mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-09-17 00:02:06 -04:00
Compare commits
60 changed files with 22111 additions and 14083 deletions
|
|
@ -1,7 +1,7 @@
|
|||
# Ignore everything
|
||||
// Ignore everything
|
||||
*
|
||||
|
||||
# Allow what is needed
|
||||
// Allow what is needed
|
||||
!.git
|
||||
!docker/healthcheck.sh
|
||||
!docker/start.sh
|
||||
|
|
|
|||
|
|
@ -390,7 +390,6 @@
|
|||
##
|
||||
## The following flags are available:
|
||||
## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
|
||||
## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
|
||||
## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
|
||||
## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
|
||||
## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
|
||||
|
|
@ -519,9 +518,6 @@
|
|||
## Prevent users from logging in directly without going through SSO
|
||||
# SSO_ONLY=false
|
||||
|
||||
## Allow SSO flow to create account. You probably want to disable it when using a public provider.
|
||||
# SSO_SIGNUPS_ALLOWED=true
|
||||
|
||||
## On SSO Signup if a user with a matching email already exists make the association
|
||||
# SSO_SIGNUPS_MATCH_EMAIL=true
|
||||
|
||||
|
|
|
|||
2
.github/workflows/build.yml
vendored
2
.github/workflows/build.yml
vendored
|
|
@ -113,7 +113,7 @@ jobs:
|
|||
|
||||
# Enable Rust Caching
|
||||
- name: Rust Caching
|
||||
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
||||
uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
|
||||
with:
|
||||
# Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
|
||||
# Like changing the build host from Ubuntu 20.04 to 22.04 for example.
|
||||
|
|
|
|||
6
.github/workflows/hadolint.yml
vendored
6
.github/workflows/hadolint.yml
vendored
|
|
@ -20,7 +20,7 @@ jobs:
|
|||
steps:
|
||||
# Start Docker Buildx
|
||||
- name: Setup Docker Buildx
|
||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
||||
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
||||
# https://github.com/moby/buildkit/issues/3969
|
||||
# Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
|
||||
with:
|
||||
|
|
@ -41,12 +41,12 @@ jobs:
|
|||
# Uses the Docker-based action (hadolint pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian)
|
||||
# so no binary is downloaded at runtime. Pinned by commit SHA for supply-chain safety.
|
||||
- name: Run hadolint on Dockerfile.debian
|
||||
uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
|
||||
uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
|
||||
with:
|
||||
dockerfile: docker/Dockerfile.debian
|
||||
|
||||
- name: Run hadolint on Dockerfile.alpine
|
||||
uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
|
||||
uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
|
||||
with:
|
||||
dockerfile: docker/Dockerfile.alpine
|
||||
# End Test Dockerfiles with hadolint
|
||||
|
|
|
|||
4
.github/workflows/release.yml
vendored
4
.github/workflows/release.yml
vendored
|
|
@ -58,13 +58,13 @@ jobs:
|
|||
|
||||
steps:
|
||||
- name: Initialize QEMU binfmt support
|
||||
uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
|
||||
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
||||
with:
|
||||
platforms: "arm64,arm"
|
||||
|
||||
# Start Docker Buildx
|
||||
- name: Setup Docker Buildx
|
||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
||||
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
||||
# https://github.com/moby/buildkit/issues/3969
|
||||
# Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
|
||||
with:
|
||||
|
|
|
|||
2
.github/workflows/trivy.yml
vendored
2
.github/workflows/trivy.yml
vendored
|
|
@ -50,6 +50,6 @@ jobs:
|
|||
severity: CRITICAL,HIGH
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
|
||||
uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
|
|
|
|||
2
.github/workflows/typos.yml
vendored
2
.github/workflows/typos.yml
vendored
|
|
@ -23,4 +23,4 @@ jobs:
|
|||
|
||||
# When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
|
||||
- name: Spell Check Repo
|
||||
uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b # v1.50.1
|
||||
uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
|
||||
|
|
|
|||
2
.github/workflows/zizmor.yml
vendored
2
.github/workflows/zizmor.yml
vendored
|
|
@ -24,7 +24,7 @@ jobs:
|
|||
persist-credentials: false
|
||||
|
||||
- name: Run zizmor
|
||||
uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
|
||||
uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
|
||||
with:
|
||||
# intentionally not scanning the entire repository,
|
||||
# since it contains integration tests.
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ repos:
|
|||
|
||||
# When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
|
||||
- repo: https://github.com/crate-ci/typos
|
||||
rev: d43b6c087ac471e2ea7b8af622ff15f05c0c365b # v1.50.1
|
||||
rev: 8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
|
||||
hooks:
|
||||
- id: typos
|
||||
always_run: true
|
||||
|
|
|
|||
787
Cargo.lock
generated
787
Cargo.lock
generated
File diff suppressed because it is too large
Load diff
47
Cargo.toml
47
Cargo.toml
|
|
@ -1,6 +1,6 @@
|
|||
[workspace.package]
|
||||
edition = "2024"
|
||||
rust-version = "1.96.1"
|
||||
rust-version = "1.95.0"
|
||||
license = "AGPL-3.0-only"
|
||||
repository = "https://github.com/dani-garcia/vaultwarden"
|
||||
publish = false
|
||||
|
|
@ -12,6 +12,7 @@ members = ["macros"]
|
|||
name = "vaultwarden"
|
||||
version = "1.0.0"
|
||||
authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
|
||||
readme = "README.md"
|
||||
build = "build.rs"
|
||||
repository.workspace = true
|
||||
edition.workspace = true
|
||||
|
|
@ -40,7 +41,6 @@ vendored_openssl = ["openssl/vendored"]
|
|||
enable_mimalloc = ["dep:mimalloc"]
|
||||
s3 = [
|
||||
"opendal/services-s3",
|
||||
"dep:opendal-http-transport-reqwest",
|
||||
"dep:aws-config",
|
||||
"dep:aws-credential-types",
|
||||
"dep:aws-smithy-runtime-api",
|
||||
|
|
@ -66,7 +66,7 @@ syslog = "7.0.0"
|
|||
macros = { path = "./macros" }
|
||||
|
||||
# Logging
|
||||
log = "0.4.34"
|
||||
log = "0.4.33"
|
||||
fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
|
||||
# We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
|
||||
tracing = { version = "0.1.44", features = ["log"] }
|
||||
|
|
@ -90,7 +90,7 @@ rmpv = "1.3.1" # MessagePack library
|
|||
dashmap = "6.2.1"
|
||||
|
||||
# Async futures
|
||||
futures = "0.3.34"
|
||||
futures = "0.3.33"
|
||||
tokio = { version = "1.53.1", features = [
|
||||
"fs",
|
||||
"io-util",
|
||||
|
|
@ -107,7 +107,7 @@ serde = { version = "1.0.229", features = ["derive"] }
|
|||
serde_json = "1.0.151"
|
||||
|
||||
# A safe, extensible ORM and Query builder
|
||||
diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric"] }
|
||||
diesel = { version = "2.3.11", features = ["chrono", "r2d2", "numeric"] }
|
||||
diesel_migrations = "2.3.2"
|
||||
|
||||
derive_more = { version = "2.1.1", features = [
|
||||
|
|
@ -120,16 +120,16 @@ derive_more = { version = "2.1.1", features = [
|
|||
diesel-derive-newtype = "2.1.3"
|
||||
|
||||
# SQLite, statically bundled unless the `sqlite_system` feature is enabled
|
||||
libsqlite3-sys = { version = "0.38.2", optional = true }
|
||||
libsqlite3-sys = { version = "0.37.0", optional = true }
|
||||
|
||||
# Crypto-related libraries
|
||||
rand = "0.10.2"
|
||||
ring = "0.17.14"
|
||||
rustls = { version = "0.23.44", features = ["ring", "std"], default-features = false }
|
||||
rustls = { version = "0.23.43", features = ["ring", "std"], default-features = false }
|
||||
subtle = "2.6.1"
|
||||
|
||||
# UUID generation
|
||||
uuid = { version = "1.26.0", features = ["v4"] }
|
||||
uuid = { version = "1.24.0", features = ["v4"] }
|
||||
|
||||
# Date and time libraries
|
||||
chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
|
||||
|
|
@ -180,10 +180,10 @@ percent-encoding = "2.3.2" # URL encoding library used for URL's in the emails
|
|||
email_address = "0.2.9"
|
||||
|
||||
# HTML Template library
|
||||
handlebars = { version = "6.4.4", features = ["dir_source"] }
|
||||
handlebars = { version = "6.4.3", features = ["dir_source"] }
|
||||
|
||||
# HTTP client (Used for favicons, version check, DUO and HIBP API)
|
||||
reqwest = { version = "0.13.5", default-features = false, features = [
