diff --git a/.env.template b/.env.template index 62231776..43ed914f 100644 --- a/.env.template +++ b/.env.template @@ -180,7 +180,7 @@ ## Defaults to every minute. Set blank to disable this job. # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *" ## -## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt. +## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled. ## Defaults to every minute. Set blank to disable this job. # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *" # @@ -391,24 +391,12 @@ ## The following flags are available: ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0) ## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0) -## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0) ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1) -## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0) -## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0) -## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0) -## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0) -## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0) -## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0) -## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2) -## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2) ## - "pm-30529-webauthn-related-origins": ## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0) ## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1) -## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0) -## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0) -## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0) -## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0) ## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0) +## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0) # EXPERIMENTAL_CLIENT_FEATURE_FLAGS= ## Require new device emails. When a user logs in an email is required to be sent. @@ -587,11 +575,6 @@ # DUO_HOST= ## After that, you should be able to follow the rest of the guide linked above, ## ignoring the fields that ask for the values that you already configured beforehand. -## -## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'. -## Duo no longer supports this, but it still works for some integrations. -## If you aren't sure, leave this alone. -# DUO_USE_IFRAME=false ## Email 2FA settings ## Email token size diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian index b8490609..62dff072 100644 --- a/docker/Dockerfile.debian +++ b/docker/Dockerfile.debian @@ -101,9 +101,17 @@ RUN . /env-cargo && \ # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977 # https://github.com/dani-garcia/vaultwarden/discussions/7522 if xx-info is-cross; then \ - XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \ - export XX_RUSTFLAGS; \ + XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \ fi && \ + # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang + # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied + # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip + # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548 + # See: https://github.com/dani-garcia/vaultwarden/issues/7754 + if [ "$(xx-info arch)" = "arm64" ]; then \ + XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \ + fi && \ + export XX_RUSTFLAGS && \ PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \ find . -not -path "./target*" -delete @@ -123,9 +131,17 @@ RUN . /env-cargo && \ # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977 # https://github.com/dani-garcia/vaultwarden/discussions/7522 if xx-info is-cross; then \ - XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \ - export XX_RUSTFLAGS; \ + XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \ + fi && \ + # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang + # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied + # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip + # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548 + # See: https://github.com/dani-garcia/vaultwarden/issues/7754 + if [ "$(xx-info arch)" = "arm64" ]; then \ + XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \ fi && \ + export XX_RUSTFLAGS && \ PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \ if [ "${CARGO_PROFILE}" = "dev" ] ; then \ ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \ diff --git a/docker/Dockerfile.j2 b/docker/Dockerfile.j2 index 633d6955..2dc175b0 100644 --- a/docker/Dockerfile.j2 +++ b/docker/Dockerfile.j2 @@ -32,9 +32,17 @@ # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977 # https://github.com/dani-garcia/vaultwarden/discussions/7522 if xx-info is-cross; then \ - XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \ - export XX_RUSTFLAGS; \ + XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \ fi && \ + # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang + # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied + # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip + # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548 + # See: https://github.com/dani-garcia/vaultwarden/issues/7754 + if [ "$(xx-info arch)" = "arm64" ]; then \ + XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \ + fi && \ + export XX_RUSTFLAGS && \ PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" {%- endmacro %} FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault diff --git a/src/api/admin.rs b/src/api/admin.rs index cebd35b4..09a95908 100644 --- a/src/api/admin.rs +++ b/src/api/admin.rs @@ -510,6 +510,7 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult { let mut user = get_user_or_404(&user_id, &conn).await?; TwoFactor::delete_all_by_user(&user.uuid, &conn).await?; + Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?; two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?; user.totp_recover = None; user.save(&conn).await @@ -1009,23 +1010,23 @@ mod tests { fn validate_web_vault_compare() { // web_vault_compare(active, latest) // Test normal versions - assert!(web_vault_compare("2025.12.0", "2025.12.1") == -1); - assert!(web_vault_compare("2025.12.1", "2025.12.1") == 0); - assert!(web_vault_compare("2025.12.2", "2025.12.1") == 1); + assert_eq!(web_vault_compare("2025.12.0", "2025.12.1"), -1); + assert_eq!(web_vault_compare("2025.12.1", "2025.12.1"), 0); + assert_eq!(web_vault_compare("2025.12.2", "2025.12.1"), 1); // Test patched/+build.n versions // Newer latest version - assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1") == -1); - assert!(web_vault_compare("2025.12.1", "2025.12.1+build.1") == -1); - assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1") == -1); - assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2") == -1); + assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1"), -1); + assert_eq!(web_vault_compare("2025.12.1", "2025.12.1+build.1"), -1); + assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1"), -1); + assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2"), -1); // Equal versions - assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1") == 0); - assert!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2") == 0); + assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1"), 0); + assert_eq!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2"), 0); // Newer active version - assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1") == 1); - assert!(web_vault_compare("2025.12.2", "2025.12.1+build.1") == 1); - assert!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1") == 1); - assert!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2") == 1); + assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1"), 1); + assert_eq!(web_vault_compare("2025.12.2", "2025.12.1+build.1"), 1); + assert_eq!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1"), 1); + assert_eq!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2"), 1); } } diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs index 8cc5e55b..930107c9 100644 --- a/src/api/core/accounts.rs +++ b/src/api/core/accounts.rs @@ -32,7 +32,7 @@ use crate::{ use super::{ ciphers::{CipherData, update_cipher_from_data}, - sends::{SendData, update_send_from_data}, + sends::SendData, }; pub fn routes() -> Vec { @@ -59,7 +59,6 @@ pub fn routes() -> Vec { delete_account, revision_date, password_hint, - post_prelogin, verify_password, post_api_key, rotate_api_key, @@ -106,11 +105,8 @@ pub struct RegisterData { master_password_hint: Option, - name: Option, - organization_user_id: Option, - // Used only from the register/finish endpoint email_verification_token: Option, accept_emergency_access_id: Option, accept_emergency_access_invite_token: Option, @@ -163,7 +159,9 @@ struct RegisterDataOld { #[derive(Debug, Deserialize)] #[serde(rename_all = "camelCase")] struct RegisterDataCur { + #[serde(alias = "MasterPasswordAuthentication")] master_password_authentication: MasterPasswordAuthentication, + #[serde(alias = "MasterPasswordUnlock")] master_password_unlock: MasterPasswordUnlock, } @@ -197,10 +195,12 @@ struct KeysData { #[derive(Debug, Deserialize)] #[serde(rename_all = "camelCase")] pub struct MasterPasswordAuthentication { + #[serde(alias = "Kdf")] kdf: KDFData, + #[serde(alias = "Salt")] salt: String, - #[serde(alias = "masterPasswordAuthenticationHash")] + #[serde(alias = "masterPasswordAuthenticationHash", alias = "MasterPasswordAuthenticationHash")] hash: String, } @@ -257,12 +257,11 @@ async fn is_email_2fa_required(member_id: Option, conn: &DbConn) - false } -pub async fn register(data: Json, email_verification: bool, conn: DbConn) -> JsonResult { - let mut data: RegisterData = data.into_inner(); +pub async fn register(data: Json, conn: DbConn) -> JsonResult { + let data: RegisterData = data.into_inner(); let email = data.email.to_lowercase(); - let mut email_verified = false; - + let mut name = None; let mut pending_emergency_access = None; if data.unprocessable() { @@ -270,69 +269,65 @@ pub async fn register(data: Json, email_verification: bool, conn: } // First, validate the provided verification tokens - if email_verification { - match ( - &data.email_verification_token, - &data.accept_emergency_access_id, - &data.accept_emergency_access_invite_token, - &data.organization_user_id, - &data.org_invite_token, - ) { - // Normal user registration, when email verification is required - (Some(email_verification_token), None, None, None, None) => { - let claims = crate::auth::decode_register_verify(email_verification_token)?; - if claims.sub != data.email { - err!("Email verification token does not match email"); - } - - // During this call we don't get the name, so extract it from the claims - if claims.name.is_some() { - data.name = claims.name; - } - email_verified = claims.verified; + let mut email_verified = match ( + &data.email_verification_token, + &data.accept_emergency_access_id, + &data.accept_emergency_access_invite_token, + &data.organization_user_id, + &data.org_invite_token, + ) { + // Normal user registration, when email verification is required + (Some(email_verification_token), None, None, None, None) => { + let claims = crate::auth::decode_register_verify(email_verification_token)?; + if claims.sub != data.email { + err!("Email verification token does not match email"); } - // Emergency access registration - (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => { - if !CONFIG.emergency_access_allowed() { - err!("Emergency access is not enabled.") - } - let claims = crate::auth::decode_emergency_access_invite(accept_emergency_access_invite_token)?; + // During this call we don't get the name, so extract it from the claims + name = claims.name; + claims.verified + } + // Emergency access registration + (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => { + if !CONFIG.emergency_access_allowed() { + err!("Emergency access is not enabled.") + } - if claims.email != data.email { - err!("Claim email does not match email") - } - if &claims.emer_id != accept_emergency_access_id { - err!