organization(&org_id, &conn).await; + let collections = if can_read_collection_list { + all_collections + } else { + let mut explicitly_managed = Vec::new(); + for collection in all_collections { + if headers.membership.has_explicit_collection_manage_access(&collection.uuid, &conn).await { + explicitly_managed.push(collection); + } + } + explicitly_managed + }; + if !can_read_collection_list && collections.is_empty() { err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code); } Ok(Json(json!({ - "data": get_org_collections_impl(&org_id, &conn).await, + "data": collections.iter().map(Collection::to_json).collect::(), "object": "list", "continuationToken": null, }))) @@ -444,11 +450,6 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea || member.has_manage_groups() || member.has_delete_any_collection() || member.has_create_new_collections(); - // Delete any collection can reveal collection access metadata, matching Bitwarden's - // ReadAllWithAccess behavior, but still does not grant cipher access. Manage Users/Groups - // retain the narrower metadata-only view introduced by the base PR. - let can_read_all_collection_access = member.has_edit_any_collection() || member.has_delete_any_collection(); - // Get all admins, owners and managers who can manage/access all // Those are currently not listed in the col_users but need to be listed too. let manage_all_members: Vec = Membership::find_confirmed_and_manage_all_by_org(&org_id, &conn) @@ -472,53 +473,58 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea || (CONFIG.org_groups_enabled() && GroupUser::has_access_to_collection_by_member(&col.uuid, &member.uuid, &conn).await); - // If the user is a manager and is not assigned to this collection, normally skip it. - // Exception: custom users with a manage permission get a metadata-only entry (no user - // or group access details) so the web client can resolve assignment references without - // crashing. This never exposes cipher contents. - if !assigned && !can_read_all_collection_access { - if can_read_collection_list { + // ACL mappings require the same authority as the single-collection details endpoint. + // Mere read access (`assigned`, including group `access_all`) is not Manage authority. + match collection_details_response_scope( + can_read_collection_access(&member, &col.uuid, &conn).await, + assigned, + can_read_collection_list, + ) { + CollectionDetailsResponseScope::MetadataOnly => { let mut json_object = col.to_json_details(&headers.user.uuid, None, &conn).await; - json_object["assigned"] = json!(false); + json_object["assigned"] = json!(assigned); json_object["users"] = json!(Vec::::new()); json_object["groups"] = json!(Vec::::new()); json_object["object"] = json!("collectionAccessDetails"); json_object["unmanaged"] = json!(false); data.push(json_object); } - continue; - } - - // get the users assigned directly to the given collection - let mut users: Vec = col_users - .iter() - .filter(|collection_member| collection_member.collection_uuid == col.uuid) - .map(|collection_member| { - collection_member.to_json_details_for_member( - *membership_type.get(&collection_member.membership_uuid).unwrap_or(&(MembershipType::User as i32)), - ) - }) - .collect(); - users.extend_from_slice(&manage_all_members); - - // get the group details for the given collection - let groups: Vec = if CONFIG.org_groups_enabled() { - CollectionGroup::find_by_collection(&col.uuid, &conn) - .await - .iter() - .map(CollectionGroup::to_json_details_for_group) - .collect() - } else { - Vec::new() - }; + CollectionDetailsResponseScope::Hidden => {} + CollectionDetailsResponseScope::AccessDetails => { + // get the users assigned directly to the given collection + let mut users: Vec = col_users + .iter() + .filter(|collection_member| collection_member.collection_uuid == col.uuid) + .map(|collection_member| { + collection_member.to_json_details_for_member( + *membership_type + .get(&collection_member.membership_uuid) + .unwrap_or(&(MembershipType::User as i32)), + ) + }) + .collect(); + users.extend_from_slice(&manage_all_members); + + // get the group details for the given collection + let groups: Vec = if CONFIG.org_groups_enabled() { + CollectionGroup::find_by_collection(&col.uuid, &conn) + .await + .iter() + .map(CollectionGroup::to_json_details_for_group) + .collect() + } else { + Vec::new() + }; - let mut json_object = col.to_json_details(&headers.user.uuid, None, &conn).await; - json_object["assigned"] = json!(assigned); - json_object["users"] = json!(users); - json_object["groups"] = json!(groups); - json_object["object"] = json!("collectionAccessDetails"); - json_object["unmanaged"] = json!(false); - data.push(json_object); + let mut json_object = col.to_json_details(&headers.user.uuid, None, &conn).await; + json_object["assigned"] = json!(assigned); + json_object["users"] = json!(users); + json_object["groups"] = json!(groups); + json_object["object"] = json!("collectionAccessDetails"); + json_object["unmanaged"] = json!(false); + data.push(json_object); + } + } } Ok(Json(json!({ @@ -528,8 +534,35 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea }))) } -async fn get_org_collections_impl(org_id: &OrganizationId, conn: &DbConn) -> Value { - Collection::find_by_organization(org_id, conn).await.iter().map(Collection::to_json).collect::() +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +enum CollectionDetailsResponseScope { + AccessDetails, + MetadataOnly, + Hidden, +} + +fn may_read_complete_collection_list(member: &Membership) -> bool { + member.has_full_access() + || member.has_manage_users() + || member.has_manage_groups() + || member.has_delete_any_collection() + // Create new collections needs the list too: the client resolves the parent of a nested + // collection against it and refreshes it after a create. + || member.has_create_new_collections() +} + +fn collection_details_response_scope( + can_read_access_details: bool, + has_collection_read_access: bool, + can_read_collection_list: bool, +) -> CollectionDetailsResponseScope { + if can_read_access_details { + CollectionDetailsResponseScope::AccessDetails + } else if has_collection_read_access || can_read_collection_list { + CollectionDetailsResponseScope::MetadataOnly + } else { + CollectionDetailsResponseScope::Hidden + } } #[post("/organizations//collections", data = "")] @@ -569,15 +602,14 @@ async fn post_organization_collections( let collection = Collection::new(org_id.clone(), data.name, data.external_id); collection.save(&conn).await?; - // Security (F-3): a `manage` grant carries collection *delete*/administer authority - // (`has_explicit_collection_manage_access` -> CollectionDeleteHeaders/ManagerHeaders), so only a - // caller who could delete this collection may confer it — the same rule the collection-update and - // bulk-access endpoints apply. Create is deliberately independent from Edit/Delete, so a Custom - // member holding only `create_new_collections` must not be able to hand a manage row to another - // member or to a group while creating the collection. For such callers the requested `manage` - // is forced to false; Admin/Owner and Custom-with-`delete_any_collection` keep it. The creator's - // own object-scoped ownership is added separately below. Evaluated after the collection exists - // so the per-collection lookup sees it. + // Security (F-3): a `manage` grant carries collection administration authority + // (`has_explicit_collection_manage_access` -> ManagerHeaders), so only a caller who may already + // administer this collection may confer it — the same rule the collection-update and bulk-access + // endpoints apply. Create is deliberately independent from Edit/Delete, so a Custom member + // holding only `create_new_collections` must not be able to hand a manage row to another member + // or to a group while creating the collection. For such callers the requested `manage` is forced + // to false. The creator's own object-scoped ownership is added separately below. Evaluated after + // the collection exists so the per-collection lookup sees it. let may_grant_manage = caller_may_grant_collection_manage(&headers.membership, &collection.uuid, &conn).await; let creator_needs_assignment = !headers.membership.has_full_access(); @@ -1088,32 +1120,17 @@ async fn assigned_org_ciphers_json( // report (Exposed/Reused/Weak Passwords, Unsecured Websites, Inactive 2FA, ...) locally — Vaultwarden // has no server-side reports. // -// Two different answers, depending on how much the caller may actually read: -// -// * Members who already reach every collection (Admin/Owner, or Custom + `editAnyCollection`) get -// the whole organization, serialized with `CipherSyncType::Organization` which deliberately skips -// the per-cipher access restrictions. This is unchanged behavior. -// -// * `accessReports` opens the endpoint *without* widening what may be read: the response is built -// from the caller's own assignments with `CipherSyncType::User`, so `readOnly`/`hidePasswords` -// still apply and collections the member is not assigned to never appear. Their reports therefore -// cover exactly their own collections. -// -// This mirrors `accessImportExport`/`get_org_export`: a permission decides *whether* a member may use -// a feature, never *what* they may read. Bitwarden upstream is more permissive here (its -// `CanAccessAllCiphersAsync` grants the full organization to AccessReports as well); we deliberately -// deviate so that ticking "Access reports" cannot hand out read access to every password in the -// organization. +// Bitwarden computes organization reports locally from this list. `accessReports` therefore grants +// the full organization cipher list, just like Admin/Owner or `editAnyCollection`; limiting it to the +// caller's assignments makes organization-wide reports silently incomplete. #[get("/ciphers/organization-details?")] async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult { if data.organization_id != headers.membership.org_uuid { err_code!("Resource not found.", "Organization id's do not match", rocket::http::Status::NotFound.code); } - let ciphers_json = if headers.membership.has_full_access() { + let ciphers_json = if may_read_all_organization_ciphers(&headers.membership) { get_org_details_impl(&data.organization_id, &headers.host, &headers.user.uuid, &conn).await? - } else if headers.membership.has_access_reports() { - assigned_org_ciphers_json(&data.organization_id, &headers.host, &headers.user.uuid, &conn).await? } else { err_code!( "Resource not found.", @@ -1320,15 +1337,26 @@ impl CustomRolePermissions { } fn differs_from(self, membership: &Membership) -> bool { - self.manage_users != membership.manage_users - || self.manage_groups != membership.manage_groups - || self.manage_policies != membership.manage_policies - || self.create_new_collections != membership.create_new_collections - || self.edit_any_collection != membership.edit_any_collection - || self.delete_any_collection != membership.delete_any_collection - || self.access_event_logs != membership.access_event_logs - || self.access_import_export != membership.access_import_export - || self.access_reports != membership.access_reports + let stored = if membership.atype == MembershipType::Custom as i32 { + Self { + manage_users: membership.manage_users, + manage_groups: membership.manage_groups, + manage_policies: membership.manage_policies, + create_new_collections: membership.create_new_collections, + edit_any_collection: membership.edit_any_collection, + delete_any_collection: membership.delete_any_collection, + access_event_logs: membership.access_event_logs, + access_import_export: membership.access_import_export, + access_reports: membership.access_reports, + } + } else { + // Permission bits outside the Custom role are stale, inert data. Clearing them while an + // ordinary member is edited is not an authority change and must not make a + // ManageUsers-only caller fail the "may not change custom permissions" check. + Self::default() + }; + + self != stored } fn apply_to(self, membership: &mut Membership) { @@ -1428,9 +1456,14 @@ async fn send_invite( } } - let mut user_created: bool = false; for email in &data.emails { let mut member_status = MembershipStatus::Invited as i32; + // Scoped to this iteration on purpose. A single flag hoisted out of the loop stays `true` + // for every later recipient once any account has been created, so a failing invite mail to + // an address that already had an account would delete that *existing* global user -- their + // personal ciphers, devices, 2FA, emergency access and memberships in unrelated + // organizations -- instead of only the membership this request just made. + let mut user_created: bool = false; let user = match User::find_by_mail(email, &conn).await { None => { if !CONFIG.invitations_allowed() { @@ -1958,6 +1991,16 @@ async fn edit_member( // confirm, revoke, restore, delete). Without it `edit_member` was the only path on which a // Custom member holding manage_users could aim at an Admin or at a fellow Custom membership, as // long as the request left the role unchanged. + // + // NOTE: this is a deliberate, documented narrowing of upstream. Bitwarden lets Custom+ManageUsers + // administer *peer Custom* members too, and delegate a subset of the permissions the actor holds + // itself (`OrganizationUserValidationService`). Implementing that would put permission delegation + // -- the one operation that can raise another member's authority -- into the hands of a + // non-Admin, and correctness would then rest on a subset comparison being right on every path. + // Vaultwarden keeps role and permission changes with Admins/Owners instead: strictly less + // authority than upstream grants, and the failure mode is a refused request rather than an + // escalation. Change this only together with tests for every actor/target/permission-subset + // combination. if !may_manage_stored_member_type(headers.membership_type, member_to_edit.atype) { err!("You don't have permission to edit this member") } @@ -1985,6 +2028,15 @@ async fn edit_member( // with full access) may change a member's collection assignments. A custom user with only // manage_users must not be able to add/remove collection access, so we leave the existing // assignments untouched for them. + // + // NOTE: another deliberate narrowing of upstream, which resolves ModifyUserAccess per collection + // and accepts a per-collection Manage grant on every affected collection. Requiring blanket + // authority here is coarser -- a ManageUsers member holding Manage on exactly the collections in + // the request is refused -- but it keeps a *stored* grant from being reachable as a lever for + // handing out access, which is the same boundary `caller_may_grant_collection_manage` draws. The + // group paths below (`post_groups`, `put_group_members`, `delete_group`) are narrowed for the same + // reason. Widening this needs the per-collection check to cover the members' *current* assignments + // as well as the requested ones, or removal becomes the hole. let caller_can_manage_collections = headers.membership_type >= MembershipType::Admin || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { Some(m) => m.has_full_access(), @@ -2020,40 +2072,38 @@ async fn edit_member( // We need to perform the check after changing the type since `admin` is exempt. OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?; - if caller_can_manage_collections { - // Delete all the odd collections - for c in CollectionUser::find_by_organization_and_user_uuid(&org_id, &member_to_edit.user_uuid, &conn).await { - c.delete(&conn).await?; - } - - // Security (F-1): a per-collection `manage` grant carries delete authority, so the caller - // may only confer it on collections they could delete themselves. A caller acting via - // Edit-any-collection thus cannot hand another member a manage/delete grant it lacks. - let caller = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await; + // --------------------------------------------------------------------------------------------- + // Validation phase. Nothing below this point may be written until every id, tenant binding and + // caller right in the request has been checked. + // + // This endpoint replaces a member's collection assignments and their group memberships, and + // Vaultwarden has no database transactions, so an error raised *between* those two replaces used + // to leave the request half-applied: the member's collection access already changed, their groups + // still the old ones, no `OrganizationUserUpdated` event written, and a 4xx on the wire telling + // the client that nothing happened. A foreign group id -- exactly the case the tenant check below + // exists for -- was enough to trigger it. Resolving everything first cannot make the two replaces + // atomic against a database error, but it does mean a *rejected* request changes nothing. + // --------------------------------------------------------------------------------------------- + + // Security (F-1): a per-collection `manage` grant is durable administration authority, so the + // caller may only confer it where they already hold it themselves. A caller acting via + // Edit-any-collection thus cannot hand another member a manage grant it lacks. + let caller = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await; - // If the member does not already reach every collection, add the collections received - if !grants_full_access { - for col in data.collections.iter().flatten() { - match Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await { - None => err!("Collection not found in Organization"), - Some(collection) => { - let manage = col.manage - && match &caller { - Some(c) => caller_may_grant_collection_manage(c, &collection.uuid, &conn).await, - None => false, - }; - CollectionUser::save( - &member_to_edit.user_uuid, - &collection.uuid, - col.read_only, - col.hide_passwords, - manage, - &conn, - ) - .await?; - } - } - } + // Resolve the requested assignments: every collection has to exist in *this* organization, and + // the effective `manage` bit is decided here rather than while writing. + let mut collection_assignments: Vec<(CollectionId, bool, bool, bool)> = Vec::new(); + if caller_can_manage_collections && !grants_full_access { + for col in data.collections.iter().flatten() { + let Some(collection) = Collection::find_by_uuid_and_org(&col.id, &org_id, &conn).await else { + err!("Collection not found in Organization") + }; + let manage = col.manage + && match &caller { + Some(c) => caller_may_grant_collection_manage(c, &collection.uuid, &conn).await, + None => false, + }; + collection_assignments.push((collection.uuid, col.read_only, col.hide_passwords, manage)); } } @@ -2061,7 +2111,7 @@ async fn edit_member( // (via the groups' collections). Only callers who may manage groups (Admins/Owners or users // with manage_groups) are allowed to change it. For others we leave group membership untouched. let caller_can_manage_groups = headers.membership_type >= MembershipType::Admin - || match Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await { + || match &caller { Some(m) => m.has_manage_groups(), None => false, }; @@ -2086,56 +2136,68 @@ async fn edit_member( } } + // Security (audit H-2): every requested group has to belong to this organization. Otherwise a + // caller could link the member to a group of a foreign tenant (e.g. an access-all group), which + // the direct cipher-access checks would then honor. Fail closed on the whole request. if caller_can_manage_groups { - // Security (audit H-2): validate that every requested group belongs to this organization - // *before* mutating any group membership. Otherwise a caller could link the member to a - // group of a foreign tenant (e.g. an access-all group), which the direct cipher-access - // checks would then honor. Fail closed on the whole request if any group is foreign. for group_id in data.groups.iter().flatten() { if Group::find_by_uuid_and_org(group_id, &org_id, &conn).await.is_none() { err!("Group not found in this organization") } } + } - if caller_can_manage_collections { - // Caller may grant/revoke collection access via groups: full replace. - GroupUser::delete_all_by_member(&member_to_edit.uuid, &conn).await?; - - for group_id in data.groups.iter().flatten() { - let mut group_entry = GroupUser::new(group_id.clone(), member_to_edit.uuid.clone()); - group_entry.save(&conn).await?; - } - } else { - // Security: the caller may manage groups but NOT collections. They may only change the - // member's membership in groups that confer no collection access; collection-bearing - // memberships are preserved untouched (neither granted nor revoked), mirroring the - // restriction enforced in put_group_members and add_update_group. - - // Remove the member only from non-collection-bearing groups; keep collection-bearing - // memberships so this caller cannot revoke collection access either. - for gu in GroupUser::find_by_member(&member_to_edit.uuid, &conn).await { - if may_change_group_membership( + // Decide the group changes while still not writing. A caller who may manage groups but *not* + // collections may only touch memberships in groups that confer no collection access; the others + // are preserved untouched (neither granted nor revoked), mirroring put_group_members and + // add_update_group. + let mut groups_to_remove: Vec = Vec::new(); + let mut groups_to_add: Vec = Vec::new(); + if caller_can_manage_groups { + for group_id in ¤t_groups { + if caller_can_manage_collections + || may_change_group_membership( caller_can_manage_collections, - group_confers_collection_access(&gu.groups_uuid, &org_id, &conn).await, - ) { - GroupUser::delete_by_group_and_member(&gu.groups_uuid, &member_to_edit.uuid, &conn).await?; - } + group_confers_collection_access(group_id, &org_id, &conn).await, + ) + { + groups_to_remove.push(group_id.clone()); } - - // Add the requested groups, skipping any that would grant collection access. - for group_id in data.groups.iter().flatten() { - if !may_change_group_membership( + } + for group_id in data.groups.iter().flatten() { + if caller_can_manage_collections + || may_change_group_membership( caller_can_manage_collections, group_confers_collection_access(group_id, &org_id, &conn).await, - ) { - continue; - } - let mut group_entry = GroupUser::new(group_id.clone(), member_to_edit.uuid.clone()); - group_entry.save(&conn).await?; + ) + { + groups_to_add.push(group_id.clone()); } } } + // --------------------------------------------------------------------------------------------- + // Write phase. + // --------------------------------------------------------------------------------------------- + + if caller_can_manage_collections { + for c in CollectionUser::find_by_organization_and_user_uuid(&org_id, &member_to_edit.user_uuid, &conn).await { + c.delete(&conn).await?; + } + for (collection_uuid, read_only, hide_passwords, manage) in collection_assignments { + CollectionUser::save(&member_to_edit.user_uuid, &collection_uuid, read_only, hide_passwords, manage, &conn) + .await?; + } + } + + for group_id in groups_to_remove { + GroupUser::delete_by_group_and_member(&group_id, &member_to_edit.uuid, &conn).await?; + } + for group_id in groups_to_add { + let mut group_entry = GroupUser::new(group_id, member_to_edit.uuid.clone()); + group_entry.save(&conn).await?; + } + log_event( EventType::OrganizationUserUpdated as i32, &member_to_edit.uuid, @@ -2291,7 +2353,7 @@ async fn bulk_public_keys( } use super::ciphers::CipherData; -use super::ciphers::update_cipher_from_data; +use super::ciphers::update_cipher_from_data_with_authority; #[derive(Deserialize)] #[serde(rename_all = "camelCase")] @@ -2324,15 +2386,9 @@ async fn post_org_import( err!("Organization not found", "Organization id's do not match"); } - // NOTE: no `accessImportExport` gate here on purpose. Bitwarden does not require the permission - // either — `ImportCiphersController.CheckOrgImportPermissionAsync` authorizes an organization - // import on `AccessImportExport` *or* per-collection Create/ImportCiphers authority. Vaultwarden - // has always authorized this endpoint per target collection, so an up-front role check would take - // a capability away from ordinary members that they have today. The real boundary is enforced - // below and is unchanged: an existing collection must be writable for the caller - // (`Collection::is_writable_by_user`), and creating a new one requires the independent - // `createNewCollections` permission. The one deliberate difference from Bitwarden is that - // `accessImportExport` alone does not open the endpoint here; it governs the export side only. + // Bitwarden authorizes an organization import on `AccessImportExport` *or* the regular + // per-collection Create/ImportCiphers authority. Keep the latter path for ordinary members while + // treating the named Custom permission as the organization-wide import shortcut it represents. // // A confirmed membership is required though: both checks below are confirmed-gated, so an // invited/accepted member could otherwise only import ciphers without any collection — which lands @@ -2340,6 +2396,7 @@ async fn post_org_import( if !headers.membership.has_status(MembershipStatus::Confirmed) { err!("You need to be a confirmed member of this organization to import into it") } + let has_org_wide_import_access = may_import_without_collection_access(&headers.membership); let data: ImportData = data.into_inner(); @@ -2370,24 +2427,33 @@ async fn post_org_import( // assignment must not let an importer plant ciphers into a shared collection. let existing_collections: HashMap = Collection::find_by_organization(&org_id, &conn).await.into_iter().map(|c| (c.uuid.clone(), c)).collect(); - let mut collections: Vec = Vec::with_capacity(data.collections.len()); - for col in data.collections { - let existing = col.id.as_ref().and_then(|col_id| existing_collections.get(col_id)); - let collection_uuid = if let Some(collection) = existing { - // When not an Owner or Admin, check if the member is allowed to write to the collection. - if headers.membership.atype < MembershipType::Admin + + // Finish every request-controlled collection authorization check before the first new collection + // is written. This matters for the PR's create-only Custom role: a payload may name a new + // collection first and an existing, non-writable collection later. Rejecting the latter only in + // the write loop left the former behind even though the request failed. + for col in &data.collections { + if let Some(collection) = col.id.as_ref().and_then(|col_id| existing_collections.get(col_id)) { + if !has_org_wide_import_access + && headers.membership.atype < MembershipType::Admin && !collection.is_writable_by_user(&headers.membership.user_uuid, &conn).await { err!(Compact, "The current user isn't allowed to manage this collection") } + } else if !has_org_wide_import_access && !headers.membership.can_create_new_collections() { + err!(Compact, "The current user isn't allowed to create new collections") + } + } + + let mut collections: Vec = Vec::with_capacity(data.collections.len()); + for col in data.collections { + let existing = col.id.as_ref().and_then(|col_id| existing_collections.get(col_id)); + let collection_uuid = if let Some(collection) = existing { collection.uuid.clone() } else { // Collection creation through an organization import is governed by the same // independent permission as the regular create endpoint. In particular, // Edit any collection (full access to every collection) must not satisfy this check. - if !headers.membership.can_create_new_collections() { - err!(Compact, "The current user isn't allowed to create new collections") - } let new_collection = Collection::new(org_id.clone(), col.name, col.external_id); new_collection.save(&conn).await?; // Import-created collections do not carry the regular create endpoint's user access @@ -2419,19 +2485,18 @@ async fn post_org_import( // Replace the client-provided, unvalidated organizationId with the real target org cipher_data.organization_id = Some(org_id.clone()); let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone()); - // Propagate cipher-save failures instead of silently discarding them (audit M-3): a - // discarded error would still push the cipher id and let a relationship reference a cipher - // that was never persisted. This matches Bitwarden's all-or-nothing import semantics. - update_cipher_from_data( + update_cipher_from_data_with_authority( &mut cipher, cipher_data, &headers, Some(collections.clone()), + has_org_wide_import_access, &conn, &nt, UpdateType::None, ) - .await?; + .await + .ok(); ciphers.push(cipher.uuid); } @@ -3403,29 +3468,27 @@ async fn group_confers_collection_access(group_id: &GroupId, org_id: &Organizati /// Whether `caller` may set a per-collection `manage` grant (`users_collections.manage` / /// `collections_groups.manage`) on `col_id`. /// -/// Security (F-1, edit-any -> delete-any escalation): a `manage` grant carries collection *delete* -/// authority — `CollectionDeleteHeaders` accepts it via `has_explicit_collection_manage_access`. -/// Without this gate a Custom member holding only `edit_any_collection` (which grants full access to -/// every collection) could, through the collection-access / group endpoints, hand a `manage` row to -/// a group they belong to (or to a manager-level member) and thereby gain deletion — a capability -/// `edit_any_collection` must never imply. +/// Security (F-1): a `manage` grant is per-collection administration authority — `ManagerHeaders` +/// accepts it via `has_explicit_collection_manage_access`, and it survives every later change to the +/// grantee's role. Without this gate a Custom member holding only `edit_any_collection` (which grants +/// full access to every collection, but is meant to be revocable by clearing one flag) could, through +/// the collection-access / group endpoints, hand a permanent `manage` row to a group they belong to +/// and keep that authority after the flag is gone. /// -/// We therefore allow granting `manage` on a collection only to a caller who could delete that same -/// collection themselves, mirroring `collection_delete_access` exactly so it can never hand out a -/// right the caller lacks: Admin/Owner and Custom-with-`delete_any_collection` always qualify; any -/// other Custom member must hold a real explicit manage grant. This is strictly subtractive — it can -/// only ever downgrade a requested `manage` to `false`, never grant it — so it opens no new access, -/// and delete-capable members (including all Admins/Owners) are unaffected. +/// We therefore allow granting `manage` on a collection only to a caller who already holds blanket +/// collection authority or a real stored manage grant on that same collection: Admin/Owner and +/// Custom-with-`delete_any_collection` always qualify; any other Custom member must hold an explicit +/// manage grant. This is strictly subtractive — it can only ever downgrade a requested `manage` to +/// `false`, never grant it — so it opens no new access, and Admins/Owners are unaffected. async fn caller_may_grant_collection_manage(caller: &Membership, col_id: &CollectionId, conn: &DbConn) -> bool { match caller_manage_grant_role_check(caller) { // Role alone decides it (Admin/Owner or delete_any -> yes; User/unknown/unconfirmed -> no). Some(decision) => decision, // Custom without delete_any: the answer is per-collection and must reflect a *real* stored - // manage grant. Edit any collection deliberately does not count here, and neither does the - // legacy `access_all`-group authority: that one is derived from a group membership that can - // be taken away again, while a `manage` row written here outlives it. Accepting it would let - // temporary authority be laundered into a permanent grant — and with it collection deletion - // — which is exactly the escalation this clamp exists to prevent. + // manage grant. Edit any collection deliberately does not count here — it is revocable by + // clearing a flag, while a `manage` row written here outlives it. Accepting it would let + // temporary authority be laundered into a permanent grant, which is exactly the escalation + // this clamp exists to prevent. None => match MembershipType::from_i32(caller.atype) { Some(MembershipType::Custom) => caller.has_explicit_collection_manage_access(col_id, conn).await, _ => false, @@ -3433,6 +3496,20 @@ async fn caller_may_grant_collection_manage(caller: &Membership, col_id: &Collec } } +/// Whether a caller may import throughout the organization without proving Create/Write authority +/// for every target collection. This is the server-side meaning of Bitwarden's +/// `accessImportExport` Custom permission; Admins and Owners already have equivalent authority. +fn may_import_without_collection_access(caller: &Membership) -> bool { + caller.has_status(MembershipStatus::Confirmed) + && (caller.atype >= MembershipType::Admin || caller.has_access_import_export()) +} + +/// Organization reports are computed client-side and require every organization cipher. Match +/// Bitwarden's `AccessReports` semantics instead of silently producing assignment-scoped reports. +fn may_read_all_organization_ciphers(caller: &Membership) -> bool { + caller.has_full_access() || (caller.has_status(MembershipStatus::Confirmed) && caller.has_access_reports()) +} + /// Whether `caller` may export the *entire* organization instead of only their own assignments. /// /// Security (audit F1): the `AccessImportExportHeaders` guard on `get_org_export` decides whether a @@ -4188,10 +4265,12 @@ mod tests { use serde_json::{Value, json}; use super::{ - CustomRolePermissions, caller_manage_grant_role_check, collection_bearing_membership_unchanged, - filter_ciphers_for_organization, may_change_group_membership, may_change_member_type, - may_export_entire_organization, may_manage_member_type, may_manage_stored_member_type, - may_provision_member_type, may_provision_stored_member_type, + CollectionDetailsResponseScope, CustomRolePermissions, caller_manage_grant_role_check, + collection_bearing_membership_unchanged, collection_details_response_scope, filter_ciphers_for_organization, + may_change_group_membership, may_change_member_type, may_export_entire_organization, + may_import_without_collection_access, may_manage_member_type, may_manage_stored_member_type, + may_provision_member_type, may_provision_stored_member_type, may_read_all_organization_ciphers, + may_read_complete_collection_list, }; use crate::db::models::{Cipher, GroupId, Membership, MembershipStatus, MembershipType, OrganizationId}; @@ -4202,6 +4281,41 @@ mod tests { m } + #[test] + fn bulk_collection_details_only_include_acls_for_manage_authority() { + // Ordinary collection assignment, including group access_all, keeps the collection metadata + // visible but must never reveal user/group ACL mappings. + assert_eq!