From 4e562f240c7b8072ca7e3cfc486fb1920ca10d8d Mon Sep 17 00:00:00 2001
From: tom27052006 <83423411+tom27052006@users.noreply.github.com>
Date: Tue, 4 Aug 2026 20:51:42 +0200
Subject: [PATCH] Leave the admin approvals out of what a device is waiting on

A request addressed to an administrator is answered through the organization
and stays open for a week, so counting it as the pending request of its device
hid the short lived one the user was actually being shown and made approving
from another device fail for as long as it was open. It is now excluded, along
with requests past their window, as upstream does.
---
 src/api/core/accounts.rs      |  3 ++-
 src/db/models/auth_request.rs | 11 +++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs
index 2852a3bd..d1cdf384 100644
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
@@ -2177,7 +2177,8 @@ async fn get_auth_requests_pending(headers: Headers, conn: DbConn) -> JsonResult
     Ok(Json(json!({
         "data": auth_requests
             .iter()
-            .filter(|request| request.approved.is_none())
+            // The same set a device answers for itself, see `find_by_user_and_requested_device`.
+            .filter(|request| request.approved.is_none() && !request.is_admin_approval() && !request.is_expired())
             .map(|request| {
             let response_date_utc = request.response_date.map(|response_date| format_date(&response_date));
 
diff --git a/src/db/models/auth_request.rs b/src/db/models/auth_request.rs
index 0472f62f..bda821fe 100644
--- a/src/db/models/auth_request.rs
+++ b/src/db/models/auth_request.rs
@@ -220,16 +220,27 @@ impl AuthRequest {
         .await
     }
 
+    /// The request a device is currently waiting on, if it is still open and still within its
+    /// window.
+    ///
+    /// Only the types a device answers for itself. A request addressed to an administrator is
+    /// answered through the organization and stays open for a week, so counting it here would let
+    /// it shadow the short lived request the user is actually being shown.
+    /// https://github.com/bitwarden/server/blob/main/src/Infrastructure.EntityFramework/Auth/Repositories/Queries/DeviceWithPendingAuthByUserIdQuery.cs
     pub async fn find_by_user_and_requested_device(
         user_uuid: &UserId,
         device_uuid: &DeviceId,
         conn: &DbConn,
     ) -> Option<Self> {
+        let oldest = Utc::now().naive_utc() - Self::user_request_expiration();
+
         conn.run(move |conn| {
             auth_requests::table
                 .filter(auth_requests::user_uuid.eq(user_uuid))
                 .filter(auth_requests::request_device_identifier.eq(device_uuid))
+                .filter(auth_requests::atype.ne(AuthRequestType::AdminApproval as i32))
                 .filter(auth_requests::approved.is_null())
+                .filter(auth_requests::creation_date.gt(oldest))
                 .order_by(auth_requests::creation_date.desc())
                 .first::<Self>(conn)
                 .ok()