diff --git a/.env.template b/.env.template
index 2d5c5d8e..f34ea249 100644
--- a/.env.template
+++ b/.env.template
@@ -78,7 +78,7 @@
# DB_CONNECTION_RETRIES=15
## Database timeout
-## Timeout in seconds when acquiring database connection
+## Timeout when acquiring database connection
# DATABASE_TIMEOUT=30
## Database idle timeout
@@ -173,7 +173,7 @@
## Defaults to daily. Set blank to disable this job. Also without EVENTS_DAYS_RETAIN set, this job will not start.
# EVENT_CLEANUP_SCHEDULE="0 10 0 * * *"
## Number of days to retain events stored in the database.
-## If unset (the default) or 0, events are kept indefinitely and the scheduled job is disabled!
+## If unset (the default), events are kept indefinitely and the scheduled job is disabled!
# EVENTS_DAYS_RETAIN=
##
## Cron schedule of the job that cleans old auth requests from the auth request.
@@ -233,7 +233,7 @@
# USER_SEND_LIMIT=
## Number of days to wait before auto-deleting a trashed item.
-## If unset (the default) or 0, trashed items are not auto-deleted.
+## If unset (the default), trashed items are not auto-deleted.
## This setting applies globally, so make sure to inform all users of any changes to this setting.
# TRASH_AUTO_DELETE_DAYS=
@@ -386,31 +386,19 @@
# HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS=true
## Client Settings
-## Server-wide Fill Assist rules feed base directory URL, not a JSON file.
-## Defaults to https://fillassist.bitwarden.com.
-## Must be a valid HTTPS URL without credentials, query parameters, fragments, or surrounding whitespace.
-# FILL_ASSIST_RULES_URL=https://fillassist.bitwarden.com
-
## Enable experimental feature flags for clients.
## This is a comma-separated list of flags, e.g. "flag1,flag2,flag3".
## Note that clients cache the /api/config endpoint for about 1 hour and it could take some time before they are enabled or disabled!
##
## The following flags are available:
-## - "fill-assist-targeting-rules": Enable Fill Assist targeting rules in the browser extension. (Browser >= 2026.6.0)
## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
-## - "windows-desktop-autotype": Enable the autotype feature preview on Windows. (Desktop >= 2025.8.0)
-## - "windows-desktop-autotype-ga": Enable the new, still in development, autotype implementation on Windows. (Desktop >= 2026.9.1)
-## Only enable one of the two autotype flags, the clients disable autotype completely when both are enabled.
-## - "pm-30529-webauthn-related-origins": Allow passkeys stored in the vault to be used on related origins listed in a site's /.well-known/webauthn file (Browser >= 2026.2.0)
+## - "pm-30529-webauthn-related-origins":
## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
-## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
-## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers.
-## Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet.
# EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
## Require new device emails. When a user logs in an email is required to be sent.
@@ -471,7 +459,7 @@
## Allowed connect-src (Know the risks!)
## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
-## Allows other domains for URLs which can be loaded using script interfaces like the Forwarded email alias feature
+## Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
## This adds the configured value to the 'Content-Security-Policy' headers 'connect-src' value.
## Multiple values must be separated with a whitespace. And only HTTPS values are allowed.
## Example: "https://my-addy-io.domain.tld https://my-simplelogin.domain.tld"
@@ -497,15 +485,6 @@
## KNOW WHAT YOU ARE DOING!
# ORG_GROUPS_ENABLED=false
-## EXPERIMENTAL FEATURE: Custom roles
-## Enables the Custom member role with granular permissions for organizations.
-## This is still being developed: only the permissions this version enforces can be granted.
-## This is enforced by the server and is unrelated to EXPERIMENTAL_CLIENT_FEATURE_FLAGS.
-## Disabling it again keeps the stored Custom roles and permissions, but they grant nothing until it is re-enabled.
-## Disabled by default because this is an experimental feature!
-## KNOW WHAT YOU ARE DOING!
-# EXPERIMENTAL_CUSTOM_ROLES=false
-
## Increase secure note size limit (Know the risks!)
## Sets the secure note size limit to 100_000 instead of the default 10_000.
## WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
@@ -623,9 +602,6 @@
## Note that the checkbox would still be present, but ignored.
# DISABLE_2FA_REMEMBER=false
##
-## Number of days before a remembered 2FA login expires (min: 1, max: 90).
-# TWO_FACTOR_REMEMBER_DAYS=30
-##
## Authenticator Settings
## Disable authenticator time drifted codes to be valid.
## TOTP codes of the previous and next 30 seconds will be invalid
@@ -634,7 +610,7 @@
## we allow by default the TOTP code which was valid one step back and one in the future.
## This can however allow attackers to be a bit more lucky with their attempts because there are 3 valid codes.
## You can disable this, so that only the current TOTP Code is allowed.
-## Keep in mind that when a server drifts out of time, valid codes could be marked as invalid.
+## Keep in mind that when a sever drifts out of time, valid codes could be marked as invalid.
## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid.
# AUTHENTICATOR_DISABLE_TIME_DRIFT=false
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 673137cf..f52bd8e4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -113,7 +113,7 @@ jobs:
# Enable Rust Caching
- name: Rust Caching
- uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+ uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
with:
# Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
# Like changing the build host from Ubuntu 20.04 to 22.04 for example.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f80509d..903a5e22 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -106,7 +106,7 @@ jobs:
# Login to Docker Hub
- name: Login to Docker Hub
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -121,7 +121,7 @@ jobs:
# Login to GitHub Container Registry
- name: Login to GitHub Container Registry
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -137,7 +137,7 @@ jobs:
# Login to Quay.io
- name: Login to Quay.io
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -185,7 +185,7 @@ jobs:
- name: Bake ${{ matrix.base_image }} containers
id: bake_vw
- uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
+ uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
env:
BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -222,7 +222,7 @@ jobs:
touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
- name: Upload digest
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: digests-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
path: ${{ runner.temp }}/digests/*
@@ -242,7 +242,7 @@ jobs:
subject-path: vaultwarden-${{ env.NORMALIZED_ARCH }}
- name: Upload binaries as artifacts
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
path: vaultwarden-${{ env.NORMALIZED_ARCH }}
@@ -264,7 +264,7 @@ jobs:
steps:
- name: Download digests
- uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
path: ${{ runner.temp }}/digests
pattern: digests-*-${{ matrix.base_image }}
@@ -272,7 +272,7 @@ jobs:
# Login to Docker Hub
- name: Login to Docker Hub
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -287,7 +287,7 @@ jobs:
# Login to GitHub Container Registry
- name: Login to GitHub Container Registry
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -303,7 +303,7 @@ jobs:
# Login to Quay.io
- name: Login to Quay.io
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 7ffbe632..81c51847 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -50,6 +50,6 @@ jobs:
severity: CRITICAL,HIGH
- name: Upload Trivy scan results to GitHub Security tab
- uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+ uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
with:
sarif_file: 'trivy-results.sarif'
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index f7d1f92c..45f90bb9 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -23,4 +23,4 @@ jobs:
# When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
- name: Spell Check Repo
- uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+ uses: crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 7372759b..31153b07 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -24,7 +24,7 @@ jobs:
persist-credentials: false
- name: Run zizmor
- uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+ uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
with:
# intentionally not scanning the entire repository,
# since it contains integration tests.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b6352bbb..ab96a84f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -18,7 +18,7 @@ repos:
# When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
- repo: https://github.com/crate-ci/typos
- rev: 7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+ rev: 00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
hooks:
- id: typos
always_run: true
diff --git a/Cargo.lock b/Cargo.lock
index 587ac6b6..6c9d9237 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -68,9 +68,9 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
[[package]]
name = "arc-swap"
-version = "1.9.3"
+version = "1.9.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380962b3d93b99642e50b9febf72c071e97e8b32d86eae9cf4ef582bb960ae6e"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
dependencies = [
"rustversion",
]
@@ -151,9 +151,9 @@ dependencies = [
[[package]]
name = "async-compression"
-version = "0.4.51"
+version = "0.4.50"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d5755640120b24961f8231e05892e4a4f7e0d04e8aeca161508c9c397946970"
+checksum = "ee19bd99b43e3691acbad4e840420a4881cea6c0b66a208125a824f8fd53f5a1"
dependencies = [
"compression-codecs",
"compression-core",
@@ -318,14 +318,20 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
name = "asyncband"
-version = "0.7.4"
+version = "0.7.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d2050892d4691cf110586070786712b504985a4d37ed64a9cd8a402718e1706"
+checksum = "5161fb43cb8f231f06983cb2b8f9ee9cee14be0b1356d8383398cc0f312800d1"
+
+[[package]]
+name = "atomic"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59bdb34bc650a32731b31bd8f0829cc15d24a708ee31559e0bb34f2bc320cba"
[[package]]
name = "atomic"
@@ -350,9 +356,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
[[package]]
name = "aws-config"
-version = "1.13.0"
+version = "1.12.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "939e256cfe0ed68e96d32f194339d88210d5c10685cff0787400158f852c6819"
+checksum = "b8d7b388a9fc3a6db15a5ec778c38b354eff1364882c94d08e0252f7a47dcaa4"
dependencies = [
"aws-credential-types",
"aws-runtime",
@@ -381,9 +387,9 @@ dependencies = [
[[package]]
name = "aws-credential-types"
-version = "1.3.1"
+version = "1.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "576e8da35751dc85409ec1cd15999f692c277a1fbe9336780fe6f15e49dd637d"
+checksum = "e93964ffdaf57857f544be3666a5f57570bb699e934700f11b49708f61bb556e"
dependencies = [
"aws-smithy-async",
"aws-smithy-runtime-api",
@@ -393,9 +399,9 @@ dependencies = [
[[package]]
name = "aws-runtime"
-version = "1.10.2"
+version = "1.10.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a0cc2144962cc5e358467b16e3d82981b1d424a7c3d34602be0036103814a1a"
+checksum = "2b8a9911551b4ea6ca13805ef52ed96f7d2bbb43cc3b4a14cb0776a71f33cfaa"
dependencies = [
"aws-credential-types",
"aws-sigv4",
@@ -409,7 +415,7 @@ dependencies = [
"bytes-utils",
"fastrand",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"percent-encoding",
"pin-project-lite",
"tracing",
@@ -418,9 +424,9 @@ dependencies = [
[[package]]
name = "aws-sdk-sso"
-version = "1.119.0"
+version = "1.114.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c414f25ec4aa9dc18f5cc8f55e18848bb509fcda4ce7c77bee6072e95806bc9"
+checksum = "12be2f9c8eef7f5fc919c96d538e629698469a02b4cb75408b26b1bd984ebe79"
dependencies = [
"arc-swap",
"aws-credential-types",
@@ -443,9 +449,9 @@ dependencies = [
[[package]]
name = "aws-sdk-ssooidc"
-version = "1.121.0"
+version = "1.116.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc638bb4355e6514334dcc3228cd4622f5ee54d704bd6a9010a5a91d7856d9d9"
+checksum = "d7645db8724ea3b82fdccfb67e1b0f637c9d8ab0e7ef29d84884d8d8d73f805d"
dependencies = [
"arc-swap",
"aws-credential-types",
@@ -468,9 +474,9 @@ dependencies = [
[[package]]
name = "aws-sdk-sts"
-version = "1.124.0"
+version = "1.119.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f8a0dd8fbde04ba58ad722113c7addb11bf94cf549b1ea0eb9ea427fb87198a"
+checksum = "03e490aa904849b38e770922faac779dd245f5cf8be81f19065acf18d276e4ad"
dependencies = [
"arc-swap",
"aws-credential-types",
@@ -494,9 +500,9 @@ dependencies = [
[[package]]
name = "aws-sigv4"
-version = "1.6.4"
+version = "1.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f385da9b7757ed4c8214797ad663ff534fb622006143530aa80e21f8e06ff85c"
+checksum = "2312577f088c9fbf4206dfdb884cf1de9407b43e1a923cbed5237775116fc24b"
dependencies = [
"aws-credential-types",
"aws-smithy-http",
@@ -508,16 +514,16 @@ dependencies = [
"hmac 0.13.0",
"http 1.5.0",
"percent-encoding",
- "sha2 0.11.1",
+ "sha2 0.11.0",
"time",
"tracing",
]
[[package]]
name = "aws-smithy-async"
-version = "1.3.1"
+version = "1.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de681a9df7ff79823b759ee17061076ec049cd61a8fa28ece4293d89c9f6964e"
+checksum = "f02e407fb3b54891734224b9ffac8a71fdd35f542500fa1af95754a6b2beb316"
dependencies = [
"futures-util",
"pin-project-lite",
@@ -526,9 +532,9 @@ dependencies = [
[[package]]
name = "aws-smithy-http"
-version = "0.64.3"
+version = "0.64.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19af609dd5edf8b056cd0bb001c706c8b3b1458055328b334ec13d7f46f6aaa8"
+checksum = "639b4d8f8555f24a9be649811c3eb0b4d4616f4d61daf0c32e28873bc1ea9af1"
dependencies = [
"aws-smithy-runtime-api",
"aws-smithy-types",
@@ -537,18 +543,19 @@ dependencies = [
"futures-core",
"futures-util",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"http-body-util",
"percent-encoding",
"pin-project-lite",
+ "pin-utils",
"tracing",
]
[[package]]
name = "aws-smithy-json"
-version = "0.65.1"
+version = "0.63.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b45f9fc77ffe92c92c341165a01a565bd30c39ecf5aa8c0719b41719009604f9"
+checksum = "3385d469edbe8b60cc72002784652b5efca39178192aa9cc4b44c9875c6bdc18"
dependencies = [
"aws-smithy-runtime-api",
"aws-smithy-schema",
@@ -566,9 +573,9 @@ dependencies = [
[[package]]
name = "aws-smithy-query"
-version = "0.64.0"
+version = "0.62.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "165f6265342a313ad6f7a1ac17a0cdba30c522039d3f41d8d6871ce8a2b34ecd"
+checksum = "f1d1d71f6562be974caa85442ecd90194c40fdb5df045f182a6c2e872ce95056"
dependencies = [
"aws-smithy-runtime-api",
"aws-smithy-schema",
@@ -579,9 +586,9 @@ dependencies = [
[[package]]
name = "aws-smithy-runtime"
-version = "1.16.2"
+version = "1.16.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cb80fb19c084da5fca9d797845735e184445e5b958599440d67529bf6ef1b64"
+checksum = "d6e302ac1d88b99652489df31abdec6ac42a2ab2ac3982ad0ac49f64dfaf28ba"
dependencies = [
"aws-smithy-async",
"aws-smithy-http",
@@ -592,18 +599,19 @@ dependencies = [
"bytes",
"fastrand",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"http-body-util",
"pin-project-lite",
+ "pin-utils",
"tokio",
"tracing",
]
[[package]]
name = "aws-smithy-runtime-api"
-version = "1.19.2"
+version = "1.19.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c4e85cffe9944b10d576b075432bd8f98dbc081e8681cb37d5b2d87dc27bc84"
+checksum = "c0730c16f91124c6a2abb4932c77e299288b3dd9f967ea2e9ec48cc6731e87a4"
dependencies = [
"aws-smithy-async",
"aws-smithy-runtime-api-macros",
@@ -618,9 +626,9 @@ dependencies = [
[[package]]
name = "aws-smithy-runtime-api-macros"
-version = "1.2.0"
+version = "1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce237f890a2283c9b328955c3b0918d2d5bf66a1cb6ceccd36a0047246fbc6e6"
+checksum = "221eaa237ddf1ca79b60d1372aad77e47f9c0ea5b3ce5099da8c61d027dc77b3"
dependencies = [
"proc-macro2",
"quote",
@@ -629,9 +637,9 @@ dependencies = [
[[package]]
name = "aws-smithy-schema"
-version = "1.1.2"
+version = "0.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9543fc722ed4865ab29fb66bd7ed0bef7b029d265ba8c587144511e30006d431"
+checksum = "e8f395d93304280b64b7632fea798d177e74897fe7f063416ce627cd6fa24829"
dependencies = [
"aws-smithy-runtime-api",
"aws-smithy-types",
@@ -640,19 +648,20 @@ dependencies = [
[[package]]
name = "aws-smithy-types"
-version = "1.9.1"
+version = "1.8.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf183d70774ea2cfcc101ca74a8884e4c76be8b9df65cd303f6a1175c88e8f80"
+checksum = "69bb407740a197147da48238ecc94498493c9e85445732360cec180296ca45f1"
dependencies = [
"base64-simd",
"bytes",
"bytes-utils",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"http-body-util",
"itoa",
"num-integer",
"pin-project-lite",
+ "pin-utils",
"ryu",
"serde",
"time",
@@ -660,9 +669,9 @@ dependencies = [
[[package]]
name = "aws-smithy-xml"
-version = "0.64.1"
+version = "0.62.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "590fdc1a70546b2f7f2061c42eaf173fb6f26d935330d069edc04dbd8f01d924"
+checksum = "0b932c8d6dc127fc980eecd78f8694ae9b9551b69a93a7def2a199c1c0033daf"
dependencies = [
"aws-smithy-runtime-api",
"aws-smithy-schema",
@@ -672,9 +681,9 @@ dependencies = [
[[package]]
name = "aws-types"
-version = "1.7.0"
+version = "1.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba0d970d3947bb064d2ae1d823efa186c1dbde88f88afa8f6549946e5d8deee"
+checksum = "209f3a6d82a6e9e5f94abbed94c7a26e1c052341002bf57a5fb5481f625896fc"
dependencies = [
"aws-credential-types",
"aws-smithy-async",
@@ -691,12 +700,6 @@ version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
-[[package]]
-name = "base16ct"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
-
[[package]]
name = "base64"
version = "0.21.7"
@@ -815,9 +818,9 @@ dependencies = [
[[package]]
name = "brotli"
-version = "9.1.1"
+version = "9.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "627b7cfb0578f0eafce087a90fcd40add1231900b69e4d4de2d456260a4f5d81"
+checksum = "f8b851b75c23ca7873623d612fe49bd1989aeb03d08fb9432187eb253d3d4c6b"
dependencies = [
"alloc-no-stdlib",
"alloc-stdlib",
@@ -826,9 +829,9 @@ dependencies = [
[[package]]
name = "brotli-decompressor"
-version = "6.2.0"
+version = "6.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34c6783f42c21c952ad7112b354f0ba2f10760e9decea5b1b60523d6e270faaf"
+checksum = "941cd9bd4ddab83cb46fa5a2d428f1c857b24ac78cb876cf7beb710840934bd7"
dependencies = [
"alloc-no-stdlib",
"alloc-stdlib",
@@ -879,16 +882,16 @@ dependencies = [
[[package]]
name = "cached"
-version = "4.1.0"
+version = "4.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f886e989b5b6e7991606f2550e45a99e130024465ba8d67f9f9b256eb7044bf"
+checksum = "292f39b5c459538e148825347c400cb2005a618b897d0e6be183bad677d460b7"
dependencies = [
"ahash",
"async-lock",
"cached_proc_macro",
"cached_proc_macro_types",
"hashbrown 0.17.1",
- "parking_lot 0.12.5",
+ "parking_lot",
"thiserror 2.0.21",
"web-time",
]
@@ -914,9 +917,9 @@ checksum = "f5813789573ae815c8b4be58c4428e0e7ae05f0227678ba9de332ded585b9159"
[[package]]
name = "cc"
-version = "1.10.0"
+version = "1.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86e055fa6e3e40ad6187ba25b6855eeb635d5271f8e0f0e1e9a5826b8d75bea0"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
dependencies = [
"find-msvc-tools",
"jobserver",
@@ -985,9 +988,9 @@ checksum = "b9e769b5c8c8283982a987c6e948e540254f1058d5a74b8794914d4ef5fc2a24"
[[package]]
name = "combine"
-version = "4.6.9"
+version = "4.6.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4356eba6976435498d05a311ee9fc486da3bc81c200d3f0d7dd9703b41913f92"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
dependencies = [
"bytes",
"memchr",
@@ -995,9 +998,9 @@ dependencies = [
[[package]]
name = "compression-codecs"
-version = "0.4.46"
+version = "0.4.45"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cae36683101b2899f48bd31f8db9839437356188e3b1ff23096e73dab09ba8fe"
+checksum = "98fc98460ba0ad5317075d3632b8dfc45d0be8c4a49347c2a38272019717614a"
dependencies = [
"brotli",
"compression-core",
@@ -1009,9 +1012,9 @@ dependencies = [
[[package]]
name = "compression-core"
-version = "0.4.34"
+version = "0.4.33"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ebdda89edc534bf8d5dd2857562633b6495557e5846552ade994b99ed13c36a"
+checksum = "6e8ccc4ea9f6acc32d102c0f6d471d11d913ad15f20c04de743374861fa1d414"
[[package]]
name = "concurrent-queue"
@@ -1124,12 +1127,6 @@ version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
-[[package]]
-name = "cpubits"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
-
[[package]]
name = "cpufeatures"
version = "0.2.17"
@@ -1160,9 +1157,9 @@ dependencies = [
[[package]]
name = "crc32fast"
-version = "1.5.3"
+version = "1.5.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
dependencies = [
"cfg-if",
]
@@ -1227,22 +1224,6 @@ dependencies = [
"zeroize",
]
-[[package]]
-name = "crypto-bigint"
-version = "0.7.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c035cb64cba03dad2fb921f3e218785e8cf9a41790da5eb3a1400f62fa2be11"
-dependencies = [
- "cpubits",
- "ctutils",
- "getrandom 0.4.3",
- "hybrid-array",
- "num-traits",
- "rand_core 0.10.1",
- "subtle",
- "zeroize",
-]
-
[[package]]
name = "crypto-common"
version = "0.1.6"
@@ -1259,19 +1240,16 @@ version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
dependencies = [
- "getrandom 0.4.3",
"hybrid-array",
- "rand_core 0.10.1",
]
[[package]]
name = "ctutils"
-version = "0.4.7"
+version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
dependencies = [
"cmov",
- "subtle",
]
[[package]]
@@ -1284,23 +1262,7 @@ dependencies = [
"cpufeatures 0.2.17",
"curve25519-dalek-derive",
"digest 0.10.7",
- "fiat-crypto 0.2.9",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek"
-version = "5.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.1",
- "curve25519-dalek-derive",
- "digest 0.11.3",
- "fiat-crypto 0.3.0",
+ "fiat-crypto",
"rustc_version",
"subtle",
"zeroize",
@@ -1385,7 +1347,7 @@ dependencies = [
"proc-macro2",
"quote",
"strsim",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -1418,7 +1380,7 @@ checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
dependencies = [
"darling_core 0.24.1",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -1430,9 +1392,9 @@ dependencies = [
"cfg-if",
"crossbeam-utils",
"hashbrown 0.14.5",
- "lock_api 0.4.14",
+ "lock_api",
"once_cell",
- "parking_lot_core 0.9.12",
+ "parking_lot_core",
]
[[package]]
@@ -1449,9 +1411,9 @@ checksum = "be1e0bca6c3637f992fc1cc7cbc52a78c1ef6db076dbf1059c4323d6a2048376"
[[package]]
name = "defmt"
-version = "1.2.0"
+version = "1.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4a0795ac740cb54d7b3775c9c17345f6aaecf884c01733b39d6017738e0e3e1"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
dependencies = [
"bitflags 1.3.2",
"defmt-macros",
@@ -1459,21 +1421,21 @@ dependencies = [
[[package]]
name = "defmt-macros"
-version = "1.2.0"
+version = "1.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "840bb056bd99c495c9188198a258ab787c79f306d864db3e6e8451442d6d8366"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
dependencies = [
"defmt-parser",
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 2.0.119",
]
[[package]]
name = "defmt-parser"
-version = "1.1.0"
+version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71958f69fb2de856c5dd51ac9377e986ca1aa5919f931bf5395a807277f889a0"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
dependencies = [
"thiserror 2.0.21",
]
@@ -1485,18 +1447,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
dependencies = [
"const-oid 0.9.6",
- "pem-rfc7468 0.7.0",
- "zeroize",
-]
-
-[[package]]
-name = "der"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a996a108feb8b427a6e12fcf6af4aa83409b79d72c15337d7741368131ee004"
-dependencies = [
- "const-oid 0.10.2",
- "pem-rfc7468 1.0.0",
+ "pem-rfc7468",
"zeroize",
]
@@ -1516,9 +1467,9 @@ dependencies = [
[[package]]
name = "deranged"
-version = "0.5.9"
+version = "0.5.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
dependencies = [
"serde_core",
]
@@ -1579,9 +1530,9 @@ dependencies = [
[[package]]
name = "devise"
-version = "0.5.0"
+version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143afb21c617f66c792ef2d75f9fb4c9dd774ff206bcc24df08a1bda294a37bc"
+checksum = "f1d90b0c4c777a2cad215e3c7be59ac7c15adf45cf76317009b7d096d46f651d"
dependencies = [
"devise_codegen",
"devise_core",
@@ -1589,9 +1540,9 @@ dependencies = [
[[package]]
name = "devise_codegen"
-version = "0.5.0"
+version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b3187e4283046e01d16d724ed05326427aa9c1c3a376548ef31820e6eb9717"
+checksum = "71b28680d8be17a570a2334922518be6adc3f58ecc880cbb404eaeb8624fd867"
dependencies = [
"devise_core",
"quote",
@@ -1599,22 +1550,22 @@ dependencies = [
[[package]]
name = "devise_core"
-version = "0.5.0"
+version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "970e4b2fcd605ffa79715510663a9fe76b87f5483d59857399129cf047f73d27"
+checksum = "b035a542cf7abf01f2e3c4d5a7acbaebfefe120ae4efc7bde3df98186e4b8af7"
dependencies = [
"bitflags 2.13.2",
"proc-macro2",
- "proc-macro2-diagnostics 0.11.0",
+ "proc-macro2-diagnostics",
"quote",
- "syn 3.0.9",
+ "syn 2.0.119",
]
[[package]]
name = "diesel"
-version = "2.3.14"
+version = "2.3.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe9f7eaef33febd60290c5a9f3b0571d03c4c04a24739cd64808ce30e65a5d3"
+checksum = "e3b934ddbdcb2abb9f9fc9c30bd47bcc5618b615eea1d334cda5fdf8ff9b072a"
dependencies = [
"bigdecimal",
"bitflags 2.13.2",
@@ -1712,7 +1663,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -1771,27 +1722,12 @@ version = "0.16.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
dependencies = [
- "der 0.7.10",
+ "der",
"digest 0.10.7",
- "elliptic-curve 0.13.8",
- "rfc6979 0.4.0",
- "signature 2.2.0",
- "spki 0.7.3",
-]
-
-[[package]]
-name = "ecdsa"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
-dependencies = [
- "der 0.8.3",
- "digest 0.11.3",
- "elliptic-curve 0.14.3",
- "rfc6979 0.6.0",
- "signature 3.0.0",
- "spki 0.8.1",
- "zeroize",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
]
[[package]]
@@ -1800,18 +1736,8 @@ version = "2.2.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
dependencies = [
- "pkcs8 0.10.2",
- "signature 2.2.0",
-]
-
-[[package]]
-name = "ed25519"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
-dependencies = [
- "pkcs8 0.11.0",
- "signature 3.0.0",
+ "pkcs8",
+ "signature",
]
[[package]]
@@ -1820,34 +1746,19 @@ version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
dependencies = [
- "curve25519-dalek 4.1.3",
- "ed25519 2.2.3",
+ "curve25519-dalek",
+ "ed25519",
"serde",
"sha2 0.10.9",
"subtle",
"zeroize",
]
-[[package]]
-name = "ed25519-dalek"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
-dependencies = [
- "curve25519-dalek 5.0.0",
- "ed25519 3.0.0",
- "serde",
- "sha2 0.11.1",
- "signature 3.0.0",
- "subtle",
- "zeroize",
-]
-
[[package]]
name = "either"
-version = "1.19.0"
+version = "1.18.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
[[package]]
name = "elliptic-curve"
@@ -1855,38 +1766,17 @@ version = "0.13.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
dependencies = [
- "base16ct 0.2.0",
- "crypto-bigint 0.5.5",
+ "base16ct",
+ "crypto-bigint",
"digest 0.10.7",
- "ff 0.13.1",
+ "ff",
"generic-array",
- "group 0.13.0",
+ "group",
"hkdf",
- "pem-rfc7468 0.7.0",
- "pkcs8 0.10.2",
+ "pem-rfc7468",
+ "pkcs8",
"rand_core 0.6.4",
- "sec1 0.7.3",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "elliptic-curve"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "900f37e7e18d74a2347389af6cd69e3a30d5cc9e697f40004865679aa75e9c7c"
-dependencies = [
- "base16ct 1.0.0",
- "crypto-bigint 0.7.10",
- "crypto-common 0.2.2",
- "digest 0.11.3",
- "ff 0.14.0",
- "group 0.14.0",
- "hybrid-array",
- "pem-rfc7468 1.0.0",
- "pkcs8 0.11.0",
- "rand_core 0.10.1",
- "sec1 0.8.1",
+ "sec1",
"subtle",
"zeroize",
]
@@ -1912,9 +1802,9 @@ dependencies = [
[[package]]
name = "encoding_rs"
-version = "0.8.44"
+version = "0.8.42"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89253175e704ab869b04f9db224d38630e0211a53841a79181deae0889e169f5"
+checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
dependencies = [
"cfg-if",
"core_detect",
@@ -1926,9 +1816,9 @@ dependencies = [
[[package]]
name = "equivalent"
-version = "1.0.3"
+version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
[[package]]
name = "errno"
@@ -1994,36 +1884,20 @@ dependencies = [
"subtle",
]
-[[package]]
-name = "ff"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
-dependencies = [
- "rand_core 0.10.1",
- "subtle",
-]
-
[[package]]
name = "fiat-crypto"
version = "0.2.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-[[package]]
-name = "fiat-crypto"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
-
[[package]]
name = "figment"
version = "0.10.19"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8cb01cd46b0cf372153850f4c6c272d9cbea2da513e07538405148f95bd789f3"
dependencies = [
- "atomic",
- "pear 0.2.9",
+ "atomic 0.6.1",
+ "pear",
"serde",
"toml 0.8.23",
"uncased",
@@ -2032,9 +1906,9 @@ dependencies = [
[[package]]
name = "find-msvc-tools"
-version = "0.1.15"
+version = "0.1.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
[[package]]
name = "flate2"
@@ -2152,7 +2026,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -2248,11 +2122,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
dependencies = [
"cfg-if",
- "js-sys",
"libc",
"r-efi 6.0.0",
"rand_core 0.10.1",
- "wasm-bindgen",
]
[[package]]
@@ -2287,7 +2159,7 @@ dependencies = [
"getrandom 0.3.4",
"hashbrown 0.16.1",
"nonzero_ext",
- "parking_lot 0.12.5",
+ "parking_lot",
"portable-atomic",
"quanta",
"rand 0.9.5",
@@ -2315,27 +2187,16 @@ version = "0.13.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
dependencies = [
- "ff 0.13.1",
+ "ff",
"rand_core 0.6.4",
"subtle",
]
-[[package]]
-name = "group"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
-dependencies = [
- "ff 0.14.0",
- "rand_core 0.10.1",
- "subtle",
-]
-
[[package]]
name = "h2"
-version = "0.4.20"
+version = "0.4.19"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
dependencies = [
"atomic-waker",
"bytes",
@@ -2494,7 +2355,7 @@ dependencies = [
"moka",
"ndk-context",
"once_cell",
- "parking_lot 0.12.5",
+ "parking_lot",
"rand 0.10.3",
"resolv-conf",
"smallvec",
@@ -2544,9 +2405,12 @@ dependencies = [
[[package]]
name = "html5gum"
-version = "0.9.0"
+version = "0.8.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbae3133814a10216af5242a254420a74cb0d2f7715646924f5a8e7720cd188b"
+checksum = "428502d3ec1742c35e015871aef742bc4722a9acfcb616b8ff79b519922e1c36"
+dependencies = [
+ "jetscii",
+]
[[package]]
name = "http"
@@ -2569,6 +2433,17 @@ dependencies = [
"itoa",
]
+[[package]]
+name = "http-body"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+dependencies = [
+ "bytes",
+ "http 0.2.12",
+ "pin-project-lite",
+]
+
[[package]]
name = "http-body"
version = "1.1.0"
@@ -2588,7 +2463,7 @@ dependencies = [
"bytes",
"futures-core",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"pin-project-lite",
]
@@ -2610,16 +2485,37 @@ version = "0.4.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
dependencies = [
- "subtle",
"typenum",
- "zeroize",
]
[[package]]
name = "hyper"
-version = "1.12.0"
+version = "0.14.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
+checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2 0.5.10",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
dependencies = [
"atomic-waker",
"bytes",
@@ -2627,9 +2523,8 @@ dependencies = [
"futures-core",
"h2",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"httparse",
- "httpdate",
"itoa",
"pin-project-lite",
"smallvec",
@@ -2644,11 +2539,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
dependencies = [
"http 1.5.0",
- "hyper",
+ "hyper 1.11.1",
"hyper-util",
- "rustls",
+ "rustls 0.23.45",
"tokio",
- "tokio-rustls",
+ "tokio-rustls 0.26.6",
"tower-service",
]
@@ -2663,14 +2558,14 @@ dependencies = [
"futures-channel",
"futures-util",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"httparse",
- "hyper",
+ "hyper 1.11.1",
"ipnet",
"libc",
"percent-encoding",
"pin-project-lite",
- "socket2",
+ "socket2 0.6.5",
"system-configuration",
"tokio",
"tower-service",
@@ -2704,9 +2599,9 @@ dependencies = [
[[package]]
name = "icu_collections"
-version = "2.4.0"
+version = "2.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
dependencies = [
"displaydoc",
"potential_utf",
@@ -2718,9 +2613,9 @@ dependencies = [
[[package]]
name = "icu_locale_core"
-version = "2.4.0"
+version = "2.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
dependencies = [
"displaydoc",
"litemap",
@@ -2731,9 +2626,9 @@ dependencies = [
[[package]]
name = "icu_normalizer"
-version = "2.4.0"
+version = "2.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
dependencies = [
"icu_collections",
"icu_normalizer_data",
@@ -2745,15 +2640,15 @@ dependencies = [
[[package]]
name = "icu_normalizer_data"
-version = "2.4.0"
+version = "2.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
[[package]]
name = "icu_properties"
-version = "2.4.0"
+version = "2.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
dependencies = [
"displaydoc",
"icu_collections",
@@ -2766,15 +2661,15 @@ dependencies = [
[[package]]
name = "icu_properties_data"
-version = "2.4.0"
+version = "2.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
[[package]]
name = "icu_provider"
-version = "2.4.0"
+version = "2.3.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
dependencies = [
"displaydoc",
"icu_locale_core",
@@ -2847,7 +2742,7 @@ version = "0.3.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
dependencies = [
- "socket2",
+ "socket2 0.6.5",
"widestring",
"windows-registry",
"windows-result",
@@ -2876,9 +2771,9 @@ dependencies = [
[[package]]
name = "itertools"
-version = "0.14.0"
+version = "0.10.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
dependencies = [
"either",
]
@@ -2890,10 +2785,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
[[package]]
-name = "jiff"
-version = "0.2.38"
+name = "jetscii"
+version = "0.5.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2b005715dcbeb0089a3c0dab99f2ff1cc3b2525323552703d648585d342a383"
+checksum = "47f142fe24a9c9944451e8349de0a56af5f3e7226dc46f3ed4d4ecc0b85af75e"
+
+[[package]]
+name = "jiff"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
dependencies = [
"defmt",
"jiff-core",
@@ -2920,9 +2821,9 @@ dependencies = [
[[package]]
name = "jiff-static"
-version = "0.2.38"
+version = "0.2.37"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cc9817253cf7c7ee4684451bd327e88d6f3658014e54a29198625590650695c"
+checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
dependencies = [
"jiff-core",
"proc-macro2",
@@ -2932,9 +2833,9 @@ dependencies = [
[[package]]
name = "jiff-tzdb"
-version = "0.1.9"
+version = "0.1.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa8377070c6bae868759445e5a77f66d84f0b72f3a054bfb00e6d038b8282da7"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
[[package]]
name = "jiff-tzdb-platform"
@@ -3017,9 +2918,9 @@ dependencies = [
[[package]]
name = "js-sys"
-version = "0.3.107"
+version = "0.3.106"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dc09d2154098bbf4ef54eab6b117a3c24cbbffe94046b16ee6d6d4510584d3a"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
dependencies = [
"cfg-if",
"futures-util",
@@ -3033,19 +2934,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e75fe14a82d81e5f5af639997db37d8b96045938a7ac6ab18cdbe1c7467e05e1"
dependencies = [
"base64 0.22.1",
- "ed25519-dalek 2.2.0",
+ "ed25519-dalek",
"getrandom 0.2.17",
"hmac 0.12.1",
"js-sys",
- "p256 0.13.2",
- "p384 0.13.1",
+ "p256",
+ "p384",
"pem",
"rand 0.8.8",
"rsa",
"serde",
"serde_json",
"sha2 0.10.9",
- "signature 2.2.0",
+ "signature",
"simple_asn1",
"zeroize",
]
@@ -3098,21 +2999,21 @@ dependencies = [
"nom 8.0.0",
"percent-encoding",
"quoted_printable",
- "rustls",
+ "rustls 0.23.45",
"rustls-native-certs",
"serde",
- "socket2",
+ "socket2 0.6.5",
"tokio",
- "tokio-rustls",
+ "tokio-rustls 0.26.6",
"tracing",
"url",
]
[[package]]
name = "libc"
-version = "0.2.191"
+version = "0.2.190"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
[[package]]
name = "libm"
@@ -3154,9 +3055,9 @@ checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
[[package]]
name = "litrs"
-version = "1.0.1"
+version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4744e383959f0db86ede514b809b1c53251889093803c05267acc7d4e7030d70"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
[[package]]
name = "lock_api"
@@ -3167,20 +3068,11 @@ dependencies = [
"scopeguard",
]
-[[package]]
-name = "lock_api"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65d91b22da179613dcf4d6ec8349563f52a363f6849e03b00dd0a185ec4a59af"
-dependencies = [
- "scopeguard",
-]
-
[[package]]
name = "log"
-version = "0.4.35"
+version = "0.4.34"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d15f86d12da44cd8d4ec3c73984537eb7f4cadcb9776a575a0a8a05ca11005c"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
dependencies = [
"value-bag",
]
@@ -3205,7 +3097,7 @@ name = "macros"
version = "0.1.0"
dependencies = [
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -3245,14 +3137,13 @@ dependencies = [
[[package]]
name = "migrations_macros"
-version = "2.3.1"
+version = "2.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9423d6affd681fb4d25d35885d0d0262c52f8ade16e96f87c064c442e5aa5d47"
+checksum = "36fc5ac76be324cfd2d3f2cf0fdf5d5d3c4f14ed8aaebadb09e304ba42282703"
dependencies = [
"migrations_internals",
"proc-macro2",
"quote",
- "syn 3.0.9",
]
[[package]]
@@ -3310,7 +3201,7 @@ dependencies = [
"equivalent",
"event-listener 5.4.2",
"futures-util",
- "parking_lot 0.12.5",
+ "parking_lot",
"portable-atomic",
"smallvec",
"tagptr",
@@ -3445,7 +3336,7 @@ checksum = "e4e98dc3b890f6c23a0f9d3d491a2823d0dea0fa656302a13dd225fa924112a8"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -3469,9 +3360,9 @@ dependencies = [
[[package]]
name = "num-modular"
-version = "0.6.5"
+version = "0.6.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd8e500409e6cd603b03e477c26a6caecdc27ac58979a53e881c75eafc079f44"
+checksum = "26ac76200f74e658124f95fa63e1a82b2fd2181c5b2fdde80b3d89d2d3f905e7"
[[package]]
name = "num-order"