("Claim emer_id does not match accept_emergency_access_id") - } + let claims = crate::auth::decode_emergency_access_invite(accept_emergency_access_invite_token)?; - pending_emergency_access = Some((accept_emergency_access_id, claims)); - email_verified = true; + if claims.email != data.email { + err!("Claim email does not match email") + } + if &claims.emer_id != accept_emergency_access_id { + err!("Claim emer_id does not match accept_emergency_access_id") } - // Org invite - (None, None, None, Some(organization_user_id), Some(org_invite_token)) => { - let claims = decode_invite(org_invite_token)?; - - if claims.email != data.email { - err!("Claim email does not match email") - } - if &claims.member_id != organization_user_id { - err!("Claim org_user_id does not match organization_user_id") - } + pending_emergency_access = Some((accept_emergency_access_id, claims)); + true + } + // Org invite + (None, None, None, Some(organization_user_id), Some(org_invite_token)) => { + let claims = decode_invite(org_invite_token)?; - email_verified = true; + if claims.email != data.email { + err!("Claim email does not match email") } - _ => { - err!("Registration is missing required parameters") + if &claims.member_id != organization_user_id { + err!("Claim org_user_id does not match organization_user_id") } + + true } - } + + _ => { + err!("Registration is missing required parameters") + } + }; // Check if the length of the username exceeds 50 characters (Same is Upstream Bitwarden) // This also prevents issues with very long usernames causing to large JWT's. See #2419 - if let Some(ref name) = data.name + if let Some(ref name) = name && name.len() > 50 { err!("The field Name must be a string with a maximum length of 50."); @@ -394,7 +389,7 @@ pub async fn register(data: Json, email_verification: bool, conn: user.password_hint = password_hint; // Add extra fields if present - if let Some(name) = data.name { + if let Some(name) = name { user.name = name; } @@ -432,8 +427,7 @@ pub async fn register(data: Json, email_verification: bool, conn: } Ok(Json(json!({ - "object": "register", - "captchaBypassToken": "", + "object": "registerFinish", }))) } @@ -442,7 +436,7 @@ async fn post_set_password(data: Json, headers: Headers, conn: let data: SetPasswordData = data.into_inner(); let mut user = headers.user; - if user.private_key.is_some() { + if user.private_key.is_some() || !user.password_hash.is_empty() { err!("Account already initialized, cannot set password") } @@ -496,7 +490,6 @@ async fn post_set_password(data: Json, headers: Headers, conn: Ok(Json(json!({ "object": "set-password", - "captchaBypassToken": "", }))) } @@ -581,6 +574,10 @@ async fn post_keys(data: Json, headers: Headers, conn: DbConn) -> Json let mut user = headers.user; + if user.private_key.is_some() || user.public_key.is_some() { + err!("User has existing keypair") + } + user.private_key = Some(data.encrypted_private_key); user.public_key = Some(data.public_key); @@ -702,8 +699,11 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult { #[derive(Deserialize)] #[serde(rename_all = "camelCase")] struct AuthenticationData { + #[serde(alias = "Salt")] salt: String, + #[serde(alias = "Kdf")] kdf: KDFData, + #[serde(alias = "MasterPasswordAuthenticationHash")] master_password_authentication_hash: String, } @@ -982,11 +982,13 @@ async fn post_rotatekey(data: Json, headers: Headers, conn: DbConn, nt: // Update send data for send_data in data.account_data.sends { - let Some(send) = existing_sends.iter_mut().find(|s| &s.uuid == send_data.id.as_ref().unwrap()) else { + let Some(send) = send_data.id.as_ref().and_then(|id| existing_sends.iter_mut().find(|s| &s.uuid == id)) else { err!("Send doesn't exist") }; - update_send_from_data(send, send_data, &headers, &conn, &nt, UpdateType::None).await?; + // Like upstream, only the key changes on rotation + send.akey = send_data.key; + send.save(&conn).await?; } // Update cipher data @@ -1358,11 +1360,6 @@ pub struct PreloginData { email: String, } -#[post("/accounts/prelogin", data = "")] -async fn post_prelogin(data: Json, ip: ClientIp, conn: DbConn) -> JsonResult { - prelogin(data, ip, conn).await -} - pub async fn prelogin(data: Json, ip: ClientIp, conn: DbConn) -> JsonResult { crate::ratelimit::check_limit_unauthenticated(&ip.ip)?; @@ -1854,3 +1851,62 @@ pub async fn purge_auth_requests(pool: DbPool) { error!("Failed to get DB connection while purging auth requests"); } } + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_register_data_current_format() { + // Web and iOS since the master password authentication/unlock split + let data: RegisterData = serde_json::from_str( + r#"{ + "email": "user@example.com", + "emailVerificationToken": "token", + "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"}, + "masterPasswordAuthentication": { + "kdf": {"kdfType": 0, "iterations": 600000}, + "salt": "user@example.com", + "masterPasswordAuthenticationHash": "hash" + }, + "masterPasswordUnlock": { + "kdf": {"kdfType": 0, "iterations": 600000}, + "salt": "user@example.com", + "masterKeyWrappedUserKey": "key" + } + }"#, + ) + .unwrap(); + + assert!(!data.unprocessable()); + assert_eq!(data.hash(), "hash"); + assert_eq!(data.key(), "key"); + assert_eq!(data.kdf().kdf_iterations, 600_000); + assert!(data.keys.is_some()); + assert_eq!(data.email_verification_token.as_deref(), Some("token")); + } + + #[test] + fn test_register_data_flat_format() { + // Android before 2026.9.0 + let data: RegisterData = serde_json::from_str( + r#"{ + "email": "user@example.com", + "emailVerificationToken": "token", + "masterPasswordHash": "hash", + "masterPasswordHint": null, + "userSymmetricKey": "key", + "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"}, + "kdf": 0, + "kdfIterations": 600000 + }"#, + ) + .unwrap(); + + assert!(!data.unprocessable()); + assert_eq!(data.hash(), "hash"); + assert_eq!(data.key(), "key"); + assert_eq!(data.kdf().kdf_iterations, 600_000); + assert!(data.keys.is_some()); + } +} diff --git a/src/api/core/ciphers.rs b/src/api/core/ciphers.rs index a5b7e58b..5010bd92 100644 --- a/src/api/core/ciphers.rs +++ b/src/api/core/ciphers.rs @@ -1869,7 +1869,7 @@ async fn delete_cipher_by_uuid( #[derive(Deserialize)] #[serde(rename_all = "camelCase")] struct CipherIdsData { - ids: Vec, + ids: HashSet, } async fn delete_multiple_ciphers( @@ -2180,8 +2180,15 @@ impl CipherSyncData { } } + // Generate a HashMap with the Organization UUID as key and the Membership record + let members: HashMap = Membership::find_confirmed_by_user(user_id, conn) + .await + .into_iter() + .map(|m| (m.org_uuid.clone(), m)) + .collect(); + // Generate a list of Cipher UUID's containing a Vec with one or more Attachment records - let orgs = Membership::get_orgs_by_user(user_id, conn).await; + let orgs: Vec = members.keys().cloned().collect(); let attachments = Attachment::find_all_by_user_and_orgs(user_id, &orgs, conn).await; let mut cipher_attachments: HashMap> = HashMap::with_capacity(attachments.len()); for attachment in attachments { @@ -2196,13 +2203,6 @@ impl CipherSyncData { cipher_collections.entry(cipher).or_default().push(collection); } - // Generate a HashMap with the Organization UUID as key and the Membership record - let members: HashMap = Membership::find_confirmed_by_user(user_id, conn) - .await - .into_iter() - .map(|m| (m.org_uuid.clone(), m)) - .collect(); - // Generate a HashMap with the User_Collections UUID as key and the CollectionUser record let user_collections: HashMap = CollectionUser::find_by_user(user_id, conn) .await diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs index 2ff56fe5..00ffd33b 100644 --- a/src/api/core/organizations.rs +++ b/src/api/core/organizations.rs @@ -15,10 +15,10 @@ use crate::{ db::{ DbConn, models::{ - Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType, - Group, GroupId, GroupUser, Invitation, MaximumVaultTimeoutPolicyData, Membership, MembershipId, - MembershipStatus, MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, - OrganizationId, TwoFactor, TwoFactorType, User, UserId, + Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, Device, + EventType, Group, GroupId, GroupUser, Invitation, MaximumVaultTimeoutPolicyData, Membership, MembershipId, + MembershipStatus, MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, + TwoFactor, TwoFactorType, User, UserId, }, }, mail, @@ -31,7 +31,6 @@ pub fn routes() -> Vec { get_organization, create_organization, delete_organization, - post_delete_organization, leave_organization, get_user_collections, get_org_collections, @@ -39,13 +38,10 @@ pub fn routes() -> Vec { get_org_collection_detail, get_collection_users, put_organization, - post_organization, post_organization_collections, post_bulk_access_collections, - post_organization_collection_update, put_organization_collection_update, delete_organization_collection, - post_organization_collection_delete, bulk_delete_organization_collections, post_bulk_collections, get_org_details, @@ -60,7 +56,6 @@ pub fn routes() -> Vec { get_org_user_mini_details, get_user, edit_member, - put_member, delete_member, bulk_delete_member, post_org_import, @@ -70,7 +65,6 @@ pub fn routes() -> Vec { get_master_password_policy, get_policy, put_policy, - put_policy_vnext, get_plans, post_org_keys, get_organization_keys, @@ -86,22 +80,16 @@ pub fn routes() -> Vec { post_groups, get_group, put_group, - post_group, get_group_details, delete_group, - post_delete_group, bulk_delete_groups, get_group_members, - put_group_members, - post_delete_group_member, put_reset_password_enrollment, get_reset_password_details, - put_reset_password, put_recover_account, get_org_export, post_api_key, rotate_api_key, - get_billing_metadata, get_billing_warnings, get_auto_enroll_status, get_self_host_billing_metadata, @@ -245,16 +233,6 @@ async fn delete_organization( } } -#[post("/organizations//delete", data = "")] -async fn post_delete_organization( - org_id: OrganizationId, - data: Json, - headers: OwnerHeaders, - conn: DbConn, -) -> EmptyResult { - delete_organization(org_id, data, headers, conn).await -} - #[post("/organizations//leave")] async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> EmptyResult { if headers.membership.status != MembershipStatus::Confirmed as i32 { @@ -300,16 +278,6 @@ async fn put_organization( headers: OwnerHeaders, data: Json, conn: DbConn, -) -> JsonResult { - post_organization(org_id, headers, data, conn).await -} - -#[post("/organizations/", data = "")] -async fn post_organization( - org_id: OrganizationId, - headers: OwnerHeaders, - data: Json, - conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); @@ -415,8 +383,9 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea let col_users = CollectionUser::find_by_organization_swap_user_uuid_with_member_uuid(&org_id, &conn).await; // Generate a HashMap to get the correct MembershipType per user to determine the manage permission // We use the uuid instead of the user_uuid here, since that is what is used in CollectionUser + // This lists other members for admins, so it must not depend on the membership status let membership_type: HashMap = - Membership::find_confirmed_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect(); + Membership::find_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect(); // check if current user has full access to the organization (either directly or via any group) let has_full_access_to_org = member.has_full_access() @@ -639,17 +608,6 @@ async fn put_organization_collection_update( headers: ManagerHeaders, data: Json, conn: DbConn, -) -> JsonResult { - post_organization_collection_update(org_id, col_id, headers, data, conn).await -} - -#[post("/organizations//collections/", data = "", rank = 2)] -async fn post_organization_collection_update( - org_id: OrganizationId, - col_id: CollectionId, - headers: ManagerHeaders, - data: Json, - conn: DbConn, ) -> JsonResult { if org_id != headers.org_id { err!