From fddc8e71be5904333acd135734cd1e8f4d8f9c20 Mon Sep 17 00:00:00 2001
From: Tom <83423411+tom27052006@users.noreply.github.com>
Date: Fri, 18 Sep 2026 16:52:49 +0200
Subject: [PATCH] Support the vault banner policy (#7748)

---
 src/api/core/events.rs      | 20 ++++++++++++++++++++
 src/db/models/event.rs      |  2 +-
 src/db/models/org_policy.rs |  1 +
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/api/core/events.rs b/src/api/core/events.rs
index 2c437a36..a5b5b6b1 100644
--- a/src/api/core/events.rs
+++ b/src/api/core/events.rs
@@ -199,6 +199,26 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                     .await;
                 }
             }
+            // Only the vault notification banner click is accepted from clients. The rest of
+            // the 1500..=1599 range is written server-side and must not be forgeable by a client.
+            t if t == EventType::OrganizationUserNotificationBannerActionClicked as i32 => {
+                if let Some(org_id) = &event.organization_id
+                    && let Some(membership) =
+                        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await
+                {
+                    log_event_impl(
+                        event.r#type,
+                        &membership.uuid,
+                        org_id,
+                        &headers.user.uuid,
+                        headers.device.atype,
+                        Some(event_date),
+                        &headers.ip.ip,
+                        &conn,
+                    )
+                    .await;
+                }
+            }
             _ => {
                 // The cipher determines the organization the event is logged to, so make sure the
                 // user can actually access it instead of trusting the provided cipher uuid.
diff --git a/src/db/models/event.rs b/src/db/models/event.rs
index 2d9ed8b2..cc0eb504 100644
--- a/src/db/models/event.rs
+++ b/src/db/models/event.rs
@@ -113,7 +113,7 @@ pub enum EventType {
     OrganizationUserAdminResetTwoFactor = 1519,
     // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
     // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
-    // OrganizationUserNotificationBannerActionClicked = 1522,
+    OrganizationUserNotificationBannerActionClicked = 1522,
 
     // Organization
     OrganizationUpdated = 1600,
diff --git a/src/db/models/org_policy.rs b/src/db/models/org_policy.rs
index 2b45cd86..bf927d5f 100644
--- a/src/db/models/org_policy.rs
+++ b/src/db/models/org_policy.rs
@@ -49,6 +49,7 @@ pub enum OrgPolicyType {
     // AutotypeDefaultSetting = 17, // Not supported yet
     // AutoConfirm = 18, // Not supported (not implemented yet)
     // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
+    OrganizationUserNotification = 20,
 }
 
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs#L5