@@ -3504,9 +3395,9 @@ dependencies = [
[[package]]
name = "num_threads"
-version = "0.1.8"
+version = "0.1.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cabcc654086861f9e1bc5115258de62ef92c79b20f4615a1b0cc57c4e82027d4"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
dependencies = [
"libc",
]
@@ -3551,9 +3442,9 @@ dependencies = [
[[package]]
name = "opendal"
-version = "0.59.5"
+version = "0.59.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46081824c74bac9f68f0bc4408077f77b0e315c006514719c97af1c2227ac2d2"
+checksum = "3cbd193aec6d62efaff87611dfae52c132aed650bb3cb0c684c0a9394f09a42a"
dependencies = [
"opendal-core",
"opendal-service-fs",
@@ -3562,9 +3453,9 @@ dependencies = [
[[package]]
name = "opendal-core"
-version = "0.59.5"
+version = "0.59.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33d5a635dfea36a7a0c3bbb2ca34c97af17f98dd69b0cdf31a1d436a346e0a12"
+checksum = "54b5555d753dd6a6383dc0891254b72f3cdc40c011ba0372b560e0ae5aa29f5c"
dependencies = [
"anyhow",
"asyncband",
@@ -3576,7 +3467,7 @@ dependencies = [
"log",
"md-5",
"percent-encoding",
- "quick-xml",
+ "quick-xml 0.41.0",
"reqsign-core",
"serde",
"serde_json",
@@ -3588,23 +3479,23 @@ dependencies = [
[[package]]
name = "opendal-http-transport-reqwest"
-version = "0.59.5"
+version = "0.59.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc025e163c43993e30cf1829a30b791934e5b0f7cd4d7e03acc902a9efb7e8f5"
+checksum = "4d6588678f3040a3eab1819364dcbc6a746a8286d1ceb23a70a6614faa01dc6c"
dependencies = [
"bytes",
"futures",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"opendal-core",
"reqwest",
]
[[package]]
name = "opendal-service-fs"
-version = "0.59.5"
+version = "0.59.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70768b8f5af6996a494e784a1dc2a76b5cf890c422aff31ad094319bde98feb7"
+checksum = "ec5c16fe91b77c0364f66546a1c32b2999e9c3c3c75c2e908a282268e0890bac"
dependencies = [
"bytes",
"log",
@@ -3616,9 +3507,9 @@ dependencies = [
[[package]]
name = "opendal-service-s3"
-version = "0.59.5"
+version = "0.59.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0932321e27c712a30ef72db56b12f31e41e9f0d2d3841d63a91bc8075cd8f0ef"
+checksum = "1d83e716c25a81fe2ca701894b8e14b9966acca3812af250e50132accb19da02"
dependencies = [
"base64 0.23.1",
"bytes",
@@ -3627,7 +3518,7 @@ dependencies = [
"log",
"md-5",
"opendal-core",
- "quick-xml",
+ "quick-xml 0.41.0",
"reqsign-aws-v4",
"reqsign-core",
"reqsign-file-read-tokio",
@@ -3637,22 +3528,21 @@ dependencies = [
[[package]]
name = "openidconnect"
-version = "4.1.0"
+version = "4.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df0d098a59353679624d406825940139e2b2d554a52b64c9fb1b1bc42a11fe5c"
+checksum = "0d8c6709ba2ea764bbed26bce1adf3c10517113ddea6f2d4196e4851757ef2b2"
dependencies = [
- "base64 0.22.1",
+ "base64 0.21.7",
"chrono",
"dyn-clone",
- "ed25519-dalek 3.0.0",
- "getrandom 0.4.3",
+ "ed25519-dalek",
"hmac 0.12.1",
"http 1.5.0",
"itertools",
"log",
"oauth2",
- "p256 0.14.0",
- "p384 0.14.0",
+ "p256",
+ "p384",
"rand 0.8.8",
"rsa",
"serde",
@@ -3694,9 +3584,9 @@ dependencies = [
[[package]]
name = "openssl-probe"
-version = "0.2.2"
+version = "0.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e036b411754132fd6b74e94b74e9a13c5cf606fa93d1885c35860d3060820b1"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
[[package]]
name = "openssl-src"
@@ -3751,51 +3641,24 @@ version = "0.13.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
dependencies = [
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
- "primeorder 0.13.6",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
"sha2 0.10.9",
]
-[[package]]
-name = "p256"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
-dependencies = [
- "ecdsa 0.17.0",
- "elliptic-curve 0.14.3",
- "primefield",
- "primeorder 0.14.0",
- "sha2 0.11.1",
-]
-
[[package]]
name = "p384"
version = "0.13.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
dependencies = [
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
- "primeorder 0.13.6",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
"sha2 0.10.9",
]
-[[package]]
-name = "p384"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f"
-dependencies = [
- "ecdsa 0.17.0",
- "elliptic-curve 0.14.3",
- "fiat-crypto 0.3.0",
- "primefield",
- "primeorder 0.14.0",
- "sha2 0.11.1",
-]
-
[[package]]
name = "parking"
version = "2.2.1"
@@ -3808,18 +3671,8 @@ version = "0.12.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
dependencies = [
- "lock_api 0.4.14",
- "parking_lot_core 0.9.12",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9cf937ca4e1d0b7578784559063422fc39ae7c5a00f02471f2614d5486fd226"
-dependencies = [
- "lock_api 0.5.0",
- "parking_lot_core 0.10.0",
+ "lock_api",
+ "parking_lot_core",
]
[[package]]
@@ -3830,19 +3683,7 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
dependencies = [
"cfg-if",
"libc",
- "redox_syscall 0.5.18",
- "smallvec",
- "windows-link",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cfff060068cc18aa7815010fcaf80c68c7fb9e85fc7f5c0f9bf142c21d19826"
-dependencies = [
- "libc",
- "redox_syscall 0.9.5",
+ "redox_syscall",
"smallvec",
"windows-link",
]
@@ -3876,18 +3717,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bdeeaa00ce488657faba8ebf44ab9361f9365a97bd39ffb8a60663f57ff4b467"
dependencies = [
"inlinable_string",
- "pear_codegen 0.2.9",
- "yansi",
-]
-
-[[package]]
-name = "pear"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bdc582f5ece4663ba62cb9cc81b9f86aa23884ee92cddb1d5e75a94991119cb"
-dependencies = [
- "inlinable_string",
- "pear_codegen 0.3.0",
+ "pear_codegen",
"yansi",
]
@@ -3898,23 +3728,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4bab5b985dc082b345f812b7df84e1bef27e7207b39e448439ba8bd69c93f147"
dependencies = [
"proc-macro2",
- "proc-macro2-diagnostics 0.10.1",
+ "proc-macro2-diagnostics",
"quote",
"syn 2.0.119",
]
-[[package]]
-name = "pear_codegen"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b4262794e70dac544a759fd50088c6331e7a2ba4fc204b4b6e29c9b5257f9c4"
-dependencies = [
- "proc-macro2",
- "proc-macro2-diagnostics 0.11.0",
- "quote",
- "syn 3.0.9",
-]
-
[[package]]
name = "pem"
version = "3.0.6"
@@ -3934,15 +3752,6 @@ dependencies = [
"base64ct",
]
-[[package]]
-name = "pem-rfc7468"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
-dependencies = [
- "base64ct",
-]
-
[[package]]
name = "percent-encoding"
version = "2.3.2"
@@ -3951,20 +3760,19 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
[[package]]
name = "pest"
-version = "2.9.5"
+version = "2.9.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8db75153506001cb36ed924f08cadc862eb3f8c4d0d534139f29074769d7660"
+checksum = "45d3aca230fad2e6f6317ca0a72724338c4960cb97168a85cdee66df4a9a21a8"
dependencies = [
"memchr",
- "pest_stack_guard",
"ucd-trie",
]
[[package]]
name = "pest_derive"
-version = "2.9.5"
+version = "2.9.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20aa17e11fb35664b67d5214a0afac57a360d231b6ec53d6eba0700b27d933b4"
+checksum = "284b60557f2c4a2e72ad3f2d34d42685a2fa4a6a61d0d2a10c0ae2a5e916c2cf"
dependencies = [
"pest",
"pest_generator",
@@ -3972,36 +3780,26 @@ dependencies = [
[[package]]
name = "pest_generator"
-version = "2.9.5"
+version = "2.9.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626ec5afccf44ccbfeb2b232316510bb55b4bf34d891afcb0fb07d2b17d7fe9d"
+checksum = "1d9d1f08a115309ee99268cf85e5228e0e56aa9caf8841ec12866b6be07c3109"
dependencies = [
"pest",
"pest_meta",
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 2.0.119",
]
[[package]]
name = "pest_meta"
-version = "2.9.5"
+version = "2.9.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3f45b6caa65c1b08186832745159c2529994146340a7bf44168095469720f5d"
+checksum = "ed93ba1a9ffcca32130a5188701c81c0c49cf00d4b7c5007d5148951d743adcb"
dependencies = [
"pest",
]
-[[package]]
-name = "pest_stack_guard"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97e6cd2217057fa86b6eaa512917e58089d875b957a31e35e7ab729977e0a5f2"
-dependencies = [
- "psm",
- "stacker",
-]
-
[[package]]
name = "phc"
version = "0.6.1"
@@ -4108,9 +3906,9 @@ version = "0.7.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
dependencies = [
- "der 0.7.10",
- "pkcs8 0.10.2",
- "spki 0.7.3",
+ "der",
+ "pkcs8",
+ "spki",
]
[[package]]
@@ -4119,18 +3917,8 @@ version = "0.10.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
dependencies = [
- "der 0.7.10",
- "spki 0.7.3",
-]
-
-[[package]]
-name = "pkcs8"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
-dependencies = [
- "der 0.8.3",
- "spki 0.8.1",
+ "der",
+ "spki",
]
[[package]]
@@ -4194,9 +3982,9 @@ dependencies = [
[[package]]
name = "pq-sys"
-version = "0.7.8"
+version = "0.7.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "297a95d6f2378891f949d9556723e15140e50d29eac07458dabcee8688995b1d"
+checksum = "9152654059e4fb5b66a4052acf3ee43a7a7132332e44cdb72a81ee93bd038950"
dependencies = [
"libc",
"pkg-config",
@@ -4214,40 +4002,13 @@ dependencies = [
"num-traits",
]
-[[package]]
-name = "primefield"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
-dependencies = [
- "crypto-bigint 0.7.10",
- "crypto-common 0.2.2",
- "ff 0.14.0",
- "rand_core 0.10.1",
- "subtle",
- "zeroize",
-]
-
[[package]]
name = "primeorder"
version = "0.13.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
dependencies = [
- "elliptic-curve 0.13.8",
-]
-
-[[package]]
-name = "primeorder"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
-dependencies = [
- "elliptic-curve 0.14.3",
- "once_cell",
- "primefield",
- "serdect",
- "wnaf",
+ "elliptic-curve",
]
[[package]]
@@ -4256,7 +4017,7 @@ version = "3.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
dependencies = [
- "toml_edit 0.25.17+spec-1.1.0",
+ "toml_edit 0.25.15+spec-1.1.0",
]
[[package]]
@@ -4281,33 +4042,12 @@ dependencies = [
"yansi",
]
-[[package]]
-name = "proc-macro2-diagnostics"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df921e1ef974ebc8dd9effdb0c037a96928ae8cbf871438e02d6fd67204b595e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
- "version_check",
-]
-
[[package]]
name = "psl-types"
version = "2.0.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
-[[package]]
-name = "psm"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "200b9ff220857e53e184257720a14553b2f4aa02577d2ed9842d45d4b9654810"
-dependencies = [
- "cc",
-]
-
[[package]]
name = "publicsuffix"
version = "2.3.0"
@@ -4339,6 +4079,16 @@ version = "2.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
[[package]]
name = "quick-xml"
version = "0.42.0"
@@ -4383,7 +4133,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "51de85fb3fb6524929c8a2eb85e6b6d363de4e8c48f9e2c2eac4944abc181c93"
dependencies = [
"log",
- "parking_lot 0.12.5",
+ "parking_lot",
"scheduled-thread-pool",
]
@@ -4481,15 +4231,6 @@ dependencies = [
"bitflags 2.13.2",
]
-[[package]]
-name = "redox_syscall"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "580c875845b41ecb1564ad1ae4703044cef774145e3d7a94dc2b3fa7c97868fd"
-dependencies = [
- "bitflags 2.13.2",
-]
-
[[package]]
name = "ref-cast"
version = "1.0.27"
@@ -4507,15 +4248,9 @@ checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
-[[package]]
-name = "ref-swap"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09c30c54dffee5b40af088d5d50aa3455c91a0127164b51f0215efc4cb28fb3c"
-
[[package]]
name = "regex"
version = "1.13.1"
@@ -4574,7 +4309,7 @@ dependencies = [
"http 1.5.0",
"log",
"percent-encoding",
- "quick-xml",
+ "quick-xml 0.42.0",
"reqsign-core",
"rust-ini",
"serde",
@@ -4592,7 +4327,7 @@ dependencies = [
"bytes",
"http 1.5.0",
"log",
- "quick-xml",
+ "quick-xml 0.42.0",
"reqsign-aws-core",
"reqsign-core",
"serde",
@@ -4615,7 +4350,7 @@ dependencies = [
"log",
"percent-encoding",
"sha1 0.11.0",
- "sha2 0.11.1",
+ "sha2 0.11.0",
"windows-sys 0.61.2",
]
@@ -4645,9 +4380,9 @@ dependencies = [
"futures-util",
"h2",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"http-body-util",
- "hyper",
+ "hyper 1.11.1",
"hyper-rustls",
"hyper-util",
"js-sys",
@@ -4655,7 +4390,7 @@ dependencies = [
"mime",
"percent-encoding",
"pin-project-lite",
- "rustls",
+ "rustls 0.23.45",
"rustls-pki-types",
"rustls-platform-verifier",
"serde",
@@ -4663,7 +4398,7 @@ dependencies = [
"serde_urlencoded",
"sync_wrapper",
"tokio",
- "tokio-rustls",
+ "tokio-rustls 0.26.6",
"tokio-util",
"tower",
"tower-http",
@@ -4691,16 +4426,6 @@ dependencies = [
"subtle",
]
-[[package]]
-name = "rfc6979"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
-dependencies = [
- "crypto-bigint 0.7.10",
- "hmac 0.13.0",
-]
-
[[package]]
name = "ring"
version = "0.17.14"
@@ -4735,28 +4460,27 @@ dependencies = [
[[package]]
name = "rocket"
-version = "0.5.2"
+version = "0.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c17431360eb641a861453b57107ee1b425a799f49ec1b0fe9b8a45fe437447ce"
+checksum = "a516907296a31df7dc04310e7043b61d71954d703b603cc6867a026d7e72d73f"
dependencies = [
"async-stream",
"async-trait",
+ "atomic 0.5.3",
"binascii",
"bytes",
"either",
"figment",
"futures",
- "http-body-util",
- "hyper-util",
"indexmap 2.14.2",
"log",
"memchr",
"multer",
"num_cpus",
- "parking_lot 0.12.5",
+ "parking_lot",
"pin-project-lite",
+ "rand 0.8.8",
"ref-cast",
- "ref-swap",
"rocket_codegen",
"rocket_http",
"serde",
@@ -4774,50 +4498,48 @@ dependencies = [
[[package]]
name = "rocket_codegen"
-version = "0.5.2"
+version = "0.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "352bd0b773ca6f5bea6cd18efc2fd7f04fcd34c75c242dad6ef1bbd729cc619d"
+checksum = "575d32d7ec1a9770108c879fc7c47815a80073f96ca07ff9525a94fcede1dd46"
dependencies = [
"devise",
"glob",
"indexmap 2.14.2",
"proc-macro2",
- "proc-macro2-diagnostics 0.11.0",
"quote",
"rocket_http",
- "syn 3.0.9",
+ "syn 2.0.119",
"unicode-xid",
"version_check",
]
[[package]]
name = "rocket_http"
-version = "0.5.2"
+version = "0.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "847886ef963dff77126f110fd2b4401f5149440ab32973bef16c4a2cc83e525f"
+checksum = "e274915a20ee3065f611c044bd63c40757396b6dbc057d6046aec27f14f882b9"
dependencies = [
"cookie",
"either",
"futures",
"http 0.2.12",
- "hyper",
+ "hyper 0.14.32",
"indexmap 2.14.2",
"log",
"memchr",
- "pear 0.3.0",
+ "pear",
"percent-encoding",
"pin-project-lite",
"ref-cast",
- "rustls",
- "rustls-pki-types",
- "rustls-webpki",
+ "rustls 0.21.12",
+ "rustls-pemfile",
"serde",
"smallvec",
"stable-pattern",
"state",
"time",
"tokio",
- "tokio-rustls",
+ "tokio-rustls 0.24.1",
"uncased",
]
@@ -4854,20 +4576,21 @@ dependencies = [
"num-integer",
"num-traits",
"pkcs1",
- "pkcs8 0.10.2",
+ "pkcs8",
"rand_core 0.6.4",
- "signature 2.2.0",
- "spki 0.7.3",
+ "signature",
+ "spki",
"subtle",
"zeroize",
]
[[package]]
name = "rsqlite-vfs"
-version = "0.2.0"
+version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "353b74f9810d5b085b6c42c9d86a5f0fdb795553235cdd48753b32e3809d18a7"
+checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
dependencies = [
+ "hashbrown 0.16.1",
"thiserror 2.0.21",
]
@@ -4911,9 +4634,9 @@ dependencies = [
[[package]]
name = "rustix"
-version = "1.1.6"
+version = "1.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5e76742e5294153d4dde1207dbec5bdd81eef6fabdc0d2118babadabfd858aa"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
dependencies = [
"bitflags 2.13.2",
"errno",
@@ -4924,24 +4647,36 @@ dependencies = [
[[package]]
name = "rustls"
-version = "0.23.46"
+version = "0.21.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-webpki 0.101.7",
+ "sct",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
dependencies = [
"log",
"once_cell",
"ring",
"rustls-pki-types",
- "rustls-webpki",
+ "rustls-webpki 0.103.15",
"subtle",
"zeroize",
]
[[package]]
name = "rustls-native-certs"
-version = "0.8.5"
+version = "0.8.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
dependencies = [
"openssl-probe",
"rustls-pki-types",
@@ -4949,6 +4684,15 @@ dependencies = [
"security-framework",
]
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
+]
+
[[package]]
name = "rustls-pki-types"
version = "1.15.1"
@@ -4969,10 +4713,10 @@ dependencies = [
"jni",
"log",
"once_cell",
- "rustls",
+ "rustls 0.23.45",
"rustls-native-certs",
"rustls-platform-verifier-android",
- "rustls-webpki",
+ "rustls-webpki 0.103.15",
"security-framework",
"security-framework-sys",
"webpki-root-certs",
@@ -4987,9 +4731,19 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
[[package]]
name = "rustls-webpki"
-version = "0.103.16"
+version = "0.101.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
dependencies = [
"ring",
"rustls-pki-types",
@@ -5019,20 +4773,20 @@ dependencies = [
[[package]]
name = "schannel"
-version = "0.1.30"
+version = "0.1.29"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cb23c424d8ee841bb4d813677ca237e2a610067d594fec130f87d6093495ab5"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
dependencies = [
"windows-sys 0.61.2",
]
[[package]]
name = "scheduled-thread-pool"
-version = "0.2.8"
+version = "0.2.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f304b290c05b371b2aa1e8718242ff0394530f9334ecedcb9ae51330f37fc1ba"
+checksum = "3cbc66816425a074528352f5789333ecff06ca41b36b0b0efdfbb29edc391a19"
dependencies = [
- "parking_lot 0.13.0",
+ "parking_lot",
]
[[package]]
@@ -5049,9 +4803,9 @@ dependencies = [
[[package]]
name = "schemars"
-version = "1.2.3"
+version = "1.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab508826f74a77ca9d5aba6ff19b522583ee3eaf28a19384ff3d0e5835fadf6e"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
dependencies = [
"dyn-clone",
"ref-cast",
@@ -5071,30 +4825,26 @@ version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
[[package]]
name = "sec1"
version = "0.7.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
dependencies = [
- "base16ct 0.2.0",
- "der 0.7.10",
+ "base16ct",
+ "der",
"generic-array",
- "pkcs8 0.10.2",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "sec1"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
-dependencies = [
- "base16ct 1.0.0",
- "ctutils",
- "der 0.8.3",
- "hybrid-array",
+ "pkcs8",
"subtle",
"zeroize",
]
@@ -5175,14 +4925,14 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
name = "serde_json"
-version = "1.0.154"
+version = "1.0.151"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
dependencies = [
"itoa",
"memchr",
@@ -5222,9 +4972,9 @@ dependencies = [
[[package]]
name = "serde_spanned"
-version = "1.1.2"
+version = "1.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
dependencies = [
"serde_core",
]
@@ -5255,7 +5005,7 @@ dependencies = [
"indexmap 2.14.2",
"jiff",
"schemars 0.9.0",
- "schemars 1.2.3",
+ "schemars 1.2.2",
"serde_core",
"serde_json",
"serde_with_macros",
@@ -5271,17 +5021,7 @@ dependencies = [
"darling 0.24.1",
"proc-macro2",
"quote",
- "syn 3.0.9",
-]
-
-[[package]]
-name = "serdect"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
-dependencies = [
- "base16ct 1.0.0",
- "serde",
+ "syn 3.0.6",
]
[[package]]
@@ -5319,9 +5059,9 @@ dependencies = [
[[package]]
name = "sha2"
-version = "0.11.1"
+version = "0.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
dependencies = [
"cfg-if",
"cpufeatures 0.3.1",
@@ -5373,16 +5113,6 @@ dependencies = [
"rand_core 0.6.4",
]
-[[package]]
-name = "signature"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
-dependencies = [
- "digest 0.11.3",
- "rand_core 0.10.1",
-]
-
[[package]]
name = "simd-adler32"
version = "0.3.10"
@@ -5431,9 +5161,19 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
[[package]]
name = "smallvec"
-version = "1.16.4"
+version = "1.16.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8"
+checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
+
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
[[package]]
name = "socket2"
@@ -5459,11 +5199,11 @@ checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
[[package]]
name = "spinning_top"
-version = "0.3.1"
+version = "0.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf02766a1eb909bc7653557c66b384e44edc3ad979e6257c6173c65ea51bc7d"
+checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
dependencies = [
- "lock_api 0.4.14",
+ "lock_api",
]
[[package]]
@@ -5473,27 +5213,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
dependencies = [
"base64ct",
- "der 0.7.10",
-]
-
-[[package]]
-name = "spki"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
-dependencies = [
- "base64ct",
- "der 0.8.3",
+ "der",
]
[[package]]
name = "sqlite-wasm-rs"
-version = "0.6.2"
+version = "0.5.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36bd8e29bf08189a005b2df1df99823aa0861cabe9044e5f31ed54ca292ee618"
+checksum = "dc3efc0da82635d7e1ced0053bbbfa8c7ab9645d0bf36ceb4f7127bb85315d75"
dependencies = [
"cc",
+ "js-sys",
"rsqlite-vfs",
+ "wasm-bindgen",
]
[[package]]
@@ -5511,19 +5243,6 @@ version = "1.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-[[package]]
-name = "stacker"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
-dependencies = [
- "cc",
- "cfg-if",
- "libc",
- "psm",
- "windows-sys 0.61.2",
-]
-
[[package]]
name = "state"
version = "0.6.0"
@@ -5571,9 +5290,9 @@ dependencies = [
[[package]]
name = "syn"
-version = "3.0.9"
+version = "3.0.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
dependencies = [
"proc-macro2",
"quote",
@@ -5608,7 +5327,7 @@ checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -5700,7 +5419,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -5755,9 +5474,9 @@ dependencies = [
[[package]]
name = "tinystr"
-version = "0.8.5"
+version = "0.8.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
dependencies = [
"displaydoc",
"zerovec",
@@ -5771,17 +5490,17 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
[[package]]
name = "tokio"
-version = "1.54.1"
+version = "1.53.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
dependencies = [
"bytes",
"libc",
"mio",
- "parking_lot 0.12.5",
+ "parking_lot",
"pin-project-lite",
"signal-hook-registry",
- "socket2",
+ "socket2 0.6.5",
"tokio-macros",
"windows-sys 0.61.2",
]
@@ -5794,7 +5513,17 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls 0.21.12",
+ "tokio",
]
[[package]]
@@ -5803,7 +5532,7 @@ version = "0.26.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
dependencies = [
- "rustls",
+ "rustls 0.23.45",
"tokio",
]
@@ -5832,9 +5561,9 @@ dependencies = [
[[package]]
name = "tokio-util"
-version = "0.7.20"
+version = "0.7.19"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
dependencies = [
"bytes",
"futures-core",
@@ -5864,7 +5593,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
dependencies = [
"serde_core",
- "serde_spanned 1.1.2",
+ "serde_spanned 1.1.1",
"toml_datetime 0.7.5+spec-1.1.0",
"toml_parser",
"winnow 0.7.15",
@@ -5890,9 +5619,9 @@ dependencies = [
[[package]]
name = "toml_datetime"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
dependencies = [
"serde_core",
]
@@ -5913,21 +5642,21 @@ dependencies = [
[[package]]
name = "toml_edit"
-version = "0.25.17+spec-1.1.0"
+version = "0.25.15+spec-1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c"
+checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
dependencies = [
"indexmap 2.14.2",
- "toml_datetime 1.1.2+spec-1.1.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
"toml_parser",
"winnow 1.0.4",
]
[[package]]
name = "toml_parser"
-version = "1.1.5+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
dependencies = [
"winnow 1.0.4",
]
@@ -5977,7 +5706,7 @@ dependencies = [
"futures-core",
"futures-util",
"http 1.5.0",
- "http-body",
+ "http-body 1.1.0",
"http-body-util",
"pin-project-lite",
"tokio",
@@ -6120,9 +5849,9 @@ dependencies = [
[[package]]
name = "unicode-ident"
-version = "1.0.27"
+version = "1.0.26"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
[[package]]
name = "unicode-segmentation"
@@ -6169,24 +5898,15 @@ checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
[[package]]
name = "utf8_iter"
-version = "1.1.0"
+version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
-dependencies = [
- "utf_types",
-]
-
-[[package]]
-name = "utf_types"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
[[package]]
name = "uuid"
-version = "1.29.0"
+version = "1.27.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0e2d11620c50695fe12bbbfde96b3477fe606e7284c22d505c12ce51214514"
+checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
dependencies = [
"getrandom 0.4.3",
"js-sys",
@@ -6267,7 +5987,7 @@ dependencies = [
"rocket",
"rocket_ws",
"rpassword",
- "rustls",
+ "rustls 0.23.45",
"semver",
"serde",
"serde_json",
@@ -6318,9 +6038,9 @@ dependencies = [
[[package]]
name = "want"
-version = "0.3.2"
+version = "0.3.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
dependencies = [
"try-lock",
]
@@ -6342,11 +6062,12 @@ dependencies = [
[[package]]
name = "wasm-bindgen"
-version = "0.2.130"
+version = "0.2.129"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0181c14ddd6c7b8b0b0132a5f1ea2f32be0d893cd3ea97b6e3b28886b8a3d1c"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
dependencies = [
"cfg-if",
+ "once_cell",
"rustversion",
"wasm-bindgen-macro",
"wasm-bindgen-shared",
@@ -6354,9 +6075,9 @@ dependencies = [
[[package]]
name = "wasm-bindgen-futures"
-version = "0.4.80"
+version = "0.4.79"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e14e0327cb5368ad60ccb22d04a9827a693c95a926d8d125e9fa39e0baec501"
+checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
dependencies = [
"js-sys",
"tokio",
@@ -6365,9 +6086,9 @@ dependencies = [
[[package]]
name = "wasm-bindgen-macro"
-version = "0.2.130"
+version = "0.2.129"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e931a02a39abdbf66966fc35902b5ed58344750a70885bed4ebb3d8eaf28ed9"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
dependencies = [
"quote",
"wasm-bindgen-macro-support",
@@ -6375,22 +6096,22 @@ dependencies = [
[[package]]
name = "wasm-bindgen-macro-support"
-version = "0.2.130"
+version = "0.2.129"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ca4b54280e455bd831e33a6b8e734baf432fe63fbc35c42ac14ce67a043a53a"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
dependencies = [
"bumpalo",
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
"wasm-bindgen-shared",
]
[[package]]
name = "wasm-bindgen-shared"
-version = "0.2.130"
+version = "0.2.129"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b1f9c3798725016c6ee5f2f57869ec0831e8bbc0ab0310a86e787e97f41389e"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
dependencies = [
"unicode-ident",
]
@@ -6410,9 +6131,9 @@ dependencies = [
[[package]]
name = "web-sys"
-version = "0.3.107"
+version = "0.3.106"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7d179596ff5ec0f6de4db64d54011bde6289cc49603d3a6e4ce3f329207ab88"
+checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
dependencies = [
"js-sys",
"wasm-bindgen",
@@ -6498,9 +6219,9 @@ dependencies = [
[[package]]
name = "webpki-root-certs"
-version = "1.0.11"
+version = "1.0.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
dependencies = [
"rustls-pki-types",
]
@@ -6793,18 +6514,6 @@ version = "0.57.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
-[[package]]
-name = "wnaf"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa"
-dependencies = [
- "ff 0.14.0",
- "group 0.14.0",
- "hybrid-array",
- "primefield",
-]
-
[[package]]
name = "writeable"
version = "0.6.4"
@@ -6830,9 +6539,9 @@ dependencies = [
[[package]]
name = "xattr"
-version = "1.7.0"
+version = "1.6.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "963d6fab92d5504b971dc8bd90ca743c2575e590bc8071ea5bc571598667ae08"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
dependencies = [
"libc",
"rustix",
@@ -6861,9 +6570,9 @@ dependencies = [
[[package]]
name = "yoke"
-version = "0.8.4"
+version = "0.8.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
dependencies = [
"stable_deref_trait",
"yoke-derive",
@@ -6878,7 +6587,7 @@ checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
"synstructure 0.14.0",
]
@@ -6897,18 +6606,18 @@ dependencies = [
[[package]]
name = "zerocopy"
-version = "0.8.63"
+version = "0.8.59"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8"
+checksum = "6df92bf3d9227be3d53173901ddbffac2babc27ae50f397776ffd6dc33f800cb"
dependencies = [
"zerocopy-derive",
]
[[package]]
name = "zerocopy-derive"
-version = "0.8.63"
+version = "0.8.59"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f"
+checksum = "ac4f328cf2f05d084e496c3e9c3f33ed0a183656a16e1fcec4d464d8373aec82"
dependencies = [
"proc-macro2",
"quote",
@@ -6932,15 +6641,15 @@ checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
"synstructure 0.14.0",
]
[[package]]
name = "zeroize"
-version = "1.9.1"
+version = "1.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
dependencies = [
"zeroize_derive",
]
@@ -6969,9 +6678,9 @@ dependencies = [
[[package]]
name = "zerovec"
-version = "0.11.9"
+version = "0.11.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
dependencies = [
"yoke",
"zerofrom",
@@ -6980,13 +6689,13 @@ dependencies = [
[[package]]
name = "zerovec-derive"
-version = "0.11.7"
+version = "0.11.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
dependencies = [
"proc-macro2",
"quote",
- "syn 3.0.9",
+ "syn 3.0.6",
]
[[package]]
@@ -7003,27 +6712,27 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
[[package]]
name = "zstd"
-version = "0.14.3"
+version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
+checksum = "bf06bd8162af0734b344780deb55b42a2429ae430870d13fcc12f238e880fe6e"
dependencies = [
"zstd-safe",
]
[[package]]
name = "zstd-safe"
-version = "8.2.0"
+version = "8.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
+checksum = "ae42c0555055784c70058d19ba8e275528e8a99a706684868ace5da4e716a4ab"
dependencies = [
"zstd-sys",
]
[[package]]
name = "zstd-sys"
-version = "2.1.2+zstd.1.5.7"
+version = "2.1.0+zstd.1.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
+checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
dependencies = [
"cc",
"pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index 6b4e8965..764fbd53 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -66,7 +66,7 @@ syslog = "7.0.0"
macros = { path = "./macros" }
# Logging
-log = "0.4.35"
+log = "0.4.34"
fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
# We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
tracing = { version = "0.1.44", features = ["log"] }
@@ -80,7 +80,7 @@ num-derive = "0.5.1"
bigdecimal = "0.4.11"
# Web framework
-rocket = { version = "0.5.2", default-features = false, features = ["json", "tls"] }
+rocket = { version = "0.5.1", default-features = false, features = ["json", "tls"] }
rocket_ws = { version = "0.1.1" }
# WebSockets libraries
@@ -91,7 +91,7 @@ dashmap = "6.2.1"
# Async futures
futures = "0.3.34"
-tokio = { version = "1.54.1", features = [
+tokio = { version = "1.53.2", features = [
"fs",
"io-util",
"net",
@@ -100,14 +100,14 @@ tokio = { version = "1.54.1", features = [
"signal",
"time",
] }
-tokio-util = { version = "0.7.20", features = ["compat"] }
+tokio-util = { version = "0.7.19", features = ["compat"] }
# A generic serialization/deserialization framework
serde = { version = "1.0.229", features = ["derive"] }
-serde_json = "1.0.154"
+serde_json = "1.0.151"
# A safe, extensible ORM and Query builder
-diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric"] }
diesel_migrations = "2.3.2"
derive_more = { version = "2.1.1", features = [
@@ -125,11 +125,11 @@ libsqlite3-sys = { version = "0.38.2", optional = true }
# Crypto-related libraries
rand = "0.10.3"
ring = "0.17.14"
-rustls = { version = "0.23.46", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.45", features = ["ring", "std"], default-features = false }
subtle = "2.6.1"
# UUID generation
-uuid = { version = "1.29.0", features = ["v4"] }
+uuid = { version = "1.27.0", features = ["v4"] }
# Date and time libraries
chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
@@ -204,7 +204,7 @@ reqwest = { version = "0.13.5", default-features = false, features = [
hickory-resolver = "0.26.3"
# Favicon extraction libraries
-html5gum = "0.9.0"
+html5gum = "0.8.4"
regex = { version = "1.13.1", default-features = false, features = [
"perf",
"std",
@@ -215,7 +215,7 @@ bytes = "1.12.1"
svg-hush = "0.9.7"
# Cache function results (Used for version check and favicon fetching)
-cached = { version = "4.1.0", features = ["async"] }
+cached = { version = "4.0.1", features = ["async"] }
# Used for custom short lived cookie jar during favicon extraction
cookie = "0.18.2"
@@ -235,7 +235,7 @@ governor = "0.10.4"
ipnet = "2.12.2"
# OIDC for SSO
-openidconnect = { version = "4.1.0", default-features = false }
+openidconnect = { version = "4.0.1", default-features = false }
moka = { version = "0.12.16", features = ["future"] }
# Check client versions for specific features.
@@ -257,18 +257,18 @@ rpassword = "7.5.4"
grass_compiler = { version = "0.13.4", default-features = false }
# File are accessed through Apache OpenDAL
-opendal = { version = "0.59.5", default-features = false, features = ["services-fs"] }
-opendal-http-transport-reqwest = { version = "0.59.5", default-features = false, features = ["rustls-no-provider"], optional = true }
+opendal = { version = "0.59.4", default-features = false, features = ["services-fs"] }
+opendal-http-transport-reqwest = { version = "0.59.4", default-features = false, features = ["rustls-no-provider"], optional = true }
# For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.13.0", optional = true, default-features = false, features = [
+aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
"behavior-version-latest",
"credentials-process",
"rt-tokio",
"sso",
] }
-aws-credential-types = { version = "1.3.1", optional = true }
-aws-smithy-runtime-api = { version = "1.19.2", optional = true }
+aws-credential-types = { version = "1.3.0", optional = true }
+aws-smithy-runtime-api = { version = "1.19.0", optional = true }
http = { version = "1.5.0", optional = true }
reqsign-aws-v4 = { version = "3.3.1", optional = true }
reqsign-core = { version = "3.3.2", optional = true }
diff --git a/docker/DockerSettings.yaml b/docker/DockerSettings.yaml
index 4ef24c9d..6ae6e9a8 100644
--- a/docker/DockerSettings.yaml
+++ b/docker/DockerSettings.yaml
@@ -1,10 +1,10 @@
---
-vault_version: "v2026.10.1"
-vault_image_digest: "sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52"
-# Cross Compile Docker Helper Scripts v1.10.0
+vault_version: "v2026.7.0"
+vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c"
+# Cross Compile Docker Helper Scripts v1.9.0
# We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
# https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
-xx_image_digest: "sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6"
+xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
# The `rust_version` variable is extracted from `rust-toolchain.toml`
# rust_version: x.yy.z # Rust version to be used
debian_version: trixie # Debian release name to be used
diff --git a/docker/Dockerfile.alpine b/docker/Dockerfile.alpine
index 95e8784d..6e6a79a3 100644
--- a/docker/Dockerfile.alpine
+++ b/docker/Dockerfile.alpine
@@ -19,23 +19,23 @@
# - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
# click the tag name to view the digest of the image it currently points to.
# - From the command line:
-# $ docker pull docker.io/vaultwarden/web-vault:v2026.10.1
-# $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.10.1
-# [docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52]
+# $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+# $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+# [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
#
# - Conversely, to get the tag name from the digest:
-# $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52
-# [docker.io/vaultwarden/web-vault:v2026.10.1]
+# $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+# [docker.io/vaultwarden/web-vault:v2026.7.0]
#
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
########################## ALPINE BUILD IMAGES ##########################
## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.99.1 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.99.1 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.99.1 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.99.1 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.99.0 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.99.0 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.99.0 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.99.0 AS build_armv6
########################## BUILD IMAGE ##########################
# hadolint ignore=DL3006
diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian
index 621cfafe..44d068ef 100644
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@@ -19,24 +19,24 @@
# - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
# click the tag name to view the digest of the image it currently points to.
# - From the command line:
-# $ docker pull docker.io/vaultwarden/web-vault:v2026.10.1
-# $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.10.1
-# [docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52]
+# $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+# $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+# [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
#
# - Conversely, to get the tag name from the digest:
-# $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52
-# [docker.io/vaultwarden/web-vault:v2026.10.1]
+# $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+# [docker.io/vaultwarden/web-vault:v2026.7.0]
#
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
########################## Cross Compile Docker Helper Scripts ##########################
## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
## And these bash scripts do not have any significant difference if at all
-FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6 AS xx
+FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
########################## BUILD IMAGE ##########################
# hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.99.1-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.99.0-slim-trixie AS build
# hadolint ignore=DL3067
COPY --from=xx / /
ARG TARGETARCH
diff --git a/docker/README.md b/docker/README.md
index 3bbc31e1..d64d5789 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -15,7 +15,6 @@ Some unsupported platforms for Debian based images. These are not built and test
- 386 (linux/386)
- ppc64le (linux/ppc64le)
- s390x (linux/s390x)
-- riscv64 (linux/riscv64)
To build these containers you need to enable QEMU binfmt support to be able to run/emulate architectures which are different then your host.