("Organization not found", "Organization id's do not match"); @@ -745,16 +703,6 @@ async fn delete_organization_collection( delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await } -#[post("/organizations//collections//delete")] -async fn post_organization_collection_delete( - org_id: OrganizationId, - col_id: CollectionId, - headers: ManagerHeaders, - conn: DbConn, -) -> EmptyResult { - delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await -} - #[derive(Deserialize, Debug)] #[serde(rename_all = "camelCase")] struct BulkCollectionIds { @@ -818,11 +766,9 @@ async fn get_org_collection_detail( // Generate a HashMap to get the correct MembershipType per user to determine the manage permission // We use the uuid instead of the user_uuid here, since that is what is used in CollectionUser - let membership_type: HashMap = Membership::find_confirmed_by_org(&org_id, &conn) - .await - .into_iter() - .map(|m| (m.uuid, m.atype)) - .collect(); + // This lists other members for admins, so it must not depend on the membership status + let membership_type: HashMap = + Membership::find_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect(); let users: Vec = CollectionUser::find_by_org_and_coll_swap_user_uuid_with_member_uuid(&org_id, &collection.uuid, &conn) @@ -960,8 +906,9 @@ async fn get_members( let mut users_json = Vec::new(); for u in Membership::find_by_org(&org_id, &conn).await { + // The user can be a manager instead of an admin, but we've checked above that they have full access users_json.push( - u.to_json_user_details( + u.to_json_details_for_admin( data.include_collections.unwrap_or(false), data.include_groups.unwrap_or(false), &conn, @@ -1516,7 +1463,9 @@ async fn get_user( // In this case, when groups are requested we also need to include collections. // Else these will not be shown in the interface, and could lead to missing collections when saved. let include_groups = data.include_groups.unwrap_or(false); - Ok(Json(user.to_json_user_details(data.include_collections.unwrap_or(include_groups), include_groups, &conn).await)) + Ok(Json( + user.to_json_details_for_admin(data.include_collections.unwrap_or(include_groups), include_groups, &conn).await, + )) } #[derive(Deserialize)] @@ -1530,17 +1479,6 @@ struct EditUserData { } #[put("/organizations//users/", data = "", rank = 1)] -async fn put_member( - org_id: OrganizationId, - member_id: MembershipId, - data: Json, - headers: AdminHeaders, - conn: DbConn, -) -> EmptyResult { - edit_member(org_id, member_id, data, headers, conn).await -} - -#[post("/organizations//users/", data = "", rank = 1)] async fn edit_member( org_id: OrganizationId, member_id: MembershipId, @@ -1835,6 +1773,10 @@ async fn post_org_import( if org_id != headers.membership.org_uuid { err!("Organization not found", "Organization id's do not match"); } + // OrgMemberHeaders also allows invited and accepted members, which are not allowed to import + if headers.membership.status != MembershipStatus::Confirmed as i32 { + err!("You need to be a Member of the Organization to call this endpoint") + } let data: ImportData = data.into_inner(); // Validate the import before continuing @@ -1916,7 +1858,7 @@ async fn post_org_import( #[serde(rename_all = "camelCase")] struct BulkCollectionsData { organization_id: OrganizationId, - cipher_ids: Vec, + cipher_ids: HashSet, collection_ids: HashSet, remove_collections: bool, } @@ -2207,18 +2149,6 @@ async fn put_policy( Ok(Json(policy.to_json())) } -// Deprecated with client v2026.5.0 -#[put("/organizations//policies//vnext", data = "")] -async fn put_policy_vnext( - org_id: OrganizationId, - pol_type: i32, - data: Json, - headers: AdminHeaders, - conn: DbConn, -) -> JsonResult { - put_policy(org_id, pol_type, data, headers, conn).await -} - #[get("/plans")] fn get_plans() -> Json { // Respond with a minimal json just enough to allow the creation of an new organization. @@ -2247,12 +2177,6 @@ fn get_plans() -> Json { })) } -#[get("/organizations/<_org_id>/billing/metadata")] -fn get_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json { - // Prevent a 404 error, which also causes Javascript errors. - Json(empty_data_json()) -} - #[get("/organizations/<_org_id>/billing/vnext/warnings")] fn get_billing_warnings(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json { Json(json!({ @@ -2272,14 +2196,6 @@ fn get_self_host_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHe })) } -fn empty_data_json() -> Value { - json!({ - "object": "list", - "data": [], - "continuationToken": null - }) -} - #[derive(Deserialize, Debug)] #[serde(rename_all = "camelCase")] struct BulkRevokeMembershipIds { @@ -2598,17 +2514,6 @@ impl CollectionData { } } -#[post("/organizations//groups/", data = "")] -async fn post_group( - org_id: OrganizationId, - group_id: GroupId, - data: Json, - headers: AdminHeaders, - conn: DbConn, -) -> JsonResult { - put_group(org_id, group_id, data, headers, conn).await -} - #[post("/organizations//groups", data = "")] async fn post_groups( org_id: OrganizationId, @@ -2718,7 +2623,6 @@ async fn add_update_group( "id": group.uuid, "organizationId": group.organizations_uuid, "name": group.name, - "accessAll": group.access_all, "externalId": group.external_id, "object": "group" }))) @@ -2745,16 +2649,6 @@ async fn get_group_details( Ok(Json(group.to_json_details(&conn).await)) } -#[post("/organizations//groups//delete")] -async fn post_delete_group( - org_id: OrganizationId, - group_id: GroupId, - headers: AdminHeaders, - conn: DbConn, -) -> EmptyResult { - delete_group_impl(&org_id, &group_id, &headers, &conn).await -} - #[delete("/organizations//groups/")] async fn delete_group(org_id: OrganizationId, group_id: GroupId, headers: AdminHeaders, conn: DbConn) -> EmptyResult { delete_group_impl(&org_id, &group_id, &headers, &conn).await @@ -2856,90 +2750,6 @@ async fn get_group_members( Ok(Json(json!(group_members))) } -#[put("/organizations//groups//users", data = "")] -async fn put_group_members( - org_id: OrganizationId, - group_id: GroupId, - headers: AdminHeaders, - data: Json>, - conn: DbConn, -) -> EmptyResult { - if org_id != headers.org_id { - err!("Organization not found", "Organization id's do not match"); - } - if !CONFIG.org_groups_enabled() { - err!("Group support is disabled"); - } - - if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() { - err!("Group could not be found!", "Group uuid is invalid or does not belong to the organization") - } - - let assigned_members = data.into_inner(); - - let org_memberships = Membership::find_by_org(&org_id, &conn).await; - let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect(); - if let Some(e) = assigned_members.iter().find(|m| !org_membership_ids.contains(m)) { - err!("Invalid member", format!("Member {} does not belong to organization {}!", e, org_id)) - } - - GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?; - for assigned_member in assigned_members { - let mut user_entry = GroupUser::new(group_id.clone(), assigned_member.clone()); - user_entry.save(&conn).await?; - - log_event( - EventType::OrganizationUserUpdatedGroups, - &assigned_member, - &org_id, - &headers.user.uuid, - headers.device.atype, - &headers.ip.ip, - &conn, - ) - .await; - } - - Ok(()) -} - -#[post("/organizations//groups//delete-user/")] -async fn post_delete_group_member( - org_id: OrganizationId, - group_id: GroupId, - member_id: MembershipId, - headers: AdminHeaders, - conn: DbConn, -) -> EmptyResult { - if org_id != headers.org_id { - err!("Organization not found", "Organization id's do not match"); - } - if !CONFIG.org_groups_enabled() { - err!("Group support is disabled"); - } - - if Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await.is_none() { - err!("User could not be found or does not belong to the organization."); - } - - if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() { - err!("Group could not be found or does not belong to the organization."); - } - - log_event( - EventType::OrganizationUserUpdatedGroups, - &member_id, - &org_id, - &headers.user.uuid, - headers.device.atype, - &headers.ip.ip, - &conn, - ) - .await; - - GroupUser::delete_by_group_and_member(&group_id, &member_id, &conn).await -} - #[derive(Deserialize)] #[serde(rename_all = "camelCase")] struct OrganizationUserResetPasswordEnrollmentRequest { @@ -2999,19 +2809,6 @@ async fn put_recover_account( recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await } -// Deprecated since `v2026.4.2` -#[put("/organizations//users//reset-password", data = "")] -async fn put_reset_password( - org_id: OrganizationId, - member_id: MembershipId, - headers: AdminHeaders, - data: Json, - conn: DbConn, - nt: Notify<'_>, -) -> EmptyResult { - recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await -} - async fn recover_account( org_id: OrganizationId, member_id: MembershipId, @@ -3044,11 +2841,12 @@ async fn recover_account( err!("Organization user must be confirmed for password reset functionality"); } - let fallback_2fa_email = if req.reset_two_factor && CONFIG.email_2fa_auto_fallback() { - TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none() - } else { - false - }; + let fallback_2fa_email = + if req.reset_two_factor && CONFIG.mail_enabled() && CONFIG.email_2fa_auto_fallback() && user.verified() { + TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none() + } else { + false + }; // Sending email first ensure working email configuration and the resulting user notification. // Also this might add some protection against security flaws and misuse @@ -3077,6 +2875,7 @@ async fn recover_account( if req.reset_two_factor { TwoFactor::delete_all_by_user(&user.uuid, &conn).await?; + Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?; if !fallback_2fa_email || two_factor::email::find_and_activate_email_2fa(&user.uuid, &conn).await.is_err() { two_factor::enforce_2fa_policy(&user, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn) .await?; @@ -3245,7 +3044,7 @@ async fn api_key( org_id: &OrganizationId, data: Json, rotate: bool, - headers: AdminHeaders, + headers: OwnerHeaders, conn: DbConn, ) -> JsonResult { if org_id != &headers.org_id { @@ -3254,7 +3053,7 @@ async fn api_key( let data: PasswordOrOtpData = data.into_inner(); let user = headers.user; - // Validate the admin users password/otp + // Validate the owner users password/otp data.validate(&user, true, &conn).await?; let org_api_key = if let Some(mut org_api_key) = OrganizationApiKey::find_by_org_uuid(org_id, &conn).await { @@ -3282,7 +3081,7 @@ async fn api_key( async fn post_api_key( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: OwnerHeaders, conn: DbConn, ) -> JsonResult { api_key(&org_id, data, false, headers, conn).await @@ -3292,7 +3091,7 @@ async fn post_api_key( async fn rotate_api_key( org_id: OrganizationId, data: Json, - headers: AdminHeaders, + headers: OwnerHeaders, conn: DbConn, ) -> JsonResult { api_key(&org_id, data, true, headers, conn).await diff --git a/src/api/core/sends.rs b/src/api/core/sends.rs index 042ce95b..bfff4e96 100644 --- a/src/api/core/sends.rs +++ b/src/api/core/sends.rs @@ -12,7 +12,7 @@ use serde_json::Value; use crate::{ CONFIG, api::{ApiResult, EmptyResult, JsonResult, Notify, UpdateType}, - auth::{ClientIp, Headers, Host, SendHeaders}, + auth::{Headers, Host, SendHeaders}, config::PathType, db::{ DbConn, DbPool, @@ -46,11 +46,8 @@ pub fn routes() -> Vec { get_sends, get_send, post_send, - post_send_file, post_access, - post_access_legacy, post_access_file, - post_access_file_legacy, put_send, delete_send, put_remove_password, @@ -73,7 +70,7 @@ pub async fn purge_sends(pool: DbPool) { #[serde(rename_all = "camelCase")] pub struct SendData { r#type: i32, - key: String, + pub key: String, password: Option, max_access_count: Option, expiration_date: Option>, @@ -201,7 +198,7 @@ async fn post_send(data: Json, headers: Headers, conn: DbConn, nt: Not enforce_disable_hide_email_policy(&data, &headers, &conn).await?; if data.r#type == SendType::File as i32 { - err!