Merge 10662371ba into a6c3bd6d18

.env.template

@@ -491,6 +491,13 @@
 ## KNOW WHAT YOU ARE DOING!
 # ORG_GROUPS_ENABLED=false
 
+## Automatic user confirmation (Know the risks!)
+## Allows organizations to enable the automatic user confirmation policy.
+## Members which accepted an invitation are then confirmed unattended by the browser extension
+## of an unlocked admin, without any human reviewing the invitation.
+## KNOW WHAT YOU ARE DOING!
+# ORG_AUTO_CONFIRM_ENABLED=false
+
 ## Increase secure note size limit (Know the risks!)
 ## Sets the secure note size limit to 100_000 instead of the default 10_000.
 ## WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!

src/api/core/accounts.rs

@@ -12,7 +12,7 @@ use crate::{
     CONFIG,
     api::{
         AnonymousNotify, ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
-        core::{accept_org_invite, log_user_event, two_factor::email},
+        core::{accept_org_invite, accept_user_invitations, log_user_event, two_factor::email},
         master_password_policy, register_push_device, unregister_push_device,
     },
     auth::{ClientHeaders, ClientIp, Headers, decode_delete, decode_invite, decode_verify_email},
@@ -255,7 +255,7 @@ async fn is_email_2fa_required(member_id: Option<MembershipId>, conn: &DbConn) -
     false
 }
 
-pub async fn register(data: Json<RegisterData>, email_verification: bool, conn: DbConn) -> JsonResult {
+pub async fn register(data: Json<RegisterData>, email_verification: bool, conn: DbConn, nt: Notify<'_>) -> JsonResult {
     let mut data: RegisterData = data.into_inner();
     let email = data.email.to_lowercase();
 
@@ -357,7 +357,7 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
                     err!("Registration email does not match invite email")
                 }
             } else if Invitation::take(&email, &conn).await {
-                Membership::accept_user_invitations(&user.uuid, &conn).await?;
+                accept_user_invitations(&user.uuid, &conn, &nt).await?;
                 user
             } else if CONFIG.is_signup_allowed(&email)
                 || (CONFIG.emergency_access_allowed()
@@ -436,7 +436,7 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
 }
 
 #[post("/accounts/set-password", data = "<data>")]
-async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
     let data: SetPasswordData = data.into_inner();
     let mut user = headers.user;
 
@@ -478,13 +478,13 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
             err!("Failed to retrieve the invitation")
         };
 
-        accept_org_invite(&user, membership, None, &conn).await?;
+        accept_org_invite(&user, membership, None, &conn, &nt).await?;
     }
 
     if CONFIG.mail_enabled() {
         mail::send_welcome(&user.email.to_lowercase()).await?;
     } else {
-        Membership::accept_user_invitations(&user.uuid, &conn).await?;
+        accept_user_invitations(&user.uuid, &conn, &nt).await?;
     }
 
     log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)

src/api/core/emergency_access.rs

@@ -1,3 +1,5 @@
+use std::collections::HashMap;
+
 use chrono::{TimeDelta, Utc};
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
@@ -12,14 +14,66 @@ use crate::{
     db::{
         DbConn, DbPool,
         models::{
-            Cipher, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType, Invitation,
+            AutoConfirmRequirement, Cipher, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus,
-            Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
+            EmergencyAccessType, Invitation, Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
         },
     },
     mail,
     util::NumberOrString,
 };
 
+/// Drops every emergency access of `user_id`, the ones it granted as well as the ones it holds, and tells
+/// the grantors which contacts they lost. The grantor of the second group is somebody else, so without a
+/// mail that user would silently lose a part of its account setup.
+/// Bitwarden notifies the same way, one mail per grantor listing all of its removed contacts.
+/// https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/Auth/UserFeatures/EmergencyAccess/Commands/DeleteEmergencyAccessCommand.cs
+pub async fn delete_all_emergency_access_of_user(user_id: &UserId, conn: &DbConn) -> EmptyResult {
+    // Read before deleting, afterwards the rows are gone.
+    let mut removed = EmergencyAccess::find_all_by_grantor_uuid(user_id, conn).await;
+    removed.extend(EmergencyAccess::find_all_by_grantee_uuid(user_id, conn).await);
+
+    EmergencyAccess::delete_all_by_user(user_id, conn).await?;
+
+    if !CONFIG.mail_enabled() || removed.is_empty() {
+        return Ok(());
+    }
+
+    // Group by grantor so that each of them gets a single mail listing all of its removed contacts.
+    let mut by_grantor: HashMap<UserId, Vec<String>> = HashMap::new();
+    for emergency_access in removed {
+        // An invitation that was never accepted only carries the address, the uuid is stored on accept.
+        let grantee_email = match &emergency_access.grantee_uuid {
+            Some(grantee_uuid) => User::find_by_uuid(grantee_uuid, conn).await.map(|u| u.email),
+            None => emergency_access.email.clone(),
+        };
+        let Some(grantee_email) = grantee_email else {
+            warn!(
+                "Not naming the grantee of emergency access {} in the removal notification, it has neither a known user nor an address",
+                emergency_access.uuid
+            );
+            continue;
+        };
+        by_grantor.entry(emergency_access.grantor_uuid).or_default().push(grantee_email);
+    }
+
+    for (grantor_uuid, mut grantee_emails) in by_grantor {
+        let Some(grantor) = User::find_by_uuid(&grantor_uuid, conn).await else {
+            warn!("Skipping the emergency access removal notification for {grantor_uuid}, the account is gone");
+            continue;
+        };
+
+        grantee_emails.sort_unstable();
+        grantee_emails.dedup();
+
+        // The rows are already gone, so a failing mail must not take the whole request down with it.
+        if let Err(e) = mail::send_emergency_access_grantees_removed(&grantor.email, &grantee_emails).await {
+            error!("Failed to notify {} about its removed emergency access contacts: {e:?}", grantor.email);
+        }
+    }
+
+    Ok(())
+}
+
 pub fn routes() -> Vec<Route> {
     routes![
         get_contacts,
@@ -222,6 +276,12 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
         err!("You can not set yourself as an emergency contact.")
     }
 
+    // Emergency access would hand this account to somebody the organization never vetted, which is why
+    // Bitwarden forbids it for members of an organization which confirms its members automatically.
+    if AutoConfirmRequirement::for_user(&grantor_user.uuid, &conn).await.forbids_emergency_access() {
+        err!("You are a member of an organization which does not allow emergency access.")
+    }
+
     let (grantee_user, new_user) = match User::find_by_mail(&email, &conn).await {
         None => {
             if !CONFIG.invitations_allowed() {
@@ -354,6 +414,11 @@ async fn accept_invite(
         err!("Invited user not found")
     };
 
