Support admin reset 2fa (#7435)

* Support admin reset 2fa

* Fix recovery email

---------

Co-authored-by: Timshel <timshel@users.noreply.github.com>

playwright/tests/organization.smtp.spec.ts

@@ -127,6 +127,9 @@ test('Organization is visible', async ({ page }) => {
 });
 
 test('Recover user password', async ({ page }) => {
+    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
+    await activateTOTP(test, page, users.user2);
+
     await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
 
     let newPassword = "TotoNewPassword";
@@ -138,9 +141,10 @@ test('Recover user password', async ({ page }) => {
         await page.getByRole('menuitem', { name: 'Recover account' }).click();
         await page.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
         await page.getByRole('textbox', { name: 'Confirm new master password * (' }).fill(newPassword);
+        await page.getByRole('checkbox', { name: 'Reset two-step login' }).check();
         await page.getByRole('button', { name: 'Save' }).click();
         await utils.checkNotification(page, 'Account recovery success');
-        await mail2Buffer.expect((m) => m.subject.includes('Master Password Has Been Changed'));
+        await mail2Buffer.expect((m) => m.subject.includes('Admin account recovery from Test organization'));
     });
 
     let user2 = {
@@ -150,6 +154,7 @@ test('Recover user password', async ({ page }) => {
     };
     await logUser(test, page, user2, {
         mailBuffer: mail2Buffer,
+        mail2fa: true,
         notNewDevice: true,
     });
 });

src/api/core/organizations.rs

@@ -1,7 +1,7 @@
 use std::collections::{HashMap, HashSet};
 
 use num_traits::FromPrimitive;
-use rocket::{Route, serde::json::Json};
+use rocket::{Route, http::Status, serde::json::Json};
 use serde_json::Value;
 
 use crate::{
@@ -17,7 +17,8 @@ use crate::{
         models::{
             Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType,
             Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus, MembershipType,
-            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, User, UserId,
+            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User,
+            UserId,
         },
     },
     mail,
@@ -390,7 +391,7 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos
     }
 
     if !headers.membership.has_full_access() {
-        err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
+        err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
     }
 
     Ok(Json(json!({
@@ -886,11 +887,11 @@ struct OrgIdData {
 #[get("/ciphers/organization-details?<data..>")]
 async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult {
     if data.organization_id != headers.membership.org_uuid {
-        err_code!("Resource not found.", "Organization id's do not match", rocket::http::Status::NotFound.code);
+        err_code!("Resource not found.", "Organization id's do not match", Status::NotFound.code);
     }
 
     if !headers.membership.has_full_access() {
-        err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
+        err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
     }
 
     Ok(Json(json!({
@@ -954,7 +955,7 @@ async fn get_members(
     }
 
     if !headers.membership.has_full_access() {
-        err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
+        err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
     }
 
     let mut users_json = Vec::new();
@@ -2486,7 +2487,7 @@ async fn get_groups_data(
             || Collection::has_manageable_collection_by_user(&org_id, &headers.membership.user_uuid, &conn).await
     };
     if !allowed {
-        err_code!("Resource not found.", "User does not have access", rocket::http::Status::NotFound.code);
+        err_code!("Resource not found.", "User does not have access", Status::NotFound.code);
     }
 
     let groups: Vec<Value> = if CONFIG.org_groups_enabled() {
@@ -2937,8 +2938,8 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserRecoverAccountRequest {
-    new_master_password_hash: String,
-    key: String,
+    new_master_password_hash: Option<String>,
+    key: Option<String>,
 
     #[serde(default)]
     reset_master_password: bool,
@@ -2982,12 +2983,7 @@ async fn put_recover_account(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
-    let req = data.into_inner();
-    if req.reset_master_password && !req.reset_two_factor {
-        recover_account(org_id, member_id, headers, req, conn, nt).await
-    } else {
-        err!("Unsupported operation")
-    }
+    recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
 }
 