("File sends should use /api/sends/file") + err!("File sends should use /api/sends/file/v2") } let mut send = create_send(data, headers.user.uuid)?; @@ -218,93 +215,11 @@ async fn post_send(data: Json, headers: Headers, conn: DbConn, nt: Not Ok(Json(send.to_json())) } -#[derive(FromForm)] -struct UploadData<'f> { - model: Json, - data: TempFile<'f>, -} - #[derive(FromForm)] struct UploadDataV2<'f> { data: TempFile<'f>, } -// @deprecated Mar 25 2021: This method has been deprecated in favor of direct uploads (v2). -// This method still exists to support older clients, probably need to remove it sometime. -// Upstream: https://github.com/bitwarden/server/blob/d0c793c95181dfb1b447eb450f85ba0bfd7ef643/src/Api/Controllers/SendsController.cs#L164-L167 -// 2025: This endpoint doesn't seem to exists anymore in the latest version -// See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs -#[post("/sends/file", format = "multipart/form-data", data = "")] -async fn post_send_file(data: Form>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult { - enforce_disable_send_policy(&headers, &conn).await?; - - let UploadData { - model, - data, - } = data.into_inner(); - let model = model.into_inner(); - - let Some(size) = data.len().to_i64() else { - err!("Invalid send size"); - }; - if size < 0 { - err!("Send size can't be negative") - } - - enforce_disable_hide_email_policy(&model, &headers, &conn).await?; - - let size_limit = match CONFIG.user_send_limit() { - Some(0) => err!("File uploads are disabled"), - Some(limit_kb) => { - let Some(already_used) = Send::size_by_user(&headers.user.uuid, &conn).await else { - err!("Existing sends overflow") - }; - let Some(left) = limit_kb.checked_mul(1024).and_then(|l| l.checked_sub(already_used)) else { - err!("Send size overflow"); - }; - if left <= 0 { - err!("Send storage limit reached! Delete some sends to free up space") - } - i64::clamp(left, 0, SIZE_525_MB) - } - None => SIZE_525_MB, - }; - - if size > size_limit { - err!("Send storage limit exceeded with this file"); - } - - let mut send = create_send(model, headers.user.uuid)?; - if send.atype != SendType::File as i32 { - err!("Send content is not a file"); - } - - let file_id = crate::crypto::generate_send_file_id(); - - save_temp_file(&PathType::Sends, &format!("{}/{file_id}", send.uuid), data, true).await?; - - let mut data_value: Value = serde_json::from_str(&send.data)?; - if let Some(o) = data_value.as_object_mut() { - o.insert(String::from("id"), Value::String(file_id)); - o.insert(String::from("size"), Value::Number(size.into())); - o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(size))); - } - send.data = serde_json::to_string(&data_value)?; - - // Save the changes in the database - send.save(&conn).await?; - nt.send_send_update( - UpdateType::SyncSendCreate, - &send, - &send.update_users_revision(&conn).await, - &headers.device, - &conn, - ) - .await; - - Ok(Json(send.to_json())) -} - // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L165 #[post("/sends/file/v2", data = "")] async fn post_send_file_v2(data: Json, headers: Headers, conn: DbConn) -> JsonResult { @@ -450,63 +365,16 @@ async fn post_send_file_v2_data( #[post("/sends/access")] async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> JsonResult { - let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else { + let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else { err_code!(SEND_INACCESSIBLE_MSG, 404) }; if !send.is_accessible() { err_code!(SEND_INACCESSIBLE_MSG, 404) } - process_access(send, conn, nt).await -} - -#[derive(Deserialize)] -#[serde(rename_all = "camelCase")] -pub struct SendAccessData { - pub password: Option, -} - -// Legacy since web-2026.6.0 -#[post("/sends/access/", data = "")] -async fn post_access_legacy( - access_id: &str, - data: Json, - conn: DbConn, - ip: ClientIp, - nt: Notify<'_>, -) -> JsonResult { - crate::ratelimit::check_limit_unauthenticated(&ip.ip)?; - - let Some(mut send) = Send::find_by_access_id(access_id, &conn).await else { - err_code!(SEND_INACCESSIBLE_MSG, 404) - }; - - if let Some(max_access_count) = send.max_access_count - && send.access_count >= max_access_count - { - err_code!(SEND_INACCESSIBLE_MSG, 404); - } - - if !send.is_accessible() { - err_code!(SEND_INACCESSIBLE_MSG, 404) - } - - if send.password_hash.is_some() { - match data.into_inner().password { - Some(ref p) if send.check_password(p) => { /* Nothing to do here */ } - Some(_) => err!("Invalid password", format!("IP: {}.", ip.ip)), - None => err_code!("Password not provided", format!("IP: {}.", ip.ip), 401), - } - } - // Files are incremented during the download - if send.atype == SendType::Text as i32 { - if !send.register_access(&conn).await? { - err_code!(SEND_INACCESSIBLE_MSG, 404) - } - } else { - send.save(&conn).await?; + if send.atype == SendType::Text as i32 && !send.register_access(&conn).await? { + err_code!(SEND_INACCESSIBLE_MSG, 404) } - process_access(send, conn, nt).await } @@ -531,55 +399,27 @@ async fn post_access_file( conn: DbConn, nt: Notify<'_>, ) -> JsonResult { - let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else { + let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else { err_code!(SEND_INACCESSIBLE_MSG, 404) }; if !send.is_accessible() { err_code!(SEND_INACCESSIBLE_MSG, 404) } - process_access_file(send, file_id, host, conn, nt).await -} - -// Legacy since web-2026.6.0 -#[post("/sends//access/file/", data = "")] -async fn post_access_file_legacy( - send_id: SendId, - file_id: SendFileId, - data: Json, - host: Host, - conn: DbConn, - ip: ClientIp, - nt: Notify<'_>, -) -> JsonResult { - crate::ratelimit::check_limit_unauthenticated(&ip.ip)?; - - let Some(mut send) = Send::find_by_uuid(&send_id, &conn).await else { - err_code!(SEND_INACCESSIBLE_MSG, 404) - }; - - if let Some(max_access_count) = send.max_access_count - && send.access_count >= max_access_count - { - err_code!(SEND_INACCESSIBLE_MSG, 404) - } - - if !send.is_accessible() { + check_send_file_id(&send, &file_id)?; + if !send.register_access(&conn).await? { err_code!(SEND_INACCESSIBLE_MSG, 404) } + process_access_file(send, file_id, host, conn, nt).await +} - if send.password_hash.is_some() { - match data.into_inner().password { - Some(ref p) if send.check_password(p) => { /* Nothing to do here */ } - Some(_) => err!("Invalid password."), - None => err_code!("Password not provided", 401), - } +fn check_send_file_id(send: &Send, file_id: &SendFileId) -> EmptyResult { + if send.atype != SendType::File as i32 { + err!("Send is not a file type send."); } - - if !send.register_access(&conn).await? { - err_code!(SEND_INACCESSIBLE_MSG, 404) + match serde_json::from_str::(&send.data) { + Ok(data) if &data.id == file_id => Ok(()), + _ => err_code!(SEND_INACCESSIBLE_MSG, 404), } - - process_access_file(send, file_id, host, conn, nt).await } async fn process_access_file(send: Send, file_id: SendFileId, host: Host, conn: DbConn, nt: Notify<'_>) -> JsonResult { @@ -642,7 +482,7 @@ async fn put_send(send_id: SendId, data: Json, headers: Headers, conn: Ok(Json(send.to_json())) } -pub async fn update_send_from_data( +async fn update_send_from_data( send: &mut Send, data: SendData, headers: &Headers, diff --git a/src/api/core/two_factor/authenticator.rs b/src/api/core/two_factor/authenticator.rs index 692e8248..99b5c67c 100644 --- a/src/api/core/two_factor/authenticator.rs +++ b/src/api/core/two_factor/authenticator.rs @@ -7,7 +7,7 @@ use crate::{ crypto, db::{ DbConn, - models::{EventType, TwoFactor, TwoFactorType, UserId}, + models::{Device, EventType, TwoFactor, TwoFactorType, UserId}, }, util::NumberOrString, }; @@ -200,6 +200,7 @@ async fn disable_authenticator(data: Json, headers: He if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await { if twofactor.data == data.key { twofactor.delete(&conn).await?; + Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?; log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn) .await; } else { diff --git a/src/api/core/two_factor/duo.rs b/src/api/core/two_factor/duo.rs index ed112eb9..860979ff 100644 --- a/src/api/core/two_factor/duo.rs +++ b/src/api/core/two_factor/duo.rs @@ -1,5 +1,4 @@ use chrono::Utc; -use data_encoding::BASE64; use rocket::{Route, serde::json::Json}; use crate::{ @@ -222,13 +221,6 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) Ok(()) } -const DUO_EXPIRE: i64 = 300; -const APP_EXPIRE: i64 = 3600; - -const AUTH_PREFIX: &str = "AUTH"; -const DUO_PREFIX: &str = "TX"; -const APP_PREFIX: &str = "APP"; - async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus { let type_ = TwoFactorType::Duo as i32; @@ -251,118 +243,13 @@ async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus { DuoStatus::Disabled(false) } -// let (ik, sk, ak, host) = get_duo_keys(); -pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String, String)> { +// let (ik, sk, host) = get_duo_keys_email(); +pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String)> { let data = match User::find_by_mail(email, conn).await { Some(u) => get_user_duo_data(&u.uuid, conn).await.data(), _ => DuoData::global(), } .map_res("Can't fetch Duo Keys")?; - Ok((data.ik, data.sk, CONFIG.get_duo_akey().await, data.host)) -} - -pub async fn generate_duo_signature(email: &str, conn: &DbConn) -> ApiResult<(String, String)> { - let now = Utc::now().timestamp(); - - let (ik, sk, ak, host) = get_duo_keys_email(email, conn).await?; - - let duo_sign = sign_duo_values(&sk, email, &ik, DUO_PREFIX, now + DUO_EXPIRE); - let app_sign = sign_duo_values(&ak, email, &ik, APP_PREFIX, now + APP_EXPIRE); - - Ok((format!("{duo_sign}:{app_sign}"), host)) -} - -fn sign_duo_values(key: &str, email: &str, ikey: &str, prefix: &str, expire: i64) -> String { - let val = format!("{email}|{ikey}|{expire}"); - let cookie = format!("{prefix}|{}", BASE64.encode(val.as_bytes())); - - format!("{cookie}|{}", crypto::hmac_sign(key, &cookie)) -} - -pub async fn validate_duo_login(email: &str, response: &str, conn: &DbConn) -> EmptyResult { - let split: Vec<&str> = response.split(':').collect(); - if split.len() != 2 { - err!( - "Invalid response length", - ErrorEvent { - event: EventType::UserFailedLogIn2fa - } - ); - } - - let auth_sig = split[0]; - let app_sig = split[1]; - - let now = Utc::now().timestamp(); - - let (ik, sk, ak, _host) = get_duo_keys_email(email, conn).await?; - - let auth_user = parse_duo_values(&sk, auth_sig, &ik, AUTH_PREFIX, now)?; - let app_user = parse_duo_values(&ak, app_sig, &ik, APP_PREFIX, now)?; - - if !crypto::ct_eq(&auth_user, app_user) || !crypto::ct_eq(&auth_user, email) { - err!( - "Error validating duo authentication", - ErrorEvent { - event: EventType::UserFailedLogIn2fa - } - ) - } - - Ok(()) -} - -fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -> ApiResult { - let split: Vec<&str> = val.split('|').collect(); - if split.len() != 3 { - err!("Invalid value length") - } - - let u_prefix = split[0]; - let u_b64 = split[1]; - let u_sig = split[2]; - - let sig = crypto::hmac_sign(key, &format!("{u_prefix}|{u_b64}")); - - if !crypto::ct_eq(crypto::hmac_sign(key, &sig), crypto::hmac_sign(key, u_sig)) { - err!("Duo signatures don't match") - } - - if u_prefix != prefix { - err!("Prefixes don't match") - } - - let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else { - err!("Invalid Duo cookie encoding") - }; - - let Ok(cookie) = String::from_utf8(cookie_vec) else { - err!("Invalid Duo cookie encoding") - }; - - let cookie_split: Vec<&str> = cookie.split('|').collect(); - if cookie_split.len() != 3 { - err!("Invalid cookie length") - } - - let username = cookie_split[0]; - let u_ikey = cookie_split[1]; - let expire = cookie_split[2]; - - if !crypto::ct_eq(ikey, u_ikey) { - err!("Invalid ikey") - } - - let expire: i64 = if let Ok(e) = expire.parse() { - e - } else { - err!