Block owners and admins from enrolling in the Key Connector

They administer the key connector itself and are expected to keep a
master password, so refuse set-key-connector-key and
convert-to-key-connector for anyone with an owner or admin membership,
including pending invites.

src/api/core/key_connector.rs

@@ -6,7 +6,10 @@ use crate::{
     CONFIG,
     api::{EmptyResult, JsonResult},
     auth::Headers,
-    db::DbConn,
+    db::{
+        DbConn,
+        models::{Membership, MembershipType, UserId},
+    },
 };
 
 pub fn routes() -> Vec<Route> {
@@ -33,6 +36,13 @@ pub struct SetKeyConnectorKeyData {
     org_identifier: String,
 }
 
+async fn can_use_key_connector(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
+    if Membership::find_by_user(user_uuid, conn).await.iter().any(|m| m.atype >= MembershipType::Admin) {
+        err!("Owners and admins cannot use Key Connector and must keep a master password");
+    }
+    Ok(())
+}
+
 // Called by the client to finish provisioning a new SSO user whose master key
 // was just stored on the key connector.
 #[post("/accounts/set-key-connector-key", data = "<data>")]
@@ -48,6 +58,8 @@ async fn post_set_key_connector_key(data: Json<SetKeyConnectorKeyData>, headers:
         err!("Account already initialized, cannot set Key Connector key");
     }
 
+    can_use_key_connector(&user.uuid, &conn).await?;
+
     user.client_kdf_type = data.kdf;
     user.client_kdf_iter = data.kdf_iterations;
     user.client_kdf_memory = data.kdf_memory;
@@ -78,6 +90,8 @@ async fn post_convert_to_key_connector(headers: Headers, conn: DbConn) -> EmptyR
         err!("Account is not initialized, cannot convert to Key Connector");
     }
 
+    can_use_key_connector(&user.uuid, &conn).await?;
+
     user.password_hash = Vec::new();
     user.password_hint = None;
     user.uses_key_connector = true;