|
||||
reqwest = { version = "0.13.4", default-features = false, features = [
|
||||
# Misc
|
||||
"charset",
|
||||
"cookies",
|
||||
|
|
@ -201,7 +201,7 @@ reqwest = { version = "0.13.5", default-features = false, features = [
|
|||
"socks",
|
||||
"system-proxy",
|
||||
] }
|
||||
hickory-resolver = "0.26.2"
|
||||
hickory-resolver = "0.26.1"
|
||||
|
||||
# Favicon extraction libraries
|
||||
html5gum = "0.8.4"
|
||||
|
|
@ -212,13 +212,13 @@ regex = { version = "1.13.1", default-features = false, features = [
|
|||
] }
|
||||
data-url = "0.3.2"
|
||||
bytes = "1.12.1"
|
||||
svg-hush = "0.9.7"
|
||||
svg-hush = "0.9.6"
|
||||
|
||||
# Cache function results (Used for version check and favicon fetching)
|
||||
cached = { version = "4.0.0", features = ["async"] }
|
||||
cached = { version = "2.0.2", features = ["async"] }
|
||||
|
||||
# Used for custom short lived cookie jar during favicon extraction
|
||||
cookie = "0.18.2"
|
||||
cookie = "0.18.1"
|
||||
cookie_store = "0.22.1"
|
||||
|
||||
# Used by U2F, JWT and PostgreSQL
|
||||
|
|
@ -232,11 +232,11 @@ pastey = "0.2.3"
|
|||
governor = "0.10.4"
|
||||
|
||||
# CIDR parsing for the trusted proxies of the client IP header
|
||||
ipnet = "2.12.2"
|
||||
ipnet = "2.12.1"
|
||||
|
||||
# OIDC for SSO
|
||||
openidconnect = { version = "4.0.1", default-features = false }
|
||||
moka = { version = "0.12.16", features = ["future"] }
|
||||
moka = { version = "0.12.15", features = ["future"] }
|
||||
|
||||
# Check client versions for specific features.
|
||||
semver = "1.0.28"
|
||||
|
|
@ -245,10 +245,10 @@ semver = "1.0.28"
|
|||
# Mainly used for the musl builds, since the default musl malloc is very slow
|
||||
mimalloc = { version = "0.1.52", optional = true, default-features = false, features = ["secure"] }
|
||||
|
||||
which = "8.0.6"
|
||||
which = "8.0.5"
|
||||
|
||||
# Argon2 library with support for the PHC format
|
||||
argon2 = "0.6.0"
|
||||
argon2 = "0.5.3"
|
||||
|
||||
# Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
|
||||
rpassword = "7.5.4"
|
||||
|
|
@ -257,21 +257,20 @@ rpassword = "7.5.4"
|
|||
grass_compiler = { version = "0.13.4", default-features = false }
|
||||
|
||||
# File are accessed through Apache OpenDAL
|
||||
opendal = { version = "0.59.1", default-features = false, features = ["services-fs"] }
|
||||
opendal-http-transport-reqwest = { version = "0.59.1", default-features = false, features = ["rustls-no-provider"], optional = true }
|
||||
opendal = { version = "0.58.1", default-features = false, features = ["services-fs"] }
|
||||
|
||||
# For retrieving AWS credentials, including temporary SSO credentials
|
||||
aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
|
||||
aws-config = { version = "1.10.1", optional = true, default-features = false, features = [
|
||||
"behavior-version-latest",
|
||||
"credentials-process",
|
||||
"rt-tokio",
|
||||
"sso",
|
||||
] }
|
||||
aws-credential-types = { version = "1.3.0", optional = true }
|
||||
aws-smithy-runtime-api = { version = "1.16.0", optional = true }
|
||||
aws-smithy-runtime-api = { version = "1.14.0", optional = true }
|
||||
http = { version = "1.5.0", optional = true }
|
||||
reqsign-aws-v4 = { version = "3.3.0", optional = true }
|
||||
reqsign-core = { version = "3.3.1", optional = true }
|
||||
reqsign-aws-v4 = { version = "3.1.0", optional = true }
|
||||
reqsign-core = { version = "3.2.1", optional = true }
|
||||
|
||||
# Strip debuginfo from the release builds
|
||||
# The debug symbols are to provide better panic traces
|
||||
|
|
|
|||
|
|
@ -5,8 +5,7 @@ vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10
|
|||
# We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
|
||||
# https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
|