("Invalid expire time") - }; - - if time >= expire { - err!("Expired authorization") - } - - Ok(username.into()) + Ok((data.ik, data.sk, data.host)) } diff --git a/src/api/core/two_factor/duo_oidc.rs b/src/api/core/two_factor/duo_oidc.rs index adb030af..e5e1df0f 100644 --- a/src/api/core/two_factor/duo_oidc.rs +++ b/src/api/core/two_factor/duo_oidc.rs @@ -383,7 +383,7 @@ pub async fn get_duo_auth_url( device_identifier: &DeviceId, conn: &DbConn, ) -> Result { - let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?; + let (ik, sk, host) = get_duo_keys_email(email, conn).await?; let callback_url = match make_callback_url(client_id) { Ok(url) => url, @@ -435,7 +435,7 @@ pub async fn validate_duo_login( let code = split[0]; let state = split[1]; - let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?; + let (ik, sk, host) = get_duo_keys_email(email, conn).await?; // Get the context by the state reported by the client. If we don't have one, // it means the context is either missing or expired. diff --git a/src/api/core/two_factor/email.rs b/src/api/core/two_factor/email.rs index 3667b871..836d1c47 100644 --- a/src/api/core/two_factor/email.rs +++ b/src/api/core/two_factor/email.rs @@ -65,7 +65,7 @@ async fn send_email_login(data: Json, client_headers: Client let Some(user) = User::find_by_mail(email, &conn).await else { err!( "Username or password is incorrect. Try again", - format!("IP: {}. Username: {email}.", client_headers.ip.ip) + format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug()) ) }; @@ -74,7 +74,7 @@ async fn send_email_login(data: Json, client_headers: Client if !user.check_valid_password(master_password_hash) { err!( "Username or password is incorrect. Try again", - format!("IP: {}. Username: {email}.", client_headers.ip.ip) + format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug()) ) } } else if let Some(auth_request_id) = auth_request_id { @@ -188,7 +188,7 @@ async fn send_email(data: Json, headers: Headers, conn: DbConn) - } let generated_token = crypto::generate_email_token(CONFIG.email_token_size()); - let twofactor_data = EmailTokenData::new(data.email, generated_token); + let twofactor_data = EmailTokenData::new(data.email, Some(generated_token)); // Uses EmailVerificationChallenge as type to show that it's not verified yet. let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json()); @@ -322,10 +322,10 @@ pub struct EmailTokenData { } impl EmailTokenData { - pub fn new(email: String, token: String) -> EmailTokenData { + pub fn new(email: String, token: Option) -> EmailTokenData { EmailTokenData { email, - last_token: Some(token), + last_token: token, token_sent: Utc::now().timestamp(), attempts: 0, } @@ -363,7 +363,8 @@ pub async fn activate_email_2fa(user: &User, conn: &DbConn) -> EmptyResult { if user.verified_at.is_none() { err!("Auto-enabling of email 2FA failed because the users email address has not been verified!"); } - let twofactor_data = EmailTokenData::new(user.email.clone(), String::new()); + // The token is set when the first code is sent + let twofactor_data = EmailTokenData::new(user.email.clone(), None); let twofactor = TwoFactor::new(user.uuid.clone(), TwoFactorType::Email, twofactor_data.to_json()); twofactor.save(conn).await } diff --git a/src/api/core/two_factor/mod.rs b/src/api/core/two_factor/mod.rs index 0eb6563e..14bdafd5 100644 --- a/src/api/core/two_factor/mod.rs +++ b/src/api/core/two_factor/mod.rs @@ -69,13 +69,7 @@ pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data } pub fn routes() -> Vec { - let mut routes = routes![ - get_twofactor, - get_recover, - disable_twofactor, - disable_twofactor_put, - get_device_verification_settings, - ]; + let mut routes = routes![get_twofactor, get_recover, disable_twofactor, get_device_verification_settings]; routes.append(&mut authenticator::routes()); routes.append(&mut duo::routes()); @@ -134,7 +128,7 @@ struct DisableTwoFactorData { r#type: NumberOrString, } -#[post("/two-factor/disable", data = "")] +#[put("/two-factor/disable", data = "")] async fn disable_twofactor(data: Json, headers: Headers, conn: DbConn) -> JsonResult { let data: DisableTwoFactorData = data.into_inner(); let user = headers.user; @@ -167,11 +161,6 @@ async fn disable_twofactor(data: Json, headers: Headers, c }))) } -#[put("/two-factor/disable", data = "")] -async fn disable_twofactor_put(data: Json, headers: Headers, conn: DbConn) -> JsonResult { - disable_twofactor(data, headers, conn).await -} - pub async fn enforce_2fa_policy( user: &User, act_user_id: &UserId, diff --git a/src/api/core/two_factor/webauthn.rs b/src/api/core/two_factor/webauthn.rs index 07b964e5..a3a9b21b 100644 --- a/src/api/core/two_factor/webauthn.rs +++ b/src/api/core/two_factor/webauthn.rs @@ -24,7 +24,7 @@ use crate::{ crypto::ct_eq, db::{ DbConn, - models::{EventType, TwoFactor, TwoFactorType, UserId}, + models::{Device, EventType, TwoFactor, TwoFactorType, UserId}, }, error::Error, util::NumberOrString, @@ -338,6 +338,7 @@ async fn delete_webauthn(data: Json, headers: Headers, conn: DbCo tf.data = serde_json::to_string(&data)?; tf.save(&conn).await?; drop(tf); + Device::clear_twofactor_remember_by_user(&headers.user.uuid, &conn).await?; // If entry is migrated from u2f, delete the u2f entry as well if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await diff --git a/src/api/identity.rs b/src/api/identity.rs index 6808ddde..702a0d0e 100644 --- a/src/api/identity.rs +++ b/src/api/identity.rs @@ -17,15 +17,14 @@ use crate::{ accounts::{PreloginData, RegisterData, kdf_upgrade, prelogin, register}, log_user_event, two_factor::{ - authenticator, duo, duo_oidc, email, enforce_2fa_policy, is_twofactor_provider_usable, webauthn, - yubikey, + authenticator, duo_oidc, email, enforce_2fa_policy, is_twofactor_provider_usable, webauthn, yubikey, }, }, master_password_policy, push::register_push_device, }, auth, - auth::{AuthMethod, ClientHeaders, ClientIp, ClientVersion, Secure, generate_organization_api_key_login_claims}, + auth::{AuthMethod, ClientHeaders, ClientIp, Secure, generate_organization_api_key_login_claims}, crypto, db::{ DbConn, @@ -46,7 +45,6 @@ pub fn routes() -> Vec { login, post_prelogin, prelogin_password, - identity_register, register_verification_email, register_finish, prevalidate, @@ -57,12 +55,7 @@ pub fn routes() -> Vec { } #[post("/connect/token", data = "")] -async fn login( - data: Form, - client_header: ClientHeaders, - client_version: Option, - conn: DbConn, -) -> JsonResult { +async fn login(data: Form, client_header: ClientHeaders, conn: DbConn) -> JsonResult { let data: ConnectData = data.into_inner(); let mut user_id: Option = None; @@ -83,7 +76,7 @@ async fn login( check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?; check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?; - password_login(data, &mut user_id, &conn, &client_header.ip, client_version.as_ref()).await + password_login(data, &mut user_id, &conn, &client_header.ip).await } "client_credentials" => { check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?; @@ -105,7 +98,7 @@ async fn login( check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?; check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?; - sso_login(data, &mut user_id, &conn, &client_header.ip, client_version.as_ref()).await + sso_login(data, &mut user_id, &conn, &client_header.ip).await } "authorization_code" => err!("SSO sign-in is not available"), "send_access" => { @@ -190,13 +183,7 @@ async fn refresh_login(data: ConnectData, conn: &DbConn, ip: &ClientIp) -> JsonR } // After exchanging the code we need to check first if 2FA is needed before continuing -async fn sso_login( - data: ConnectData, - user_id: &mut Option, - conn: &DbConn, - ip: &ClientIp, - client_version: Option<&ClientVersion>, -) -> JsonResult { +async fn sso_login(data: ConnectData, user_id: &mut Option, conn: &DbConn, ip: &ClientIp) -> JsonResult { AuthMethod::Sso.check_scope(data.scope.as_ref())?; // Ratelimit the login @@ -353,7 +340,7 @@ async fn sso_login( Some((mut user, sso_user)) => { let mut device = get_device(&data, conn, &user).await?; - let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?; + let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?; if user.private_key.is_none() { // User was invited a stub was created @@ -385,13 +372,7 @@ async fn sso_login( authenticated_response(&user, &mut device, auth_tokens, twofactor_token, conn, ip).await } -async fn password_login( - data: ConnectData, - user_id: &mut Option, - conn: &DbConn, - ip: &ClientIp, - client_version: Option<&ClientVersion>, -) -> JsonResult { +async fn password_login(data: ConnectData, user_id: &mut Option, conn: &DbConn, ip: &ClientIp) -> JsonResult { // Validate scope AuthMethod::Password.check_scope(data.scope.as_ref())?; @@ -400,24 +381,14 @@ async fn password_login( // Get the user let username = data.username.as_ref().unwrap().trim(); + let log_username = username.escape_debug(); let Some(mut user) = User::find_by_mail(username, conn).await else { - err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {username}.", ip.ip)) + err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {log_username}.", ip.ip)) }; // Set the user_id here to be passed back used for event logging. *user_id = Some(user.uuid.clone()); - // Check if the user is disabled - if !user.enabled { - err!( - "This user has been disabled", - format!("IP: {}. Username: {username}.", ip.ip), - ErrorEvent { - event: EventType::UserFailedLogIn - } - ) - } - let password = data.password.as_ref().unwrap(); // If we get an auth request, we don't check the user's password, but the access code of the auth request @@ -425,7 +396,7 @@ async fn password_login( let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, conn).await else { err!( "Auth request not found. Try again.", - format!("IP: {}. Username: {username}.", ip.ip), + format!("IP: {}. Username: {log_username}.", ip.ip), ErrorEvent { event: EventType::UserFailedLogIn, } @@ -443,7 +414,7 @@ async fn password_login( { err!( "Username or access code is incorrect. Try again", - format!("IP: {}. Username: {username}.", ip.ip), + format!("IP: {}. Username: {log_username}.", ip.ip), ErrorEvent { event: EventType::UserFailedLogIn, } @@ -452,13 +423,24 @@ async fn password_login( } else if !user.check_valid_password(password) { err!( "Username or password is incorrect. Try again", - format!("IP: {}. Username: {username}.", ip.ip), + format!("IP: {}. Username: {log_username}.", ip.ip), ErrorEvent { event: EventType::UserFailedLogIn, } ) } + // Check if the user is disabled + if !user.enabled { + err!( + "This user has been disabled", + format!("IP: {}. Username: {log_username}.", ip.ip), + ErrorEvent { + event: EventType::UserFailedLogIn + } + ) + } + // Change the KDF Iterations (only when not logging in with an auth request) if data.auth_request.is_none() { kdf_upgrade(&mut user, password, conn).await?; @@ -491,7 +473,7 @@ async fn password_login( // We still want the login to fail until they actually verified the email address err!( "Please verify your email before trying again.", - format!("IP: {}. Username: {username}.", ip.ip), + format!