+    // See `send_invite`, the same restriction applies to the grantee side of an emergency access.
+    if AutoConfirmRequirement::for_user(&grantee_user.uuid, &conn).await.forbids_emergency_access() {
+        err!("You are a member of an organization which does not allow emergency access.")
+    }
+
     // We need to search for the uuid in combination with the email, since we do not yet store the uuid of the grantee in the database.
     // The uuid of the grantee gets stored once accepted.
     let Some(mut emergency_access) =

src/api/core/mod.rs

@@ -24,7 +24,7 @@ use crate::{
     auth::Headers,
     db::{
         DbConn,
-        models::{Membership, MembershipStatus, OrgPolicy, Organization, User},
+        models::{Membership, MembershipStatus, MembershipType, OrgPolicy, Organization, User, UserId},
     },
     error::Error,
     http_client::make_http_request,
@@ -220,6 +220,10 @@ fn config() -> Json<Value> {
         &FeatureFlagFilter::ValidOnly,
     );
     feature_states.insert("pm-19148-innovation-archive".to_owned(), true);
+    // Web vaults up to 2026.4.x only offer the automatic user confirmation policy when this flag is on:
+    // `display$(org, config) => config.getFeatureFlag$(FeatureFlag.AutoConfirm).pipe(map(f => f && org.useAutomaticUserConfirmation))`
+    // Newer clients dropped the flag and look at `useAutomaticUserConfirmation` alone, so sending it stays harmless.
+    feature_states.insert("pm-19934-auto-confirm-organization-users".to_owned(), CONFIG.org_auto_confirm_enabled());
 
     Json(json!({
         // Note: The clients use this version to handle backwards compatibility concerns
@@ -277,11 +281,54 @@ fn api_not_found() -> Json<Value> {
     }))
 }
 
+/// Tells everybody who is able to confirm this member that it accepted its invitation and is waiting.
+/// Only the browser extension of an unlocked admin acts upon this, it holds the organization key which
+/// is needed to confirm a member and which the server never has.
+/// Call this wherever a membership reaches the accepted state.
+pub async fn notify_pending_auto_confirm(member: &Membership, conn: &DbConn, nt: &Notify<'_>) {
+    if member.status != MembershipStatus::Accepted as i32
+        || member.atype != MembershipType::User
+        || !OrgPolicy::is_auto_confirm_enabled(&member.org_uuid, conn).await
+    {
+        return;
+    }
+
+    // Confirming requires `AdminHeaders`, so skip the managers this also returns. They could not act on
+    // the notification anyway and would only run into a rejected request.
+    for admin in Membership::find_confirmed_and_manage_all_by_org(&member.org_uuid, conn)
+        .await
+        .into_iter()
+        .filter(|m| m.atype >= MembershipType::Admin)
+    {
+        nt.send_auto_confirm_member(&admin.user_uuid, &member.org_uuid, &member.uuid, &member.user_uuid).await;
+    }
+}
+
+/// Accepts every open invitation of a user at once, as done when mail is disabled, and notifies for each
+/// of them. See [`notify_pending_auto_confirm`].
+pub async fn accept_user_invitations(user_id: &UserId, conn: &DbConn, nt: &Notify<'_>) -> EmptyResult {
+    let invited: Vec<Membership> = Membership::find_any_state_by_user(user_id, conn)
+        .await
+        .into_iter()
+        .filter(|m| m.status == MembershipStatus::Invited as i32)
+        .collect();
+
+    Membership::accept_user_invitations(user_id, conn).await?;
+
+    for mut member in invited {
+        member.status = MembershipStatus::Accepted as i32;
+        notify_pending_auto_confirm(&member, conn, nt).await;
+    }
+
+    Ok(())
+}
+
 async fn accept_org_invite(
     user: &User,
     mut member: Membership,
     reset_password_key: Option<String>,
     conn: &DbConn,
+    nt: &Notify<'_>,
 ) -> EmptyResult {
     if member.status != MembershipStatus::Invited as i32 {
         err!("User already accepted the invitation");
@@ -295,6 +342,8 @@ async fn accept_org_invite(
 
     member.save(conn).await?;
 
+    notify_pending_auto_confirm(&member, conn, nt).await;
+
     if CONFIG.mail_enabled() {
         let Some(org) = Organization::find_by_uuid(&member.org_uuid, conn).await else {
             err!("Organization not found.")

src/api/core/organizations.rs

@@ -9,15 +9,19 @@ use crate::{
     api::admin::FAKE_ADMIN_UUID,
     api::{
         EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
-        core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor},
+        core::{
+            CipherSyncData, CipherSyncType, accept_org_invite, emergency_access::delete_all_emergency_access_of_user,
+            log_event, notify_pending_auto_confirm, two_factor,
+        },
     },
     auth::{AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite},
     db::{
         DbConn,
         models::{
-            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType,
+            AutoConfirmRequirement, Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId,
-            Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus, MembershipType,
+            CollectionUser, EventType, Group, GroupId, GroupUser, Invitation, Membership, MembershipId,
-            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, User, UserId,
+            MembershipStatus, MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey,
+            OrganizationId, User, UserId,
         },
     },
     mail,
@@ -55,6 +59,9 @@ pub fn routes() -> Vec<Route> {
         bulk_reinvite_members,
         confirm_invite,
         bulk_confirm_invite,
+        get_pending_auto_confirm_members,
+        auto_confirm_member,
+        bulk_auto_confirm_members,
         accept_invite,
         get_org_user_mini_details,
         get_user,
@@ -196,6 +203,15 @@ async fn create_organization(headers: Headers, data: Json<OrgData>, conn: DbConn
     if !CONFIG.is_org_creation_allowed(&headers.user.email) {
         err!("User not allowed to create organizations")
     }
+    // Stricter than the SingleOrg policy below, which exempts owners and admins: an organization which
+    // confirms its members automatically forbids every one of its members, in any role and in any status,
+    // to be part of another organization, so it may not create one either.
+    // https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/AdminConsole/OrganizationFeatures/Organizations/SelfHostedOrganizationSignUpCommand.cs
+    if AutoConfirmRequirement::for_user(&headers.user.uuid, &conn).await.forbids_creating_organization() {
+        err!(
+            "You may not create an organization. You belong to an organization which confirms its members automatically and prohibits you from being a member of any other organization."
+        )
+    }
     if OrgPolicy::is_applicable_to_user(&headers.user.uuid, OrgPolicyType::SingleOrg, None, &conn).await {
         err!(
             "You may not create an organization. You belong to an organization which has a policy that prohibits you from being a member of any other organization."
@@ -1045,6 +1061,7 @@ async fn send_invite(
     data: Json<InviteData>,
     headers: AdminHeaders,
     conn: DbConn,
+    nt: Notify<'_>,
 ) -> EmptyResult {
     if org_id != headers.org_id {
         err!("Organization not found", "Organization id's do not match");
@@ -1185,6 +1202,11 @@ async fn send_invite(
             let mut group_entry = GroupUser::new(group_id.clone(), new_member.uuid.clone());
             group_entry.save(&conn).await?;
         }
+
+        // With mail disabled an existing user is accepted right away, so there is no accept request later on.
+        // This is the last step on purpose: an admin client may confirm the member the moment it is told
+        // about it, and by then the collections and groups of the invite have to be in place.
+        notify_pending_auto_confirm(&new_member, &conn, &nt).await;
     }
 