This ensures the container build process can run binaries from other architectures.
diff --git a/docker/docker-bake.hcl b/docker/docker-bake.hcl
index 30902bba..c27c39a6 100644
--- a/docker/docker-bake.hcl
+++ b/docker/docker-bake.hcl
@@ -148,12 +148,6 @@ target "debian-s390x" {
platforms = ["linux/s390x"]
tags = generate_tags("", "-s390x")
}
-
-target "debian-riscv64" {
- inherits = ["debian"]
- platforms = ["linux/riscv64"]
- tags = generate_tags("", "-riscv64")
-}
// ==== End of unsupported Debian architecture targets ===
// A Group to build all platforms individually for local testing
diff --git a/macros/Cargo.toml b/macros/Cargo.toml
index ee9fd206..b397fbe1 100644
--- a/macros/Cargo.toml
+++ b/macros/Cargo.toml
@@ -14,7 +14,7 @@ proc-macro = true
[dependencies]
quote = "1.0.47"
-syn = "3.0.9"
+syn = "3.0.6"
[lints]
workspace = true
diff --git a/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/down.sql b/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/down.sql
deleted file mode 100644
index 27c33623..00000000
--- a/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/down.sql
+++ /dev/null
@@ -1 +0,0 @@
-ALTER TABLE org_policies DROP COLUMN revision_date;
diff --git a/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/up.sql b/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/up.sql
deleted file mode 100644
index 97a84117..00000000
--- a/migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/up.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- DATETIME (not TIMESTAMP) to match this repo's convention for revision_date
--- columns elsewhere, and to avoid MySQL's implicit session-timezone
--- conversion and 2038 range limit on TIMESTAMP.
-ALTER TABLE org_policies
-ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = UTC_TIMESTAMP();
diff --git a/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/down.sql b/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/down.sql
deleted file mode 100644
index 85ebcbfb..00000000
--- a/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/down.sql
+++ /dev/null
@@ -1,22 +0,0 @@
--- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
--- versions before this one don't know. So while there are any, this fails on the duplicate key below, before anything
--- is dropped: change their role first, or restore the backup taken before the upgrade.
--- A failed attempt leaves the temporary table on this connection. Clear it before retrying.
-DROP TEMPORARY TABLE IF EXISTS custom_role_downgrade;
-CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
-INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
-INSERT INTO custom_role_downgrade
- SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
- FROM users_organizations WHERE atype = 4 LIMIT 1;
-DROP TEMPORARY TABLE custom_role_downgrade;
-
-ALTER TABLE users_organizations
- DROP COLUMN manage_users,
- DROP COLUMN manage_groups,
- DROP COLUMN manage_policies,
- DROP COLUMN create_new_collections,
- DROP COLUMN edit_any_collection,
- DROP COLUMN delete_any_collection,
- DROP COLUMN access_event_logs,
- DROP COLUMN access_import_export,
- DROP COLUMN access_reports;
diff --git a/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/up.sql b/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/up.sql
deleted file mode 100644
index d28b0d64..00000000
--- a/migrations/mysql/2026-10-10-120000_add_custom_role_permissions/up.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- The granular permissions of the Custom member role. They only take effect on a Custom membership
--- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
--- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
-ALTER TABLE users_organizations
- ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;
diff --git a/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/down.sql b/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/down.sql
deleted file mode 100644
index 27c33623..00000000
--- a/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/down.sql
+++ /dev/null
@@ -1 +0,0 @@
-ALTER TABLE org_policies DROP COLUMN revision_date;
diff --git a/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/up.sql b/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/up.sql
deleted file mode 100644
index 44229de2..00000000
--- a/migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/up.sql
+++ /dev/null
@@ -1,9 +0,0 @@
--- Backfill via `now() AT TIME ZONE 'utc'` rather than a DEFAULT of now():
--- assigning timestamptz now() into a naive TIMESTAMP column casts through
--- the server's TimeZone GUC, so a DEFAULT now() would store local wall-clock
--- instead of UTC on non-UTC servers, unlike every other naive-UTC timestamp
--- column in this schema.
-ALTER TABLE org_policies
-ADD COLUMN revision_date TIMESTAMP NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = (now() AT TIME ZONE 'utc');
diff --git a/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/down.sql b/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/down.sql
deleted file mode 100644
index 0cc5dd03..00000000
--- a/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/down.sql
+++ /dev/null
@@ -1,20 +0,0 @@
--- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
--- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
--- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
-CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
-INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
-INSERT INTO custom_role_downgrade
- SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
- FROM users_organizations WHERE atype = 4 LIMIT 1;
-DROP TABLE custom_role_downgrade;
-
-ALTER TABLE users_organizations
- DROP COLUMN manage_users,
- DROP COLUMN manage_groups,
- DROP COLUMN manage_policies,
- DROP COLUMN create_new_collections,
- DROP COLUMN edit_any_collection,
- DROP COLUMN delete_any_collection,
- DROP COLUMN access_event_logs,
- DROP COLUMN access_import_export,
- DROP COLUMN access_reports;
diff --git a/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/up.sql b/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/up.sql
deleted file mode 100644
index d28b0d64..00000000
--- a/migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/up.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- The granular permissions of the Custom member role. They only take effect on a Custom membership
--- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
--- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
-ALTER TABLE users_organizations
- ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
- ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;
diff --git a/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/down.sql b/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/down.sql
deleted file mode 100644
index e69de29b..00000000
diff --git a/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/up.sql b/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/up.sql
deleted file mode 100644
index 86595711..00000000
--- a/migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/up.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- SQLite forbids non-constant defaults in ALTER TABLE ... ADD COLUMN, so add
--- the column with a constant placeholder and backfill separately.
-ALTER TABLE org_policies
-ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = CURRENT_TIMESTAMP;
diff --git a/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/down.sql b/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/down.sql
deleted file mode 100644
index 11c30bec..00000000
--- a/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/down.sql
+++ /dev/null
@@ -1,19 +0,0 @@
--- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
--- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
--- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
-CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
-INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
-INSERT INTO custom_role_downgrade
- SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
- FROM users_organizations WHERE atype = 4 LIMIT 1;
-DROP TABLE custom_role_downgrade;
-
-ALTER TABLE users_organizations DROP COLUMN manage_users;
-ALTER TABLE users_organizations DROP COLUMN manage_groups;
-ALTER TABLE users_organizations DROP COLUMN manage_policies;
-ALTER TABLE users_organizations DROP COLUMN create_new_collections;
-ALTER TABLE users_organizations DROP COLUMN edit_any_collection;
-ALTER TABLE users_organizations DROP COLUMN delete_any_collection;
-ALTER TABLE users_organizations DROP COLUMN access_event_logs;
-ALTER TABLE users_organizations DROP COLUMN access_import_export;
-ALTER TABLE users_organizations DROP COLUMN access_reports;
diff --git a/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/up.sql b/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/up.sql
deleted file mode 100644
index c708c693..00000000
--- a/migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/up.sql
+++ /dev/null
@@ -1,11 +0,0 @@
--- The granular permissions of the Custom member role. They only take effect on a Custom membership
--- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
-ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT 0; -- FALSE
diff --git a/playwright/README.md b/playwright/README.md
index cd18bebd..000725d7 100644
--- a/playwright/README.md
+++ b/playwright/README.md
@@ -2,7 +2,7 @@
This allows running integration tests using [Playwright](https://playwright.dev/).
\
-It uses its own [test.env](./test.env) with different ports to not collide with a running dev instance.
+It usse its own [test.env](/test/scenarios/test.env) with different ports to not collide with a running dev instance.
## Install
@@ -62,7 +62,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
### Keep services running
-If you want you can keep the DB and Keycloak running (states are not impacted by the tests):
+If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
```bash
PW_KEEP_SERVICE_RUNNING=true npx playwright test
diff --git a/playwright/tests/emergency.spec.ts b/playwright/tests/emergency.spec.ts
deleted file mode 100644
index 4c836986..00000000
--- a/playwright/tests/emergency.spec.ts
+++ /dev/null
@@ -1,131 +0,0 @@
-import { test, expect, type Page, type TestInfo, Test } from '@playwright/test';
-import { MailDev } from 'maildev';
-
-import * as utils from "../global-utils";
-import { createAccount, logUser } from './setups/user';
-import { activateTOTP } from './setups/2fa';
-
-let users = utils.loadEnv();
-let mailserver;
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
- mailserver = new MailDev({
- port: process.env.MAILDEV_SMTP_PORT,
- web: { port: process.env.MAILDEV_HTTP_PORT },
- })
-
- await mailserver.listen();
-
- await utils.startVault(browser, testInfo, {
- SMTP_HOST: process.env.MAILDEV_HOST,
- SMTP_FROM: process.env.PW_SMTP_FROM,
- });
-});
-
-test.afterAll('Teardown', async ({}) => {
- utils.stopVault();
- if( mailserver ){
- await mailserver.close();
- }
-});
-
-async function emergencyAccess(test: Test, page: Page, user: { name: string }) {
- await test.step('Navigate', async () => {
- await page.getByRole('button', { name: user.name }).click();
- await page.getByRole('menuitem', { name: 'Account settings' }).click();
- await page.getByRole('link', { name: 'Emergency access' }).click();
- await expect(page.locator('#main-content').getByText('Emergency access', { exact: true })).toBeVisible();
- });
-}
-
-test('Emergency access', async ({ browser, page }) => {
- const context2 = await browser.newContext();
- const page2 = await context2.newPage();
-
- const mailBuffer = mailserver.buffer(users.user1.email);
- const mailBuffer2 = mailserver.buffer(users.user2.email);
-
- await createAccount(test, page, users.user1);
- await createAccount(test, page2, users.user2);
-
- await test.step('Add test2', async () => {
- await emergencyAccess(test, page, users.user1);
- await page.getByRole('button', { name: 'Add emergency contact' }).click();
- await page.getByRole('textbox', { name: 'Email * (required)' }).fill(users.user2.email);
- await page.getByRole('radio', { name: 'Takeover Can reset your' }).check();
- await page.getByRole('button', { name: 'Save' }).click();
- await utils.checkNotification(page, 'User(s) invited');
- });
-
- await test.step('Accept', async () => {
- const email = await mailBuffer2.expect((m) => m.subject === "Emergency access for " + users.user1.name);
- const pageE = await context2.newPage();
- await pageE.setContent(email.html);
- const link = await pageE.getByTestId("emergency").getAttribute("href");
- await pageE.close();
-
- await page2.goto(link);
- await utils.checkNotification(page2, 'Invitation accepted');
- });
-
- await test.step('Confirm', async () => {
- await emergencyAccess(test, page, users.user1);
- await expect(page.locator('#main-content').getByText('Needs confirmation')).toBeVisible();
- await page.getByRole('button', { name: 'Options' }).click();
- await page.getByRole('menuitem', { name: 'Confirm' }).click();
- await page.getByRole('button', { name: 'Confirm' }).click();
- await utils.checkNotification(page, users.user2.name + ' confirmed');
- await mailBuffer2.expect((m) => m.subject === "Emergency access contact for " + users.user1.name + " confirmed");
- });
-
- await test.step('Request', async () => {
- await emergencyAccess(test, page2, users.user2);
- await page2.getByRole('button', { name: 'Options' }).click();
- await page2.getByRole('menuitem', { name: 'Request Access' }).click();
- await page2.getByRole('button', { name: 'Request Access' }).click();
- await utils.checkNotification(page2, 'Emergency access requested');
- await mailBuffer.expect((m) => m.subject === "Emergency access request by " + users.user2.name + " initiated");
- });
-
- await test.step('Approved', async () => {
- await emergencyAccess(test, page, users.user1);
- await page.getByRole('button', { name: 'Options' }).click();
- await page.getByRole('menuitem', { name: 'Approve' }).click();
- await page.getByRole('button', { name: 'Approve' }).click();
- await utils.checkNotification(page, 'Emergency access approved');
- await mailBuffer2.expect((m) => m.subject === "Emergency access request for " + users.user1.name + " approved");
- });
- await activateTOTP(test, page, users.user1);
-
- let newPassword = "TotoNewPassword";
- await test.step('Access', async () => {
- await emergencyAccess(test, page2, users.user2);
- await page2.getByRole('button', { name: 'Options' }).click();
- await page2.getByRole('menuitem', { name: 'Takeover' }).click();
- await page2.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
- await page2.getByRole('textbox', { name: 'Confirm new master password' }).fill(newPassword);
- await page2.getByRole('button', { name: 'Save' }).click();
- await utils.checkNotification(page2, 'Password reset for ' + users.user1.name);
- });
-
- await test.step('Changed no 2fa', async () => {
- users.user1.password = newPassword;
- await logUser(test, page, users.user1);
- });
-
- await test.step('Reject', async () => {
- await emergencyAccess(test, page, users.user1);
- await page.getByRole('button', { name: 'Options' }).click();
- await page.getByRole('menuitem', { name: 'Reject' }).click();
- await utils.checkNotification(page, 'Emergency access rejected');
- await mailBuffer2.expect((m) => m.subject === "Emergency access request to " + users.user1.name + " rejected");
- });
-
- await test.step('Remove', async () => {
- await page.getByRole('button', { name: 'Options' }).click();
- await page.getByRole('menuitem', { name: 'Remove' }).click();
- await page.getByRole('button', { name: 'Yes' }).click();
- await utils.checkNotification(page, 'Removed user ' + users.user2.name);
- await expect(page.getByText('You have not added any emergency contacts')).toBeVisible();
- });
-});
diff --git a/playwright/tests/login.spec.ts b/playwright/tests/login.spec.ts
index bc229c43..194976ea 100644
--- a/playwright/tests/login.spec.ts
+++ b/playwright/tests/login.spec.ts
@@ -3,7 +3,7 @@ import * as OTPAuth from "otpauth";
import * as utils from "../global-utils";
import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP, recoveryCodes } from './setups/2fa';
+import { activateTOTP, disableTOTP } from './setups/2fa';
let users = utils.loadEnv();
let totp;
@@ -31,42 +31,21 @@ test('Authenticator 2fa', async ({ page }) => {
await utils.logout(test, page, users.user1);
- await logUser(test, page, users.user1, { totp });
-
- await disableTOTP(test, page, users.user1);
-});
-
-test('Recovery codes', async ({ context, page }) => {
- await logUser(test, page, users.user1);
-
- await activateTOTP(test, page, users.user1);
- let recovery = await recoveryCodes(test, page, users.user1);
-
- await utils.logout(test, page, users.user1);
-
await test.step('login', async () => {
+ let timestamp = Date.now(); // Needed to use the next token
+ timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
+
await page.getByLabel(/Email address/).fill(users.user1.email);
await page.getByRole('button', { name: 'Continue' }).click();
await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
await page.getByRole('button', { name: 'Log in', exact: true }).click();
await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
+ await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
+ await page.getByRole('button', { name: 'Continue' }).click();
await expect(page).toHaveTitle(/Vaultwarden Web/);
-
- const newPagePromise = context.waitForEvent('page');
- await page.getByRole('button', { name: 'Use your recovery code' }).click();
- const newPage = await newPagePromise;
-
- const tabs = context.pages();
- await tabs[1].bringToFront();
- await expect(tabs[1].getByRole('heading', { name: 'Recover account two-step login' })).toBeVisible();
- await tabs[1].getByRole('textbox', { name: 'Email address * (required)' }).fill(users.user1.email);
- await tabs[1].getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
- await tabs[1].getByRole('textbox', { name: 'Recovery code * (required)' }).fill(recovery);
- await tabs[1].getByRole('button', { name: 'Submit' }).click();
-
- await expect(tabs[1]).toHaveTitle(/Two-step login/);
});
-});
+ await disableTOTP(test, page, users.user1);
+});
diff --git a/playwright/tests/setups/2fa.ts b/playwright/tests/setups/2fa.ts
index 0b1711a1..d430d053 100644
--- a/playwright/tests/setups/2fa.ts
+++ b/playwright/tests/setups/2fa.ts
@@ -4,24 +4,6 @@ import * as OTPAuth from "otpauth";
import * as utils from '../../global-utils';
-export async function recoveryCodes(test: Test, page: Page, user: { name: string, password: string }): string {
- return await test.step('Recovery code', async () => {
- await page.getByRole('button', { name: user.name }).click();
- await page.getByRole('menuitem', { name: 'Account settings' }).click();
- await page.getByRole('link', { name: 'Security' }).click();
- await page.getByRole('link', { name: 'Two-step login' }).click();
-
- await page.getByRole('button', { name: 'View recovery code' }).click();
- await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
- await page.getByRole('button', { name: 'Continue' }).click();
-
- const recovery = await page.getByRole('code').innerText();
- await page.getByLabel('Close').click();
-
- return recovery;
- })
-}
-
export async function activateTOTP(test: Test, page: Page, user: { name: string, password: string }): OTPAuth.TOTP {
return await test.step('Activate TOTP 2FA', async () => {
await page.getByRole('button', { name: user.name }).click();
@@ -39,6 +21,7 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
await page.getByLabel(/Verification code/).fill(totp.generate());
await page.getByRole('button', { name: 'Turn on' }).click();
await page.getByRole('heading', { name: 'Turned on', exact: true });
+ await page.getByLabel('Close').click();
return totp;
})
diff --git a/playwright/tests/setups/user.ts b/playwright/tests/setups/user.ts
index 11b39763..3d3990e9 100644
--- a/playwright/tests/setups/user.ts
+++ b/playwright/tests/setups/user.ts
@@ -2,7 +2,6 @@ import { expect, type Browser, Page } from '@playwright/test';
import { type MailBuffer } from 'maildev';
-import * as OTPAuth from "otpauth";
import * as utils from '../../global-utils';
import { retrieveEmailCode } from './2fa';
@@ -44,7 +43,6 @@ export async function logUser(
mailBuffer ?: MailBuffer,
mail2fa?: boolean,
notNewDevice?: boolean,
- totp?: OTPAuth.TOTP,
} = {}
) {
await test.step(`Log user ${user.email}`, async () => {
@@ -57,23 +55,11 @@ export async function logUser(
await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
await page.getByRole('button', { name: 'Log in', exact: true }).click();
- if( options.mail2fa || options.totp ){
- let code;
-
+ if( options.mail2fa ){
await test.step('2FA check', async () => {
await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-
- if( options.totp ) {
- const totp = options.totp;
- let timestamp = Date.now(); // Needed to use the next token
- timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
- code = totp.generate({timestamp});
- } else if( options.mail2fa ){
- code = await retrieveEmailCode(test, page, options.mailBuffer);
- }
-
+ let code = await retrieveEmailCode(test, page, options.mailBuffer);
await page.getByLabel(/Verification code/).fill(code);
-
await page.getByRole('button', { name: 'Continue' }).click();
});
}
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index b195f645..a66db95c 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,4 +1,4 @@
[toolchain]
-channel = "1.99.1"
+channel = "1.99.0"
components = [ "rustfmt", "clippy" ]
profile = "minimal"
diff --git a/src/api/admin.rs b/src/api/admin.rs
index 5e51306c..2a84f611 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, env, sync::LazyLock};
+use std::{env, sync::LazyLock};
use reqwest::Method;
use rocket::{
@@ -17,7 +17,7 @@ use crate::{
api::{
ApiResult, EmptyResult, JsonResult, Notify,
core::{log_event, two_factor},
- push_logout_to_relay, unregister_push_device,
+ unregister_push_device,
},
auth::{ClientIp, Secure, decode_admin, encode_jwt, generate_admin_claims},
config::ConfigBuilder,
@@ -26,7 +26,6 @@ use crate::{
models::{
Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
- custom_roles_enabled,
},
},
error::{Error, MapResult},
@@ -202,15 +201,12 @@ fn post_admin_login(
// If the token is invalid, redirect to login page
if validate_token(&data.token) {
// If the token received is valid, generate JWT and save it as a cookie
- let claims = match generate_admin_claims() {
- Ok(claims) => claims,
- Err(e) => return Err(AdminResponse::Ok(render_admin_login(Some(e.message()), redirect.as_deref()))),
- };
+ let claims = generate_admin_claims();
let jwt = encode_jwt(&claims);
let cookie = Cookie::build((COOKIE_NAME, jwt))
.path(admin_path())
- .max_age(time::Duration::minutes(i64::from(CONFIG.admin_session_lifetime())))
+ .max_age(time::Duration::minutes(CONFIG.admin_session_lifetime()))
.same_site(SameSite::Strict)
.http_only(true)
.secure(secure.https);
@@ -257,7 +253,6 @@ struct AdminTemplateData {
logged_in: bool,
urlpath: String,
sso_enabled: bool,
- custom_roles_enabled: bool,
}
impl AdminTemplateData {
@@ -268,7 +263,6 @@ impl AdminTemplateData {
logged_in: true,
urlpath: CONFIG.domain_path(),
sso_enabled: CONFIG.sso_enabled(),
- custom_roles_enabled: custom_roles_enabled(),
}
}
@@ -393,18 +387,6 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult = Membership::find_confirmed_by_user(&u.uuid, &conn)
- .await
- .into_iter()
- .map(|member| (member.org_uuid.to_string(), member.atype))
- .collect();
- for org in usr["organizations"].as_array_mut().into_iter().flatten() {
- if let Some(atype) = org["id"].as_str().and_then(|org_id| roles.get(org_id)) {
- org["type"] = json!(atype);
- }
- }
-
users_json.push(usr);
}
@@ -434,21 +416,13 @@ async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> Jso
}
#[post("/users//delete", format = "application/json")]
-async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
let user = get_user_or_404(&user_id, &conn).await?;
- // Get the membership records and push devices before deleting the actual user
+ // Get the membership records before deleting the actual user
let memberships = Membership::find_any_state_by_user(&user_id, &conn).await;
- let has_push_device = CONFIG.push_enabled() && Device::check_user_has_push_device(&user_id, &conn).await;
let res = user.delete(&conn).await;
- if res.is_ok() {
- nt.send_logout(&user, None, &conn).await;
- if has_push_device {
- push_logout_to_relay(&user, None);
- }
- }
-
for membership in memberships {
log_event(
EventType::OrganizationUserDeleted,
@@ -580,14 +554,10 @@ async fn update_membership_type(data: Json, token: AdminToke
err!("The specified user isn't member of the organization")
};
- let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
- // Unlike the clients, the admin panel tells the Custom and the legacy Manager role apart. Unless Custom roles
- // are enabled, a Custom role is a Manager here as well, but an existing Custom member is kept as one.
- Some(MembershipType::Custom) if !custom_roles_enabled() && !member_to_edit.has_type(MembershipType::Custom) => {
- MembershipType::Manager
- }
- Some(new_type) => new_type,
- None => err!("Invalid type"),
+ let new_type = if let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) {
+ new_type as i32
+ } else {
+ err!("Invalid type")
};
if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
@@ -597,14 +567,7 @@ async fn update_membership_type(data: Json, token: AdminToke
}
}
- // A Manager only becomes a Custom member if that changes nothing they may do
- if new_type == MembershipType::Custom
- && let Some(loss) = member_to_edit.custom_role_conversion_loss(&conn).await
- {
- err!(loss)
- }
-
- member_to_edit.set_type(new_type);
+ member_to_edit.atype = new_type;
// This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type
OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
@@ -816,8 +779,6 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
.into_keys()
.collect();
- let invalid_env_vars = crate::util::INVALID_ENV_VARS.lock().unwrap().join(", ");
-
let diagnostics_json = json!({
"dns_resolved": dns_resolved,
"current_release": VERSION,
@@ -840,9 +801,7 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
"db_version": get_sql_server_version(&conn).await,
"admin_url": format!("{}/diagnostics", admin_url()),
"overrides": &CONFIG.get_overrides().join(", "),
- "config_file_status": &CONFIG.get_config_file_status(),
"template_overrides": check_template_overrides().join(", "),
- "invalid_env_vars": invalid_env_vars,
"invalid_feature_flags": invalid_feature_flags,
"host_arch": env::consts::ARCH,
"host_os": env::consts::OS,
diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs
index 69918212..b3499a93 100644
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
@@ -13,7 +13,7 @@ use crate::{
api::{
AnonymousNotify, ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
core::{accept_org_invite, log_user_event, two_factor::email},
- master_password_policy, push_logout_to_relay, register_push_device, unregister_push_device,
+ master_password_policy, register_push_device, unregister_push_device,
},
auth::{ClientHeaders, ClientIp, Headers, decode_delete, decode_invite, decode_verify_email},
crypto,
@@ -93,15 +93,6 @@ pub struct KDFData {
kdf_parallelism: Option,
}
-impl KDFData {
- pub(super) fn matches_user(&self, user: &User) -> bool {
- self.kdf == user.client_kdf_type
- && self.kdf_iterations == user.client_kdf_iter
- && self.kdf_memory == user.client_kdf_memory
- && self.kdf_parallelism == user.client_kdf_parallelism
- }
-}
-
#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct RegisterData {
@@ -493,7 +484,8 @@ async fn post_set_password(data: Json, headers: Headers, conn:
Membership::accept_user_invitations(&user.uuid, &conn).await?;
}
- log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+ .await;
user.save(&conn).await?;
@@ -639,7 +631,8 @@ async fn post_password(data: Json, headers: Headers, conn: DbCon
err!("Invalid password")
}
- log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+ .await;
let (new_master_password_hash, new_key) =
if let (Some(unlock_data), Some(authentication_data)) = (data.unlock_data, data.authentication_data) {
@@ -724,35 +717,21 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult {
#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
-pub(super) struct AuthenticationData {
+struct AuthenticationData {
#[serde(alias = "Salt")]
salt: String,
#[serde(alias = "Kdf")]
- pub(super) kdf: KDFData,
+ kdf: KDFData,
#[serde(alias = "MasterPasswordAuthenticationHash")]
- pub(super) master_password_authentication_hash: String,
-}
-
-impl AuthenticationData {
- pub(super) fn check(&self, user: &User, unlock: &UnlockData) -> EmptyResult {
- if self.kdf != unlock.kdf {
- err!("KDF settings must be equal for authentication and unlock")
- }
-
- if self.salt != user.master_password_salt() || self.salt != unlock.salt {
- err!("Invalid master password salt")
- }
-
- Ok(())
- }
+ master_password_authentication_hash: String,
}
#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
-pub(super) struct UnlockData {
+struct UnlockData {
salt: String,
kdf: KDFData,
- pub(super) master_key_wrapped_user_key: String,
+ master_key_wrapped_user_key: String,
}
#[derive(Deserialize)]
@@ -771,7 +750,13 @@ async fn post_kdf(data: Json, headers: Headers, conn: DbConn, nt:
err!("Invalid password")
}
- data.authentication_data.check(&headers.user, &data.unlock_data)?;
+ if data.authentication_data.kdf != data.unlock_data.kdf {
+ err!("KDF settings must be equal for authentication and unlock")
+ }
+
+ if headers.user.email != data.authentication_data.salt || headers.user.email != data.unlock_data.salt {
+ err!("Invalid master password salt")
+ }
let mut user = headers.user;
@@ -1148,11 +1133,7 @@ async fn post_email_token(data: Json, headers: Headers, conn: Db
error!("Error sending change-email email: {e:#?}");
}
} else {
- debug!(
- "Email change request for user ({}) to email ({}) with token ({token})",
- user.uuid,
- data.new_email.escape_debug()
- );
+ debug!("Email change request for user ({}) to email ({}) with token ({token})", user.uuid, data.new_email);
}
user.email_new = Some(data.new_email);
@@ -1305,7 +1286,7 @@ struct DeleteRecoverTokenData {
}
#[post("/accounts/delete-recover-token", data = "")]
-async fn post_delete_recover_token(data: Json, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+async fn post_delete_recover_token(data: Json, conn: DbConn) -> EmptyResult {
let data: DeleteRecoverTokenData = data.into_inner();
let Ok(claims) = decode_delete(&data.token) else {
@@ -1319,44 +1300,22 @@ async fn post_delete_recover_token(data: Json, conn: DbC
if claims.sub != *user.uuid {
err!("Invalid claim");
}
-
- // The devices are deleted together with the user, so check for push devices beforehand
- let has_push_device = CONFIG.push_enabled() && Device::check_user_has_push_device(&user.uuid, &conn).await;
- user.delete(&conn).await?;
-
- nt.send_logout(&user, None, &conn).await;
- if has_push_device {
- push_logout_to_relay(&user, None);
- }
- Ok(())
+ user.delete(&conn).await
}
#[post("/accounts/delete", data = "")]
-async fn post_delete_account(
- data: Json,
- headers: Headers,
- conn: DbConn,
- nt: Notify<'_>,
-) -> EmptyResult {
- delete_account(data, headers, conn, nt).await
+async fn post_delete_account(data: Json, headers: Headers, conn: DbConn) -> EmptyResult {
+ delete_account(data, headers, conn).await
}
#[delete("/accounts", data = "")]
-async fn delete_account(data: Json, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+async fn delete_account(data: Json, headers: Headers, conn: DbConn) -> EmptyResult {
let data: PasswordOrOtpData = data.into_inner();
let user = headers.user;
data.validate(&user, true, &conn).await?;
- // The devices are deleted together with the user, so check for push devices beforehand
- let has_push_device = CONFIG.push_enabled() && Device::check_user_has_push_device(&user.uuid, &conn).await;
- user.delete(&conn).await?;
-
- nt.send_logout(&user, None, &conn).await;
- if has_push_device {
- push_logout_to_relay(&user, None);
- }
- Ok(())
+ user.delete(&conn).await
}
#[expect(clippy::needless_pass_by_value, reason = "Not beneficial for Headers")]
@@ -1407,7 +1366,7 @@ async fn password_hint(data: Json, ip: ClientIp, conn: DbConn)
mail::send_password_hint(email, hint).await?;
Ok(())
} else if let Some(hint) = hint {
- err_silent!(format!("Your password hint is: {hint}"));
+ err!(format!("Your password hint is: {hint}"));
} else {
err!(NO_HINT);
}
@@ -1720,7 +1679,7 @@ async fn post_auth_request(
nt.send_auth_request(&user.uuid, &auth_request.uuid, &device, &conn).await;
log_user_event(
- EventType::UserRequestedDeviceApproval,
+ EventType::UserRequestedDeviceApproval as i32,
&user.uuid,
client_headers.device_type,
&client_headers.ip.ip,
@@ -1814,7 +1773,7 @@ async fn put_auth_request(
nt.send_auth_response(&auth_request.user_uuid, &auth_request.uuid, &headers.device, &conn).await;
log_user_event(
- EventType::OrganizationUserApprovedAuthRequest,
+ EventType::OrganizationUserApprovedAuthRequest as i32,
&headers.user.uuid,
headers.device.atype,
&headers.ip.ip,
@@ -1825,7 +1784,7 @@ async fn put_auth_request(
// If denied, there's no reason to keep the request
auth_request.delete(&conn).await?;
log_user_event(
- EventType::OrganizationUserRejectedAuthRequest,
+ EventType::OrganizationUserRejectedAuthRequest as i32,
&headers.user.uuid,
headers.device.atype,
&headers.ip.ip,
diff --git a/src/api/core/ciphers.rs b/src/api/core/ciphers.rs
index 97f5fd49..46766896 100644
--- a/src/api/core/ciphers.rs
+++ b/src/api/core/ciphers.rs
@@ -13,7 +13,7 @@ use serde_json::Value;
use crate::{
CONFIG,
- api::{self, ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType, core::log_event},
+ api::{self, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType, core::log_event},
auth::ClientVersion,
auth::{Headers, OrgIdGuard, OwnerHeaders},
config::PathType,
@@ -23,7 +23,7 @@ use crate::{
models::{
Archive, Attachment, AttachmentId, Cipher, CipherId, Collection, CollectionCipher, CollectionGroup,
CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, KeyId,
- Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, User, UserId,
+ Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, UserId,
},
},
util::{NumberOrString, deser_opt_nonempty_str, save_temp_file},
@@ -458,7 +458,7 @@ pub async fn update_cipher_from_data(
{
match NaiveDateTime::parse_from_str(&dt, "%+") {
// ISO 8601 format
- Err(err) => warn!("Error parsing LastKnownRevisionDate '{}': {err}", dt.escape_debug()),
+ Err(err) => warn!("Error parsing LastKnownRevisionDate '{dt}': {err}"),
Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => {
err!("The client copy of this cipher is out of date. Resync the client and try again.")
}
@@ -521,7 +521,7 @@ pub async fn update_cipher_from_data(
// A missing attachment means it was removed via an other client.
// Also the Desktop Client supports removing attachments and save an update afterwards.
// Bitwarden it self ignores these mismatches server side.
- warn!("Attachment {} doesn't exist", id.escape_debug());
+ warn!("Attachment {id} doesn't exist");
continue;
};
@@ -580,7 +580,7 @@ pub async fn update_cipher_from_data(
match data.archived_date {
Some(dt_str) => match NaiveDateTime::parse_from_str(&dt_str, "%+") {
Ok(dt) => cipher.set_archived_at(dt, &headers.user.uuid, conn).await?,
- Err(err) => warn!("Error parsing ArchivedDate '{}': {err}", dt_str.escape_debug()),
+ Err(err) => warn!("Error parsing ArchivedDate '{dt_str}': {err}"),
},
None => cipher.unarchive(&headers.user.uuid, conn).await?,
}
@@ -666,9 +666,6 @@ async fn post_ciphers_import(data: Json, headers: Headers, conn: DbC
for (index, mut cipher_data) in data.ciphers.into_iter().enumerate() {
let folder_id = relations_map.get(&index).and_then(|i| folders.get(*i).cloned());
cipher_data.folder_id = folder_id;
- // A personal import always creates personal ciphers, the organization ID is ignored instead of rejected
- // Upstream: https://github.com/bitwarden/server/blob/b06b81c1fb33ce9c9872b96397ba2b4d879b66af/src/Api/Tools/Controllers/ImportCiphersController.cs#L58
- cipher_data.organization_id = None;
let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
@@ -690,11 +687,6 @@ async fn put_cipher_admin(
conn: DbConn,
nt: Notify<'_>,
) -> JsonResult {
- // Only organization ciphers can be edited here, put_cipher() rejects an organization ID that isn't the cipher's
- if data.organization_id.is_none() {
- err_code!("Resource not found.", "Cipher is not an organization cipher", Status::NotFound.code);
- }
-
put_cipher(cipher_id, data, headers, conn, nt).await
}
@@ -706,7 +698,7 @@ async fn post_cipher_admin(
conn: DbConn,
nt: Notify<'_>,
) -> JsonResult {
- put_cipher_admin(cipher_id, data, headers, conn, nt).await
+ post_cipher(cipher_id, data, headers, conn, nt).await
}
#[post("/ciphers/", data = "")]
@@ -743,11 +735,6 @@ async fn put_cipher(
err!("Cipher is not write accessible")
}
- // Moving a cipher into an organization is only possible through the share endpoints
- if cipher.organization_uuid != data.organization_id {
- err!("Organization mismatch. Please resync the client before updating the cipher")
- }
-
update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherUpdate).await?;
Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -1006,7 +993,9 @@ async fn post_cipher_share(
conn: DbConn,
nt: Notify<'_>,
) -> JsonResult {
- put_cipher_share(cipher_id, data, headers, conn, nt).await
+ let data: ShareCipherData = data.into_inner();
+
+ share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
}
#[put("/ciphers//share", data = "")]
@@ -1019,14 +1008,6 @@ async fn put_cipher_share(
) -> JsonResult {
let data: ShareCipherData = data.into_inner();
- if data.cipher.organization_id.is_none() {
- err!("Cipher OrganizationId is required.")