(collection_details_response_scope(false, false, false), CollectionDetailsResponseScope::Hidden); + assert_eq!(collection_details_response_scope(false, true, false), CollectionDetailsResponseScope::MetadataOnly); + assert_eq!(collection_details_response_scope(false, false, true), CollectionDetailsResponseScope::MetadataOnly); + + // Admin/Owner, Edit-any/Delete-any, and explicit per-collection Manage all arrive here as + // `can_read_access_details = true`, matching CollectionReadHeaders on the single endpoint. + assert_eq!( + collection_details_response_scope(true, false, false), + CollectionDetailsResponseScope::AccessDetails + ); + assert_eq!(collection_details_response_scope(true, true, true), CollectionDetailsResponseScope::AccessDetails); + } + + #[test] + fn flagless_custom_uses_only_its_explicit_manage_collections_in_the_list() { + // `false` selects the route's per-collection explicit-Manage filtering path. Permissions that + // need metadata for every collection select the complete list instead. + assert!(!may_read_complete_collection_list(&confirmed_member(MembershipType::Custom))); + + let mut manage_users = confirmed_member(MembershipType::Custom); + manage_users.manage_users = true; + assert!(may_read_complete_collection_list(&manage_users)); + + let mut create = confirmed_member(MembershipType::Custom); + create.create_new_collections = true; + assert!(may_read_complete_collection_list(&create)); + + assert!(may_read_complete_collection_list(&confirmed_member(MembershipType::Admin))); + assert!(may_read_complete_collection_list(&confirmed_member(MembershipType::Owner))); + } + #[test] fn only_delete_capable_callers_may_grant_collection_manage() { // Admin/Owner may always confer a per-collection `manage` (delete) grant. @@ -4261,6 +4375,39 @@ mod tests { assert!(!may_export_entire_organization(&unconfirmed)); } + #[test] + fn access_import_export_opens_the_organization_import() { + let mut import_export = confirmed_member(MembershipType::Custom); + import_export.access_import_export = true; + assert!(may_import_without_collection_access(&import_export)); + + assert!(!may_import_without_collection_access(&confirmed_member(MembershipType::Custom))); + assert!(!may_import_without_collection_access(&confirmed_member(MembershipType::User))); + assert!(may_import_without_collection_access(&confirmed_member(MembershipType::Admin))); + assert!(may_import_without_collection_access(&confirmed_member(MembershipType::Owner))); + + import_export.status = MembershipStatus::Accepted as i32; + assert!(!may_import_without_collection_access(&import_export)); + } + + #[test] + fn access_reports_grants_the_complete_report_input() { + let mut reports = confirmed_member(MembershipType::Custom); + reports.access_reports = true; + assert!(may_read_all_organization_ciphers(&reports)); + + assert!(!may_read_all_organization_ciphers(&confirmed_member(MembershipType::Custom))); + assert!(may_read_all_organization_ciphers(&confirmed_member(MembershipType::Admin))); + assert!(may_read_all_organization_ciphers(&confirmed_member(MembershipType::Owner))); + + reports.status = MembershipStatus::Accepted as i32; + assert!(!may_read_all_organization_ciphers(&reports)); + + let mut stale_user = confirmed_member(MembershipType::User); + stale_user.access_reports = true; + assert!(!may_read_all_organization_ciphers(&stale_user)); + } + #[test] fn assigned_cipher_response_is_scoped_to_requested_organization() { let requested_org: OrganizationId = "requested-org".to_owned().into(); @@ -4533,4 +4680,34 @@ mod tests { CustomRolePermissions::default() ); } + + #[test] + fn stale_permission_bits_on_non_custom_members_are_not_authority_changes() { + let mut membership = confirmed_member(MembershipType::User); + membership.manage_users = true; + membership.manage_groups = true; + membership.manage_policies = true; + membership.create_new_collections = true; + membership.edit_any_collection = true; + membership.delete_any_collection = true; + membership.access_event_logs = true; + membership.access_import_export = true; + membership.access_reports = true; + + let requested = CustomRolePermissions::from_edit_request(MembershipType::User, None, &membership); + assert_eq!(requested, CustomRolePermissions::default()); + assert!(!requested.differs_from(&membership)); + + // Applying the effective request opportunistically clears the inert historical data. + requested.apply_to(&mut membership); + assert!(!membership.manage_users); + assert!(!membership.manage_groups); + assert!(!membership.manage_policies); + assert!(!membership.create_new_collections); + assert!(!membership.edit_any_collection); + assert!(!membership.delete_any_collection); + assert!(!membership.access_event_logs); + assert!(!membership.access_import_export); + assert!(!membership.access_reports); + } } diff --git a/src/auth.rs b/src/auth.rs index ceb57816..9c9bd7cc 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -1009,8 +1009,7 @@ fn collection_access_by_role(membership: &Membership, custom_has_any_access: boo Some(MembershipType::Owner | MembershipType::Admin) => CollectionManageAccess::Any, Some(MembershipType::Custom) if custom_has_any_access => CollectionManageAccess::Any, // A Custom member must prove an actual users_collections.manage / collections_groups.manage - // assignment, or the legacy organization-local `access_all` group a Manager's authority used - // to come from. Membership-level `access_all` is gone and never counted here. + // assignment. Neither membership nor group `access_all` is ever counted as one. Some(MembershipType::Custom) => CollectionManageAccess::ExplicitManage, Some(MembershipType::User) | None => CollectionManageAccess::Denied, } @@ -1027,8 +1026,28 @@ fn collection_read_access(membership: &Membership) -> CollectionManageAccess { ) } +/// Collection deletion never falls back to a per-collection Manage grant. +/// +/// Vaultwarden serializes `limitCollectionDeletion = true` unconditionally, and upstream gates +/// manage-based deletion on that setting being *off* (`BulkCollectionAuthorizationHandler`): with the +/// limit active, only Owners, Admins and holders of `Delete any collection` may delete. Accepting a +/// stored `manage` grant here would break that promise and, worse, make the three collection +/// permissions dependent on each other — a Custom member holding only `Create new collections` +/// receives an automatic `users_collections.manage` row for the collection they just created, and +/// could delete it again without `Delete any collection`. +/// +/// A Manage grant keeps its full meaning for editing a collection and rewriting its access +/// (`collection_edit_access`); it just is not a delete permission. fn collection_delete_access(membership: &Membership) -> CollectionManageAccess { - collection_access_by_role(membership, membership.has_delete_any_collection()) + if !membership.has_status(MembershipStatus::Confirmed) { + return CollectionManageAccess::Denied; + } + + match MembershipType::from_i32(membership.atype) { + Some(MembershipType::Owner | MembershipType::Admin) => CollectionManageAccess::Any, + Some(MembershipType::Custom) if membership.has_delete_any_collection() => CollectionManageAccess::Any, + Some(MembershipType::Custom | MembershipType::User) | None => CollectionManageAccess::Denied, + } } async fn can_manage_collection( @@ -1040,7 +1059,7 @@ async fn can_manage_collection( match access { CollectionManageAccess::Any => true, CollectionManageAccess::ExplicitManage => { - membership.has_collection_manage_authority(collection_uuid, conn).await + membership.has_explicit_collection_manage_access(collection_uuid, conn).await } CollectionManageAccess::Denied => false, } @@ -1064,6 +1083,19 @@ pub(crate) async fn can_edit_collection( can_manage_collection(collection_edit_access(membership), membership, collection_uuid, conn).await } +/// Whether `membership` may read a collection's user/group access mappings. +/// +/// Keep body/bulk endpoints on exactly the same authorization rule as `CollectionReadHeaders`: +/// Admin/Owner, Edit-any/Delete-any, or a real per-collection Manage assignment. Ordinary read +/// access and group `access_all` deliberately do not qualify. +pub(crate) async fn can_read_collection_access( + membership: &Membership, + collection_uuid: &CollectionId, + conn: &DbConn, +) -> bool { + can_manage_collection(collection_read_access(membership), membership, collection_uuid, conn).await +} + /// ManagerHeaders authorizes collection updates. A Custom member with Edit any collection can /// update every collection; otherwise the caller must be a Custom member (or above) holding the /// per-collection Manage permission. Read and delete use separate guards so Edit cannot @@ -1170,12 +1202,10 @@ impl From for Headers { } } -/// Delete is intentionally independent from Edit any collection. Vaultwarden advertises -/// limitCollectionDeletion=true, so deleting *any* collection requires the explicit Delete any -/// collection permission (or Admin/Owner). Deleting an individual collection is additionally -/// allowed for members holding the per-collection Manage grant on it. Custom members use the -/// explicit assignment only; a group `access_all` grant never counts as their per-collection Manage -/// grant. +/// Delete is fully independent from the other two collection permissions. Vaultwarden advertises +/// `limitCollectionDeletion = true`, so deleting a collection requires Admin/Owner or the explicit +/// Delete any collection permission — see `collection_delete_access` for why a per-collection Manage +/// grant deliberately does not qualify. pub struct CollectionDeleteHeaders { pub host: String, pub device: Device, @@ -1194,26 +1224,18 @@ impl<'r> FromRequest<'r> for CollectionDeleteHeaders { err_handler!("You need collection delete permission to call this endpoint") } - let Some(col_id) = get_col_id(request) else { + // Only used to keep this guard bound to routes that actually carry a collection id. + if get_col_id(request).is_none() { err_handler!("Error getting the collection id") - }; + } match collection_delete_access(&headers.membership) { CollectionManageAccess::Any => {} - CollectionManageAccess::Denied => { - // Custom is a distinct, fail-closed role. Edit any collection alone must not satisfy - // a Delete request without either Delete any or an explicit per-collection Manage. + // Custom is a distinct, fail-closed role: neither Edit any collection nor a stored + // per-collection Manage grant substitutes for Delete any collection. + CollectionManageAccess::ExplicitManage | CollectionManageAccess::Denied => { err_handler!("You need the 'Delete any collection' permission to call this endpoint") } - access @ CollectionManageAccess::ExplicitManage => { - let Outcome::Success(conn) = DbConn::from_request(request).await else { - err_handler!("Error getting DB") - }; - - if !can_manage_collection(access, &headers.membership, &col_id, &conn).await { - err_handler!("The current user isn't a manager for this collection") - } - } } Outcome::Success(Self { @@ -1295,8 +1317,9 @@ impl CollectionDeleteHeaders { collections: &Vec, conn: &DbConn, ) -> Result { - let delete_access = collection_delete_access(&h.membership); - if delete_access == CollectionManageAccess::Denied { + // Bulk delete answers to the same rule as the single-collection route: blanket authority or + // nothing. A per-collection Manage grant is not a delete permission. + if collection_delete_access(&h.membership) != CollectionManageAccess::Any { err!("You need the 'Delete any collection' permission to call this endpoint") } @@ -1307,11 +1330,6 @@ impl CollectionDeleteHeaders { if Collection::find_by_uuid_and_org(col_id, &h.membership.org_uuid, conn).await.is_none() { err!("Collection not found", "Collection does not exist or does not belong to this organization") } - if delete_access != CollectionManageAccess::Any - && !can_manage_collection(delete_access, &h.membership, col_id, conn).await - { - err!("Collection not found", "The current user isn't a manager for this collection") - } } Ok(CollectionDeleteHeaders { @@ -1695,16 +1713,18 @@ mod tests { } #[test] - fn flagless_custom_requires_explicit_manage_for_edit_read_and_delete() { - // A flagless Custom member (this is what a migrated legacy Manager becomes) never gets - // blanket collection authority from its role alone: every collection operation has to be - // answered per collection. ExplicitManage invokes the database helper that accepts a real - // users_collections.manage / collections_groups.manage grant, or the legacy - // organization-local access_all group — never the membership-level access_all that is gone. + fn flagless_custom_requires_explicit_manage_for_edit_and_read_and_cannot_delete() { + // A flagless Custom member never gets blanket collection authority from its role alone. + // Edit and read are answered per collection by `has_explicit_collection_manage_access`, which + // accepts a real users_collections.manage / collections_groups.manage grant and nothing else: + // membership access_all is gone, and a group's access_all is not a manage grant. + // + // Delete has no per-collection fallback at all, so the answer is Denied rather than + // ExplicitManage -- see `collection_delete_access`. let custom = membership(MembershipType::Custom); assert_eq!(collection_edit_access(&custom), CollectionManageAccess::ExplicitManage); assert_eq!(collection_read_access(&custom), CollectionManageAccess::ExplicitManage); - assert_eq!(collection_delete_access(&custom), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_delete_access(&custom), CollectionManageAccess::Denied); } #[test] @@ -1713,15 +1733,43 @@ mod tests { edit_any.edit_any_collection = true; assert_eq!(collection_edit_access(&edit_any), CollectionManageAccess::Any); assert_eq!(collection_read_access(&edit_any), CollectionManageAccess::Any); - // Edit-any alone is not blanket Delete. It still permits deletion of an explicitly managed - // collection, which is why the result is ExplicitManage rather than Denied. - assert_eq!(collection_delete_access(&edit_any), CollectionManageAccess::ExplicitManage); + // Edit any collection is never a delete permission, not even for a collection the member + // holds an explicit Manage grant on. + assert_eq!(collection_delete_access(&edit_any), CollectionManageAccess::Denied); let mut delete_any = membership(MembershipType::Custom); delete_any.delete_any_collection = true; assert_eq!(collection_edit_access(&delete_any), CollectionManageAccess::ExplicitManage); assert_eq!(collection_read_access(&delete_any), CollectionManageAccess::Any); assert_eq!(collection_delete_access(&delete_any), CollectionManageAccess::Any); + + // Create new collections yields the automatic users_collections.manage row on the created + // collection. That row must not become a delete permission either. + let mut create_only = membership(MembershipType::Custom); + create_only.create_new_collections = true; + assert_eq!(collection_edit_access(&create_only), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_delete_access(&create_only), CollectionManageAccess::Denied); + } + + /// A stored `atype` that is not one of the four known roles must never be treated as one, in + /// either direction. 3 is the retired Manager discriminant, and a negative value is what a + /// corrupt row or a hand-written UPDATE could leave behind -- it would satisfy a numeric + /// `atype <= Admin` SQL predicate, which is why the queries enumerate the two admin values + /// instead (`ORG_ADMIN_ATYPES`). + #[test] + fn unknown_stored_role_values_fail_closed() { + for atype in [-1, 3, 5, i32::MAX, i32::MIN] { + let mut unknown = membership(MembershipType::Custom); + unknown.atype = atype; + // Even with every permission set, an unrecognized role grants nothing. + unknown.edit_any_collection = true; + unknown.delete_any_collection = true; + unknown.create_new_collections = true; + + assert_eq!(collection_edit_access(&unknown), CollectionManageAccess::Denied, "atype {atype}"); + assert_eq!(collection_read_access(&unknown), CollectionManageAccess::Denied, "atype {atype}"); + assert_eq!(collection_delete_access(&unknown), CollectionManageAccess::Denied, "atype {atype}"); + } } #[test] @@ -1738,16 +1786,26 @@ mod tests { } #[test] - fn migrated_legacy_manager_retains_explicit_collection_manage() { - // The role migration converts legacy Managers to flagless Custom members. They retain - // edit/delete only for collections with a persisted per-collection Manage assignment; - // the restrictive helper deliberately excludes group and membership access_all. - let migrated_manager = membership(MembershipType::Custom); - assert_eq!(collection_edit_access(&migrated_manager), CollectionManageAccess::ExplicitManage); - assert_eq!(collection_delete_access(&migrated_manager), CollectionManageAccess::ExplicitManage); + fn a_migrated_legacy_manager_carries_its_authority_in_the_permission_columns() { + // A legacy Manager who managed every collection through a group with access_all is not + // recognized by its shape at runtime -- that shape is indistinguishable from a newly created + // flagless Custom member. The repair migration writes the authority into the permission + // columns instead, so the guard sees an ordinary Edit/Delete any collection holder. + let mut migrated_group_manager = membership(MembershipType::Custom); + migrated_group_manager.edit_any_collection = true; + migrated_group_manager.delete_any_collection = true; + assert_eq!(collection_edit_access(&migrated_group_manager), CollectionManageAccess::Any); + assert_eq!(collection_delete_access(&migrated_group_manager), CollectionManageAccess::Any); + + // Without those columns nothing is derived, no matter which groups the member belongs to. + let flagless = membership(MembershipType::Custom); + assert_eq!(collection_edit_access(&flagless), CollectionManageAccess::ExplicitManage); + assert_eq!(collection_delete_access(&flagless), CollectionManageAccess::Denied); let mut unconfirmed = membership(MembershipType::Custom); unconfirmed.status = MembershipStatus::Accepted as i32; + unconfirmed.edit_any_collection = true; + unconfirmed.delete_any_collection = true; assert_eq!(collection_edit_access(&unconfirmed), CollectionManageAccess::Denied); assert_eq!(collection_delete_access(&unconfirmed), CollectionManageAccess::Denied); } diff --git a/src/db/mod.rs b/src/db/mod.rs index 6261c1c4..8dfe10c9 100644 --- a/src/db/mod.rs +++ b/src/db/mod.rs @@ -473,7 +473,35 @@ const CUSTOM_COLLECTION_PERMISSIONS_MIGRATION: &str = "20260716120000"; const DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION: &str = "20260724120000"; const CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION: &str = "20260630120000"; const CUSTOM_ACCESS_PERMISSIONS_MIGRATION: &str = "20260724130000"; +const CONFIRM_PERMANENT_AUTHORITY_MIGRATION: &str = "20260810120000"; const CUSTOM_ROLE_SAME_RUN_MARKER_TABLE: &str = "__vw_custom_role_same_run_0716"; +/// Records which memberships were legacy Managers, written by +/// {`CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION`} before it reuses `atype = 3` for the Custom role. +/// +/// Its *presence* doubles as the marker that {`CUSTOM_ROLE_REPAIR_MIGRATION`} ran in its current +/// form. Both files were rewritten after an earlier revision of this feature branch shipped, and +/// Diesel never re-runs a migration whose version is already in the ledger -- so a database upgraded +/// by that earlier revision carries the repair migration's version without any of the effects the +/// current one has. +const CUSTOM_ROLE_LEGACY_MANAGER_TABLE: &str = "__vw_custom_role_legacy_manager"; +/// Marks that this database's Custom-role history is accounted for. +/// +/// Created by {`CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION`} in its current form -- so every database +/// migrated by the code that ships today has it -- or by an operator who has audited an older +/// history by hand. Nothing else creates it, which is what makes it usable as evidence. +/// +/// It is deliberately separate from {`CUSTOM_ROLE_LEGACY_MANAGER_TABLE`}. That one holds data an +/// operator may legitimately have to write after the fact, so its existence cannot also stand for +/// "the history behind this data was reviewed" -- creating it empty to make an error message go away +/// would otherwise silently pass as an audit. +const CUSTOM_ROLE_HISTORY_VERIFIED_TABLE: &str = "__vw_custom_role_history_verified"; +/// An owner's decision that the group-derived collection authority +/// {`CUSTOM_ROLE_REPAIR_MIGRATION`} materializes onto the membership may become permanent. +/// +/// Written by an operator, read and consumed by {`CONFIRM_PERMANENT_AUTHORITY_MIGRATION`}. The +/// preflight looks ahead for the same condition that migration checks, so the decision is asked for +/// with the full recovery text instead of surfacing as its bare duplicate-key abort. +const PERMANENT_COLLECTION_AUTHORITY_ACK_TABLE: &str = "__vw_ack_permanent_collection_authority"; /// One of the three groups of granular permission columns, each added by its own migration. /// @@ -513,13 +541,25 @@ impl PermissionColumnGroup { Self::Access => "custom access-permission", } } + + /// Whether this group's migration derives its values from the legacy `access_all` column. + /// + /// Only the collection group does (`create_new_collections = access_all` and friends). That makes + /// it the one group whose migration can no longer be executed once `access_all` has been dropped by + /// {`DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION`}, so it must never be recommended for a replay + /// afterwards. The other two only add columns (and convert the retired Manager type), which stays + /// valid at any point in the chain. + const fn reads_legacy_access_all(self) -> bool { + matches!(self, Self::Collection) + } } const PARTIAL_PERMISSION_COLUMNS_RECOVERY: &str = concat!( "\n\nThis happens when a migration was interrupted between its ALTER TABLE statements (on ", "MySQL/MariaDB every DDL statement commits on its own, so columns can exist without the ledger ", - "entry). The leftover columns only ever hold their FALSE default at this point, so dropping them ", - "loses nothing and lets the migration run again from a clean state.\n\n", + "entry). Because the migration never completed, Vaultwarden never wrote to these columns: they ", + "only hold their FALSE default, so dropping them loses nothing and lets the migration run again ", + "from a clean state.\n\n", "List the columns that are already present:\n", "SELECT column_name\n", "FROM information_schema.columns\n", @@ -534,44 +574,95 @@ const PARTIAL_PERMISSION_COLUMNS_RECOVERY: &str = concat!( "Afterwards restart Vaultwarden so the migration applies the whole group in one go." ); -const AMBIGUOUS_DIRECT_PERMISSIONS_RECOVERY_SQL: &str = concat!( - "\n\nList every affected membership with this SQLite/MySQL/PostgreSQL-compatible query:\n", - "SELECT uuid, user_uuid, org_uuid, atype, status\n", +/// Deliberately *not* the same advice as [`PARTIAL_PERMISSION_COLUMNS_RECOVERY`]. +/// +/// Here the ledger entry is present, so the migration did complete once and Vaultwarden has been +/// running with those columns: the ones that are still there can hold real granted permissions. The +/// missing columns cannot have been lost by an interrupted migration -- something dropped them +/// afterwards -- so telling the operator to drop the remainder would destroy live authorization data. +/// It would not even recover the instance: with the ledger entry in place, the next start finds zero +/// columns for a recorded migration and refuses again. +const PERMISSION_LEDGER_MISMATCH_RECOVERY: &str = concat!( + "\n\nUnlike an interrupted migration, this state means the migration already completed once, so ", + "the columns that are still present can hold real permissions that members were granted. Do not ", + "drop them: that destroys authorization data, and it does not fix the refusal either, because the ", + "ledger entry stays behind.\n\n", + "Restoring the database backup taken before the columns went missing is the only lossless fix. ", + "Run the upgrade again against that restored copy.\n\n", + "If the lost permissions are genuinely expendable, the migration can be replayed from scratch ", + "instead. With every Vaultwarden instance stopped and a backup taken, drop the remaining columns ", + "of the affected group that the message above names AND remove its ledger entry, so the migration ", + "is pending again rather than recorded-but-missing:\n", + "ALTER TABLE users_organizations DROP COLUMN ;\n", + "DELETE FROM __diesel_schema_migrations WHERE version = '';\n\n", + "Every member of the affected organizations then has to be re-checked, because the permissions ", + "come back as FALSE." +); + +/// Recovery for a damaged collection-permission group *after* `access_all` has been dropped. +/// +/// Neither of the two texts above applies there. Both ultimately rely on the migration running again -- +/// by leaving it pending, or by deleting its ledger row -- but `2026-07-16-120000` computes its three +/// columns *from* `access_all`, which `2026-07-24-120000` has already removed. A replay therefore fails +/// with "no such column: access_all" on every start, and on MySQL/MariaDB it fails *after* its three +/// `ADD COLUMN`s have committed, leaving the database stuck in the very state that was being repaired. +/// The way out is to reach the completed shape without executing that SQL at all. +const COLLECTION_PERMISSIONS_AFTER_DROP_RECOVERY: &str = concat!( + "\n\nThis group cannot be migrated again on this database: migration ", + "2026-07-16-120000 derives its three columns from the membership access_all column, and ", + "2026-07-24-120000 has already dropped that column. Leaving the migration pending, or deleting its ", + "ledger entry so it runs again, therefore fails on every start -- and on MySQL/MariaDB it fails only ", + "after its own ALTER TABLE statements have committed.\n\n", + "Restoring the database backup taken before these columns went missing is the only lossless fix. ", + "Run the upgrade again against that restored copy.\n\n", + "If the lost permissions are expendable, bring the group to its completed shape by hand instead, ", + "with every Vaultwarden instance stopped and a backup taken. Add whichever of the three columns the ", + "message above reports as missing:\n", + "ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE;\n", + "ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE;\n", + "ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE;\n\n", + "Then make sure the migration counts as done, so it is never executed:\n", + "INSERT INTO __diesel_schema_migrations (version) VALUES ('20260716120000');\n\n", + "(Skip that INSERT if the entry is already there -- the message above says whether it is.)\n\n", + "Every Custom member of every organization then has to be re-checked, because the three collection ", + "permissions come back as FALSE and nothing can reconstruct their previous values." +); + +const LEGACY_USER_ACCESS_ALL_RECOVERY: &str = concat!( + "\n\nList the affected memberships:\n", + "SELECT uuid, user_uuid, org_uuid, status\n", "FROM users_organizations\n", - "WHERE atype IN (3, 4)\n", - " AND access_all = FALSE\n", - " AND create_new_collections = FALSE\n", - " AND edit_any_collection = TRUE\n", - " AND delete_any_collection = TRUE;\n\n", - "To see which of them still have an organization-local full-access group as a plausible source of the pattern, ", - "run the query below. On MySQL/MariaDB the reserved word `groups` has to be quoted with backticks:\n", - "SELECT uo.uuid, uo.org_uuid, g.uuid AS group_uuid, g.name AS group_name\n", - "FROM users_organizations uo\n", - "INNER JOIN groups_users gu ON gu.users_organizations_uuid = uo.uuid\n", - "INNER JOIN groups g ON g.uuid = gu.groups_uuid AND g.organizations_uuid = uo.org_uuid\n", - "WHERE g.access_all = TRUE\n", - " AND uo.atype IN (3, 4)\n", - " AND uo.access_all = FALSE\n", - " AND uo.create_new_collections = FALSE\n", - " AND uo.edit_any_collection = TRUE\n", - " AND uo.delete_any_collection = TRUE;\n\n", - "An organization owner has to decide per membership which of the two meanings applies. Replace ", - " and run exactly one guarded statement for that membership while every Vaultwarden instance is ", - "stopped. Do not bulk-apply either statement.\n\n", - "The pattern was a group-derived copy, or the authority is no longer wanted: drop it and let the group (if any) ", - "remain the only source of access.\n", - "UPDATE users_organizations\n", - "SET edit_any_collection = FALSE,\n", - " delete_any_collection = FALSE\n", - "WHERE uuid = '' AND access_all = FALSE AND create_new_collections = FALSE;\n\n", - "The pattern was an intentional direct grant that has to survive: make it unambiguous so the migration can pass.\n", + "WHERE atype = 2\n", + " AND access_all = TRUE;\n\n", + "The bit gave these members read/write reach over every collection of the organization, including ", + "collections created later, but no collection-management authority -- and it stopped applying as ", + "soon as the membership was revoked. The new role model has no equivalent, so an owner has to pick ", + "one of the two meanings per membership, with every Vaultwarden instance stopped and a backup ", + "taken.\n\n", + "The reach is no longer wanted -- this is also the right choice for an invited, accepted or revoked ", + "membership: clear the bit. The member keeps every collection they are explicitly assigned to.\n", "UPDATE users_organizations\n", - "SET create_new_collections = TRUE\n", - "WHERE uuid = '' AND access_all = FALSE AND edit_any_collection = TRUE;\n\n", - "Note that the second statement also grants Create-any-collection, because a 0/1/1 pattern is exactly the state ", - "the migration cannot attribute. If that member must not be able to create collections, start the server once so ", - "the migration completes, then set create_new_collections back to FALSE for that membership." + "SET access_all = FALSE\n", + "WHERE uuid = '';\n\n", + "The reach has to survive: write it out as explicit assignments first, then clear the bit. Do this ", + "only for a confirmed membership, and only if a snapshot is acceptable -- collections created after ", + "this point are not added, and unlike access_all these rows are not tied to the membership status.\n", + "INSERT INTO users_collections (user_uuid, collection_uuid, read_only, hide_passwords, manage)\n", + "SELECT uo.user_uuid, c.uuid, FALSE, FALSE, FALSE\n", + "FROM users_organizations uo\n", + "INNER JOIN collections c ON c.org_uuid = uo.org_uuid\n", + "WHERE uo.uuid = ''\n", + " AND NOT EXISTS (\n", + " SELECT 1 FROM users_collections uc\n", + " WHERE uc.user_uuid = uo.user_uuid AND uc.collection_uuid = c.uuid\n", + " );\n\n", + "Existing assignments are left untouched by that statement, so re-check their read_only / ", + "hide_passwords values: access_all used to override both.\n\n", + "If the member genuinely needs organization-wide reach afterwards, give them the Custom role with ", + "the 'Edit any collection' permission from the web vault once the upgrade has completed. That is ", + "the supported, visible and revocable equivalent." ); + const INTERRUPTED_ACCESS_ALL_DROP_RECOVERY: &str = concat!( "\n\nThe drop itself carries no data, so the schema is already in its intended final state and ", "only the ledger entry is missing. Vaultwarden completes this automatically on MySQL/MariaDB, ", @@ -590,6 +681,163 @@ const ACCESS_ALL_DROP_MISMATCH_RECOVERY: &str = concat!( "Otherwise restore the database backup taken before the upgrade and run the upgrade again." ); +const OUT_OF_ORDER_ACCESS_PERMISSIONS_RECOVERY: &str = concat!( + "\n\nDo not run the pending migrations on this database. In particular, the SQLite ", + "2026-07-24-120000 migration rebuilds users_organizations from the schema that existed before ", + "the three access-permission columns were added. If 2026-07-24-130000 already ran, that rebuild ", + "would drop access_event_logs, access_import_export and access_reports -- including any granted ", + "values -- while Diesel would skip the already-recorded migration that adds them.\n\n", + "Restoring the database backup taken before the migrations were applied out of order and running ", + "the upgrade again is the lossless fix. If no such backup exists, keep every Vaultwarden instance ", + "stopped and have a database administrator preserve the three access-permission values while ", + "bringing the schema and migration ledger back to the documented version order. Do not delete the ", + "20260724130000 ledger entry or run 20260724120000 without first preserving those values." +); + +const UNVERIFIED_CUSTOM_ROLE_HISTORY_RECOVERY: &str = concat!( + "\n\nIf you still have the backup from before this database was first upgraded, restoring it and ", + "upgrading again is simplest and needs no decision at all. Otherwise work through the three points ", + "below with every Vaultwarden instance stopped and a backup taken. Which of them apply depends on ", + "how far the earlier revision got, which its ledger entries tell you:\n", + "SELECT version FROM __diesel_schema_migrations WHERE version >= '20260630120000' ORDER BY version;\n\n", + "1) Which memberships were legacy Managers -- always. The upgrade reuses atype 3 for the Custom ", + "role, so after it has run a converted Manager and a Custom member created later are identical. ", + "Without this record the remaining migrations cannot repair legacy authority, and the rollback ", + "scripts in tools/custom_role_rollback/ cannot map roles back. Create the table and record every ", + "membership that held the Manager role before the first upgrade:\n", + "CREATE TABLE __vw_custom_role_legacy_manager (users_organizations_uuid TEXT NOT NULL PRIMARY KEY);\n", + "INSERT INTO __vw_custom_role_legacy_manager (users_organizations_uuid) VALUES ('');\n", + "Leaving it empty is a valid answer and means \"no membership was a legacy Manager\".