     Ok(())
@@ -1196,6 +1218,7 @@ async fn bulk_reinvite_members(
     data: Json<BulkMembershipIds>,
     headers: AdminHeaders,
     conn: DbConn,
+    nt: Notify<'_>,
 ) -> JsonResult {
     if org_id != headers.org_id {
         err!("Organization not found", "Organization id's do not match");
@@ -1204,7 +1227,7 @@ async fn bulk_reinvite_members(
 
     let mut bulk_response = Vec::new();
     for member_id in data.ids {
-        let err_msg = match reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn).await {
+        let err_msg = match reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn, &nt).await {
             Ok(()) => String::new(),
             Err(e) => format!("{e:?}"),
         };
@@ -1231,11 +1254,12 @@ async fn reinvite_member(
     member_id: MembershipId,
     headers: AdminHeaders,
     conn: DbConn,
+    nt: Notify<'_>,
 ) -> EmptyResult {
     if org_id != headers.org_id {
         err!("Organization not found", "Organization id's do not match");
     }
-    reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn).await
+    reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn, &nt).await
 }
 
 async fn reinvite_member_impl(
@@ -1243,6 +1267,7 @@ async fn reinvite_member_impl(
     member_id: &MembershipId,
     invited_by_email: &str,
     conn: &DbConn,
+    nt: &Notify<'_>,
 ) -> EmptyResult {
     let Some(member) = Membership::find_by_uuid_and_org(member_id, org_id, conn).await else {
         err!("The user hasn't been invited to the organization.")
@@ -1276,6 +1301,7 @@ async fn reinvite_member_impl(
         let mut member = member;
         member.status = MembershipStatus::Accepted as i32;
         member.save(conn).await?;
+        notify_pending_auto_confirm(&member, conn, nt).await;
     }
 
     Ok(())
@@ -1295,6 +1321,7 @@ async fn accept_invite(
     data: Json<AcceptData>,
     headers: Headers,
     conn: DbConn,
+    nt: Notify<'_>,
 ) -> EmptyResult {
     // The web-vault passes org_id and member_id in the URL, but we are just reading them from the JWT instead
     let data: AcceptData = data.into_inner();
@@ -1333,7 +1360,7 @@ async fn accept_invite(
         // In case the user was invited before the mail was saved in db.
         membership.invited_by_email = membership.invited_by_email.or(claims.invited_by_email);
 
-        accept_org_invite(&headers.user, membership, reset_password_key, &conn).await?;
+        accept_org_invite(&headers.user, membership, reset_password_key, &conn, &nt).await?;
     } else if CONFIG.mail_enabled() {
         // User was invited from /admin, so they are automatically confirmed
         let org_name = CONFIG.invitation_org_name();
@@ -1373,7 +1400,11 @@ async fn bulk_confirm_invite(
     match data.keys {
         Some(keys) => {
             for invite in keys {
-                let member_id = invite.id.unwrap();
+                // Never unwrap the id, this is client supplied and a missing one must not take the request down
+                let Some(member_id) = invite.id else {
+                    error!("Ignoring a bulk confirm entry without a member id");
+                    continue;
+                };
                 let user_key = invite.key.unwrap_or_default();
                 let err_msg = match confirm_invite_impl(&org_id, &member_id, &user_key, &headers, &conn, &nt).await {
                     Ok(()) => String::new(),
@@ -1428,7 +1459,7 @@ async fn confirm_invite_impl(
         err!("Key or UserId is not set, unable to process request");
     }
 
-    let Some(mut member_to_confirm) = Membership::find_by_uuid_and_org(member_id, org_id, conn).await else {
+    let Some(member_to_confirm) = Membership::find_by_uuid_and_org(member_id, org_id, conn).await else {
         err!("The specified user isn't a member of the organization")
     };
 
@@ -1436,6 +1467,20 @@ async fn confirm_invite_impl(
         err!("Only Owners can confirm Managers, Admins or Owners")
     }
 
+    confirm_member(member_to_confirm, key, headers, conn, nt).await
+}
+
+/// Shared by the manual and the automatic confirmation, both hand us the organization key encrypted
+/// with the public key of the member to confirm.
+async fn confirm_member(
+    mut member_to_confirm: Membership,
+    key: &str,
+    headers: &AdminHeaders,
+    conn: &DbConn,
+    nt: &Notify<'_>,
+) -> EmptyResult {
+    let org_id = member_to_confirm.org_uuid.clone();
+
     if member_to_confirm.status != MembershipStatus::Accepted as i32 {
         err!("User in invalid state")
     }
@@ -1446,10 +1491,20 @@ async fn confirm_invite_impl(
     // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type
     OrgPolicy::check_user_allowed(&member_to_confirm, "confirm", conn).await?;
 
+    // An organization which confirms its members automatically does not tolerate emergency access: the
+    // grantee could take over the account of a member that nobody ever vetted and reach the organization
+    // vault through it. Enabling the policy drops the grants of the members present at that time, this
+    // covers the member which brings one along when it joins afterwards. Bitwarden does the same, and
+    // like there it applies to the manual confirmation as well.
+    // https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/ConfirmOrganizationUserCommand.cs
+    if OrgPolicy::is_auto_confirm_enabled(&org_id, conn).await {
+        delete_all_emergency_access_of_user(&member_to_confirm.user_uuid, conn).await?;
+    }
+
     log_event(
         EventType::OrganizationUserConfirmed,
         &member_to_confirm.uuid,
-        org_id,
+        &org_id,
         &headers.user.uuid,
         headers.device.atype,
         &headers.ip.ip,
@@ -1458,7 +1513,7 @@ async fn confirm_invite_impl(
     .await;
 
     if CONFIG.mail_enabled() {
-        let org_name = if let Some(org) = Organization::find_by_uuid(org_id, conn).await {
+        let org_name = if let Some(org) = Organization::find_by_uuid(&org_id, conn).await {
             org.name
         } else {
             err!("Error looking up organization.")
@@ -1480,6 +1535,142 @@ async fn confirm_invite_impl(
     save_result
 }
 