- }
-
- if data.collection_ids.is_empty() {
- err!("You must select at least one collection.")
- }
-
share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
}
@@ -1037,53 +1018,14 @@ struct ShareSelectedCipherData {
collection_ids: Vec,
}
-// A bulk share returns cipherMini models, not the cipherDetails models used by
-// the single-share route. Keep the encrypted legacy fields and a future v2
-// `data` blob, but do not expose details-only fields in this response.
-fn cipher_mini_from_json(mut cipher: Value) -> Value {
- const FIELDS: &[&str] = &[
- "id",
- "organizationId",
- "type",
- "data",
- "partialData",
- "name",
- "notes",
- "login",
- "card",
- "identity",
- "secureNote",
- "sshKey",
- "bankAccount",
- "driversLicense",
- "passport",
- "fields",
- "passwordHistory",
- "attachments",
- "organizationUseTotp",
- "revisionDate",
- "creationDate",
- "deletedDate",
- "reprompt",
- "key",
- ];
-
- let Some(object) = cipher.as_object_mut() else {
- return json!({ "object": "cipherMini" });
- };
- object.retain(|field, _| FIELDS.contains(&field.as_str()));
- object.insert("object".into(), "cipherMini".into());
- cipher
-}
-
#[put("/ciphers/share", data = "")]
async fn put_cipher_share_selected(
data: Json,
headers: Headers,
conn: DbConn,
nt: Notify<'_>,
-) -> JsonResult {
- let data: ShareSelectedCipherData = data.into_inner();
+) -> EmptyResult {
+ let mut data: ShareSelectedCipherData = data.into_inner();
if data.ciphers.is_empty() {
err!("You must select at least one cipher.")
@@ -1097,43 +1039,25 @@ async fn put_cipher_share_selected(
if cipher.id.is_none() {
err!("Request missing ids field")
}
- if cipher.organization_id.is_none() {
- err!("Cipher OrganizationId is required.")
- }
}
- let mut responses = Vec::with_capacity(data.ciphers.len());
- for cipher in data.ciphers {
+ while let Some(cipher) = data.ciphers.pop() {
let mut shared_cipher_data = ShareCipherData {
cipher,
collection_ids: data.collection_ids.clone(),
};
if let Some(id) = shared_cipher_data.cipher.id.take() {
- let response =
- share_cipher_by_uuid(&id, shared_cipher_data, &headers, &conn, &nt, Some(UpdateType::None)).await?;
-
- // Like upstream's VisibleToClient, withhold a cipher if sharing it
- // removed the user's access to it. Only then include its encrypted
- // mini response; the full single-share response stays internal.
- if let Some(shared_cipher) = Cipher::find_by_uuid(&id, &conn).await
- && shared_cipher.is_accessible_to_user(&headers.user.uuid, &conn).await
- {
- responses.push(cipher_mini_from_json(response.into_inner()));
- }
+ share_cipher_by_uuid(&id, shared_cipher_data, &headers, &conn, &nt, Some(UpdateType::None)).await?
} else {
err!("Request missing ids field")
- }
+ };
}
// Multi share actions do not send out a push for each cipher, we need to send a general sync here
nt.send_user_update(UpdateType::SyncCiphers, &headers.user, headers.device.push_uuid.as_ref(), &conn).await;
- Ok(Json(json!({
- "data": responses,
- "object": "list",
- "continuationToken": null,
- })))
+ Ok(())
}
async fn share_cipher_by_uuid(
@@ -1236,40 +1160,6 @@ enum FileUploadType {
// Azure = 1, // only used upstream
}
-/// Remaining attachment storage in bytes for the cipher's owner, `None` when unlimited.
-/// `size_adjust` credits a v2 attachment whose record already counts as used.
-async fn attachment_size_limit(cipher: &Cipher, size_adjust: i64, conn: &DbConn) -> ApiResult> {
- let (limit_kb, already_used) = if let Some(ref user_id) = cipher.user_uuid {
- let Some(limit_kb) = CONFIG.user_attachment_limit() else {
- return Ok(None);
- };
- (limit_kb, Attachment::size_by_user(user_id, conn).await)
- } else if let Some(ref org_id) = cipher.organization_uuid {
- let Some(limit_kb) = CONFIG.org_attachment_limit() else {
- return Ok(None);
- };
- (limit_kb, Attachment::size_by_org(org_id, conn).await)
- } else {
- err!("Cipher is neither owned by a user nor an organization");
- };
-
- if limit_kb == 0 {
- err!("Attachments are disabled")
- }
-
- let Some(left) =
- limit_kb.checked_mul(1024).and_then(|l| l.checked_sub(already_used)).and_then(|l| l.checked_add(size_adjust))
- else {
- err!("Attachment size overflow");
- };
-
- if left <= 0 {
- err!("Attachment storage limit reached! Delete some attachments to free up space")
- }
-
- Ok(Some(left))
-}
-
/// v2 API for creating an attachment associated with a cipher.
/// This redirects the client to the API it should use to upload the attachment.
/// For upstream's cloud-hosted service, it's an Azure object storage API.
@@ -1280,7 +1170,6 @@ async fn post_attachment_v2(
data: Json,
headers: Headers,
conn: DbConn,
- nt: Notify<'_>,
) -> JsonResult {
let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
err!("Cipher doesn't exist")
@@ -1300,18 +1189,10 @@ async fn post_attachment_v2(
if file_size > SIZE_525_MB {
err!("Max file size is 525 MB.")
}
-
- if let Some(size_limit) = attachment_size_limit(&cipher, 0, &conn).await?
- && file_size > size_limit
- {
- err!("Attachment storage limit exceeded with this file");
- }
-
let attachment_id = crypto::generate_attachment_id();
let attachment =
Attachment::new(attachment_id.clone(), cipher.uuid.clone(), data.file_name, file_size, Some(data.key));
attachment.save(&conn).await.expect("Error saving attachment");
- notify_attachment_created(&cipher, &headers, &conn, &nt).await;
let url = format!("/ciphers/{}/attachment/{attachment_id}", cipher.uuid);
let response_key = match data.admin_request {
@@ -1374,7 +1255,55 @@ async fn save_attachment(
Some(a) => a.file_size, // v2 API
};
- if let Some(size_limit) = attachment_size_limit(&cipher, size_adjust, &conn).await?
+ let size_limit = if let Some(ref user_id) = cipher.user_uuid {
+ match CONFIG.user_attachment_limit() {
+ Some(0) => err!("Attachments are disabled"),
+ Some(limit_kb) => {
+ let already_used = Attachment::size_by_user(user_id, &conn).await;
+ let left = limit_kb
+ .checked_mul(1024)
+ .and_then(|l| l.checked_sub(already_used))
+ .and_then(|l| l.checked_add(size_adjust));
+
+ let Some(left) = left else {
+ err!("Attachment size overflow");
+ };
+
+ if left <= 0 {
+ err!("Attachment storage limit reached! Delete some attachments to free up space")
+ }
+
+ Some(left)
+ }
+ None => None,
+ }
+ } else if let Some(ref org_id) = cipher.organization_uuid {
+ match CONFIG.org_attachment_limit() {
+ Some(0) => err!("Attachments are disabled"),
+ Some(limit_kb) => {
+ let already_used = Attachment::size_by_org(org_id, &conn).await;
+ let left = limit_kb
+ .checked_mul(1024)
+ .and_then(|l| l.checked_sub(already_used))
+ .and_then(|l| l.checked_add(size_adjust));
+
+ let Some(left) = left else {
+ err!("Attachment size overflow");
+ };
+
+ if left <= 0 {
+ err!("Attachment storage limit reached! Delete some attachments to free up space")
+ }
+
+ Some(left)
+ }
+ None => None,
+ }
+ } else {
+ err!("Cipher is neither owned by a user nor an organization");
+ };
+
+ if let Some(size_limit) = size_limit
&& size > size_limit
{
err!("Attachment storage limit exceeded with this file");
@@ -1431,23 +1360,13 @@ async fn save_attachment(
save_temp_file(&PathType::Attachments, &format!("{cipher_id}/{file_id}"), data.data, true).await?;
- // With the v2 API, post_attachment_v2() already did this when it created the attachment record
- if attachment.is_none() {
- notify_attachment_created(&cipher, headers, &conn, &nt).await;
- }
-
- Ok((cipher, conn))
-}
-
-/// Sends the cipher update to the clients and logs the attachment event
-async fn notify_attachment_created(cipher: &Cipher, headers: &Headers, conn: &DbConn, nt: &Notify<'_>) {
nt.send_cipher_update(
UpdateType::SyncCipherUpdate,
- cipher,
- &cipher.update_users_revision(conn).await,
+ &cipher,
+ &cipher.update_users_revision(&conn).await,
&headers.device,
None,
- conn,
+ &conn,
)
.await;
@@ -1459,10 +1378,12 @@ async fn notify_attachment_created(cipher: &Cipher, headers: &Headers, conn: &Db
&headers.user.uuid,
headers.device.atype,
&headers.ip.ip,
- conn,
+ &conn,
)
.await;
}
+
+ Ok((cipher, conn))
}
/// v2 API for uploading the actual data content of an attachment.
@@ -1738,22 +1659,12 @@ async fn move_cipher_selected(
// Find all ciphers a user has access to, all others will be ignored
let accessible_ciphers = Cipher::find_by_user_and_ciphers(user_id, &data.ids, &conn).await;
let accessible_ciphers_count = accessible_ciphers.len();
- let mut move_result = Ok(());
for cipher in accessible_ciphers {
- move_result = cipher.move_to_folder_without_revision_update(data.folder_id.clone(), user_id, &conn).await;
- if move_result.is_err() {
- break;
- }
+ cipher.move_to_folder(data.folder_id.clone(), user_id, &conn).await?;
if cipher_count == 1 {
single_cipher = Some(cipher);
}
}
- // Update the revision once for the whole batch. Also when a move failed halfway,
- // since the ciphers moved before it are already changed.
- if accessible_ciphers_count > 0 {
- User::update_uuid_revision(user_id, &conn).await;
- }
- move_result?;
if let Some(cipher) = single_cipher {
nt.send_cipher_update(
diff --git a/src/api/core/emergency_access.rs b/src/api/core/emergency_access.rs
index 773697e5..6afc683c 100644
--- a/src/api/core/emergency_access.rs
+++ b/src/api/core/emergency_access.rs
@@ -1,4 +1,4 @@
-use chrono::Utc;
+use chrono::{TimeDelta, Utc};
use rocket::{Route, serde::json::Json};
use serde_json::Value;
@@ -6,17 +6,14 @@ use crate::{
CONFIG,
api::{
EmptyResult, JsonResult,
- core::{
- CipherSyncData, CipherSyncType,
- accounts::{AuthenticationData, UnlockData},
- },
+ core::{CipherSyncData, CipherSyncType},
},
auth::{Headers, decode_emergency_access_invite},
db::{
DbConn, DbPool,
models::{
- Cipher, EMERGENCY_ACCESS_TIMEOUT_RANGE, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus,
- EmergencyAccessType, Invitation, Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
+ Cipher, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType, Invitation,
+ Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
},
},
mail,
@@ -136,21 +133,19 @@ async fn post_emergency_access(
let data: EmergencyAccessUpdateData = data.into_inner();
- let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
- err!("Invalid emergency access type.")
- };
-
- if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&data.wait_time_days) {
- err!("Emergency access wait time is out-of-bounds!")
- }
-
let Some(mut emergency_access) =
EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
else {
err!("Emergency access not valid.")
};
- emergency_access.atype = new_type as i32;
+ let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
+ new_type as i32
+ } else {
+ err!("Invalid emergency access type.")
+ };
+
+ emergency_access.atype = new_type;
emergency_access.wait_time_days = data.wait_time_days;
if data.key_encrypted.is_some() {
emergency_access.key_encrypted = data.key_encrypted;
@@ -212,11 +207,11 @@ async fn send_invite(data: Json, headers: Headers, co
let email = data.email.to_lowercase();
let wait_time_days = data.wait_time_days;
- if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&wait_time_days) {
- err!("Emergency access wait time is out-of-bounds!")
- }
+ let emergency_access_status = EmergencyAccessStatus::Invited as i32;
- let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
+ let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
+ new_type as i32
+ } else {
err!("Invalid emergency access type.")
};
@@ -262,8 +257,6 @@ async fn send_invite(data: Json, headers: Headers, co
err!(format!("Grantee user already invited: {}", &grantee_user.email))
}
- let new_type = new_type as i32;
- let emergency_access_status = EmergencyAccessStatus::Invited as i32;
let mut new_emergency_access =
EmergencyAccess::new(grantor_user.uuid, grantee_user.email, emergency_access_status, new_type, wait_time_days);
new_emergency_access.save(&conn).await?;
@@ -296,7 +289,7 @@ async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, conn: DbCon
};
if emergency_access.status != EmergencyAccessStatus::Invited as i32 {
- err!("The grantee user is already accepted or confirmed for emergency access");
+ err!("The grantee user is already accepted or confirmed to the organization");
}
let Some(email) = emergency_access.email.clone() else {
@@ -457,24 +450,11 @@ async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
let Some(mut emergency_access) =
EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &initiating_user.uuid, &conn).await
else {
- err!(
- "Emergency access not valid.",
- format!("Emergency access '{emer_id}', not found for user '{}'.", initiating_user.email)
- )
+ err!("Emergency access not valid.")
};
if emergency_access.status != EmergencyAccessStatus::Confirmed as i32 {
- err!(
- "Emergency access not valid.",
- format!("Emergency access '{emer_id}', not confirmed for user '{}'.", initiating_user.email)
- )
- }
-
- if !EMERGENCY_ACCESS_TIMEOUT_RANGE.contains(&emergency_access.wait_time_days) {
- err!(
- "Emergency access not valid.",
- format!("Emergency access '{emer_id}' timeout range '{}' is invalid", emergency_access.wait_time_days)
- )
+ err!("Emergency access not valid.")
}
let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &conn).await else {
@@ -507,17 +487,11 @@ async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
let Some(mut emergency_access) =
EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
else {
- err!(
- "Emergency access not valid.",
- format!("Emergency access '{emer_id}', not found for user '{}'.", headers.user.email)
- )
+ err!("Emergency access not valid.")
};
if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32 {
- err!(
- "Emergency access not valid.",
- format!("Emergency access '{emer_id}', not initiated for user '{}'.", headers.user.email)
- )
+ err!("Emergency access not valid.")
}
let Some(grantor_user) = User::find_by_uuid(&headers.user.uuid, &conn).await else {
@@ -641,7 +615,6 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
"kdfMemory": grantor_user.client_kdf_memory,
"kdfParallelism": grantor_user.client_kdf_parallelism,
"keyEncrypted": &emergency_access.key_encrypted,
- "salt": grantor_user.master_password_salt(),
"object": "emergencyAccessTakeover",
});
@@ -651,13 +624,8 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
struct EmergencyAccessPasswordData {
- // Legacy payload
- new_master_password_hash: Option,
- key: Option,
-
- // Current payload
- authentication_data: Option,
- unlock_data: Option,
+ new_master_password_hash: String,
+ key: String,
}
#[post("/emergency-access//password", data = "")]
@@ -670,6 +638,8 @@ async fn password_emergency_access(
check_emergency_access_enabled()?;
let data: EmergencyAccessPasswordData = data.into_inner();
+ let new_master_password_hash = &data.new_master_password_hash;
+ //let key = &data.Key;
let requesting_user = headers.user;
let Some(emergency_access) =
@@ -686,23 +656,8 @@ async fn password_emergency_access(
err!("Grantor user not found.")
};
- let (new_master_password_hash, new_key) =
- if let (Some(authentication_data), Some(unlock_data)) = (data.authentication_data, data.unlock_data) {
- authentication_data.check(&grantor_user, &unlock_data)?;
-
- if !authentication_data.kdf.matches_user(&grantor_user) {
- err!("KDF settings do not match the grantor account")
- }
-
- (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
- } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
- (new_master_password_hash, new_key)
- } else {
- err!("Invalid request!")
- };
-
// change grantor_user password
- grantor_user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
+ grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
grantor_user.save(&conn).await?;
// Disable TwoFactor providers since they will otherwise block logins
@@ -770,71 +725,52 @@ pub async fn emergency_request_timeout_job(pool: DbPool) {
return;
}
- let Ok(conn) = pool.get().await else {
- error!("Failed to get DB connection for emergency time-outs!");
- return;
- };
+ if let Ok(conn) = pool.get().await {
+ let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
- let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
-
- if emergency_access_list.is_empty() {
- debug!("No emergency request timeout to approve");
- return;
- }
-
- let now = Utc::now().naive_utc();
- for mut emer in emergency_access_list {
- match emer.is_recovery_allowed(&now) {
- Ok(true) => {} // Recovery is allowed
- Ok(false) => continue,
- Err(e) => {
- error!("Failed to check if recovery is allowed for '{}': {e}", emer.uuid);
- continue;
- }
+ if emergency_access_list.is_empty() {
+ debug!("No emergency request timeout to approve");
}
- // Get grantor user to send Accepted email
- let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
- error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
- continue;
- };
+ let now = Utc::now().naive_utc();
+ for mut emer in emergency_access_list {
+ // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
+ let recovery_allowed_at =
+ emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days)).unwrap();
+ if recovery_allowed_at.le(&now) {
+ // Only update the access status
+ // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
+ emer.update_access_status_and_save(EmergencyAccessStatus::RecoveryApproved as i32, &now, &conn)
+ .await
+ .expect("Unable to update emergency access status");
- let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
- error!("Missing grantee for emergency access '{}'", emer.uuid);
- continue;
- };
+ if CONFIG.mail_enabled() {
+ // get grantor user to send Accepted email
+ let grantor_user =
+ User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
- // Get grantee user to send Accepted email
- let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
- error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
- continue;
- };
+ // get grantee user to send Accepted email
+ let grantee_user =
+ User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
+ .await
+ .expect("Grantee user not found");
- // Only update the access status
- // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
- let status_initiated = EmergencyAccessStatus::RecoveryInitiated as i32;
- let status_approved = EmergencyAccessStatus::RecoveryApproved as i32;
- if let Err(e) = emer.update_access_status_and_save(status_initiated, status_approved, &now, &conn).await {
- error!("Unable to update emergency access status for '{}': {e}", emer.uuid);
- continue;
- }
+ mail::send_emergency_access_recovery_timed_out(
+ &grantor_user.email,
+ &grantee_user.name,
+ emer.get_type_as_str(),
+ )
+ .await
+ .expect("Error on sending email");
- if CONFIG.mail_enabled() {
- if let Err(e) = mail::send_emergency_access_recovery_timed_out(
- &grantor_user.email,
- &grantee_user.name,
- emer.get_type_as_str(),
- )
- .await
- {
- error!("Failed to send emergency access recovery time-out email for '{}': {e}", emer.uuid);
- }
-
- if let Err(e) = mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name).await
- {
- error!("Failed to send emergency access recovery approved email for '{}': {e}", emer.uuid);
+ mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name)
+ .await
+ .expect("Error on sending email");
+ }
}
}
+ } else {
+ error!("Failed to get DB connection while searching emergency request timed out");
}
}
@@ -844,85 +780,55 @@ pub async fn emergency_notification_reminder_job(pool: DbPool) {
return;
}
- let Ok(conn) = pool.get().await else {
- error!("Failed to get DB connection for emergency reminders!");
- return;
- };
+ if let Ok(conn) = pool.get().await {
+ let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
- let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
-
- if emergency_access_list.is_empty() {
- debug!("No emergency request reminder notification to send");
- return;
- }
-
- let now = Utc::now().naive_utc();
- for mut emer in emergency_access_list {
- let Ok(deadline_at) = emer.deadline_at() else {
- error!("Invalid deadline for emergency access '{}'", emer.uuid);
- continue;
- };
-
- let Some(final_reminder_at) = deadline_at.checked_sub_days(chrono::Days::new(1)) else {
- error!("Cannot calculate reminder date for emergency access '{}'", emer.uuid);
- continue;
- };
-
- // Only send reminders during the last 24 hours, else continue
- if now < final_reminder_at || now >= deadline_at {
- continue;
+ if emergency_access_list.is_empty() {
+ debug!("No emergency request reminder notification to send");
}
- // Check if we did not sent a recovery mail in the past 24h already, else skip it.
- // In case something goes wrong with the date calculation or `last_notification_at` is None we use now.
- // This is to prevent possible missed reminders, this might cause an extra reminder,
- // but that is better then no reminder at all.
- let next_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
- last_notification_at.checked_add_days(chrono::Days::new(1)).unwrap_or(now)
- } else {
- now
- };
+ let now = Utc::now().naive_utc();
+ for mut emer in emergency_access_list {
+ // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
+ // Calculate the day before the recovery will become active
+ let final_recovery_reminder_at =
+ emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days - 1)).unwrap();
+ // Calculate if a day has passed since the previous notification, else no notification has been sent before
+ let next_recovery_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
+ last_notification_at + TimeDelta::try_days(1).unwrap()
+ } else {
+ now
+ };
+ if final_recovery_reminder_at.le(&now) && next_recovery_reminder_at.le(&now) {
+ // Only update the last notification date
+ // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
+ emer.update_last_notification_date_and_save(&now, &conn)
+ .await
+ .expect("Unable to update emergency access notification date");
- // Only send a reminder if the `next_reminder_at` is less then or equal to `now`
- // Else we can skip the current emergency access this run.
- if next_reminder_at.gt(&now) {
- continue;
- }
-
- // Get grantor user to send Reminder email
- let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
- error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
- continue;
- };
-
- let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
- error!("Missing grantee for emergency access '{}'", emer.uuid);
- continue;
- };
-
- // Get grantee user to send Reminder email
- let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
- error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
- continue;
- };
-
- // Only update the last notification date
- // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
- if let Err(e) = emer.update_last_notification_date_and_save(&now, &conn).await {
- error!("Unable to update emergency access reminder date for '{}': {e}", emer.uuid);
- continue;
- }
-
- if CONFIG.mail_enabled()
- && let Err(e) = mail::send_emergency_access_recovery_reminder(
- &grantor_user.email,
- &grantee_user.name,
- emer.get_type_as_str(),
- "1", // This notification is only triggered one day before the activation
- )
- .await
- {
- error!("Failed to send emergency access reminder email for '{}': {e}", emer.uuid);
+ if CONFIG.mail_enabled() {
+ // get grantor user to send Accepted email
+ let grantor_user =
+ User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
+
+ // get grantee user to send Accepted email
+ let grantee_user =
+ User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
+ .await
+ .expect("Grantee user not found");
+
+ mail::send_emergency_access_recovery_reminder(
+ &grantor_user.email,
+ &grantee_user.name,
+ emer.get_type_as_str(),
+ "1", // This notification is only triggered one day before the activation
+ )
+ .await
+ .expect("Error on sending email");
+ }
+ }
}
+ } else {
+ error!("Failed to get DB connection while searching emergency notification reminder");
}
}
diff --git a/src/api/core/events.rs b/src/api/core/events.rs
index 3b758bb2..80906e40 100644
--- a/src/api/core/events.rs
+++ b/src/api/core/events.rs
@@ -214,8 +214,8 @@ async fn post_events_collect(data: Json>, headers: Headers,
.await;
}
}
- // Client-side cipher events (viewed, copied, toggled, autofilled, HTTP auth).
- 1107..=1114 | 1117 | 1119..=1133 => {
+ // Client-side cipher events (viewed, copied, toggled, autofilled).
+ 1107..=1114 | 1117 | 1119..=1132 => {
// The cipher determines the organization the event is logged to, so make sure the
// user can actually access it instead of trusting the provided cipher uuid.
if let Some(cipher_uuid) = &event.cipher_id
@@ -242,11 +242,11 @@ async fn post_events_collect(data: Json>, headers: Headers,
Ok(())
}
-pub async fn log_user_event(event_type: EventType, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
+pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
if !CONFIG.org_events_enabled() {
return;
}
- log_user_event_impl(event_type as i32, user_id, device_type, None, ip, conn).await;
+ log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await;
}
async fn log_user_event_impl(
@@ -347,17 +347,14 @@ async fn log_event_impl(
pub async fn event_cleanup_job(pool: DbPool) {
debug!("Start events cleanup job");
- if CONFIG.events_days_retain().is_none_or(|d| d == 0) {
- debug!("events_days_retain is not configured or set to 0, skipping");
+ if CONFIG.events_days_retain().is_none() {
+ debug!("events_days_retain is not configured, abort");
return;
}
- let Ok(conn) = pool.get().await else {
+ if let Ok(conn) = pool.get().await {
+ Event::clean_events(&conn).await.ok();
+ } else {
error!("Failed to get DB connection while trying to cleanup the events table");
- return;
- };
-
- if let Err(e) = Event::clean_events(&conn).await {
- error!("Failed to cleanup the events table: {e}");
}
}
diff --git a/src/api/core/mod.rs b/src/api/core/mod.rs
index b7923982..e6a184dd 100644
--- a/src/api/core/mod.rs
+++ b/src/api/core/mod.rs
@@ -247,7 +247,6 @@ fn config() -> Json {
"notifications": format!("{domain}/notifications"),
"sso": "",
"cloudRegion": null,
- "fillAssistRules": CONFIG.fill_assist_rules_url(),
},
// Bitwarden uses this for the self-hosted servers to indicate the default push technology
"push": {
diff --git a/src/api/core/organizations.rs b/src/api/core/organizations.rs
index 607db45b..6464f774 100644
--- a/src/api/core/organizations.rs
+++ b/src/api/core/organizations.rs
@@ -15,10 +15,10 @@ use crate::{
db::{
DbConn,
models::{
- Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser,
- CustomPermission, Device, EventType, FillAssistPolicyData, Group, GroupId, GroupUser, Invitation,
- Membership, MembershipId, MembershipStatus, MembershipType, OrgPolicy, OrgPolicyType, Organization,
- OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User, UserId, custom_roles_enabled,
+ Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, Device,
+ EventType, Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus,
+ MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor,
+ TwoFactorType, User, UserId,
},
},
mail,
@@ -26,8 +26,6 @@ use crate::{
util::{NumberOrString, convert_json_key_lcase_first},
};
-use super::accounts::{AuthenticationData, UnlockData};
-
pub fn routes() -> Vec {
routes![
get_organization,
@@ -131,16 +129,13 @@ impl FullCollectionData {
let org_groups = Group::find_by_organization(org_id, conn).await;
let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|c| &c.uuid).collect();
if let Some(e) = self.groups.iter().find(|g| !org_group_ids.contains(&g.id)) {
- err!("Invalid group", format!("Group {} does not belong to organization {}!", e.id.escape_debug(), org_id))
+ err!("Invalid group", format!("Group {} does not belong to organization {}!", e.id, org_id))
}
let org_memberships = Membership::find_by_org(org_id, conn).await;
let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
if let Some(e) = self.users.iter().find(|m| !org_membership_ids.contains(&m.id)) {
- err!(
- "Invalid member",
- format!("Member {} does not belong to organization {}!", e.id.escape_debug(), org_id)
- )
+ err!("Invalid member", format!("Member {} does not belong to organization {}!", e.id, org_id))
}
Ok(())
@@ -555,7 +550,7 @@ async fn post_bulk_access_collections(
let org_groups = Group::find_by_organization(&org_id, &conn).await;
let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|g| &g.uuid).collect();
if let Some(g) = data.groups.iter().find(|g| !org_group_ids.contains(&g.id)) {
- err!("Invalid group", format!("Group {} does not belong to organization {}!", g.id.escape_debug(), org_id))
+ err!("Invalid group", format!("Group {} does not belong to organization {}!", g.id, org_id))
}
for col_id in data.collection_ids {
@@ -978,16 +973,13 @@ impl InviteData {
let org_collections = Collection::find_by_organization(org_id, conn).await;
let org_collection_ids: HashSet<&CollectionId> = org_collections.iter().map(|c| &c.uuid).collect();
if let Some(e) = self.collections.iter().flatten().find(|c| !org_collection_ids.contains(&c.id)) {
- err!(
- "Invalid collection",
- format!("Collection {} does not belong to organization {}!", e.id.escape_debug(), org_id)
- )
+ err!("Invalid collection", format!("Collection {} does not belong to organization {}!", e.id, org_id))
}
let org_groups = Group::find_by_organization(org_id, conn).await;
let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|c| &c.uuid).collect();
if let Some(e) = self.groups.iter().find(|g| !org_group_ids.contains(g)) {
- err!("Invalid group", format!("Group {} does not belong to organization {}!", e.escape_debug(), org_id))
+ err!("Invalid group", format!("Group {} does not belong to organization {}!", e, org_id))
}
Ok(())
@@ -1008,12 +1000,14 @@ async fn send_invite(
data.validate(&org_id, &conn).await?;
// HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission
- // Unless Custom roles are enabled, a custom role (4) is converted to a manager role (3)
+ // The from_str() will convert the custom role type into a manager role type
let raw_type = &data.r#type.into_string();
- let Some(requested_type) = MembershipType::from_str(raw_type) else {
+ // Membership::from_str will convert custom (4) to manager (3)
+ let new_type = if let Some(new_type) = MembershipType::from_str(raw_type) {
+ new_type as i32
+ } else {
err!("Invalid type")
};
- let new_type = MembershipType::requested(requested_type, None, custom_roles_enabled());
if new_type != MembershipType::User && headers.membership_type != MembershipType::Owner {
err!("Only Owners can invite Managers, Admins or Owners")
@@ -1023,19 +1017,11 @@ async fn send_invite(
// Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes
// If the box is not checked, the user will still be a manager, but not with the access_all permission
let access_all = new_type >= MembershipType::Admin
- || (new_type == MembershipType::Manager
- && raw_type.eq("4")
+ || (raw_type.eq("4")
&& data.permissions.get("editAnyCollection") == Some(&json!(true))
&& data.permissions.get("deleteAnyCollection") == Some(&json!(true))
&& data.permissions.get("createNewCollections") == Some(&json!(true)));
- // Checked before anything is created, so a rejected permission leaves nothing behind
- let custom_permissions = if new_type == MembershipType::Custom {
- Some(CustomPermission::requested(&data.permissions)?)
- } else {
- None
- };
-
let mut user_created: bool;
for email in &data.emails {
let mut member_status = MembershipStatus::Invited as i32;
@@ -1077,11 +1063,8 @@ async fn send_invite(
};
let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(headers.user.email.clone()));
- new_member.set_type(new_type);
new_member.access_all = access_all;
- if let Some(permissions) = &custom_permissions {
- new_member.set_custom_permissions(permissions);
- }
+ new_member.atype = new_type;
new_member.status = member_status;
new_member.save(&conn).await?;
@@ -1171,10 +1154,7 @@ async fn bulk_reinvite_members(
for member_id in data.ids {
let err_msg = match reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn).await {
Ok(()) => String::new(),
- Err(e) => {
- warn!("Unable to reinvite member {}: {e:?}", member_id.escape_debug());
- e.message().to_owned()
- }
+ Err(e) => format!("{e:?}"),
};
bulk_response.push(json!(
@@ -1347,10 +1327,7 @@ async fn bulk_confirm_invite(
let user_key = invite.key.unwrap_or_default();
let err_msg = match confirm_invite_impl(&org_id, &member_id, &user_key, &headers, &conn, &nt).await {
Ok(()) => String::new(),
- Err(e) => {
- warn!("Unable to confirm member {}: {e:?}", member_id.escape_debug());
- e.message().to_owned()
- }
+ Err(e) => format!("{e:?}"),
};
bulk_response.push(json!(
@@ -1517,32 +1494,24 @@ async fn edit_member(
let data: EditUserData = data.into_inner();
// HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission
- // Unless Custom roles are enabled, a custom role (4) is converted to a manager role (3)
+ // The from_str() will convert the custom role type into a manager role type
let raw_type = &data.r#type.into_string();
- let Some(requested_type) = MembershipType::from_str(raw_type) else {
+ // MembershipType::from_str will convert custom (4) to manager (3)
+ let Some(new_type) = MembershipType::from_str(raw_type) else {
err!("Invalid type")
};
- let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else {
- err!("The specified user isn't member of the organization")
- };
- let new_type = MembershipType::requested(requested_type, Some(&member_to_edit), custom_roles_enabled());
-
// HACK: This converts the Custom role which has the `Manage all collections` box checked into an access_all flag
// Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes
// If the box is not checked, the user will still be a manager, but not with the access_all permission
let access_all = new_type >= MembershipType::Admin
- || (new_type == MembershipType::Manager
- && raw_type.eq("4")
+ || (raw_type.eq("4")
&& data.permissions.get("editAnyCollection") == Some(&json!(true))
&& data.permissions.get("deleteAnyCollection") == Some(&json!(true))
&& data.permissions.get("createNewCollections") == Some(&json!(true)));
- // While Custom roles are disabled, a Custom member keeps their stored permissions untouched
- let custom_permissions = if new_type == MembershipType::Custom && custom_roles_enabled() {
- Some(CustomPermission::requested(&data.permissions)?)
- } else {
- None
+ let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else {
+ err!("The specified user isn't member of the organization")
};
if new_type != member_to_edit.atype
@@ -1566,11 +1535,8 @@ async fn edit_member(
}
}
- member_to_edit.set_type(new_type);
member_to_edit.access_all = access_all;
- if let Some(permissions) = &custom_permissions {
- member_to_edit.set_custom_permissions(permissions);
- }
+ member_to_edit.atype = new_type as i32;
// This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type
// We need to perform the check after changing the type since `admin` is exempt.
@@ -1642,10 +1608,7 @@ async fn bulk_delete_member(
for member_id in data.ids {
let err_msg = match delete_member_impl(&org_id, &member_id, &headers, &conn, &nt).await {
Ok(()) => String::new(),
- Err(e) => {
- warn!("Unable to delete member {}: {e:?}", member_id.escape_debug());
- e.message().to_owned()
- }
+ Err(e) => format!("{e:?}"),
};
bulk_response.push(json!(
@@ -2074,29 +2037,6 @@ async fn put_policy(
err!("Invalid or unsupported policy type")
};
- let current_policy = OrgPolicy::find_by_org_and_type(&org_id, pol_type_enum, &conn).await;
- let is_currently_enabled = current_policy.as_ref().is_some_and(|policy| policy.enabled);
-
- // Fill Assist depends on Single Organization. Match Bitwarden's dependency checks by only checking when the
- // policy changes state.
- if pol_type_enum == OrgPolicyType::FillAssist && data.enabled && !is_currently_enabled {
- let single_org_policy_enabled =
- OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::SingleOrg, &conn).await.is_some_and(|p| p.enabled);
-
- if !single_org_policy_enabled {
- err!("Turn on the Single organization policy because it is required for the Activate fill assist policy.")
- }
- }
-
- if pol_type_enum == OrgPolicyType::SingleOrg && !data.enabled && is_currently_enabled {
- let fill_assist_policy_enabled =
- OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::FillAssist, &conn).await.is_some_and(|p| p.enabled);
-
- if fill_assist_policy_enabled {
- err!("Turn off the Activate fill assist policy because it requires the Single organization policy.")
- }
- }
-
// Bitwarden only allows the Reset Password policy when Single Org policy is enabled
// Vaultwarden encouraged to use multiple orgs instead of groups because groups were not available in the past
// Now that groups are available we can enforce this option when wanted.
@@ -2129,37 +2069,6 @@ async fn put_policy(
}
}
- if pol_type_enum == OrgPolicyType::FillAssist {
- let fill_assist_data = match data.data.as_ref() {
- None | Some(Value::Null) => FillAssistPolicyData {
- rules_url: None,
- },
- Some(data) => {
- let Ok(data) = serde_json::from_value::(data.clone()) else {
- err!("Invalid data for FillAssist policy: rulesUrl has an invalid value.")
- };
- data
- }
- };
-
- if data.enabled {
- let Some(rules_url) = fill_assist_data.rules_url.filter(|url| !url.trim().is_empty()) else {
- err!("The RulesUrl field is required.")
- };
- let Ok(rules_url) = url::Url::parse(&rules_url) else {
- err!("The RulesUrl field is not a valid fully-qualified http, https, or ftp URL.")
- };
-
- if !rules_url.has_host() || !matches!(rules_url.scheme(), "http" | "https" | "ftp") {
- err!("The RulesUrl field is not a valid fully-qualified http, https, or ftp URL.")
- }
-
- if rules_url.scheme() != "https" {
- err!("RulesUrl must use HTTPS.")