||||
xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
|
||||
# The `rust_version` variable is extracted from `rust-toolchain.toml`
|
||||
# rust_version: x.yy.z # Rust version to be used
|
||||
rust_version: 1.97.1 # Rust version to be used
|
||||
debian_version: trixie # Debian release name to be used
|
||||
alpine_version: "3.24" # Alpine version to be used
|
||||
# For which platforms/architectures will we try to build images
|
||||
|
|
|
|||
|
|
@ -32,10 +32,10 @@ FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330
|
|||
########################## ALPINE BUILD IMAGES ##########################
|
||||
## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
|
||||
## And for Alpine we define all build images here, they will only be loaded when actually used
|
||||
FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.98.1 AS build_amd64
|
||||
FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.98.1 AS build_arm64
|
||||
FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.98.1 AS build_armv7
|
||||
FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.98.1 AS build_armv6
|
||||
FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.97.1 AS build_amd64
|
||||
FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.97.1 AS build_arm64
|
||||
FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.97.1 AS build_armv7
|
||||
FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.97.1 AS build_armv6
|
||||
|
||||
########################## BUILD IMAGE ##########################
|
||||
# hadolint ignore=DL3006
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f
|
|||
|
||||
########################## BUILD IMAGE ##########################
|
||||
# hadolint ignore=DL3006
|
||||
FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.1-slim-trixie AS build
|
||||
FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.97.1-slim-trixie AS build
|
||||
# hadolint ignore=DL3067
|
||||
COPY --from=xx / /
|
||||
ARG TARGETARCH
|
||||
|
|
|
|||
|
|
@ -3,23 +3,17 @@
|
|||
import os
|
||||
import argparse
|
||||
import json
|
||||
import tomllib
|
||||
import yaml
|
||||
import jinja2
|
||||
|
||||
# Load settings file
|
||||
with open('DockerSettings.yaml', 'r', encoding='utf-8') as yaml_file:
|
||||
with open("DockerSettings.yaml", 'r') as yaml_file:
|
||||
yaml_data = yaml.safe_load(yaml_file)
|
||||
|
||||
# Extract the rust_version from the rust-toolchain.toml file
|
||||
script_dir = os.path.dirname(os.path.abspath(__file__))
|
||||
with open(os.path.join(script_dir, '..', 'rust-toolchain.toml'), 'rb') as toolchain_file:
|
||||
yaml_data["rust_version"] = tomllib.load(toolchain_file)["toolchain"]["channel"]
|
||||
|
||||
settings_env = jinja2.Environment(
|
||||
loader=jinja2.FileSystemLoader(os.getcwd()),
|
||||
)
|
||||
settings_yaml = yaml.safe_load(settings_env.get_template('DockerSettings.yaml').render(yaml_data))
|
||||
settings_yaml = yaml.safe_load(settings_env.get_template("DockerSettings.yaml").render(yaml_data))
|
||||
|
||||
args_parser = argparse.ArgumentParser()
|
||||
args_parser.add_argument('template_file', help='Jinja2 template file to render.')
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ proc-macro = true
|
|||
|
||||
[dependencies]
|
||||
quote = "1.0.47"
|
||||
syn = "3.0.5"
|
||||
syn = "3.0.3"
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
|
|
|
|||
|
|
@ -1,31 +1,15 @@
|
|||
SELECT if (
|
||||
EXISTS(
|
||||
SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
|
||||
WHERE TABLE_SCHEMA = DATABASE()
|
||||
AND TABLE_NAME = 'sso_users'
|
||||
AND CONSTRAINT_TYPE = 'FOREIGN KEY'
|
||||
AND CONSTRAINT_NAME = 'sso_users_ibfk_1'
|
||||
)
|
||||
,'ALTER TABLE sso_users DROP FOREIGN KEY `sso_users_ibfk_1`'
|
||||
,'SELECT "info: FK sso_users_ibfk_1 does not exist."'