+// Automatic user confirmation. The server can never confirm a member by itself, confirming means
+// encrypting the organization key with the public key of the member and the server does not have the
+// organization key. So all we do here is telling an admin client which members are waiting, the client
+// does the actual work in the background.
+// https://bitwarden.com/help/automatic-confirmation/
+
+/// Only a member which accepted its invitation and holds the plain User role is ever confirmed without
+/// a human looking at it. Every elevated role keeps needing a manual confirmation by an Owner, and an
+/// Owner can not lift that restriction here like it can for the manual confirmation.
+fn may_be_confirmed_automatically(member: &Membership) -> bool {
+    member.status == MembershipStatus::Accepted as i32 && member.atype == MembershipType::User
+}
+
+#[get("/organizations/<org_id>/users/pending-auto-confirm")]
+async fn get_pending_auto_confirm_members(org_id: OrganizationId, headers: AdminHeaders, conn: DbConn) -> JsonResult {
+    if org_id != headers.org_id {
+        err!("Organization not found", "Organization id's do not match");
+    }
+
+    // Bitwarden responds with an empty list instead of an error when the feature or the policy is off.
+    let members = if OrgPolicy::is_auto_confirm_enabled(&org_id, &conn).await {
+        Membership::find_by_org(&org_id, &conn)
+            .await
+            .into_iter()
+            .filter(may_be_confirmed_automatically)
+            .map(|m| {
+                json!({
+                    "object": "organizationUserPendingAutoConfirm",
+                    "id": m.uuid,
+                    "userId": m.user_uuid,
+                })
+            })
+            .collect()
+    } else {
+        Vec::new()
+    };
+
+    Ok(Json(json!({
+        "data": members,
+        "object": "list",
+        "continuationToken": null
+    })))
+}
+
+#[post("/organizations/<org_id>/users/<member_id>/auto-confirm", data = "<data>")]
+async fn auto_confirm_member(
+    org_id: OrganizationId,
+    member_id: MembershipId,
+    data: Json<ConfirmData>,
+    headers: AdminHeaders,
+    conn: DbConn,
+    nt: Notify<'_>,
+) -> EmptyResult {
+    let data = data.into_inner();
+    let user_key = data.key.unwrap_or_default();
+    auto_confirm_member_impl(&org_id, &member_id, &user_key, &headers, &conn, &nt).await
+}
+
+#[post("/organizations/<org_id>/users/bulk-auto-confirm", data = "<data>")]
+async fn bulk_auto_confirm_members(
+    org_id: OrganizationId,
+    data: Json<BulkConfirmData>,
+    headers: AdminHeaders,
+    conn: DbConn,
+    nt: Notify<'_>,
+) -> JsonResult {
+    if org_id != headers.org_id {
+        err!("Organization not found", "Organization id's do not match");
+    }
+    let data = data.into_inner();
+
+    let mut bulk_response = Vec::new();
+    match data.keys {
+        Some(keys) => {
+            for member in keys {
+                // Never unwrap the id, this is client supplied and a missing one must not take the request down
+                let Some(member_id) = member.id else {
+                    error!("Ignoring a bulk auto confirm entry without a member id");
+                    continue;
+                };
+                let user_key = member.key.unwrap_or_default();
+                let err_msg = match auto_confirm_member_impl(&org_id, &member_id, &user_key, &headers, &conn, &nt).await
+                {
+                    Ok(()) => String::new(),
+                    Err(e) => format!("{e:?}"),
+                };
+
+                bulk_response.push(json!(
+                    {
+                        "object": "OrganizationBulkConfirmResponseModel",
+                        "id": member_id,
+                        "error": err_msg
+                    }
+                ));
+            }
+        }
+        None => error!("No keys to confirm"),
+    }
+
+    Ok(Json(json!({
+        "data": bulk_response,
+        "object": "list",
+        "continuationToken": null
+    })))
+}
+
+async fn auto_confirm_member_impl(
+    org_id: &OrganizationId,
+    member_id: &MembershipId,
+    key: &str,
+    headers: &AdminHeaders,
+    conn: &DbConn,
+    nt: &Notify<'_>,
+) -> EmptyResult {
+    if org_id != &headers.org_id {
+        err!("Organization not found", "Organization id's do not match");
+    }
+    if key.is_empty() || member_id.is_empty() {
+        err!("Key or UserId is not set, unable to process request");
+    }
+
+    if !OrgPolicy::is_auto_confirm_enabled(org_id, conn).await {
+        err!("Automatic user confirmation is not enabled for this organization")
+    }
+
+    let Some(member_to_confirm) = Membership::find_by_uuid_and_org(member_id, org_id, conn).await else {
+        err!("The specified user isn't a member of the organization")
+    };
+
+    if !may_be_confirmed_automatically(&member_to_confirm) {
+        err!("This member can not be confirmed automatically")
+    }
+
+    confirm_member(member_to_confirm, key, headers, conn, nt).await
+}
+
 #[get("/organizations/<org_id>/users/mini-details", rank = 1)]
 async fn get_org_user_mini_details(org_id: OrganizationId, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult {
     if org_id != headers.membership.org_uuid {
@@ -2113,6 +2304,54 @@ async fn put_policy(
         }
     }
 
+    // The automatic user confirmation policy hands out organization access without anybody looking at it,
+    // so it needs to be allowed by the server first and it requires the Single Org policy on top.
+    // https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/AutomaticUserConfirmationPolicyEventHandler.cs
+    let auto_confirm_turned_on = if pol_type_enum == OrgPolicyType::AutomaticUserConfirmation
+        && data.enabled
+        // Only the step from disabled to enabled validates and has side effects. The web vault saves a
+        // policy on every edit, and re-running the below on an already enabled policy would keep wiping
+        // emergency access that members created in the meantime. Bitwarden guards this the same way.
+        && !OrgPolicy::is_auto_confirm_enabled(&org_id, &conn).await
+    {
+        if !CONFIG.org_auto_confirm_enabled() {
+            err!("Automatic user confirmation is not enabled on this server.")
+        }
+
+        let single_org_policy_enabled =
+            match OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::SingleOrg, &conn).await {
+                Some(p) => p.enabled,
+                None => false,
+            };
+
+        if !single_org_policy_enabled {
+            err!("Single Organization policy is not enabled. It is mandatory for this policy to be enabled.")
+        }
+
+        // Every member has to be compliant already. Contrary to the Single Org policy below we do not revoke
+        // the members that are not, because this policy also applies to owners and admins and revoking those
+        // could lock the organization out of itself.
+        for member in Membership::find_by_org(&org_id, &conn).await {
+            if member.counts_for_auto_confirm()
+                && Membership::count_accepted_confirmed_and_revoked_by_user(&member.user_uuid, &org_id, &conn).await > 0
+            {
+                err!("This policy forbids members to be part of other organizations, but at least one member still is.")
+            }
+        }
+
+        true
+    } else {
+        false
+    };
+
+    // Also prevent the Single Org policy to be disabled while automatic user confirmation depends on it
+    if pol_type_enum == OrgPolicyType::SingleOrg
+        && !data.enabled
+        && OrgPolicy::is_auto_confirm_enabled(&org_id, &conn).await
+    {
+        err!("Automatic user confirmation is enabled. It is not allowed to disable this policy.")
+    }
+
     // When enabling the TwoFactorAuthentication policy, revoke all members that do not have 2FA
     if pol_type_enum == OrgPolicyType::TwoFactorAuthentication && data.enabled {
         two_factor::enforce_2fa_policy_for_org(
@@ -2169,6 +2408,25 @@ async fn put_policy(
     policy.data = serde_json::to_string(&data.data)?;
     policy.save(&conn).await?;
 
+    // Emergency access would hand the account of a member to somebody outside of the control of this
+    // organization, which defeats the point of vetting members. Bitwarden drops these grants when the
+    // policy is turned on, and blocks new ones while it is on (see `emergency_access.rs`).
+    // This runs after the policy is stored so that a failed save can not destroy data for nothing, and it
+    // skips invited members on purpose: an invitation is created by an admin without any consent of the
+    // invited user, so it must never be able to delete data of an account that never joined.
+    if auto_confirm_turned_on {
+        for member in Membership::find_by_org(&org_id, &conn).await {
+            if member.status == MembershipStatus::Invited as i32 {
+                continue;
+            }
+            info!(
+                "Removing emergency access of {} because automatic user confirmation was enabled for {org_id}",
+                member.user_uuid
+            );
+            delete_all_emergency_access_of_user(&member.user_uuid, &conn).await?;
+        }
+    }
+
     log_event(
         EventType::PolicyUpdated,
         policy.uuid.as_ref(),
@@ -2434,6 +2692,20 @@ async fn restore_member_impl(
             // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type
             // This check need to be done after restoring to work with the correct status
             OrgPolicy::check_user_allowed(&member, "restore", conn).await?;
+
+            // A revoked membership is restored without another accept step, so the member is back inside the
+            // organization with whatever it set up while it was revoked. Emergency access created in that
+            // window would therefore outlive the revocation, which the policy must not allow, so it is
+            // dropped here before the membership becomes active again. Like enabling the policy this leaves
+            // a member which is only invited alone, an invitation must never delete data of an account that
+            // never joined.
+            // https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RestoreUser/v1/RestoreOrganizationUserCommand.cs
+            if member.status != MembershipStatus::Invited as i32
+                && OrgPolicy::is_auto_confirm_enabled(org_id, conn).await
+            {
+                delete_all_emergency_access_of_user(&member.user_uuid, conn).await?;
+            }
+
             member.save(conn).await?;
 