- }
- }
- }
-
// When enabling the TwoFactorAuthentication policy, revoke all members that do not have 2FA
if pol_type_enum == OrgPolicyType::TwoFactorAuthentication && data.enabled {
two_factor::enforce_2fa_policy_for_org(
@@ -2191,7 +2100,7 @@ async fn put_policy(
}
log_event(
- EventType::OrganizationUserRevokedSingleOrganizationNonCompliance,
+ EventType::OrganizationUserRemoved,
&member.uuid,
&org_id,
&headers.user.uuid,
@@ -2207,7 +2116,7 @@ async fn put_policy(
}
}
- let mut policy = match current_policy {
+ let mut policy = match OrgPolicy::find_by_org_and_type(&org_id, pol_type_enum, &conn).await {
Some(p) => p,
None => OrgPolicy::new(org_id.clone(), pol_type_enum, false, "{}".to_owned()),
};
@@ -2311,10 +2220,7 @@ async fn bulk_revoke_members(
for member_id in members {
let err_msg = match revoke_member_impl(&org_id, &member_id, &headers, &conn).await {
Ok(()) => String::new(),
- Err(e) => {
- warn!("Unable to revoke member {}: {e:?}", member_id.escape_debug());
- e.message().to_owned()
- }
+ Err(e) => format!("{e:?}"),
};
bulk_response.push(json!(
@@ -2417,10 +2323,7 @@ async fn bulk_restore_members(
for member_id in data.ids {
let err_msg = match restore_member_impl(&org_id, &member_id, &headers, &conn).await {
Ok(()) => String::new(),
- Err(e) => {
- warn!("Unable to restore member {}: {e:?}", member_id.escape_debug());
- e.message().to_owned()
- }
+ Err(e) => format!("{e:?}"),
};
bulk_response.push(json!(
@@ -2573,16 +2476,13 @@ impl GroupRequest {
let org_collections = Collection::find_by_organization(org_id, conn).await;
let org_collection_ids: HashSet<&CollectionId> = org_collections.iter().map(|c| &c.uuid).collect();
if let Some(e) = self.collections.iter().find(|c| !org_collection_ids.contains(&c.id)) {
- err!(
- "Invalid collection",
- format!("Collection {} does not belong to organization {}!", e.id.escape_debug(), org_id)
- )
+ err!("Invalid collection", format!("Collection {} does not belong to organization {}!", e.id, org_id))
}
let org_memberships = Membership::find_by_org(org_id, conn).await;
let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
if let Some(e) = self.users.iter().find(|m| !org_membership_ids.contains(m)) {
- err!("Invalid member", format!("Member {} does not belong to organization {}!", e.escape_debug(), org_id))
+ err!("Invalid member", format!("Member {} does not belong to organization {}!", e, org_id))
}
Ok(())
@@ -2851,14 +2751,9 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
struct OrganizationUserRecoverAccountRequest {
- // Legacy payload
new_master_password_hash: Option,
key: Option,
- // Current payload
- authentication_data: Option,
- unlock_data: Option,
-
#[serde(default)]
reset_master_password: bool,
#[serde(default)]
@@ -2936,34 +2831,12 @@ async fn recover_account(
err!("Organization user must be confirmed for password reset functionality");
}
- let fallback_2fa_email = req.reset_two_factor
- && CONFIG.mail_enabled()
- && CONFIG.email_2fa_auto_fallback()
- && user.verified()
- && TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await.is_none();
-
- // Check the new password before the email below, so that a rejected request doesn't tell the user
- // their password was reset
- let new_password = if req.reset_master_password {
- let (new_master_password_hash, new_key) = if let (Some(authentication_data), Some(unlock_data)) =
- (req.authentication_data, req.unlock_data)
- {
- authentication_data.check(&user, &unlock_data)?;
-
- if !authentication_data.kdf.matches_user(&user) {
- err!("KDF settings do not match the user account")
- }
-
- (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
- } else if let (Some(new_master_password_hash), Some(new_key)) = (req.new_master_password_hash, req.key) {
- (new_master_password_hash, new_key)
+ let fallback_2fa_email =
+ if req.reset_two_factor && CONFIG.mail_enabled() && CONFIG.email_2fa_auto_fallback() && user.verified() {
+ TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
} else {
- err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
+ false
};
- Some((new_master_password_hash, new_key))
- } else {
- None
- };
// Sending email first ensure working email configuration and the resulting user notification.
// Also this might add some protection against security flaws and misuse
@@ -2980,8 +2853,14 @@ async fn recover_account(
err!(format!("Error sending user reset password email: {e:#?}"));
}
- if let Some((new_master_password_hash, new_key)) = new_password {
- user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
+ if req.reset_master_password {
+ if let Some(key) = req.key
+ && let Some(hash) = req.new_master_password_hash
+ {
+ user.set_password(hash.as_str(), Some(key), true, None, &conn).await?;
+ } else {
+ err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
+ }
}
if req.reset_two_factor {
@@ -3040,7 +2919,6 @@ async fn get_reset_password_details(
"kdfIterations": user.client_kdf_iter,
"kdfMemory": user.client_kdf_memory,
"kdfParallelism": user.client_kdf_parallelism,
- "masterPasswordSalt": user.master_password_salt(),
"resetPasswordKey": member.reset_password_key,
"encryptedPrivateKey": org.private_key,
})))
diff --git a/src/api/core/public.rs b/src/api/core/public.rs
index 1ee80515..fbb1f855 100644
--- a/src/api/core/public.rs
+++ b/src/api/core/public.rs
@@ -137,13 +137,9 @@ async fn ldap_import(data: Json, token: PublicToken, conn: DbConn
if CONFIG.org_groups_enabled() {
for group_data in &data.groups {
- let group_uuid = if let Some(mut group) =
+ let group_uuid = if let Some(group) =
Group::find_by_external_id_and_org(&group_data.external_id, &org_id, &conn).await
{
- if group.name != group_data.name {
- group.name = group_data.name.clone();
- group.save(&conn).await?;
- }
group.uuid
} else {
let mut group =
diff --git a/src/api/core/sends.rs b/src/api/core/sends.rs
index f8cc92bc..2a604b74 100644
--- a/src/api/core/sends.rs
+++ b/src/api/core/sends.rs
@@ -268,12 +268,11 @@ async fn post_send_file_v2(data: Json, headers: Headers, conn: DbConn)
let file_id = crate::crypto::generate_send_file_id();
let mut data_value: Value = serde_json::from_str(&send.data)?;
- let Some(o) = data_value.as_object_mut() else {
- err!("Invalid Send file data")
- };
- o.insert(String::from("id"), Value::String(file_id.clone()));
- o.insert(String::from("size"), Value::Number(file_length.into()));
- o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
+ if let Some(o) = data_value.as_object_mut() {
+ o.insert(String::from("id"), Value::String(file_id.clone()));
+ o.insert(String::from("size"), Value::Number(file_length.into()));
+ o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
+ }
send.data = serde_json::to_string(&data_value)?;
send.save(&conn).await?;
diff --git a/src/api/core/two_factor/authenticator.rs b/src/api/core/two_factor/authenticator.rs
index 55984443..99b5c67c 100644
--- a/src/api/core/two_factor/authenticator.rs
+++ b/src/api/core/two_factor/authenticator.rs
@@ -3,11 +3,11 @@ use rocket::{Route, serde::json::Json};
use crate::{
api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code},
- auth::{ClientIp, Headers, two_factor},
+ auth::{ClientIp, Headers},
crypto,
db::{
DbConn,
- models::{EventType, TwoFactor, TwoFactorType, UserId},
+ models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
},
util::NumberOrString,
};
@@ -20,23 +20,27 @@ pub fn routes() -> Vec {
#[post("/two-factor/get-authenticator", data = "")]
async fn generate_authenticator(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
+ let data: PasswordOrOtpData = data.into_inner();
let user = headers.user;
data.validate(&user, false, &conn).await?;
- let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await;
+ let type_ = TwoFactorType::Authenticator as i32;
+ let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await;
let (enabled, key) = match twofactor {
Some(tf) => (true, tf.data),
_ => (false, crypto::encode_random_bytes::<20>(&BASE32)),
};
+ // Upstream seems to also return `userVerificationToken`, but doesn't seem to be used at all.
+ // It should help prevent TOTP disclosure if someone keeps their vault unlocked.
+ // Since it doesn't seem to be used, and also does not cause any issues, lets leave it out of the response.
+ // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Controllers/TwoFactorController.cs#L94
Ok(Json(json!({
- "authenticator": json!({
- "enabled": enabled,
- "key": key,
- }),
- "userVerificationToken": two_factor::authenticator_token(user.uuid, key, enabled),
+ "enabled": enabled,
+ "key": key,
+ "object": "twoFactorAuthenticator"
})))
}
@@ -45,7 +49,8 @@ async fn generate_authenticator(data: Json, headers: Headers,
struct EnableAuthenticatorData {
key: String,
token: NumberOrString,
- user_verification_token: String,
+ master_password_hash: Option,
+ otp: Option,
}
#[post("/two-factor/authenticator", data = "")]
@@ -56,7 +61,12 @@ async fn activate_authenticator(data: Json, headers: He
let mut user = headers.user;
- two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &key, false)?;
+ PasswordOrOtpData {
+ master_password_hash: data.master_password_hash,
+ otp: data.otp,
+ }
+ .validate(&user, true, &conn)
+ .await?;
// Validate key as base32 and 20 bytes length
let decoded_key: Vec = if let Ok(decoded) = BASE32.decode(key.as_bytes()) {
@@ -74,13 +84,12 @@ async fn activate_authenticator(data: Json, headers: He
generate_recover_code(&mut user, &conn).await;
- log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
Ok(Json(json!({
- "authenticator": json!({
- "enabled": true,
- "key": key,
- }),
+ "enabled": true,
+ "key": key,
+ "object": "twoFactorAuthenticator"
})))
}
@@ -116,7 +125,8 @@ pub async fn validate_totp_code(
err!("Invalid TOTP secret")
};
- let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator, conn).await {
+ let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
+ {
Some(tf) => tf,
_ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_owned()),
};
@@ -174,25 +184,37 @@ pub async fn validate_totp_code(
#[serde(rename_all = "camelCase")]
struct DisableAuthenticatorData {
key: String,
- user_verification_token: String,
+ master_password_hash: String,
+ r#type: NumberOrString,
}
#[delete("/two-factor/authenticator", data = "")]
-async fn disable_authenticator(data: Json, headers: Headers, conn: DbConn) -> EmptyResult {
+async fn disable_authenticator(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
let user = headers.user;
+ let type_ = data.r#type.into_i32()?;
- two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &data.key, true)?;
+ if !user.check_valid_password(&data.master_password_hash) {
+ err!("Invalid password");
+ }
- if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await {
+ if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
if twofactor.data == data.key {
twofactor.delete(&conn).await?;
- log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
+ log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+ .await;
} else {
err!(format!("TOTP key for user {} does not match recorded value, cannot deactivate", &user.email));
}
}
- super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+ if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
+ super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
+ }
- Ok(())
+ Ok(Json(json!({
+ "enabled": false,
+ "keys": type_,
+ "object": "twoFactorProvider"
+ })))
}
diff --git a/src/api/core/two_factor/duo.rs b/src/api/core/two_factor/duo.rs
index 23116b2c..860979ff 100644
--- a/src/api/core/two_factor/duo.rs
+++ b/src/api/core/two_factor/duo.rs
@@ -2,12 +2,12 @@ use chrono::Utc;
use rocket::{Route, serde::json::Json};
use crate::{
+ CONFIG,
api::{
- ApiResult, EmptyResult, JsonResult, PasswordOrOtpData,
- core::log_user_event,
- core::two_factor::{VerificationTokenData, generate_recover_code},
+ ApiResult, EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event,
+ core::two_factor::generate_recover_code,
},
- auth::{Headers, two_factor, two_factor::DuoData},
+ auth::Headers,
crypto,
db::{
DbConn,
@@ -18,7 +18,55 @@ use crate::{
};
pub fn routes() -> Vec {
- routes![get_duo, activate_duo, activate_duo_put, disable_duo,]
+ routes![get_duo, activate_duo, activate_duo_put,]
+}
+
+#[derive(Serialize, Deserialize)]
+struct DuoData {
+ host: String, // Duo API hostname
+ ik: String, // client id
+ sk: String, // client secret
+}
+
+impl DuoData {
+ fn global() -> Option {
+ match (CONFIG._enable_duo(), CONFIG.duo_host()) {
+ (true, Some(host)) => Some(Self {
+ host,
+ ik: CONFIG.duo_ikey().unwrap(),
+ sk: CONFIG.duo_skey().unwrap(),
+ }),
+ _ => None,
+ }
+ }
+ fn msg(s: &str) -> Self {
+ Self {
+ host: s.into(),
+ ik: s.into(),
+ sk: s.into(),
+ }
+ }
+ fn secret() -> Self {
+ Self::msg("")
+ }
+ fn obscure(self) -> Self {
+ let mut host = self.host;
+ let mut ik = self.ik;
+ let mut sk = self.sk;
+
+ let digits = 4;
+ let replaced = "************";
+
+ host.replace_range(digits.., replaced);
+ ik.replace_range(digits.., replaced);
+ sk.replace_range(digits.., replaced);
+
+ Self {
+ host,
+ ik,
+ sk,
+ }
+ }
}
enum DuoStatus {
@@ -47,19 +95,22 @@ async fn get_duo(data: Json, headers: Headers, conn: DbConn)
data.validate(&user, false, &conn).await?;
- let (enabled, duo) = match get_user_duo_data(&user.uuid, &conn).await {
+ let data = get_user_duo_data(&user.uuid, &conn).await;
+
+ let (enabled, data) = match data {
DuoStatus::Global(_) => (true, Some(DuoData::secret())),
DuoStatus::User(data) => (true, Some(data.obscure())),
DuoStatus::Disabled(true) => (false, Some(DuoData::msg(DISABLED_MESSAGE_DEFAULT))),
DuoStatus::Disabled(false) => (false, None),
};
- let duo_json = if let Some(data) = duo.as_ref() {
+ let json = if let Some(data) = data {
json!({
"enabled": enabled,
"host": data.host,
"clientSecret": data.sk,
"clientId": data.ik,
+ "object": "twoFactorDuo"
})
} else {
json!({
@@ -67,13 +118,11 @@ async fn get_duo(data: Json, headers: Headers, conn: DbConn)
"host": null,
"clientSecret": null,
"clientId": null,
+ "object": "twoFactorDuo"
})
};
- Ok(Json(rocket::serde::json::json!({
- "duo": duo_json,
- "userVerificationToken": two_factor::duo_token(user.uuid, duo, enabled),
- })))
+ Ok(Json(json))
}
#[derive(Deserialize)]
@@ -82,7 +131,8 @@ struct EnableDuoData {
host: String,
client_secret: String,
client_id: String,
- user_verification_token: String,
+ master_password_hash: Option,
+ otp: Option,
}
impl From for DuoData {
@@ -109,7 +159,12 @@ async fn activate_duo(data: Json, headers: Headers, conn: DbConn)
let data: EnableDuoData = data.into_inner();
let mut user = headers.user;
- two_factor::validate_duo(&data.user_verification_token, &user.uuid, None, false)?;
+ PasswordOrOtpData {
+ master_password_hash: data.master_password_hash.clone(),
+ otp: data.otp.clone(),
+ }
+ .validate(&user, true, &conn)
+ .await?;
let (data, data_str) = if check_duo_fields_custom(&data) {
let data_req: DuoData = data.into();
@@ -126,15 +181,14 @@ async fn activate_duo(data: Json, headers: Headers, conn: DbConn)
generate_recover_code(&mut user, &conn).await;
- log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
Ok(Json(json!({
- "duo": json!({
- "enabled": true,
- "host": data.host,
- "clientSecret": data.sk,
- "clientId": data.ik,
- }),
+ "enabled": true,
+ "host": data.host,
+ "clientSecret": data.sk,
+ "clientId": data.ik,
+ "object": "twoFactorDuo"
})))
}
@@ -143,29 +197,6 @@ async fn activate_duo_put(data: Json, headers: Headers, conn: DbC
activate_duo(data, headers, conn).await
}
-#[delete("/two-factor/duo", data = "")]
-async fn disable_duo(data: Json, headers: Headers, conn: DbConn) -> EmptyResult {
- let user = headers.user;
-
- if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Duo, &conn).await {
- // Apply the same transformation than in `get_duo` to check we are disabling the correct one
- let duo = match to_user_duo_data(&twofactor) {
- DuoStatus::Global(_) => Some(DuoData::secret()),
- DuoStatus::User(data) => Some(data.obscure()),
- DuoStatus::Disabled(_) => None,
- };
-
- two_factor::validate_duo(&data.user_verification_token, &user.uuid, duo.as_ref(), true)?;
-
- twofactor.delete(&conn).await?;
- log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
- }
-
- super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
-
- Ok(())
-}
-
async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) -> EmptyResult {
use reqwest::{Method, header};
use std::str::FromStr;
@@ -191,15 +222,13 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
}
async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
+ let type_ = TwoFactorType::Duo as i32;
+
// If the user doesn't have an entry, disabled
- let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Duo, conn).await else {
+ let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await else {
return DuoStatus::Disabled(DuoData::global().is_some());
};
- to_user_duo_data(&twofactor)
-}
-
-fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
// If the user has the required values, we use those
if let Ok(data) = serde_json::from_str(&twofactor.data) {
return DuoStatus::User(data);
diff --git a/src/api/core/two_factor/email.rs b/src/api/core/two_factor/email.rs
index 15bfdbc3..836d1c47 100644
--- a/src/api/core/two_factor/email.rs
+++ b/src/api/core/two_factor/email.rs
@@ -5,26 +5,20 @@ use crate::{
CONFIG,
api::{
EmptyResult, JsonResult, PasswordOrOtpData,
- core::{
- log_user_event,
- two_factor::{VerificationTokenData, generate_recover_code},
- },
+ core::{log_user_event, two_factor::generate_recover_code},
},
- auth::{ClientHeaders, Headers, two_factor},
+ auth::{ClientHeaders, Headers},
crypto,
db::{
DbConn,
- models::{
- AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorIncomplete, TwoFactorType, User,
- UserId,
- },
+ models::{AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorType, User, UserId},
},
error::{Error, MapResult},
mail,
};
pub fn routes() -> Vec {
- routes![get_email, send_email_login, send_email, email, disable_email]
+ routes![get_email, send_email_login, send_email, email,]
}
#[derive(Deserialize)]
@@ -84,41 +78,19 @@ async fn send_email_login(data: Json, client_headers: Client
)
}
} else if let Some(auth_request_id) = auth_request_id {
+ let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
+ err!("AuthRequest doesn't exist", "User not found")
+ };
let Some(code) = &data.auth_request_access_code else {
err!("no auth request access code")
};
- let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, &conn).await
- else {
- err!("AuthRequest doesn't exist", "Invalid auth request or does not belong to user")
- };
- let request_expired = Utc::now().naive_utc() >= auth_request.creation_date + TimeDelta::minutes(5);
- if !auth_request.approved.unwrap_or(false)
- || auth_request.authentication_date.is_some()
- || request_expired
- || auth_request.device_type != client_headers.device_type
+ if auth_request.device_type != client_headers.device_type
|| auth_request.request_ip != client_headers.ip.ip.to_string()
|| !auth_request.check_access_code(code)
{
- err!(
- "AuthRequest doesn't exist",
- "Auth request not approved, already used or expired, or invalid device, IP or code"
- )
+ err!("AuthRequest doesn't exist", "Invalid device, IP or code")
}
- } else if let Some(device_identifier) = &data.device_identifier {
- // iOS/Android SSO logins send the email and device id but no password hash,
- // so accept a device that has a pending 2FA login for this user
- if TwoFactorIncomplete::find_by_user_and_device(&user.uuid, device_identifier, &conn).await.is_none() {
- err!(
- "Username or password is incorrect. Try again",
- format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
- )
- }
- debug!(
- "Email 2FA fallback: pending login. Username: {}. Device: {}.",
- user.email,
- device_identifier.to_string().escape_debug()
- );
} else {
err!("No password hash has been submitted.")
}
@@ -132,7 +104,7 @@ async fn send_email_login(data: Json, client_headers: Client
let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
err!(
"Username or password is incorrect. Try again",
- format!("IP: {}. Device: {}.", client_headers.ip.ip, device_identifier.to_string().escape_debug())
+ format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
)
};
@@ -144,8 +116,8 @@ async fn send_email_login(data: Json, client_headers: Client
/// Generate the token, save the data for later verification and send email to user
pub async fn send_token(user_id: &UserId, conn: &DbConn) -> EmptyResult {
- let mut twofactor =
- TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
+ let type_ = TwoFactorType::Email as i32;
+ let mut twofactor = TwoFactor::find_by_user_and_type(user_id, type_, conn).await.map_res("Two factor not found")?;
let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
@@ -168,19 +140,18 @@ async fn get_email(data: Json, headers: Headers, conn: DbConn
data.validate(&user, false, &conn).await?;
let (enabled, mfa_email) =
- if let Some(x) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
- let twofactor_data = EmailTokenData::from_json(&x.data)?;
- (true, Some(twofactor_data.email))
- } else {
- (false, None)
+ match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await {
+ Some(x) => {
+ let twofactor_data = EmailTokenData::from_json(&x.data)?;
+ (true, json!(twofactor_data.email))
+ }
+ _ => (false, serde_json::value::Value::Null),
};
- Ok(Json(rocket::serde::json::json!({
- "email": rocket::serde::json::json!({
- "enabled": enabled,
- "email": mfa_email,
- }),
- "userVerificationToken": two_factor::email_token(user.uuid, mfa_email, enabled),
+ Ok(Json(json!({
+ "email": mfa_email,
+ "enabled": enabled,
+ "object": "twoFactorEmail"
})))
}
@@ -189,22 +160,30 @@ async fn get_email(data: Json, headers: Headers, conn: DbConn
struct SendEmailData {
/// Email where 2FA codes will be sent to, can be different than user email account.
email: String,
- user_verification_token: String,
+ master_password_hash: Option,
+ otp: Option,
}
/// Send a verification email to the specified email address to check whether it exists/belongs to user.
#[post("/two-factor/send-email", data = "")]
-async fn send_email(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
+async fn send_email(data: Json, headers: Headers, conn: DbConn) -> EmptyResult {
let data: SendEmailData = data.into_inner();
let user = headers.user;
- two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email.clone(), false)?;
+ PasswordOrOtpData {
+ master_password_hash: data.master_password_hash,
+ otp: data.otp,
+ }
+ .validate(&user, false, &conn)
+ .await?;
if !CONFIG._enable_email_2fa() {
err!("Email 2FA is disabled")
}
- if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+ let type_ = TwoFactorType::Email as i32;
+
+ if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
tf.delete(&conn).await?;
}
@@ -212,13 +191,12 @@ async fn send_email(data: Json, headers: Headers, conn: DbConn) -
let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));
// Uses EmailVerificationChallenge as type to show that it's not verified yet.
- let twofactor =
- TwoFactor::new(user.uuid.clone(), TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
+ let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
twofactor.save(&conn).await?;
mail::send_token(&twofactor_data.email, &twofactor_data.last_token.map_res("Token is empty")?).await?;
- Ok(Json(json!({})))
+ Ok(())
}
#[derive(Deserialize, Serialize)]
@@ -226,7 +204,8 @@ async fn send_email(data: Json, headers: Headers, conn: DbConn) -
struct EmailData {
email: String,
token: String,
- user_verification_token: String,
+ master_password_hash: Option,
+ otp: Option,
}
/// Verify email belongs to user and can be used for 2FA email codes.
@@ -235,11 +214,17 @@ async fn email(data: Json, headers: Headers, conn: DbConn) -> JsonRes
let data: EmailData = data.into_inner();
let mut user = headers.user;
- two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email, false)?;
+ // This is the last step in the verification process, delete the otp directly afterwards
+ PasswordOrOtpData {
+ master_password_hash: data.master_password_hash,
+ otp: data.otp,
+ }
+ .validate(&user, true, &conn)
+ .await?;
- let mut twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::EmailVerificationChallenge, &conn)
- .await
- .map_res("Two factor not found")?;
+ let type_ = TwoFactorType::EmailVerificationChallenge as i32;
+ let mut twofactor =
+ TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await.map_res("Two factor not found")?;
let mut email_data = EmailTokenData::from_json(&twofactor.data)?;
@@ -258,26 +243,13 @@ async fn email(data: Json, headers: Headers, conn: DbConn) -> JsonRes
generate_recover_code(&mut user, &conn).await;
- log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
- Ok(Json(json!({})))
-}
-
-#[delete("/two-factor/email", data = "")]
-async fn disable_email(data: Json, headers: Headers, conn: DbConn) -> EmptyResult {
- let user = headers.user;
-
- if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
- let twofactor_data = EmailTokenData::from_json(&twofactor.data)?;
- two_factor::validate_email(&data.user_verification_token, &user.uuid, twofactor_data.email, true)?;
-
- twofactor.delete(&conn).await?;
- log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
- }
-
- super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
-
- Ok(())
+ Ok(Json(json!({
+ "email": email_data.email,
+ "enabled": "true",
+ "object": "twoFactorEmail"
+ })))
}
/// Validate the email code when used as TwoFactor token mechanism
@@ -289,8 +261,9 @@ pub async fn validate_email_code_str(
conn: &DbConn,
) -> EmptyResult {
let mut email_data = EmailTokenData::from_json(data)?;
- let mut twofactor =
- TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
+ let mut twofactor = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email as i32, conn)
+ .await
+ .map_res("Two factor not found")?;
let Some(issued_token) = &email_data.last_token else {
err!(
format!("No token available! IP: {ip}"),
@@ -302,7 +275,7 @@ pub async fn validate_email_code_str(
if !crypto::ct_eq(issued_token, token) {
email_data.add_attempt();
- if email_data.attempts >= u64::from(CONFIG.email_attempts_limit()) {
+ if email_data.attempts >= CONFIG.email_attempts_limit() {
email_data.reset_token();
}
twofactor.data = email_data.to_json();
@@ -321,7 +294,7 @@ pub async fn validate_email_code_str(
twofactor.save(conn).await?;
let dt = DateTime::from_timestamp(email_data.token_sent, 0).expect("Email token timestamp invalid.").naive_utc();
- let max_time = i64::from(CONFIG.email_expiration_time());
+ let max_time = CONFIG.email_expiration_time().cast_signed();
if dt + TimeDelta::try_seconds(max_time).unwrap() < Utc::now().naive_utc() {
err!(
"Token has expired",
diff --git a/src/api/core/two_factor/mod.rs b/src/api/core/two_factor/mod.rs
index cfec98c7..14bdafd5 100644
--- a/src/api/core/two_factor/mod.rs
+++ b/src/api/core/two_factor/mod.rs
@@ -7,7 +7,10 @@ use serde_json::Value;
use crate::{
CONFIG,
- api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_event},
+ api::{
+ EmptyResult, JsonResult, PasswordOrOtpData,
+ core::{log_event, log_user_event},
+ },
auth::Headers,
crypto,
db::{
@@ -18,6 +21,7 @@ use crate::{
},
},
mail,
+ util::NumberOrString,
};
pub mod authenticator;
@@ -65,7 +69,7 @@ pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data
}
pub fn routes() -> Vec {
- let mut routes = routes![get_twofactor, get_recover, get_device_verification_settings];
+ let mut routes = routes![get_twofactor, get_recover, disable_twofactor, get_device_verification_settings];
routes.append(&mut authenticator::routes());
routes.append(&mut duo::routes());
@@ -77,12 +81,6 @@ pub fn routes() -> Vec {
routes
}
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct VerificationTokenData {
- user_verification_token: String,
-}
-
#[get("/two-factor")]
async fn get_twofactor(headers: Headers, conn: DbConn) -> Json {
let twofactors = TwoFactor::find_by_user(&headers.user.uuid, &conn).await;
@@ -122,14 +120,45 @@ async fn generate_recover_code(user: &mut User, conn: &DbConn) {
}
}
-/// Call after a 2FA provider, or one of its keys, was removed. No remembered device may keep skipping
-/// the providers that are left, and once every provider is gone the 2FA policy applies.
-pub async fn check_2fa_state(user: &User, device_type: i32, ip: &std::net::IpAddr, conn: &DbConn) -> EmptyResult {
- Device::clear_twofactor_remember_by_user(&user.uuid, conn).await?;
- if TwoFactor::find_by_user(&user.uuid, conn).await.is_empty() {
- enforce_2fa_policy(user, &user.uuid, device_type, ip, conn).await?;
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct DisableTwoFactorData {
+ master_password_hash: Option,
+ otp: Option,
+ r#type: NumberOrString,
+}
+
+#[put("/two-factor/disable", data = "")]
+async fn disable_twofactor(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
+ let data: DisableTwoFactorData = data.into_inner();
+ let user = headers.user;
+
+ // Delete directly after a valid token has been provided
+ PasswordOrOtpData {
+ master_password_hash: data.master_password_hash,
+ otp: data.otp,
}
- Ok(())
+ .validate(&user, true, &conn)
+ .await?;
+
+ let type_ = data.r#type.into_i32()?;
+
+ if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
+ twofactor.delete(&conn).await?;
+ Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
+ log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+ .await;
+ }
+
+ if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
+ enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
+ }
+
+ Ok(Json(json!({
+ "enabled": false,
+ "type": type_,
+ "object": "twoFactorProvider"
+ })))
}
pub async fn enforce_2fa_policy(
@@ -151,7 +180,7 @@ pub async fn enforce_2fa_policy(
member.save(conn).await?;
log_event(
- EventType::OrganizationUserRevokedTwoFactorNonCompliance,
+ EventType::OrganizationUserRevoked,
&member.uuid,
&member.org_uuid,
act_user_id,
@@ -185,16 +214,8 @@ pub async fn enforce_2fa_policy_for_org(
member.revoke();
member.save(conn).await?;
- log_event(
- EventType::OrganizationUserRevokedTwoFactorNonCompliance,
- &member.uuid,
- org_id,
- act_user_id,
- device_type,
- ip,
- conn,
- )
- .await;
+ log_event(EventType::OrganizationUserRevoked, &member.uuid, org_id, act_user_id, device_type, ip, conn)
+ .await;
}
}
@@ -204,7 +225,7 @@ pub async fn enforce_2fa_policy_for_org(
pub async fn send_incomplete_2fa_notifications(pool: DbPool) {
debug!("Sending notifications for incomplete 2FA logins");
- if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
+ if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
return;
}
@@ -214,21 +235,11 @@ pub async fn send_incomplete_2fa_notifications(pool: DbPool) {
};
let now = Utc::now().naive_utc();
- let Some(time_limit) = TimeDelta::try_minutes(i64::from(CONFIG.incomplete_2fa_time_limit())) else {
- error!("Failed to calculate the time limit for sending incomplete 2fa attempts");
- return;
- };
- let Some(time_before) = now.checked_sub_signed(time_limit) else {
- error!("Failed to calculate the timestamp for sending incomplete 2fa attempts");
- return;
- };
-
+ let time_limit = TimeDelta::try_minutes(CONFIG.incomplete_2fa_time_limit()).unwrap();
+ let time_before = now - time_limit;
let incomplete_logins = TwoFactorIncomplete::find_logins_before(&time_before, &conn).await;
for login in incomplete_logins {
- let Some(user) = User::find_by_uuid(&login.user_uuid, &conn).await else {
- error!("User '{}', not found!", login.user_uuid);
- continue;
- };
+ let user = User::find_by_uuid(&login.user_uuid, &conn).await.expect("User not found");
info!(
"User {} did not complete a 2FA login within the configured time limit. IP: {}",
user.email, login.ip_address
diff --git a/src/api/core/two_factor/protected_actions.rs b/src/api/core/two_factor/protected_actions.rs
index bf757d14..c0c1b5e8 100644
--- a/src/api/core/two_factor/protected_actions.rs
+++ b/src/api/core/two_factor/protected_actions.rs
@@ -72,7 +72,8 @@ async fn request_otp(headers: Headers, conn: DbConn) -> EmptyResult {
let user = headers.user;
// Only one Protected Action per user is allowed to take place, delete the previous one
- if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions, &conn).await {
+ if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions as i32, &conn).await
+ {
let pa_data = ProtectedActionData::from_json(&pa.data)?;
let elapsed = pa_data.time_since_sent().num_seconds();
let delay = 30;
@@ -124,28 +125,27 @@ pub async fn validate_protected_action_otp(
delete_if_valid: bool,
conn: &DbConn,
) -> EmptyResult {
- let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions, conn)
+ let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions as i32, conn)
.await
.map_res("Protected action token not found, try sending the code again or restart the process")?;
let mut pa_data = ProtectedActionData::from_json(&pa.data)?;
+ pa_data.add_attempt();
+ pa.data = pa_data.to_json();
// Fail after x attempts if the token has been used too many times.
// Don't delete it, as we use it to keep track of attempts.
- if pa_data.attempts >= u64::from(CONFIG.email_attempts_limit()) {
+ if pa_data.attempts >= CONFIG.email_attempts_limit() {
err!("Token has expired")
}
// Check if the token has expired (Using the email 2fa expiration time)
- let max_time = i64::from(CONFIG.email_expiration_time());
+ let max_time = CONFIG.email_expiration_time().cast_signed();
if pa_data.time_since_sent().num_seconds() > max_time {
pa.delete(conn).await?;
err!("Token has expired")
}
if !crypto::ct_eq(&pa_data.token, otp) {
- pa_data.add_attempt();
- pa.data = pa_data.to_json();
-
pa.save(conn).await?;
err!("Token is invalid")
}
diff --git a/src/api/core/two_factor/webauthn.rs b/src/api/core/two_factor/webauthn.rs
index 7eab5546..a3a9b21b 100644
--- a/src/api/core/two_factor/webauthn.rs
+++ b/src/api/core/two_factor/webauthn.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashSet, str::FromStr, sync::LazyLock, time::Duration};
+use std::{str::FromStr, sync::LazyLock, time::Duration};
use rocket::{Route, serde::json::Json};
use serde_json::Value;
@@ -18,18 +18,16 @@ use crate::{
CONFIG,
api::{
EmptyResult, JsonResult, PasswordOrOtpData,
- core::{
- log_user_event,
- two_factor::{VerificationTokenData, generate_recover_code},
- },
+ core::{log_user_event, two_factor::generate_recover_code},
},
- auth::{Headers, two_factor},
+ auth::Headers,
crypto::ct_eq,
db::{
DbConn,
- models::{EventType, TwoFactor, TwoFactorType, UserId},
+ models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
},
error::Error,
+ util::NumberOrString,
};
static WEBAUTHN: LazyLock = LazyLock::new(|| {
@@ -47,14 +45,7 @@ static WEBAUTHN: LazyLock = LazyLock::new(|| {
});
pub fn routes() -> Vec {
- routes![
- get_webauthn,
- generate_webauthn_challenge,
- activate_webauthn,
- activate_webauthn_put,
- delete_webauthn,
- delete_webauthns
- ]
+ routes![get_webauthn, generate_webauthn_challenge, activate_webauthn, activate_webauthn_put, delete_webauthn,]
}
// Some old u2f structs still needed for migrating from u2f to WebAuthn
@@ -128,36 +119,34 @@ async fn get_webauthn(data: Json, headers: Headers, conn: DbC
data.validate(&user, false, &conn).await?;
let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
- let keys: Vec = registrations.iter().map(|r| r.id).collect();
let registrations_json: Vec = registrations.iter().map(WebauthnRegistration::to_json).collect();
Ok(Json(json!({
- "webAuthn": json!({
- "enabled": enabled,
- "keys": registrations_json,
- }),
- "userVerificationToken": two_factor::webauthn_token(user.uuid, keys, enabled),
+ "enabled": enabled,
+ "keys": registrations_json,
+ "object": "twoFactorWebAuthn"
})))
}
#[post("/two-factor/get-webauthn-challenge", data = "")]
-async fn generate_webauthn_challenge(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
+async fn generate_webauthn_challenge(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
+ let data: PasswordOrOtpData = data.into_inner();
let user = headers.user;
- let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
- let keys: Vec = registrations.iter().map(|r| r.id).collect();
- let creds = registrations
+ data.validate(&user, false, &conn).await?;
+
+ let registrations = get_webauthn_registrations(&user.uuid, &conn)
+ .await?