 // Deprecated since `v2026.4.2`
@@ -3007,7 +3003,7 @@ async fn recover_account(
     org_id: OrganizationId,
     member_id: MembershipId,
     headers: AdminHeaders,
-    reset_request: OrganizationUserRecoverAccountRequest,
+    req: OrganizationUserRecoverAccountRequest,
     conn: DbConn,
     nt: Notify<'_>,
 ) -> EmptyResult {
@@ -3022,7 +3018,7 @@ async fn recover_account(
         err!("User to reset isn't member of required organization")
     };
 
-    let Some(user) = User::find_by_uuid(&member.user_uuid, &conn).await else {
+    let Some(mut user) = User::find_by_uuid(&member.user_uuid, &conn).await else {
         err!("User not found")
     };
 
@@ -3035,29 +3031,56 @@ async fn recover_account(
         err!("Organization user must be confirmed for password reset functionality");
     }
 
-    // Sending email before resetting password to ensure working email configuration and the resulting
-    // user notification. Also this might add some protection against security flaws and misuse
-    if let Err(e) = mail::send_admin_reset_password(&user.email, user.display_name(), &org.name).await {
+    let fallback_2fa_email = if req.reset_two_factor && CONFIG.email_2fa_auto_fallback() {
+        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
+    } else {
+        false
+    };
+
+    // Sending email first ensure working email configuration and the resulting user notification.
+    // Also this might add some protection against security flaws and misuse
+    if let Err(e) = mail::send_admin_account_recovery(
+        &user.email,
+        user.display_name(),
+        &org.name,
+        req.reset_master_password,
+        req.reset_two_factor,
+        fallback_2fa_email,
+    )
+    .await
+    {
         err!(format!("Error sending user reset password email: {e:#?}"));
     }
 
-    let mut user = user;
-    user.set_password(reset_request.new_master_password_hash.as_str(), Some(reset_request.key), true, None, &conn)
-        .await?;
+    if req.reset_master_password {
+        if let Some(key) = req.key
+            && let Some(hash) = req.new_master_password_hash
+        {
+            user.set_password(hash.as_str(), Some(key), true, None, &conn).await?;
+        } else {
+            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
+        }
+    }
+
+    if req.reset_two_factor {
+        TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
+        if !fallback_2fa_email || two_factor::email::find_and_activate_email_2fa(&user.uuid, &conn).await.is_err() {
+            two_factor::enforce_2fa_policy(&user, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+                .await?;
+        }
+    }
+
     user.save(&conn).await?;
 
     nt.send_logout(&user, None, &conn).await;
 
-    log_event(
-        EventType::OrganizationUserAdminResetPassword,
-        &member_id,
-        &org_id,
-        &headers.user.uuid,
-        headers.device.atype,
-        &headers.ip.ip,
-        &conn,
-    )
-    .await;
+    if req.reset_master_password {
+        headers.log_event(EventType::OrganizationUserAdminResetPassword, &member_id, &org_id, &conn).await;
+    }
+
+    if req.reset_two_factor {
+        headers.log_event(EventType::OrganizationUserAdminResetTwoFactor, &member_id, &org_id, &conn).await;
+    }
 
     Ok(())
 }

src/auth.rs

@@ -23,14 +23,14 @@ use rocket::{
 
 use crate::{
     CONFIG,
-    api::ApiResult,
+    api::{ApiResult, core::log_event},
     config::PathType,
     db::{
         DbConn,
         models::{
             AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
-            Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId, SendFileId,
-            SendId, User, UserId, UserStampException,
+            EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
+            SendFileId, SendId, User, UserId, UserStampException,
         },
     },
     error::Error,
@@ -822,6 +822,12 @@ pub struct AdminHeaders {
     pub org_id: OrganizationId,
 }
 
+impl AdminHeaders {
+    pub async fn log_event(&self, event_type: EventType, source_uuid: &str, org_id: &OrganizationId, conn: &DbConn) {
+        log_event(event_type, source_uuid, org_id, &self.user.uuid, self.device.atype, &self.ip.ip, conn).await;
+    }
+}
+
 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for AdminHeaders {
     type Error = &'static str;

src/config.rs

@@ -1745,7 +1745,7 @@ where
     reg!("email/email_footer");
     reg!("email/email_footer_text");
 