|
||||
) INTO @drop_stmt;
|
||||
PREPARE drop_stmt FROM @drop_stmt;
|
||||
EXECUTE drop_stmt;
|
||||
|
||||
SELECT if (
|
||||
EXISTS(
|
||||
SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
|
||||
WHERE TABLE_SCHEMA = DATABASE()
|
||||
AND TABLE_NAME = 'sso_users'
|
||||
AND CONSTRAINT_TYPE = 'FOREIGN KEY'
|
||||
AND CONSTRAINT_NAME = '1'
|
||||
)
|
||||
,'ALTER TABLE sso_users DROP FOREIGN KEY `1`'
|
||||
,'SELECT "info: FK sso_users 1 does not exist."'
|
||||
) INTO @drop_stmt;
|
||||
PREPARE drop_stmt FROM @drop_stmt;
|
||||
EXECUTE drop_stmt;
|
||||
|
||||
DEALLOCATE PREPARE drop_stmt;
|
||||
-- Dynamically create DROP FOREIGN KEY
|
||||
-- Some versions of MySQL or MariaDB might fail if the key doesn't exists
|
||||
-- This checks if the key exists, and if so, will drop it.
|
||||
SET @drop_sso_fk = IF((SELECT true FROM information_schema.TABLE_CONSTRAINTS WHERE
|
||||
CONSTRAINT_SCHEMA = DATABASE() AND
|
||||
TABLE_NAME = 'sso_users' AND
|
||||
CONSTRAINT_NAME = 'sso_users_ibfk_1' AND
|
||||
CONSTRAINT_TYPE = 'FOREIGN KEY') = true,
|
||||
'ALTER TABLE sso_users DROP FOREIGN KEY sso_users_ibfk_1',
|
||||
'SELECT 1');
|
||||
PREPARE stmt FROM @drop_sso_fk;
|
||||
EXECUTE stmt;
|
||||
DEALLOCATE PREPARE stmt;
|
||||
|
||||
ALTER TABLE sso_users ADD FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE;
|
||||
|
|
|
|||
|
|
@ -61,7 +61,7 @@ services:
|
|||
Mariadb:
|
||||
profiles: ["playwright"]
|
||||
container_name: playwright_mariadb
|
||||
image: mariadb:12.2.2
|
||||
image: mariadb:11.2.4
|
||||
env_file: test.env
|
||||
healthcheck:
|
||||
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
||||
|
|
|
|||
|
|
@ -127,9 +127,6 @@ test('Organization is visible', async ({ page }) => {
|
|||
});
|
||||
|
||||
test('Recover user password', async ({ page }) => {
|
||||
await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
|
||||
await activateTOTP(test, page, users.user2);
|
||||
|
||||
await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
|
||||
|
||||
let newPassword = "TotoNewPassword";
|
||||
|
|
@ -141,10 +138,9 @@ test('Recover user password', async ({ page }) => {
|
|||
await page.getByRole('menuitem', { name: 'Recover account' }).click();
|
||||
await page.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
|
||||
await page.getByRole('textbox', { name: 'Confirm new master password * (' }).fill(newPassword);
|
||||
await page.getByRole('checkbox', { name: 'Reset two-step login' }).check();
|
||||
await page.getByRole('button', { name: 'Save' }).click();
|
||||
await utils.checkNotification(page, 'Account recovery success');
|
||||
await mail2Buffer.expect((m) => m.subject.includes('Admin account recovery from Test organization'));
|
||||
await mail2Buffer.expect((m) => m.subject.includes('Master Password Has Been Changed'));
|
||||
});
|
||||
|
||||
let user2 = {
|
||||
|
|
@ -154,7 +150,6 @@ test('Recover user password', async ({ page }) => {
|
|||
};
|
||||
await logUser(test, page, user2, {
|
||||
mailBuffer: mail2Buffer,
|
||||
mail2fa: true,
|
||||
notNewDevice: true,
|
||||
});
|
||||
});
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
[toolchain]
|
||||
channel = "1.98.1"
|
||||
channel = "1.97.1"
|
||||
components = [ "rustfmt", "clippy" ]
|
||||
profile = "minimal"
|
||||
|
|
|
|||
|
|
@ -231,7 +231,7 @@ fn validate_token(token: &str) -> bool {
|
|||
None => false,
|
||||
Some(t) if t.starts_with("$argon2") => {
|
||||
use argon2::password_hash::PasswordVerifier;
|
||||
match argon2::password_hash::phc::PasswordHash::new(t) {
|
||||
match argon2::password_hash::PasswordHash::new(t) {
|
||||
Ok(h) => {
|
||||
// NOTE: hash params from `ADMIN_TOKEN` are used instead of what is configured in the `Argon2` instance.