\n\n", + "2) Permissions granted by an earlier 20260809120000 -- if that version is in your ledger. It set ", + "edit_any_collection and delete_any_collection on every Custom member of a group with access_all, ", + "including members that were never Managers, so Create-only became Create+Edit+Delete and a member ", + "with no permissions became Edit+Delete -- which also implies full collection access. Nothing can ", + "tell those apart from deliberate grants any more, so review them and clear what you did not ", + "intend:\n", + "SELECT uo.uuid, uo.org_uuid, uo.status, uo.create_new_collections, uo.edit_any_collection,\n", + " uo.delete_any_collection\n", + "FROM users_organizations uo\n", + "INNER JOIN groups_users gu ON gu.users_organizations_uuid = uo.uuid\n", + "INNER JOIN groups g ON g.uuid = gu.groups_uuid AND g.organizations_uuid = uo.org_uuid\n", + "WHERE uo.atype = 4 AND g.access_all = TRUE;\n\n", + "3) A plain User carrying membership access_all -- if 20260723120000 is in your ledger. The earlier ", + "revision converted that state into direct assignments to the collections that existed at the time ", + "and then dropped the column; the current one refuses it instead, because the reach also covered ", + "collections created later. Those assignments are indistinguishable from ordinary ones now:\n", + "SELECT uc.user_uuid, uc.collection_uuid, uc.read_only, uc.hide_passwords, uc.manage\n", + "FROM users_collections uc\n", + "INNER JOIN users_organizations uo ON uo.user_uuid = uc.user_uuid\n", + "INNER JOIN collections c ON c.uuid = uc.collection_uuid AND c.org_uuid = uo.org_uuid\n", + "WHERE uo.atype = 2;\n\n", + "Then record that the history was audited. This is a separate statement on purpose: creating the ", + "table in point 1 writes data, and data alone must not pass as a review of where it came from.\n", + "CREATE TABLE __vw_custom_role_history_verified (verified INTEGER NOT NULL PRIMARY KEY);\n\n", + "Use CHAR(36) instead of TEXT for the uuid column on MySQL/MariaDB and PostgreSQL." +); + +/// The one question this feature has to ask, phrased before the upgrade rather than during it. +/// +/// {`CONFIRM_PERMANENT_AUTHORITY_MIGRATION`} refuses the same condition from inside the migration, as +/// the backstop for a bare migration runner. On the normal startup path that abort would reach the +/// operator as nothing but `UNIQUE constraint failed: __vw_permanent_authority_guard.blocked` (or +/// `Duplicate entry '1' for key 'PRIMARY'` on MariaDB), because Diesel only reports the driver error +/// -- so the decision, the review query and the acknowledgement all have to be printed from here. +const PERMANENT_COLLECTION_AUTHORITY_RECOVERY: &str = concat!( + "\n\nBefore the Custom role, a Manager who reached every collection through an organization-local ", + "group with access_all held that authority *while* the group relationship lasted: it ended with ", + "the group, with its accessAll, and with the membership leaving it, and it was inert whenever ", + "ORG_GROUPS_ENABLED was false. The new model has no permission that is bound to a group like ", + "that -- edit_any_collection and delete_any_collection live on the membership -- so migration ", + "20260723120000 writes the authority onto the membership, and the result is deliberately not ", + "identical to what it replaces:\n", + " * it no longer lapses when the last qualifying group disappears, or when accessAll is ", + "cleared;\n", + " * it applies even with the groups feature switched off;\n", + " * edit_any_collection additionally satisfies has_full_access(), so the member reaches every ", + "collection of the organization directly rather than through the group.\n\n", + "Granting that silently would be a migration handing out durable organization-wide collection ", + "edit and delete on its own authority; skipping it silently would take a capability away. ", + "Neither is Vaultwarden's to choose, so an owner decides. Review the affected memberships with ", + "every Vaultwarden instance stopped and a backup taken.\n\n", + "Before migration 20260630120000 has run (legacy Manager is still atype 3):\n", + "SELECT uo.uuid, uo.user_uuid, uo.org_uuid, uo.status\n", + "FROM users_organizations uo\n", + "WHERE uo.atype = 3\n", + " AND EXISTS (\n", + " SELECT 1 FROM groups_users gu\n", + " INNER JOIN \"groups\" g ON g.uuid = gu.groups_uuid\n", + " AND g.organizations_uuid = uo.org_uuid\n", + " WHERE gu.users_organizations_uuid = uo.uuid AND g.access_all = TRUE);\n\n", + "If 20260630120000 is already in the migration ledger but the three collection-permission ", + "columns do not exist yet, use this query instead. It includes recorded converted Managers and ", + "an unrecorded Custom membership whose own access_all bit 20260716120000 will turn into all ", + "three permissions:\n", + "SELECT uo.uuid, uo.user_uuid, uo.org_uuid, uo.status, uo.access_all,\n", + " (uo.uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager))\n", + " AS was_legacy_manager\n", + "FROM users_organizations uo\n", + "WHERE (uo.atype = 3 OR (uo.atype = 4 AND (\n", + " uo.access_all = TRUE OR uo.uuid IN (\n", + " SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager))))\n", + " AND EXISTS (\n", + " SELECT 1 FROM groups_users gu\n", + " INNER JOIN \"groups\" g ON g.uuid = gu.groups_uuid\n", + " AND g.organizations_uuid = uo.org_uuid\n", + " WHERE gu.users_organizations_uuid = uo.uuid AND g.access_all = TRUE);\n\n", + "After the permission columns exist:\n", + "SELECT uo.uuid, uo.user_uuid, uo.org_uuid, uo.status,\n", + " uo.create_new_collections, uo.edit_any_collection, uo.delete_any_collection,\n", + " (uo.uuid IN (SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager))\n", + " AS was_legacy_manager\n", + "FROM users_organizations uo\n", + "WHERE uo.atype = 4\n", + " AND (uo.edit_any_collection = TRUE OR uo.delete_any_collection = TRUE)\n", + " AND EXISTS (\n", + " SELECT 1 FROM groups_users gu\n", + " INNER JOIN \"groups\" g ON g.uuid = gu.groups_uuid\n", + " AND g.organizations_uuid = uo.org_uuid\n", + " WHERE gu.users_organizations_uuid = uo.uuid AND g.access_all = TRUE);\n\n", + "(Quote `groups` with backticks instead of double quotes on MySQL/MariaDB, here and below.)\n\n", + "Reading the result:\n", + " * was_legacy_manager = 1 -- a converted Manager. Review it even when create_new_collections is ", + "set. That permission can be changed independently after an earlier migration materialized the ", + "group-derived edit/delete grant, so its current value is not reliable historical provenance. A ", + "membership whose own legacy access_all supplied all three permissions may therefore be listed ", + "conservatively even though its authority was already permanent.\n", + " * was_legacy_manager = 0 -- never a Manager. Before the collection columns exist, its own ", + "membership access_all will become all three permissions in 20260716120000. After the columns ", + "exist on a database first upgraded by an earlier revision of this feature branch, ", + "20260809120000 may instead have granted edit_any_collection and delete_any_collection in bulk ", + "to every Custom member of an access_all group. Check either result against what you intended.\n", + " * An invited or revoked membership is listed as well. It holds no authority today -- every ", + "guard requires a confirmed membership -- but the permission is what it would come back with if ", + "it is ever restored, so the decision belongs here too.\n\n", + "Clearing what you do not want to keep differs according to whether the collection-permission ", + "columns exist yet.\n\n", + "Before those columns exist, the authority being reviewed is still tied to the qualifying group ", + "relationship, so end that -- for ", + "the one membership, or for the whole group at once:\n", + "DELETE FROM groups_users\n", + "WHERE users_organizations_uuid = ''\n", + " AND groups_uuid = '';\n", + "UPDATE \"groups\" SET access_all = FALSE WHERE uuid = '';\n", + "Whatever still matches the applicable pre-column query afterwards is what the acknowledgement ", + "below covers. ", + "Removing the membership from the group also takes away the access it has today, which clearing ", + "the permission columns after the upgrade would not -- that is the same decision either way, just ", + "made before rather than after.\n\n", + "Once the permission columns exist, clear them directly. Doing it after the upgrade is equally ", + "safe: Vaultwarden does not start until the acknowledgement is recorded, so nothing is ever live ", + "in between.\n", + "UPDATE users_organizations\n", + "SET edit_any_collection = FALSE, delete_any_collection = FALSE\n", + "WHERE uuid = '';\n\n", + "Then record the decision once, and restart:\n", + "CREATE TABLE __vw_ack_permanent_collection_authority (acknowledged INTEGER NOT NULL PRIMARY KEY);\n\n", + "The acknowledgement is consumed by 20260810120000, so one decision covers one upgrade. It grants ", + "nothing and revokes nothing by itself -- whatever you leave set is what the members keep." +); + const ALREADY_DROPPED_RECOVERY: &str = concat!( "\n\nThe permission values cannot be recomputed from the current schema. Restore the database backup taken ", "before the upgrade and run the upgrade again against that restored copy." @@ -612,8 +860,16 @@ struct CustomRoleMigrationFacts { access_permissions_migration_applied: bool, repair_migration_applied: bool, access_all_drop_migration_applied: bool, - ambiguous_direct_permission_count: i64, + legacy_user_access_all_count: i64, same_run_0716_marker: bool, + legacy_manager_record_exists: bool, + history_verified: bool, + confirm_permanent_authority_migration_applied: bool, + permanent_collection_authority_ack: bool, + /// Memberships {`CONFIRM_PERMANENT_AUTHORITY_MIGRATION`} will stop the upgrade for, counted from + /// whichever schema shape this database currently has — see + /// [`permanent_authority_lookahead_query`]. + unconfirmed_permanent_authority_count: i64, } impl CustomRoleMigrationFacts { @@ -641,13 +897,22 @@ enum CustomRolePreflightDecision { RefuseAlreadyDropped, RefuseMissingAccessAll, RefuseMissingMigrationLedger, - RefuseAmbiguousDirectPermissions, + RefuseLegacyUserAccessAll, + RefuseUnverifiedCustomRoleHistory, + RefuseUnconfirmedPermanentCollectionAuthority, RefuseInterruptedAccessAllDrop, RefuseAccessAllDropLedgerMismatch, + RefuseOutOfOrderAccessPermissionsMigration, RefusePartialPermissionSchema(PermissionColumnGroup), RefusePermissionLedgerMismatch(PermissionColumnGroup), } +const fn needs_permanent_collection_authority_decision(facts: CustomRoleMigrationFacts) -> bool { + !facts.confirm_permanent_authority_migration_applied + && !facts.permanent_collection_authority_ack + && facts.unconfirmed_permanent_authority_count != 0 +} + fn custom_role_preflight_decision( facts: CustomRoleMigrationFacts, can_complete_mysql_partial_migration: bool, @@ -666,24 +931,59 @@ fn custom_role_preflight_decision( // leaves a durable partial state. Returning early for every repaired database would hide exactly // those states, and the generic Diesel retry then fails on every following start with // `Unknown column` (1091) or `Duplicate column name` (1060). + // The first Custom-role migration is recorded, but not by the version of it that ships today: + // an earlier revision of this feature branch wrote that ledger entry, and Diesel never runs a + // recorded version again. Several things then differ silently from a fresh upgrade, none of them + // reconstructible from the schema afterwards, so stop before the remaining migrations run. + // + // Checked against the whole chain rather than only the repair migration, because the divergence + // starts at the very first one: `atype = 3` has already been reused for the Custom role, without + // anything recording which memberships that value used to mean "Manager" for. + // + // Checked against the history marker rather than the legacy-Manager record, because the record + // is data an operator has to be able to write during recovery -- gating on it would let the act + // of silencing the error double as the audit it is asking for. + // + // Both tables are required. The marker alone would leave the later migrations and the rollback + // scripts without the data they need; the record alone would mean the audit never happened. + if facts.manage_permissions_migration_applied && !(facts.history_verified && facts.legacy_manager_record_exists) { + return CustomRolePreflightDecision::RefuseUnverifiedCustomRoleHistory; + } + + // The access-permission migration is ordered immediately after the membership access_all drop. + // A database carrying the later ledger entry while the drop is still pending is not a harmless + // gap: SQLite's portable drop rebuild has a fixed pre-access-permissions column list and would + // destroy those three columns and their values. Diesel would then skip the already-recorded + // migration that adds them. Refuse the non-prefix ledger before any automatic MySQL repair or + // pending migration can mutate the database. + if facts.access_permissions_migration_applied && !facts.access_all_drop_migration_applied { + return CustomRolePreflightDecision::RefuseOutOfOrderAccessPermissionsMigration; + } + + // Automatic MySQL repairs are mutations. Remember a repairable state here, but do not select it + // until every refusal below has been evaluated. In particular, recording a missing ledger row or + // completing 0716 before discovering another damaged permission group (or an unanswered owner + // decision) would make the eventual "Nothing has been changed" refusal false. + let mut automatic_repair = None; + if facts.repair_migration_applied { // The drop is a single statement with no data component, so it is all-or-nothing: either the // column is still there and the migration is pending, or the column is gone and the // migration is recorded. if facts.access_all_column_exists == facts.access_all_drop_migration_applied { - return if facts.access_all_drop_migration_applied { - CustomRolePreflightDecision::RefuseAccessAllDropLedgerMismatch + if facts.access_all_drop_migration_applied { + return CustomRolePreflightDecision::RefuseAccessAllDropLedgerMismatch; } else if can_complete_mysql_partial_migration { // Only reachable on MySQL/MariaDB, and the schema is already in its intended final - // state -- just record the migration instead of stopping the operator. - CustomRolePreflightDecision::CompleteInterruptedAccessAllDrop + // state. Defer recording the migration until every refusal has been checked. + automatic_repair = Some(CustomRolePreflightDecision::CompleteInterruptedAccessAllDrop); } else { - CustomRolePreflightDecision::RefuseInterruptedAccessAllDrop - }; + return CustomRolePreflightDecision::RefuseInterruptedAccessAllDrop; + } } } else { - // Once access_all has been dropped, its former value and the provenance of 0/1/1 - // collection permissions can no longer be reconstructed. Never guess at either. + // Once access_all has been dropped, its former value can no longer be reconstructed. Never + // guess at it. if facts.access_all_drop_migration_applied { return CustomRolePreflightDecision::RefuseAlreadyDropped; } @@ -691,8 +991,15 @@ fn custom_role_preflight_decision( return CustomRolePreflightDecision::RefuseMissingAccessAll; } - if facts.ambiguous_direct_permission_count != 0 && !facts.same_run_0716_marker { - return CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions; + // A plain User carrying membership `access_all` has no representation in the new model: the + // bit gave unlimited *reach* over every collection, present and future, without any + // management authority, and the role that replaces it cannot express that. Converting the + // reach into direct per-collection assignments would silently turn a dynamic guarantee into a + // point-in-time snapshot, and -- because a `users_collections` row is not bound to the + // membership status the way `access_all` was -- would hand a revoked or never-confirmed member + // durable assignments that outlive this schema. Refuse and let an owner decide. + if facts.legacy_user_access_all_count != 0 { + return CustomRolePreflightDecision::RefuseLegacyUserAccessAll; } } @@ -704,15 +1011,35 @@ fn custom_role_preflight_decision( for group in [PermissionColumnGroup::Manage, PermissionColumnGroup::Collection, PermissionColumnGroup::Access] { match facts.permission_columns(group) { (0, false) | (3, true) => {} - (3, false) if group == PermissionColumnGroup::Collection && can_complete_mysql_partial_migration => { - return CustomRolePreflightDecision::CompleteMysqlCollectionMigration; + (3, false) + if group == PermissionColumnGroup::Collection + && can_complete_mysql_partial_migration + && !facts.repair_migration_applied + && facts.access_all_column_exists => + { + // This is the historical MySQL 0716 partial state: its DDL committed, while the + // ledger and the later 0723 repair are both still pending. `access_all` is required + // by both the validation and completion queries. Merely remember the repair here so + // a later permission group or the permanent-authority decision can still refuse + // without any preceding mutation. + automatic_repair = Some(CustomRolePreflightDecision::CompleteMysqlCollectionMigration); } (_, true) => return CustomRolePreflightDecision::RefusePermissionLedgerMismatch(group), _ => return CustomRolePreflightDecision::RefusePartialPermissionSchema(group), } } - CustomRolePreflightDecision::Proceed + // Last, because it is the only refusal that is not about a damaged database: the schema is fine + // and the upgrade is ready to run, but one step of it changes a meaning that nothing in the new + // model can express, and that is an owner's decision rather than a migration's. Checked here + // rather than left to the migration's own guard so the question arrives with the review query + // and the acknowledgement attached — Diesel would surface that guard as nothing but its + // driver-level duplicate-key error. + if needs_permanent_collection_authority_decision(facts) { + return CustomRolePreflightDecision::RefuseUnconfirmedPermanentCollectionAuthority; + } + + automatic_repair.unwrap_or(CustomRolePreflightDecision::Proceed) } fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: CustomRoleMigrationFacts) -> Error { @@ -732,11 +1059,37 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus Refusing to guess which schema and data migrations were previously applied." .to_owned() } - CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions => format!( - "Found {} membership(s) with an ambiguous 0/1/1 collection-permission pattern. It is \ - not possible to distinguish an older group-derived backfill from an intentional \ - direct Edit+Delete assignment.", - facts.ambiguous_direct_permission_count + CustomRolePreflightDecision::RefuseLegacyUserAccessAll => format!( + "Found {} membership(s) of the plain User type carrying the legacy access_all bit. That \ + combination has no representation in the Custom role model: it grants dynamic reach over \ + every collection without any management authority.", + facts.legacy_user_access_all_count + ), + CustomRolePreflightDecision::RefuseUnverifiedCustomRoleHistory => format!( + "Migration {CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION} is recorded, but the tables it \ + creates today are not both present ({CUSTOM_ROLE_LEGACY_MANAGER_TABLE}: {}, \ + {CUSTOM_ROLE_HISTORY_VERIFIED_TABLE}: {}). This database was upgraded by an earlier \ + revision of the Custom-role change, whose migrations had different effects and which \ + Diesel will not re-run.", + if facts.legacy_manager_record_exists { + "present" + } else { + "missing" + }, + if facts.history_verified { + "present" + } else { + "missing" + } + ), + CustomRolePreflightDecision::RefuseUnconfirmedPermanentCollectionAuthority => format!( + "Migration {CONFIRM_PERMANENT_AUTHORITY_MIGRATION} needs a decision before it can run: {} \ + membership(s) match collection authority that may have come from an organization-local \ + access_all group. The current permissions cannot distinguish every group-derived grant \ + from independently changed or legacy membership-level authority, so the check is \ + deliberately conservative rather than silently making a possible group-derived grant \ + permanent. Nothing has been changed.", + facts.unconfirmed_permanent_authority_count ), CustomRolePreflightDecision::RefusePartialPermissionSchema(group) => format!( "Found {} of the three {} columns ({}) without a completed {} migration. The migration \ @@ -762,6 +1115,12 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus "Migration {DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION} is recorded, but the membership \ access_all column still exists. Schema and migration ledger disagree." ), + CustomRolePreflightDecision::RefuseOutOfOrderAccessPermissionsMigration => format!( + "Migration {CUSTOM_ACCESS_PERMISSIONS_MIGRATION} is recorded while its required earlier \ + migration {DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION} is not. The Custom-role migration ledger \ + is not a valid prefix, and continuing could destroy stored access-permission values. \ + Nothing has been changed." + ), CustomRolePreflightDecision::Proceed | CustomRolePreflightDecision::CompleteMysqlCollectionMigration | CustomRolePreflightDecision::CompleteInterruptedAccessAllDrop => { @@ -769,12 +1128,27 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus } }; let recovery = match decision { - CustomRolePreflightDecision::RefuseAmbiguousDirectPermissions => AMBIGUOUS_DIRECT_PERMISSIONS_RECOVERY_SQL, - CustomRolePreflightDecision::RefusePartialPermissionSchema(_) - | CustomRolePreflightDecision::RefusePermissionLedgerMismatch(_) => PARTIAL_PERMISSION_COLUMNS_RECOVERY, + CustomRolePreflightDecision::RefuseLegacyUserAccessAll => LEGACY_USER_ACCESS_ALL_RECOVERY, + CustomRolePreflightDecision::RefuseUnverifiedCustomRoleHistory => UNVERIFIED_CUSTOM_ROLE_HISTORY_RECOVERY, + CustomRolePreflightDecision::RefuseUnconfirmedPermanentCollectionAuthority => { + PERMANENT_COLLECTION_AUTHORITY_RECOVERY + } + // Once access_all is gone, the collection group's migration can no longer run at all, so + // neither of the two generic texts may be handed out -- both end in a replay. + CustomRolePreflightDecision::RefusePartialPermissionSchema(group) + | CustomRolePreflightDecision::RefusePermissionLedgerMismatch(group) + if group.reads_legacy_access_all() && !facts.access_all_column_exists => + { + COLLECTION_PERMISSIONS_AFTER_DROP_RECOVERY + } + CustomRolePreflightDecision::RefusePartialPermissionSchema(_) => PARTIAL_PERMISSION_COLUMNS_RECOVERY, + CustomRolePreflightDecision::RefusePermissionLedgerMismatch(_) => PERMISSION_LEDGER_MISMATCH_RECOVERY, CustomRolePreflightDecision::RefuseAlreadyDropped => ALREADY_DROPPED_RECOVERY, CustomRolePreflightDecision::RefuseInterruptedAccessAllDrop => INTERRUPTED_ACCESS_ALL_DROP_RECOVERY, CustomRolePreflightDecision::RefuseAccessAllDropLedgerMismatch => ACCESS_ALL_DROP_MISMATCH_RECOVERY, + CustomRolePreflightDecision::RefuseOutOfOrderAccessPermissionsMigration => { + OUT_OF_ORDER_ACCESS_PERMISSIONS_RECOVERY + } _ => "", }; @@ -785,25 +1159,166 @@ fn custom_role_preflight_error(decision: CustomRolePreflightDecision, facts: Cus .into() } +/// Counts the memberships {`CONFIRM_PERMANENT_AUTHORITY_MIGRATION`} will refuse to convert without an +/// owner's acknowledgement — from whichever schema shape the database has *right now*. +/// +/// Two broad shapes, because the preflight runs before any migration does and the answer has to be +/// the same either way: +/// +/// * **After the collection columns exist** the authority is already materialized, so this is the +/// migration's own predicate verbatim. `create_new_collections` is deliberately not used as a +/// provenance proxy: owners can change that independent permission after an earlier revision +/// materialized group-derived edit/delete, so its current value cannot prove where those two +/// permissions came from. Keeping the two predicates textually parallel is the point. +/// * **Before them** — the ordinary upgrade from a release without this feature — the columns are +/// not there yet and the answer has to be predicted from the legacy schema. `atype = 3` is the +/// retired Manager role, which {`CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION`} both records and +/// converts to Custom. Between the two migrations `atype = 4` rows can exist without the columns; +/// they are only attributable through the record, which is guaranteed to be present by then (the +/// history refusal above requires it whenever `20260630120000` is recorded). A Manager that also +/// carried membership `access_all` is conservatively included: asking an owner again is safer than +/// treating a mutable modern permission as immutable historical evidence. An unrecorded Custom +/// membership carrying `access_all` is included too: 0716 will turn that stored bit into 1/1/1, +/// which the later materialized guard will preserve and ask about if the membership is also in an +/// organization-local `access_all` group. +/// +/// `groups` is the backend's quoting of the reserved identifier. Returns `None` when neither shape is +/// readable, which is also exactly when the migration cannot run yet. +#[expect( + clippy::fn_params_excessive_bools, + reason = "These independent booleans describe historical schema and migration-ledger facts" +)] +fn permanent_authority_lookahead_query( + collection_columns_present: bool, + access_all_column_exists: bool, + legacy_manager_record_exists: bool, + collection_permissions_migration_applied: bool, + repair_migration_applied: bool, + groups: &str, +) -> Option { + let in_access_all_group = format!( + "EXISTS ( \ + SELECT 1 \ + FROM groups_users AS gu \ + INNER JOIN {groups} AS g ON g.uuid = gu.groups_uuid \ + WHERE gu.users_organizations_uuid = uo.uuid \ + AND g.organizations_uuid = uo.org_uuid \ + AND g.access_all = TRUE \ + )" + ); + let on_record = format!("uo.uuid IN (SELECT users_organizations_uuid FROM {CUSTOM_ROLE_LEGACY_MANAGER_TABLE})"); + + if collection_columns_present && collection_permissions_migration_applied && repair_migration_applied { + // Do not infer provenance from `create_new_collections`. It is an independently mutable + // permission, so an owner can turn a group-derived 0/1/1 grant into 1/1/1 after an earlier + // revision ran. Excluding that current shape would silently accept the very permanent + // edit/delete authority this question exists to review. Conservatively ask about every + // materialized edit/delete grant that still has the qualifying group relationship. + Some(format!( + "SELECT COUNT(*) AS count FROM users_organizations AS uo \ + WHERE uo.atype = 4 \ + AND (uo.edit_any_collection = TRUE OR uo.delete_any_collection = TRUE) \ + AND {in_access_all_group}" + )) + } else if access_all_column_exists { + // This branch also covers both historical states in which the columns exist but the repair is + // still pending: MySQL DDL committed without the 0716 ledger, or an earlier recorded 0716 did + // not contain today's group update. In either case 20260723120000 will materialize the + // provenance-bound group authority. 0716 also turns an unrecorded Custom membership's own + // `access_all` bit into 1/1/1. Project both end states instead of trusting temporary 0/0/0 + // values, so the owner is asked before any automatic completion or pending migration. + let pending_conversion = if legacy_manager_record_exists { + format!( + "(uo.atype = 3 OR (uo.atype = 4 AND \ + ({on_record} OR uo.access_all = TRUE)))" + ) + } else { + "(uo.atype = 3 OR (uo.atype = 4 AND uo.access_all = TRUE))".to_owned() + }; + // When the collection columns already exist, also retain any materialized Custom grant that + // is not part of the legacy-Manager record. The pending repair does not create that grant, but + // the later confirmation migration will still preserve it permanently. `OR` keeps both sets + // in one membership-level count without double-counting recorded rows that already have 0/1/1. + let pending_or_materialized_authority = if collection_columns_present { + format!( + "({pending_conversion} OR (uo.atype = 4 AND \ + (uo.edit_any_collection = TRUE OR uo.delete_any_collection = TRUE)))" + ) + } else { + pending_conversion + }; + Some(format!( + "SELECT COUNT(*) AS count FROM users_organizations AS uo \ + WHERE {pending_or_materialized_authority} \ + AND {in_access_all_group}" + )) + } else { + None + } +} + +/// Requires every existing relation the PostgreSQL preflight and migration chain share to resolve to +/// the schema in which unqualified `CREATE TABLE` statements will create new bookkeeping objects. +/// +/// `to_regclass` correctly follows `search_path` for an existing relation, but `CREATE TABLE` uses +/// `current_schema()`. With `search_path = decoy, real` and Vaultwarden's tables in `real`, reading the +/// former while creating provenance in the latter splits one migration across schemas. Returning one +/// row is the only safe shape; zero means the caller must refuse before any migration runs. +#[cfg(any(postgresql, test))] +const fn postgresql_migration_namespace_query() -> &'static str { + "SELECT COUNT(*) AS count \ + FROM pg_class AS memberships \ + INNER JOIN pg_namespace AS current_ns ON current_ns.nspname = current_schema() \ + WHERE memberships.oid = to_regclass('users_organizations') \ + AND memberships.relnamespace = current_ns.oid \ + AND NOT EXISTS ( \ + SELECT 1 \ + FROM (VALUES \ + ('__diesel_schema_migrations'), \ + ('groups'), \ + ('groups_users'), \ + ('__vw_custom_role_legacy_manager'), \ + ('__vw_custom_role_history_verified'), \ + ('__vw_custom_role_same_run_0716'), \ + ('__vw_ack_permanent_collection_authority') \ + ) AS relation(name) \ + INNER JOIN pg_class AS resolved ON resolved.oid = to_regclass(relation.name) \ + WHERE resolved.relnamespace <> memberships.relnamespace \ + )" +} + +/// The shapes a half-applied {`CUSTOM_COLLECTION_PERMISSIONS_MIGRATION`} may legitimately have left +/// behind, expressed as a count of the rows that have any *other* shape. +/// +/// `allow_same_run_group_derived` additionally permits the result of that migration's second data +/// statement. That statement is driven by {`CUSTOM_ROLE_LEGACY_MANAGER_TABLE`}, so the allowance +/// carries the same condition: a 0/1/1 row belonging to a membership that is *not* on record as a +/// legacy Manager cannot have come from the migration that ships today, and counting it as expected +/// would let the automatic recovery adopt a grant nothing can account for. The caller therefore only +/// passes `true` when that record actually exists — without it the shape is undecidable, and the +/// recovery refuses rather than guessing. #[cfg(any(mysql, test))] fn mysql_partial_unexpected_values_query(allow_same_run_group_derived: bool) -> String { let same_run_group_derived = if allow_same_run_group_derived { - " OR \ - (atype = 4 \ - AND access_all = FALSE \ - AND create_new_collections = FALSE \ - AND edit_any_collection = TRUE \ - AND delete_any_collection = TRUE \ - AND EXISTS ( \ - SELECT 1 \ - FROM groups_users AS gu \ - INNER JOIN `groups` AS g ON g.uuid = gu.groups_uuid \ - WHERE gu.users_organizations_uuid = users_organizations.uuid \ - AND g.organizations_uuid = users_organizations.org_uuid \ - AND g.access_all = TRUE \ - ))" + format!( + " OR \ + (atype = 4 \ + AND access_all = FALSE \ + AND create_new_collections = FALSE \ + AND edit_any_collection = TRUE \ + AND delete_any_collection = TRUE \ + AND uuid IN (SELECT users_organizations_uuid FROM {CUSTOM_ROLE_LEGACY_MANAGER_TABLE}) \ + AND EXISTS ( \ + SELECT 1 \ + FROM groups_users AS gu \ + INNER JOIN `groups` AS g ON g.uuid = gu.groups_uuid \ + WHERE gu.users_organizations_uuid = users_organizations.uuid \ + AND g.organizations_uuid = users_organizations.org_uuid \ + AND g.access_all = TRUE \ + ))" + ) } else { - "" + String::new() }; format!( @@ -911,26 +1426,44 @@ mod sqlite_migrations { let access_all_drop_migration_applied = migration_table_exists && migration_applied(connection, super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION)?; let same_run_marker_table_exists = table_exists(connection, super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE)?; + let legacy_manager_record_exists = table_exists(connection, super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE)?; + let history_verified = table_exists(connection, super::CUSTOM_ROLE_HISTORY_VERIFIED_TABLE)?; let same_run_0716_marker = same_run_marker_table_exists && count( connection, format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), )? != 0; - let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { + // Status is deliberately not part of this count: an invited, accepted or revoked membership + // carrying the bit is exactly the state that must never become durable direct assignments, so + // it has to stop the upgrade as well. + let legacy_user_access_all_count = if access_all_column_exists { count( connection, "SELECT COUNT(*) AS count FROM users_organizations \ - WHERE atype IN (3, 4) \ - AND access_all = FALSE \ - AND create_new_collections = FALSE \ - AND edit_any_collection = TRUE \ - AND delete_any_collection = TRUE", + WHERE atype = 2 \ + AND access_all = TRUE", )? } else { 0 }; + let confirm_permanent_authority_migration_applied = + migration_table_exists && migration_applied(connection, super::CONFIRM_PERMANENT_AUTHORITY_MIGRATION)?; + let permanent_collection_authority_ack = + table_exists(connection, super::PERMANENT_COLLECTION_AUTHORITY_ACK_TABLE)?; + let unconfirmed_permanent_authority_count = match super::permanent_authority_lookahead_query( + collection_permission_columns == 3, + access_all_column_exists, + legacy_manager_record_exists, + collection_permissions_migration_applied, + repair_migration_applied, + "\"groups\"", + ) { + Some(query) => count(connection, query)?, + None => 0, + }; + let facts = super::CustomRoleMigrationFacts { memberships_table_exists, migration_table_exists, @@ -943,8 +1476,13 @@ mod sqlite_migrations { access_permissions_migration_applied, repair_migration_applied, access_all_drop_migration_applied, - ambiguous_direct_permission_count, + legacy_user_access_all_count, same_run_0716_marker, + legacy_manager_record_exists, + history_verified, + confirm_permanent_authority_migration_applied, + permanent_collection_authority_ack, + unconfirmed_permanent_authority_count, }; let decision = super::custom_role_preflight_decision(facts, false); @@ -1061,8 +1599,17 @@ mod mysql_migrations { connection.transaction::<(), diesel::result::Error, _>(|connection| { // This is the first data statement from the canonical migration. It also resets an - // exact, same-run group-derived 0/1/1 row to 0/0/0; that authority remains dynamically - // derived from the group, and the separate 07-23 repair then reconciles the role. + // exact, same-run group-derived 0/1/1 row to 0/0/0. That is deliberate: this completion + // path is not where legacy group authority is decided. Nothing derives it at request + // time any more -- the live fallback is gone -- so the reset is not "the group still + // covers it"; it is "leave the columns at the value this statement defines, and let the + // repair migration re-establish the authority from the legacy-Manager record". The + // canonical file's second statement is deliberately *not* replayed here, because the + // record it has to be driven by is the same one 2026-07-23-120000 reads a moment later. + // + // The two runs therefore converge: a recorded legacy Manager in an access_all group gets + // its 0/1/1 back from 2026-07-23-120000, and a membership that is not on the record + // keeps 0/0/0 -- which is the whole point of driving the grant by provenance. diesel::sql_query( "UPDATE users_organizations \ SET create_new_collections = access_all, \ @@ -1092,19 +1639,33 @@ mod mysql_migrations { // migration would then fail with error 1091 (Unknown column) on every start. The statement // has no data component and the preflight has just confirmed the column is gone, so the // schema already is what the migration wanted: record it and let the rest of the chain run. - diesel::sql_query(format!