("IP: {}. Username: {log_username}.", ip.ip), ErrorEvent { event: EventType::UserFailedLogIn } @@ -500,7 +482,7 @@ async fn password_login( let mut device = get_device(&data, conn, &user).await?; - let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?; + let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?; let auth_tokens = auth::AuthTokens::new(&device, &user, AuthMethod::Password, data.client_id); @@ -583,7 +565,6 @@ async fn authenticated_response( "KdfIterations": user.client_kdf_iter, "KdfMemory": user.client_kdf_memory, "KdfParallelism": user.client_kdf_parallelism, - "ResetMasterPassword": false, // TODO: Same as above "ForcePasswordReset": false, "MasterPasswordPolicy": master_password_policy, "scope": auth_tokens.scope(), @@ -737,7 +718,6 @@ async fn user_api_key_login( "KdfIterations": user.client_kdf_iter, "KdfMemory": user.client_kdf_memory, "KdfParallelism": user.client_kdf_parallelism, - "ResetMasterPassword": false, // TODO: according to official server seems something like: user.password_hash.is_empty(), but would need testing "ForcePasswordReset": false, "scope": AuthMethod::UserApiKey.scope(), "AccountKeys": account_keys, @@ -803,7 +783,6 @@ async fn twofactor_auth( data: &ConnectData, device: &mut Device, ip: &ClientIp, - client_version: Option<&ClientVersion>, conn: &DbConn, ) -> ApiResult> { let twofactors = TwoFactor::find_by_user(&user.uuid, conn).await; @@ -832,17 +811,12 @@ async fn twofactor_auth( if ![TwoFactorType::Remember as i32, TwoFactorType::RecoveryCode as i32].contains(&selected_id) && !twofactor_ids.contains(&selected_id) { - err_json!( - json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?, - "Invalid two factor provider" - ) + err_json!(json_err_twofactor(&twofactor_ids, &user.uuid, data, conn).await?, "Invalid two factor provider") } - let Some(ref twofactor_code) = data.two_factor_token else { - err_json!( - json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?, - "2FA token not provided" - ) + // Like upstream, a blank token counts as not provided + let Some(twofactor_code) = data.two_factor_token.as_deref().filter(|t| !t.trim().is_empty()) else { + err_json!(json_err_twofactor(&twofactor_ids, &user.uuid, data, conn).await?, "2FA token not provided") }; let selected_twofactor = twofactors.into_iter().find(|tf| tf.atype == selected_id && tf.enabled); @@ -856,20 +830,14 @@ async fn twofactor_auth( Some(TwoFactorType::Webauthn) => webauthn::validate_webauthn_login(&user.uuid, twofactor_code, conn).await?, Some(TwoFactorType::YubiKey) => yubikey::validate_yubikey_login(twofactor_code, &selected_data?).await?, Some(TwoFactorType::Duo) => { - if CONFIG.duo_use_iframe() { - // Legacy iframe prompt flow - duo::validate_duo_login(&user.email, twofactor_code, conn).await?; - } else { - // OIDC based flow - duo_oidc::validate_duo_login( - &user.email, - twofactor_code, - data.client_id.as_ref().unwrap(), - data.device_identifier.as_ref().unwrap(), - conn, - ) - .await?; - } + duo_oidc::validate_duo_login( + &user.email, + twofactor_code, + data.client_id.as_ref().unwrap(), + data.device_identifier.as_ref().unwrap(), + conn, + ) + .await?; } Some(TwoFactorType::Email) => { email::validate_email_code_str(&user.uuid, twofactor_code, &selected_data?, &ip.ip, conn).await?; @@ -891,7 +859,7 @@ async fn twofactor_auth( device.save(true, conn).await?; } err_json!( - json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?, + json_err_twofactor(&twofactor_ids, &user.uuid, data, conn).await?, "2FA Remember token not provided or expired" ) } @@ -946,7 +914,6 @@ async fn json_err_twofactor( providers: &[i32], user_id: &UserId, data: &ConnectData, - client_version: Option<&ClientVersion>, conn: &DbConn, ) -> ApiResult { let mut result = json!({ @@ -975,27 +942,17 @@ async fn json_err_twofactor( err!("User does not exist") }; - if CONFIG.duo_use_iframe() { - // Legacy iframe prompt flow - let (signature, host) = duo::generate_duo_signature(&email, conn).await?; - result["TwoFactorProviders2"][provider.to_string()] = json!({ - "Host": host, - "Signature": signature, - }); - } else { - // OIDC based flow - let auth_url = duo_oidc::get_duo_auth_url( - &email, - data.client_id.as_ref().unwrap(), - data.device_identifier.as_ref().unwrap(), - conn, - ) - .await?; + let auth_url = duo_oidc::get_duo_auth_url( + &email, + data.client_id.as_ref().unwrap(), + data.device_identifier.as_ref().unwrap(), + conn, + ) + .await?; - result["TwoFactorProviders2"][provider.to_string()] = json!({ - "AuthUrl": auth_url, - }); - } + result["TwoFactorProviders2"][provider.to_string()] = json!({ + "AuthUrl": auth_url, + }); } Some(tf_type @ TwoFactorType::YubiKey) => { @@ -1015,19 +972,6 @@ async fn json_err_twofactor( err!("No twofactor email registered") }; - // Starting with version 2025.5.0 the client will call `/api/two-factor/send-email-login`. - let disabled_send = if let Some(cv) = client_version { - let ver_match = semver::VersionReq::parse(">=2025.5.0").unwrap(); - ver_match.matches(&cv.0) - } else { - false - }; - - // Send email immediately if email is the only 2FA option. - if providers.len() == 1 && !disabled_send { - email::send_token(user_id, conn).await?; - } - let email_data = email::EmailTokenData::from_json(&twofactor.data)?; result["TwoFactorProviders2"][provider.to_string()] = json!({ "Email": email::obscure_email(&email_data.email), @@ -1065,11 +1009,6 @@ async fn prelogin_password(data: Json, ip: ClientIp, conn: DbConn) prelogin(data, ip, conn).await } -#[post("/accounts/register", data = "")] -async fn identity_register(data: Json, conn: DbConn) -> JsonResult { - register(data, false, conn).await -} - #[derive(Debug, Deserialize)] #[serde(rename_all = "camelCase")] struct RegisterVerificationData { @@ -1141,8 +1080,9 @@ async fn register_verification_email( } #[post("/accounts/register/finish", data = "")] -async fn register_finish(data: Json, conn: DbConn) -> JsonResult { - register(data, true, conn).await +async fn register_finish(data: Json, ip: ClientIp, conn: DbConn) -> JsonResult { + crate::ratelimit::check_limit_unauthenticated(&ip.ip)?; + register(data, conn).await } // https://github.com/bitwarden/jslib/blob/master/common/src/models/request/tokenRequest.ts diff --git a/src/api/web.rs b/src/api/web.rs index d6d8d62c..aa67e614 100644 --- a/src/api/web.rs +++ b/src/api/web.rs @@ -89,6 +89,7 @@ fn vaultwarden_css() -> EtagCached> { // Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS let css_options = json!({ + "email_change_allowed": CONFIG.email_change_allowed(), "emergency_access_allowed": CONFIG.emergency_access_allowed(), "load_user_scss": true, "mail_2fa_enabled": CONFIG._enable_email_2fa(), diff --git a/src/auth.rs b/src/auth.rs index 07373389..39ce2732 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -253,7 +253,7 @@ impl LoginJwtClaims { premium: true, name: user.name.clone(), email: user.email.clone(), - email_verified: !CONFIG.mail_enabled() || user.verified_at.is_some(), + email_verified: user.verified(), // --- // Disabled these keys to be added to the JWT since they could cause the JWT to get too large diff --git a/src/auth/send.rs b/src/auth/send.rs index 2554488a..518b7098 100644 --- a/src/auth/send.rs +++ b/src/auth/send.rs @@ -75,7 +75,7 @@ impl SendTokens { return Self::invalid_error(&format!("Can't convert {access_id}"), "send_id_invalid", false); }; - let Some(mut send) = Send::find_by_uuid(&send_id, conn).await else { + let Some(send) = Send::find_by_uuid(&send_id, conn).await else { return Self::invalid_error(&format!("Can't find {send_id}"), "send_id_invalid", false); }; @@ -103,10 +103,6 @@ impl SendTokens { } } - if !send.register_access(conn).await? { - return Self::invalid_error(&format!("Send {send_id}, max access reached"), "send_id_invalid", true); - } - Ok(Self { access_claims: generate_send_access_claims(&send_id), }) diff --git a/src/config.rs b/src/config.rs index 9f0ae2e1..b03e006c 100644 --- a/src/config.rs +++ b/src/config.rs @@ -561,7 +561,7 @@ make_config! { /// Auth Request cleanup schedule |> Cron schedule of the job that cleans old auth requests from the auth request. /// Defaults to every minute. Set blank to disable this job. auth_request_purge_schedule: String, false, def, "30 * * * * *".to_owned(); - /// Duo Auth context cleanup schedule |> Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt. + /// Duo Auth context cleanup schedule |> Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled. /// Defaults to once every minute. Set blank to disable this job. duo_context_purge_schedule: String, false, def, "30 * * * * *".to_owned(); /// Purge incomplete SSO auth. |> Cron schedule of the job that cleans leftover auth in db due to incomplete SSO login. @@ -865,16 +865,12 @@ make_config! { duo: _enable_duo { /// Enabled _enable_duo: bool, true, def, true; - /// Attempt to use deprecated iframe-based Traditional Prompt (Duo WebSDK 2) - duo_use_iframe: bool, false, def, false; /// Client Id duo_ikey: String, true, option; /// Client Secret duo_skey: Pass, true, option; /// Host duo_host: String, true, option; - /// Application Key (generated automatically) - _duo_akey: Pass, false, option; }, /// SMTP Email Settings @@ -1418,28 +1414,16 @@ pub enum PathType { // Android (v2026.2.1): https://github.com/bitwarden/android/blob/6902c19c0093fa476bbf74ccaa70c9f14afbb82f/core/src/main/kotlin/com/bitwarden/core/data/manager/model/FlagKey.kt#L31 // iOS (v2026.2.1): https://github.com/bitwarden/ios/blob/cdd9ba1770ca2ffc098d02d12cc3208e3a830454/BitwardenShared/Core/Platform/Models/Enum/FeatureFlag.swift#L7 pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[ - // Architecture - "desktop-ui-migration-milestone-1", - "desktop-ui-migration-milestone-2", - "desktop-ui-migration-milestone-3", - "desktop-ui-migration-milestone-4", // Auth Team "pm-5594-safari-account-switching", "pm-32413-multi-client-password-management", // Autofill Team + "undetermined-cipher-scenario-logic", "enable-basic-auth-response", - "ssh-agent", "ssh-agent-v2", // Key Management Team - "ssh-key-vault-item", - "pm-25373-windows-biometrics-v2", - "pm-26340-linux-biometrics-v2", + "windows-native-credential-sync", // Mobile Team - "anon-addy-self-host-alias", - "simple-login-self-host-alias", - "mutual-tls", - "cxp-import-mobile", - "cxp-export-mobile", "pm-34171-card-scanner", // Platform Team "pm-30529-webauthn-related-origins", @@ -1516,15 +1500,6 @@ impl Config { Ok(()) } - async fn update_config_partial(&self, other: ConfigBuilder) -> Result<(), Error> { - let builder = { - let usr = &self.inner.read().unwrap()._usr; - let mut overrides = Vec::new(); - usr.merge(&other, false, &mut overrides) - }; - self.update_config(builder, false).await - } - /// Tests whether an email's domain is allowed. A domain is allowed if it /// is in signups_domains_whitelist, or if no whitelist is set (so there /// are no domain restrictions in effect). @@ -1620,23 +1595,6 @@ impl Config { inner._enable_smtp && (inner.smtp_host.is_some() || inner.use_sendmail) } - pub async fn get_duo_akey(&self) -> String { - if let Some(akey) = self._duo_akey() { - akey - } else { - let akey_s = crate::crypto::encode_random_bytes::<64>(&data_encoding::BASE64); - - // Save the new value - let builder = ConfigBuilder { - _duo_akey: Some(akey_s.clone()), - ..Default::default() - }; - self.update_config_partial(builder).await.ok(); - - akey_s - } - } - pub fn is_webauthn_2fa_supported(&self) -> bool { Url::parse(&self.domain()).expect("DOMAIN not a valid URL").domain().is_some() } diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs index 721d9790..f39b0bfc 100644 --- a/src/db/models/cipher.rs +++ b/src/db/models/cipher.rs @@ -657,16 +657,27 @@ impl Cipher { } async fn get_user_collections_access_flags(&self, user_uuid: &UserId, conn: &DbConn) -> Vec<(bool, bool, bool)> { + let user_uuid = user_uuid.to_string(); conn.run(move |conn| { // Check whether this cipher is in any collections accessible to the // user. If so, retrieve the access flags for each collection. + // The user must have a confirmed membership in the cipher's + // organization, since users_collections rows are kept when a + // membership is revoked or not confirmed yet. ciphers::table .filter(ciphers::uuid.eq(&self.uuid)) .inner_join(ciphers_collections::table.on(ciphers::uuid.eq(ciphers_collections::cipher_uuid))) + .inner_join( + users_organizations::table.on(ciphers::organization_uuid + .eq(users_organizations::org_uuid.nullable()) + .and(users_organizations::user_uuid.eq(user_uuid)) + .