+ .1
.into_iter()
.map(|r| r.credential.cred_id().to_owned()) // We return the credentialIds to the clients to avoid double registering
.collect();
- two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, enabled)?;
-
let (mut challenge, state) = WEBAUTHN.start_passkey_registration(
Uuid::from_str(&user.uuid).expect("Failed to parse UUID"), // Should never fail
&user.email,
user.display_name(),
- Some(creds),
+ Some(registrations),
)?;
let mut state = serde_json::to_value(&state)?;
@@ -177,19 +166,17 @@ async fn generate_webauthn_challenge(data: Json, headers:
let mut challenge_value = serde_json::to_value(challenge.public_key)?;
challenge_value["status"] = "ok".into();
challenge_value["errorMessage"] = "".into();
-
- Ok(Json(json!({
- "options": challenge_value
- })))
+ Ok(Json(challenge_value))
}
#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
struct EnableWebauthnData {
- id: i32,
+ id: NumberOrString, // 1..5
name: String,
device_response: RegisterPublicKeyCredentialCopy,
- user_verification_token: String,
+ master_password_hash: Option,
+ otp: Option,
}
#[derive(Debug, Deserialize)]
@@ -270,14 +257,16 @@ async fn activate_webauthn(data: Json, headers: Headers, con
let data: EnableWebauthnData = data.into_inner();
let mut user = headers.user;
- let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
- let keys: Vec = registrations.iter().map(|r| r.id).collect();
- two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, !keys.is_empty())?;
+ PasswordOrOtpData {
+ master_password_hash: data.master_password_hash,
+ otp: data.otp,
+ }
+ .validate(&user, true, &conn)
+ .await?;
// Retrieve and delete the saved challenge state
- let state = if let Some(tf) =
- TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::WebauthnRegisterChallenge, &conn).await
- {
+ let type_ = TwoFactorType::WebauthnRegisterChallenge as i32;
+ let state = if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
let state: PasskeyRegistration = serde_json::from_str(&tf.data)?;
tf.delete(&conn).await?;
state
@@ -288,9 +277,10 @@ async fn activate_webauthn(data: Json, headers: Headers, con
// Verify the credentials with the saved state
let credential = WEBAUTHN.finish_passkey_registration(&data.device_response.into(), &state)?;
+ let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
// TODO: Check for repeated ID's
registrations.push(WebauthnRegistration {
- id: data.id,
+ id: data.id.into_i32()?,
name: data.name,
migrated: false,
@@ -303,13 +293,13 @@ async fn activate_webauthn(data: Json, headers: Headers, con
.await?;
generate_recover_code(&mut user, &conn).await;
- log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ let keys_json: Vec = registrations.iter().map(WebauthnRegistration::to_json).collect();
Ok(Json(json!({
- "webAuthn": json!({
- "enabled": true,
- "keys": registrations.iter().map(WebauthnRegistration::to_json).collect::>(),
- }),
+ "enabled": true,
+ "keys": keys_json,
+ "object": "twoFactorU2f"
})))
}
@@ -320,87 +310,58 @@ async fn activate_webauthn_put(data: Json, headers: Headers,
#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
-struct DeleteWebauthnData {
- id: i32,
- user_verification_token: String,
+struct DeleteU2FData {
+ id: NumberOrString,
+ master_password_hash: String,
}
#[delete("/two-factor/webauthn", data = "")]
-async fn delete_webauthn(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
- inner_delete_webauthns(&data.user_verification_token, |key| key.id != data.id, headers, &conn).await
-}
+async fn delete_webauthn(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
+ let id = data.id.into_i32()?;
+ if !headers.user.check_valid_password(&data.master_password_hash) {
+ err!("Invalid password");
+ }
-#[delete("/two-factor/webauthn/all", data = "")]
-async fn delete_webauthns(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
- inner_delete_webauthns(&data.user_verification_token, |_| false, headers, &conn).await
-}
-
-async fn inner_delete_webauthns(
- token: &str,
- retain: impl Fn(&WebauthnRegistration) -> bool,
- headers: Headers,
- conn: &DbConn,
-) -> JsonResult {
- let user = headers.user;
-
- let Some(mut tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Webauthn, conn).await else {
+ let Some(mut tf) =
+ TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &conn).await
+ else {
err!("Webauthn data not found!")
};
- let mut keys: Vec = serde_json::from_str(&tf.data)?;
- let keys_id: Vec = keys.iter().map(|r| r.id).collect();
+ let mut data: Vec = serde_json::from_str(&tf.data)?;
- two_factor::validate_webauthn(token, &user.uuid, &keys_id, true)?;
-
- let mut removed: HashSet> = HashSet::new();
- let mut migrated = false;
-
- keys.retain(|key| {
- let retained = retain(key);
- if !retained {
- removed.insert(key.credential.cred_id().to_vec());
- migrated = migrated || key.migrated;
- }
- retained
- });
-
- if removed.is_empty() {
+ let Some(item_pos) = data.iter().position(|r| r.id == id) else {
err!("Webauthn entry not found")
- }
+ };
- if keys.is_empty() {
- tf.delete(conn).await?;
- log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, conn).await;
- } else {
- tf.data = serde_json::to_string(&keys)?;
- tf.save(conn).await?;
- drop(tf);
- }
+ let removed_item = data.remove(item_pos);
+ tf.data = serde_json::to_string(&data)?;
+ tf.save(&conn).await?;
+ drop(tf);
+ Device::clear_twofactor_remember_by_user(&headers.user.uuid, &conn).await?;
// If entry is migrated from u2f, delete the u2f entry as well
- if migrated && let Some(mut u2f) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::U2f, conn).await {
- let Ok(mut data) = serde_json::from_str::>(&u2f.data) else {
+ if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await
+ {
+ let mut data: Vec = if let Ok(d) = serde_json::from_str(&u2f.data) {
+ d
+ } else {
err!("Error parsing U2F data")
};
- data.retain(|old| !removed.contains(&old.reg.key_handle));
+ data.retain(|r| r.reg.key_handle != removed_item.credential.cred_id().as_slice());
+ let new_data_str = serde_json::to_string(&data)?;
- if data.is_empty() {
- u2f.delete(conn).await?;
- } else {
- let new_data_str = serde_json::to_string(&data)?;
- u2f.data = new_data_str;
- u2f.save(conn).await?;
- }
+ u2f.data = new_data_str;
+ u2f.save(&conn).await?;
}
- super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, conn).await?;
+ let keys_json: Vec = data.iter().map(WebauthnRegistration::to_json).collect();
Ok(Json(json!({
- "webAuthn": json!({
- "enabled": !keys.is_empty(),
- "keys": keys.iter().map(WebauthnRegistration::to_json).collect::>(),
- }),
+ "enabled": true,
+ "keys": keys_json,
+ "object": "twoFactorU2f"
})))
}
@@ -408,7 +369,8 @@ pub async fn get_webauthn_registrations(
user_id: &UserId,
conn: &DbConn,
) -> Result<(bool, Vec), Error> {
- match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Webauthn, conn).await {
+ let type_ = TwoFactorType::Webauthn as i32;
+ match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
Some(tf) => Ok((tf.enabled, serde_json::from_str(&tf.data)?)),
None => Ok((false, Vec::new())), // If no data, return empty list
}
@@ -455,9 +417,8 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &DbConn) -> JsonRes
}
pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &DbConn) -> EmptyResult {
- let mut state = if let Some(tf) =
- TwoFactor::find_by_user_and_type(user_id, TwoFactorType::WebauthnLoginChallenge, conn).await
- {
+ let type_ = TwoFactorType::WebauthnLoginChallenge as i32;
+ let mut state = if let Some(tf) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
let state: PasskeyAuthentication = serde_json::from_str(&tf.data)?;
tf.delete(conn).await?;
state
diff --git a/src/api/core/two_factor/yubikey.rs b/src/api/core/two_factor/yubikey.rs
index 17c4e9a0..54f0adb5 100644
--- a/src/api/core/two_factor/yubikey.rs
+++ b/src/api/core/two_factor/yubikey.rs
@@ -10,12 +10,9 @@ use crate::{
CONFIG,
api::{
EmptyResult, JsonResult, PasswordOrOtpData,
- core::{
- log_user_event,
- two_factor::{VerificationTokenData, generate_recover_code},
- },
+ core::{log_user_event, two_factor::generate_recover_code},
},
- auth::{Headers, two_factor},
+ auth::Headers,
db::{
DbConn,
models::{EventType, TwoFactor, TwoFactorType},
@@ -25,7 +22,7 @@ use crate::{
};
pub fn routes() -> Vec {
- routes![generate_yubikey, activate_yubikey, activate_yubikey_put, delete_yubikeys,]
+ routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
}
struct HttpClientTransport {
@@ -63,7 +60,8 @@ struct EnableYubikeyData {
key4: Option,
key5: Option,
nfc: bool,
- user_verification_token: String,
+ master_password_hash: Option,
+ otp: Option,
}
#[derive(Deserialize, Serialize, Debug)]
@@ -127,47 +125,55 @@ async fn generate_yubikey(data: Json, headers: Headers, conn:
data.validate(&user, false, &conn).await?;
let user_id = &user.uuid;
+ let yubikey_type = TwoFactorType::YubiKey as i32;
- let (enabled, keys, yubikey_json) =
- if let Some(r) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::YubiKey, &conn).await {
- let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
- let enabled = !yubikey_metadata.keys.is_empty();
- let mut result = jsonify_yubikeys(yubikey_metadata.keys.clone());
- result["enabled"] = Value::Bool(enabled);
- result["nfc"] = Value::Bool(yubikey_metadata.nfc);
- (enabled, yubikey_metadata.keys, result)
- } else {
- (false, Vec::new(), json!({"enabled": false}))
- };
- Ok(Json(json!({
- "yubiKey": yubikey_json,
- "userVerificationToken": two_factor::yubikey_token(user.uuid, keys, enabled),
- })))
+ let r = TwoFactor::find_by_user_and_type(user_id, yubikey_type, &conn).await;
+
+ if let Some(r) = r {
+ let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
+
+ let mut result = jsonify_yubikeys(yubikey_metadata.keys);
+
+ result["enabled"] = Value::Bool(true);
+ result["nfc"] = Value::Bool(yubikey_metadata.nfc);
+ result["object"] = Value::String("twoFactorU2f".to_owned());
+
+ Ok(Json(result))
+ } else {
+ Ok(Json(json!({
+ "enabled": false,
+ "object": "twoFactorU2f",
+ })))
+ }
}
#[post("/two-factor/yubikey", data = "")]
async fn activate_yubikey(data: Json, headers: Headers, conn: DbConn) -> JsonResult {
let data: EnableYubikeyData = data.into_inner();
- let yubikeys = parse_yubikeys(&data);
let mut user = headers.user;
+ PasswordOrOtpData {
+ master_password_hash: data.master_password_hash.clone(),
+ otp: data.otp.clone(),
+ }
+ .validate(&user, true, &conn)
+ .await?;
+
+ // Check if we already have some data
+ let mut yubikey_data =
+ match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey as i32, &conn).await {
+ Some(data) => data,
+ None => TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new()),
+ };
+
+ let yubikeys = parse_yubikeys(&data);
+
if yubikeys.is_empty() {
// Return an error to prevent saving empty keys which would cause users not being able to login anymore.
// To remove all keys users should click the `Deactivate all keys` button
err!("A key is required.");
}
- // Check if we already have some data
- let mut yubikey_data =
- if let Some(yd) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
- let ym: YubikeyMetadata = serde_json::from_str(&yd.data)?;
- two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &ym.keys, !ym.keys.is_empty())?;
- yd
- } else {
- two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &Vec::new(), false)?;
- TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new())
- };
-
// Ensure they are valid OTPs
for yubikey in &yubikeys {
if yubikey.is_empty() || yubikey.len() == 12 {
@@ -189,12 +195,15 @@ async fn activate_yubikey(data: Json, headers: Headers, conn:
generate_recover_code(&mut user, &conn).await;
- log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+ log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
let mut result = jsonify_yubikeys(yubikey_metadata.keys);
+
result["enabled"] = Value::Bool(true);
result["nfc"] = Value::Bool(yubikey_metadata.nfc);
- Ok(Json(json!({"yubiKey": result})))
+ result["object"] = Value::String("twoFactorU2f".to_owned());
+
+ Ok(Json(result))
}
#[put("/two-factor/yubikey", data = "")]
@@ -202,23 +211,6 @@ async fn activate_yubikey_put(data: Json, headers: Headers, c
activate_yubikey(data, headers, conn).await
}
-#[delete("/two-factor/yubikey", data = "")]
-async fn delete_yubikeys(data: Json, headers: Headers, conn: DbConn) -> EmptyResult {
- let user = headers.user;
-
- if let Some(r) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
- let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
- two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &yubikey_metadata.keys, true)?;
-
- r.delete(&conn).await?;
- log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
- }
-
- super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
-
- Ok(())
-}
-
pub async fn validate_yubikey_login(response: &str, twofactor_data: &str) -> EmptyResult {
if response.len() != 44 {
err!("Invalid Yubikey OTP length");
diff --git a/src/api/icons.rs b/src/api/icons.rs
index 1c7b2a57..05027959 100644
--- a/src/api/icons.rs
+++ b/src/api/icons.rs
@@ -62,7 +62,7 @@ static CLIENT: LazyLock = LazyLock::new(|| {
// Generate the cookie store
let cookie_store = Arc::new(Jar::default());
- let icon_download_timeout = Duration::from_secs(u64::from(CONFIG.icon_download_timeout()));
+ let icon_download_timeout = Duration::from_secs(CONFIG.icon_download_timeout());
let pool_idle_timeout = Duration::from_secs(10);
// Reuse the client between requests
get_reqwest_client_builder(true)
@@ -193,14 +193,14 @@ async fn get_cached_icon(path: &str) -> Option> {
None
}
-async fn file_is_expired(path: &str, ttl: u32) -> Result {
+async fn file_is_expired(path: &str, ttl: u64) -> Result {
let operator = CONFIG.opendal_operator_for_path_type(&PathType::IconCache)?;
let meta = operator.stat(path).await?;
let modified =
meta.last_modified().ok_or_else(|| std::io::Error::other(format!("No last modified time for `{path}`")))?;
let age = SystemTime::now().duration_since(modified.into())?;
- Ok(ttl > 0 && u64::from(ttl) <= age.as_secs())
+ Ok(ttl > 0 && ttl <= age.as_secs())
}
async fn icon_is_negcached(path: &str) -> bool {
@@ -264,7 +264,7 @@ fn get_favicons_node(dom: Tokenizer, FaviconEmitter>, icons: &m
TAG_BASE => {
base_url = if let Some(href) = token.tag.attributes.get(ATTR_HREF) {
let href = std::str::from_utf8(href).unwrap_or_default();
- debug!("Found base href: {}", href.escape_debug());
+ debug!("Found base href: {href}");
match base_url.join(href) {
Ok(inner_url) => inner_url,
_ => continue,
@@ -524,7 +524,7 @@ async fn download_icon(domain: &str) -> Result<(Bytes, Option<&str>), Error> {
Ok(())
}) {
Ok(_) => {
- // Also check if the size is at least 67 bytes, which seems to be the smallest png I could create
+ // Also check if the size is atleast 67 bytes, which seems to be the smallest png i could create
if body.len() >= 67 {
// Check if the icon type is allowed, else try an icon from the list.
icon_type = get_icon_type(&body);
@@ -663,17 +663,6 @@ impl reqwest::cookie::CookieStore for Jar {
use time::Duration;
let mut cookie_store = self.0.write().unwrap();
-
- // The store only skips expired cookies when reading them, so remove them here or they are kept forever
- let expired: Vec<_> = cookie_store
- .iter_any()
- .filter(|c| c.is_expired())
- .map(|c| (String::from(&c.domain), String::from(&c.path), c.name().to_owned()))
- .collect();
- for (domain, path, name) in expired {
- cookie_store.remove(&domain, &path, &name);
- }
-
let cookies = cookie_headers.filter_map(|val| {
std::str::from_utf8(val.as_bytes())
.map_err(RawCookieParseError::from)
diff --git a/src/api/identity.rs b/src/api/identity.rs
index 4608ed77..ac05386a 100644
--- a/src/api/identity.rs
+++ b/src/api/identity.rs
@@ -46,7 +46,6 @@ pub fn routes() -> Vec {
post_prelogin,
prelogin_password,
register_verification_email,
- register_verification_email_clicked,
register_finish,
prevalidate,
authorize,
@@ -112,14 +111,14 @@ async fn login(data: Form, client_header: ClientHeaders, conn: DbCo
.await?;
Ok(Json(tokens.to_json()))
}
- t => err!("Invalid type", t.escape_debug().to_string()),
+ t => err!("Invalid type", t),
};
if let Some(user_id) = user_id {
match &login_result {
Ok(_) => {
log_user_event(
- EventType::UserLoggedIn,
+ EventType::UserLoggedIn as i32,
&user_id,
client_header.device_type,
&client_header.ip.ip,
@@ -129,7 +128,8 @@ async fn login(data: Form, client_header: ClientHeaders, conn: DbCo
}
Err(e) => {
if let Some(ev) = e.get_event() {
- log_user_event(ev.event, &user_id, client_header.device_type, &client_header.ip.ip, &conn).await;
+ log_user_event(ev.event as i32, &user_id, client_header.device_type, &client_header.ip.ip, &conn)
+ .await;
}
}
}
@@ -448,9 +448,9 @@ async fn password_login(data: ConnectData, user_id: &mut Option, conn: &
if user.verified_at.is_none() && CONFIG.mail_enabled() && CONFIG.signups_verify() {
if user.last_verifying_at.is_none()
|| now.signed_duration_since(user.last_verifying_at.unwrap()).num_seconds()
- > i64::from(CONFIG.signups_verify_resend_time())
+ > CONFIG.signups_verify_resend_time().cast_signed()
{
- let resend_limit = i32::from(CONFIG.signups_verify_resend_limit());
+ let resend_limit = CONFIG.signups_verify_resend_limit().cast_signed();
if resend_limit == 0 || user.login_verify_count < resend_limit {
// We want to send another email verification if we require signups to verify
// their email address, and we haven't sent them a reminder in a while...
@@ -904,7 +904,7 @@ async fn twofactor_auth(
enforce_2fa_policy(user, &user.uuid, device.atype, &ip.ip, conn).await?;
- log_user_event(EventType::UserRecovered2fa, &user.uuid, device.atype, &ip.ip, conn).await;
+ log_user_event(EventType::UserRecovered2fa as i32, &user.uuid, device.atype, &ip.ip, conn).await;
if CONFIG.mail_enabled()
&& let Err(e) =
@@ -974,7 +974,7 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
}
Some(tf_type @ TwoFactorType::YubiKey) => {
- let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
+ let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
err!("No YubiKey devices registered")
};
@@ -986,7 +986,7 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
}
Some(tf_type @ TwoFactorType::Email) => {
- let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
+ let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
err!("No twofactor email registered")
};
@@ -1035,13 +1035,6 @@ struct RegisterVerificationData {
// receiveMarketingEmails: bool,
}
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct RegisterVerificationEmailClickedData {
- email: String,
- email_verification_token: String,
-}
-
#[derive(rocket::Responder)]
enum RegisterVerificationResponse {
#[response(status = 204)]
@@ -1104,25 +1097,6 @@ async fn register_verification_email(
}
}
-#[post("/accounts/register/verification-email-clicked", data = "")]
-async fn register_verification_email_clicked(
- data: Json,
- conn: DbConn,
-) -> EmptyResult {
- let data = data.into_inner();
- let token_valid = auth::decode_register_verify(&data.email_verification_token)
- .is_ok_and(|claims| claims.verified && claims.sub.eq_ignore_ascii_case(&data.email));
- let user_exists = User::find_by_mail(&data.email, &conn)
- .await
- .is_some_and(|user| !user.password_hash.is_empty() || user.private_key.is_some());
-
- if !token_valid || user_exists {
- err!("Expired link. Please restart registration or try logging in. You may already have an account")
- }
-
- Ok(())
-}
-
#[post("/accounts/register/finish", data = "")]
async fn register_finish(data: Json, ip: ClientIp, conn: DbConn) -> JsonResult {
crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
diff --git a/src/api/mod.rs b/src/api/mod.rs
index 450c2113..1b3b5a7b 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -25,12 +25,12 @@ pub use crate::api::{
notifications::routes as notifications_routes,
notifications::{AnonymousNotify, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
push::{
- push_cipher_update, push_folder_update, push_logout, push_logout_to_relay, push_send_update, push_user_update,
- register_push_device, unregister_push_device,
+ push_cipher_update, push_folder_update, push_logout, push_send_update, push_user_update, register_push_device,
+ unregister_push_device,
},
web::catchers as web_catchers,
web::routes as web_routes,
- web::{STATIC_FILES, invalidate_css_cache},
+ web::{invalidate_css_cache, static_files},
};
use crate::{
CONFIG,
@@ -46,7 +46,7 @@ pub type JsonResult = ApiResult>;
pub type EmptyResult = ApiResult<()>;
// Common structs representing JSON data received
-#[derive(Debug, Deserialize)]
+#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
struct PasswordOrOtpData {
#[serde(alias = "MasterPasswordHash")]
diff --git a/src/api/notifications.rs b/src/api/notifications.rs
index 3bce7219..8bfcd518 100644
--- a/src/api/notifications.rs
+++ b/src/api/notifications.rs
@@ -1,7 +1,7 @@
use std::{
net::IpAddr,
sync::{Arc, LazyLock},
- time::{Duration, Instant},
+ time::Duration,
};
use chrono::{NaiveDateTime, Utc};
@@ -41,14 +41,6 @@ pub static WS_ANONYMOUS_SUBSCRIPTIONS: LazyLock = LazyLock::new(|| !CONFIG.enable_websocket() && !CONFIG.push_enabled());
pub fn routes() -> Vec {
@@ -164,16 +156,12 @@ fn websockets_hub<'r>(
rocket_ws::Stream! { ws => {
let mut ws = ws;
let _guard = guard;
- let mut interval = tokio::time::interval(WS_PING_INTERVAL);
- let mut last_received = Instant::now();
+ let mut interval = tokio::time::interval(Duration::from_secs(15));
loop {
tokio::select! {
res = ws.next() => {
match res {
Some(Ok(message)) => {
- // Any message, including a Pong, means the client is still there
- last_received = Instant::now();
-
match message {
// Respond to any pings
Message::Ping(ping) => yield Message::Pong(ping),
@@ -207,13 +195,7 @@ fn websockets_hub<'r>(
}
}
- _ = interval.tick() => {
- // The client stopped responding without closing the connection, drop it
- if last_received.elapsed() > WS_CLIENT_TIMEOUT {
- break;
- }
- yield Message::Ping(PING.to_vec());
- }
+ _ = interval.tick() => yield Message::Ping(create_ping())
}
}
}}
@@ -247,16 +229,12 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
rocket_ws::Stream! { ws => {
let mut ws = ws;
let _guard = guard;
- let mut interval = tokio::time::interval(WS_PING_INTERVAL);
- let mut last_received = Instant::now();
+ let mut interval = tokio::time::interval(Duration::from_secs(15));
loop {
tokio::select! {
res = ws.next() => {
match res {
Some(Ok(message)) => {
- // Any message, including a Pong, means the client is still there
- last_received = Instant::now();
-
match message {
// Respond to any pings
Message::Ping(ping) => yield Message::Pong(ping),
@@ -290,13 +268,7 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
}
}
- _ = interval.tick() => {
- // The client stopped responding without closing the connection, drop it
- if last_received.elapsed() > WS_CLIENT_TIMEOUT {
- break;
- }
- yield Message::Ping(PING.to_vec());
- }
+ _ = interval.tick() => yield Message::Ping(create_ping())
}
}
}}
@@ -359,7 +331,6 @@ fn convert_option>(option: Option) -> Value {
const RECORD_SEPARATOR: u8 = 0x1e;
const INITIAL_RESPONSE: [u8; 3] = [0x7b, 0x7d, RECORD_SEPARATOR]; // {, },
-const PING: [u8; 3] = [0x02, 0x91, 0x06];
#[derive(Deserialize, Copy, Clone, Eq, PartialEq)]
struct InitialMessage<'a> {
@@ -692,6 +663,10 @@ fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id
serialize(&value)
}
+fn create_ping() -> Vec {
+ serialize(&Value::Array(vec![6.into()]))
+}
+
// https://github.com/bitwarden/server/blob/375af7c43b10d9da03525d41452f95de3f921541/src/Core/Enums/PushType.cs
#[derive(Copy, Clone, Eq, PartialEq)]
pub enum UpdateType {
diff --git a/src/api/push.rs b/src/api/push.rs
index 4da790e4..e87a0985 100644
--- a/src/api/push.rs
+++ b/src/api/push.rs
@@ -139,25 +139,21 @@ pub async fn unregister_push_device(push_id: Option<&PushId>) -> EmptyResult {
if !CONFIG.push_enabled() || push_id.is_none() {
return Ok(());
}
- let data = json!({
- "id": push_id.as_ref().unwrap(),
- });
-
let auth_api_token = get_auth_api_token().await?;
+
let auth_header = format!("Bearer {auth_api_token}");
- if let Err(e) = make_http_request(Method::POST, &(CONFIG.push_relay_uri() + "/push/delete"))?
- .header(CONTENT_TYPE, "application/json")
- .header(ACCEPT, "application/json")
- .header(AUTHORIZATION, auth_header)
- .json(&data)
- .send()
- .await?
- .error_for_status()
+ match make_http_request(
+ Method::POST,
+ &format!("{}/push/delete/{}", CONFIG.push_relay_uri(), push_id.as_ref().unwrap()),
+ )?
+ .header(AUTHORIZATION, auth_header)
+ .send()
+ .await
{
- err!(format!("An error occurred during device unregistration: {e}"));
- }
-
+ Ok(r) => r,
+ Err(e) => err!(format!("An error occurred during device unregistration: {e}")),
+ };
Ok(())
}
@@ -194,26 +190,20 @@ pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device
pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbConn) {
if Device::check_user_has_push_device(&user.uuid, conn).await {
- push_logout_to_relay(user, acting_device);
- }
-}
-
-// Sends the logout without checking for push devices first.
-// Needed after deleting a user, when the devices are already gone from the database.
-pub fn push_logout_to_relay(user: &User, acting_device: Option<&Device>) {
- tokio::task::spawn(send_to_push_relay(json!({
- "userId": user.uuid,
- "organizationId": (),
- "deviceId": acting_device.and_then(|d| d.push_uuid.as_ref()),
- "identifier": acting_device.map(|d| &d.uuid),
- "type": UpdateType::LogOut as i32,
- "payload": {
+ tokio::task::spawn(send_to_push_relay(json!({
"userId": user.uuid,
- "date": format_date(&user.updated_at)
- },
- "clientType": null,
- "installationId": null
- })));
+ "organizationId": (),
+ "deviceId": acting_device.and_then(|d| d.push_uuid.as_ref()),
+ "identifier": acting_device.map(|d| &d.uuid),
+ "type": UpdateType::LogOut as i32,
+ "payload": {
+ "userId": user.uuid,
+ "date": format_date(&user.updated_at)
+ },
+ "clientType": null,
+ "installationId": null
+ })));
+ }
}
pub async fn push_user_update(ut: UpdateType, user: &User, push_uuid: Option<&PushId>, conn: &DbConn) {
diff --git a/src/api/web.rs b/src/api/web.rs
index 2818b5b7..aa67e614 100644
--- a/src/api/web.rs
+++ b/src/api/web.rs
@@ -1,14 +1,13 @@
use std::{
- collections::HashMap,
path::{Path, PathBuf},
- sync::{Arc, LazyLock, RwLock},
+ sync::{Arc, RwLock},
};
use rocket::{
Catcher, Route,
fs::NamedFile,
http::ContentType,
- response::{Redirect, content::RawHtml as Html},
+ response::{Redirect, content::RawCss as Css, content::RawHtml as Html},
serde::json::Json,
};
use serde_json::Value;
@@ -20,7 +19,7 @@ use crate::{
crypto::sha256_hex,
db::{
DbConn,
- models::{AttachmentId, CipherId, custom_roles_enabled},
+ models::{AttachmentId, CipherId},
},
error::Error,
util::{Cached, EtagCached},
@@ -80,17 +79,16 @@ pub fn invalidate_css_cache() {
}
#[get("/css/vaultwarden.css")]
-fn vaultwarden_css() -> EtagCached {
+fn vaultwarden_css() -> EtagCached> {
// If reload_templates is false, and we already have the CSS Cached, return this
if !CONFIG.reload_templates()
&& let Some(cached) = CSS_CACHE.read().unwrap().as_ref()
{
- return EtagCached::new(cached.css.clone(), ContentType::CSS, &cached.etag);
+ return EtagCached::new(Css(cached.css.clone()), &cached.etag);
}
// Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS
let css_options = json!({
- "custom_roles_enabled": custom_roles_enabled(),
"email_change_allowed": CONFIG.email_change_allowed(),
"emergency_access_allowed": CONFIG.emergency_access_allowed(),
"load_user_scss": true,
@@ -149,7 +147,7 @@ fn vaultwarden_css() -> EtagCached {
}
// Etag Caching will let the browser send us an etag to verify and send new content if needed
- EtagCached::new(cached.css.clone(), ContentType::CSS, &cached.etag)
+ EtagCached::new(Css(cached.css.clone()), &cached.etag)
}
#[get("/")]
@@ -258,7 +256,7 @@ fn alive_head(_conn: DbConn) -> EmptyResult {
// This endpoint/function is used during development and development only.
// It allows to easily develop the admin interface by always loading the files from disk instead from a slice of bytes
// This will only be active during a debug build and only when `RELOAD_TEMPLATES` is set to `true`
-// NOTE: Do not forget to add any new files added to the `STATIC_FILES` HashMap below!
+// NOTE: Do not forget to add any new files added to the `static_files` function below!