             log_event(
@@ -3251,3 +3523,32 @@ async fn rotate_api_key(
 ) -> JsonResult {
     api_key(&org_id, data, true, headers, conn).await
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Automatic confirmation hands out access to the organization vault without anybody looking at it,
+    /// so it must stay limited to plain members which actually accepted their invitation.
+    #[test]
+    fn only_accepted_plain_members_are_confirmed_automatically() {
+        let mut member =
+            Membership::new(UserId::from(String::from("user")), OrganizationId::from(String::from("org")), None);
+
+        for status in
+            [MembershipStatus::Revoked as i32, MembershipStatus::Invited as i32, MembershipStatus::Confirmed as i32]
+        {
+            member.status = status;
+            assert!(!may_be_confirmed_automatically(&member), "status {status} must not qualify");
+        }
+
+        member.status = MembershipStatus::Accepted as i32;
+        for atype in [MembershipType::Owner as i32, MembershipType::Admin as i32, MembershipType::Manager as i32] {
+            member.atype = atype;
+            assert!(!may_be_confirmed_automatically(&member), "type {atype} must not qualify");
+        }
+
+        member.atype = MembershipType::User as i32;
+        assert!(may_be_confirmed_automatically(&member));
+    }
+}

src/api/identity.rs

@@ -12,7 +12,7 @@ use serde_json::Value;
 use crate::{
     CONFIG,
     api::{
-        ApiResult, EmptyResult, JsonResult,
+        ApiResult, EmptyResult, JsonResult, Notify,
         core::{
             accounts::{PreloginData, RegisterData, kdf_upgrade, prelogin, register},
             log_user_event,
@@ -1060,8 +1060,8 @@ async fn prelogin_password(data: Json<PreloginData>, conn: DbConn) -> Json<Value
 }
 
 #[post("/accounts/register", data = "<data>")]
-async fn identity_register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
+async fn identity_register(data: Json<RegisterData>, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    register(data, false, conn).await
+    register(data, false, conn, nt).await
 }
 
 #[derive(Debug, Deserialize)]
@@ -1124,8 +1124,8 @@ async fn register_verification_email(
 }
 
 #[post("/accounts/register/finish", data = "<data>")]
-async fn register_finish(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
+async fn register_finish(data: Json<RegisterData>, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    register(data, true, conn).await
+    register(data, true, conn, nt).await
 }
 
 // https://github.com/bitwarden/jslib/blob/master/common/src/models/request/tokenRequest.ts

src/api/notifications.rs

@@ -15,7 +15,10 @@ use crate::{
     auth::{ClientIp, WsAccessTokenHeader},
     db::{
         DbConn,
-        models::{AuthRequestId, Cipher, CollectionId, Device, DeviceId, Folder, PushId, Send as DbSend, User, UserId},
+        models::{
+            AuthRequestId, Cipher, CollectionId, Device, DeviceId, Folder, MembershipId, OrganizationId, PushId,
+            Send as DbSend, User, UserId,
+        },
     },
 };
 
@@ -510,6 +513,33 @@ impl WebSocketUsers {
         }
     }
 
+    /// Tells the clients of `recipient_id` that `member_id` accepted an invitation and is waiting to be
+    /// confirmed. Only the browser extension acts upon this, it holds the organization key needed to
+    /// confirm the member, which the server never has. Because of that this is WebSocket only.
+    /// https://github.com/bitwarden/clients/blob/main/libs/auto-confirm/README.md
+    pub async fn send_auto_confirm_member(
+        &self,
+        recipient_id: &UserId,
+        org_id: &OrganizationId,
+        member_id: &MembershipId,
+        member_user_id: &UserId,
+    ) {
+        if !CONFIG.enable_websocket() {
+            return;
+        }
+        let data = create_update(
+            vec![
+                ("UserId".into(), recipient_id.to_string().into()),
+                ("OrganizationId".into(), org_id.to_string().into()),
+                ("TargetUserId".into(), member_user_id.to_string().into()),
+                ("TargetOrganizationUserId".into(), member_id.to_string().into()),
+            ],
+            UpdateType::AutoConfirmMember,
+            None,
+        );
+        self.send_update(recipient_id, &data).await;
+    }
+
     pub async fn send_auth_request(&self, user_id: &UserId, auth_request_uuid: &str, device: &Device, conn: &DbConn) {
         // Skip any processing if both WebSockets and Push are not active
         if *NOTIFICATIONS_DISABLED {
@@ -700,6 +730,13 @@ pub enum UpdateType {
     // NotificationStatus = 21, // Not supported
 
     // RefreshSecurityTasks = 22, // Not supported
+
+    // OrganizationBankAccountVerified = 23, // Not supported (Not AGPLv3 Licensed)
+    // ProviderBankAccountVerified = 24, // Not supported (Not AGPLv3 Licensed)
+
+    // SyncPolicy = 25, // Not supported
+    AutoConfirmMember = 26,
+    // PremiumStatusChanged = 27, // Not supported
     None = 100,
 }
 

src/config.rs

@@ -795,6 +795,11 @@ make_config! {
         /// Enable groups (BETA!) (Know the risks!) |> Enables groups support for organizations (Currently contains known issues!).
         org_groups_enabled:            bool, false, def, false;
 
