@ -1,7 +1,7 @@
use std ::collections ::{ HashMap , HashSet } ;
use num_traits ::FromPrimitive ;
use rocket ::{ Route , serde ::json ::Json } ;
use rocket ::{ Route , http ::Status , serde ::json ::Json } ;
use serde_json ::Value ;
use crate ::{
@ -17,7 +17,8 @@ use crate::{
models ::{
Cipher , CipherId , Collection , CollectionCipher , CollectionGroup , CollectionId , CollectionUser , EventType ,
Group , GroupId , GroupUser , Invitation , Membership , MembershipId , MembershipStatus , MembershipType ,
OrgPolicy , OrgPolicyType , Organization , OrganizationApiKey , OrganizationId , User , UserId ,
OrgPolicy , OrgPolicyType , Organization , OrganizationApiKey , OrganizationId , TwoFactor , TwoFactorType , User ,
UserId ,
} ,
} ,
mail ,
@ -132,7 +133,6 @@ struct FullCollectionData {
name : String ,
groups : Vec < CollectionGroupData > ,
users : Vec < CollectionMembershipData > ,
id : Option < CollectionId > ,
external_id : Option < String > ,
}
@ -269,7 +269,7 @@ async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, c
}
log_event (
EventType ::OrganizationUserLeft as i32 ,
EventType ::OrganizationUserLeft ,
& membership . uuid ,
& org_id ,
& headers . user . uuid ,
@ -327,7 +327,7 @@ async fn post_organization(
org . save ( & conn ) . await ? ;
log_event (
EventType ::OrganizationUpdated as i32 ,
EventType ::OrganizationUpdated ,
org_id . as_ref ( ) ,
& org_id ,
& headers . user . uuid ,
@ -391,7 +391,7 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos
}
if ! headers . membership . has_full_access ( ) {
err_code ! ( "Resource not found." , "User does not have full access" , rocket ::http ::Status ::NotFound . code ) ;
err_code ! ( "Resource not found." , "User does not have full access" , Status ::NotFound . code ) ;
}
Ok ( Json ( json ! ( {
@ -514,7 +514,7 @@ async fn post_organization_collections(
collection . save ( & conn ) . await ? ;
log_event (
EventType ::CollectionCreated as i32 ,
EventType ::CollectionCreated ,
& collection . uuid ,
& org_id ,
& headers . user . uuid ,
@ -597,7 +597,7 @@ async fn post_bulk_access_collections(
collection . save ( & conn ) . await ? ;
log_event (
EventType ::CollectionUpdated as i32 ,
EventType ::CollectionUpdated ,
& collection . uuid ,
& org_id ,
& headers . user . uuid ,
@ -674,7 +674,7 @@ async fn post_organization_collection_update(
collection . save ( & conn ) . await ? ;
log_event (
EventType ::CollectionUpdated as i32 ,
EventType ::CollectionUpdated ,
& collection . uuid ,
& org_id ,
& headers . user . uuid ,
@ -723,7 +723,7 @@ async fn delete_organization_collection_impl(
err ! ( "Collection not found" , "Collection does not exist or does not belong to this organization" )
} ;
log_event (
EventType ::CollectionDeleted as i32 ,
EventType ::CollectionDeleted ,
& collection . uuid ,
org_id ,
& headers . user . uuid ,
@ -887,11 +887,11 @@ struct OrgIdData {
#[ get( " /ciphers/organization-details?<data..> " ) ]