-    reg!("email/admin_reset_password", ".html");
+    reg!("email/admin_account_recovery", ".html");
     reg!("email/change_email_existing", ".html");
     reg!("email/change_email_invited", ".html");
     reg!("email/change_email", ".html");

src/db/models/event.rs

@@ -43,7 +43,7 @@ pub struct Event {
     pub provider_org_uuid: Option<String>,
 }
 
-// Upstream enum: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/EventType.cs
+// Upstream enum: https://github.com/bitwarden/server/blob/v2026.6.2/src/Core/Dirt/Enums/EventType.cs
 #[derive(Debug, Copy, Clone)]
 pub enum EventType {
     // User
@@ -108,6 +108,12 @@ pub enum EventType {
     OrganizationUserRejectedAuthRequest = 1514,
     OrganizationUserDeleted = 1515, // Both user and organization user data were deleted
     OrganizationUserLeft = 1516,    // User voluntarily left the organization
+    // OrganizationUserAutomaticallyConfirmed = 1517,
+    // OrganizationUserSelfRevoked = 1518, // User self-revoked due to declining organization data ownership policy
+    OrganizationUserAdminResetTwoFactor = 1519,
+    // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
+    // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
+    // OrganizationUserNotificationBannerActionClicked = 1522,
 
     // Organization
     OrganizationUpdated = 1600,

src/mail.rs

@@ -633,14 +633,24 @@ pub async fn send_test(address: &str) -> EmptyResult {
     send_email(address, &subject, body_html, body_text).await
 }
 
-pub async fn send_admin_reset_password(address: &str, user_name: &str, org_name: &str) -> EmptyResult {
+pub async fn send_admin_account_recovery(
+    address: &str,
+    user_name: &str,
+    org_name: &str,
+    reset_password: bool,
+    reset_2fa: bool,
+    fallback_2fa_email: bool,
+) -> EmptyResult {
     let (subject, body_html, body_text) = get_text(
-        "email/admin_reset_password",
+        "email/admin_account_recovery",
         json!({
             "url": CONFIG.domain(),
             "img_src": CONFIG._smtp_img_src(),
             "user_name": user_name,
             "org_name": org_name,
+            "reset_password": reset_password,
+            "reset_2fa": reset_2fa,
+            "fallback_2fa_email": fallback_2fa_email,
         }),
     )?;
     send_email(address, &subject, body_html, body_text).await

src/static/templates/email/admin_account_recovery.hbs

@@ -0,0 +1,12 @@
+Admin account recovery from {{org_name}} organization
+<!---------------->
+{{#if reset_password}}
+The master password for {{user_name}} has been changed.
+{{/if}}
+{{#if reset_2fa}}
+Your two-step verification providers have been reset.{{#if fallback_2fa_email}} Email two factor has been activated as a fallback.{{/if}}
+{{/if}}
+
+If you did not initiate this request, please reach out to your administrator immediately.
+
+{{> email/email_footer_text }}

src/static/templates/email/admin_reset_password.html.hbs → src/static/templates/email/admin_account_recovery.html.hbs

@@ -1,10 +1,17 @@
-Master Password Has Been Changed
+Admin account recovery from {{org_name}} organization
 <!---------------->
 {{> email/email_header }}
 <table width="100%" cellpadding="0" cellspacing="0" style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
     <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
         <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
-            The master password for <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{user_name}}</b> has been changed by an administrator in your <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{org_name}}</b> organization. If you did not initiate this request, please reach out to your administrator immediately.
+            {{#if reset_password}}
+                The master password for <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{user_name}}</b> has been changed.
+            {{/if}}
+            {{#if reset_2fa}}
+                Your two-step verification providers have been reset.{{#if fallback_2fa_email}} Email two factor has been activated as a fallback.{{/if}}
+            {{/if}}
+            <br>
+            If you did not initiate this request, please reach out to your administrator immediately.
         </td>
     </tr>
 </table>

src/static/templates/email/admin_reset_password.hbs

@@ -1,4 +0,0 @@
-Master Password Has Been Changed
-<!---------------->
-The master password for {{user_name}} has been changed by an administrator in your {{org_name}} organization. If you did not initiate this request, please reach out to your administrator immediately.
-{{> email/email_footer_text }}