+        /// Enable automatic user confirmation (Know the risks!) |> Allows organizations to enable the automatic user confirmation policy.
+        /// Members which accepted an invitation are then confirmed unattended by the browser extension of an unlocked admin,
+        /// without any human reviewing the invitation. Bitwarden only enables this per organization on request, we keep it off by default.
+        org_auto_confirm_enabled:      bool, false, def, false;
+
         /// Increase note size limit (Know the risks!) |> Sets the secure note size limit to 100_000 instead of the default 10_000.
         /// WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
         increase_note_size_limit:      bool,  true,  def, false;
@@ -1749,6 +1754,7 @@ where
     reg!("email/change_email_invited", ".html");
     reg!("email/change_email", ".html");
     reg!("email/delete_account", ".html");
+    reg!("email/emergency_access_grantees_removed", ".html");
     reg!("email/emergency_access_invite_accepted", ".html");
     reg!("email/emergency_access_invite_confirmed", ".html");
     reg!("email/emergency_access_recovery_approved", ".html");
@@ -1868,3 +1874,33 @@ handlebars::handlebars_helper!(webver: | web_vault_version: String |
 handlebars::handlebars_helper!(vwver: | vw_version: String |
     semver::VersionReq::parse(&vw_version).expect("Invalid Vaultwarden version compare string").matches(&VW_VERSION)
 );
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The registry runs in strict mode, so a placeholder which the sender does not fill only blows up
+    /// when the mail is actually sent. Render both templates of the emergency access removal notification
+    /// with the data `mail::send_emergency_access_grantees_removed` passes.
+    #[test]
+    fn emergency_access_grantees_removed_renders() {
+        let hb = load_templates(std::env::temp_dir());
+        let data = serde_json::json!({
+            "url": "https://vault.example.com",
+            "img_src": "https://vault.example.com/mail/",
+            "grantee_emails": ["first@example.com", "second@example.com"],
+        });
+
+        for name in ["email/emergency_access_grantees_removed", "email/emergency_access_grantees_removed.html"] {
+            let rendered = match hb.render(name, &data) {
+                Ok(rendered) => rendered,
+                Err(e) => panic!("{name} failed to render: {e:?}"),
+            };
+
+            let (subject, body) = rendered.split_once("<!---------------->").expect("no subject separator");
+            assert_eq!(subject.trim(), "Emergency contacts removed");
+            assert!(body.contains("first@example.com"), "{name} does not list every removed contact");
+            assert!(body.contains("second@example.com"), "{name} does not list every removed contact");
+        }
+    }
+}

src/db/models/mod.rs

@@ -29,7 +29,7 @@ pub use self::event::{Event, EventType};
 pub use self::favorite::Favorite;
 pub use self::folder::{Folder, FolderCipher, FolderId};
 pub use self::group::{CollectionGroup, Group, GroupId, GroupUser};
-pub use self::org_policy::{OrgPolicy, OrgPolicyId, OrgPolicyType};
+pub use self::org_policy::{AutoConfirmRequirement, OrgPolicy, OrgPolicyId, OrgPolicyType};
 pub use self::organization::{
     Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization, OrganizationApiKey,
     OrganizationId,

src/db/models/org_policy.rs

@@ -47,7 +47,7 @@ pub enum OrgPolicyType {
     RestrictedItemTypes = 15,
     UriMatchDefaults = 16,
     // AutotypeDefaultSetting = 17, // Not supported yet
-    // AutoConfirm = 18, // Not supported (not implemented yet)
+    AutomaticUserConfirmation = 18,
     // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
 }
 
@@ -281,6 +281,43 @@ impl OrgPolicy {
         false
     }
 
+    /// Returns every membership of the user, in any status and of any role, in an organization which has
+    /// `policy_type` enabled. Contrary to the queries above this filters nothing away, the caller decides
+    /// which memberships its operation cares about. Bitwarden collects the policies of a user the same way
+    /// and lets each policy declare the roles and statuses it exempts.
+    /// https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/BasePolicyRequirementFactory.cs
+    pub async fn find_memberships_by_user_and_active_policy(
+        user_uuid: &UserId,
+        policy_type: OrgPolicyType,
+        conn: &DbConn,
+    ) -> Vec<Membership> {
+        conn.run(move |conn| {
+            org_policies::table
+                .inner_join(
+                    users_organizations::table.on(users_organizations::org_uuid
+                        .eq(org_policies::org_uuid)
+                        .and(users_organizations::user_uuid.eq(user_uuid))),
+                )
+                .filter(org_policies::atype.eq(policy_type as i32))
+                .filter(org_policies::enabled.eq(true))
+                .select(users_organizations::all_columns)
+                .load::<Membership>(conn)
+                .expect("Error loading memberships by org_policy")
+        })
+        .await
+    }
+
+    /// Returns true if members of this organization may be confirmed automatically. This requires both the
+    /// server wide config option and the policy of this organization to be enabled, which mirrors Bitwarden
+    /// where the organization needs the feature enabled by support on top of the policy.
+    pub async fn is_auto_confirm_enabled(org_uuid: &OrganizationId, conn: &DbConn) -> bool {
+        CONFIG.org_auto_confirm_enabled()
+            && match Self::find_by_org_and_type(org_uuid, OrgPolicyType::AutomaticUserConfirmation, conn).await {
+                Some(p) => p.enabled,
+                None => false,
+            }
+    }
+
     pub async fn check_user_allowed(m: &Membership, action: &str, conn: &DbConn) -> EmptyResult {
         if m.atype < MembershipType::Admin && m.status > (MembershipStatus::Invited as i32) {
             // Enforce TwoFactor/TwoStep login
@@ -314,6 +351,26 @@ impl OrgPolicy {
             }
         }
 
+        // The automatic user confirmation policy is a stricter variant of the SingleOrg policy, it does not
+        // exempt owners and admins and it applies to every status. Therefore it is checked outside of the
+        // block above.
+        // https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/AdminConsole/OrganizationFeatures/Policies/Enforcement/AutoConfirm/AutomaticUserConfirmationPolicyEnforcementHandler.cs
+        if AutoConfirmRequirement::for_user(&m.user_uuid, conn).await.forbids_membership_outside(&m.org_uuid) {
+            err!(format!(
+                "Cannot {} because another organization confirms its members automatically and forbids other memberships (membership {})",
+                action, m.uuid
+            ));
+        }
+
+        if Self::is_auto_confirm_enabled(&m.org_uuid, conn).await
+            && Membership::count_accepted_confirmed_and_revoked_by_user(&m.user_uuid, &m.org_uuid, conn).await > 0
+        {
+            err!(format!(
+                "Cannot {} because the organization confirms its members automatically and forbids being part of other organizations (membership {})",
+                action, m.uuid
+            ));
+        }
+
         Ok(())
     }
 