( - "INSERT INTO __diesel_schema_migrations (version) VALUES ('{}')", - super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION - )) - .execute(connection)?; + // Do not rely on the server/session autocommit setting or on a later pending migration to + // commit this repair. With autocommit=0 and no later migration, a plain INSERT is rolled back + // when this freshly established connection closes, so every start rediscovers the same + // interrupted drop. Diesel's transaction commits the ledger entry before preflight continues. + connection.transaction::<(), diesel::result::Error, _>(|connection| { + diesel::sql_query(format!( + "INSERT INTO __diesel_schema_migrations (version) VALUES ('{}')", + super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION + )) + .execute(connection)?; + Ok(()) + })?; Ok(()) } - fn preflight(connection: &mut diesel::mysql::MysqlConnection) -> Result<(), super::Error> { + /// Read everything [`super::custom_role_preflight_decision`] answers from, once. + /// + /// Separate from `preflight` because two of its decisions repair the database instead of + /// refusing, and every fact below can change when they do. + fn inspect( + connection: &mut diesel::mysql::MysqlConnection, + ) -> Result { let memberships_table_exists = table_exists(connection, "users_organizations")?; if !memberships_table_exists { - return Ok(()); + // Nothing to read, and nothing to decide: the default answers `Proceed`. + return Ok(super::CustomRoleMigrationFacts::default()); } let migration_table_exists = table_exists(connection, "__diesel_schema_migrations")?; @@ -1141,27 +1702,45 @@ mod mysql_migrations { let access_all_drop_migration_applied = migration_table_exists && migration_applied(connection, super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION)?; let same_run_marker_table_exists = table_exists(connection, super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE)?; + let legacy_manager_record_exists = table_exists(connection, super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE)?; + let history_verified = table_exists(connection, super::CUSTOM_ROLE_HISTORY_VERIFIED_TABLE)?; let same_run_0716_marker = same_run_marker_table_exists && count( connection, format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), )? != 0; - let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { + // Status is deliberately not part of this count: an invited, accepted or revoked membership + // carrying the bit is exactly the state that must never become durable direct assignments, so + // it has to stop the upgrade as well. + let legacy_user_access_all_count = if access_all_column_exists { count( connection, "SELECT COUNT(*) AS count FROM users_organizations \ - WHERE atype IN (3, 4) \ - AND access_all = FALSE \ - AND create_new_collections = FALSE \ - AND edit_any_collection = TRUE \ - AND delete_any_collection = TRUE", + WHERE atype = 2 \ + AND access_all = TRUE", )? } else { 0 }; - let facts = super::CustomRoleMigrationFacts { + let confirm_permanent_authority_migration_applied = + migration_table_exists && migration_applied(connection, super::CONFIRM_PERMANENT_AUTHORITY_MIGRATION)?; + let permanent_collection_authority_ack = + table_exists(connection, super::PERMANENT_COLLECTION_AUTHORITY_ACK_TABLE)?; + let unconfirmed_permanent_authority_count = match super::permanent_authority_lookahead_query( + collection_permission_columns == 3, + access_all_column_exists, + legacy_manager_record_exists, + collection_permissions_migration_applied, + repair_migration_applied, + "`groups`", + ) { + Some(query) => count(connection, query)?, + None => 0, + }; + + Ok(super::CustomRoleMigrationFacts { memberships_table_exists, migration_table_exists, access_all_column_exists, @@ -1173,20 +1752,57 @@ mod mysql_migrations { access_permissions_migration_applied, repair_migration_applied, access_all_drop_migration_applied, - ambiguous_direct_permission_count, + legacy_user_access_all_count, same_run_0716_marker, - }; + legacy_manager_record_exists, + history_verified, + confirm_permanent_authority_migration_applied, + permanent_collection_authority_ack, + unconfirmed_permanent_authority_count, + }) + } - match super::custom_role_preflight_decision(facts, true) { - super::CustomRolePreflightDecision::Proceed => Ok(()), - super::CustomRolePreflightDecision::CompleteMysqlCollectionMigration => { - complete_partial_collection_migration(connection, same_run_0716_marker) - } - super::CustomRolePreflightDecision::CompleteInterruptedAccessAllDrop => { - complete_interrupted_access_all_drop(connection) + /// The two repairs below each record exactly one migration, so neither can be chosen twice. + /// The bound is not load-bearing for them -- it is there so a future repair that forgets to + /// advance the ledger cannot spin here instead of failing. + const MAX_AUTOMATIC_REPAIRS: usize = 2; + + fn preflight(connection: &mut diesel::mysql::MysqlConnection) -> Result<(), super::Error> { + // A repair is not the end of the preflight, it is the start of another pass. Both repairs + // record a migration, and 0716 completion also normalizes its permission values, so every + // fact has to be read again afterwards. `custom_role_preflight_decision` evaluates all + // refusals before it returns either repair action; the loop therefore mutates only a snapshot + // that has already passed the schema, history and owner checks, then verifies the resulting + // snapshot from scratch. + for _ in 0..=MAX_AUTOMATIC_REPAIRS { + let facts = inspect(connection)?; + match super::custom_role_preflight_decision(facts, true) { + super::CustomRolePreflightDecision::Proceed => return Ok(()), + super::CustomRolePreflightDecision::CompleteMysqlCollectionMigration => { + // The same-run allowance reads the legacy-Manager record, so it may only be + // offered when that record exists. Everywhere this decision is normally reachable + // it does -- the history refusal already requires it -- but the recovery must not + // depend on that: without the record the group-derived shape cannot be attributed + // to anything, and refusing is the correct answer. + complete_partial_collection_migration( + connection, + facts.same_run_0716_marker && facts.legacy_manager_record_exists, + )?; + } + super::CustomRolePreflightDecision::CompleteInterruptedAccessAllDrop => { + complete_interrupted_access_all_drop(connection)?; + } + decision => return Err(super::custom_role_preflight_error(decision, facts)), } - decision => Err(super::custom_role_preflight_error(decision, facts)), } + + Err(std::io::Error::other( + "Custom-role migration preflight kept finding a state it had just repaired. Each \ + automatic repair records a migration and can only apply once, so this means the ledger \ + insert did not take effect. Back up the database and resolve the partial migration \ + manually before restarting.", + ) + .into()) } pub fn run_migrations(db_url: &str) -> Result<(), super::Error> { @@ -1225,15 +1841,39 @@ mod postgresql_migrations { diesel::sql_query(query).get_result::(connection).map(|row| row.count) } + /// Resolved through `to_regclass`, i.e. exactly the way an unqualified name in a migration is + /// resolved -- and deliberately *not* through `table_schema = current_schema()`. + /// + /// `current_schema()` is the first *existing* schema on the `search_path`, which is where new + /// objects are created. It is not necessarily the schema an existing table is found in: with + /// `search_path = decoy, real` and the tables in `real`, `current_schema()` answers `decoy`, the + /// lookup finds nothing, and `preflight` returns early on `!memberships_table_exists` -- silently + /// skipping every check while Diesel then runs the migrations against `real`. `to_regclass` + /// walks the same path the migrations do, so the preflight and the statements it is guarding can + /// no longer disagree about which table they mean. (`tools/custom_role_rollback/postgresql.sql` + /// defends against the same split by binding the namespace once.) fn table_exists(connection: &mut diesel::pg::PgConnection, table: &str) -> Result { + count(connection, format!("SELECT COUNT(*) AS count FROM pg_class WHERE oid = to_regclass('{table}')")) + .map(|value| value != 0) + } + + /// Columns of `users_organizations`, resolved through the same `to_regclass` lookup as + /// [`table_exists`] so a `search_path` split cannot make the schema and the column checks + /// describe two different tables. + fn column_count( + connection: &mut diesel::pg::PgConnection, + column_list: &str, + ) -> Result { count( connection, format!( - "SELECT COUNT(*) AS count FROM information_schema.tables \ - WHERE table_schema = current_schema() AND table_name = '{table}'" + "SELECT COUNT(*) AS count FROM pg_attribute \ + WHERE attrelid = to_regclass('users_organizations') \ + AND attnum > 0 \ + AND NOT attisdropped \ + AND attname IN ({column_list})" ), ) - .map(|value| value != 0) } fn migration_applied( @@ -1257,27 +1897,23 @@ mod postgresql_migrations { } let migration_table_exists = table_exists(connection, "__diesel_schema_migrations")?; - let access_all_column_exists = count( - connection, - "SELECT COUNT(*) AS count FROM information_schema.columns \ - WHERE table_schema = current_schema() \ - AND table_name = 'users_organizations' \ - AND column_name = 'access_all'", - )? != 0; - let permission_columns = |connection: &mut diesel::pg::PgConnection, - group: super::PermissionColumnGroup| - -> Result { - count( - connection, - format!( - "SELECT COUNT(*) AS count FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = 'users_organizations' AND column_name IN ({})", - group.column_list() - ), + if migration_table_exists && count(connection, super::postgresql_migration_namespace_query())? != 1 { + return Err(std::io::Error::other( + "Custom-role migration preflight stopped startup: PostgreSQL resolves Vaultwarden's \ + existing migration relations in a different schema from current_schema(). An \ + unqualified migration would read users_organizations from one schema and create its \ + provenance or acknowledgement tables in another. Nothing has been changed. Set the \ + connection search_path so the schema containing users_organizations, groups, \ + groups_users and __diesel_schema_migrations is first, remove any shadow relations, \ + then restart.", ) - }; - let manage_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Manage)?; - let collection_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Collection)?; - let access_permission_columns = permission_columns(connection, super::PermissionColumnGroup::Access)?; + .into()); + } + let access_all_column_exists = column_count(connection, "'access_all'")? != 0; + let manage_permission_columns = column_count(connection, super::PermissionColumnGroup::Manage.column_list())?; + let collection_permission_columns = + column_count(connection, super::PermissionColumnGroup::Collection.column_list())?; + let access_permission_columns = column_count(connection, super::PermissionColumnGroup::Access.column_list())?; let manage_permissions_migration_applied = migration_table_exists && migration_applied(connection, super::CUSTOM_ROLE_MANAGE_PERMISSIONS_MIGRATION)?; @@ -1290,26 +1926,44 @@ mod postgresql_migrations { let access_all_drop_migration_applied = migration_table_exists && migration_applied(connection, super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION)?; let same_run_marker_table_exists = table_exists(connection, super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE)?; + let legacy_manager_record_exists = table_exists(connection, super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE)?; + let history_verified = table_exists(connection, super::CUSTOM_ROLE_HISTORY_VERIFIED_TABLE)?; let same_run_0716_marker = same_run_marker_table_exists && count( connection, format!("SELECT COUNT(*) AS count FROM {} WHERE marker = 1", super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE), )? != 0; - let ambiguous_direct_permission_count = if access_all_column_exists && collection_permission_columns == 3 { + // Status is deliberately not part of this count: an invited, accepted or revoked membership + // carrying the bit is exactly the state that must never become durable direct assignments, so + // it has to stop the upgrade as well. + let legacy_user_access_all_count = if access_all_column_exists { count( connection, "SELECT COUNT(*) AS count FROM users_organizations \ - WHERE atype IN (3, 4) \ - AND access_all = FALSE \ - AND create_new_collections = FALSE \ - AND edit_any_collection = TRUE \ - AND delete_any_collection = TRUE", + WHERE atype = 2 \ + AND access_all = TRUE", )? } else { 0 }; + let confirm_permanent_authority_migration_applied = + migration_table_exists && migration_applied(connection, super::CONFIRM_PERMANENT_AUTHORITY_MIGRATION)?; + let permanent_collection_authority_ack = + table_exists(connection, super::PERMANENT_COLLECTION_AUTHORITY_ACK_TABLE)?; + let unconfirmed_permanent_authority_count = match super::permanent_authority_lookahead_query( + collection_permission_columns == 3, + access_all_column_exists, + legacy_manager_record_exists, + collection_permissions_migration_applied, + repair_migration_applied, + "\"groups\"", + ) { + Some(query) => count(connection, query)?, + None => 0, + }; + let facts = super::CustomRoleMigrationFacts { memberships_table_exists, migration_table_exists, @@ -1322,8 +1976,13 @@ mod postgresql_migrations { access_permissions_migration_applied, repair_migration_applied, access_all_drop_migration_applied, - ambiguous_direct_permission_count, + legacy_user_access_all_count, same_run_0716_marker, + legacy_manager_record_exists, + history_verified, + confirm_permanent_authority_migration_applied, + permanent_collection_authority_ack, + unconfirmed_permanent_authority_count, }; let decision = super::custom_role_preflight_decision(facts, false); @@ -1345,91 +2004,1278 @@ mod postgresql_migrations { } } -#[cfg(test)] -mod custom_role_migration_preflight_tests { - use std::error::Error as _; - - use super::{ - CustomRoleMigrationFacts as Facts, CustomRolePreflightDecision as Decision, custom_role_preflight_decision, - custom_role_preflight_error, mysql_partial_unexpected_values_query, +/// Executes the real migration files against a throwaway SQLite database. +/// +/// Everything else in this file tests the *decision* the preflight makes; nothing tested the SQL the +/// decision is protecting. The one rule those files encode -- legacy authority is granted from the +/// recorded provenance, never from the shape of a membership -- is invisible to a Rust test unless +/// the statements actually run, and it is a rule that was already lost once: `2026-07-16-120000` +/// kept granting `edit_any_collection` / `delete_any_collection` to every Custom member of an +/// `access_all` group after `2026-07-23-120000` and `2026-08-09-120000` had been narrowed to the +/// record. `edit_any_collection` satisfies `has_full_access()`, so that reached every cipher in the +/// organization. +#[cfg(all(test, sqlite))] +mod custom_role_migration_sql_tests { + use diesel::connection::SimpleConnection; + use diesel::{ + Connection, RunQueryDsl, + sql_types::{BigInt, Text}, + sqlite::SqliteConnection, }; - fn pending_repair() -> Facts { - Facts { - memberships_table_exists: true, - migration_table_exists: true, - access_all_column_exists: true, - ..Facts::default() + const ADD_COLLECTION_PERMISSIONS: &str = + include_str!("../../migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql"); + const DROP_MEMBERSHIP_ACCESS_ALL: &str = + include_str!("../../migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql"); + const MATERIALIZE_GROUP_AUTHORITY: &str = + include_str!("../../migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql"); + const CONFIRM_PERMANENT_AUTHORITY: &str = + include_str!("../../migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/up.sql"); + + const HISTORY_VERIFIED: &str = " + CREATE TABLE __vw_custom_role_history_verified (verified INTEGER NOT NULL PRIMARY KEY); + "; + const PERMANENT_AUTHORITY_ACK: &str = " + CREATE TABLE __vw_ack_permanent_collection_authority (acknowledged INTEGER NOT NULL PRIMARY KEY); + "; + + /// The shape `users_organizations` has when `2026-07-16-120000` runs: `2026-06-30-120000` has + /// added the three management columns and converted `atype = 3` to `4`, and membership + /// `access_all` still exists (`2026-07-24-120000` drops it later). + const SCHEMA_BEFORE_0716: &str = " + CREATE TABLE users_organizations ( + uuid TEXT NOT NULL PRIMARY KEY, + user_uuid TEXT NOT NULL, + org_uuid TEXT NOT NULL, + access_all BOOLEAN NOT NULL DEFAULT FALSE, + akey TEXT NOT NULL DEFAULT '', + status INTEGER NOT NULL DEFAULT 2, + atype INTEGER NOT NULL, + manage_users BOOLEAN NOT NULL DEFAULT FALSE, + manage_groups BOOLEAN NOT NULL DEFAULT FALSE, + manage_policies BOOLEAN NOT NULL DEFAULT FALSE + ); + CREATE TABLE groups ( + uuid TEXT NOT NULL PRIMARY KEY, + organizations_uuid TEXT NOT NULL, + access_all BOOLEAN NOT NULL DEFAULT FALSE + ); + CREATE TABLE groups_users ( + groups_uuid TEXT NOT NULL, + users_organizations_uuid TEXT NOT NULL, + PRIMARY KEY (groups_uuid, users_organizations_uuid) + ); + "; + + const LEGACY_MANAGER_RECORD: &str = " + CREATE TABLE __vw_custom_role_legacy_manager ( + users_organizations_uuid TEXT NOT NULL PRIMARY KEY + ); + "; + + /// `users_organizations` as the release *before* this feature leaves it: membership `access_all`, + /// the retired Manager role, and none of the nine permission columns. This is the schema the + /// preflight refuses from on an ordinary upgrade, which is the common path. + const LEGACY_SCHEMA: &str = " + CREATE TABLE users_organizations ( + uuid TEXT NOT NULL PRIMARY KEY, + user_uuid TEXT NOT NULL, + org_uuid TEXT NOT NULL, + access_all BOOLEAN NOT NULL DEFAULT FALSE, + status INTEGER NOT NULL DEFAULT 2, + atype INTEGER NOT NULL + ); + CREATE TABLE groups ( + uuid TEXT NOT NULL PRIMARY KEY, + organizations_uuid TEXT NOT NULL, + access_all BOOLEAN NOT NULL DEFAULT FALSE + ); + CREATE TABLE groups_users ( + groups_uuid TEXT NOT NULL, + users_organizations_uuid TEXT NOT NULL, + PRIMARY KEY (groups_uuid, users_organizations_uuid) + ); + "; + + /// The one membership the question is actually about, in its pre-upgrade shape. + const LEGACY_GROUP_DERIVED_MANAGER: &str = " + INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES ('g_all', 'org', TRUE); + INSERT INTO users_organizations (uuid, user_uuid, org_uuid, access_all, atype) VALUES + ('m_mgr', 'u1', 'org', FALSE, 3); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) VALUES ('g_all', 'm_mgr'); + "; + + /// Two memberships that are byte-identical in role and group membership and differ only in their + /// recorded provenance, plus a recorded Manager that is in no group at all. + const MEMBERSHIPS: &str = " + INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES ('g_all', 'org', TRUE); + INSERT INTO users_organizations (uuid, user_uuid, org_uuid, access_all, atype) VALUES + ('m_recorded', 'u1', 'org', FALSE, 4), + ('m_unrecorded', 'u2', 'org', FALSE, 4), + ('m_no_group', 'u3', 'org', FALSE, 4); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) VALUES + ('g_all', 'm_recorded'), + ('g_all', 'm_unrecorded'); + "; + + #[derive(diesel::QueryableByName)] + struct Count { + #[diesel(sql_type = BigInt)] + count: i64, + } + + #[derive(diesel::QueryableByName)] + struct ReviewMembership { + #[diesel(sql_type = Text)] + uuid: String, + } + + fn count(connection: &mut SqliteConnection, query: &str) -> i64 { + diesel::sql_query(query).get_result::(connection).map(|row| row.count).unwrap() + } + + fn collection_permissions(connection: &mut SqliteConnection, membership: &str) -> (bool, bool, bool) { + let flag = |connection: &mut SqliteConnection, column: &str| { + count( + connection, + &format!( + "SELECT COUNT(*) AS count FROM users_organizations \ + WHERE uuid = '{membership}' AND {column} = TRUE" + ), + ) != 0 + }; + ( + flag(connection, "create_new_collections"), + flag(connection, "edit_any_collection"), + flag(connection, "delete_any_collection"), + ) + } + + fn connect(setup: &[&str]) -> SqliteConnection { + let mut connection = SqliteConnection::establish(":memory:").unwrap(); + for statements in setup { + connection.batch_execute(statements).unwrap(); + } + connection + } + + /// Everything up to and including `2026-07-16-120000`, so the collection permission columns hold + /// whatever the real migration put there. `record` lists the memberships written to + /// {`CUSTOM_ROLE_LEGACY_MANAGER_TABLE`} before it runs, which is what `2026-06-30-120000` does. + /// + /// `access_all` is left in place; `2026-07-24-120000` drops it, but neither of the two migrations + /// under test reads it and keeping it makes the fixtures legible. + fn connect_after_0716(memberships: &str, record: &[&str]) -> SqliteConnection { + let mut connection = connect(&[SCHEMA_BEFORE_0716, LEGACY_MANAGER_RECORD, memberships]); + for uuid in record { + connection + .batch_execute(&format!( + "INSERT INTO __vw_custom_role_legacy_manager (users_organizations_uuid) VALUES ('{uuid}')" + )) + .unwrap(); } + connection.batch_execute(ADD_COLLECTION_PERMISSIONS).unwrap(); + connection + } + + fn table_exists(connection: &mut SqliteConnection, table: &str) -> bool { + count( + connection, + &format!("SELECT COUNT(*) AS count FROM sqlite_master WHERE type = 'table' AND name = '{table}'"), + ) != 0 + } + + /// What the startup preflight would answer for this database, through the very query it uses. + fn lookahead_count(connection: &mut SqliteConnection) -> i64 { + let record = table_exists(connection, super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE); + let query = super::permanent_authority_lookahead_query(true, true, record, true, true, "\"groups\"") + .expect("the collection columns exist in these fixtures"); + count(connection, &query) } + /// Membership `access_all` is a stored value, not a shape, so it carries its own evidence and is + /// converted for every Custom member that holds it. #[test] - fn empty_database_can_run_normal_migrations() { - assert_eq!(custom_role_preflight_decision(Facts::default(), false), Decision::Proceed); + fn membership_access_all_becomes_all_three_collection_permissions() { + let mut connection = connect(&[SCHEMA_BEFORE_0716, LEGACY_MANAGER_RECORD, MEMBERSHIPS]); + connection + .batch_execute("UPDATE users_organizations SET access_all = TRUE WHERE uuid = 'm_unrecorded'") + .unwrap(); + + connection.batch_execute(ADD_COLLECTION_PERMISSIONS).unwrap(); + + assert_eq!(collection_permissions(&mut connection, "m_unrecorded"), (true, true, true)); } + /// 20260630120000 was available before 20260716120000, so this is a legitimate feature-branch + /// upgrade prefix: Managers are already converted and recorded, while a newer, unrecorded Custom + /// membership still carries its own legacy access_all bit and the collection columns are pending. + /// 0716 will turn that bit into 1/1/1, after which the conservative 0810 guard asks about it when + /// it also belongs to an organization-local access_all group. The startup lookahead must agree + /// before either migration runs, and its recovery query has to be executable on this exact shape. #[test] - fn existing_schema_without_a_ledger_is_not_guessed() { + fn ledgered_0630_unrecorded_custom_access_all_matches_the_later_guard() { + let mut connection = connect(&[ + SCHEMA_BEFORE_0716, + LEGACY_MANAGER_RECORD, + HISTORY_VERIFIED, + "CREATE TABLE __diesel_schema_migrations (version TEXT NOT NULL PRIMARY KEY); + INSERT INTO __diesel_schema_migrations (version) VALUES ('20260630120000'); + INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES ('g_all', 'org', TRUE); + INSERT INTO users_organizations (uuid, user_uuid, org_uuid, access_all, atype) + VALUES ('m_custom', 'u1', 'org', TRUE, 4); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) + VALUES ('g_all', 'm_custom');", + ]); + let lookahead = super::permanent_authority_lookahead_query(false, true, true, false, false, "\"groups\"") + .expect("access_all makes the pending 0716 result projectable"); + assert_eq!(count(&mut connection, &lookahead), 1); + + let review = "SELECT uo.uuid, uo.user_uuid, uo.org_uuid, uo.status, uo.access_all, + (uo.uuid IN (SELECT users_organizations_uuid + FROM __vw_custom_role_legacy_manager)) AS was_legacy_manager + FROM users_organizations uo + WHERE (uo.atype = 3 OR (uo.atype = 4 AND ( + uo.access_all = TRUE OR uo.uuid IN ( + SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager)))) + AND EXISTS ( + SELECT 1 FROM groups_users gu + INNER JOIN \"groups\" g ON g.uuid = gu.groups_uuid + AND g.organizations_uuid = uo.org_uuid + WHERE gu.users_organizations_uuid = uo.uuid AND g.access_all = TRUE)"; + let rows = diesel::sql_query(review).load::(&mut connection).unwrap(); + assert_eq!(rows.len(), 1); + assert_eq!(rows[0].uuid, "m_custom"); + assert!(super::PERMANENT_COLLECTION_AUTHORITY_RECOVERY.contains("If 20260630120000 is already")); + assert!(super::PERMANENT_COLLECTION_AUTHORITY_RECOVERY.contains("uo.access_all = TRUE OR uo.uuid IN")); + + connection.batch_execute(ADD_COLLECTION_PERMISSIONS).unwrap(); + assert_eq!(collection_permissions(&mut connection, "m_custom"), (true, true, true)); + assert!( + connection.batch_execute(CONFIRM_PERMANENT_AUTHORITY).is_err(), + "the preflight projection and the real 0810 guard must agree" + ); + } + + #[test] + fn out_of_order_access_permissions_would_be_destroyed_by_the_pending_sqlite_rebuild() { + let mut connection = connect_after_0716(MEMBERSHIPS, &["m_recorded"]); + connection + .batch_execute( + "CREATE TABLE users (uuid TEXT NOT NULL PRIMARY KEY); + CREATE TABLE organizations (uuid TEXT NOT NULL PRIMARY KEY); + INSERT INTO users (uuid) VALUES ('u1'), ('u2'), ('u3'); + INSERT INTO organizations (uuid) VALUES ('org'); + ALTER TABLE users_organizations ADD COLUMN reset_password_key TEXT; + ALTER TABLE users_organizations ADD COLUMN external_id TEXT; + ALTER TABLE users_organizations ADD COLUMN invited_by_email TEXT DEFAULT NULL; + ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE; + ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE; + ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE; + UPDATE users_organizations + SET access_event_logs = TRUE, access_import_export = TRUE, access_reports = TRUE + WHERE uuid = 'm_recorded';", + ) + .unwrap(); + assert_eq!( - custom_role_preflight_decision( - Facts { - memberships_table_exists: true, - access_all_column_exists: true, - ..Facts::default() - }, - false, + count( + &mut connection, + "SELECT COUNT(*) AS count FROM users_organizations + WHERE uuid = 'm_recorded' + AND access_event_logs = TRUE + AND access_import_export = TRUE + AND access_reports = TRUE" ), - Decision::RefuseMissingMigrationLedger + 1, + "the historical later migration can hold live grants" ); - } - /// A database on which the whole chain has already run. - fn fully_migrated() -> Facts { - Facts { - memberships_table_exists: true, - migration_table_exists: true, - access_all_column_exists: false, - manage_permission_columns: 3, - manage_permissions_migration_applied: true, - collection_permission_columns: 3, - collection_permissions_migration_applied: true, - access_permission_columns: 3, - access_permissions_migration_applied: true, - repair_migration_applied: true, - access_all_drop_migration_applied: true, - ambiguous_direct_permission_count: 0, - same_run_0716_marker: false, - } + connection.batch_execute(DROP_MEMBERSHIP_ACCESS_ALL).unwrap(); + + assert_eq!( + count( + &mut connection, + "SELECT COUNT(*) AS count FROM pragma_table_info('users_organizations') + WHERE name IN ('access_event_logs', 'access_import_export', 'access_reports')" + ), + 0, + "this pins why the preflight must refuse before running the unchanged migration file" + ); } + /// The regression this test exists for. `m_recorded` and `m_unrecorded` differ in nothing a + /// query at request time could see -- same role, same organization, same `access_all` group -- + /// so only the provenance record may decide, and it must not leak organization-wide collection + /// authority to the membership that has none. #[test] - fn repair_marker_makes_completed_state_idempotent() { - assert_eq!(custom_role_preflight_decision(fully_migrated(), false), Decision::Proceed); + fn group_derived_authority_is_granted_only_to_recorded_legacy_managers() { + let mut connection = connect(&[SCHEMA_BEFORE_0716, LEGACY_MANAGER_RECORD, MEMBERSHIPS]); + connection + .batch_execute( + "INSERT INTO __vw_custom_role_legacy_manager (users_organizations_uuid) \ + VALUES ('m_recorded'), ('m_no_group')", + ) + .unwrap(); + + connection.batch_execute(ADD_COLLECTION_PERMISSIONS).unwrap(); + + // Edit and delete, never create: creating collections historically required membership + // `access_all`, which this member does not have. + assert_eq!(collection_permissions(&mut connection, "m_recorded"), (false, true, true)); + // Not on record: identical in shape, and it gets nothing. + assert_eq!(collection_permissions(&mut connection, "m_unrecorded"), (false, false, false)); + // On record, but its authority never came from a group. + assert_eq!(collection_permissions(&mut connection, "m_no_group"), (false, false, false)); } - /// The repair migration runs *before* the access_all drop and the third permission column group, - /// so a partial state of either always carries `repair_migration_applied`. Skipping the schema - /// checks for repaired databases would make them unreachable in exactly the situation they were - /// written for. + /// Without the record the grant is undecidable, so the migration refuses -- and it has to refuse + /// *before* the `ALTER TABLE`s. On MySQL/MariaDB every one of them commits on its own, so a + /// guard placed after them would leave a half-added column group behind, which is exactly the + /// state `RefusePartialPermissionSchema` then has to talk an operator out of. #[test] - fn interrupted_migrations_after_the_repair_are_still_detected() { - // Crash after `DROP COLUMN access_all`, before the ledger insert. MySQL/MariaDB commit DDL - // implicitly, so the column is gone for good; a retry would fail with 1091. - let interrupted_drop = Facts { - access_all_drop_migration_applied: false, - access_permission_columns: 0, - access_permissions_migration_applied: false, - ..fully_migrated() - }; - assert_eq!( - custom_role_preflight_decision(interrupted_drop, true), - Decision::CompleteInterruptedAccessAllDrop, - "MySQL/MariaDB can complete this in place" - ); + fn the_migration_refuses_without_the_record_and_adds_no_column() { + let mut connection = connect(&[SCHEMA_BEFORE_0716, MEMBERSHIPS]); + + assert!(connection.batch_execute(ADD_COLLECTION_PERMISSIONS).is_err()); + assert_eq!( - custom_role_preflight_decision(interrupted_drop, false), - Decision::RefuseInterruptedAccessAllDrop, - "backends with transactional DDL cannot reach this state by themselves" + count( + &mut connection, + "SELECT COUNT(*) AS count FROM pragma_table_info('users_organizations') \ + WHERE name IN ('create_new_collections', 'edit_any_collection', 'delete_any_collection')" + ), + 0, + "the guard has to run before the ALTER TABLE statements, or MySQL keeps the partial column group" + ); + } + + /// `2026-08-09-120000` repeats the materialization for databases that already recorded + /// `2026-07-23-120000`, and it is driven by the same record for the same reason. + #[test] + fn the_repeat_materialization_is_also_bound_to_the_record() { + let mut connection = connect_after_0716(MEMBERSHIPS, &["m_recorded", "m_no_group"]); + connection.batch_execute(HISTORY_VERIFIED).unwrap(); + + connection.batch_execute(MATERIALIZE_GROUP_AUTHORITY).unwrap(); + + assert_eq!(collection_permissions(&mut connection, "m_recorded"), (false, true, true)); + assert_eq!(collection_permissions(&mut connection, "m_unrecorded"), (false, false, false)); + assert_eq!(collection_permissions(&mut connection, "m_no_group"), (false, false, false)); + } + + /// Without the record the file cannot tell a converted legacy Manager from an ordinary Custom + /// member, and without the history marker nobody has said the unrecorded ones are unrecorded on + /// purpose. Granting would be a silent escalation, skipping would silently drop a capability, so + /// it stops -- and the marker itself never grants anything. + #[test] + fn the_repeat_materialization_refuses_an_unaudited_history() { + let mut refuses = connect_after_0716(MEMBERSHIPS, &["m_recorded"]); + assert!(refuses.batch_execute(MATERIALIZE_GROUP_AUTHORITY).is_err()); + + let mut audited = connect_after_0716(MEMBERSHIPS, &["m_recorded"]); + audited.batch_execute(HISTORY_VERIFIED).unwrap(); + audited.batch_execute(MATERIALIZE_GROUP_AUTHORITY).unwrap(); + assert_eq!( + collection_permissions(&mut audited, "m_unrecorded"), + (false, false, false), + "the marker settles who is undecidable, it never grants" + ); + } + + /// The one question the chain asks. `m_recorded` is the conversion it is about: its authority came + /// from the group and is about to outlive it. + /// + /// The two halves deliberately use separate connections. Every guard in this chain aborts by + /// leaving its `CREATE TEMPORARY TABLE` un-dropped, so a *retry on the same session* trips over + /// the leftover instead of the real condition. That is not reachable from Vaultwarden -- a failed + /// migration ends the process, and Diesel wraps each migration in a transaction on SQLite and + /// PostgreSQL, where temporary DDL rolls back with it -- but a test that reused the connection + /// would be asserting on the wrong error. + #[test] + fn permanent_collection_authority_needs_an_acknowledgement() { + let mut refuses = connect_after_0716(MEMBERSHIPS, &["m_recorded"]); + assert_eq!(collection_permissions(&mut refuses, "m_recorded"), (false, true, true)); + assert!(refuses.batch_execute(CONFIRM_PERMANENT_AUTHORITY).is_err()); + + // The answer lifts it, and is consumed so the next upgrade has to ask again. + let mut acknowledged = connect_after_0716(MEMBERSHIPS, &["m_recorded"]); + acknowledged.batch_execute(PERMANENT_AUTHORITY_ACK).unwrap(); + acknowledged.batch_execute(CONFIRM_PERMANENT_AUTHORITY).unwrap(); + assert!(!table_exists(&mut acknowledged, super::PERMANENT_COLLECTION_AUTHORITY_ACK_TABLE)); + + // It grants nothing and revokes nothing on the way through. + assert_eq!