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))), + ) .inner_join( users_collections::table.on(ciphers_collections::collection_uuid .eq(users_collections::collection_uuid) - .and(users_collections::user_uuid.eq(user_uuid))), + // Only allow collection access via the confirmed membership. + .and(users_organizations::user_uuid.eq(users_collections::user_uuid))), ) .select((users_collections::read_only, users_collections::hide_passwords, users_collections::manage)) .load::<(bool, bool, bool)>(conn) @@ -697,6 +708,10 @@ impl Cipher { .and(groups::organizations_uuid.eq(users_organizations::org_uuid))), ) .filter(users_organizations::user_uuid.eq(user_uuid)) + // Only allow group access via a confirmed membership, since + // groups_users rows are kept when a membership is revoked. + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) + .filter(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable())) .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage)) .load::<(bool, bool, bool)>(conn) .expect("Error getting group access restrictions") @@ -989,6 +1004,7 @@ impl Cipher { .eq(ciphers_collections::collection_uuid) .and(collections_groups::groups_uuid.eq(groups::uuid))), ) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_organizations::access_all .eq(true) // User has access all @@ -1020,6 +1036,7 @@ impl Cipher { .eq(ciphers_collections::collection_uuid) .and(users_collections::user_uuid.eq(user_uuid.clone()))), ) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_organizations::access_all .eq(true) // User has access all @@ -1064,6 +1081,7 @@ impl Cipher { .eq(ciphers_collections::collection_uuid) .and(collections_groups::groups_uuid.eq(groups::uuid))), ) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_organizations::access_all .eq(true) // User has access all @@ -1096,6 +1114,7 @@ impl Cipher { .eq(ciphers_collections::collection_uuid) .and(users_collections::user_uuid.eq(user_uuid.clone()))), ) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_organizations::access_all .eq(true) // User has access all @@ -1147,6 +1166,7 @@ impl Cipher { .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner .or_filter(groups::access_all.eq(true)) //Access via group .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .select(ciphers_collections::all_columns) .distinct() .load::<(CipherId, CollectionId)>(conn) diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs index be108f13..21387e4d 100644 --- a/src/db/models/collection.rs +++ b/src/db/models/collection.rs @@ -367,6 +367,7 @@ impl Collection { .and(collections_groups::collections_uuid.eq(collections::uuid))), ) .filter(collections::uuid.eq(uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_collections::collection_uuid .eq(uuid) @@ -406,6 +407,7 @@ impl Collection { .and(users_organizations::user_uuid.eq(user_uuid))), ) .filter(collections::uuid.eq(uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter(users_collections::collection_uuid.eq(uuid).or( // Directly accessed collection users_organizations::access_all.eq(true).or( @@ -430,7 +432,8 @@ impl Collection { .inner_join( users_organizations::table.on(collections::org_uuid .eq(users_organizations::org_uuid) - .and(users_organizations::user_uuid.eq(user_uuid.clone()))), + .and(users_organizations::user_uuid.eq(user_uuid.clone())) + .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))), ) .left_join( users_collections::table.on(users_collections::collection_uuid @@ -476,7 +479,8 @@ impl Collection { .inner_join( users_organizations::table.on(collections::org_uuid .eq(users_organizations::org_uuid) - .and(users_organizations::user_uuid.eq(user_uuid.clone()))), + .and(users_organizations::user_uuid.eq(user_uuid.clone())) + .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))), ) .left_join( users_collections::table.on(users_collections::collection_uuid @@ -527,6 +531,7 @@ impl Collection { .and(collections_groups::collections_uuid.eq(collections::uuid))), ) .filter(collections::uuid.eq(&self.uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_collections::collection_uuid .eq(&self.uuid) @@ -586,6 +591,7 @@ impl Collection { .and(collections_groups::collections_uuid.eq(collections::uuid))), ) .filter(collections::uuid.eq(&uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_collections::collection_uuid .eq(&uuid) @@ -650,6 +656,7 @@ impl Collection { .and(collections_groups::collections_uuid.eq(collections::uuid))), ) .filter(collections::org_uuid.eq(&org_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( // Manage permission on a collection assigned directly or via a group. users_collections::manage.eq(true).or(collections_groups::manage.eq(true)), @@ -819,10 +826,18 @@ impl CollectionUser { .await } + // Only returns the collections of organizations the user is a confirmed member of pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec { conn.run(move |conn| { users_collections::table + .inner_join(collections::table.on(collections::uuid.eq(users_collections::collection_uuid))) + .inner_join( + users_organizations::table.on(users_organizations::org_uuid + .eq(collections::org_uuid) + .and(users_organizations::user_uuid.eq(users_collections::user_uuid))), + ) .filter(users_collections::user_uuid.eq(user_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .select(users_collections::all_columns) .load::(conn) .expect("Error loading users_collections") diff --git a/src/db/models/group.rs b/src/db/models/group.rs index 32e9333f..007ad375 100644 --- a/src/db/models/group.rs +++ b/src/db/models/group.rs @@ -13,7 +13,7 @@ use crate::{ }; use macros::UuidFromParam; -use super::{CollectionId, Membership, MembershipId, OrganizationId, User, UserId}; +use super::{CollectionId, Membership, MembershipId, MembershipStatus, OrganizationId, User, UserId}; #[derive(Identifiable, Queryable, Insertable, AsChangeset)] #[diesel(table_name = groups)] @@ -104,7 +104,6 @@ impl Group { "id": self.uuid, "organizationId": self.organizations_uuid, "name": self.name, - "accessAll": self.access_all, "externalId": self.external_id, "collections": collections_groups, "object": "groupDetails" @@ -249,6 +248,7 @@ impl Group { .and(groups::organizations_uuid.eq(users_organizations::org_uuid))), ) .filter(users_organizations::user_uuid.eq(user_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter(groups::access_all.eq(true)) .select(groups::organizations_uuid) .distinct() @@ -268,6 +268,9 @@ impl Group { .and(users_organizations::org_uuid.eq(groups::organizations_uuid))), ) .filter(users_organizations::user_uuid.eq(user_uuid)) + // Only allow full access via a confirmed membership, since + // groups_users rows are kept when a membership is revoked. + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter(groups::organizations_uuid.eq(org_uuid)) .filter(groups::access_all.eq(true)) .select(groups::access_all) @@ -384,6 +387,7 @@ impl CollectionGroup { .and(collections::org_uuid.eq(groups::organizations_uuid))), ) .filter(users_organizations::user_uuid.eq(user_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .select(collections_groups::all_columns) .load::(conn) .expect("Error loading user collection groups") @@ -569,26 +573,6 @@ impl GroupUser { } } - pub async fn delete_by_group_and_member( - group_uuid: &GroupId, - member_uuid: &MembershipId, - conn: &DbConn, - ) -> EmptyResult { - match Membership::find_by_uuid(member_uuid, conn).await { - Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await, - None => warn!("Member could not be found!"), - } - - conn.run(move |conn| { - diesel::delete(groups_users::table) - .filter(groups_users::groups_uuid.eq(group_uuid)) - .filter(groups_users::users_organizations_uuid.eq(member_uuid)) - .execute(conn) - .map_res("Error deleting group users") - }) - .await - } - pub async fn delete_all_by_group(group_uuid: &GroupId, org_uuid: &OrganizationId, conn: &DbConn) -> EmptyResult { let group_users = GroupUser::find_by_group(group_uuid, org_uuid, conn).await; for group_user in group_users { diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs index d615a3fc..9816c579 100644 --- a/src/db/models/organization.rs +++ b/src/db/models/organization.rs @@ -1,7 +1,4 @@ -use std::{ - cmp::Ordering, - collections::{HashMap, HashSet}, -}; +use std::cmp::Ordering; use chrono::{NaiveDateTime, Utc}; use derive_more::{AsRef, Deref, Display, From}; @@ -24,8 +21,8 @@ use crate::{ use macros::UuidFromParam; use super::{ - Cipher, CipherId, Collection, CollectionGroup, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, - OrgPolicyType, TwoFactor, User, UserId, + Cipher, CipherId, Collection, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, OrgPolicyType, + TwoFactor, User, UserId, }; #[derive(Identifiable, Queryable, Insertable, AsChangeset)] @@ -518,8 +515,7 @@ impl Membership { "limitCollectionDeletion": true, "limitItemDeletion": false, "allowAdminAccessToAllCollectionItems": true, - "userIsManagedByOrganization": false, // Means not managed via the Members UI, like SSO - "userIsClaimedByOrganization": false, // The new key instead of the obsolete userIsManagedByOrganization + "userIsClaimedByOrganization": false, // Means not managed via the Members UI, like SSO "permissions": permissions, @@ -536,7 +532,13 @@ impl Membership { }) } - pub async fn to_json_user_details(&self, include_collections: bool, include_groups: bool, conn: &DbConn) -> Value { + // Used by admins to view other members, so nothing here may depend on this member's status + pub async fn to_json_details_for_admin( + &self, + include_collections: bool, + include_groups: bool, + conn: &DbConn, + ) -> Value { let user = User::find_by_uuid(&self.user_uuid, conn).await.unwrap(); // Because BitWarden want the status to be -1 for revoked users we need to catch that here. @@ -559,52 +561,23 @@ impl Membership { // Check if a user is in a group which has access to all collections // If that is the case, we should not return individual collections! + // This is used by admins to view other members, so it must not depend on the membership status let full_access_group = - CONFIG.org_groups_enabled() && Group::is_in_full_access_group(&self.user_uuid, &self.org_uuid, conn).await; + CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(&self.org_uuid, &self.uuid, conn).await; // If collections are to be included, only include them if the user does not have full access via a group or defined to the user it self + // Only the collections assigned directly are returned, the ones assigned via a group are returned via a special group endpoint let collections: Vec = if include_collections && !(full_access_group || self.access_all) { - // Get all collections for the user here already to prevent more queries - let cu: HashMap = - CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn) - .await - .into_iter() - .map(|cu| (cu.collection_uuid.clone(), cu)) - .collect(); - - // Get all collection groups for this user to prevent there inclusion - let cg: HashSet = CollectionGroup::find_by_user(&self.user_uuid, conn) - .await - .into_iter() - .map(|cg| cg.collections_uuid) - .collect(); - - Collection::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn) + CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn) .await .into_iter() - .filter_map(|c| { - let (read_only, hide_passwords, manage) = if self.has_full_access() { - (false, false, self.atype >= MembershipType::Manager) - } else if let Some(cu) = cu.get(&c.uuid) { - ( - cu.read_only, - cu.hide_passwords, - cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords), - ) - // If previous checks failed it might be that this user has access via a group, but we should not return those elements here - // Those are returned via a special group endpoint - } else if cg.contains(&c.uuid) { - return None; - } else { - (true, true, false) - }; - - Some(json!({ - "id": c.uuid, - "readOnly": read_only, - "hidePasswords": hide_passwords, - "manage": manage, - })) + .map(|cu| { + json!