async fn get_org_details ( data : OrgIdData , headers : ManagerHeadersLoose , conn : DbConn ) -> JsonResult {
if data . organization_id ! = headers . membership . org_uuid {
err_code ! ( "Resource not found." , "Organization id's do not match" , rocket ::http ::Status ::NotFound . code ) ;
err_code ! ( "Resource not found." , "Organization id's do not match" , Status ::NotFound . code ) ;
}
if ! headers . membership . has_full_access ( ) {
err_code ! ( "Resource not found." , "User does not have full access" , rocket ::http ::Status ::NotFound . code ) ;
err_code ! ( "Resource not found." , "User does not have full access" , Status ::NotFound . code ) ;
}
Ok ( Json ( json ! ( {
@ -955,7 +955,7 @@ async fn get_members(
}
if ! headers . membership . has_full_access ( ) {
err_code ! ( "Resource not found." , "User does not have full access" , rocket ::http ::Status ::NotFound . code ) ;
err_code ! ( "Resource not found." , "User does not have full access" , Status ::NotFound . code ) ;
}
let mut users_json = Vec ::new ( ) ;
@ -1075,7 +1075,7 @@ async fn send_invite(
& & data . permissions . get ( "deleteAnyCollection" ) = = Some ( & json ! ( true ) )
& & data . permissions . get ( "createNewCollections" ) = = Some ( & json ! ( true ) ) ) ;
let mut user_created : bool = false ;
let mut user_created : bool ;
for email in & data . emails {
let mut member_status = MembershipStatus ::Invited as i32 ;
let user = match User ::find_by_mail ( email , & conn ) . await {
@ -1110,6 +1110,7 @@ async fn send_invite(
member_status = MembershipStatus ::Accepted as i32 ;
}
}
user_created = false ;
user
}
} ;
@ -1148,7 +1149,7 @@ async fn send_invite(
}
log_event (
EventType ::OrganizationUserInvited as i32 ,
EventType ::OrganizationUserInvited ,
& new_member . uuid ,
& org_id ,
& headers . user . uuid ,
@ -1447,7 +1448,7 @@ async fn confirm_invite_impl(
OrgPolicy ::check_user_allowed ( & member_to_confirm , "confirm" , conn ) . await ? ;
log_event (
EventType ::OrganizationUserConfirmed as i32 ,
EventType ::OrganizationUserConfirmed ,
& member_to_confirm . uuid ,
org_id ,
& headers . user . uuid ,
@ -1637,7 +1638,7 @@ async fn edit_member(
}
log_event (
EventType ::OrganizationUserUpdated as i32 ,
EventType ::OrganizationUserUpdated ,
& member_to_edit . uuid ,
& org_id ,
& headers . user . uuid ,
@ -1724,7 +1725,7 @@ async fn delete_member_impl(
}
log_event (
EventType ::OrganizationUserRemoved as i32 ,
EventType ::OrganizationUserRemoved ,
& member_to_delete . uuid ,
org_id ,
& headers . user . uuid ,
@ -1793,11 +1794,22 @@ async fn bulk_public_keys(
use super ::ciphers ::CipherData ;
use super ::ciphers ::update_cipher_from_data ;
// The import endpoint only ever uses the name/id/external_id of a collection.
// Bitwarden's own server ignores `groups`/`users` here too, so do not make them
// mandatory: clients are free to leave them out.