(collection_permissions(&mut acknowledged, "m_recorded"), (false, true, true)); + } + + /// `create_new_collections` is independently mutable. An owner can set it after an earlier + /// revision materialized a group-derived 0/1/1 grant, so the resulting 1/1/1 shape must not be + /// mistaken for immutable evidence that membership `access_all` supplied all three permissions. + #[test] + fn mutable_create_permission_does_not_hide_group_derived_authority() { + let mut connection = connect_after_0716(MEMBERSHIPS, &["m_recorded"]); + connection + .batch_execute("UPDATE users_organizations SET create_new_collections = TRUE WHERE uuid = 'm_recorded';") + .unwrap(); + assert_eq!(collection_permissions(&mut connection, "m_recorded"), (true, true, true)); + + assert!( + connection.batch_execute(CONFIRM_PERMANENT_AUTHORITY).is_err(), + "a current permission value is not historical provenance" + ); + } + + /// An unrecorded Custom member holding the permissions is *not* excluded: on a database first + /// upgraded by an earlier revision those may be the bulk grant its `20260809120000` wrote, and + /// nothing can tell them from a deliberate grant any more. + #[test] + fn an_unrecorded_grant_is_still_worth_asking_about() { + let mut connection = connect_after_0716(MEMBERSHIPS, &[]); + connection + .batch_execute( + "UPDATE users_organizations \ + SET create_new_collections = TRUE, edit_any_collection = TRUE, delete_any_collection = TRUE \ + WHERE uuid = 'm_unrecorded'", + ) + .unwrap(); + + assert!(connection.batch_execute(CONFIRM_PERMANENT_AUTHORITY).is_err()); + } + + /// The record is still a chain invariant used by repair and rollback even though the final + /// materialized-authority predicate no longer uses it to exclude rows. Refuse a damaged chain + /// explicitly rather than letting a later statement fail as `no such table`. + #[test] + fn the_confirmation_refuses_without_the_record() { + let mut connection = connect(&[SCHEMA_BEFORE_0716, LEGACY_MANAGER_RECORD, MEMBERSHIPS]); + connection.batch_execute(ADD_COLLECTION_PERMISSIONS).unwrap(); + connection.batch_execute("DROP TABLE __vw_custom_role_legacy_manager").unwrap(); + + assert!(connection.batch_execute(CONFIRM_PERMANENT_AUTHORITY).is_err()); + } + + /// A refusal is only a decision if "no" can be carried out on the schema it is printed for, and + /// this one is printed from two of them. The migrated shape was always answerable; the legacy + /// shape -- the ordinary upgrade, and the common case -- was told to clear columns that do not + /// exist there yet, so the only statement an operator could actually run was the acknowledgement. + /// + /// Both halves are checked against the recovery text itself, so a future edit that drops one of + /// the two statements fails here rather than in an operator's terminal. + #[test] + fn the_recovery_can_be_declined_on_both_schema_shapes() { + let legacy_query = super::permanent_authority_lookahead_query(false, true, false, false, false, "\"groups\"") + .expect("membership access_all is still present in the legacy fixture"); + + // 1. Legacy shape. The migrated shape's statement cannot run here at all. + let mut connection = connect(&[LEGACY_SCHEMA, LEGACY_GROUP_DERIVED_MANAGER]); + assert_eq!(count(&mut connection, &legacy_query), 1, "the fixture has to raise the question"); + assert!( + connection + .batch_execute( + "UPDATE users_organizations \ + SET edit_any_collection = FALSE, delete_any_collection = FALSE \ + WHERE uuid = 'm_mgr'" + ) + .is_err(), + "the permission columns do not exist before the upgrade -- this is why the text needs two answers" + ); + + // What the text offers instead: end the group relationship, for one membership... + let mut connection = connect(&[LEGACY_SCHEMA, LEGACY_GROUP_DERIVED_MANAGER]); + connection + .batch_execute( + "DELETE FROM groups_users \ + WHERE users_organizations_uuid = 'm_mgr' AND groups_uuid = 'g_all'", + ) + .unwrap(); + assert_eq!(count(&mut connection, &legacy_query), 0, "declining has to answer the question"); + + // ...or for the whole group at once. + let mut connection = connect(&[LEGACY_SCHEMA, LEGACY_GROUP_DERIVED_MANAGER]); + connection.batch_execute("UPDATE \"groups\" SET access_all = FALSE WHERE uuid = 'g_all'").unwrap(); + assert_eq!(count(&mut connection, &legacy_query), 0, "declining has to answer the question"); + + // 2. Migrated shape: the statement the text prints for it runs, and answers the question. + let mut connection = connect_after_0716(MEMBERSHIPS, &["m_recorded"]); + assert_eq!(lookahead_count(&mut connection), 1); + connection + .batch_execute( + "UPDATE users_organizations \ + SET edit_any_collection = FALSE, delete_any_collection = FALSE \ + WHERE uuid = 'm_recorded'", + ) + .unwrap(); + assert_eq!(lookahead_count(&mut connection), 0); + + for statement in [ + "DELETE FROM groups_users", + "UPDATE \"groups\" SET access_all = FALSE", + "SET edit_any_collection = FALSE, delete_any_collection = FALSE", + ] { + assert!( + super::PERMANENT_COLLECTION_AUTHORITY_RECOVERY.contains(statement), + "the refusal has to print `{statement}`" + ); + } + } + + /// The reason the preflight exists: it has to reach the *same* verdict as the migration, or it + /// either refuses a database the migration would have let through, or lets one through that then + /// aborts with nothing but a duplicate-key error. Checked against the real files. + #[test] + fn the_preflight_lookahead_agrees_with_the_migration() { + // (name, record contents, extra setup) -> the migration decides, the lookahead has to match. + let cases: [(&str, &[&str], &str); 5] = [ + ("group-derived conversion", &["m_recorded"], ""), + ("nothing qualifies", &["m_no_group"], ""), + ( + "membership access_all, never group-bound", + &["m_recorded"], + "UPDATE users_organizations SET create_new_collections = TRUE WHERE uuid = 'm_recorded'", + ), + ( + "bulk grant to a membership that is not on the record", + &[], + "UPDATE users_organizations SET edit_any_collection = TRUE WHERE uuid = 'm_unrecorded'", + ), + ( + "revoked membership: no authority today, but it would come back with one", + &["m_recorded"], + "UPDATE users_organizations SET status = -1 WHERE uuid = 'm_recorded'", + ), + ]; + + for (name, record, extra) in cases { + let mut connection = connect_after_0716(MEMBERSHIPS, record); + if !extra.is_empty() { + connection.batch_execute(extra).unwrap(); + } + + let predicted = lookahead_count(&mut connection) != 0; + let refused = connection.batch_execute(CONFIRM_PERMANENT_AUTHORITY).is_err(); + assert_eq!(predicted, refused, "preflight and migration disagree for: {name}"); + } + } +} + +/// Runs the whole Custom-role chain, then `tools/custom_role_rollback/sqlite.sql`, then the chain +/// again — against a throwaway SQLite database, with the real files on both legs. +/// +/// The round trip is the claim the rollback tooling rests on: an operator who downgrades and later +/// upgrades again has to arrive at the same permissions, or the escape hatch quietly rewrites +/// authorization. It was only ever verified by hand. +#[cfg(all(test, sqlite))] +mod custom_role_rollback_sql_tests { + use diesel::connection::SimpleConnection; + use diesel::{Connection, RunQueryDsl, sql_types::Text, sqlite::SqliteConnection}; + + /// The nine files, in the order Diesel applies them. + const CHAIN: [&str; 9] = [ + include_str!("../../migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql"), + include_str!("../../migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/up.sql"), + include_str!("../../migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/up.sql"), + include_str!("../../migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/up.sql"), + include_str!("../../migrations/sqlite/2026-07-24-120000_drop_membership_access_all/up.sql"), + include_str!("../../migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/up.sql"), + include_str!("../../migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/up.sql"), + include_str!("../../migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/up.sql"), + include_str!("../../migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/up.sql"), + ]; + const CHAIN_VERSIONS: [&str; 9] = [ + "20260630120000", + "20260715120000", + "20260716120000", + "20260723120000", + "20260724120000", + "20260724130000", + "20260724140000", + "20260809120000", + "20260810120000", + ]; + + const ROLLBACK: &str = include_str!("../../tools/custom_role_rollback/sqlite.sql"); + + const PERMANENT_AUTHORITY_ACK: &str = + "CREATE TABLE __vw_ack_permanent_collection_authority (acknowledged INTEGER NOT NULL PRIMARY KEY)"; + + /// `users_organizations` exactly as the release before this feature leaves it — the rollback + /// script checks for *precisely* eighteen columns afterwards, so a reduced fixture would not + /// exercise the check it exists for. + const UPSTREAM_SCHEMA: &str = " + CREATE TABLE __diesel_schema_migrations ( + version VARCHAR(50) NOT NULL PRIMARY KEY, + run_on TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP + ); + CREATE TABLE users_organizations ( + uuid TEXT NOT NULL PRIMARY KEY, + user_uuid TEXT NOT NULL, + org_uuid TEXT NOT NULL, + access_all BOOLEAN NOT NULL DEFAULT FALSE, + akey TEXT NOT NULL DEFAULT '', + status INTEGER NOT NULL DEFAULT 2, + atype INTEGER NOT NULL, + reset_password_key TEXT, + external_id TEXT, + invited_by_email TEXT DEFAULT NULL, + UNIQUE (user_uuid, org_uuid) + ); + CREATE TABLE groups ( + uuid TEXT NOT NULL PRIMARY KEY, + organizations_uuid TEXT NOT NULL, + access_all BOOLEAN NOT NULL DEFAULT FALSE + ); + CREATE TABLE groups_users ( + groups_uuid TEXT NOT NULL, + users_organizations_uuid TEXT NOT NULL, + PRIMARY KEY (groups_uuid, users_organizations_uuid) + ); + INSERT INTO __diesel_schema_migrations (version) VALUES ('20250109172300'); + "; + + /// One membership per legacy shape that the mapping treats differently. + const LEGACY_MEMBERSHIPS: &str = " + INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES + ('g_all', 'org', TRUE), + ('g_plain', 'org', FALSE); + INSERT INTO users_organizations (uuid, user_uuid, org_uuid, access_all, status, atype) VALUES + ('m_owner', 'u1', 'org', FALSE, 2, 0), + ('m_admin', 'u2', 'org', FALSE, 2, 1), + ('m_user', 'u3', 'org', FALSE, 2, 2), + ('m_mgr_bare', 'u4', 'org', FALSE, 2, 3), + ('m_mgr_all', 'u5', 'org', TRUE, 2, 3), + ('m_mgr_group', 'u6', 'org', FALSE, 2, 3), + ('m_mgr_gone', 'u7', 'org', FALSE, -1, 3); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) VALUES + ('g_all', 'm_mgr_group'), + ('g_all', 'm_mgr_gone'), + ('g_plain', 'm_mgr_bare'); + "; + + #[derive(diesel::QueryableByName)] + struct Row { + #[diesel(sql_type = Text)] + value: String, + } + + fn rows(connection: &mut SqliteConnection, query: &str) -> Vec { + diesel::sql_query(query).load::(connection).unwrap().into_iter().map(|row| row.value).collect() + } + + /// Every membership's role plus its nine permissions, as one comparable line each. + fn permission_state(connection: &mut SqliteConnection) -> Vec { + rows( + connection, + "SELECT uuid || ' atype=' || atype || ' status=' || status \ + || ' ' || manage_users || manage_groups || manage_policies \ + || create_new_collections || edit_any_collection || delete_any_collection \ + || access_event_logs || access_import_export || access_reports AS value \ + FROM users_organizations ORDER BY uuid", + ) + } + + fn legacy_state(connection: &mut SqliteConnection) -> Vec { + rows( + connection, + "SELECT uuid || ' atype=' || atype || ' access_all=' || access_all AS value \ + FROM users_organizations ORDER BY uuid", + ) + } + + /// Applies the chain, recording each version the way Diesel would. + fn upgrade(connection: &mut SqliteConnection) -> Result<(), diesel::result::Error> { + for (sql, version) in CHAIN.iter().zip(CHAIN_VERSIONS) { + connection.batch_execute(sql)?; + connection + .batch_execute(&format!("INSERT INTO __diesel_schema_migrations (version) VALUES ('{version}')"))?; + } + Ok(()) + } + + /// `.bail on` is a sqlite3 shell command, not SQL. Dropping it is safe here — a failing statement + /// fails the whole `batch_execute` anyway — but the assertion keeps the test honest if another + /// dot-command is ever added, because those the shell would act on and this runner would not. + fn rollback_sql() -> String { + let (dot, sql): (Vec<&str>, Vec<&str>) = ROLLBACK.lines().partition(|line| line.starts_with('.')); + assert_eq!(dot, [".bail on"], "unexpected sqlite3 shell command in the rollback script"); + sql.join("\n") + } + + fn connect() -> SqliteConnection { + connect_with(LEGACY_MEMBERSHIPS) + } + + fn connect_with(memberships: &str) -> SqliteConnection { + let mut connection = SqliteConnection::establish(":memory:").unwrap(); + connection.batch_execute("PRAGMA foreign_keys = OFF").unwrap(); + connection.batch_execute(UPSTREAM_SCHEMA).unwrap(); + connection.batch_execute(memberships).unwrap(); + connection + } + + fn count(connection: &mut SqliteConnection, query: &str) -> i64 { + rows(connection, &format!("SELECT ({query}) || '' AS value"))[0].parse().unwrap() + } + + /// The nine `down.sql` files, in the order `diesel migration revert` applies them. + const REVERT_CHAIN: [&str; 9] = [ + include_str!("../../migrations/sqlite/2026-08-10-120000_confirm_permanent_collection_authority/down.sql"), + include_str!( + "../../migrations/sqlite/2026-08-09-120000_materialize_legacy_group_collection_authority/down.sql" + ), + include_str!("../../migrations/sqlite/2026-07-24-140000_guard_custom_role_downgrade/down.sql"), + include_str!("../../migrations/sqlite/2026-07-24-130000_add_custom_access_permissions/down.sql"), + include_str!("../../migrations/sqlite/2026-07-24-120000_drop_membership_access_all/down.sql"), + include_str!("../../migrations/sqlite/2026-07-23-120000_reconcile_legacy_custom_roles/down.sql"), + include_str!("../../migrations/sqlite/2026-07-16-120000_add_custom_collection_permissions/down.sql"), + include_str!("../../migrations/sqlite/2026-07-15-120000_mark_pending_custom_collection_migration/down.sql"), + include_str!("../../migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql"), + ]; + + const DOWNGRADE_ACK: &str = + "CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY)"; + + /// The revert chain the rollback README offers as the Diesel alternative to `sqlite.sql`, run + /// end to end. It was only ever verified by hand, and it is where the acknowledgement's lifetime + /// lives: consuming it at the guard instead of at the oldest lossy step leaves every following + /// destructive revert unguarded and strands the chain halfway. + #[test] + fn the_diesel_revert_chain_runs_with_one_acknowledgement() { + let mut connection = connect(); + let before = legacy_state(&mut connection); + + connection.batch_execute(PERMANENT_AUTHORITY_ACK).unwrap(); + upgrade(&mut connection).unwrap(); + + // One decision, plus the historical provenance as the allowlist -- what the README suggests. + connection.batch_execute(DOWNGRADE_ACK).unwrap(); + connection + .batch_execute( + "CREATE TABLE __vw_rollback_manager_allowlist (users_organizations_uuid TEXT NOT NULL PRIMARY KEY); + INSERT INTO __vw_rollback_manager_allowlist (users_organizations_uuid) + SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager;", + ) + .unwrap(); + + for (step, down) in REVERT_CHAIN.iter().enumerate() { + connection.batch_execute(down).unwrap_or_else(|e| panic!("revert step {step} failed: {e}")); + } + + assert_eq!( + legacy_state(&mut connection), + before + .iter() + .map(|row| { + // Same documented exception as the standalone script: the upgrade dropped the + // column because the role already reaches every collection, so the original + // value no longer exists. + if row.starts_with("m_owner") || row.starts_with("m_admin") { + row.replace("access_all=0", "access_all=1") + } else { + row.clone() + } + }) + .collect::>(), + "the revert chain has to land on the same legacy shape as tools/custom_role_rollback/" + ); + } + + /// Without the acknowledgement the chain stops at the guard, before the first destructive step, + /// and changes nothing. + #[test] + fn the_revert_chain_stops_at_the_guard_and_mutates_nothing() { + let mut connection = connect(); + connection.batch_execute(PERMANENT_AUTHORITY_ACK).unwrap(); + upgrade(&mut connection).unwrap(); + let upgraded = permission_state(&mut connection); + + // 2026-08-10 and 2026-08-09 revert cleanly; they are no-ops by design. + connection.batch_execute(REVERT_CHAIN[0]).unwrap(); + connection.batch_execute(REVERT_CHAIN[1]).unwrap(); + assert!(connection.batch_execute(REVERT_CHAIN[2]).is_err(), "the downgrade guard has to refuse"); + + assert_eq!(permission_state(&mut connection), upgraded, "a refused revert must not mutate"); + } + + /// The migrated-schema half of this is covered in `custom_role_migration_sql_tests`. This is the + /// other half, and the one an ordinary upgrade actually meets: the preflight has to predict from + /// the *legacy* schema exactly whether the chain will stop for the permanent-authority decision. + #[test] + fn the_legacy_shape_lookahead_agrees_with_the_whole_chain() { + let query = super::permanent_authority_lookahead_query(false, true, false, false, false, "\"groups\"") + .expect("membership access_all is still present before the upgrade"); + + let cases: [(&str, &str); 5] = [ + ("group-derived Manager: the question", LEGACY_MEMBERSHIPS), + ( + "membership access_all too: conservatively ask without immutable provenance", + "INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES ('g_all', 'org', TRUE); + INSERT INTO users_organizations (uuid, user_uuid, org_uuid, access_all, status, atype) + VALUES ('m', 'u', 'org', TRUE, 2, 3); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) VALUES ('g_all', 'm');", + ), + ( + "the access_all group belongs to another organization", + "INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES ('g_all', 'other', TRUE); + INSERT INTO users_organizations (uuid, user_uuid, org_uuid, access_all, status, atype) + VALUES ('m', 'u', 'org', FALSE, 2, 3); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) VALUES ('g_all', 'm');", + ), + ( + "a plain User in the group is not converted and not asked about", + "INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES ('g_all', 'org', TRUE); + INSERT INTO users_organizations (uuid, user_uuid, org_uuid, access_all, status, atype) + VALUES ('m', 'u', 'org', FALSE, 2, 2); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) VALUES ('g_all', 'm');", + ), + ( + "an invited Manager holds nothing today, but would come back with it", + "INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES ('g_all', 'org', TRUE); + INSERT INTO users_organizations (uuid, user_uuid, org_uuid, access_all, status, atype) + VALUES ('m', 'u', 'org', FALSE, 0, 3); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) VALUES ('g_all', 'm');", + ), + ]; + + for (name, memberships) in cases { + let mut connection = connect_with(memberships); + let predicted = count(&mut connection, &query) != 0; + let refused = upgrade(&mut connection).is_err(); + assert_eq!(predicted, refused, "preflight and chain disagree on the legacy schema for: {name}"); + } + } + + #[test] + fn upgrade_rollback_and_upgrade_again_converge() { + let mut connection = connect(); + let before = legacy_state(&mut connection); + + // `m_mgr_group` and `m_mgr_gone` reach every collection through an access_all group, so the + // chain stops for the decision 2026-08-10-120000 exists to ask. + connection.batch_execute(PERMANENT_AUTHORITY_ACK).unwrap(); + upgrade(&mut connection).unwrap(); + let upgraded = permission_state(&mut connection); + + // The legacy Manager whose authority came from the group carries it in the columns now; the + // one whose membership held access_all gets all three; a bare Manager gets nothing. + assert!(upgraded.contains(&"m_mgr_group atype=4 status=2 000011000".to_owned()), "{upgraded:?}"); + assert!(upgraded.contains(&"m_mgr_all atype=4 status=2 000111000".to_owned()), "{upgraded:?}"); + assert!(upgraded.contains(&"m_mgr_bare atype=4 status=2 000000000".to_owned()), "{upgraded:?}"); + assert!(upgraded.contains(&"m_user atype=2 status=2 000000000".to_owned()), "{upgraded:?}"); + + // Roll back with the historical provenance as the allowlist, which is what the README offers + // as the starting point. + connection + .batch_execute( + "CREATE TABLE __vw_rollback_manager_allowlist (users_organizations_uuid TEXT NOT NULL PRIMARY KEY); + INSERT INTO __vw_rollback_manager_allowlist (users_organizations_uuid) + SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager;", + ) + .unwrap(); + connection.batch_execute(&rollback_sql()).unwrap(); + + assert_eq!( + legacy_state(&mut connection), + before + .iter() + .map(|row| { + // Owner and Admin always come back with access_all set: the upgrade dropped the + // column precisely because their role already reaches every collection, so the + // original value no longer exists. Documented in the rollback README. + if row.starts_with("m_owner") || row.starts_with("m_admin") { + row.replace("access_all=0", "access_all=1") + } else { + row.clone() + } + }) + .collect::>(), + "the rollback has to restore the legacy roles it was given an allowlist for" + ); + assert_eq!( + rows( + &mut connection, + "SELECT version AS value FROM __diesel_schema_migrations WHERE version >= '20260630120000'" + ), + Vec::::new(), + "the older binary must not see a ledger from the future" + ); + + // A re-upgrade has to ask again -- the acknowledgement is consumed, and a revert is not + // consent -- and then land on exactly the state it produced the first time. + assert!(upgrade(&mut connect_from(&mut connection)).is_err(), "the question has to be asked again"); + connection.batch_execute(PERMANENT_AUTHORITY_ACK).unwrap(); + upgrade(&mut connection).unwrap(); + + assert_eq!(permission_state(&mut connection), upgraded, "the round trip has to converge"); + } + + /// A second connection onto the same rolled-back content, so the "asks again" probe can fail + /// without leaving its aborted guard behind on the connection the test continues with. + fn connect_from(source: &mut SqliteConnection) -> SqliteConnection { + let mut copy = SqliteConnection::establish(":memory:").unwrap(); + copy.batch_execute("PRAGMA foreign_keys = OFF").unwrap(); + copy.batch_execute(UPSTREAM_SCHEMA).unwrap(); + copy.batch_execute("DELETE FROM __diesel_schema_migrations").unwrap(); + for statement in rows( + source, + "SELECT 'INSERT INTO users_organizations (uuid,user_uuid,org_uuid,access_all,akey,status,atype) VALUES (''' \ + || uuid || ''',''' || user_uuid || ''',''' || org_uuid || ''',' || access_all || ',''' || akey \ + || ''',' || status || ',' || atype || ')' AS value FROM users_organizations", + ) { + copy.batch_execute(&statement).unwrap(); + } + copy.batch_execute(LEGACY_GROUPS_ONLY).unwrap(); + copy + } + + const LEGACY_GROUPS_ONLY: &str = " + INSERT INTO groups (uuid, organizations_uuid, access_all) VALUES + ('g_all', 'org', TRUE), + ('g_plain', 'org', FALSE); + INSERT INTO groups_users (groups_uuid, users_organizations_uuid) VALUES + ('g_all', 'm_mgr_group'), + ('g_all', 'm_mgr_gone'), + ('g_plain', 'm_mgr_bare'); + "; + + /// The precondition is the only thing standing between a mismatched database and an irreversible + /// rewrite, so it has to refuse before touching anything. + #[test] + fn the_rollback_refuses_without_an_allowlist_and_changes_nothing() { + let mut connection = connect(); + connection.batch_execute(PERMANENT_AUTHORITY_ACK).unwrap(); + upgrade(&mut connection).unwrap(); + let upgraded = permission_state(&mut connection); + + assert!(connection.batch_execute(&rollback_sql()).is_err()); + + assert_eq!(permission_state(&mut connection), upgraded, "a refused rollback must not mutate"); + assert_eq!( + rows( + &mut connection, + "SELECT COUNT(*) || '' AS value FROM __diesel_schema_migrations WHERE version >= '20260630120000'" + ), + vec!["9".to_owned()], + "and it must not touch the ledger either" + ); + } +} + +#[cfg(test)] +mod custom_role_migration_preflight_tests { + use std::error::Error as _; + + use super::{ + CustomRoleMigrationFacts as Facts, CustomRolePreflightDecision as Decision, custom_role_preflight_decision, + custom_role_preflight_error, mysql_partial_unexpected_values_query, permanent_authority_lookahead_query, + }; + + fn pending_repair() -> Facts { + Facts { + memberships_table_exists: true, + migration_table_exists: true, + access_all_column_exists: true, + // Any database on which the chain has started under the code that ships today carries + // both of these, because its first migration writes them. Where it has not started, + // `manage_permissions_migration_applied` is false and neither is read. + legacy_manager_record_exists: true, + history_verified: true, + ..Facts::default() + } + } + + #[test] + fn empty_database_can_run_normal_migrations() { + assert_eq!(custom_role_preflight_decision(Facts::default(), false), Decision::Proceed); + } + + #[test] + fn existing_schema_without_a_ledger_is_not_guessed() { + assert_eq!( + custom_role_preflight_decision( + Facts { + memberships_table_exists: true, + access_all_column_exists: true, + ..Facts::default() + }, + false, + ), + Decision::RefuseMissingMigrationLedger + ); + } + + /// A database on which the whole chain has already run. + fn fully_migrated() -> Facts { + Facts { + memberships_table_exists: true, + migration_table_exists: true, + access_all_column_exists: false, + manage_permission_columns: 3, + manage_permissions_migration_applied: true, + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + access_permission_columns: 3, + access_permissions_migration_applied: true, + repair_migration_applied: true, + access_all_drop_migration_applied: true, + legacy_user_access_all_count: 0, + same_run_0716_marker: false, + legacy_manager_record_exists: true, + history_verified: true, + confirm_permanent_authority_migration_applied: true, + permanent_collection_authority_ack: false, + unconfirmed_permanent_authority_count: 0, + } + } + + /// A database ready for `20260810120000`, i.e. one memberships still awaiting the decision. + fn awaiting_permanent_authority_decision() -> Facts { + Facts { + confirm_permanent_authority_migration_applied: false, + permanent_collection_authority_ack: false, + unconfirmed_permanent_authority_count: 2, + ..fully_migrated() + } + } + + /// The refusal `20260810120000` exists for has to be reached *here*, with the review query and + /// the acknowledgement attached. Left to the migration's own guard it arrives as nothing but + /// `UNIQUE constraint failed: __vw_permanent_authority_guard.blocked`, on an upgrade that is + /// otherwise perfectly healthy. + #[test] + fn unconfirmed_permanent_collection_authority_is_refused_with_a_recovery_path() { + let facts = awaiting_permanent_authority_decision(); + let decision = custom_role_preflight_decision(facts, false); + assert_eq!(decision, Decision::RefuseUnconfirmedPermanentCollectionAuthority); + assert_eq!(custom_role_preflight_decision(facts, true), decision, "MySQL must not auto-complete this"); + + let error = custom_role_preflight_error(decision, facts); + let message = error.source().expect("preflight error should retain its I/O error source").to_string(); + assert!(message.contains("__vw_ack_permanent_collection_authority"), "{message}"); + assert!(message.contains("was_legacy_manager"), "{message}"); + assert!(message.contains("Nothing has been changed."), "{message}"); + // The count belongs in the message: it is what tells an operator whether the review query is + // expected to return one row or a hundred. + assert!(message.contains('2'), "{message}"); + } + + /// Three separate ways out, and each of them has to actually let the upgrade through. + #[test] + fn the_permanent_authority_question_is_asked_exactly_once() { + // The owner answered it. + assert_eq!( + custom_role_preflight_decision( + Facts { + permanent_collection_authority_ack: true, + ..awaiting_permanent_authority_decision() + }, + false, + ), + Decision::Proceed + ); + // Already answered on an earlier start: the migration is recorded, so it never runs again and + // the acknowledgement it consumed is gone. Asking a second time would deadlock the upgrade. + assert_eq!( + custom_role_preflight_decision( + Facts { + confirm_permanent_authority_migration_applied: true, + ..awaiting_permanent_authority_decision() + }, + false, + ), + Decision::Proceed + ); + // Nothing to decide -- the common case. + assert_eq!( + custom_role_preflight_decision( + Facts { + unconfirmed_permanent_authority_count: 0, + ..awaiting_permanent_authority_decision() + }, + false, + ), + Decision::Proceed + ); + } + + /// A damaged schema is the more urgent problem and its recovery is a different one, so it has to + /// be reported first. The question is only worth asking about a database that can actually run + /// the migration. + #[test] + fn a_damaged_schema_outranks_the_permanent_authority_question() { + assert_eq!( + custom_role_preflight_decision( + Facts { + access_permission_columns: 1, + access_permissions_migration_applied: false, + ..awaiting_permanent_authority_decision() + }, + false, + ), + Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Access) + ); + assert_eq!( + custom_role_preflight_decision( + Facts { + history_verified: false, + ..awaiting_permanent_authority_decision() + }, + false, + ), + Decision::RefuseUnverifiedCustomRoleHistory + ); + } + + /// The lookahead has to answer the same question before and after the columns it would rather + /// read exist, because the preflight runs before any migration does. + #[test] + fn the_permanent_authority_lookahead_reads_whichever_schema_is_present() { + let materialized = permanent_authority_lookahead_query(true, false, true, true, true, "\"groups\"").unwrap(); + assert!(materialized.contains("uo.atype = 4")); + assert!(materialized.contains("edit_any_collection = TRUE OR uo.delete_any_collection = TRUE")); + assert!(!materialized.contains("create_new_collections")); + assert!(!materialized.contains(super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE)); + + // The materialized predicate does not change with provenance availability: a mutable current + // permission is never treated as historical evidence. + let no_record = permanent_authority_lookahead_query(true, false, false, true, true, "\"groups\"").unwrap(); + assert_eq!(no_record, materialized); + + // The ordinary upgrade: nothing is materialized yet, so the answer comes from the retired + // Manager role plus the legacy bit that the first migration turns into all three permissions. + let legacy = permanent_authority_lookahead_query(false, true, false, false, false, "\"groups\"").unwrap(); + assert!(legacy.contains("uo.atype = 3")); + assert!(!legacy.contains("uo.access_all = FALSE")); + + // Both shapes bind the group to the membership's own organization. + for query in [&materialized, &no_record, &legacy] { + assert!(query.contains("g.organizations_uuid = uo.org_uuid"), "{query}"); + assert!(query.contains("g.access_all = TRUE"), "{query}"); + } + + // Neither column group is readable: the migration cannot run either, so there is nothing to + // look ahead to. + assert!(permanent_authority_lookahead_query(false, false, true, false, false, "\"groups\"").is_none()); + + // The reserved identifier is the caller's to quote. + assert!( + permanent_authority_lookahead_query(true, false, true, true, true, "`groups`") + .unwrap() + .contains("`groups`") + ); + } + + #[test] + fn repair_marker_makes_completed_state_idempotent() { + assert_eq!(custom_role_preflight_decision(fully_migrated(), false), Decision::Proceed); + } + + /// A database upgraded by an earlier revision of this feature branch carries the Custom-role + /// versions without the effects the current files have, and Diesel will not run them again. The + /// two tables the first migration creates today are the only durable evidence of that, so their + /// absence has to stop the upgrade -- before every check that assumes the chain did what it does + /// today. + #[test] + fn a_history_written_by_an_earlier_revision_is_refused() { + // Neither table: an untouched earlier-revision database. + assert_eq!( + custom_role_preflight_decision( + Facts { + legacy_manager_record_exists: false, + history_verified: false, + ..fully_migrated() + }, + false, + ), + Decision::RefuseUnverifiedCustomRoleHistory + ); + + // Recording provenance is data recovery, not an audit: writing the record table must not by + // itself pass as a review of the history that made it necessary. + assert_eq!( + custom_role_preflight_decision( + Facts { + legacy_manager_record_exists: true, + history_verified: false, + ..fully_migrated() + }, + false, + ), + Decision::RefuseUnverifiedCustomRoleHistory + ); + + // And the marker alone leaves the later migrations and the rollback scripts without the data + // they read. + assert_eq!( + custom_role_preflight_decision( + Facts { + legacy_manager_record_exists: false, + history_verified: true, + ..fully_migrated() + }, + false, + ), + Decision::RefuseUnverifiedCustomRoleHistory + ); + + // It is checked from the *first* Custom-role migration, not only from the repair one: the + // divergence starts where `atype = 3` is reused, which is before the repair runs. + assert_eq!( + custom_role_preflight_decision( + Facts { + repair_migration_applied: false, + access_all_drop_migration_applied: false, + access_all_column_exists: true, + legacy_manager_record_exists: false, + history_verified: false, + ..fully_migrated() + }, + false, + ), + Decision::RefuseUnverifiedCustomRoleHistory + ); + + // It outranks the schema/ledger checks: those describe an interrupted migration whose replay + // is safe, which is not what this database needs. + assert_eq!( + custom_role_preflight_decision( + Facts { + legacy_manager_record_exists: false, + history_verified: false, + access_all_column_exists: true, + ..fully_migrated() + }, + false, + ), + Decision::RefuseUnverifiedCustomRoleHistory + ); + + // A database that has not started the chain at all is untouched by any of this. + assert_eq!(custom_role_preflight_decision(pending_repair(), false), Decision::Proceed); + } + + /// The repair migration runs *before* the access_all drop and the third permission column group, + /// so a partial state of either always carries `repair_migration_applied`. Skipping the schema + /// checks for repaired databases would make them unreachable in exactly the situation they were + /// written for. + #[test] + fn interrupted_migrations_after_the_repair_are_still_detected() { + // Crash after `DROP COLUMN access_all`, before the ledger insert. MySQL/MariaDB commit DDL + // implicitly, so the column is gone for good; a retry would fail with 1091. + let interrupted_drop = Facts { + access_all_drop_migration_applied: false, + access_permission_columns: 0, + access_permissions_migration_applied: false, + ..fully_migrated() + }; + assert_eq!