|
||||
argon2::Argon2::default().verify_password(token.trim().as_ref(), &h).is_ok()
|
||||
|
|
@ -425,7 +425,7 @@ async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyR
|
|||
|
||||
for membership in memberships {
|
||||
log_event(
|
||||
EventType::OrganizationUserDeleted,
|
||||
EventType::OrganizationUserDeleted as i32,
|
||||
&membership.uuid,
|
||||
&membership.org_uuid,
|
||||
&ACTING_ADMIN_USER.into(),
|
||||
|
|
@ -446,7 +446,7 @@ async fn delete_sso_user(user_id: UserId, token: AdminToken, conn: DbConn) -> Em
|
|||
|
||||
for membership in memberships {
|
||||
log_event(
|
||||
EventType::OrganizationUserUnlinkedSso,
|
||||
EventType::OrganizationUserUnlinkedSso as i32,
|
||||
&membership.uuid,
|
||||
&membership.org_uuid,
|
||||
&ACTING_ADMIN_USER.into(),
|
||||
|
|
@ -571,7 +571,7 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
|
|||
OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserUpdated,
|
||||
EventType::OrganizationUserUpdated as i32,
|
||||
&member_to_edit.uuid,
|
||||
&data.org_uuid,
|
||||
&ACTING_ADMIN_USER.into(),
|
||||
|
|
@ -647,7 +647,7 @@ use cached::macros::cached;
|
|||
/// Cache this function to prevent API call rate limit. Github only allows 60 requests per hour, and we use 3 here already
|
||||
/// It will cache this function for 600 seconds (10 minutes) which should prevent the exhaustion of the rate limit
|
||||
/// Any cache will be lost if Vaultwarden is restarted
|
||||
#[cached(ttl_secs = 600, sync_writes = "default")]
|
||||
#[cached(ttl = 600, sync_writes = "default")]
|
||||
async fn get_release_info(has_http_access: bool) -> (String, String, String) {
|
||||
// If the HTTP Check failed, do not even attempt to check for new versions since we were not able to connect with github.com anyway.
|
||||
if has_http_access {
|
||||
|
|
|
|||
|
|
@ -595,52 +595,29 @@ async fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> Json
|
|||
#[serde(rename_all = "camelCase")]
|
||||
struct ChangePassData {
|
||||
master_password_hash: String,
|
||||
new_master_password_hash: String,
|
||||
master_password_hint: Option<String>,
|
||||
authentication_data: Option<AuthenticationData>,
|
||||
unlock_data: Option<UnlockData>,
|
||||
|
||||
// Outdated values, might still be used by older clients
|
||||
new_master_password_hash: Option<String>,
|
||||
key: Option<String>,
|
||||
key: String,
|
||||
}
|
||||
|
||||
#[post("/accounts/password", data = "<data>")]
|
||||
async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
|
||||
let data: ChangePassData = data.into_inner();
|
||||
let user = headers.user;
|
||||
let mut user = headers.user;
|
||||
|
||||
if !user.check_valid_password(&data.master_password_hash) {
|
||||
err!("Invalid password")
|
||||
}
|
||||
|
||||
log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
|
||||
.await;
|
||||
|
||||
let (new_master_password_hash, new_key) =
|
||||
if let (Some(unlock_data), Some(authentication_data)) = (data.unlock_data, data.authentication_data) {
|
||||
if authentication_data.kdf != unlock_data.kdf {
|
||||
err!("KDF settings must be equal for authentication and unlock")
|
||||
}
|
||||
|
||||
if user.email != authentication_data.salt || user.email != unlock_data.salt {
|
||||
err!("Invalid master password salt")
|
||||
}
|
||||
|
||||
(authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
|
||||
} else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
|
||||
(new_master_password_hash, new_key)
|
||||
} else {
|
||||
err!("Invalid request!")
