- SQLite: the access_all drop used ALTER TABLE ... DROP COLUMN, which needs
SQLite 3.35 while a sqlite_system build links whatever the host provides and
libsqlite3-sys accepts 3.34.1. Use the portable table rebuild instead.
- Preflight: it returned Proceed for every database carrying the repair
migration. Both the access_all drop and the access-permission columns run
after that repair, so their interrupted MySQL/MariaDB states went undetected
and every restart failed with 1091/1060. Check schema and ledger after the
repair too, complete a recorded-drop-without-ledger in place, and refuse the
remaining states with a recovery path.
- Keep deriving a legacy Manager's collection edit/delete from the
organization-local access_all group it came from, rather than dropping the
authority when the repair removes its 0/1/1 copy. Stays revocable with the
group; collection creation remains the independent permission.
- post_org_import: Bitwarden does not require accessImportExport either, it
authorizes on that permission *or* per-collection create/import authority.
- Migrate legacy `access_all` Users losslessly into per-collection
assignments instead of refusing to start the server.
- Keep provisioning of Admin/Owner memberships Owner-only (invite,
confirm, delete); state changes stay as they were.
- Drop the new organization-import gate; the import stays authorized per
target collection, and now requires a confirmed membership.
- Scope `accessReports` to the caller's own collections instead of
handing out every cipher in the organization.
- Let `createNewCollections` read the collection list it needs.
- Reject group changes a caller may not make instead of silently
dropping them.
- Detect partially applied permission-column migrations on MySQL.
- Drop the migration bookkeeping table and remove dead code.
tom27052006