#[ derive(Deserialize) ]
#[ serde(rename_all = " camelCase " ) ]
struct ImportCollectionData {
name : String ,
id : Option < CollectionId > ,
external_id : Option < String > ,
}
#[ derive(Deserialize) ]
#[ serde(rename_all = " camelCase " ) ]
struct ImportData {
ciphers : Vec < CipherData > ,
collections : Vec < FullCollectionData > ,
collections : Vec < Import CollectionData> ,
collection_relationships : Vec < RelationsData > ,
}
@ -2144,7 +2156,7 @@ async fn put_policy(
}
log_event (
EventType ::OrganizationUserRemoved as i32 ,
EventType ::OrganizationUserRemoved ,
& member . uuid ,
& org_id ,
& headers . user . uuid ,
@ -2170,7 +2182,7 @@ async fn put_policy(
policy . save ( & conn ) . await ? ;
log_event (
EventType ::PolicyUpdated as i32 ,
EventType ::PolicyUpdated ,
policy . uuid . as_ref ( ) ,
& org_id ,
& headers . user . uuid ,
@ -2339,7 +2351,7 @@ async fn revoke_member_impl(
member . save ( conn ) . await ? ;
log_event (
EventType ::OrganizationUserRevoked as i32 ,
EventType ::OrganizationUserRevoked ,
& member . uuid ,
org_id ,
& headers . user . uuid ,
@ -2437,7 +2449,7 @@ async fn restore_member_impl(
member . save ( conn ) . await ? ;
log_event (
EventType ::OrganizationUserRestored as i32 ,
EventType ::OrganizationUserRestored ,
& member . uuid ,
org_id ,
& headers . user . uuid ,
@ -2476,7 +2488,7 @@ async fn get_groups_data(
| | Collection ::has_manageable_collection_by_user ( & org_id , & headers . membership . user_uuid , & conn ) . await
} ;
if ! allowed {
err_code ! ( "Resource not found." , "User does not have access" , rocket ::http ::Status ::NotFound . code ) ;
err_code ! ( "Resource not found." , "User does not have access" , Status ::NotFound . code ) ;
}
let groups : Vec < Value > = if CONFIG . org_groups_enabled ( ) {
@ -2605,7 +2617,7 @@ async fn post_groups(
let group = group_request . to_group ( & org_id ) ;
log_event (
EventType ::GroupCreated as i32 ,
EventType ::GroupCreated ,
& group . uuid ,
& org_id ,
& headers . user . uuid ,
@ -2646,7 +2658,7 @@ async fn put_group(
GroupUser ::delete_all_by_group ( & group_id , & org_id , & conn ) . await ? ;
log_event (
EventType ::GroupUpdated as i32 ,
EventType ::GroupUpdated ,
& updated_group . uuid ,
& org_id ,
& headers . user . uuid ,
@ -2679,7 +2691,7 @@ async fn add_update_group(
user_entry . save ( conn ) . await ? ;
log_event (
EventType ::OrganizationUserUpdatedGroups as i32 ,
EventType ::OrganizationUserUpdatedGroups ,
& assigned_member ,
& org_id ,
& headers . user . uuid ,
@ -2754,7 +2766,7 @@ async fn delete_group_impl(
} ;
log_event (
EventType ::GroupDeleted as i32 ,
EventType ::GroupDeleted ,
& group . uuid ,
org_id ,
& headers . user . uuid ,
@ -2865,7 +2877,7 @@ async fn put_group_members(
user_entry . save ( & conn ) . await ? ;
log_event (
EventType ::OrganizationUserUpdatedGroups as i32 ,
EventType ::OrganizationUserUpdatedGroups ,
& assigned_member ,
& org_id ,
& headers . user . uuid ,
@ -2903,7 +2915,7 @@ async fn post_delete_group_member(
}
log_event (
EventType ::OrganizationUserUpdatedGroups as i32 ,
EventType ::OrganizationUserUpdatedGroups ,
& member_id ,
& org_id ,
& headers . user . uuid ,
@ -2927,8 +2939,8 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
#[ derive(Deserialize) ]
#[ serde(rename_all = " camelCase " ) ]
struct OrganizationUserRecoverAccountRequest {
new_master_password_hash : String ,
key : String ,
new_master_password_hash : Option < String > ,
key : Option < String > ,
#[ serde(default) ]
reset_master_password : bool ,
@ -2972,12 +2984,7 @@ async fn put_recover_account(
conn : DbConn ,
nt : Notify < '_ > ,
) -> EmptyResult {
let req = data . into_inner ( ) ;
if req . reset_master_password & & ! req . reset_two_factor {
recover_account ( org_id , member_id , headers , req , conn , nt ) . await
} else {
err ! ( "Unsupported operation" )
}
