Leave the admin approvals out of what a device is waiting on

A request addressed to an administrator is answered through the organization
and stays open for a week, so counting it as the pending request of its device
hid the short lived one the user was actually being shown and made approving
from another device fail for as long as it was open. It is now excluded, along
with requests past their window, as upstream does.

src/api/core/accounts.rs

@@ -2177,7 +2177,8 @@ async fn get_auth_requests_pending(headers: Headers, conn: DbConn) -> JsonResult
     Ok(Json(json!({
         "data": auth_requests
             .iter()
-            .filter(|request| request.approved.is_none())
+            // The same set a device answers for itself, see `find_by_user_and_requested_device`.
+            .filter(|request| request.approved.is_none() && !request.is_admin_approval() && !request.is_expired())
             .map(|request| {
             let response_date_utc = request.response_date.map(|response_date| format_date(&response_date));
 

src/db/models/auth_request.rs

@@ -220,16 +220,27 @@ impl AuthRequest {
         .await
     }
 
+    /// The request a device is currently waiting on, if it is still open and still within its
+    /// window.
+    ///
+    /// Only the types a device answers for itself. A request addressed to an administrator is
+    /// answered through the organization and stays open for a week, so counting it here would let
+    /// it shadow the short lived request the user is actually being shown.
+    /// https://github.com/bitwarden/server/blob/main/src/Infrastructure.EntityFramework/Auth/Repositories/Queries/DeviceWithPendingAuthByUserIdQuery.cs
     pub async fn find_by_user_and_requested_device(
         user_uuid: &UserId,
         device_uuid: &DeviceId,
         conn: &DbConn,
     ) -> Option<Self> {
+        let oldest = Utc::now().naive_utc() - Self::user_request_expiration();
+
         conn.run(move |conn| {
             auth_requests::table
                 .filter(auth_requests::user_uuid.eq(user_uuid))
                 .filter(auth_requests::request_device_identifier.eq(device_uuid))
+                .filter(auth_requests::atype.ne(AuthRequestType::AdminApproval as i32))
                 .filter(auth_requests::approved.is_null())
+                .filter(auth_requests::creation_date.gt(oldest))
                 .order_by(auth_requests::creation_date.desc())
                 .first::<Self>(conn)
                 .ok()