#[cfg(debug_assertions)]
#[get("/vw_static/", rank = 1)]
pub async fn static_files_dev(filename: PathBuf) -> Option {
@@ -278,61 +276,32 @@ pub async fn static_files_dev(filename: PathBuf) -> Option {
None
}
-pub struct StaticFile {
- pub content_type: ContentType,
- pub bytes: &'static [u8],
- pub etag: String,
-}
-
-pub static STATIC_FILES: LazyLock> = LazyLock::new(|| {
- [
- ("404.png", ContentType::PNG, &include_bytes!("../static/images/404.png")[..]),
- ("mail-github.png", ContentType::PNG, &include_bytes!("../static/images/mail-github.png")[..]),
- ("logo-gray.png", ContentType::PNG, &include_bytes!("../static/images/logo-gray.png")[..]),
- ("error-x.svg", ContentType::SVG, &include_bytes!("../static/images/error-x.svg")[..]),
- ("hibp.png", ContentType::PNG, &include_bytes!("../static/images/hibp.png")[..]),
- ("vaultwarden-icon.png", ContentType::PNG, &include_bytes!("../static/images/vaultwarden-icon.png")[..]),
- ("vaultwarden-favicon.png", ContentType::PNG, &include_bytes!("../static/images/vaultwarden-favicon.png")[..]),
- ("404.css", ContentType::CSS, &include_bytes!("../static/scripts/404.css")[..]),
- ("admin.css", ContentType::CSS, &include_bytes!("../static/scripts/admin.css")[..]),
- ("admin.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin.js")[..]),
- ("admin_settings.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin_settings.js")[..]),
- ("admin_users.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin_users.js")[..]),
- (
- "admin_organizations.js",
- ContentType::JavaScript,
- &include_bytes!("../static/scripts/admin_organizations.js")[..],
- ),
- (
- "admin_diagnostics.js",
- ContentType::JavaScript,
- &include_bytes!("../static/scripts/admin_diagnostics.js")[..],
- ),
- ("bootstrap.css", ContentType::CSS, &include_bytes!("../static/scripts/bootstrap.css")[..]),
- ("bootstrap.bundle.js", ContentType::JavaScript, &include_bytes!("../static/scripts/bootstrap.bundle.js")[..]),
- ("jdenticon-3.3.0.js", ContentType::JavaScript, &include_bytes!("../static/scripts/jdenticon-3.3.0.js")[..]),
- ("datatables.js", ContentType::JavaScript, &include_bytes!("../static/scripts/datatables.js")[..]),
- ("datatables.css", ContentType::CSS, &include_bytes!("../static/scripts/datatables.css")[..]),
- ]
- .into_iter()
- .map(|(name, content_type, bytes)| {
- (
- name,
- StaticFile {
- content_type,
- bytes,
- etag: sha256_hex(bytes),
- },
- )
- })
- .collect()
-});
-
#[get("/vw_static/", rank = 2)]
-pub fn static_files(filename: &str) -> Result, Error> {
- if let Some(file) = STATIC_FILES.get(filename) {
- Ok(EtagCached::new(file.bytes, file.content_type.clone(), &file.etag))
- } else {
- err!(format!("Static file not found: {}", filename.escape_debug()))
+pub fn static_files(filename: &str) -> Result<(ContentType, &'static [u8]), Error> {
+ match filename {
+ "404.png" => Ok((ContentType::PNG, include_bytes!("../static/images/404.png"))),
+ "mail-github.png" => Ok((ContentType::PNG, include_bytes!("../static/images/mail-github.png"))),
+ "logo-gray.png" => Ok((ContentType::PNG, include_bytes!("../static/images/logo-gray.png"))),
+ "error-x.svg" => Ok((ContentType::SVG, include_bytes!("../static/images/error-x.svg"))),
+ "hibp.png" => Ok((ContentType::PNG, include_bytes!("../static/images/hibp.png"))),
+ "vaultwarden-icon.png" => Ok((ContentType::PNG, include_bytes!("../static/images/vaultwarden-icon.png"))),
+ "vaultwarden-favicon.png" => Ok((ContentType::PNG, include_bytes!("../static/images/vaultwarden-favicon.png"))),
+ "404.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/404.css"))),
+ "admin.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/admin.css"))),
+ "admin.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin.js"))),
+ "admin_settings.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_settings.js"))),
+ "admin_users.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_users.js"))),
+ "admin_organizations.js" => {
+ Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_organizations.js")))
+ }
+ "admin_diagnostics.js" => {
+ Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_diagnostics.js")))
+ }
+ "bootstrap.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/bootstrap.css"))),
+ "bootstrap.bundle.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/bootstrap.bundle.js"))),
+ "jdenticon-3.3.0.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/jdenticon-3.3.0.js"))),
+ "datatables.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/datatables.js"))),
+ "datatables.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/datatables.css"))),
+ _ => err!(format!("Static file not found: {filename}")),
}
}
diff --git a/src/auth.rs b/src/auth.rs
index cedbb130..cad9b298 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -1,6 +1,3 @@
-#[path = "auth/two_factor.rs"]
-pub mod two_factor;
-
#[path = "auth/send.rs"]
pub mod send;
pub type SendTokens = send::SendTokens;
@@ -314,17 +311,6 @@ impl LoginJwtClaims {
}
}
-fn calculate_invite_expire_hours(now: &DateTime) -> Result, Error> {
- let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
- let Some(hours_delta) = TimeDelta::try_hours(expire_hours) else {
- err!("Unable to calculate time delta for invite expire hours. Check `INVITATION_EXPIRATION_HOURS`.");
- };
- let Some(exp) = now.checked_add_signed(hours_delta) else {
- err!("Unable to calculate invitation expire date. Check `INVITATION_EXPIRATION_HOURS`.");
- };
- Ok(exp)
-}
-
#[derive(Debug, Serialize, Deserialize)]
pub struct InviteJwtClaims {
// Not before
@@ -348,19 +334,19 @@ pub fn generate_invite_claims(
org_id: OrganizationId,
member_id: MembershipId,
invited_by_email: Option,
-) -> Result {
+) -> InviteJwtClaims {
let time_now = Utc::now();
- let exp = calculate_invite_expire_hours(&time_now)?;
- Ok(InviteJwtClaims {
+ let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+ InviteJwtClaims {
nbf: time_now.timestamp(),
- exp: exp.timestamp(),
+ exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
iss: JWT_INVITE_ISSUER.to_string(),
sub: user_id,
email,
org_id,
member_id,
invited_by_email,
- })
+ }
}
#[derive(Debug, Serialize, Deserialize)]
@@ -386,19 +372,19 @@ pub fn generate_emergency_access_invite_claims(
emer_id: EmergencyAccessId,
grantor_name: String,
grantor_email: String,
-) -> Result {
+) -> EmergencyAccessInviteJwtClaims {
let time_now = Utc::now();
- let exp = calculate_invite_expire_hours(&time_now)?;
- Ok(EmergencyAccessInviteJwtClaims {
+ let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+ EmergencyAccessInviteJwtClaims {
nbf: time_now.timestamp(),
- exp: exp.timestamp(),
+ exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
iss: JWT_EMERGENCY_ACCESS_INVITE_ISSUER.to_string(),
sub: user_id,
email,
emer_id,
grantor_name,
grantor_email,
- })
+ }
}
#[derive(Debug, Serialize, Deserialize)]
@@ -503,17 +489,13 @@ pub fn generate_2fa_remember_claims(device_uuid: DeviceId, user_uuid: UserId) ->
let time_now = Utc::now();
TwoFactorRememberClaims {
nbf: time_now.timestamp(),
- exp: two_factor_remember_expiration(time_now, CONFIG.two_factor_remember_days()),
+ exp: (time_now + TimeDelta::try_days(30).unwrap()).timestamp(),
iss: JWT_2FA_REMEMBER_ISSUER.to_string(),
sub: device_uuid,
user_uuid,
}
}
-fn two_factor_remember_expiration(time_now: DateTime, remember_days: i64) -> i64 {
- (time_now + TimeDelta::try_days(remember_days).expect("TWO_FACTOR_REMEMBER_DAYS is validated")).timestamp()
-}
-
#[derive(Debug, Serialize, Deserialize)]
pub struct BasicJwtClaims {
// Not before
@@ -536,43 +518,36 @@ impl BasicJwtClaims {
}
}
-pub fn generate_delete_claims(uuid: String) -> Result {
+pub fn generate_delete_claims(uuid: String) -> BasicJwtClaims {
let time_now = Utc::now();
- let exp = calculate_invite_expire_hours(&time_now)?;
- Ok(BasicJwtClaims {
+ let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+ BasicJwtClaims {
nbf: time_now.timestamp(),
- exp: exp.timestamp(),
+ exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
iss: JWT_DELETE_ISSUER.to_string(),
sub: uuid,
- })
+ }
}
-pub fn generate_verify_email_claims(user_id: &UserId) -> Result {
+pub fn generate_verify_email_claims(user_id: &UserId) -> BasicJwtClaims {
let time_now = Utc::now();
- let exp = calculate_invite_expire_hours(&time_now)?;
- Ok(BasicJwtClaims {
+ let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+ BasicJwtClaims {
nbf: time_now.timestamp(),
- exp: exp.timestamp(),
+ exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
iss: JWT_VERIFYEMAIL_ISSUER.to_string(),
sub: user_id.to_string(),
- })
+ }
}
-pub fn generate_admin_claims() -> Result {
+pub fn generate_admin_claims() -> BasicJwtClaims {
let time_now = Utc::now();
- let lifetime_minutes = i64::from(CONFIG.admin_session_lifetime());
- let Some(minutes_delta) = TimeDelta::try_minutes(lifetime_minutes) else {
- err!("Unable to calculate time delta for admin session lifetime. Check `ADMIN_SESSION_LIFETIME`.");
- };
- let Some(exp) = time_now.checked_add_signed(minutes_delta) else {
- err!("Unable to calculate admin session lifetime. Check `ADMIN_SESSION_LIFETIME`.");
- };
- Ok(BasicJwtClaims {
+ BasicJwtClaims {
nbf: time_now.timestamp(),
- exp: exp.timestamp(),
+ exp: (time_now + TimeDelta::try_minutes(CONFIG.admin_session_lifetime()).unwrap()).timestamp(),
iss: JWT_ADMIN_ISSUER.to_string(),
sub: "admin_panel".to_owned(),
- })
+ }
}
pub fn generate_send_claims(send_id: &SendId, file_id: &SendFileId) -> BasicJwtClaims {
diff --git a/src/auth/send.rs b/src/auth/send.rs
index 85b91d99..518b7098 100644
--- a/src/auth/send.rs
+++ b/src/auth/send.rs
@@ -72,11 +72,7 @@ impl SendTokens {
conn: &DbConn,
) -> ApiResult {
let Some(send_id) = Self::as_send_id(access_id) else {
- return Self::invalid_error(
- &format!("Can't convert {}", access_id.escape_debug()),
- "send_id_invalid",
- false,
- );
+ return Self::invalid_error(&format!("Can't convert {access_id}"), "send_id_invalid", false);
};
let Some(send) = Send::find_by_uuid(&send_id, conn).await else {
diff --git a/src/auth/two_factor.rs b/src/auth/two_factor.rs
deleted file mode 100644
index 533c0cf4..00000000
--- a/src/auth/two_factor.rs
+++ /dev/null
@@ -1,281 +0,0 @@
-use chrono::{TimeDelta, Utc};
-use serde::{de::DeserializeOwned, ser::Serialize};
-use std::sync::LazyLock;
-
-use crate::{
- CONFIG,
- api::{ApiResult, EmptyResult},
- auth::{decode_jwt, encode_jwt},
- db::models::UserId,
-};
-
-static JWT_2FA_AUTH_ISSUER: LazyLock = LazyLock::new(|| format!("{}|api.2fa", CONFIG.domain_origin()));
-
-#[derive(Serialize, Deserialize)]
-pub struct TwoFactorClaims {
- // Not before
- pub nbf: i64,
- // Expiration time
- pub exp: i64,
- // Issuer
- pub iss: String,
- // Subject
- pub sub: UserId,
-
- pub enabled: bool,
-
- pub claims: T,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct AuthenticatorClaims {
- #[serde(rename = "authenticator_key")]
- pub key: String,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct DuoClaims {
- #[serde(rename = "duo_data")]
- pub data: Option,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct WebauthnClaims {
- #[serde(rename = "webauthn_keys")]
- pub keys: Vec,
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct YubikeyClaims {
- #[serde(rename = "yubi_keys")]
- pub keys: Vec,
-}
-
-#[derive(Serialize, Deserialize, PartialEq)]
-pub struct DuoData {
- pub host: String, // Duo API hostname
- pub ik: String, // client id
- pub sk: String, // client secret
-}
-
-impl DuoData {
- pub fn global() -> Option {
- match (CONFIG._enable_duo(), CONFIG.duo_host()) {
- (true, Some(host)) => Some(Self {
- host,
- ik: CONFIG.duo_ikey().unwrap(),
- sk: CONFIG.duo_skey().unwrap(),
- }),
- _ => None,
- }
- }
- pub fn msg(s: &str) -> Self {
- Self {
- host: s.into(),
- ik: s.into(),
- sk: s.into(),
- }
- }
- pub fn secret() -> Self {
- Self::msg("")
- }
- pub fn obscure(self) -> Self {
- let mut host = self.host;
- let mut ik = self.ik;
- let mut sk = self.sk;
-
- let digits = 4;
- let replaced = "************";
-
- host.replace_range(digits.., replaced);
- ik.replace_range(digits.., replaced);
- sk.replace_range(digits.., replaced);
-
- Self {
- host,
- ik,
- sk,
- }
- }
-}
-
-#[derive(Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct EmailClaims {
- pub email: Option,
-}
-
-fn token(user_id: UserId, enabled: bool, claims: T) -> String {
- let time_now = Utc::now();
- let claims = TwoFactorClaims {
- nbf: time_now.timestamp(),
- exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
- iss: JWT_2FA_AUTH_ISSUER.to_string(),
- sub: user_id,
- enabled,
- claims,
- };
- encode_jwt(&claims)
-}
-
-fn validate(token: &str, user_id: &UserId, enabled: bool) -> ApiResult {
- match decode_jwt::>(token, JWT_2FA_AUTH_ISSUER.to_string()) {
- Ok(claims) => {
- if claims.sub != *user_id {
- err!("Invalid verification token: Invalid user");
- }
- if claims.enabled != enabled {
- err!("Invalid verification token: Invalid state");
- }
- Ok(claims.claims)
- }
- Err(err) => err!(format!("Failed to decode verification token: {err}")),
- }
-}
-
-pub fn authenticator_token(user_id: UserId, key: String, enabled: bool) -> String {
- token(
- user_id,
- enabled,
- AuthenticatorClaims {
- key,
- },
- )
-}
-
-pub fn validate_authenticator(token: &str, user_id: &UserId, key: &str, enabled: bool) -> EmptyResult {
- let claims = validate::(token, user_id, enabled)?;
- if claims.key != key {
- err!("Invalid verification token: Invalid key");
- }
- Ok(())
-}
-
-pub fn duo_token(user_id: UserId, data: Option, enabled: bool) -> String {
- token(
- user_id,
- enabled,
- DuoClaims {
- data,
- },
- )
-}
-
-// When disabling we check that it's the correct data
-pub fn validate_duo(token: &str, user_id: &UserId, data: Option<&DuoData>, enabled: bool) -> EmptyResult {
- let claims = validate::(token, user_id, enabled)?;
- if enabled && claims.data.as_ref() != data {
- err!("Invalid verification token: Invalid duo data");
- }
- Ok(())
-}
-
-pub fn email_token(user_id: UserId, email: Option, enabled: bool) -> String {
- token(
- user_id,
- enabled,
- EmailClaims {
- email,
- },
- )
-}
-
-// When disabling we check that it's the correct `email`
-pub fn validate_email(token: &str, user_id: &UserId, email: String, enabled: bool) -> EmptyResult {
- let claims = validate::(token, user_id, enabled)?;
- if enabled && claims.email != Some(email) {
- err!("Invalid verification token: Invalid email");
- }
- Ok(())
-}
-
-pub fn webauthn_token(user_id: UserId, keys: Vec, enabled: bool) -> String {
- token(
- user_id,
- enabled,
- WebauthnClaims {
- keys,
- },
- )
-}
-
-pub fn validate_webauthn(token: &str, user_id: &UserId, keys: &[i32], enabled: bool) -> EmptyResult {
- let claims = validate::(token, user_id, enabled)?;
- if keys != claims.keys {
- err!("Invalid verification token: Invalid keys");
- }
- Ok(())
-}
-
-pub fn yubikey_token(user_id: UserId, keys: Vec, enabled: bool) -> String {
- token(
- user_id,
- enabled,
- YubikeyClaims {
- keys,
- },
- )
-}
-
-pub fn validate_yubikey(token: &str, user_id: &UserId, keys: &Vec, enabled: bool) -> EmptyResult {
- let claims = validate::(token, user_id, enabled)?;
- if *keys != claims.keys {
- err!("Invalid verification token: Invalid keys");
- }
- Ok(())
-}
-
-#[cfg(test)]
-mod tests {
- use super::*;
- use serde_json::{Value, from_value, to_value};
-
- fn token(claims: T) -> Value {
- to_value(TwoFactorClaims {
- nbf: 0,
- exp: 0,
- iss: String::new(),
- sub: UserId::from(String::from("4ff0f0a4-0aa4-4c1d-9d43-1f2bd4d5e8b1")),
- enabled: false,
- claims,
- })
- .unwrap()
- }
-
- #[test]
- fn claims_only_parse_as_their_own_provider() {
- let tokens = [
- token(AuthenticatorClaims {
- key: String::from("JBSWY3DPEHPK3PXP"),
- }),
- token(DuoClaims {
- data: None,
- }),
- token(WebauthnClaims {
- keys: vec![1],
- }),
- token(YubikeyClaims {
- keys: Vec::new(),
- }),
- token(EmailClaims {
- email: None,
- }),
- ];
- for (issued, token) in tokens.iter().enumerate() {
- let parsed = [
- from_value::>(token.clone()).is_ok(),
- from_value::>(token.clone()).is_ok(),
- from_value::>(token.clone()).is_ok(),
- from_value::>(token.clone()).is_ok(),
- from_value::>(token.clone()).is_ok(),
- ];
- for (checked, ok) in parsed.into_iter().enumerate() {
- assert_eq!(ok, issued == checked, "token {issued} parsed as {checked}");
- }
- }
- }
-}
diff --git a/src/config.rs b/src/config.rs
index a565a93e..7d35461c 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -111,7 +111,6 @@ macro_rules! make_config {
_usr: ConfigBuilder,
_overrides: Vec<&'static str>,
- _config_file_status: ConfigFileStatus,
}
// Custom Deserialize for ConfigBuilder, mainly based upon https://serde.rs/deserialize-struct.html
@@ -260,22 +259,11 @@ macro_rules! make_config {
builder
}
- async fn from_file() -> Result, Error> {
- // The Fs operator would create the folder if it doesn't exist, which we never want
- if !CONFIG_FILE_PARENT_DIR.starts_with("s3://") && !std::path::Path::new(&*CONFIG_FILE_PARENT_DIR).is_dir() {
- return Ok(None);
- }
+ async fn from_file() -> Result {
let operator = storage::operator_for_path(&CONFIG_FILE_PARENT_DIR)?;
- let config_bytes = match operator.read(&CONFIG_FILENAME).await {
- Ok(bytes) => bytes,
- // No config file is fine, should not return any error
- Err(e) if e.kind() == opendal::ErrorKind::NotFound => return Ok(None),
- // Any other error might be an issue and should be passed back to the caller
- Err(e) => return Err(e.into()),
- };
- let builder = serde_json::from_slice(&config_bytes.to_vec())?;
+ let config_bytes = operator.read(&CONFIG_FILENAME).await?;
println!("[INFO] Using saved config from `{}` for configuration.\n", *CONFIG_FILE);
- Ok(Some(builder))
+ serde_json::from_slice(&config_bytes.to_vec()).map_err(Into::into)
}
fn clear_non_editable(&mut self) {
@@ -452,8 +440,6 @@ macro_rules! make_config {
"domain_origin",
"domain_path",
"domain",
- "duo_ikey",
- "duo_host",
"helo_name",
"org_creation_users",
"signups_domains_whitelist",
@@ -465,8 +451,6 @@ macro_rules! make_config {
"sso_authority",
"sso_callback_path",
"sso_client_id",
- "yubico_client_id",
- "yubico_server",
];
let cfg = {
@@ -499,10 +483,6 @@ macro_rules! make_config {
};
overrides
}
-
- pub fn get_config_file_status(&self) -> ConfigFileStatus {
- self.inner.read().unwrap()._config_file_status
- }
}
};
}
@@ -559,7 +539,7 @@ make_config! {
jobs {
/// Job scheduler poll interval |> How often the job scheduler thread checks for jobs to run.
/// Set to 0 to globally disable scheduled jobs.
- job_poll_interval_ms: u32, false, def, 30_000;
+ job_poll_interval_ms: u64, false, def, 30_000;
/// Send purge schedule |> Cron schedule of the job that checks for Sends past their deletion date.
/// Defaults to hourly. Set blank to disable this job.
send_purge_schedule: String, false, def, "0 5 * * * *".to_owned();
@@ -607,9 +587,6 @@ make_config! {
/// This setting applies globally to all users. To control this on a per-org basis instead, use the "Disable Send" org policy.
sends_allowed: bool, true, def, true;
- /// Fill Assist Rules URL |> HTTPS URL for the server-wide Fill Assist rules feed base directory.
- fill_assist_rules_url: String, true, def, "https://fillassist.bitwarden.com".to_owned();
-
/// HIBP Api Key |> HaveIBeenPwned API Key, request it here: https://haveibeenpwned.com/API/Key
hibp_api_key: Pass, true, option;
@@ -618,19 +595,19 @@ make_config! {
/// Per-organization attachment storage limit (KB) |> Max kilobytes of attachment storage allowed per org. When this limit is reached, org members will not be allowed to upload further attachments for ciphers owned by that org.
org_attachment_limit: i64, true, option;
/// Per-user send storage limit (KB) |> Max kilobytes of sends storage allowed per user. When this limit is reached, the user will not be allowed to upload further sends.
- user_send_limit: i64, true, option;
+ user_send_limit: i64, true, option;
/// Trash auto-delete days |> Number of days to wait before auto-deleting a trashed item.
- /// If unset or 0, trashed items are not auto-deleted. This setting applies globally, so make
+ /// If unset, trashed items are not auto-deleted. This setting applies globally, so make
/// sure to inform all users of any changes to this setting.
- trash_auto_delete_days: u16, true, option;
+ trash_auto_delete_days: i64, true, option;
/// Incomplete 2FA time limit |> Number of minutes to wait before a 2FA-enabled login is
/// considered incomplete, resulting in an email notification. An incomplete 2FA login is one
/// where the correct master password was provided but the required 2FA step was not completed,
/// which potentially indicates a master password compromise. Set to 0 to disable this check.
/// This setting applies globally to all users.
- incomplete_2fa_time_limit: u16, true, def, 3;
+ incomplete_2fa_time_limit: i64, true, def, 3;
/// Disable icon downloads |> Set to true to disable icon downloading in the internal icon service.
/// This still serves existing icons from $ICON_CACHE_FOLDER, without generating any external
@@ -643,9 +620,9 @@ make_config! {
/// this will prevent logins from succeeding until the address has been verified
signups_verify: bool, true, def, false;
/// If signups require email verification, automatically re-send verification email if it hasn't been sent for a while (in seconds)
- signups_verify_resend_time: u32, true, def, 3_600;
+ signups_verify_resend_time: u64, true, def, 3_600;
/// If signups require email verification, limit how many emails are automatically sent when login is attempted (0 means no limit)
- signups_verify_resend_limit: u16, true, def, 6;
+ signups_verify_resend_limit: u32, true, def, 6;
/// Email domain whitelist |> Allow signups only from this list of comma-separated domains, even when signups are otherwise disabled
signups_domains_whitelist: String, true, def, String::new();
/// Enable event logging |> Enables event logging for organizations.
@@ -657,7 +634,7 @@ make_config! {
invitations_allowed: bool, true, def, true;
/// Invitation token expiration time (in hours) |> The number of hours after which an organization invite token, emergency access invite token,
/// email verification token and deletion request token will expire (must be at least 1)
- invitation_expiration_hours: u16, false, def, 120;
+ invitation_expiration_hours: u32, false, def, 120;
/// Enable emergency access |> Controls whether users can enable emergency access to their accounts. This setting applies globally to all users.
emergency_access_allowed: bool, true, def, true;
/// Allow email change |> Controls whether users can change their email. This setting applies globally to all users.
@@ -678,8 +655,8 @@ make_config! {
/// Invitation organization name |> Name shown in the invitation emails that don't come from a specific organization
invitation_org_name: String, true, def, "Vaultwarden".to_owned();
- /// Events days retain |> Number of days to retain events stored in the database. If unset or 0, events are kept indefinitely.
- events_days_retain: u16, false, option;
+ /// Events days retain |> Number of days to retain events stored in the database. If unset, events are kept indefinitely.
+ events_days_retain: i64, false, option;
},
client {
@@ -717,13 +694,13 @@ make_config! {
/// Temporary redirects are useful while testing different icon services, but once a service
/// has been decided on, consider using permanent redirects for cacheability. The legacy codes
/// are currently better supported by the Bitwarden clients.
- icon_redirect_code: u16, true, def, 302;
+ icon_redirect_code: u32, true, def, 302;
/// Positive icon cache expiry |> Number of seconds to consider that an already cached icon is fresh. After this period, the icon will be refreshed
- icon_cache_ttl: u32, true, def, 2_592_000;
+ icon_cache_ttl: u64, true, def, 2_592_000;
/// Negative icon cache expiry |> Number of seconds before trying to download an icon that failed again.
- icon_cache_negttl: u32, true, def, 259_200;
+ icon_cache_negttl: u64, true, def, 259_200;
/// Icon download timeout |> Number of seconds when to stop attempting to download an icon.
- icon_download_timeout: u16, true, def, 10;
+ icon_download_timeout: u64, true, def, 10;
/// [Deprecated] Icon blacklist Regex |> Use `http_request_block_regex` instead
icon_blacklist_regex: String, false, option;
@@ -740,8 +717,6 @@ make_config! {
/// Disable Two-Factor remember |> Enabling this would force the users to use a second factor to login every time.
/// Note that the checkbox would still be present, but ignored.
disable_2fa_remember: bool, true, def, false;
- /// Two-Factor remember duration |> Number of days before a remembered Two-Factor login expires (min: 1, max: 90).
- two_factor_remember_days: i64, true, def, 30;
/// Disable authenticator time drifted codes to be valid |> Enabling this only allows the current TOTP code to be valid
/// TOTP codes of the previous and next 30 seconds will be invalid.
@@ -776,11 +751,11 @@ make_config! {
/// Max database connection retries |> Number of times to retry the database connection during startup, with 1 second between each retry, set to 0 to retry indefinitely
db_connection_retries: u32, false, def, 15;
- /// Timeout in seconds when acquiring database connection
- database_timeout: u32, false, def, 30;
+ /// Timeout when acquiring database connection
+ database_timeout: u64, false, def, 30;
/// Timeout in seconds before idle connections to the database are closed
- database_idle_timeout: u32, false, def, 600;
+ database_idle_timeout: u64, false, def, 600;
/// Database connection max pool size
database_max_conns: u32, false, def, 10;
@@ -797,34 +772,30 @@ make_config! {
/// Allowed iframe ancestors (Know the risks!) |> Allows other domains to embed the web vault into an iframe, useful for embedding into secure intranets
allowed_iframe_ancestors: String, true, def, String::new();
- /// Allowed connect-src (Know the risks!) |> Allows other domains for URLs which can be loaded using script interfaces like the Forwarded email alias feature
+ /// Allowed connect-src (Know the risks!) |> Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
allowed_connect_src: String, true, def, String::new();
/// Seconds between login requests |> Number of seconds, on average, between login and 2FA requests from the same IP address before rate limiting kicks in
- login_ratelimit_seconds: u16, false, def, 60;
+ login_ratelimit_seconds: u64, false, def, 60;
/// Max burst size for login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `login_ratelimit_seconds`. Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2
- login_ratelimit_max_burst: u16, false, def, 10;
+ login_ratelimit_max_burst: u32, false, def, 10;
/// Seconds between unauthenticated requests |> Number of seconds, on average, between requests from the same IP address to any of the rate limited unauthenticated endpoints
- unauthenticated_ratelimit_seconds: u16, false, def, 60;
+ unauthenticated_ratelimit_seconds: u64, false, def, 60;
/// Max burst size for unauthenticated requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `unauthenticated_ratelimit_seconds`. This is shared between several endpoints, so it needs to be more lenient than the login one
- unauthenticated_ratelimit_max_burst: u16, false, def, 50;
+ unauthenticated_ratelimit_max_burst: u32, false, def, 50;
/// Seconds between admin login requests |> Number of seconds, on average, between admin requests from the same IP address before rate limiting kicks in
- admin_ratelimit_seconds: u16, false, def, 300;
+ admin_ratelimit_seconds: u64, false, def, 300;
/// Max burst size for admin login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `admin_ratelimit_seconds`
- admin_ratelimit_max_burst: u16, false, def, 3;
+ admin_ratelimit_max_burst: u32, false, def, 3;
/// Admin session lifetime |> Set the lifetime of admin sessions to this value (in minutes).
- admin_session_lifetime: u32, true, def, 20;
+ admin_session_lifetime: i64, true, def, 20;
/// Enable groups (BETA!) (Know the risks!) |> Enables groups support for organizations (Currently contains known issues!).
org_groups_enabled: bool, false, def, false;
- /// Enable Custom roles (EXPERIMENTAL!) (Know the risks!) |> Enables the in-development Custom member role with granular permissions for organizations.
- /// Only the permissions this version enforces can be granted. Disabling it again keeps the stored Custom roles, but they grant nothing until it is re-enabled.
- experimental_custom_roles: bool, false, def, false;
-
/// Increase note size limit (Know the risks!) |> Sets the secure note size limit to 100_000 instead of the default 10_000.
/// WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
increase_note_size_limit: bool, true, def, false;
@@ -873,8 +844,8 @@ make_config! {
sso_master_password_policy: String, true, option;
/// Use SSO only for auth not the session lifecycle |> Use default Vaultwarden session lifecycle (Idle refresh token valid for 30days)
sso_auth_only_not_session: bool, true, def, false;
- /// Client cache for discovery endpoint. |> Duration in seconds (0 to disable). More details: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect#client-cache
- sso_client_cache_expiration: u32, true, def, 0;
+ /// Client cache for discovery endpoint. |> Duration in seconds (0 or less to disable). More details: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect#client-cache
+ sso_client_cache_expiration: u64, true, def, 0;
/// Log all tokens |> `LOG_LEVEL=debug` or `LOG_LEVEL=info,vaultwarden::sso=debug` is required
sso_debug_tokens: bool, true, def, false;
},
@@ -932,11 +903,11 @@ make_config! {
/// SMTP Auth mechanism |> Defaults for SSL is "Plain" and "Login" and nothing for Non-SSL connections. Possible values: ["Plain", "Login", "Xoauth2"]. Multiple options need to be separated by a comma ','.
smtp_auth_mechanism: String, true, option;
/// SMTP connection timeout |> Number of seconds when to stop trying to connect to the SMTP server
- smtp_timeout: u16, true, def, 15;
+ smtp_timeout: u64, true, def, 15;
/// Server name sent during HELO |> By default this value should be the machine's hostname, but might need to be changed in case it trips some anti-spam filters
helo_name: String, true, option;
/// Embed images as email attachments.
- smtp_embed_images: bool, true, def, true;
+ smtp_embed_images: bool, true, def, true;
/// _smtp_img_src
_smtp_img_src: String, false, generated, |c| generate_smtp_img_src(c.smtp_embed_images, &c.domain);
/// Enable SMTP debugging (Know the risks!) |> DANGEROUS: Enabling this will output very detailed SMTP messages. This could contain sensitive information like passwords and usernames! Only enable this during troubleshooting!
@@ -954,9 +925,9 @@ make_config! {
/// Email token size |> Number of digits in an email 2FA token (min: 6, max: 255). Note that the Bitwarden clients are hardcoded to mention 6 digit codes regardless of this setting.
email_token_size: u8, true, def, 6;
/// Token expiration time |> Maximum time in seconds a token is valid. The time the user has to open email client and copy token.
- email_expiration_time: u32, true, def, 600;
+ email_expiration_time: u64, true, def, 600;
/// Maximum attempts |> Maximum attempts before an email token is reset and a new email will need to be sent
- email_attempts_limit: u8, true, def, 3;
+ email_attempts_limit: u64, true, def, 3;
/// Setup email 2FA at signup |> Setup email 2FA provider on registration regardless of any organization policy
email_2fa_enforce_on_verified_invite: bool, true, def, false;
/// Auto-enable 2FA (Know the risks!) |> Automatically setup email 2FA as fallback provider when needed
@@ -1012,15 +983,7 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
}
if cfg.database_min_conns > cfg.database_max_conns {
- err!("`DATABASE_MIN_CONNS` must be less than or equal to `DATABASE_MAX_CONNS`.");
- }
-
- if cfg.database_timeout < 1 {
- err!("`DATABASE_TIMEOUT` must be at least 1 second");
- }
-
- if cfg.database_idle_timeout < 1 {
- err!("`DATABASE_IDLE_TIMEOUT` must be at least 1 second");
+ err!("`DATABASE_MIN_CONNS` must be smaller than or equal to `DATABASE_MAX_CONNS`.");
}
if let Some(log_file) = &cfg.log_file
@@ -1036,21 +999,6 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
);
}
- let valid_fill_assist_rules_url = Url::parse(&cfg.fill_assist_rules_url).is_ok_and(|url| {
- url.scheme() == "https"
- && url.has_host()
- && url.username().is_empty()
- && url.password().is_none()
- && url.query().is_none()
- && url.fragment().is_none()
- && cfg.fill_assist_rules_url.trim() == cfg.fill_assist_rules_url
- });
- if !valid_fill_assist_rules_url {
- err!(
- "`FILL_ASSIST_RULES_URL` must be a valid HTTPS URL without credentials, query parameters, fragments, or surrounding whitespace."
- );
- }
-
let connect_src = cfg.allowed_connect_src.to_lowercase();
for url in connect_src.split_whitespace() {
if !url.starts_with("https://") || Url::parse(url).is_err() {
@@ -1285,10 +1233,6 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
err!("`INVITATION_EXPIRATION_HOURS` has a minimum duration of 1 hour")
}
- if !(1..=90).contains(&cfg.two_factor_remember_days) {
- err!("`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 90 days")
- }
-
// Validate schedule crontab format
if !cfg.send_purge_schedule.is_empty() && cfg.send_purge_schedule.parse::().is_err() {
err!("`SEND_PURGE_SCHEDULE` is not a valid cron expression")
@@ -1322,38 +1266,6 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
err!("`AUTH_REQUEST_PURGE_SCHEDULE` is not a valid cron expression")
}
- if !cfg.duo_context_purge_schedule.is_empty() && cfg.duo_context_purge_schedule.parse::().is_err() {
- err!("`DUO_CONTEXT_PURGE_SCHEDULE` is not a valid cron expression")
- }
-
- if !cfg.purge_incomplete_sso_auth.is_empty() && cfg.purge_incomplete_sso_auth.parse::().is_err() {
- err!("`PURGE_INCOMPLETE_SSO_AUTH` is not a valid cron expression")
- }
-
- if cfg.login_ratelimit_seconds < 1 {
- err!("`LOGIN_RATELIMIT_SECONDS` must be at least 1 second");
- }
-
- if cfg.login_ratelimit_max_burst < 1 {
- err!("`LOGIN_RATELIMIT_MAX_BURST` must be at least 1");
- }
-
- if cfg.admin_ratelimit_seconds < 1 {
- err!("`ADMIN_RATELIMIT_SECONDS` must be at least 1 second");
- }
-
- if cfg.admin_ratelimit_max_burst < 1 {
- err!("`ADMIN_RATELIMIT_MAX_BURST` must be at least 1");
- }
-
- if cfg.unauthenticated_ratelimit_seconds < 1 {
- err!("`UNAUTHENTICATED_RATELIMIT_SECONDS` must be at least 1 second");
- }
-
- if cfg.unauthenticated_ratelimit_max_burst < 1 {
- err!("`UNAUTHENTICATED_RATELIMIT_MAX_BURST` must be at least 1");
- }
-
if !cfg.disable_admin_token {
match cfg.admin_token.as_ref() {
Some(t) if t.starts_with("$argon2") => {
@@ -1509,12 +1421,8 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
// Autofill Team
"undetermined-cipher-scenario-logic",
"enable-basic-auth-response",
- "fill-assist-targeting-rules",
"ssh-agent-v2",
- "windows-desktop-autotype",
- "windows-desktop-autotype-ga",
// Key Management Team
- "biometrics-sdk-ipc",
"windows-native-credential-sync",
// Mobile Team
"pm-34171-card-scanner",
@@ -1524,34 +1432,11 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
"pm-32009-new-item-types",
];
-#[derive(Clone, Copy, Serialize)]
-pub enum ConfigFileStatus {
- NotFound,
- Loaded,
- Error,
-}
-
impl Config {
pub async fn load() -> Result {
// Loading from env and file
let env = ConfigBuilder::from_env();
- let (usr, config_file_status) = match ConfigBuilder::from_file().await {
- Ok(Some(usr)) => (usr, ConfigFileStatus::Loaded),
- Ok(None) => (ConfigBuilder::default(), ConfigFileStatus::NotFound),
- Err(e) => {
- println!(
- "[ERROR] Failed to load configuration from `{}`\n\
- #####################################################################################\n\
- # The file seems to exist but might contain invalid JSON or invalid values. #\n\
- # Check the syntax and make sure every value is valid and within its allowed range. #\n\
- # This file is not used until those errors are resolved. #\n\
- #####################################################################################\n\
- {e:?}\n",
- *CONFIG_FILE
- );
- (ConfigBuilder::default(), ConfigFileStatus::Error)
- }
- };
+ let usr = ConfigBuilder::from_file().await.unwrap_or_default();
// Create merged config, config file overwrites env
let mut overrides = Vec::new();
@@ -1571,7 +1456,6 @@ impl Config {
_env: env,
_usr: usr,
_overrides: overrides,
- _config_file_status: config_file_status,
}),
})
}
@@ -1605,7 +1489,6 @@ impl Config {
writer.config = config;
writer._usr = builder;
writer._overrides = overrides;
- writer._config_file_status = ConfigFileStatus::Loaded;
}
//Save to file
@@ -1624,7 +1507,7 @@ impl Config {
pub fn is_email_domain_allowed(&self, email: &str) -> bool {
let e: Vec<&str> = email.rsplitn(2, '@').collect();
if e.len() != 2 || e[0].is_empty() || e[1].is_empty() {
- warn!("Failed to parse email address '{}'", email.escape_debug());
+ warn!("Failed to parse email address '{email}'");
return false;
}
let email_domain = e[0].to_lowercase();
@@ -1697,7 +1580,6 @@ impl Config {
writer.config = config;
writer._usr = usr;
writer._overrides = Vec::new();
- writer._config_file_status = ConfigFileStatus::NotFound;
}
// Invalidate CSS Cache because several config items might have impact on the rendered CSS
diff --git a/src/db/mod.rs b/src/db/mod.rs
index 62b40965..2eae3f3c 100644
--- a/src/db/mod.rs
+++ b/src/db/mod.rs
@@ -212,8 +212,8 @@ impl DbPool {
let pool = Pool::builder()
.max_size(max_conns)
.min_idle(Some(CONFIG.database_min_conns()))
- .idle_timeout(Some(Duration::from_secs(u64::from(CONFIG.database_idle_timeout()))))
- .connection_timeout(Duration::from_secs(u64::from(CONFIG.database_timeout())))
+ .idle_timeout(Some(Duration::from_secs(CONFIG.database_idle_timeout())))
+ .connection_timeout(Duration::from_secs(CONFIG.database_timeout()))
.connection_customizer(Box::new(DbConnOptions {
init_stmts: conn_type.get_init_stmts(),
}))
@@ -233,7 +233,7 @@ impl DbPool {
// Get a connection from the pool
pub async fn get(&self) -> Result {
- let duration = Duration::from_secs(u64::from(CONFIG.database_timeout()));
+ let duration = Duration::from_secs(CONFIG.database_timeout());
let permit = match timeout(duration, Arc::clone(&self.semaphore).acquire_owned()).await {
Ok(p) => p.expect("Semaphore should be open"),
Err(_) => {
@@ -534,74 +534,3 @@ mod postgresql_migrations {
Ok(())
}
}
-
-/// A throwaway SQLite database with the real schema, for tests that need to run queries.
-#[cfg(all(test, sqlite))]
-pub mod test_db {
- use super::sqlite_migrations::MIGRATIONS;
- use diesel::connection::SimpleConnection;
- use diesel_migrations::MigrationHarness;
-
- #[test]
- fn custom_role_migration_preserves_memberships_and_guards_downgrade() {
- use super::schema::users_organizations::dsl::*;
- use diesel::{migration::MigrationSource, prelude::*};
- let mut conn = SqliteConnection::establish(":memory:").unwrap();
- for migration in conn.pending_migrations(MIGRATIONS).unwrap() {
- if migration.name().version().to_string() == "20261010120000" {
- break;
- }
- conn.run_migration(&migration).unwrap();
- }
- conn.batch_execute(
- "PRAGMA foreign_keys=OFF;
- INSERT INTO organizations (uuid,name,billing_email) VALUES ('org','Org','a@b');
- INSERT INTO users_organizations (uuid,user_uuid,org_uuid,access_all,akey,status,atype) VALUES
- ('0','0','org',TRUE,'key',2,0), ('1','1','org',TRUE,'key',2,1),
- ('2','2','org',FALSE,'key',1,2), ('3','3','org',FALSE,'key',2,3), ('4','4','org',TRUE,'key',2,3);",
- )
- .unwrap();
- let rows = |conn: &mut SqliteConnection| {
- users_organizations
- .select((uuid, user_uuid, org_uuid, access_all, akey, status, atype))
- .order(uuid)
- .load::<(String, String, String, bool, String, i32, i32)>(conn)
- .unwrap()
- };
- let before = rows(&mut conn);
- conn.run_pending_migrations(MIGRATIONS).unwrap();
- assert_eq!(rows(&mut conn), before);
- let grants = |conn: &mut SqliteConnection| {
- diesel::select(diesel::dsl::sql::(
- "(SELECT COUNT(*) FROM users_organizations WHERE manage_users OR manage_groups OR manage_policies
- OR create_new_collections OR edit_any_collection OR delete_any_collection
- OR access_event_logs OR access_import_export OR access_reports)",
- ))
- .get_result::(conn)
- .unwrap()
- };
- assert_eq!(grants(&mut conn), 0);
- let migration = MigrationSource::::migrations(&MIGRATIONS)
- .unwrap()
- .into_iter()
- .find(|m| m.name().version().to_string() == "20261010120000")
- .unwrap();
- for member_status in [1, 2] {
- conn.batch_execute(&format!(
- "UPDATE users_organizations SET atype=4,manage_users=TRUE,status={member_status} WHERE uuid='2'"
- ))
- .unwrap();
- let custom = rows(&mut conn);
- assert!(conn.revert_migration(&*migration).is_err());
- assert_eq!(rows(&mut conn), custom);
- assert!(users_organizations.filter(uuid.eq("2")).select(manage_users).first::(&mut conn).unwrap());
- }
- conn.batch_execute("UPDATE users_organizations SET atype=2,manage_users=FALSE,status=1 WHERE uuid='2'")
- .unwrap();
- conn.revert_migration(&*migration).unwrap();
- assert!(diesel::sql_query("SELECT manage_users FROM users_organizations").execute(&mut conn).is_err());
- conn.run_pending_migrations(MIGRATIONS).unwrap();
- assert_eq!(grants(&mut conn), 0);
- assert_eq!(rows(&mut conn), before);
- }
-}
diff --git a/src/db/models/auth_request.rs b/src/db/models/auth_request.rs
index f2b0ecdc..b06c9e56 100644
--- a/src/db/models/auth_request.rs
+++ b/src/db/models/auth_request.rs
@@ -166,15 +166,6 @@ impl AuthRequest {
.await
}
- pub async fn delete_all_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
- conn.run(move |conn| {
- diesel::delete(auth_requests::table.filter(auth_requests::user_uuid.eq(user_uuid)))
- .execute(conn)
- .map_res("Error deleting auth requests for user")
- })
- .await
- }
-
/// Marks the request as used to log in. Returns false when it already was, so it only works once.
pub async fn set_authentication_date(uuid: &AuthRequestId, conn: &DbConn) -> ApiResult {
let now = Utc::now().naive_utc();
@@ -197,7 +188,7 @@ impl AuthRequest {
pub async fn purge_expired_auth_requests(conn: &DbConn) {
// delete auth requests older than 15 minutes which is functionally equivalent to upstream:
// https://github.com/bitwarden/server/blob/f8ee2270409f7a13125cd414c450740af605a175/src/Sql/dbo/Auth/Stored%20Procedures/AuthRequest_DeleteIfExpired.sql
- let expiry_time = Utc::now().naive_utc() - chrono::TimeDelta::minutes(15);
+ let expiry_time = Utc::now().naive_utc() - chrono::TimeDelta::try_minutes(15).unwrap();
for auth_request in Self::find_created_before(&expiry_time, conn).await {
auth_request.delete(conn).await.ok();
}
diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs
index db8e9bf4..f39b0bfc 100644
--- a/src/db/models/cipher.rs
+++ b/src/db/models/cipher.rs
@@ -25,7 +25,7 @@ use macros::UuidFromParam;
use super::{
Archive, Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership,
- MembershipStatus, OrganizationId, User, UserId, organization::ORG_ADMIN_ATYPES,
+ MembershipStatus, MembershipType, OrganizationId, User, UserId,
};
#[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -494,22 +494,12 @@ impl Cipher {
/// Purge all ciphers that are old enough to be auto-deleted.
pub async fn purge_trash(conn: &DbConn) {
- let Some(auto_delete_days) = CONFIG.trash_auto_delete_days().filter(|&d| d != 0) else {
- debug!("trash_auto_delete_days is not configured or set to 0, skipping");
- return;
- };
-
- let Some(days) = TimeDelta::try_days(i64::from(auto_delete_days)) else {
- error!("Unable to calculate auto delete days!");
- return;
- };
- let now = Utc::now().naive_utc();
- let Some(dt) = now.checked_sub_signed(days) else {
- error!("Unable to calculate trash purge date!");
- return;
- };
- for cipher in Self::find_deleted_before(&dt, conn).await {
- cipher.delete(conn).await.ok();
+ if let Some(auto_delete_days) = CONFIG.trash_auto_delete_days() {
+ let now = Utc::now().naive_utc();
+ let dt = now - TimeDelta::try_days(auto_delete_days).unwrap();
+ for cipher in Self::find_deleted_before(&dt, conn).await {
+ cipher.delete(conn).await.ok();
+ }
}
}
@@ -520,16 +510,7 @@ impl Cipher {
conn: &DbConn,
) -> EmptyResult {
User::update_uuid_revision(user_uuid, conn).await;
- self.move_to_folder_without_revision_update(folder_uuid, user_uuid, conn).await
- }
- /// Same as `move_to_folder`, but the caller is responsible for updating the user's revision.