recover_account ( org_id , member_id , headers , data . into_inner ( ) , conn , nt ) . await
}
// Deprecated since `v2026.4.2`
@ -2997,7 +3004,7 @@ async fn recover_account(
org_id : OrganizationId ,
member_id : MembershipId ,
headers : AdminHeaders ,
reset_re quest : OrganizationUserRecoverAccountRequest ,
req : OrganizationUserRecoverAccountRequest ,
conn : DbConn ,
nt : Notify < '_ > ,
) -> EmptyResult {
@ -3012,7 +3019,7 @@ async fn recover_account(
err ! ( "User to reset isn't member of required organization" )
} ;
let Some ( user ) = User ::find_by_uuid ( & member . user_uuid , & conn ) . await else {
let Some ( mut user ) = User ::find_by_uuid ( & member . user_uuid , & conn ) . await else {
err ! ( "User not found" )
} ;
@ -3025,29 +3032,56 @@ async fn recover_account(
err ! ( "Organization user must be confirmed for password reset functionality" ) ;
}
// Sending email before resetting password to ensure working email configuration and the resulting
// user notification. Also this might add some protection against security flaws and misuse
if let Err ( e ) = mail ::send_admin_reset_password ( & user . email , user . display_name ( ) , & org . name ) . await {
let fallback_2fa_email = if req . reset_two_factor & & CONFIG . email_2fa_auto_fallback ( ) {
TwoFactor ::find_by_user_and_type ( & user . uuid , TwoFactorType ::Email as i32 , & conn ) . await . is_none ( )
} else {
false
} ;
// Sending email first ensure working email configuration and the resulting user notification.
// Also this might add some protection against security flaws and misuse
if let Err ( e ) = mail ::send_admin_account_recovery (
& user . email ,
user . display_name ( ) ,
& org . name ,
req . reset_master_password ,
req . reset_two_factor ,
fallback_2fa_email ,
)
. await
{
err ! ( format ! ( "Error sending user reset password email: {e:#?}" ) ) ;
}
let mut user = user ;
user . set_password ( reset_request . new_master_password_hash . as_str ( ) , Some ( reset_request . key ) , true , None , & conn )
. await ? ;
if req . reset_master_password {
if let Some ( key ) = req . key
& & let Some ( hash ) = req . new_master_password_hash
{
user . set_password ( hash . as_str ( ) , Some ( key ) , true , None , & conn ) . await ? ;
} else {
err_code ! ( "Unprocessable request" , "Missing fields to reset password" , Status ::UnprocessableEntity . code ) ;
}
}
if req . reset_two_factor {
TwoFactor ::delete_all_by_user ( & user . uuid , & conn ) . await ? ;
if ! fallback_2fa_email | | two_factor ::email ::find_and_activate_email_2fa ( & user . uuid , & conn ) . await . is_err ( ) {
two_factor ::enforce_2fa_policy ( & user , & headers . user . uuid , headers . device . atype , & headers . ip . ip , & conn )
. await ? ;
}
}
user . save ( & conn ) . await ? ;
nt . send_logout ( & user , None , & conn ) . await ;
log_event (
EventType ::OrganizationUserAdminResetPassword as i32 ,
& member_id ,
& org_id ,
& headers . user . uuid ,
headers . device . atype ,
& headers . ip . ip ,
& conn ,
)
. await ;
if req . reset_master_password {
headers . log_event ( EventType ::OrganizationUserAdminResetPassword , & member_id , & org_id , & conn ) . await ;
}
if req . reset_two_factor {
headers . log_event ( EventType ::OrganizationUserAdminResetTwoFactor , & member_id , & org_id , & conn ) . await ;
}
Ok ( ( ) )
}
@ -3166,9 +3200,9 @@ async fn put_reset_password_enrollment(
membership . save ( & conn ) . await ? ;
let event_type = if membership . reset_password_key . is_some ( ) {
EventType ::OrganizationUserResetPasswordEnroll as i32
EventType ::OrganizationUserResetPasswordEnroll
} else {
EventType ::OrganizationUserResetPasswordWithdraw as i32
EventType ::OrganizationUserResetPasswordWithdraw
} ;
log_event ( event_type , & membership . uuid , & org_id , & headers . user . uuid , headers . device . atype , & headers . ip . ip , & conn )
Daniel García
3 days ago
GitHub