@@ -372,3 +429,192 @@ impl OrgPolicy {
 
 #[derive(Clone, Debug, AsRef, DieselNewType, From, FromForm, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub struct OrgPolicyId(String);
+
+/// The memberships of a user in organizations which confirm their members automatically.
+///
+/// Bitwarden models this as a policy requirement: a value which answers what the policy forbids this user
+/// to do. Contrary to every other policy this one exempts no role and no status, so an owner or an admin
+/// is bound by it just like a plain member. Not every operation looks at every status though, which is why
+/// each question below states which memberships it counts instead of one shared query deciding it.
+/// https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyRequirements/AutomaticUserConfirmationPolicyRequirement.cs
+pub struct AutoConfirmRequirement(Vec<Membership>);
+
+impl AutoConfirmRequirement {
+    /// Loads the requirement of a user. It is always empty while the server wide config option is off,
+    /// the policy can not be enabled anywhere then and so it enforces nothing.
+    pub async fn for_user(user_uuid: &UserId, conn: &DbConn) -> Self {
+        if !CONFIG.org_auto_confirm_enabled() {
+            return Self(Vec::new());
+        }
+
+        Self(
+            OrgPolicy::find_memberships_by_user_and_active_policy(
+                user_uuid,
+                OrgPolicyType::AutomaticUserConfirmation,
+                conn,
+            )
+            .await,
+        )
+    }
+
+    /// The user may not create another organization. Every membership counts here, an open invitation
+    /// included, and the role does not matter: this is what makes the policy stricter than SingleOrg,
+    /// which exempts owners and admins. Mirrors `CannotCreateNewOrganization()`.
+    pub fn forbids_creating_organization(&self) -> bool {
+        !self.0.is_empty()
+    }
+
+    /// A membership in an organization other than `org_uuid` forbids the user to be part of `org_uuid`.
+    /// Mirrors `IsEnabledForOrganizationsOtherThan(organizationId)`.
+    pub fn forbids_membership_outside(&self, org_uuid: &OrganizationId) -> bool {
+        self.0.iter().any(|m| &m.org_uuid != org_uuid)
+    }
+
+    /// The user may neither grant nor accept emergency access, which would hand its account, and with it
+    /// the organization vault, to somebody the organization never vetted.
+    ///
+    /// Bitwarden restricts the accepted, the confirmed and the revoked status, and exempts only an open
+    /// invitation. See [`Membership::counts_for_auto_confirm`] for why a revoked membership is restricted
+    /// no matter which status it was revoked from.
+    /// Mirrors `GrantorCannotInviteToEmergencyAccess()` and `GranteeCannotAcceptEmergencyAccess()`.
+    pub fn forbids_emergency_access(&self) -> bool {
+        self.0.iter().any(Membership::counts_for_auto_confirm)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn org(name: &str) -> OrganizationId {
+        OrganizationId::from(String::from(name))
+    }
+
+    /// A membership of our user in an organization which has the policy enabled.
+    fn membership(org_uuid: &OrganizationId, atype: MembershipType, status: i32) -> Membership {
+        let mut member = Membership::new(UserId::from(String::from("user")), org_uuid.clone(), None);
+        member.atype = atype as i32;
+        member.status = status;
+        member
+    }
+
+    /// The revoked counterpart of `status`, stored the way `Membership::revoke` does it.
+    fn revoked(org_uuid: &OrganizationId, atype: MembershipType, status: i32) -> Membership {
+        let mut member = membership(org_uuid, atype, status);
+        assert!(member.revoke(), "status {status} can not be revoked");
+        member
+    }
+
+    /// Automatic user confirmation exempts no role, so an owner or an admin of such an organization may
+    /// not create another organization either. This is the difference to the SingleOrg policy, which lets
+    /// both of them through.
+    #[test]
+    fn no_role_may_create_another_organization() {
+        let auto_confirm_org = org("auto-confirm");
+
+        for atype in [MembershipType::User, MembershipType::Manager, MembershipType::Admin, MembershipType::Owner] {
+            let requirement =
+                AutoConfirmRequirement(vec![membership(&auto_confirm_org, atype, MembershipStatus::Confirmed as i32)]);
+            assert!(requirement.forbids_creating_organization(), "type {} must not create an org", atype as i32);
+        }
+    }
+
+    /// Neither does it exempt a status, an invitation and a revoked membership bind just as much.
+    #[test]
+    fn no_status_may_create_another_organization() {
+        let auto_confirm_org = org("auto-confirm");
+
+        let memberships = [
+            membership(&auto_confirm_org, MembershipType::User, MembershipStatus::Invited as i32),
+            membership(&auto_confirm_org, MembershipType::User, MembershipStatus::Accepted as i32),
+            membership(&auto_confirm_org, MembershipType::User, MembershipStatus::Confirmed as i32),
+            revoked(&auto_confirm_org, MembershipType::User, MembershipStatus::Accepted as i32),
+            revoked(&auto_confirm_org, MembershipType::User, MembershipStatus::Confirmed as i32),
+        ];
+
+        for member in memberships {
+            let status = member.status;
+            assert!(
+                AutoConfirmRequirement(vec![member]).forbids_creating_organization(),
+                "status {status} must not create an org"
+            );
+        }
+    }
+
+    /// A user which is in no such organization is not restricted by this policy at all. Whether it may
+    /// create an organization is then decided by the SingleOrg policy alone, exactly as before.
+    #[test]
+    fn without_such_a_membership_nothing_is_forbidden() {
+        let requirement = AutoConfirmRequirement(Vec::new());
+
+        assert!(!requirement.forbids_creating_organization());
+        assert!(!requirement.forbids_membership_outside(&org("other")));
+        assert!(!requirement.forbids_emergency_access());
+    }
+
+    /// The organization which enabled the policy is the one membership that is allowed to exist.
+    #[test]
+    fn only_a_membership_in_another_organization_is_forbidden() {
+        let auto_confirm_org = org("auto-confirm");
+        let requirement = AutoConfirmRequirement(vec![membership(
+            &auto_confirm_org,
+            MembershipType::User,
+            MembershipStatus::Confirmed as i32,
+        )]);
+
+        assert!(!requirement.forbids_membership_outside(&auto_confirm_org));
+        assert!(requirement.forbids_membership_outside(&org("other")));
+    }
+
+    /// Accepted, confirmed and every revoked membership block emergency access. The revoked ones matter
+    /// because a membership is restored without another accept step, so an emergency access created while
+    /// revoked would survive the restore.
+    #[test]
+    fn joined_and_revoked_memberships_forbid_emergency_access() {
+        let auto_confirm_org = org("auto-confirm");
+
+        let memberships = [
+            membership(&auto_confirm_org, MembershipType::User, MembershipStatus::Accepted as i32),
+            membership(&auto_confirm_org, MembershipType::User, MembershipStatus::Confirmed as i32),
+            revoked(&auto_confirm_org, MembershipType::User, MembershipStatus::Accepted as i32),
+            revoked(&auto_confirm_org, MembershipType::User, MembershipStatus::Confirmed as i32),
+        ];
+
+        for member in memberships {
+            let status = member.status;
+            assert!(
+                AutoConfirmRequirement(vec![member]).forbids_emergency_access(),
+                "status {status} must not have emergency access"
+            );
+        }
+    }
+
+    /// A revoked invitation is revoked like any other membership, so it is restricted too. Bitwarden
+    /// stores one `Revoked` status without looking at what it was revoked from and restricts all of it.
+    #[test]
+    fn a_revoked_invitation_forbids_emergency_access() {
+        let member = revoked(&org("auto-confirm"), MembershipType::User, MembershipStatus::Invited as i32);
+
+        assert!(AutoConfirmRequirement(vec![member]).forbids_emergency_access());
+    }
+
+    /// An open invitation is the only membership emergency access is not restricted by, that account did
+    /// not join yet and may still decline.
+    #[test]
+    fn an_open_invitation_does_not_forbid_emergency_access() {
+        let member = membership(&org("auto-confirm"), MembershipType::User, MembershipStatus::Invited as i32);
+
+        assert!(!AutoConfirmRequirement(vec![member]).forbids_emergency_access());
+    }
+
+    /// One joined membership is enough, even next to an invitation which does not restrict by itself.
+    #[test]
+    fn one_joined_membership_forbids_emergency_access() {
+        let requirement = AutoConfirmRequirement(vec![
+            membership(&org("invited-to"), MembershipType::User, MembershipStatus::Invited as i32),
+            membership(&org("auto-confirm"), MembershipType::User, MembershipStatus::Confirmed as i32),
+        ]);
+
+        assert!(requirement.forbids_emergency_access());
+    }
+}

src/db/models/organization.rs

@@ -204,6 +204,7 @@ impl Organization {
             "maxCollections": null,
             "maxStorageGb": i16::MAX, // The value doesn't matter, we don't check server-side
             "use2fa": true,
+            "useAutomaticUserConfirmation": CONFIG.org_auto_confirm_enabled(),
             "useCustomPermissions": true,
             "useDirectory": false, // Is supported, but this value isn't checked anywhere (yet)
             "useEvents": CONFIG.org_events_enabled(),
@@ -498,6 +499,7 @@ impl Membership {
             "useKeyConnector": false,
             "useSecretsManager": false, // Not supported (Not AGPLv3 Licensed)
             "usePasswordManager": true,
+            "useAutomaticUserConfirmation": CONFIG.org_auto_confirm_enabled(),
             "useCustomPermissions": true,
             "useActivateAutofillPolicy": false,
             "useAdminSponsoredFamilies": false,
@@ -917,6 +919,44 @@ impl Membership {
         .await
     }
 