( + custom_role_preflight_decision(interrupted_drop, true), + Decision::CompleteInterruptedAccessAllDrop, + "MySQL/MariaDB can complete this in place" + ); + assert_eq!( + custom_role_preflight_decision(interrupted_drop, false), + Decision::RefuseInterruptedAccessAllDrop, + "backends with transactional DDL cannot reach this state by themselves" ); // Crash after one of the three `ADD COLUMN` statements of the access group, before the @@ -1491,6 +3337,84 @@ mod custom_role_migration_preflight_tests { ); } + #[test] + fn a_later_access_migration_before_the_pending_drop_is_refused() { + // This exact non-prefix history was deployable from the feature's former side branch: + // 20260724130000 and its columns exist, while 20260724120000 is still pending. SQLite's + // pending fixed-list rebuild would otherwise discard all three columns and their values. + for repair_migration_applied in [false, true] { + let facts = Facts { + repair_migration_applied, + access_all_column_exists: true, + access_all_drop_migration_applied: false, + access_permission_columns: 3, + access_permissions_migration_applied: true, + ..fully_migrated() + }; + let expected = Decision::RefuseOutOfOrderAccessPermissionsMigration; + + assert_eq!(custom_role_preflight_decision(facts, false), expected); + assert_eq!(custom_role_preflight_decision(facts, true), expected); + + let message = custom_role_preflight_error(expected, facts) + .source() + .expect("preflight error should retain its I/O error source") + .to_string(); + assert!(message.contains(super::CUSTOM_ACCESS_PERMISSIONS_MIGRATION), "{message}"); + assert!(message.contains(super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION), "{message}"); + assert!(message.contains("would drop access_event_logs"), "{message}"); + assert!(message.contains("Nothing has been changed"), "{message}"); + } + } + + /// A repair is selected only after the same snapshot has passed every refusal. This pins the two + /// mutation-before-refusal orders that previously existed: 0716 completion before discovering a + /// damaged later column group, and interrupted-drop ledger repair before asking the owner. + #[test] + fn automatic_mysql_repairs_are_deferred_behind_all_refusals() { + let partial_0716_with_damaged_access_group = Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: false, + access_permission_columns: 1, + access_permissions_migration_applied: false, + ..pending_repair() + }; + assert_eq!( + custom_role_preflight_decision(partial_0716_with_damaged_access_group, true), + Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Access), + "0716 must not be completed before a later schema refusal" + ); + + let interrupted_drop_with_unanswered_authority = Facts { + access_all_drop_migration_applied: false, + access_permission_columns: 0, + access_permissions_migration_applied: false, + ..awaiting_permanent_authority_decision() + }; + let decision = custom_role_preflight_decision(interrupted_drop_with_unanswered_authority, true); + assert_eq!(decision, Decision::RefuseUnconfirmedPermanentCollectionAuthority); + let message = custom_role_preflight_error(decision, interrupted_drop_with_unanswered_authority) + .source() + .expect("preflight error should retain its I/O error source") + .to_string(); + assert!(message.contains("Nothing has been changed."), "{message}"); + + // The historical partial-completion query reads access_all. Once 0723 and its following drop + // are recorded, three columns without the earlier 0716 ledger are a non-prefix mismatch, not + // the repairable pre-0723 crash state. + assert_eq!( + custom_role_preflight_decision( + Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: false, + ..fully_migrated() + }, + true, + ), + Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Collection) + ); + } + #[test] fn interrupted_access_all_drop_error_names_the_ledger_fix() { let facts = Facts { @@ -1522,24 +3446,24 @@ mod custom_role_migration_preflight_tests { } #[test] - fn ambiguous_direct_permissions_error_carries_a_recovery_path() { + fn legacy_user_access_all_error_carries_a_recovery_path() { let facts = Facts { - ambiguous_direct_permission_count: 2, + legacy_user_access_all_count: 2, ..pending_repair() }; let decision = custom_role_preflight_decision(facts, false); - assert_eq!(decision, Decision::RefuseAmbiguousDirectPermissions); + assert_eq!(decision, Decision::RefuseLegacyUserAccessAll); let error = custom_role_preflight_error(decision, facts); let message = error.source().expect("preflight error should retain its I/O error source").to_string(); assert!(message.contains("2 membership(s)")); - // The operator needs the affected memberships and their possible group source ... - assert!(message.contains("SELECT uuid, user_uuid, org_uuid, atype, status")); - assert!(message.contains("WHERE g.access_all = TRUE")); - // ... plus both decisions, and the note that keeping the grant also grants Create. - assert!(message.contains("SET edit_any_collection = FALSE,\n delete_any_collection = FALSE")); - assert!(message.contains("SET create_new_collections = TRUE")); - assert!(message.contains("also grants Create-any-collection")); + // The operator needs the affected memberships ... + assert!(message.contains("WHERE atype = 2\n AND access_all = TRUE;")); + // ... and both decisions: drop the reach, or write it out explicitly first. + assert!(message.contains("SET access_all = FALSE")); + assert!(message.contains("INSERT INTO users_collections")); + // Nothing here may present the snapshot as equivalent to the old dynamic reach. + assert!(message.contains("collections created after")); } #[test] @@ -1556,12 +3480,26 @@ mod custom_role_migration_preflight_tests { assert!(message.contains("Restore the database backup")); } - // REGRESSION: a legacy `User` membership with the historical access_all bit must NOT stop the - // upgrade. The 2026-07-23 migration materializes that reach as explicit per-collection - // assignments, so the preflight has nothing left to decide and every other fact stays untouched. + /// A legacy `User` membership carrying the historical access_all bit stops the upgrade before any + /// migration runs, whatever its status is. Converting the bit into direct per-collection + /// assignments would turn a dynamic, status-bound reach into a durable snapshot -- and those rows + /// would still be there for an older binary after a rollback, which never checked the membership + /// status on that path. #[test] - fn legacy_user_access_all_no_longer_blocks_the_upgrade() { + fn legacy_user_access_all_blocks_the_upgrade_before_any_migration() { assert_eq!(custom_role_preflight_decision(pending_repair(), false), Decision::Proceed); + + let untouched_schema = Facts { + legacy_user_access_all_count: 1, + ..pending_repair() + }; + assert_eq!( + custom_role_preflight_decision(untouched_schema, false), + Decision::RefuseLegacyUserAccessAll, + "nothing may have been migrated yet when this is refused" + ); + // MySQL/MariaDB gets no exception: no partial state may be completed past this either. + assert_eq!(custom_role_preflight_decision(untouched_schema, true), Decision::RefuseLegacyUserAccessAll); assert_eq!( custom_role_preflight_decision( Facts { @@ -1569,11 +3507,12 @@ mod custom_role_migration_preflight_tests { collection_permissions_migration_applied: true, manage_permission_columns: 3, manage_permissions_migration_applied: true, + legacy_user_access_all_count: 1, ..pending_repair() }, false, ), - Decision::Proceed + Decision::RefuseLegacyUserAccessAll ); } @@ -1622,45 +3561,116 @@ mod custom_role_migration_preflight_tests { } } + /// A group-derived legacy Manager is no longer a special case for the preflight: the repair + /// migration writes the authority into the permission columns, and nothing reads the 0/1/1 shape + /// afterwards, so no state of those columns has to be attributed or refused. #[test] - fn group_derived_zero_permissions_are_safe_but_ambiguous_direct_permissions_are_refused() { + fn a_group_derived_legacy_manager_needs_no_preflight_decision() { assert_eq!(custom_role_preflight_decision(pending_repair(), false), Decision::Proceed); - assert_eq!( - custom_role_preflight_decision( - Facts { - collection_permission_columns: 3, - collection_permissions_migration_applied: true, - ..pending_repair() - }, - false, - ), - Decision::Proceed - ); - assert_eq!( - custom_role_preflight_decision( - Facts { - collection_permission_columns: 3, - collection_permissions_migration_applied: true, - ambiguous_direct_permission_count: 1, - ..pending_repair() - }, - false, - ), - Decision::RefuseAmbiguousDirectPermissions - ); - assert_eq!( - custom_role_preflight_decision( - Facts { - collection_permission_columns: 3, - collection_permissions_migration_applied: true, - ambiguous_direct_permission_count: 1, - same_run_0716_marker: true, - ..pending_repair() - }, - false, - ), - Decision::Proceed - ); + for same_run_0716_marker in [false, true] { + assert_eq!( + custom_role_preflight_decision( + Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + same_run_0716_marker, + ..pending_repair() + }, + false, + ), + Decision::Proceed + ); + } + } + + /// The two partial-column states need opposite advice. Without the ledger entry the migration + /// never completed, so the leftovers are untouched defaults and dropping them is free. With the + /// ledger entry the migration *did* run, so the remaining columns can hold granted permissions -- + /// and dropping them alone would not even clear the refusal, because the ledger row stays. + #[test] + fn the_two_partial_column_states_get_opposite_recovery_advice() { + let interrupted = Facts { + access_permission_columns: 1, + access_permissions_migration_applied: false, + ..fully_migrated() + }; + let vanished = Facts { + access_permission_columns: 1, + access_permissions_migration_applied: true, + ..fully_migrated() + }; + + let interrupted_decision = custom_role_preflight_decision(interrupted, false); + let vanished_decision = custom_role_preflight_decision(vanished, false); + assert_eq!(interrupted_decision, Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Access)); + assert_eq!(vanished_decision, Decision::RefusePermissionLedgerMismatch(super::PermissionColumnGroup::Access)); + + let message_of = |decision| { + custom_role_preflight_error(decision, interrupted) + .source() + .expect("preflight error should retain its I/O error source") + .to_string() + }; + let interrupted_message = message_of(interrupted_decision); + let vanished_message = message_of(vanished_decision); + + assert!(interrupted_message.contains("dropping them"), "{interrupted_message}"); + assert!(!interrupted_message.contains("DELETE FROM __diesel_schema_migrations")); + + // The dangerous claim must not be repeated where it is false, and the operator has to be told + // to remove the ledger row as well if they accept the loss. + assert!(!vanished_message.contains("loses nothing"), "{vanished_message}"); + assert!(vanished_message.contains("Do not drop them"), "{vanished_message}"); + assert!(vanished_message.contains("Restoring the database backup"), "{vanished_message}"); + assert!(vanished_message.contains("DELETE FROM __diesel_schema_migrations"), "{vanished_message}"); + } + + /// Both generic texts end in the migration running again. For the collection group after the + /// access_all drop that is impossible -- 2026-07-16-120000 reads the dropped column -- so the advice + /// has to change to "reach the finished shape without executing it". + #[test] + fn the_collection_group_gets_replay_free_advice_once_access_all_is_gone() { + for (columns, applied, expected) in [ + (1, false, Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Collection)), + (1, true, Decision::RefusePermissionLedgerMismatch(super::PermissionColumnGroup::Collection)), + ] { + let facts = Facts { + collection_permission_columns: columns, + collection_permissions_migration_applied: applied, + ..fully_migrated() + }; + let decision = custom_role_preflight_decision(facts, false); + assert_eq!(decision, expected); + + let message = custom_role_preflight_error(decision, facts) + .source() + .expect("preflight error should retain its I/O error source") + .to_string(); + assert!(message.contains("cannot be migrated again on this database"), "{message}"); + assert!(message.contains("ADD COLUMN create_new_collections"), "{message}"); + assert!(message.contains("VALUES ('20260716120000')"), "{message}"); + // The replay-based advice must not leak through for this state. + assert!(!message.contains("DELETE FROM __diesel_schema_migrations"), "{message}"); + assert!(!message.contains("lets the migration run again"), "{message}"); + } + + // While access_all still exists a replay is fine, so the generic texts stay in place. + let before_drop = Facts { + access_all_column_exists: true, + access_all_drop_migration_applied: false, + access_permission_columns: 0, + access_permissions_migration_applied: false, + collection_permission_columns: 1, + collection_permissions_migration_applied: false, + ..fully_migrated() + }; + let decision = custom_role_preflight_decision(before_drop, false); + assert_eq!(decision, Decision::RefusePartialPermissionSchema(super::PermissionColumnGroup::Collection)); + let message = custom_role_preflight_error(decision, before_drop) + .source() + .expect("preflight error should retain its I/O error source") + .to_string(); + assert!(message.contains("lets the migration run again"), "{message}"); } #[test] @@ -1677,11 +3687,166 @@ mod custom_role_migration_preflight_tests { ); } + #[test] + fn mysql_partial_0716_projects_the_pending_group_authority_before_completion() { + let projected = permanent_authority_lookahead_query(true, true, true, false, false, "`groups`") + .expect("the partial schema still has access_all"); + + assert!(!projected.contains("uo.access_all = FALSE"), "{projected}"); + assert!(projected.contains(super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE), "{projected}"); + assert!(projected.contains("g.organizations_uuid = uo.org_uuid"), "{projected}"); + assert!( + projected.contains("uo.edit_any_collection = TRUE"), + "the projection must retain both pending and already-materialized grants: {projected}" + ); + + let facts = Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: false, + unconfirmed_permanent_authority_count: 1, + ..pending_repair() + }; + assert_eq!( + custom_role_preflight_decision(facts, true), + Decision::RefuseUnconfirmedPermanentCollectionAuthority, + "the owner decision must precede complete_partial_collection_migration()" + ); + + let acknowledged = Facts { + permanent_collection_authority_ack: true, + ..facts + }; + assert_eq!( + custom_role_preflight_decision(acknowledged, true), + Decision::CompleteMysqlCollectionMigration, + "the validated partial state is repairable after the owner answers" + ); + } + + /// Some earlier feature-branch snapshots recorded 0716 after adding its columns but before the + /// group-derived UPDATE was part of that migration. The later 0723 repair is what will write + /// 0/1/1 for those recorded Managers, so a recorded 0716 must not make the preflight trust the + /// temporary 0/0/0 values while that repair is still pending. + #[test] + fn recorded_old_0716_projects_the_pending_repair_before_migrations_run() { + let projected = permanent_authority_lookahead_query(true, true, true, true, false, "\"groups\"") + .expect("the pending repair can be projected from access_all and the Manager record"); + + assert!(projected.contains(super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE), "{projected}"); + assert!(projected.contains("uo.atype = 3 OR"), "{projected}"); + assert!(projected.contains("uo.edit_any_collection = TRUE"), "{projected}"); + + let facts = Facts { + manage_permission_columns: 3, + manage_permissions_migration_applied: true, + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + repair_migration_applied: false, + unconfirmed_permanent_authority_count: 1, + ..pending_repair() + }; + for mysql in [false, true] { + assert_eq!( + custom_role_preflight_decision(facts, mysql), + Decision::RefuseUnconfirmedPermanentCollectionAuthority, + "backend flag {mysql}: the owner must decide before the pending repair writes 0/1/1" + ); + } + } + + #[test] + fn interrupted_mysql_drop_repair_has_an_explicit_transaction_boundary() { + let source = include_str!("mod.rs"); + let function = source + .split_once("fn complete_interrupted_access_all_drop(") + .expect("repair function must exist") + .1 + .split_once("/// Read everything") + .expect("repair function boundary must remain recognizable") + .0; + + assert!(function.contains("connection.transaction"), "the ledger repair must commit with autocommit=0"); + assert!(function.contains("super::DROP_MEMBERSHIP_ACCESS_ALL_MIGRATION")); + } + + #[test] + fn postgresql_preflight_requires_one_migration_namespace() { + let query = super::postgresql_migration_namespace_query(); + for relation in [ + "users_organizations", + "__diesel_schema_migrations", + "groups", + "groups_users", + super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE, + super::CUSTOM_ROLE_HISTORY_VERIFIED_TABLE, + ] { + assert!(query.contains(relation), "namespace guard does not bind {relation}: {query}"); + } + assert!(query.contains("current_schema()")); + assert!(query.contains("resolved.relnamespace <> memberships.relnamespace")); + } + + /// A repair is not an answer to the permanent-authority question. Both automatic repairs are + /// deferred behind that refusal, and re-inspection after a permitted repair must reach the same + /// refusal if the database changes between the decision and the next pass. + #[test] + fn a_repair_does_not_answer_the_permanent_authority_question() { + // The interrupted drop is reachable only after the repair migration, and 20260724130000 + // cannot have run yet, so its columns are still absent on both sides of that repair. + let interrupted_drop = Facts { + access_permission_columns: 0, + access_permissions_migration_applied: false, + ..awaiting_permanent_authority_decision() + }; + + for (name, before_repair, after_repair) in [ + ( + "the historical MySQL partial collection-permission schema", + Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: false, + unconfirmed_permanent_authority_count: 2, + ..pending_repair() + }, + // complete_partial_collection_migration() records 20260716120000, nothing else. + Facts { + collection_permission_columns: 3, + collection_permissions_migration_applied: true, + unconfirmed_permanent_authority_count: 2, + ..pending_repair() + }, + ), + ( + "an access_all drop that committed without its ledger entry", + Facts { + access_all_drop_migration_applied: false, + ..interrupted_drop + }, + // complete_interrupted_access_all_drop() records 20260724120000, nothing else. + interrupted_drop, + ), + ] { + assert_eq!( + custom_role_preflight_decision(before_repair, true), + Decision::RefuseUnconfirmedPermanentCollectionAuthority, + "{name}: no repair may mutate the database before the owner decides" + ); + assert_eq!( + custom_role_preflight_decision(after_repair, true), + Decision::RefuseUnconfirmedPermanentCollectionAuthority, + "{name}: re-inspection must preserve the refusal" + ); + } + } + #[test] fn historical_mysql_partial_query_does_not_require_the_new_marker_table() { let query = mysql_partial_unexpected_values_query(false); assert!(!query.contains(super::CUSTOM_ROLE_SAME_RUN_MARKER_TABLE)); assert!(!query.contains("groups_users")); + // Without the allowance the query reads users_organizations only, so it stays answerable on + // a database that has no provenance record at all. + assert!(!query.contains(super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE)); } #[test] @@ -1695,6 +3860,22 @@ mod custom_role_migration_preflight_tests { assert!(query.contains("g.access_all = TRUE")); } + /// The allowance describes what 2026-07-16-120000 can produce, and that statement is driven by + /// the legacy-Manager record. A 0/1/1 row for a membership that is not on the record therefore + /// has no legitimate source, and must not be counted as an expected shape -- otherwise the + /// automatic MySQL recovery would adopt a grant nothing can account for. + #[test] + fn the_same_run_allowance_is_bound_to_the_legacy_manager_record() { + let query = mysql_partial_unexpected_values_query(true); + assert!( + query.contains(&format!( + "uuid IN (SELECT users_organizations_uuid FROM {})", + super::CUSTOM_ROLE_LEGACY_MANAGER_TABLE + )), + "{query}" + ); + } + #[test] fn incomplete_columns_and_ledger_mismatch_are_refused() { assert_eq!( diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs index 2c58ed66..f1faede9 100644 --- a/src/db/models/cipher.rs +++ b/src/db/models/cipher.rs @@ -25,8 +25,8 @@ use macros::UuidFromParam; use super::{ Archive, Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership, - MembershipStatus, MembershipType, OrganizationId, User, UserId, - organization::custom_membership_with_edit_any_collection, + MembershipStatus, OrganizationId, User, UserId, + organization::{ORG_ADMIN_ATYPES, custom_membership_with_edit_any_collection}, }; #[derive(Identifiable, Queryable, Insertable, AsChangeset)] @@ -893,7 +893,7 @@ impl Cipher { // Edit any collection (Custom) or org admin/owner — the successor of access_all .or_filter( custom_membership_with_edit_any_collection() - .or(users_organizations::atype.le(MembershipType::Admin as i32)), + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // Access to collection .or_filter(groups::access_all.eq(true)) // Access via groups @@ -902,7 +902,7 @@ impl Cipher { if !visible_only { query = query.or_filter( - users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner + users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner ); } @@ -934,14 +934,14 @@ impl Cipher { // Edit any collection (Custom) or org admin/owner — the successor of access_all .or_filter( custom_membership_with_edit_any_collection() - .or(users_organizations::atype.le(MembershipType::Admin as i32)), + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // Access to collection .into_boxed(); if !visible_only { query = query.or_filter( - users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner + users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner ); } @@ -1059,7 +1059,7 @@ impl Cipher { ) .filter( custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) - .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection .and(users_collections::read_only.eq(false))) @@ -1090,7 +1090,7 @@ impl Cipher { ) .filter( custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) - .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection .and(users_collections::read_only.eq(false))), @@ -1134,7 +1134,7 @@ impl Cipher { ) .filter( custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) - .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection .and(users_collections::read_only.eq(false))) @@ -1142,7 +1142,7 @@ impl Cipher { .or(collections_groups::collections_uuid .is_not_null() // Access via groups .and(collections_groups::read_only.eq(false))) - .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), // User is admin or owner ) .select(ciphers_collections::collection_uuid) .load::(conn) @@ -1166,11 +1166,11 @@ impl Cipher { ) .filter( custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) - .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // or org admin/owner .or(users_collections::user_uuid .eq(user_uuid) // User has access to collection .and(users_collections::read_only.eq(false))) - .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), // User is admin or owner ) .select(ciphers_collections::collection_uuid) .load::(conn) @@ -1212,7 +1212,7 @@ impl Cipher { ) .or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection .or_filter(custom_membership_with_edit_any_collection()) // Custom "Edit any collection" (successor of access_all) - .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner + .or_filter(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner .or_filter(groups::access_all.eq(true)) //Access via group .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group .select(ciphers_collections::all_columns) diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index e6f74557..b31ef9e8 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -19,7 +19,8 @@ use macros::UuidFromParam; use super::{ CipherId, CollectionGroup, GroupUser, Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, - User, UserId, organization::custom_membership_with_edit_any_collection, + User, UserId, + organization::{ORG_ADMIN_ATYPES, custom_membership_with_edit_any_collection}, }; // See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/AdminConsole/Entities/Collection.cs @@ -137,15 +138,9 @@ impl Collection { // for a member who already reaches every collection: full visibility is not // management authority, but it does not cancel out a real grant either. // - // A legacy organization-local `access_all` group confers collection management - // on its Custom members (see `has_legacy_group_collection_manage_access`), and - // reaches every collection without a `collections_groups` row that could carry - // the `manage` bit — so it has to be answered from the membership side. - let legacy_group_manage = m.has_type(MembershipType::Custom) - && !m.has_create_new_collections() - && !m.has_edit_any_collection() - && !m.has_delete_any_collection() - && cipher_sync_data.user_group_full_access_for_organizations.contains(&self.org_uuid); + // Reaching every collection through a group with `access_all` is deliberately not + // management authority: the guards accept an explicit + // `users_collections.manage` / `collections_groups.manage` row only. let assignment = cipher_sync_data .user_collections .get(&self.uuid) @@ -157,7 +152,7 @@ impl Collection { .map(|cg| (cg.read_only, cg.hide_passwords, cg.manage)) }); let stored_manage = assignment.is_some_and(|(_, _, manage)| manage); - let manage = legacy_group_manage || assignment_manage_for_member(m.atype, stored_manage); + let manage = assignment_manage_for_member(m.atype, stored_manage); match assignment { Some((read_only, hide_passwords, _)) if !m.has_full_access() => { (read_only, hide_passwords, manage) @@ -175,11 +170,14 @@ impl Collection { Some(m) if m.has_full_access() => ( false, false, - assignment_manage_for_member(m.atype, m.has_collection_manage_authority(&self.uuid, conn).await), + assignment_manage_for_member( + m.atype, + m.has_explicit_collection_manage_access(&self.uuid, conn).await, + ), ), Some(m) if m.atype >= MembershipType::Custom - && m.has_collection_manage_authority(&self.uuid, conn).await => + && m.has_explicit_collection_manage_access(&self.uuid, conn).await => { (false, false, true) } @@ -311,7 +309,7 @@ impl Collection { // Full-access member: Custom "Edit any collection" or org admin/owner // (successor of the removed membership access_all) custom_membership_with_edit_any_collection() - .or(users_organizations::atype.le(MembershipType::Admin as i32)), + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), ) .or( groups::access_all.eq(true), // access_all in groups @@ -348,7 +346,7 @@ impl Collection { // Full-access member: Custom "Edit any collection" or org admin/owner // (successor of the removed membership access_all) custom_membership_with_edit_any_collection() - .or(users_organizations::atype.le(MembershipType::Admin as i32)), + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), ), ) .select(collections::all_columns) @@ -436,7 +434,7 @@ impl Collection { // Directly accessed collection custom_membership_with_edit_any_collection().or( // Custom "Edit any collection" or org admin/owner (successor of access_all) - users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner + users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner ), ) .or( @@ -472,7 +470,7 @@ impl Collection { // Directly accessed collection custom_membership_with_edit_any_collection().or( // Custom "Edit any collection" or org admin/owner (successor of access_all) - users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner + users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner ), )) .select(collections::all_columns) @@ -514,7 +512,7 @@ impl Collection { ) .filter( users_organizations::atype - .le(MembershipType::Admin as i32) // Org admin or owner + .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner .or(custom_membership_with_edit_any_collection()) // Custom "Edit any collection" (successor of access_all) .or(users_collections::collection_uuid .eq(&self.uuid) // write access given to collection @@ -547,7 +545,7 @@ impl Collection { ) .filter( users_organizations::atype - .le(MembershipType::Admin as i32) // Org admin or owner + .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner .or(custom_membership_with_edit_any_collection()) // Custom "Edit any collection" (successor of access_all) .or(users_collections::collection_uuid .eq(&self.uuid) // write access given to collection @@ -597,7 +595,7 @@ impl Collection { // Directly accessed collection custom_membership_with_edit_any_collection().or( // Custom "Edit any collection" or org admin/owner (successor of access_all) - users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner + users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner ), ) .or( diff --git a/src/db/models/event.rs b/src/db/models/event.rs index 084ffd85..96991254 100644 --- a/src/db/models/event.rs +++ b/src/db/models/event.rs @@ -341,20 +341,37 @@ impl Event { pub async fn find_by_cipher_uuid( cipher_uuid: &CipherId, + org_uuid: Option<&OrganizationId>, start: &NaiveDateTime, end: &NaiveDateTime, conn: &DbConn, ) -> Vec { - conn.run(move |conn| { - event::table - .filter(event::cipher_uuid.eq(cipher_uuid)) - .filter(event::event_date.between(start, end)) - .order_by(event::event_date.desc()) - .limit(Self::PAGE_SIZE) - .load::(conn) - .expect("Error filtering events") - }) - .await + conn.run(move |conn| Self::find_by_cipher_uuid_impl(cipher_uuid, org_uuid, start, end, conn)).await + } + + fn find_by_cipher_uuid_impl( + cipher_uuid: &CipherId, + org_uuid: Option<&OrganizationId>, + start: &NaiveDateTime, + end: &NaiveDateTime, + conn: &mut crate::db::DbConnInner, + ) -> Vec { + let query = event::table + .filter(event::cipher_uuid.eq(cipher_uuid)) + .filter(event::event_date.between(start, end)) + .into_boxed(); + + // A cipher event request is authorized for exactly one scope: either the cipher's + // current organization or its personal owner. Apply that scope before PAGE_SIZE so + // rows from another scope cannot consume the page and hide older authorized events. + match org_uuid { + Some(org_uuid) => query.filter(event::org_uuid.eq(org_uuid)), + None => query.filter(event::org_uuid.is_null()), + } + .order_by(event::event_date.desc()) + .limit(Self::PAGE_SIZE) + .load::(conn) + .expect("Error filtering events") } pub async fn clean_events(conn: &DbConn) -> EmptyResult { @@ -374,3 +391,67 @@ impl Event { #[derive(Clone, Debug, DieselNewType, FromForm, Hash, PartialEq, Eq, Serialize, Deserialize)] pub struct EventId(String); + +#[cfg(all(test, sqlite))] +mod tests { + use diesel::{Connection, connection::SimpleConnection, sqlite::SqliteConnection}; + + use super::*; + use crate::db::DbConnInner; + + #[test] + fn cipher_scope_is_applied_before_the_page_limit() { + let mut conn = DbConnInner::Sqlite(SqliteConnection::establish(":memory:").unwrap()); + conn.batch_execute( + "CREATE TABLE event ( + uuid TEXT NOT NULL PRIMARY KEY, + event_type INTEGER NOT NULL, + user_uuid TEXT, + org_uuid TEXT, + cipher_uuid TEXT, + collection_uuid TEXT, + group_uuid TEXT, + org_user_uuid TEXT, + act_user_uuid TEXT, + device_type INTEGER, + ip_address TEXT, + event_date DATETIME NOT NULL, + policy_uuid TEXT, + provider_uuid TEXT, + provider_user_uuid TEXT, + provider_org_uuid TEXT + );", + ) + .unwrap(); + + // Fill an entire page with newer rows from a different scope. If scope filtering happens + // after LIMIT, the one older authorized row can never reach the API response. + for index in 0..Event::PAGE_SIZE { + conn.batch_execute(&format!( + "INSERT INTO event (uuid, event_type, org_uuid, cipher_uuid, event_date) VALUES \ + ('foreign-{index}', 1107, 'foreign-org', 'cipher', '2026-08-12 12:{index:02}:00');" + )) + .unwrap(); + } + conn.batch_execute( + "INSERT INTO event (uuid, event_type, org_uuid, cipher_uuid, event_date) VALUES + ('authorized', 1107, 'authorized-org', 'cipher', '2026-08-12 11:00:00'); + INSERT INTO event (uuid, event_type, org_uuid, cipher_uuid, event_date) VALUES + ('personal', 1107, NULL, 'cipher', '2026-08-12 10:00:00');", + ) + .unwrap(); + + let cipher_id: CipherId = "cipher".to_owned().into(); + let org_id: OrganizationId = "authorized-org".to_owned().into(); + let start = NaiveDateTime::parse_from_str("2026-08-12 00:00:00", "%F %T").unwrap(); + let end = NaiveDateTime::parse_from_str("2026-08-13 00:00:00", "%F %T").unwrap(); + + let organization_events = Event::find_by_cipher_uuid_impl(&cipher_id, Some(&org_id), &start, &end, &mut conn); + assert_eq!(organization_events.len(), 1); + assert_eq!(organization_events[0].uuid, EventId("authorized".to_owned())); + + let personal_events = Event::find_by_cipher_uuid_impl(&cipher_id, None, &start, &end, &mut conn); + assert_eq!(personal_events.len(), 1); + assert_eq!