- pub async fn move_to_folder_without_revision_update(
- &self,
- folder_uuid: Option,
- user_uuid: &UserId,
- conn: &DbConn,
- ) -> EmptyResult {
match (self.get_folder_uuid(user_uuid, conn).await, folder_uuid) {
// No changes
(None, None) => Ok(()),
@@ -872,7 +853,7 @@ impl Cipher {
if !visible_only {
query = query.or_filter(
- users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner
+ users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner
);
}
@@ -907,7 +888,7 @@ impl Cipher {
if !visible_only {
query = query.or_filter(
- users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner
+ users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner
);
}
@@ -1111,7 +1092,7 @@ impl Cipher {
.or(collections_groups::collections_uuid
.is_not_null() // Access via groups
.and(collections_groups::read_only.eq(false)))
- .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), // User is admin or owner
+ .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner
)
.select(ciphers_collections::collection_uuid)
.load::(conn)
@@ -1140,7 +1121,7 @@ impl Cipher {
.or(users_collections::user_uuid
.eq(user_uuid) // User has access to collection
.and(users_collections::read_only.eq(false)))
- .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), // User is admin or owner
+ .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner
)
.select(ciphers_collections::collection_uuid)
.load::(conn)
@@ -1182,7 +1163,7 @@ impl Cipher {
)
.or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection
.or_filter(users_organizations::access_all.eq(true)) // User has access all
- .or_filter(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner
+ .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
.or_filter(groups::access_all.eq(true)) //Access via group
.or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group
.filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
diff --git a/src/db/models/collection.rs b/src/db/models/collection.rs
index 68c48ce9..21387e4d 100644
--- a/src/db/models/collection.rs
+++ b/src/db/models/collection.rs
@@ -18,7 +18,7 @@ use macros::UuidFromParam;
use super::{
CipherId, CollectionGroup, GroupUser, Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId,
- User, UserId, organization::ORG_ADMIN_ATYPES,
+ User, UserId,
};
// See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/AdminConsole/Entities/Collection.cs
@@ -375,7 +375,7 @@ impl Collection {
// Directly accessed collection
users_organizations::access_all.eq(true).or(
// access_all in Organization
- users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
+ users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
),
)
.or(
@@ -412,7 +412,7 @@ impl Collection {
// Directly accessed collection
users_organizations::access_all.eq(true).or(
// access_all in Organization
- users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
+ users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
),
))
.select(collections::all_columns)
@@ -455,7 +455,7 @@ impl Collection {
)
.filter(
users_organizations::atype
- .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner
+ .le(MembershipType::Admin as i32) // Org admin or owner
.or(users_organizations::access_all.eq(true)) // access_all via membership
.or(users_collections::collection_uuid
.eq(&self.uuid) // write access given to collection
@@ -489,7 +489,7 @@ impl Collection {
)
.filter(
users_organizations::atype
- .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner
+ .le(MembershipType::Admin as i32) // Org admin or owner
.or(users_organizations::access_all.eq(true)) // access_all via membership
.or(users_collections::collection_uuid
.eq(&self.uuid) // write access given to collection
@@ -540,7 +540,7 @@ impl Collection {
// Directly accessed collection
users_organizations::access_all.eq(true).or(
// access_all in Organization
- users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
+ users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
),
)
.or(
@@ -600,7 +600,7 @@ impl Collection {
// Directly accessed collection
users_organizations::access_all.eq(true).or(
// access_all in Organization
- users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
+ users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
),
)
.or(
diff --git a/src/db/models/emergency_access.rs b/src/db/models/emergency_access.rs
index 02c05d5e..09783061 100644
--- a/src/db/models/emergency_access.rs
+++ b/src/db/models/emergency_access.rs
@@ -1,4 +1,4 @@
-use chrono::{NaiveDateTime, TimeDelta, Utc};
+use chrono::{NaiveDateTime, Utc};
use derive_more::{AsRef, Deref, Display, From};
use diesel::prelude::*;
use serde_json::Value;
@@ -112,26 +112,8 @@ impl EmergencyAccess {
"object": "emergencyAccessGranteeDetails",
}))
}
-
- pub fn deadline_at(&self) -> Result {
- if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&self.wait_time_days) {
- err!("Emergency access wait time is out-of-bounds!")
- }
-
- let initiated_at = self.recovery_initiated_at.map_res("Emergency access initiation date missing!")?;
-
- TimeDelta::try_days(i64::from(self.wait_time_days))
- .and_then(|w| initiated_at.checked_add_signed(w))
- .map_res("Emergency access deadline is invalid")
- }
-
- pub fn is_recovery_allowed(&self, now: &NaiveDateTime) -> Result {
- Ok(self.deadline_at()?.le(now))
- }
}
-pub const EMERGENCY_ACCESS_TIMEOUT_RANGE: std::ops::RangeInclusive = 1..=90;
-
#[derive(Copy, Clone)]
pub enum EmergencyAccessType {
View = 0,
@@ -187,42 +169,27 @@ impl EmergencyAccess {
pub async fn update_access_status_and_save(
&mut self,
- from_status: i32,
- to_status: i32,
+ status: i32,
date: &NaiveDateTime,
conn: &DbConn,
) -> EmptyResult {
- let uuid = self.uuid.clone();
- let updated_at = *date;
- let res = conn
- .run(move |conn| {
- crate::util::retry(
- || {
- diesel::update(
- emergency_access::table
- .filter(emergency_access::uuid.eq(&uuid))
- .filter(emergency_access::status.eq(from_status)),
- )
- .set((emergency_access::status.eq(to_status), emergency_access::updated_at.eq(updated_at)))
- .execute(conn)
- },
- 10,
- )
- })
- .await;
-
- match res {
- Ok(1) => {} // One record updated, which is valid
- Ok(_) => err!("Emergency access status was changed already"),
- Err(e) => err!("Error updating emergency access status", format!("{e}")),
- }
-
- self.status = to_status;
- self.updated_at = updated_at;
-
// Update the grantee so that it will refresh it's status.
User::update_uuid_revision(self.grantee_uuid.as_ref().expect("Error getting grantee"), conn).await;
- Ok(())
+ self.status = status;
+ date.clone_into(&mut self.updated_at);
+
+ conn.run(move |conn| {
+ crate::util::retry(
+ || {
+ diesel::update(emergency_access::table.filter(emergency_access::uuid.eq(&self.uuid)))
+ .set((emergency_access::status.eq(status), emergency_access::updated_at.eq(date)))
+ .execute(conn)
+ },
+ 10,
+ )
+ .map_res("Error updating emergency access status")
+ })
+ .await
}
pub async fn update_last_notification_date_and_save(&mut self, date: &NaiveDateTime, conn: &DbConn) -> EmptyResult {
diff --git a/src/db/models/event.rs b/src/db/models/event.rs
index e020bb3d..cc0eb504 100644
--- a/src/db/models/event.rs
+++ b/src/db/models/event.rs
@@ -79,7 +79,6 @@ pub enum EventType {
CipherSoftDeleted = 1115,
CipherRestored = 1116,
CipherClientToggledCardNumberVisible = 1117,
- CipherClientHttpAuthReleased = 1133,
// Collection
CollectionCreated = 1300,
@@ -112,8 +111,8 @@ pub enum EventType {
// OrganizationUserAutomaticallyConfirmed = 1517,
// OrganizationUserSelfRevoked = 1518, // User self-revoked due to declining organization data ownership policy
OrganizationUserAdminResetTwoFactor = 1519,
- OrganizationUserRevokedTwoFactorNonCompliance = 1520,
- OrganizationUserRevokedSingleOrganizationNonCompliance = 1521,
+ // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
+ // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
OrganizationUserNotificationBannerActionClicked = 1522,
// Organization
@@ -348,23 +347,17 @@ impl Event {
}
pub async fn clean_events(conn: &DbConn) -> EmptyResult {
- let Some(days_to_retain) = CONFIG.events_days_retain().filter(|&d| d != 0) else {
- return Ok(());
- };
-
- let Some(days_to_retain) = TimeDelta::try_days(i64::from(days_to_retain)) else {
- err!("Unable to calculate the event retention date, check 'EVENTS_DAYS_RETAIN'")
- };
-
- let Some(dt) = Utc::now().naive_utc().checked_sub_signed(days_to_retain) else {
- err!("Unable to calculate the event retention date, check 'EVENTS_DAYS_RETAIN'")
- };
- conn.run(move |conn| {
- diesel::delete(event::table.filter(event::event_date.lt(dt)))
- .execute(conn)
- .map_res("Error cleaning old events")
- })
- .await
+ if let Some(days_to_retain) = CONFIG.events_days_retain() {
+ let dt = Utc::now().naive_utc() - TimeDelta::try_days(days_to_retain).unwrap();
+ conn.run(move |conn| {
+ diesel::delete(event::table.filter(event::event_date.lt(dt)))
+ .execute(conn)
+ .map_res("Error cleaning old events")
+ })
+ .await
+ } else {
+ Ok(())
+ }
}
}
diff --git a/src/db/models/group.rs b/src/db/models/group.rs
index c8df7ef2..007ad375 100644
--- a/src/db/models/group.rs
+++ b/src/db/models/group.rs
@@ -137,15 +137,15 @@ impl CollectionGroup {
}
pub fn to_json_details_for_group(&self) -> Value {
- // Return the stored manage flag. Deriving it from !read_only && !hide_passwords turned the group
- // permission "Can edit items" (readOnly=false, hidePasswords=false, manage=false) into "Can manage"
- // in GET /organizations//collections/details, while GET /groups//details reported the stored
- // value. Saving the collection access dialog then persisted manage=true.
+ // If both read_only and hide_passwords are false, then manage should be true
+ // You can't have an entry with read_only and manage, or hide_passwords and manage
+ // Or an entry with everything to false
+ // For backwards compatibility and migration proposes we keep checking read_only and hide_password
json!({
"id": self.groups_uuid,
"readOnly": self.read_only,
"hidePasswords": self.hide_passwords,
- "manage": self.manage,
+ "manage": self.manage || (!self.read_only && !self.hide_passwords),
})
}
}
diff --git a/src/db/models/mod.rs b/src/db/models/mod.rs
index 8f62bf0b..0e4073a5 100644
--- a/src/db/models/mod.rs
+++ b/src/db/models/mod.rs
@@ -24,17 +24,15 @@ pub use self::auth_request::{AuthRequest, AuthRequestId};
pub use self::cipher::{Cipher, CipherId, RepromptType};
pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
pub use self::device::{Device, DeviceId, DeviceType, DeviceWithAuthRequest, PushId};
-pub use self::emergency_access::{
- EMERGENCY_ACCESS_TIMEOUT_RANGE, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType,
-};
+pub use self::emergency_access::{EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType};
pub use self::event::{Event, EventType};
pub use self::favorite::Favorite;
pub use self::folder::{Folder, FolderCipher, FolderId};
pub use self::group::{CollectionGroup, Group, GroupId, GroupUser};
-pub use self::org_policy::{FillAssistPolicyData, OrgPolicy, OrgPolicyId, OrgPolicyType};
+pub use self::org_policy::{OrgPolicy, OrgPolicyId, OrgPolicyType};
pub use self::organization::{
- CustomPermission, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization,
- OrganizationApiKey, OrganizationId, custom_roles_enabled,
+ Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization, OrganizationApiKey,
+ OrganizationId,
};
pub use self::send::{Send, SendFileId, SendId, SendType};
pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
diff --git a/src/db/models/org_policy.rs b/src/db/models/org_policy.rs
index 554f51fc..94e53cbd 100644
--- a/src/db/models/org_policy.rs
+++ b/src/db/models/org_policy.rs
@@ -1,4 +1,3 @@
-use chrono::{NaiveDateTime, Utc};
use derive_more::{AsRef, From};
use diesel::prelude::*;
use serde::Deserialize;
@@ -12,7 +11,6 @@ use crate::{
schema::{org_policies, users_organizations},
},
error::MapResult,
- util::format_date,
};
use super::{Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, TwoFactor, UserId};
@@ -26,7 +24,6 @@ pub struct OrgPolicy {
pub atype: i32,
pub enabled: bool,
pub data: String,
- pub revision_date: NaiveDateTime,
}
// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/PolicyType.cs
@@ -49,12 +46,10 @@ pub enum OrgPolicyType {
RemoveUnlockWithPin = 14,
RestrictedItemTypes = 15,
UriMatchDefaults = 16,
- AutotypeDefaultSetting = 17,
+ // AutotypeDefaultSetting = 17, // Not supported yet
// AutoConfirm = 18, // Not supported (not implemented yet)
// BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
OrganizationUserNotification = 20,
- // SendControls = 21, // Not supported yet
- FillAssist = 22,
}
// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs#L5
@@ -73,14 +68,6 @@ pub struct ResetPasswordDataModel {
pub auto_enroll_enabled: bool,
}
-// https://github.com/bitwarden/server/blob/13bc813de8e715a71d3410f1e584e87ccdf76025/src/Core/AdminConsole/Models/Data/Organizations/Policies/FillAssistPolicyData.cs
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct FillAssistPolicyData {
- #[serde(alias = "RulesUrl")]
- pub rules_url: Option,
-}
-
/// Local methods
impl OrgPolicy {
pub fn new(org_uuid: OrganizationId, atype: OrgPolicyType, enabled: bool, data: String) -> Self {
@@ -90,7 +77,6 @@ impl OrgPolicy {
atype: atype as i32,
enabled,
data,
- revision_date: Utc::now().naive_utc(),
}
}
@@ -106,7 +92,7 @@ impl OrgPolicy {
"type": self.atype,
"data": data_json,
"enabled": self.enabled,
- "revisionDate": format_date(&self.revision_date),
+ "revisionDate": null,
"object": "policy",
});
@@ -124,13 +110,11 @@ impl OrgPolicy {
/// Database methods
impl OrgPolicy {
- pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
- self.revision_date = Utc::now().naive_utc();
-
+ pub async fn save(&self, conn: &DbConn) -> EmptyResult {
db_run! { conn:
sqlite, mysql {
match diesel::replace_into(org_policies::table)
- .values(&*self)
+ .values(self)
.execute(conn)
{
Ok(_) => Ok(()),
@@ -138,7 +122,7 @@ impl OrgPolicy {
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
diesel::update(org_policies::table)
.filter(org_policies::uuid.eq(&self.uuid))
- .set(&*self)
+ .set(self)
.execute(conn)
.map_res("Error saving org_policy")
}
@@ -158,10 +142,10 @@ impl OrgPolicy {
.map_res("Error deleting org_policy for insert")?;
diesel::insert_into(org_policies::table)
- .values(&*self)
+ .values(self)
.on_conflict(org_policies::uuid)
.do_update()
- .set(&*self)
+ .set(self)
.execute(conn)
.map_res("Error saving org_policy")
}
diff --git a/src/db/models/organization.rs b/src/db/models/organization.rs
index b7fcdfdf..72684782 100644
--- a/src/db/models/organization.rs
+++ b/src/db/models/organization.rs
@@ -1,7 +1,4 @@
-use std::{
- cmp::Ordering,
- collections::{HashMap, HashSet},
-};
+use std::cmp::Ordering;
use chrono::{NaiveDateTime, Utc};
use derive_more::{AsRef, Deref, Display, From};
@@ -24,8 +21,8 @@ use crate::{
use macros::UuidFromParam;
use super::{
- Cipher, CipherId, Collection, CollectionGroup, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy,
- OrgPolicyType, TwoFactor, User, UserId,
+ Cipher, CipherId, Collection, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, OrgPolicyType,
+ TwoFactor, User, UserId,
};
#[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -44,7 +41,6 @@ pub struct Organization {
#[diesel(table_name = users_organizations)]
#[diesel(treat_none_as_null = true)]
#[diesel(primary_key(uuid))]
-#[expect(clippy::struct_excessive_bools, reason = "Each Custom role permission is a column of its own")]
pub struct Membership {
pub uuid: MembershipId,
pub user_uuid: UserId,
@@ -58,17 +54,6 @@ pub struct Membership {
pub atype: i32,
pub reset_password_key: Option,
pub external_id: Option,
-
- // The permissions of a Custom role, only accessed through `CustomPermission`.
- manage_users: bool,
- manage_groups: bool,
- manage_policies: bool,
- create_new_collections: bool,
- edit_any_collection: bool,
- delete_any_collection: bool,
- access_event_logs: bool,
- access_import_export: bool,
- access_reports: bool,
}
#[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -104,68 +89,42 @@ impl MembershipStatus {
}
}
-#[derive(Copy, Clone, Debug, PartialEq, Eq, num_derive::FromPrimitive)]
+#[derive(Copy, Clone, PartialEq, Eq, num_derive::FromPrimitive)]
pub enum MembershipType {
Owner = 0,
Admin = 1,
User = 2,
- // The legacy Manager role. The Bitwarden clients no longer know it and are shown a Custom role instead.
Manager = 3,
- // Only granted while EXPERIMENTAL_CUSTOM_ROLES is enabled.
- Custom = 4,
}
impl MembershipType {
pub fn from_str(s: &str) -> Option {
+ #[expect(
+ clippy::match_same_arms,
+ reason = "Specifically define `4|Custom` since this is a hack, not a default"
+ )]
match s {
"0" | "Owner" => Some(MembershipType::Owner),
"1" | "Admin" => Some(MembershipType::Admin),
"2" | "User" => Some(MembershipType::User),
"3" | "Manager" => Some(MembershipType::Manager),
- "4" | "Custom" => Some(MembershipType::Custom),
+ // HACK: We convert the custom role to a manager role
+ "4" | "Custom" => Some(MembershipType::Manager),
_ => None,
}
}
-
- /// The role a member invite or edit from the Bitwarden clients asks for, given the member's current
- /// role (`None` for an invite).
- ///
- /// The clients no longer know the legacy Manager role and are shown a Custom role in its place, so a
- /// requested Custom role is the legacy Manager unless EXPERIMENTAL_CUSTOM_ROLES is enabled. An existing
- /// Manager or Custom member keeps their role when the request repeats it, so an unrelated edit never
- /// turns one into the other.
- pub fn requested(
- requested: MembershipType,
- current: Option<&Membership>,
- custom_roles_enabled: bool,
- ) -> MembershipType {
- if requested != MembershipType::Custom {
- return requested;
- }
- match current {
- Some(member) if member.has_type(MembershipType::Custom) => MembershipType::Custom,
- Some(member) if member.has_type(MembershipType::Manager) => MembershipType::Manager,
- _ if custom_roles_enabled => MembershipType::Custom,
- _ => MembershipType::Manager,
- }
- }
-
- /// The authority of a role, which is what roles are compared by. A Custom member gets its authority from
- /// its permissions, never from its role, so the role itself ranks right above User and below Manager.
- const fn rank(self) -> u8 {
- match self {
- MembershipType::User => 0,
- MembershipType::Custom => 1,
- MembershipType::Manager => 2,
- MembershipType::Admin => 3,
- MembershipType::Owner => 4,
- }
- }
}
impl Ord for MembershipType {
fn cmp(&self, other: &MembershipType) -> Ordering {
- self.rank().cmp(&other.rank())
+ // For easy comparison, map each variant to an access level (where 0 is lowest).
+ const ACCESS_LEVEL: [i32; 4] = [
+ 3, // Owner
+ 2, // Admin
+ 0, // User
+ 1, // Manager && Custom
+ ];
+ ACCESS_LEVEL[*self as usize].cmp(&ACCESS_LEVEL[*other as usize])
}
}
@@ -221,91 +180,6 @@ impl PartialOrd for i32 {
}
}
-/// The granular permissions of the Custom role.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub enum CustomPermission {
- ManageUsers,
- ManageGroups,
- ManagePolicies,
- CreateNewCollections,
- EditAnyCollection,
- DeleteAnyCollection,
- AccessEventLogs,
- AccessImportExport,
- AccessReports,
-}
-
-/// The permissions this version enforces on every endpoint they open. Only these can be granted, a stored
-/// grant of any other one grants nothing. They are implemented one at a time, so this grows with them.
-const SUPPORTED_CUSTOM_PERMISSIONS: &[CustomPermission] = &[];
-
-impl CustomPermission {
- pub const ALL: [CustomPermission; 9] = [
- CustomPermission::ManageUsers,
- CustomPermission::ManageGroups,
- CustomPermission::ManagePolicies,
- CustomPermission::CreateNewCollections,
- CustomPermission::EditAnyCollection,
- CustomPermission::DeleteAnyCollection,
- CustomPermission::AccessEventLogs,
- CustomPermission::AccessImportExport,
- CustomPermission::AccessReports,
- ];
-
- /// The key of the permission in the `permissions` object of the Bitwarden clients.
- pub const fn json_key(self) -> &'static str {
- match self {
- CustomPermission::ManageUsers => "manageUsers",
- CustomPermission::ManageGroups => "manageGroups",
- CustomPermission::ManagePolicies => "managePolicies",
- CustomPermission::CreateNewCollections => "createNewCollections",
- CustomPermission::EditAnyCollection => "editAnyCollection",
- CustomPermission::DeleteAnyCollection => "deleteAnyCollection",
- CustomPermission::AccessEventLogs => "accessEventLogs",
- CustomPermission::AccessImportExport => "accessImportExport",
- CustomPermission::AccessReports => "accessReports",
- }
- }
-
- pub fn is_supported(self) -> bool {
- SUPPORTED_CUSTOM_PERMISSIONS.contains(&self)
- }
-
- /// The permissions a member invite or edit grants a Custom role.
- ///
- /// A permission is only granted when it is set to `true`, and anything but a boolean is rejected: this
- /// replaces the member's permissions, so a malformed value must not silently remove one. Granting a
- /// permission this version does not enforce is rejected as well. The clients also send permissions
- /// Vaultwarden does not know at all, like `manageSso`, those are ignored.
- pub fn requested(permissions: &HashMap) -> Result, crate::Error> {
- let mut granted = HashSet::new();
- for permission in CustomPermission::ALL {
- match permissions.get(permission.json_key()) {
- None | Some(Value::Bool(false)) => {}
- Some(Value::Bool(true)) if permission.is_supported() => {
- granted.insert(permission);
- }
- Some(Value::Bool(true)) => {
- err!(format!("The Custom role permission '{}' is not supported yet", permission.json_key()))
- }
- Some(_) => {
- err!(format!("The Custom role permission '{}' must be true or false", permission.json_key()))
- }
- }
- }
- Ok(granted)
- }
-}
-
-/// The stored roles with authority over the whole organization. Queries match them by value, comparing
-/// `atype <= Admin` would also match any unknown value below it.
-pub(super) const ORG_ADMIN_ATYPES: [i32; 2] = [MembershipType::Owner as i32, MembershipType::Admin as i32];
-
-/// Whether the experimental Custom role is enabled. Nothing is ever granted through a Custom role otherwise.
-pub fn custom_roles_enabled() -> bool {
- CONFIG.experimental_custom_roles()
-}
-
/// Local methods
impl Organization {
pub fn new(name: String, billing_email: &str, private_key: Option, public_key: Option) -> Self {
@@ -397,92 +271,9 @@ impl Membership {
atype: MembershipType::User as i32,
reset_password_key: None,
external_id: None,
-
- manage_users: false,
- manage_groups: false,
- manage_policies: false,
- create_new_collections: false,
- edit_any_collection: false,
- delete_any_collection: false,
- access_event_logs: false,
- access_import_export: false,
- access_reports: false,
}
}
- fn custom_permission_mut(&mut self, permission: CustomPermission) -> &mut bool {
- match permission {
- CustomPermission::ManageUsers => &mut self.manage_users,
- CustomPermission::ManageGroups => &mut self.manage_groups,
- CustomPermission::ManagePolicies => &mut self.manage_policies,
- CustomPermission::CreateNewCollections => &mut self.create_new_collections,
- CustomPermission::EditAnyCollection => &mut self.edit_any_collection,
- CustomPermission::DeleteAnyCollection => &mut self.delete_any_collection,
- CustomPermission::AccessEventLogs => &mut self.access_event_logs,
- CustomPermission::AccessImportExport => &mut self.access_import_export,
- CustomPermission::AccessReports => &mut self.access_reports,
- }
- }
-
- /// Change the role. Nothing the old role carried survives a role change: the Custom role permissions are
- /// dropped, so changing the role back later starts from none. A Custom role never keeps the legacy
- /// `access_all` flag, its reach only comes from its permissions.
- pub fn set_type(&mut self, new_type: MembershipType) {
- if self.atype != new_type as i32 {
- for permission in CustomPermission::ALL {
- *self.custom_permission_mut(permission) = false;
- }
- }
- if new_type == MembershipType::Custom {
- self.access_all = false;
- }
- self.atype = new_type as i32;
- }
-
- /// Grant this Custom member exactly `permissions` out of those this version enforces. A stored grant of a
- /// permission this version does not enforce is kept as it is: it grants nothing here.
- pub fn set_custom_permissions(&mut self, permissions: &HashSet) {
- for permission in CustomPermission::ALL.into_iter().filter(|p| p.is_supported()) {
- *self.custom_permission_mut(permission) = permissions.contains(&permission);
- }
- }
-
- /// Why this legacy Manager can't become a Custom member without losing what they may do now, if they can't. A
- /// conversion must not silently change their access, and a Custom role can't keep access to all collections
- /// (which also puts every collection in the Manager's own vault), nor manage any collection yet.
- pub async fn custom_role_conversion_loss(&self, conn: &DbConn) -> Option<&'static str> {
- if !self.has_type(MembershipType::Manager) {
- return None;
- }
- if self.access_all {
- return Some(
- "This Manager has access to all collections, which a Custom member can't have: the collections they \
- aren't assigned to would disappear from their vault. Uncheck Manage all collections for them first, \
- or keep the Manager role.",
- );
- }
- // Whatever their status, the collections they manage directly, through a group or through a group with
- // access to all collections
- let mut manages = GroupUser::has_full_access_by_member(&self.org_uuid, &self.uuid, conn).await
- || CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
- .await
- .iter()
- .any(|assignment| assignment.manage);
- for group_user in GroupUser::find_by_member(&self.uuid, conn).await {
- if manages {
- break;
- }
- manages = CollectionGroup::find_by_group(&group_user.groups_uuid, &self.org_uuid, conn)
- .await
- .iter()
- .any(|assignment| assignment.manage);
- }
- manages.then_some(
- "This Manager manages collections, with the manage permission or through a group with access to all \
- collections, which a Custom member can't do yet. Remove that first, or keep the Manager role.",
- )
- }
-
pub fn restore(&mut self) -> bool {
if self.status < MembershipStatus::Invited as i32 {
self.status += ACTIVATE_REVOKE_DIFF;
@@ -732,8 +523,7 @@ impl Membership {
// These are per user
"userId": self.user_uuid,
- // Accepted (not yet confirmed) members have no key yet; send null like upstream, not ""
- "key": (!self.akey.is_empty()).then_some(&self.akey),
+ "key": self.akey,
"status": self.status,
"type": membership_type,
"enabled": true,
@@ -921,12 +711,6 @@ impl Membership {
}
pub async fn save(&self, conn: &DbConn) -> EmptyResult {
- // The legacy `access_all` flag reaches every collection, which a Custom role may only do through its
- // permissions, so it must never be stored on one. `set_type` takes care of this.
- if self.has_type(MembershipType::Custom) && self.access_all {
- err!("A Custom role membership can't have access to all collections")
- }
-
User::update_uuid_revision(&self.user_uuid, conn).await;
db_run! { conn:
@@ -1443,93 +1227,13 @@ pub struct OrgApiKeyId(String);
#[cfg(test)]
mod tests {
use super::*;
- use MembershipType::{Admin, Custom, Manager, Owner, User};
-
- fn member(role: MembershipType) -> Membership {
- let mut member = Membership::new("user".into(), "org".into(), None);
- member.atype = role as i32;
- member.status = MembershipStatus::Confirmed as i32;
- member
- }
#[test]
- fn membership_type_authority() {
- assert!(Owner > Admin && Admin > Manager && Manager > Custom && Custom > User);
- assert!((Custom as i32) >= User && (Custom as i32) < Manager && (Custom as i32) < Admin);
- for raw in [99, -1] {
- assert_eq!((raw >= User, raw >= Manager, raw >= Admin, raw < Admin), (false, false, false, true));
- }
- for (value, expected) in [
- ("3", Some(Manager)),
- ("Manager", Some(Manager)),
- ("4", Some(Custom)),
- ("Custom", Some(Custom)),
- ("5", None),
- ] {
- assert_eq!(MembershipType::from_str(value), expected);
- }
- }
-
- #[test]
- fn requested_membership_type() {
- for (current, disabled, enabled) in [
- (None, Manager, Custom),
- (Some(User), Manager, Custom),
- (Some(Manager), Manager, Manager),
- (Some(Custom), Custom, Custom),
- ] {
- let current = current.map(member);
- for (flag, expected) in [(false, disabled), (true, enabled)] {
- assert_eq!(MembershipType::requested(Custom, current.as_ref(), flag), expected);
- }
- }
- assert_eq!(MembershipType::requested(User, Some(&member(Custom)), true), User);
- assert_eq!(MembershipType::requested(User, Some(&member(Manager)), true), User);
- for requested in [Owner, Admin, Manager] {
- assert_eq!(MembershipType::requested(requested, Some(&member(Custom)), true), requested);
- }
- }
-
- #[test]
- fn custom_permission_requests() {
- let ignored = serde_json::from_value(json!({"manageUsers":false,"manageSso":true})).unwrap();
- assert!(CustomPermission::requested(&ignored).unwrap().is_empty());
- for permission in CustomPermission::ALL {
- for value in [json!(true), json!(null), json!("true"), json!(1), json!([true])] {
- let request = HashMap::from([(permission.json_key().to_owned(), value.clone())]);
- let result = CustomPermission::requested(&request);
- if value == json!(true) && SUPPORTED_CUSTOM_PERMISSIONS.contains(&permission) {
- assert_eq!(result.unwrap(), HashSet::from([permission]));
- } else {
- assert!(result.is_err(), "{permission:?}: {value}");
- }
- }
- }
- assert_eq!(SUPPORTED_CUSTOM_PERMISSIONS, []);
- }
-
- #[test]
- fn role_changes_drop_custom_permissions() {
- for (from, to) in [
- (Custom, Owner),
- (Custom, Admin),
- (Custom, Manager),
- (Custom, User),
- (User, Custom),
- (Manager, Custom),
- (Custom, Custom),
- (Admin, User),
- ] {
- let mut member = member(from);
- member.access_all = true;
- for permission in CustomPermission::ALL {
- *member.custom_permission_mut(permission) = true;
- }
- member.set_type(to);
- for permission in CustomPermission::ALL {
- assert_eq!(*member.custom_permission_mut(permission), from == to, "{from:?} -> {to:?}");
- }
- assert_eq!(member.access_all, to != Custom);
- }
+ #[allow(non_snake_case)]
+ fn partial_cmp_MembershipType() {
+ assert!(MembershipType::Owner > MembershipType::Admin);
+ assert!(MembershipType::Admin > MembershipType::Manager);
+ assert!(MembershipType::Manager > MembershipType::User);
+ assert!(MembershipType::Manager == MembershipType::from_str("4").unwrap());
}
}
diff --git a/src/db/models/send.rs b/src/db/models/send.rs
index 118f947f..721378f3 100644
--- a/src/db/models/send.rs
+++ b/src/db/models/send.rs
@@ -334,6 +334,7 @@ impl Send {
pub async fn size_by_user(user_uuid: &UserId, conn: &DbConn) -> Option {
#[derive(serde::Deserialize)]
struct FileData {
+ #[serde(rename = "size", alias = "Size")]
size: NumberOrString,
}
diff --git a/src/db/models/two_factor.rs b/src/db/models/two_factor.rs
index 051ea4df..5f57635e 100644
--- a/src/db/models/two_factor.rs
+++ b/src/db/models/two_factor.rs
@@ -137,11 +137,11 @@ impl TwoFactor {
.await
}
- pub async fn find_by_user_and_type(user_uuid: &UserId, atype: TwoFactorType, conn: &DbConn) -> Option {
+ pub async fn find_by_user_and_type(user_uuid: &UserId, atype: i32, conn: &DbConn) -> Option {
conn.run(move |conn| {
twofactor::table
.filter(twofactor::user_uuid.eq(user_uuid))
- .filter(twofactor::atype.eq(atype as i32))
+ .filter(twofactor::atype.eq(atype))
.first::(conn)
.ok()
})
diff --git a/src/db/models/two_factor_incomplete.rs b/src/db/models/two_factor_incomplete.rs
index e4c7e308..4b8cadcb 100644
--- a/src/db/models/two_factor_incomplete.rs
+++ b/src/db/models/two_factor_incomplete.rs
@@ -37,7 +37,7 @@ impl TwoFactorIncomplete {
ip: &ClientIp,
conn: &DbConn,
) -> EmptyResult {
- if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
+ if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
return Ok(());
}
@@ -66,7 +66,7 @@ impl TwoFactorIncomplete {
}
pub async fn mark_complete(user_uuid: &UserId, device_uuid: &DeviceId, conn: &DbConn) -> EmptyResult {
- if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
+ if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
return Ok(());
}
diff --git a/src/db/models/user.rs b/src/db/models/user.rs
index 30541428..ead01373 100644
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -19,8 +19,7 @@ use crate::{
use macros::UuidFromParam;
use super::{
- AuthRequest, Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor,
- TwoFactorIncomplete,
+ Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor, TwoFactorIncomplete,
};
#[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
@@ -171,10 +170,6 @@ impl User {
)
}
- pub fn master_password_salt(&self) -> String {
- self.email.trim().to_lowercase()
- }
-
pub fn check_valid_recovery_code(&self, recovery_code: &str) -> bool {
if let Some(ref totp_recover) = self.totp_recover {
crypto::ct_eq(recovery_code, totp_recover.to_lowercase())
@@ -362,7 +357,7 @@ impl User {
}
}
- pub async fn delete(&self, conn: &DbConn) -> EmptyResult {
+ pub async fn delete(self, conn: &DbConn) -> EmptyResult {
for member in Membership::find_confirmed_by_user(&self.uuid, conn).await {
if member.atype == MembershipType::Owner
&& Membership::count_confirmed_by_org_and_type(&member.org_uuid, MembershipType::Owner, conn).await <= 1
@@ -378,14 +373,13 @@ impl User {
Cipher::delete_all_by_user(&self.uuid, conn).await?;
Favorite::delete_all_by_user(&self.uuid, conn).await?;
Folder::delete_all_by_user(&self.uuid, conn).await?;
- AuthRequest::delete_all_by_user(&self.uuid, conn).await?;
Device::delete_all_by_user(&self.uuid, conn).await?;
TwoFactor::delete_all_by_user(&self.uuid, conn).await?;
TwoFactorIncomplete::delete_all_by_user(&self.uuid, conn).await?;
Invitation::take(&self.email, conn).await; // Delete invitation if any
conn.run(move |conn| {
- diesel::delete(users::table.filter(users::uuid.eq(&self.uuid))).execute(conn).map_res("Error deleting user")
+ diesel::delete(users::table.filter(users::uuid.eq(self.uuid))).execute(conn).map_res("Error deleting user")
})
.await
}
diff --git a/src/db/schema.rs b/src/db/schema.rs
index e1b9a78d..98b1eda6 100644
--- a/src/db/schema.rs
+++ b/src/db/schema.rs
@@ -116,7 +116,6 @@ table! {
atype -> Integer,
enabled -> Bool,
data -> Text,
- revision_date -> Timestamp,
}
}
@@ -244,15 +243,6 @@ table! {
atype -> Integer,
reset_password_key -> Nullable,
external_id -> Nullable,
- manage_users -> Bool,
- manage_groups -> Bool,
- manage_policies -> Bool,
- create_new_collections -> Bool,
- edit_any_collection -> Bool,
- delete_any_collection -> Bool,
- access_event_logs -> Bool,
- access_import_export -> Bool,
- access_reports -> Bool,
}
}
diff --git a/src/error.rs b/src/error.rs
index 3fee3dc4..d90c38e3 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -425,12 +425,12 @@ macro_rules! err_json {
macro_rules! err_handler {
($expr:expr) => {{
error!(target: "auth", "Unauthorized Error: {}", $expr);
- return ::rocket::request::Outcome::Error((::rocket::http::Status::Unauthorized, $expr));
+ return ::rocket::request::Outcome::Error((rocket::http::Status::Unauthorized, $expr));
}};
($usr_msg:expr, $log_value:expr) => {{
let usr_msg = $usr_msg;
let log_value = $log_value;
error!(target: "auth", "Unauthorized Error: {usr_msg}. {log_value}");
- return ::rocket::request::Outcome::Error((::rocket::http::Status::Unauthorized, usr_msg));
+ return ::rocket::request::Outcome::Error((rocket::http::Status::Unauthorized, usr_msg));
}};
}
diff --git a/src/mail.rs b/src/mail.rs
index 14294213..2efb8d70 100644
--- a/src/mail.rs
+++ b/src/mail.rs
@@ -36,7 +36,7 @@ fn smtp_transport() -> AsyncSmtpTransport {
let smtp_client = AsyncSmtpTransport::::builder_dangerous(host.as_str())
.port(CONFIG.smtp_port())
- .timeout(Some(Duration::from_secs(u64::from(CONFIG.smtp_timeout()))));
+ .timeout(Some(Duration::from_secs(CONFIG.smtp_timeout())));
// Determine security
let smtp_client = if CONFIG.smtp_security() == *"off" {
@@ -169,7 +169,7 @@ pub async fn send_password_hint(address: &str, hint: Option