+    /// Whether this membership counts for the automatic user confirmation policy, which exempts no role
+    /// and only one status: an open invitation, because that account did not join yet and may still
+    /// decline. An accepted, a confirmed and every revoked membership count, a revoked one because it is
+    /// restored without another accept step and would come back the moment the other organization
+    /// restores it. Bitwarden reads the memberships of an account the same way, its invitations are not
+    /// linked to the account at all while every revoked membership is.
+    /// https://github.com/bitwarden/server/blob/b3d1eb9a7854322f106efa55c191c1a4da9f8645/src/Core/AdminConsole/OrganizationFeatures/Policies/Enforcement/AutoConfirm/AutomaticUserConfirmationPolicyEnforcementHandler.cs
+    pub fn counts_for_auto_confirm(&self) -> bool {
+        self.status != MembershipStatus::Invited as i32
+    }
+
+    /// The same rule as [`Membership::counts_for_auto_confirm`] as a query: how many organizations besides
+    /// `excluded_org` the user belongs to as far as the automatic user confirmation policy is concerned.
+    /// Contrary to `count_accepted_and_confirmed_by_user`, which the SingleOrg policy uses and which must
+    /// keep ignoring them, this counts revoked memberships as well. A revoked membership is stored as its
+    /// previous status minus 128, so every revoked status is below `Invited`.
+    pub async fn count_accepted_confirmed_and_revoked_by_user(
+        user_uuid: &UserId,
+        excluded_org: &OrganizationId,
+        conn: &DbConn,
+    ) -> i64 {
+        conn.run(move |conn| {
+            users_organizations::table
+                .filter(users_organizations::user_uuid.eq(user_uuid))
+                .filter(users_organizations::org_uuid.ne(excluded_org))
+                .filter(
+                    users_organizations::status
+                        .eq(MembershipStatus::Accepted as i32)
+                        .or(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
+                        .or(users_organizations::status.lt(MembershipStatus::Invited as i32)),
+                )
+                .count()
+                .first::<i64>(conn)
+                .unwrap_or(0)
+        })
+        .await
+    }
+
     pub async fn find_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec<Self> {
         conn.run(move |conn| {
             users_organizations::table
@@ -1285,4 +1325,43 @@ mod tests {
         assert!(MembershipType::Manager > MembershipType::User);
         assert!(MembershipType::Manager == MembershipType::from_str("4").unwrap());
     }
+
+    fn member_with_status(status: i32) -> Membership {
+        let mut member =
+            Membership::new(UserId::from(String::from("user")), OrganizationId::from(String::from("org")), None);
+        member.status = status;
+        member
+    }
+
+    /// The rule `count_accepted_confirmed_and_revoked_by_user` encodes as a query, and which decides
+    /// whether a membership in another organization blocks joining, restoring, emergency access and
+    /// enabling the policy. Only an open invitation is exempt, every revoked membership counts, no matter
+    /// which status it was revoked from.
+    #[test]
+    fn auto_confirm_counts_everything_but_an_open_invitation() {
+        for status in [MembershipStatus::Invited, MembershipStatus::Accepted, MembershipStatus::Confirmed] {
+            let unrevoked = status as i32;
+            let mut member = member_with_status(unrevoked);
+            assert_eq!(
+                member.counts_for_auto_confirm(),
+                unrevoked != MembershipStatus::Invited as i32,
+                "status {unrevoked} is counted incorrectly"
+            );
+
+            assert!(member.revoke(), "status {unrevoked} can not be revoked");
+            assert!(member.counts_for_auto_confirm(), "status {unrevoked} must count once it is revoked");
+        }
+    }
+
+    /// The SingleOrg policy keeps ignoring revoked memberships, so the two rules must not be the same.
+    /// `count_accepted_and_confirmed_by_user` is the one that stays as it is.
+    #[test]
+    fn a_revoked_membership_is_below_invited() {
+        let mut member = member_with_status(MembershipStatus::Confirmed as i32);
+        assert!(member.revoke());
+
+        assert!(member.status < MembershipStatus::Invited as i32);
+        assert_ne!(member.status, MembershipStatus::Accepted as i32);
+        assert_ne!(member.status, MembershipStatus::Confirmed as i32);
+    }
 }

src/mail.rs

@@ -394,6 +394,22 @@ pub async fn send_emergency_access_invite_accepted(address: &str, grantee_email:
     send_email(address, &subject, body_html, body_text).await
 }
 
+/// Tells a grantor which of its emergency access contacts were dropped. Deliberately does not name the
+/// reason: the recipient can be somebody outside of the organization which triggered this, and it has no
+/// business learning about the memberships of others. Bitwarden keeps this generic as well.
+pub async fn send_emergency_access_grantees_removed(address: &str, grantee_emails: &[String]) -> EmptyResult {
+    let (subject, body_html, body_text) = get_text(
+        "email/emergency_access_grantees_removed",
+        json!({
+            "url": CONFIG.domain(),
+            "img_src": CONFIG._smtp_img_src(),
+            "grantee_emails": grantee_emails,
+        }),
+    )?;
+
+    send_email(address, &subject, body_html, body_text).await
+}
+
 pub async fn send_emergency_access_invite_confirmed(address: &str, grantor_name: &str) -> EmptyResult {
     let (subject, body_html, body_text) = get_text(
         "email/emergency_access_invite_confirmed",

src/static/templates/email/emergency_access_grantees_removed.hbs

@@ -0,0 +1,10 @@
+Emergency contacts removed
+<!---------------->
+The following emergency contacts have been removed from your account:
+
+{{#each grantee_emails}}
+* {{this}}
+{{/each}}
+
+You can set up emergency access again from the web vault ({{url}}).
+{{> email/email_footer_text }}

src/static/templates/email/emergency_access_grantees_removed.html.hbs

@@ -0,0 +1,21 @@
+Emergency contacts removed
+<!---------------->
+{{> email/email_header }}
+ <table width="100%" cellpadding="0" cellspacing="0" style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
+    <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
+       <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
+           The following emergency contacts have been removed from your account:
+           <ul style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
+{{#each grantee_emails}}
+               <li style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{this}}</li>
+{{/each}}
+           </ul>
+       </td>
+    </tr>
+    <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
+       <td class="content-block last" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0; -webkit-text-size-adjust: none;" valign="top">
+           You can set up emergency access again from the <a href="{{url}}/">web vault</a>.
+       </td>
+    </tr>
+ </table>
+{{> email/email_footer }}