(personal_events[0].uuid, EventId("personal".to_owned())); + } +} diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index d33e9b90..d41dd5df 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -149,6 +149,15 @@ impl MembershipType { } } +/// The stored `users_organizations.atype` values that carry organization-wide authority by role. +/// +/// Queries use this set instead of the numeric `atype <= Admin` comparison the removal of +/// membership-level `access_all` would otherwise have left behind in them. `<=` also matches every +/// value *below* `Owner`, so a corrupt or hand-written negative `atype` would satisfy an SQL check +/// while every Rust guard rejects it -- `MembershipType::from_i32` returns `None` there and the +/// request guards fail closed. Enumerating the two values keeps both layers on the same answer. +pub(crate) const ORG_ADMIN_ATYPES: &[i32] = &[MembershipType::Owner as i32, MembershipType::Admin as i32]; + impl Ord for MembershipType { fn cmp(&self, other: &MembershipType) -> Ordering { // Roles are ordered by their authorization rank, not by their raw discriminant (Custom's @@ -899,9 +908,18 @@ impl Membership { self.has_type(MembershipType::Custom) && self.access_reports } - /// Check for an explicit per-collection Manage grant without treating any `access_all` value - /// as such a grant. Custom-role collection guards use this instead of the legacy broad helper, - /// because membership/group `access_all` must not manufacture a per-collection Manage grant. + /// Check for an explicit per-collection Manage grant without treating any `access_all` value as + /// such a grant. This is the *only* per-collection authority a Custom member can hold: neither + /// membership nor group `access_all` may manufacture one. + /// + /// No live exception exists for legacy Managers whose authority came from an organization-local + /// `access_all` group. Deriving one from the membership's shape ("Custom, no collection + /// permissions, member of such a group") was not sound — that shape is also what every newly + /// created flagless Custom member has, so assigning one to an ordinary `access_all` group handed + /// out organization-wide collection edit and delete, and *removing* a collection permission + /// activated it. The repair migration `2026-07-23-120000` materializes that authority into the + /// visible `edit_any_collection` / `delete_any_collection` columns instead, where an owner can + /// see and revoke it. pub async fn has_explicit_collection_manage_access(&self, collection_uuid: &CollectionId, conn: &DbConn) -> bool { let membership_uuid = self.uuid.clone(); let user_uuid = self.user_uuid.clone(); @@ -964,72 +982,6 @@ impl Membership { .await } - /// Legacy collection-management authority derived from an organization-local `access_all` group. - /// - /// Before this role model existed, a Manager who reached every collection through such a group - /// could edit and delete all of them — `Collection::is_coll_manageable_by_user` accepted - /// `groups.access_all` outright. Managers are Custom members now, so that authority has to keep - /// coming from the same place, or the upgrade would silently strip a capability from members who - /// hold no explicit per-collection grant. Deriving it live (instead of copying it into the - /// permission columns during the migration) is what keeps it revocable: remove the member from - /// the group, or clear the group's `access_all`, and the authority is gone with it. - /// - /// Deliberately not collection *creation*: that historically required membership-level - /// `access_all` and is now the independent `create_new_collections` permission. - /// - /// Security: the exception is limited to members holding *none* of the three collection - /// permissions, which is exactly the shape the migration leaves a group-derived legacy Manager - /// in. Without that limit it would also cover a Custom member holding `edit_any_collection` — - /// and since `edit_any_collection` is what lets a caller create an `access_all` group in the - /// first place, such a member could grant themselves this authority and use it to persist a - /// real `collections_groups.manage` row, keeping collection deletion after leaving the group. - pub async fn has_legacy_group_collection_manage_access( - &self, - collection_uuid: &CollectionId, - conn: &DbConn, - ) -> bool { - if self.create_new_collections || self.edit_any_collection || self.delete_any_collection { - return false; - } - - let membership_uuid = self.uuid.clone(); - let user_uuid = self.user_uuid.clone(); - let org_uuid = self.org_uuid.clone(); - let collection_uuid = collection_uuid.clone(); - - conn.run(move |conn| { - users_organizations::table - .inner_join( - groups_users::table.on(groups_users::users_organizations_uuid.eq(users_organizations::uuid)), - ) - .inner_join( - groups::table.on(groups::uuid - .eq(groups_users::groups_uuid) - .and(groups::organizations_uuid.eq(users_organizations::org_uuid))), - ) - .inner_join(collections::table.on(collections::org_uuid.eq(users_organizations::org_uuid))) - .filter(users_organizations::uuid.eq(membership_uuid)) - .filter(users_organizations::user_uuid.eq(user_uuid)) - .filter(users_organizations::org_uuid.eq(org_uuid)) - .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) - .filter(users_organizations::atype.eq(MembershipType::Custom as i32)) - .filter(collections::uuid.eq(collection_uuid)) - .filter(groups::access_all.eq(true)) - .count() - .first::(conn) - .unwrap_or(0) - != 0 - }) - .await - } - - /// Whether this member may manage `collection_uuid` without holding a blanket collection - /// permission: either a real stored per-collection grant, or the legacy full-access group. - pub async fn has_collection_manage_authority(&self, collection_uuid: &CollectionId, conn: &DbConn) -> bool { - self.has_explicit_collection_manage_access(collection_uuid, conn).await - || self.has_legacy_group_collection_manage_access(collection_uuid, conn).await - } - /// `manageAllCollections` is a client-side aggregate checkbox, not a separately persisted /// Bitwarden permission. It is selected exactly when all three child permissions are selected. pub fn has_manage_all_collections(&self) -> bool { @@ -1189,7 +1141,7 @@ impl Membership { .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_organizations::atype - .eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]) + .eq_any(ORG_ADMIN_ATYPES) .or(custom_membership_with_edit_any_collection()), ) .load::(conn) @@ -1316,7 +1268,7 @@ impl Membership { ) .filter( custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) - .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // or org admin/owner .or(ciphers_collections::cipher_uuid.eq(&cipher_uuid)), // ..or access to collection with cipher ) .select(users_organizations::all_columns) @@ -1372,7 +1324,7 @@ impl Membership { .left_join(users_collections::table.on(users_collections::user_uuid.eq(users_organizations::user_uuid))) .filter( custom_membership_with_edit_any_collection() // Custom "Edit any collection" (successor of access_all) - .or(users_organizations::atype.le(MembershipType::Admin as i32)) // or org admin/owner + .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // or org admin/owner .or(users_collections::collection_uuid.eq(&collection_uuid)), // ..or access to collection ) .select(users_organizations::all_columns) @@ -1506,6 +1458,23 @@ mod tests { membership } + /// The SQL-side admin set has to stay in step with the Rust-side role check, and it must not be a + /// range: `atype <= Admin` would also match a corrupt negative value that + /// `MembershipType::from_i32` rejects. + #[test] + fn the_sql_admin_atype_set_matches_the_two_admin_roles() { + assert_eq!(ORG_ADMIN_ATYPES, [MembershipType::Owner as i32, MembershipType::Admin as i32]); + for atype in [-1, 2, 3, 5, i32::MAX, i32::MIN] { + assert!(!ORG_ADMIN_ATYPES.contains(&atype), "atype {atype} must not count as an organization admin"); + } + for atype in ORG_ADMIN_ATYPES { + assert!( + matches!(MembershipType::from_i32(*atype), Some(MembershipType::Owner | MembershipType::Admin)), + "every value in the set has to resolve to an admin role in Rust as well" + ); + } + } + #[test] fn membership_type_order_preserves_access_rank_and_ord_contract() { assert!(MembershipType::Owner > MembershipType::Admin); @@ -1529,6 +1498,54 @@ mod tests { } } + /// A stored `atype` that no role maps to is *incomparable*, and the two directions of the + /// comparison resolve that deliberately differently. Both overrides exist to keep the answer + /// fail-closed; neither was pinned by a test, and the asymmetry is easy to "tidy up" into a + /// silent authorization change. + /// + /// `MembershipType op i32` — "does the caller outrank this role?" — answers no: `gt`/`ge` are + /// false for an unknown value, so nothing is ever granted on the strength of one. + /// + /// `i32 op MembershipType` — "is this membership at most that role?" — answers yes: `lt`/`le` + /// are true. Every use of it is a *ceiling* (`atype < Admin`, `atype <= Admin`), so treating an + /// unrecognized value as low-ranked is the restrictive reading. It also cannot smuggle anything + /// past the one place that phrases a permission this way + /// (`check_reset_password_applicable_and_permissions`): the role an Admin must not reach is + /// `Owner`, whose discriminant is 0 and therefore never unknown. + #[test] + #[expect( + clippy::nonminimal_bool, + reason = "`!(role > atype)` must not become `role <= atype`: only `gt`/`ge` are overridden to \ + answer false for an incomparable value, while `le`/`lt` fall through to the derived \ + form. Clippy's rewrite would assert the opposite of what this test is for." + )] + fn an_unknown_stored_role_is_incomparable_and_resolves_fail_closed() { + for atype in [-1, 3, 5, i32::MAX, i32::MIN] { + assert_eq!(MembershipType::Admin.partial_cmp(&atype), None, "atype {atype}"); + assert_eq!(atype.partial_cmp(&MembershipType::Admin), None, "atype {atype}"); + + // Never outranked by an unknown value: no permission is granted on its strength. + for role in [MembershipType::Owner, MembershipType::Admin, MembershipType::Custom, MembershipType::User] { + let known = role as i32; + assert!(!(role > atype), "atype {atype} must not be outranked by role {known}"); + assert!(!(role >= atype), "atype {atype} must not be outranked by role {known}"); + } + + // Always under the ceiling: an unknown value is treated as the lowest rank there is. + assert!(atype < MembershipType::Admin, "atype {atype}"); + assert!(atype <= MembershipType::Admin, "atype {atype}"); + + // And it is equal to nothing, in either direction. + assert!(atype != MembershipType::Custom, "atype {atype}"); + assert!(MembershipType::Custom != atype, "atype {atype}"); + } + + // The known values keep behaving by rank, not by discriminant: Custom's is 4, above Admin's. + assert!(MembershipType::Admin > MembershipType::Custom as i32); + assert!((MembershipType::Custom as i32) < MembershipType::Admin); + assert!(MembershipType::Custom >= MembershipType::Custom as i32); + } + #[test] fn custom_collection_permissions_are_independent_and_type_gated() { let mut member = membership(MembershipType::Custom); diff --git a/tools/custom_role_rollback/README.md b/tools/custom_role_rollback/README.md index 7e47a8f4..e9dbd0d9 100644 --- a/tools/custom_role_rollback/README.md +++ b/tools/custom_role_rollback/README.md @@ -4,10 +4,55 @@ The Custom-role change removes the membership `access_all` column and adds nine A Vaultwarden version from before that change cannot start against the new schema, because its `schema.rs` still expects `access_all` to exist. -Vaultwarden only ever applies *pending* migrations — it never reverts one on its own — so putting -the old image back is not enough. Run the script for your backend once and the old version starts +Vaultwarden only ever applies *pending* migrations — it never reverts one on its own — so putting the +old image back is not enough. Run the script for your backend once and the old version starts again. +## Choosing which members come back as Manager + +The old and new role models are not ordered, so this is a decision, not a conversion. The legacy +Manager role is **not** a subset of what a Custom member holds: it manages — and deletes — every +collection reachable through `users_collections.manage`, `collections_groups.manage` or +`groups.access_all`, and it reads member and collection ACL details through `ManagerHeadersLoose`. +None of that needs a permission flag in the old schema. Mapping every Custom member to Manager would +therefore *grant* authority during a downgrade: a member with `deleteAnyCollection = false` but a +direct or group-based manage grant would come back able to delete those collections, and a member +with no permissions at all would come back able to read the organization's member list. + +So the scripts map to Manager only what you list, and everything else to plain User. Create the list +with every Vaultwarden instance stopped, right before running the rollback: + +```sql +CREATE TABLE __vw_rollback_manager_allowlist (users_organizations_uuid TEXT NOT NULL PRIMARY KEY); +``` + +Use `CHAR(36)` instead of `TEXT` on MySQL/MariaDB and PostgreSQL. An empty list is a valid answer and +maps every Custom member to plain User. To add members, list the candidates and pick from them: + +```sql +SELECT uuid, user_uuid, org_uuid, status, + manage_users, manage_groups, manage_policies, + create_new_collections, edit_any_collection, delete_any_collection, + access_event_logs, access_import_export, access_reports +FROM users_organizations WHERE atype = 4; + +INSERT INTO __vw_rollback_manager_allowlist (users_organizations_uuid) VALUES (''); +``` + +The upgrade records which memberships held the Manager role beforehand, in +`__vw_custom_role_legacy_manager`. That is useful evidence, and copying it over is a reasonable +starting point: + +```sql +INSERT INTO __vw_rollback_manager_allowlist (users_organizations_uuid) +SELECT users_organizations_uuid FROM __vw_custom_role_legacy_manager; +``` + +But it is deliberately **not** used automatically. It records who was a Manager before the *first* +upgrade and is never updated afterwards, so a member whose Manager powers an owner has since reduced +— or who was demoted to User and later re-created as a limited Custom member — would be handed the +whole legacy role back. Historical provenance is evidence, not authorization. + ## What is lost The old schema has nowhere to store the nine permissions, so they are dropped: @@ -15,35 +60,88 @@ The old schema has nowhere to store the nine permissions, so they are dropped: | Before the rollback | After | |---|---| | Owner / Admin | Owner / Admin with `access_all = TRUE` | -| Custom with **all three** collection permissions | Manager with `access_all = TRUE` | -| Custom with only some collection permissions | Manager with `access_all = FALSE` | -| Custom with `manageUsers` / `manageGroups` / `managePolicies` | Manager — those permissions are gone | -| Custom with `accessEventLogs` / `accessImportExport` / `accessReports` | Manager — those permissions are gone | +| Custom **on the allowlist**, with all three collection permissions | Manager with `access_all = TRUE` | +| Custom **on the allowlist**, with only some collection permissions | Manager with `access_all = FALSE` | +| Custom not on the allowlist | plain User with `access_all = FALSE` | | plain User | plain User with `access_all = FALSE` | Per-collection assignments (`users_collections`, `collections_groups`) and `groups.access_all` are -untouched. Only `users_organizations` changes. +untouched. Only `users_organizations` changes, so a member mapped to plain User keeps every grant +those tables carry and loses only the organization-wide powers the old schema cannot express. -Two of those rows do not come back byte-identical to what the database held before the *upgrade*, -because the information no longer exists to reconstruct them: +One row does not come back byte-identical to what the database held before the *upgrade*, because +the information no longer exists to reconstruct it: - **Owner/Admin always come back with `access_all = TRUE`**, even if the flag was `FALSE` for them before. The upgrade dropped the column precisely because Owners and Admins reach every collection through their role, so the original value is unknown afterwards. It grants them nothing they did not already have as Owner/Admin; the visible difference is that unassigned collections show up in their personal vault view again. -- **A plain User that carried `access_all` comes back with `access_all = FALSE`.** The upgrade wrote - that member's reach out as explicit per-collection assignments before dropping the bit, and those - rows are left untouched here — so the member keeps access to the collections that existed at - upgrade time, just not automatically to ones created afterwards. + +A plain User carrying `access_all` cannot reach this point at all: the upgrade refuses to start on +such a database and asks an owner to resolve it first, precisely so that no rollback has to guess +what the bit meant. For the same reason a Custom member mapped to plain User never keeps `access_all` +— that combination is the one legacy state the upgrade refuses, and leaving it behind would make the +database unable to move forward again. Edit-any-collection deliberately does **not** become `access_all` on its own: in the old schema that flag also carried the legacy "manage all collections" authority including deletion, so a member who only held Edit must not come back with delete rights. +## The upgrade asks one question of its own + +Migration `2026-08-10-120000` stops the *upgrade* — not the rollback — when a Custom member holds +`editAnyCollection` or `deleteAnyCollection` and belongs to an organization-local group with +`accessAll`. It grants nothing and revokes nothing; it exists because that combination is the one +place where the new model cannot reproduce the old semantics. + +Before the Custom role, a Manager who reached every collection through such a group held that +authority *while* the group relationship lasted: it ended when the group was deleted, when its +`accessAll` was cleared, when the member left it, and it was inert whenever `ORG_GROUPS_ENABLED` was +false. Nothing in the new model expresses a permission bound to a group like that — the permissions +live on the membership. The earlier migrations in the chain therefore write the authority onto the +membership, and the result is deliberately not identical to what it replaces: + +- it no longer lapses when the last qualifying group disappears, or when `accessAll` is cleared; +- it applies even with the groups feature switched off; +- `editAnyCollection` additionally satisfies `has_full_access()`, so the member reaches every + collection directly rather than through the group. + +Doing that silently would be a migration granting durable organization-wide collection edit and +delete on its own authority; dropping it silently would take a capability away. Neither is the +migration's call, so it hands the decision to an owner. On a database with no Custom membership that +both has edit/delete authority and belongs to an organization-local `accessAll` group, there is +nothing to decide and it is a no-op. + +**Start Vaultwarden once to get the question.** The startup preflight looks ahead for the same +condition, from the legacy schema as well as the migrated one, and refuses with the review query, the +three differences above and the acknowledgement statement +(`RefuseUnconfirmedPermanentCollectionAuthority` in `src/db/mod.rs`). The migration keeps its own +guard as the backstop for a bare `diesel migration run`, but Diesel reports only the driver error +there, so on that path the question arrives as nothing but a duplicate-key violation on +`__vw_permanent_authority_guard`. + +Every matching membership is asked about, including a recorded legacy Manager with +`createNewCollections` set. That flag is an independent permission an owner can change after an +earlier revision materialized group-derived edit/delete, so its current value is not reliable +historical provenance. This deliberately prefers a conservative extra question over silently making +group-derived authority permanent. A membership whose own legacy `access_all` supplied all three +permissions may therefore be listed even though nothing changes meaning for it. An invited or revoked +membership is asked about too: it holds no authority today, but the permission is what it would come +back with if it is ever restored. + +Answering the question is a different statement depending on when you are asked, because the +preflight looks ahead from both schemas. Before the upgrade has run there is nothing to clear — the +permission columns do not exist yet — so declining means ending the group relationship the authority +comes from, either for one membership (`DELETE FROM groups_users …`) or for the whole group +(`UPDATE groups SET access_all = FALSE …`). Once the columns exist, clear them directly. Doing that +after the upgrade is equally safe: Vaultwarden does not start until the acknowledgement is recorded, +so nothing is ever live in between. The refusal prints both statements. + ## How to run it -Stop every Vaultwarden instance and take a backup first. Then: +Stop every Vaultwarden instance and take a backup first. Create the allowlist as described above. +Then: ```bash # SQLite @@ -56,30 +154,128 @@ mysql -u -p < tools/custom_role_rollback/mysql.sql psql -U -d -v ON_ERROR_STOP=1 -f tools/custom_role_rollback/postgresql.sql ``` -Each script stops on its own if the database is not in the state it converts from, so running one -twice is refused rather than half-applied. +Every script begins with a **read-only precondition** that inspects the schema and the migration +ledger before it touches anything, and refuses unless all of these hold: + +- membership `access_all` is gone (so the upgrade did run, and this script has not), +- all nine permission columns exist, +- all nine Custom-role migrations are recorded in `__diesel_schema_migrations`, +- **no migration newer than `20260810120000` is recorded** — this script does not know what a later + migration changed, and removing only the Custom-role versions would leave the ledger claiming a + migration whose schema objects may have been undone, +- **`__vw_custom_role_history_verified` exists**, i.e. this database's Custom-role history was + produced by the migrations that ship today (see the next section), +- **`__vw_rollback_manager_allowlist` exists**, and on MySQL/MariaDB has exactly one non-nullable, + uniquely indexed `users_organizations_uuid` column — a table of the right name but the wrong shape + would otherwise pass every check and then fail on the first read, *after* the first `ALTER TABLE` + has already committed implicitly, +- SQLite only: **`users_organizations` has exactly the eighteen expected columns, two indexes and no + triggers.** The SQLite script rebuilds the table from a fixed column list, so anything it does not + know about would be dropped along with its data. The column check uses `pragma_table_xinfo`, which + unlike `table_info` also reports generated columns, and the index check counts `pragma_index_list` + rather than `sqlite_master`, because the index behind a `UNIQUE` constraint has no SQL text and + would otherwise be invisible. + +A second run, or a half-finished upgrade, is therefore refused with a message that names the reason +and leaves the database exactly as it was. This matters most on MySQL/MariaDB, where nothing can be +rolled back: without the check, a database whose `access_all` was already dropped but whose +access-permission columns were never added would get through the first `ADD COLUMN`, the value +rewrites, the type change and six `DROP COLUMN`s before failing on the seventh — ending up less +consistent than before. -**Do not drop the `-bail` / `ON_ERROR_STOP=1` flags, and do not run these through a client that -keeps going after a failed statement.** The sqlite3 shell continues after errors by default; the -script sets `.bail on` itself, but that is a shell command a different runner will ignore. A runner -that carries on past the failing statement would reach the `DROP TABLE` and commit an empty -`users_organizations`. +The PostgreSQL script resolves `users_organizations`, `__diesel_schema_migrations`, +`__vw_rollback_manager_allowlist` and `__vw_custom_role_history_verified` once each, requires all of +them to live in the **same** schema, and addresses that schema explicitly from then on. An +unqualified name is otherwise resolved per statement through `search_path`, so a session with +`search_path = decoy, real` could have the table rewrite land in one schema and the ledger delete in +another. + +The MySQL/MariaDB script ends with an explicit `COMMIT`. Everything before it is DDL and commits +implicitly, but the final ledger `DELETE` is plain DML: under `autocommit = 0` it would be rolled +back on disconnect, leaving the schema old while all nine migrations still count as applied — and a +later upgrade would then skip them and start new code against the old schema. + +**Do not drop the `-bail` / `ON_ERROR_STOP=1` flags, do not pass `--force` to `mysql`, and do not run +these through a client that keeps going after a failed statement.** The sqlite3 shell continues after +errors by default; the script sets `.bail on` itself, but that is a shell command a different runner +will ignore. A runner that carries on past a failing statement would reach the `DROP TABLE` and commit +an empty `users_organizations`. SQLite and PostgreSQL apply the script in a single transaction, so an aborted run leaves the database untouched. On MySQL/MariaDB the statements cannot be wrapped in a transaction (DDL commits -implicitly there); if the script is interrupted, restore the backup and start over. +implicitly there); the precondition is what keeps a mismatch from being mutated at all, but if the +script is interrupted *after* it passed, restore the backup and start over. + +The SQLite script rebuilds `users_organizations` instead of using `ALTER TABLE ... DROP COLUMN`, which +only exists since SQLite 3.35 — the same reason the forward migration rebuilds the table. It therefore +also works against the older system SQLite that `sqlite_system` builds link. + +Afterwards start the older Vaultwarden version. Upgrading again later re-applies the nine +migrations from a clean state, and rebuilds `__vw_custom_role_legacy_manager` from the very +`atype = 3` rows the rollback restored — so the round trip converges. + +## Databases upgraded before the history marker existed -Afterwards start the older Vaultwarden version. Upgrading again later re-applies the seven -migrations from a clean state. +`__vw_custom_role_history_verified` is created by `2026-06-30-120000`, and nothing else creates it. +A database upgraded by an earlier revision of this feature branch carries that migration's version in +its ledger without the table, and Diesel never re-runs a recorded version — so Vaultwarden refuses to +start and the rollback scripts refuse to run, rather than acting on migrations whose effects were +different. + +Start Vaultwarden once: it prints the full recovery, which depends on how far the earlier revision +got and covers up to three things — recording which memberships were legacy Managers, reviewing +permissions an earlier `20260809120000` granted in bulk to Custom members of `accessAll` groups, and +reviewing the direct collection assignments an earlier `20260723120000` wrote for a plain User that +carried membership `access_all`. If you still have the backup from before the first upgrade, +restoring it and upgrading again is simpler and needs no decision at all. + +The marker is created as a separate statement from the legacy-Manager record on purpose. That record +is data an operator has to be able to write during recovery, so its existence must not double as +evidence that the history behind it was reviewed — otherwise creating it empty to make the error +message go away would silently pass as the audit it is asking for. ## Reverting with the Diesel CLI instead -For development checkouts the down migrations do the same thing step by step. The newest one refuses -by default so an accidental revert cannot silently destroy the permission data; acknowledge it -explicitly first: +For development checkouts the down migrations do the same thing step by step. **Every one of them that +loses permission data refuses by default** — `2026-07-24-130000`, `2026-07-16-120000` and +`2026-06-30-120000` — and so does `2026-07-24-140000`, which loses nothing itself and exists to stop +the chain before the first destructive step. `2026-08-10-120000` and `2026-08-09-120000` are reverted +first and are no-ops. Acknowledge the downgrade once: ```sql CREATE TABLE __vw_allow_custom_role_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); ``` -Then `diesel migration revert` works as usual. The rollback scripts above drop that table again. +Then `diesel migration revert` works as usual for the whole chain. The acknowledgement is deliberately +*not* consumed by the first guard it satisfies: it is dropped by the oldest lossy migration +(`2026-06-30-120000`), so one decision covers one downgrade and a revert that stops halfway is still +guarded when it resumes. Re-upgrading clears a leftover acknowledgement +(`2026-07-24-140000/up.sql`), so consent never carries over into a later, unrelated revert. The +rollback scripts above drop the table as well. + +The down migrations use the same allowlist as the scripts above. Unlike the scripts they do not +refuse when `__vw_rollback_manager_allowlist` is missing — they create it empty, which means "nobody" +and maps every Custom member to plain User. Populate it first if that is not what you want. + +On SQLite the down migrations do use `ALTER TABLE ... DROP COLUMN` and therefore need SQLite 3.35 or +newer. That is fine for a development checkout with a bundled SQLite; operators on an older system +SQLite should use `sqlite.sql` above, which rebuilds the table instead. + +### MySQL/MariaDB: supported for development checkouts only + +On MySQL/MariaDB the Diesel revert chain **cannot be resumed**, and `2026-07-24-140000/down.sql` +requires a second, separate acknowledgement that says so: + +```sql +CREATE TABLE __vw_allow_unresumable_mysql_downgrade (acknowledged INTEGER NOT NULL PRIMARY KEY); +``` + +Every `ALTER TABLE` there commits on its own, while Diesel deletes the ledger row in a separate +statement afterwards. A crash in between leaves the columns gone and the migration still recorded as +applied; re-running it then fails forever with `Unknown column` (1091), the startup preflight refuses +the database — correctly — and the only way out is the backup. Making it resumable would need +conditional DDL, i.e. a stored procedure created before the checks have run. Each down migration +removes its three permission columns in a single `ALTER TABLE` rather than three, which is the +closest this backend gets to all-or-nothing, and temporary guard tables are removed with +`DROP TEMPORARY TABLE`, which is one implicit commit fewer and cannot hit a permanent table of the +same name by accident. Use `mysql.sql` above for anything you care about. diff --git a/tools/custom_role_rollback/mysql.sql b/tools/custom_role_rollback/mysql.sql index c72bd8ec..a2f05c89 100644 --- a/tools/custom_role_rollback/mysql.sql +++ b/tools/custom_role_rollback/mysql.sql @@ -3,40 +3,297 @@ -- it lists exactly what is lost and how to run this safely. -- -- NOTE: MySQL/MariaDB commit every DDL statement implicitly, so this script cannot be wrapped in a --- transaction. Take a backup before running it; if it is interrupted, restore and start over. +-- transaction. That is exactly why everything below the precondition has to be reached in a known +-- state: an ALTER that fails halfway leaves every earlier statement committed. Take a backup before +-- running it; if it is interrupted, restore and start over. + +-- --------------------------------------------------------------------------------------------- +-- Precondition. Read-only and session-local: it reads `information_schema` and the migration ledger, +-- prints the reason when the database does not fit, and aborts on a duplicate key in a TEMPORARY +-- table. No permanent object is created, altered or dropped, so a database this script does not fit +-- keeps its exact state -- which matters here precisely because DDL cannot be rolled back. +-- +-- Without it, a partially upgraded database -- for example one where `access_all` was already dropped +-- but the access-permission columns were never added, which DDL autocommit makes reachable -- would +-- get through the first ADD COLUMN, the value rewrites, the type change and six DROP COLUMN statements before +-- failing on the seventh with error 1091, ending up *less* consistent than before. +-- +-- Deliberately not a stored procedure with SIGNAL: MySQL caps `MESSAGE_TEXT` at 128 characters and +-- answers a longer one with "ERROR 1648 Data too long for condition item 'MESSAGE_TEXT'" instead of +-- the diagnosis (MariaDB accepts it, so the difference is easy to miss), and CREATE PROCEDURE is a +-- permanent object that would have to be written *before* the checks have run -- replacing any +-- same-named routine, surviving a refusal, and requiring routine privileges this script otherwise +-- does not need. +-- --------------------------------------------------------------------------------------------- +CREATE TEMPORARY TABLE __vw_rollback_precondition ( + ok INTEGER NOT NULL PRIMARY KEY +); +INSERT INTO __vw_rollback_precondition (ok) VALUES (1); + +-- 1) Membership `access_all` has to be gone already, i.e. the upgrade ran and this script did not. +SELECT CONCAT( + 'REFUSED, nothing was changed: users_organizations.access_all still exists. This database was ', + 'either never upgraded past the Custom-role migrations, or this script already ran.' +) AS rollback_precondition_failure +FROM information_schema.columns +WHERE table_schema = DATABASE() + AND table_name = 'users_organizations' + AND column_name = 'access_all'; +INSERT INTO __vw_rollback_precondition (ok) +SELECT 1 +FROM information_schema.columns +WHERE table_schema = DATABASE() + AND table_name = 'users_organizations' + AND column_name = 'access_all'; + +-- 2) All nine permission columns have to be present. +SELECT CONCAT( + 'REFUSED, nothing was changed: expected all nine Custom-role permission columns on ', + 'users_organizations, found ', c.n, '. The upgrade is incomplete, so restore the backup taken ', + 'before it and start over.' +) AS rollback_precondition_failure +FROM ( + SELECT COUNT(*) AS n + FROM information_schema.columns + WHERE table_schema = DATABASE() + AND table_name = 'users_organizations' + AND column_name IN ( + 'manage_users', 'manage_groups', 'manage_policies', + 'create_new_collections', 'edit_any_collection', 'delete_any_collection', + 'access_event_logs', 'access_import_export', 'access_reports' + ) +) AS c +WHERE c.n <> 9; +INSERT INTO __vw_rollback_precondition (ok) +SELECT 1 +FROM ( + SELECT COUNT(*) AS n + FROM information_schema.columns + WHERE table_schema = DATABASE() + AND table_name = 'users_organizations' + AND column_name IN ( + 'manage_users', 'manage_groups', 'manage_policies', + 'create_new_collections', 'edit_any_collection', 'delete_any_collection', + 'access_event_logs', 'access_import_export', 'access_reports' + ) +) AS c +WHERE c.n <> 9; + +-- 3) All nine Custom-role migrations have to be recorded. +SELECT CONCAT( + 'REFUSED, nothing was changed: expected all nine Custom-role migrations in ', + '__diesel_schema_migrations, found ', c.n, '. Schema and ledger disagree, so restore the backup ', + 'taken before the upgrade and start over.' +) AS rollback_precondition_failure +FROM ( + SELECT COUNT(*) AS n + FROM __diesel_schema_migrations + WHERE version IN ( + '20260630120000', + '20260715120000', + '20260716120000', + '20260723120000', + '20260724120000', + '20260724130000', + '20260724140000', + '20260809120000', + '20260810120000' + ) +) AS c +WHERE c.n <> 9; +INSERT INTO __vw_rollback_precondition (ok) +SELECT 1 +FROM ( + SELECT COUNT(*) AS n + FROM __diesel_schema_migrations + WHERE version IN ( + '20260630120000', + '20260715120000', + '20260716120000', + '20260723120000', + '20260724120000', + '20260724130000', + '20260724140000', + '20260809120000', + '20260810120000' + ) +) AS