({ + "id": cu.collection_uuid, + "readOnly": cu.read_only, + "hidePasswords": cu.hide_passwords, + "manage": cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords), + }) }) .collect() } else { @@ -652,7 +625,6 @@ impl Membership { "status": status, "type": membership_type, - "accessAll": self.access_all, "twoFactorEnabled": twofactor_enabled, "resetPasswordEnrolled": self.reset_password_key.is_some(), "hasMasterPassword": !user.password_hash.is_empty(), @@ -660,7 +632,6 @@ impl Membership { "permissions": permissions, "ssoBound": false, // Not supported - "managedByOrganization": false, // This key is obsolete replaced by claimedByOrganization "claimedByOrganization": false, // Means not managed via the Members UI, like SSO "usesKeyConnector": false, // Not supported "accessSecretsManager": false, // Not supported (Not AGPLv3 Licensed) @@ -711,7 +682,6 @@ impl Membership { "status": status, "type": self.atype, - "accessAll": self.access_all, "collections": coll_uuids, "object": "organizationUserDetails", @@ -1032,17 +1002,6 @@ impl Membership { .await } - pub async fn get_orgs_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec { - conn.run(move |conn| { - users_organizations::table - .filter(users_organizations::user_uuid.eq(user_uuid)) - .select(users_organizations::org_uuid) - .load::(conn) - .unwrap_or_default() - }) - .await - } - pub async fn find_by_user_and_policy(user_uuid: &UserId, policy_type: OrgPolicyType, conn: &DbConn) -> Vec { conn.run(move |conn| { users_organizations::table @@ -1065,6 +1024,7 @@ impl Membership { conn.run(move |conn| { users_organizations::table .filter(users_organizations::org_uuid.eq(org_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .left_join(users_collections::table.on(users_collections::user_uuid.eq(users_organizations::user_uuid))) .left_join( ciphers_collections::table.on(ciphers_collections::collection_uuid @@ -1091,6 +1051,7 @@ impl Membership { conn.run(move |conn| { users_organizations::table .filter(users_organizations::org_uuid.eq(org_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .inner_join( groups_users::table.on(groups_users::users_organizations_uuid.eq(users_organizations::uuid)), ) @@ -1126,6 +1087,7 @@ impl Membership { .and(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable()))), ) .filter(users_organizations::user_uuid.eq(user_uuid)) + .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32)) .filter( users_organizations::atype.eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]), ) diff --git a/src/db/models/send.rs b/src/db/models/send.rs index d7de7749..721378f3 100644 --- a/src/db/models/send.rs +++ b/src/db/models/send.rs @@ -140,6 +140,10 @@ impl Send { None } + fn access_id(&self) -> String { + BASE64URL_NOPAD.encode(Uuid::parse_str(&self.uuid).unwrap_or_default().as_bytes()) + } + pub fn to_json(&self) -> Value { let mut data = serde_json::from_str::>(&self.data).map(|d| d.data).unwrap_or_default(); @@ -150,7 +154,7 @@ impl Send { json!({ "id": self.uuid, - "accessId": BASE64URL_NOPAD.encode(Uuid::parse_str(&self.uuid).unwrap_or_default().as_bytes()), + "accessId": self.access_id(), "type": self.atype, "name": self.name, @@ -182,7 +186,7 @@ impl Send { } json!({ - "id": self.uuid, + "id": self.access_id(), "type": self.atype, "name": self.name, @@ -256,7 +260,7 @@ impl Send { /// Whether the Send is currently within its validity window: not disabled, not past its /// expiration date, and not past its deletion date. Does not consider `max_access_count` - /// (consumed at token issuance) or the password. + /// (counted on each access) or the password. pub fn is_accessible(&self) -> bool { let now = Utc::now().naive_utc(); if self.disabled { @@ -309,19 +313,6 @@ impl Send { Ok(()) } - pub async fn find_by_access_id(access_id: &str, conn: &DbConn) -> Option { - let Ok(uuid_vec) = BASE64URL_NOPAD.decode(access_id.as_bytes()) else { - return None; - }; - - let uuid = match Uuid::from_slice(&uuid_vec) { - Ok(u) => SendId::from(u.to_string()), - Err(_) => return None, - }; - - Self::find_by_uuid(&uuid, conn).await - } - pub async fn find_by_uuid(uuid: &SendId, conn: &DbConn) -> Option { conn.run(move |conn| sends::table.filter(sends::uuid.eq(uuid)).first::(conn).ok()).await } @@ -361,13 +352,6 @@ impl Send { Some(total) } - pub async fn find_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec { - conn.run(move |conn| { - sends::table.filter(sends::organization_uuid.eq(org_uuid)).load::(conn).expect("Error loading sends") - }) - .await - } - pub async fn find_by_past_deletion_date(conn: &DbConn) -> Vec { let now = Utc::now().naive_utc(); conn.run(move |conn| { diff --git a/src/db/models/user.rs b/src/db/models/user.rs index 3412b142..b4f507f4 100644 --- a/src/db/models/user.rs +++ b/src/db/models/user.rs @@ -257,6 +257,10 @@ impl User { /// Database methods impl User { + pub fn verified(&self) -> bool { + !CONFIG.mail_enabled() || self.verified_at.is_some() + } + pub async fn to_json(&self, conn: &DbConn) -> Value { let mut orgs_json = Vec::new(); for c in Membership::find_confirmed_by_user(&self.uuid, conn).await { @@ -299,7 +303,7 @@ impl User { "id": self.uuid, "name": self.name, "email": self.email, - "emailVerified": !CONFIG.mail_enabled() || self.verified_at.is_some(), + "emailVerified": self.verified(), "premium": true, "premiumFromOrganization": false, "culture": "en-US", diff --git a/src/http_client.rs b/src/http_client.rs index 5ef293fc..6225e233 100644 --- a/src/http_client.rs +++ b/src/http_client.rs @@ -466,7 +466,7 @@ mod tests { #[test] fn dotted_decimal_loopback_normalizes() { let ip = parse_to_ip("127.0.0.1").unwrap(); - assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))); + assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST)); assert!(!is_global_hardcoded(ip)); } @@ -474,21 +474,21 @@ mod tests { fn single_decimal_loopback_normalizes() { // 127.0.0.1 == 2130706433 let ip = parse_to_ip("2130706433").unwrap(); - assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))); + assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST)); assert!(!is_global_hardcoded(ip)); } #[test] fn hex_loopback_normalizes() { let ip = parse_to_ip("0x7f000001").unwrap(); - assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))); + assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST)); assert!(!is_global_hardcoded(ip)); } #[test] fn dotted_hex_loopback_normalizes() { let ip = parse_to_ip("0x7f.0.0.1").unwrap(); - assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))); + assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST)); assert!(!is_global_hardcoded(ip)); } @@ -496,14 +496,14 @@ mod tests { fn octal_loopback_normalizes() { // 017700000001 == 127.0.0.1 let ip = parse_to_ip("017700000001").unwrap(); - assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))); + assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST)); assert!(!is_global_hardcoded(ip)); } #[test] fn dotted_octal_loopback_normalizes() { let ip = parse_to_ip("0177.0.0.01").unwrap(); - assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))); + assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST)); assert!(!is_global_hardcoded(ip)); } @@ -535,19 +535,19 @@ mod tests { #[test] fn get_valid_host_normalizes_decimal_int() { let h = get_valid_host("2130706433").expect("valid"); - assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1))); + assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST)); } #[test] fn get_valid_host_normalizes_hex() { let h = get_valid_host("0x7f000001").expect("valid"); - assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1))); + assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST)); } #[test] fn get_valid_host_normalizes_octal() { let h = get_valid_host("017700000001").expect("valid"); - assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1))); + assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST)); } // === diff --git a/src/main.rs b/src/main.rs index 437354af..f27729d6 100644 --- a/src/main.rs +++ b/src/main.rs @@ -720,7 +720,7 @@ fn schedule_jobs(pool: db::DbPool) { } // Clean unused, expired Duo authentication contexts. - if !CONFIG.duo_context_purge_schedule().is_empty() && CONFIG._enable_duo() && !CONFIG.duo_use_iframe() { + if !CONFIG.duo_context_purge_schedule().is_empty() && CONFIG._enable_duo() { sched.add(Job::new(CONFIG.duo_context_purge_schedule().parse().unwrap(), || { runtime.spawn(purge_duo_contexts(pool.clone())); })); diff --git a/src/static/templates/scss/vaultwarden.scss.hbs b/src/static/templates/scss/vaultwarden.scss.hbs index 5bbe5db2..d062c026 100644 --- a/src/static/templates/scss/vaultwarden.scss.hbs +++ b/src/static/templates/scss/vaultwarden.scss.hbs @@ -42,45 +42,27 @@ a[href$="/settings/sponsored-families"] { {{/if}} /* Hide the `Enterprise Single Sign-On` button on the login page */ -{{#if (webver ">=2025.5.1")}} {{#if (not sso_enabled)}} .vw-sso-login { @extend %vw-hide; } {{/if}} -{{else}} -app-root ng-component > form > div:nth-child(1) > div > button[buttontype="secondary"].\!tw-text-primary-600:nth-child(4) { - @extend %vw-hide; -} -{{/if}} /* Hide the `Log in with passkey` settings */ app-user-layout app-password-settings app-webauthn-login-settings { @extend %vw-hide; } /* Hide Log in with passkey on the login page */ -{{#if (webver ">=2025.5.1")}} .vw-passkey-login { @extend %vw-hide; } -{{else}} -app-root ng-component > form > div:nth-child(1) > div > button[buttontype="secondary"].\!tw-text-primary-600:nth-child(3) { - @extend %vw-hide; -} -{{/if}} /* Hide the or text followed by the two buttons hidden above */ -{{#if (webver ">=2025.5.1")}} {{#if (or (not sso_enabled) sso_only)}} .vw-or-text { @extend %vw-hide; } {{/if}} -{{else}} -app-root ng-component > form > div:nth-child(1) > div:nth-child(3) > div:nth-child(2) { - @extend %vw-hide; -} -{{/if}} /* Hide the `Other` button on the login page */ {{#if (or (not sso_enabled) sso_only)}} @@ -154,17 +136,10 @@ ng-dropdown-panel div.ng-dropdown-panel-items div:has(> [title="DuckDuckGo"]) { take a while for the change to take effect. To avoid the button appearing when it shouldn't, we'll keep this style in place for a couple of versions */ /* Hide the register link on the login screen */ -{{#if (webver "<2025.3.0")}} -app-login form div + div + div + div + hr, -app-login form div + div + div + div + hr + p { - @extend %vw-hide; -} -{{else}} app-root a[routerlink="/signup"] { @extend %vw-hide; } {{/if}} -{{/if}} {{#if remember_2fa_disabled}} /* Hide checkbox to remember 2FA token for 30 days */ @@ -220,6 +195,13 @@ auth-input-password > form > bit-form-field:nth-child(4) { @extend %vw-hide; } {{/unless}} + +{{#unless email_change_allowed}} +/* Hide the whole `Change email` section, including its heading, if not allowed */ +div:has(> app-change-email) { + @extend %vw-hide; +} +{{/unless}} /**** End Dynamic Vaultwarden Changes ****/ /**** Include a special user stylesheet for custom changes ****/ {{#if load_user_scss}} diff --git a/src/util.rs b/src/util.rs index 6de2d803..2a5678bc 100644 --- a/src/util.rs +++ b/src/util.rs @@ -943,15 +943,15 @@ mod tests { use std::net::IpAddr; #[test] - #[ignore] + #[ignore = "exhaustive IPv4 check is too slow for the regular test suite"] fn test_ipv4_global() { for a in 0..u8::MAX { - println!("Iter: {}/255", a); + println!("Iter: {a}/255"); for b in 0..u8::MAX { for c in 0..u8::MAX { for d in 0..u8::MAX { let ip = IpAddr::V4(std::net::Ipv4Addr::new(a, b, c, d)); - assert_eq!(ip.is_global(), is_global_hardcoded(ip), "IP mismatch: {}", ip) + assert_eq!(ip.is_global(), is_global_hardcoded(ip), "IP mismatch: {ip}"); } } } @@ -959,15 +959,15 @@ mod tests { } #[test] - #[ignore] + #[ignore = "random IPv6 check is too slow for the regular test suite"] fn test_ipv6_global() { - use rand::Rng; + use rand::RngExt; std::thread::scope(|s| { for t in 0..16 { - let handle = s.spawn(move || { + let _handle = s.spawn(move || { let mut v = [0u8; 16]; - let mut rng = rand::thread_rng(); + let mut rng = rand::rng(); for i in 0..20 { println!("Thread {t} Iter: {i}/50");