Tree: f3a8dcfaf8

cached-config-operations

main

revert-7033-patch-1

test_dylint

threat_model

v2-1-blob-ciphers-key-ids

v2-2-registration

v2-3-key-rotation

v2-registration

0.10.0

0.11.0

0.12.0

0.13.0

0.9.0

1.0.0

1.1.0

1.10.0

1.11.0

1.12.0

1.13.0

1.13.1

1.14

1.14.1

1.14.2

1.15.0

1.15.1

1.16.0

1.16.1

1.16.2

1.16.3

1.17.0

1.18.0

1.19.0

1.2.0

1.20.0

1.21.0

1.22.0

1.22.1

1.22.2

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.25.2

1.26.0

1.27.0

1.28.0

1.28.1

1.29.0

1.29.1

1.29.2

1.3.0

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.32.0

1.32.1

1.32.2

1.32.3

1.32.4

1.32.5

1.32.6

1.32.7

1.33.0

1.33.1

1.33.2

1.34.0

1.34.1

1.34.2

1.34.3

1.35.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.5

1.35.6

1.35.7

1.35.8

1.36.0

1.37.0

1.37.1

1.37.2

1.37.3

1.37.4

1.37.5

1.4.0

1.5.0

1.6.0

1.6.1

1.7.0

1.8.0

1.9.0

1.9.1

Branches Tags

${ item.name }

Create tag ${ searchTerm }

Create branch ${ searchTerm }

from 'f3a8dcfaf8'

${ noResults }

Commit Graph

1 Commits (f3a8dcfaf867d5fbd8a4eaf77a6688d23362bca3)

Author	SHA1	Message	Date
Christian Schulz	c08713a0a1	Allow members with Manage collection to import into it under the ownership policy When the "Centralise organisation ownership" (PersonalOwnership) policy is active, a non-admin/owner member can't own personal items and must create organization items instead. The official web-vault already gates the Import destination on this: it offers an org as an import target if the member has `manage: true` on at least one of its collections in their sync data — but Vaultwarden's Collection::to_json_details() only ever set `manage: true` for members with the org-level "Manager" role, ignoring the actual per-collection Manage permission granted to a plain "User" role member. That left the whole Import form disabled for exactly the members this policy is meant to still let use it. - collection.rs: compute `manage` from the per-collection flag (or group grant) directly, independent of the member's org role. Keeps the existing Manager-with-full-access fallback. - organizations.rs (post_org_import): require the same "Manage" permission (not just write access) for existing target collections, and reject the whole import up front if a member without full org access would leave any item unassigned to a collection they can manage — no cipher is created before that's confirmed. - Adds a Playwright test (against a real HTTPS-enabled Vaultwarden + the current official web-vault) proving the import destination, collection, file format and content fields are enabled for such a member, with the org's collection pre-selected instead of the personal vault. Depends on the HTTPS/selector fixes on playwright-https-and-selector-fixes. - Adds unit tests for the new per-cipher-collection-assignment check. Security: this only widens who can be offered as an import target in line with permissions Vaultwarden already enforces elsewhere for manual collection management (is_manageable_by_user); it does not change who is authorized to write to a collection, and the personal-ownership policy itself is unaffected.	3 months ago