c +WHERE c.n <> 9; + +-- 4) No migration newer than the Custom-role change may be recorded: this script does not know what +-- such a migration changed, and removing only the nine versions below would leave the ledger +-- claiming a migration whose schema objects this script may have undone. +SELECT CONCAT( + 'REFUSED, nothing was changed: ', c.n, ' migration(s) newer than the Custom-role change are ', + 'recorded. Use the rollback script shipped with that newer version.' +) AS rollback_precondition_failure +FROM ( + SELECT COUNT(*) AS n + FROM __diesel_schema_migrations + WHERE version > '20260810120000' +) AS c +WHERE c.n <> 0; +INSERT INTO __vw_rollback_precondition (ok) +SELECT 1 +FROM ( + SELECT COUNT(*) AS n + FROM __diesel_schema_migrations + WHERE version > '20260810120000' +) AS c +WHERE c.n <> 0; + +-- 5) The upgrade records that this database's Custom-role history is accounted for. Without that +-- marker the database was migrated by an earlier revision of the change, whose migrations had +-- different effects. +SELECT CONCAT( + 'REFUSED, nothing was changed: __vw_custom_role_history_verified does not exist, so this ', + 'database was migrated by an earlier revision of the Custom-role change. Start Vaultwarden once ', + 'and follow the recovery it prints before rolling back.' +) AS rollback_precondition_failure +FROM ( + SELECT COUNT(*) AS n + FROM information_schema.tables + WHERE table_schema = DATABASE() + AND table_name = '__vw_custom_role_history_verified' +) AS c +WHERE c.n <> 1; +INSERT INTO __vw_rollback_precondition (ok) +SELECT 1 +FROM ( + SELECT COUNT(*) AS n + FROM information_schema.tables + WHERE table_schema = DATABASE() + AND table_name = '__vw_custom_role_history_verified' +) AS c +WHERE c.n <> 1; + +-- 6) Which memberships come back as legacy Manager has to be decided for *this* rollback. An empty +-- list is a valid answer and maps every Custom member to plain User. +SELECT CONCAT( + 'REFUSED, nothing was changed: __vw_rollback_manager_allowlist does not exist. See README.md, ', + 'section "Choosing which members come back as Manager".' +) AS rollback_precondition_failure +FROM ( + SELECT COUNT(*) AS n + FROM information_schema.tables + WHERE table_schema = DATABASE() + AND table_name = '__vw_rollback_manager_allowlist' +) AS c +WHERE c.n <> 1; +INSERT INTO __vw_rollback_precondition (ok) +SELECT 1 +FROM ( + SELECT COUNT(*) AS n + FROM information_schema.tables + WHERE table_schema = DATABASE() + AND table_name = '__vw_rollback_manager_allowlist' +) AS c +WHERE c.n <> 1; + +-- 7) ...and it has to have the shape the role mapping reads. Existence alone is not enough: a +-- hand-written or colliding table without a usable `users_organizations_uuid` column would pass +-- every check above and then fail on the first SELECT against it -- which happens *after* the +-- `ADD COLUMN` below has already committed implicitly, leaving a half-converted database. +-- Require exactly one non-nullable, uniquely indexed column of that name. +SELECT CONCAT( + 'REFUSED, nothing was changed: __vw_rollback_manager_allowlist must have exactly one column ', + 'named users_organizations_uuid, NOT NULL and uniquely indexed. Create it as documented in ', + 'README.md.' +) AS rollback_precondition_failure +FROM ( + SELECT + (SELECT COUNT(*) FROM information_schema.columns + WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist') AS cols, + (SELECT COUNT(*) FROM information_schema.columns + WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist' + AND column_name = 'users_organizations_uuid' AND is_nullable = 'NO') AS usable, + (SELECT COUNT(*) FROM information_schema.statistics + WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist' + AND column_name = 'users_organizations_uuid' AND non_unique = 0) AS uniq +) AS c +WHERE c.cols <> 1 OR c.usable <> 1 OR c.uniq < 1; +INSERT INTO __vw_rollback_precondition (ok) +SELECT 1 +FROM ( + SELECT + (SELECT COUNT(*) FROM information_schema.columns + WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist') AS cols, + (SELECT COUNT(*) FROM information_schema.columns + WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist' + AND column_name = 'users_organizations_uuid' AND is_nullable = 'NO') AS usable, + (SELECT COUNT(*) FROM information_schema.statistics + WHERE table_schema = DATABASE() AND table_name = '__vw_rollback_manager_allowlist' + AND column_name = 'users_organizations_uuid' AND non_unique = 0) AS uniq +) AS c +WHERE c.cols <> 1 OR c.usable <> 1 OR c.uniq < 1; + +-- `DROP TEMPORARY TABLE`, not `DROP TABLE`: the latter is one more statement that commits implicitly, +-- and it would happily drop a permanent table of the same name. +DROP TEMPORARY TABLE __vw_rollback_precondition; + +-- --------------------------------------------------------------------------------------------- +-- From here on the database is known to be in the state this script converts *from*. +-- --------------------------------------------------------------------------------------------- ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; --- The legacy flag is recomputed with the same mapping the down migrations use: everyone who --- reached every collection keeps that reach, and a Custom member has to hold all three collection --- permissions -- Edit-only must not silently turn into the legacy "manage all collections" --- authority, which in that older schema also carried collection deletion. +-- Only a membership on the allowlist comes back as Manager. The legacy Manager role is not a subset +-- of what a Custom member holds -- it manages, and deletes, every collection reachable through +-- `users_collections.manage`, `collections_groups.manage` or `groups.access_all`, and reads member +-- and collection ACL details through `ManagerHeadersLoose`, none of which needs a permission flag in +-- the old schema -- so handing it out on anything less than a current, deliberate decision would +-- *grant* authority during a downgrade. `__vw_custom_role_legacy_manager` is not that decision: it +-- records who was a Manager before the first upgrade and is never updated afterwards, so a member +-- whose powers an owner has since reduced would get all of them back. +-- +-- Everything else becomes a plain User and keeps its per-collection assignments. +-- +-- `access_all` follows the same mapping the down migrations use: everyone who reached every +-- collection keeps that reach, and a Custom member has to hold all three collection permissions -- +-- Edit-only must not silently turn into the legacy "manage all collections" authority, which in that +-- older schema also carried collection deletion. A member mapped to plain User never keeps it: +-- `User + access_all` is the one legacy state the upgrade refuses. UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); UPDATE users_organizations SET access_all = TRUE WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist) AND create_new_collections = TRUE AND edit_any_collection = TRUE AND delete_any_collection = TRUE; --- The old server cannot load type 4; Custom members were stored as Manager back then. -UPDATE users_organizations SET atype = 3 WHERE atype = 4; +-- The old server cannot load type 4. +UPDATE users_organizations SET atype = 3 +WHERE atype = 4 + AND uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist); +UPDATE users_organizations SET atype = 2, access_all = FALSE WHERE atype = 4; -ALTER TABLE users_organizations DROP COLUMN manage_users; -ALTER TABLE users_organizations DROP COLUMN manage_groups; -ALTER TABLE users_organizations DROP COLUMN manage_policies; -ALTER TABLE users_organizations DROP COLUMN create_new_collections; -ALTER TABLE users_organizations DROP COLUMN edit_any_collection; -ALTER TABLE users_organizations DROP COLUMN delete_any_collection; -ALTER TABLE users_organizations DROP COLUMN access_event_logs; -ALTER TABLE users_organizations DROP COLUMN access_import_export; -ALTER TABLE users_organizations DROP COLUMN access_reports; +-- One ALTER, not nine. Every `ALTER TABLE` commits implicitly here, so nine statements mean eight +-- intermediate states an interruption could leave behind; one statement is the closest this backend +-- gets to all-or-nothing. +ALTER TABLE users_organizations + DROP COLUMN manage_users, + DROP COLUMN manage_groups, + DROP COLUMN manage_policies, + DROP COLUMN create_new_collections, + DROP COLUMN edit_any_collection, + DROP COLUMN delete_any_collection, + DROP COLUMN access_event_logs, + DROP COLUMN access_import_export, + DROP COLUMN access_reports; --- Bookkeeping tables this feature may have left behind. +-- Bookkeeping tables this feature may have left behind. The legacy-Manager record goes too: a later +-- re-upgrade rebuilds it from the very `atype = 3` rows this script just restored, so the round trip +-- converges. DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +DROP TABLE IF EXISTS __vw_allow_unresumable_mysql_downgrade; +DROP TABLE IF EXISTS __vw_ack_permanent_collection_authority; +DROP TABLE IF EXISTS __vw_rollback_manager_allowlist; +DROP TABLE IF EXISTS __vw_custom_role_legacy_manager; +DROP TABLE IF EXISTS __vw_custom_role_history_verified; --- Finally forget the seven migrations, so the older binary does not see a ledger from the future +-- Finally forget the nine migrations, so the older binary does not see a ledger from the future -- and a later upgrade applies them again from a clean state. DELETE FROM __diesel_schema_migrations WHERE version IN ( @@ -46,5 +303,15 @@ WHERE version IN ( '20260723120000', '20260724120000', '20260724130000', - '20260724140000' + '20260724140000', + '20260809120000', + '20260810120000' ); + +-- Every statement above except this DELETE is DDL and was therefore committed implicitly the moment +-- it ran. The DELETE is plain DML: under `autocommit = 0` -- which `mysql --init-command`, a my.cnf +-- default, or a connection pool can all set -- it would be rolled back on disconnect, leaving the +-- schema rolled back but all nine migrations still marked as applied. A later upgrade would then +-- skip them and start new code against the old schema. Commit it explicitly; harmless when +-- autocommit is already on. +COMMIT; diff --git a/tools/custom_role_rollback/postgresql.sql b/tools/custom_role_rollback/postgresql.sql index 1484c862..3a4bc8ae 100644 --- a/tools/custom_role_rollback/postgresql.sql +++ b/tools/custom_role_rollback/postgresql.sql @@ -3,52 +3,241 @@ -- it lists exactly what is lost and how to run this safely. -- -- PostgreSQL DDL is transactional, so this whole script either applies or it does not. +-- +-- Everything runs inside one DO block against schema-qualified names. An unqualified relation is +-- resolved per statement through `search_path`, i.e. to the first schema that happens to contain a +-- matching name -- so a session with `search_path = decoy, real` could have the checks and the table +-- rewrite land in `decoy` while the ledger delete hits `real`, leaving the real database with a new +-- schema and a ledger claiming the old one. Resolving each relation once, requiring all of them to +-- live in the *same* namespace, and then addressing that namespace explicitly removes the ambiguity. BEGIN; -ALTER TABLE users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE; - --- The legacy flag is recomputed with the same mapping the down migrations use: everyone who --- reached every collection keeps that reach, and a Custom member has to hold all three collection --- permissions -- Edit-only must not silently turn into the legacy "manage all collections" --- authority, which in that older schema also carried collection deletion. -UPDATE users_organizations SET access_all = TRUE WHERE atype IN (0, 1); -UPDATE users_organizations -SET access_all = TRUE -WHERE atype = 4 - AND create_new_collections = TRUE - AND edit_any_collection = TRUE - AND delete_any_collection = TRUE; - --- The old server cannot load type 4; Custom members were stored as Manager back then. -UPDATE users_organizations SET atype = 3 WHERE atype = 4; - -ALTER TABLE users_organizations - DROP COLUMN manage_users, - DROP COLUMN manage_groups, - DROP COLUMN manage_policies, - DROP COLUMN create_new_collections, - DROP COLUMN edit_any_collection, - DROP COLUMN delete_any_collection, - DROP COLUMN access_event_logs, - DROP COLUMN access_import_export, - DROP COLUMN access_reports; - --- Bookkeeping tables this feature may have left behind. -DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; -DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; - --- Finally forget the seven migrations, so the older binary does not see a ledger from the future --- and a later upgrade applies them again from a clean state. -DELETE FROM __diesel_schema_migrations -WHERE version IN ( - '20260630120000', - '20260715120000', - '20260716120000', - '20260723120000', - '20260724120000', - '20260724130000', - '20260724140000' -); +DO $$ +DECLARE + memberships regclass := to_regclass('users_organizations'); + ledger regclass := to_regclass('__diesel_schema_migrations'); + allowlist regclass := to_regclass('__vw_rollback_manager_allowlist'); + history regclass := to_regclass('__vw_custom_role_history_verified'); + ns oid; + ns_name text; + access_all_present int; + permission_columns int; + allowlist_columns int; + ledger_rows int; + future_rows int; +BEGIN + -- --------------------------------------------------------------------------------------------- + -- Bind the target. Read-only: this inspects the catalog and the migration ledger and changes + -- nothing, so a database this script does not fit keeps its exact state. The transaction would + -- roll back a mismatch anyway; this turns a raw "column does not exist" into a message that says + -- what to do, and it keeps all three backends' scripts symmetrical. + -- --------------------------------------------------------------------------------------------- + IF memberships IS NULL THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: no users_organizations table is ' + 'reachable through the current search_path. Connect to the database and ' + 'schema Vaultwarden uses.'; + END IF; + + IF ledger IS NULL THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: no __diesel_schema_migrations table ' + 'is reachable through the current search_path.'; + END IF; + + IF history IS NULL THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: __vw_custom_role_history_verified ' + 'does not exist, so this database was migrated by an earlier revision of the ' + 'Custom-role change, whose migrations had different effects. Start ' + 'Vaultwarden once and follow the recovery it prints before rolling back.'; + END IF; + + IF allowlist IS NULL THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: __vw_rollback_manager_allowlist does ' + 'not exist. Which memberships come back as legacy Manager has to be decided ' + 'for this rollback -- an empty list is a valid answer and maps every Custom ' + 'member to plain User. See README.md, section "Choosing which members come ' + 'back as Manager".'; + END IF; + + SELECT relnamespace INTO ns FROM pg_class WHERE oid = memberships; + + IF (SELECT relnamespace FROM pg_class WHERE oid = ledger) <> ns + OR (SELECT relnamespace FROM pg_class WHERE oid = allowlist) <> ns + OR (SELECT relnamespace FROM pg_class WHERE oid = history) <> ns THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: the tables this script needs resolve ' + 'to different schemas through the current search_path -- ' + 'users_organizations in "%", __diesel_schema_migrations in "%", ' + '__vw_rollback_manager_allowlist in "%", ' + '__vw_custom_role_history_verified in "%". Set search_path to exactly the ' + 'schema Vaultwarden uses and run this again.', + (SELECT nspname FROM pg_namespace WHERE oid = ns), + (SELECT n.nspname FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace + WHERE c.oid = ledger), + (SELECT n.nspname FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace + WHERE c.oid = allowlist), + (SELECT n.nspname FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace + WHERE c.oid = history); + END IF; + + SELECT nspname INTO ns_name FROM pg_namespace WHERE oid = ns; + + SELECT count(*) INTO access_all_present + FROM pg_attribute + WHERE attrelid = memberships + AND attnum > 0 + AND NOT attisdropped + AND attname = 'access_all'; + + SELECT count(*) INTO permission_columns + FROM pg_attribute + WHERE attrelid = memberships + AND attnum > 0 + AND NOT attisdropped + AND attname IN ( + 'manage_users', 'manage_groups', 'manage_policies', + 'create_new_collections', 'edit_any_collection', 'delete_any_collection', + 'access_event_logs', 'access_import_export', 'access_reports' + ); + + -- The allowlist is read by the role mapping below, so a hand-written table of the right name but + -- the wrong shape has to be caught here rather than mid-rewrite. + SELECT count(*) INTO allowlist_columns + FROM pg_attribute + WHERE attrelid = allowlist + AND attnum > 0 + AND NOT attisdropped + AND attname = 'users_organizations_uuid'; + + EXECUTE format( + 'SELECT count(*) FROM %I.__diesel_schema_migrations WHERE version IN (' + '''20260630120000'', ''20260715120000'', ''20260716120000'', ''20260723120000'',' + '''20260724120000'', ''20260724130000'', ''20260724140000'', ''20260809120000'',' + '''20260810120000'')', + ns_name + ) INTO ledger_rows; + + EXECUTE format( + 'SELECT count(*) FROM %I.__diesel_schema_migrations WHERE version > ''20260810120000''', + ns_name + ) INTO future_rows; + + IF access_all_present <> 0 THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: users_organizations.access_all still ' + 'exists. This database was either never upgraded past the Custom-role ' + 'migrations, or this script already ran.'; + END IF; + + IF permission_columns <> 9 THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: expected all nine Custom-role ' + 'permission columns on users_organizations, found %. The upgrade is ' + 'incomplete, so restore the backup taken before it and start over.', + permission_columns; + END IF; + + IF allowlist_columns <> 1 THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: __vw_rollback_manager_allowlist has ' + 'no users_organizations_uuid column. Create it as documented in README.md.'; + END IF; + + IF ledger_rows <> 9 THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: expected all nine Custom-role ' + 'migrations in __diesel_schema_migrations, found %. Schema and ledger ' + 'disagree, so restore the backup taken before the upgrade and start over.', + ledger_rows; + END IF; + + IF future_rows <> 0 THEN + RAISE EXCEPTION 'Rollback refused, nothing was changed: % migration(s) newer than the ' + 'Custom-role change are recorded. This script does not know what they ' + 'changed, and removing only the nine Custom-role versions would leave the ' + 'ledger inconsistent. Use the rollback script shipped with that newer ' + 'version.', + future_rows; + END IF; + + -- --------------------------------------------------------------------------------------------- + -- From here on the database is known to be in the state this script converts *from*, and every + -- statement addresses the one namespace bound above. + -- --------------------------------------------------------------------------------------------- + EXECUTE format( + 'ALTER TABLE %I.users_organizations ADD COLUMN access_all BOOLEAN NOT NULL DEFAULT FALSE', + ns_name + ); + + -- Only a membership on the allowlist comes back as Manager. The legacy Manager role is not a + -- subset of what a Custom member holds -- it manages, and deletes, every collection reachable + -- through `users_collections.manage`, `collections_groups.manage` or `groups.access_all`, and + -- reads member and collection ACL details through `ManagerHeadersLoose`, none of which needs a + -- permission flag in the old schema -- so handing it out on anything less than a current, + -- deliberate decision would *grant* authority during a downgrade. + -- `__vw_custom_role_legacy_manager` is not that decision: it records who was a Manager before the + -- first upgrade and is never updated afterwards, so a member whose powers an owner has since + -- reduced would get all of them back. + -- + -- Everything else becomes a plain User and keeps its per-collection assignments. + -- + -- `access_all` follows the same mapping the down migrations use: everyone who reached every + -- collection keeps that reach, and a Custom member has to hold all three collection permissions + -- -- Edit-only must not silently turn into the legacy "manage all collections" authority, which + -- in that older schema also carried collection deletion. A member mapped to plain User never + -- keeps it: `User + access_all` is the one legacy state the upgrade refuses. + EXECUTE format( + 'UPDATE %I.users_organizations SET access_all = TRUE WHERE atype IN (0, 1)', ns_name + ); + EXECUTE format( + 'UPDATE %I.users_organizations SET access_all = TRUE ' + 'WHERE atype = 4 ' + ' AND uuid IN (SELECT users_organizations_uuid FROM %I.__vw_rollback_manager_allowlist) ' + ' AND create_new_collections = TRUE ' + ' AND edit_any_collection = TRUE ' + ' AND delete_any_collection = TRUE', + ns_name, ns_name + ); + + -- The old server cannot load type 4. + EXECUTE format( + 'UPDATE %I.users_organizations SET atype = 3 ' + 'WHERE atype = 4 ' + ' AND uuid IN (SELECT users_organizations_uuid FROM %I.__vw_rollback_manager_allowlist)', + ns_name, ns_name + ); + EXECUTE format( + 'UPDATE %I.users_organizations SET atype = 2, access_all = FALSE WHERE atype = 4', ns_name + ); + + EXECUTE format( + 'ALTER TABLE %I.users_organizations ' + ' DROP COLUMN manage_users, ' + ' DROP COLUMN manage_groups, ' + ' DROP COLUMN manage_policies, ' + ' DROP COLUMN create_new_collections, ' + ' DROP COLUMN edit_any_collection, ' + ' DROP COLUMN delete_any_collection, ' + ' DROP COLUMN access_event_logs, ' + ' DROP COLUMN access_import_export, ' + ' DROP COLUMN access_reports', + ns_name + ); + + -- Bookkeeping tables this feature may have left behind. A later re-upgrade rebuilds the + -- provenance record and the history marker from the very `atype = 3` rows this script just + -- restored, so the round trip converges. + EXECUTE format('DROP TABLE IF EXISTS %I.__vw_custom_role_same_run_0716', ns_name); + EXECUTE format('DROP TABLE IF EXISTS %I.__vw_allow_custom_role_downgrade', ns_name); + EXECUTE format('DROP TABLE IF EXISTS %I.__vw_ack_permanent_collection_authority', ns_name); + EXECUTE format('DROP TABLE IF EXISTS %I.__vw_rollback_manager_allowlist', ns_name); + EXECUTE format('DROP TABLE IF EXISTS %I.__vw_custom_role_legacy_manager', ns_name); + EXECUTE format('DROP TABLE IF EXISTS %I.__vw_custom_role_history_verified', ns_name); + + -- Finally forget the nine migrations, so the older binary does not see a ledger from the future + -- and a later upgrade applies them again from a clean state. + EXECUTE format( + 'DELETE FROM %I.__diesel_schema_migrations WHERE version IN (' + '''20260630120000'', ''20260715120000'', ''20260716120000'', ''20260723120000'',' + '''20260724120000'', ''20260724130000'', ''20260724140000'', ''20260809120000'',' + '''20260810120000'')', + ns_name + ); +END $$; COMMIT; diff --git a/tools/custom_role_rollback/sqlite.sql b/tools/custom_role_rollback/sqlite.sql index 54cb237b..96799fa2 100644 --- a/tools/custom_role_rollback/sqlite.sql +++ b/tools/custom_role_rollback/sqlite.sql @@ -16,20 +16,147 @@ PRAGMA foreign_keys = OFF; BEGIN; --- Refuse to start at all unless the database is in the state this script converts *from*. A repeat --- run would otherwise only fail somewhere in the middle. The failing CHECK names the reason. +-- Refuse to start at all unless the database is in the exact state this script converts *from*. A +-- repeat run, or a half-finished upgrade, would otherwise only fail somewhere in the middle. Each +-- check is read-only, and the name of the failing CHECK constraint *is* the error message. CREATE TEMPORARY TABLE __vw_rollback_precondition ( ok INTEGER NOT NULL CONSTRAINT - this_database_has_no_custom_role_permission_columns_to_roll_back CHECK (ok = 1) + refused_membership_access_all_still_exists_so_this_database_was_not_upgraded_or_was_already_rolled_back + CHECK (ok = 1) ); INSERT INTO __vw_rollback_precondition (ok) SELECT CASE - WHEN EXISTS (SELECT 1 FROM pragma_table_info('users_organizations') WHERE name = 'create_new_collections') + WHEN NOT EXISTS (SELECT 1 FROM pragma_table_xinfo('users_organizations') WHERE name = 'access_all') THEN 1 ELSE 0 END; DROP TABLE __vw_rollback_precondition; +CREATE TEMPORARY TABLE __vw_rollback_precondition_columns ( + ok INTEGER NOT NULL CONSTRAINT + refused_all_nine_custom_role_permission_columns_must_exist_restore_the_pre_upgrade_backup + CHECK (ok = 9) +); +INSERT INTO __vw_rollback_precondition_columns (ok) +SELECT COUNT(*) +FROM pragma_table_xinfo('users_organizations') +WHERE name IN ( + 'manage_users', 'manage_groups', 'manage_policies', + 'create_new_collections', 'edit_any_collection', 'delete_any_collection', + 'access_event_logs', 'access_import_export', 'access_reports' +); +DROP TABLE __vw_rollback_precondition_columns; + +-- The rebuild below copies a fixed column list, so anything this script does not know about would be +-- silently dropped together with its data. Require the table to hold *exactly* the eighteen columns +-- the Custom-role upgrade leaves behind -- not merely to contain them. A newer migration that added a +-- column, or a local modification, therefore refuses here instead of being destroyed at COMMIT. +-- +-- `table_xinfo`, not `table_info`: the latter omits generated columns entirely, so a STORED or +-- VIRTUAL column would pass the count unseen and then be lost in the rebuild. +CREATE TEMPORARY TABLE __vw_rollback_precondition_exact_columns ( + ok INTEGER NOT NULL CONSTRAINT + refused_users_organizations_has_unexpected_columns_this_script_is_older_than_the_database + CHECK (ok = 1) +); +INSERT INTO __vw_rollback_precondition_exact_columns (ok) +SELECT CASE WHEN total = 18 AND known = 18 THEN 1 ELSE 0 END +FROM ( + SELECT + COUNT(*) AS total, + SUM(CASE WHEN name IN ( + 'uuid', 'user_uuid', 'org_uuid', 'akey', 'status', 'atype', + 'reset_password_key', 'external_id', 'invited_by_email', + 'manage_users', 'manage_groups', 'manage_policies', + 'create_new_collections', 'edit_any_collection', 'delete_any_collection', + 'access_event_logs', 'access_import_export', 'access_reports' + ) THEN 1 ELSE 0 END) AS known + FROM pragma_table_xinfo('users_organizations') +); +DROP TABLE __vw_rollback_precondition_exact_columns; + +-- Same reasoning for everything else attached to the table: `DROP TABLE` takes its indexes and +-- triggers with it, and the rebuild recreates only the PRIMARY KEY and the UNIQUE pair. +-- +-- Counting `index_list` rather than `sqlite_master` on purpose. An index that SQLite created for a +-- UNIQUE constraint has no SQL text, so `sqlite_master.sql IS NOT NULL` cannot see it -- an extra +-- `UNIQUE(external_id)` would pass unnoticed and be gone afterwards. `index_list` reports every +-- index, so the upgraded table's own two are the exact expected count. +CREATE TEMPORARY TABLE __vw_rollback_precondition_objects ( + ok INTEGER NOT NULL CONSTRAINT + refused_users_organizations_has_extra_indexes_constraints_or_triggers_the_rebuild_would_destroy + CHECK (ok = 1) +); +INSERT INTO __vw_rollback_precondition_objects (ok) +SELECT CASE WHEN indexes = 2 AND triggers = 0 THEN 1 ELSE 0 END +FROM ( + SELECT + (SELECT COUNT(*) FROM pragma_index_list('users_organizations')) AS indexes, + (SELECT COUNT(*) FROM sqlite_master + WHERE tbl_name = 'users_organizations' AND type = 'trigger') AS triggers +); +DROP TABLE __vw_rollback_precondition_objects; + +CREATE TEMPORARY TABLE __vw_rollback_precondition_ledger ( + ok INTEGER NOT NULL CONSTRAINT + refused_all_nine_custom_role_migrations_must_be_recorded_schema_and_ledger_disagree + CHECK (ok = 9) +); +INSERT INTO __vw_rollback_precondition_ledger (ok) +SELECT COUNT(*) +FROM __diesel_schema_migrations +WHERE version IN ( + '20260630120000', + '20260715120000', + '20260716120000', + '20260723120000', + '20260724120000', + '20260724130000', + '20260724140000', + '20260809120000', + '20260810120000' +); +DROP TABLE __vw_rollback_precondition_ledger; + +-- A migration newer than the last Custom-role one has run, so this script cannot know what it changed +-- or whether the rebuild below would undo it. Removing only the nine versions would also leave the +-- ledger claiming a migration whose schema objects are gone. +CREATE TEMPORARY TABLE __vw_rollback_precondition_future_ledger ( + ok INTEGER NOT NULL CONSTRAINT + refused_migrations_newer_than_the_custom_role_change_are_recorded_use_a_newer_rollback_script + CHECK (ok = 0) +); +INSERT INTO __vw_rollback_precondition_future_ledger (ok) +SELECT COUNT(*) FROM __diesel_schema_migrations WHERE version > '20260810120000'; +DROP TABLE __vw_rollback_precondition_future_ledger; + +-- The upgrade records that this database's Custom-role history is accounted for. Without it the +-- database was migrated by an earlier revision of the change, whose migrations had different +-- effects -- start Vaultwarden once and follow the recovery it prints before rolling anything back. +CREATE TEMPORARY TABLE __vw_rollback_precondition_history ( + ok INTEGER NOT NULL CONSTRAINT + refused_custom_role_history_not_verified_start_vaultwarden_once_and_follow_its_recovery + CHECK (ok = 1) +); +INSERT INTO __vw_rollback_precondition_history (ok) +SELECT COUNT(*) +FROM sqlite_master +WHERE type = 'table' AND name = '__vw_custom_role_history_verified'; +DROP TABLE __vw_rollback_precondition_history; + +-- Which memberships come back as Manager has to be decided *for this rollback*. See README.md; an +-- empty list is a valid answer and maps every Custom member to plain User. +CREATE TEMPORARY TABLE __vw_rollback_precondition_allowlist ( + ok INTEGER NOT NULL CONSTRAINT + refused_create_vw_rollback_manager_allowlist_first_see_readme_role_mapping + CHECK (ok = 1) +); +INSERT INTO __vw_rollback_precondition_allowlist (ok) +SELECT COUNT(*) +FROM sqlite_master +WHERE type = 'table' AND name = '__vw_rollback_manager_allowlist'; +DROP TABLE __vw_rollback_precondition_allowlist; + CREATE TABLE users_organizations_rollback ( uuid TEXT NOT NULL PRIMARY KEY, user_uuid TEXT NOT NULL REFERENCES users (uuid), @@ -45,39 +172,69 @@ CREATE TABLE users_organizations_rollback ( UNIQUE (user_uuid, org_uuid) ); --- The legacy flag is recomputed with the same mapping the down migrations use: everyone who --- reached every collection keeps that reach, and a Custom member has to hold all three collection --- permissions -- Edit-only must not silently turn into the legacy "manage all collections" --- authority, which in that older schema also carried collection deletion. +-- Roles and the legacy flag are recomputed together, because in the old schema they are not +-- independent. +-- +-- Only a membership on the allowlist comes back as Manager. The legacy Manager role is not a subset +-- of what a Custom member holds -- it manages, and deletes, every collection reachable through +-- `users_collections.manage`, `collections_groups.manage` or `groups.access_all`, and reads member +-- and collection ACL details through `ManagerHeadersLoose`, none of which needs a permission flag in +-- the old schema -- so handing it out on anything less than a current, deliberate decision would +-- *grant* authority during a downgrade. `__vw_custom_role_legacy_manager` is not that decision: it +-- records who was a Manager before the first upgrade and is never updated afterwards, so a member +-- whose powers an owner has since reduced would get all of them back. +-- +-- Everything else becomes a plain User. Per-collection assignments are untouched, so those members +-- keep every grant `users_collections` and `collections_groups` carry. +-- +-- `access_all` follows the same mapping the down migrations use: everyone who reached every +-- collection keeps that reach, and a Custom member has to hold all three collection permissions -- +-- Edit-only must not silently turn into the legacy "manage all collections" authority, which in that +-- older schema also carried collection deletion. A member mapped to plain User never keeps it: +-- `User + access_all` is the one legacy state the upgrade refuses, so leaving it set would make this +-- database unable to move forward again. INSERT INTO users_organizations_rollback ( uuid, user_uuid, org_uuid, access_all, akey, status, atype, reset_password_key, external_id, invited_by_email ) SELECT - uuid, user_uuid, org_uuid, + uo.uuid, uo.user_uuid, uo.org_uuid, CASE - WHEN atype IN (0, 1) THEN 1 - WHEN atype = 4 - AND create_new_collections = 1 - AND edit_any_collection = 1 - AND delete_any_collection = 1 THEN 1 + WHEN uo.atype IN (0, 1) THEN 1 + WHEN uo.atype = 4 + AND uo.uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist) + AND uo.create_new_collections = 1 + AND uo.edit_any_collection = 1 + AND uo.delete_any_collection = 1 THEN 1 ELSE 0 END, - akey, status, - -- The old server cannot load type 4; Custom members were stored as Manager back then. - CASE WHEN atype = 4 THEN 3 ELSE atype END, - reset_password_key, external_id, invited_by_email -FROM users_organizations; + uo.akey, uo.status, + -- The old server cannot load type 4. + CASE + WHEN uo.atype = 4 + AND uo.uuid IN (SELECT users_organizations_uuid FROM __vw_rollback_manager_allowlist) + THEN 3 + WHEN uo.atype = 4 THEN 2 + ELSE uo.atype + END, + uo.reset_password_key, uo.external_id, uo.invited_by_email +FROM users_organizations AS uo; DROP TABLE users_organizations; ALTER TABLE users_organizations_rollback RENAME TO users_organizations; --- Bookkeeping tables this feature may have left behind. +-- Bookkeeping tables this feature may have left behind. A later re-upgrade rebuilds the provenance +-- record and the history marker from the very `atype = 3` rows this script just restored, so the +-- round trip converges. DROP TABLE IF EXISTS __vw_custom_role_same_run_0716; DROP TABLE IF EXISTS __vw_allow_custom_role_downgrade; +DROP TABLE IF EXISTS __vw_ack_permanent_collection_authority; +DROP TABLE IF EXISTS __vw_rollback_manager_allowlist; +DROP TABLE IF EXISTS __vw_custom_role_legacy_manager; +DROP TABLE IF EXISTS __vw_custom_role_history_verified; --- Finally forget the seven migrations, so the older binary does not see a ledger from the future +-- Finally forget the nine migrations, so the older binary does not see a ledger from the future -- and a later upgrade applies them again from a clean state. DELETE FROM __diesel_schema_migrations WHERE version IN ( @@ -87,7 +244,9 @@ WHERE version IN ( '20260723120000', '20260724120000', '20260724130000', - '20260724140000' + '20260724140000', + '20260809120000', + '20260810120000' ); COMMIT;