|
||||
};
|
||||
|
||||
let mut user = user;
|
||||
|
||||
user.password_hint = clean_password_hint(data.master_password_hint.as_ref());
|
||||
enforce_password_hint_setting(user.password_hint.as_ref())?;
|
||||
|
||||
log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
|
||||
.await;
|
||||
|
||||
user.set_password(
|
||||
&new_master_password_hash,
|
||||
Some(new_key),
|
||||
&data.new_master_password_hash,
|
||||
Some(data.key),
|
||||
true,
|
||||
Some(vec![
|
||||
String::from("post_rotatekey"),
|
||||
|
|
@ -1340,13 +1317,11 @@ pub struct PreloginData {
|
|||
}
|
||||
|
||||
#[post("/accounts/prelogin", data = "<data>")]
|
||||
async fn post_prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
|
||||
prelogin(data, ip, conn).await
|
||||
async fn post_prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
|
||||
prelogin(data, conn).await
|
||||
}
|
||||
|
||||
pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
|
||||
crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
|
||||
|
||||
pub async fn prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
|
||||
let data: PreloginData = data.into_inner();
|
||||
|
||||
let (kdf_type, kdf_iter, kdf_mem, kdf_para) = match User::find_by_mail(&data.email, &conn).await {
|
||||
|
|
@ -1354,7 +1329,7 @@ pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> J
|
|||
None => (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
|
||||
};
|
||||
|
||||
Ok(Json(json!({
|
||||
Json(json!({
|
||||
"kdf": kdf_type,
|
||||
"kdfIterations": kdf_iter,
|
||||
"kdfMemory": kdf_mem,
|
||||
|
|
@ -1366,7 +1341,7 @@ pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> J
|
|||
"parallelism": kdf_para
|
||||
},
|
||||
"salt": null,
|
||||
})))
|
||||
}))
|
||||
}
|
||||
|
||||
// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Models/Request/Accounts/SecretVerificationRequestModel.cs
|
||||
|
|
@ -1597,8 +1572,6 @@ async fn post_auth_request(
|
|||
conn: DbConn,
|
||||
nt: Notify<'_>,
|
||||
) -> JsonResult {
|
||||
crate::ratelimit::check_limit_unauthenticated(&client_headers.ip.ip)?;
|
||||
|
||||
let data = data.into_inner();
|
||||
|
||||
let Some(user) = User::find_by_mail(&data.email, &conn).await else {
|
||||
|
|
@ -1611,7 +1584,7 @@ async fn post_auth_request(
|
|||
_ => err!("AuthRequest doesn't exist", "Device verification failed"),
|
||||
};
|
||||
|
||||
let auth_request = AuthRequest::new(
|
||||
let mut auth_request = AuthRequest::new(
|
||||
user.uuid.clone(),
|
||||
data.device_identifier.clone(),
|
||||
client_headers.device_type,
|
||||
|
|
@ -1760,8 +1733,6 @@ async fn get_auth_request_response(
|
|||
client_headers: ClientHeaders,
|
||||
conn: DbConn,
|
||||
) -> JsonResult {
|
||||
crate::ratelimit::check_limit_unauthenticated(&client_headers.ip.ip)?;
|
||||
|
||||
let Some(auth_request) = AuthRequest::find_by_uuid(&auth_request_id, &conn).await else {
|
||||
err!("AuthRequest doesn't exist", "User not found")
|
||||
};
|
||||
|
|
|
|||
|
|
@ -167,7 +167,7 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
|
|||
api::core::get_eq_domains(&headers, true).into_inner()
|
||||
};
|
||||
|
||||
// This is very similar to the userDecryptionOptions sent in connect/token,
|
||||
// This is very similar to the the userDecryptionOptions sent in connect/token,
|
||||
// but as of 2025-12-19 they're both using different casing conventions.
|
||||
let has_master_password = !headers.user.password_hash.is_empty();
|
||||
let master_password_unlock = if has_master_password {
|
||||
|
|
@ -537,12 +537,11 @@ pub async fn update_cipher_from_data(
|
|||
cipher.move_to_folder(data.folder_id, &headers.user.uuid, conn).await?;
|
||||
cipher.set_favorite(data.favorite, &headers.user.uuid, conn).await?;
|
||||
|
||||
match data.archived_date {
|
||||
Some(dt_str) => match NaiveDateTime::parse_from_str(&dt_str, "%+") {
|
||||
if let Some(dt_str) = data.archived_date {
|
||||
match NaiveDateTime::parse_from_str(&dt_str, "%+") {
|
||||
Ok(dt) => cipher.set_archived_at(dt, &headers.user.uuid, conn).await?,
|
||||
Err(err) => warn!("Error parsing ArchivedDate '{dt_str}': {err}"),
|
||||
},
|
||||
None => cipher.unarchive(&headers.user.uuid, conn).await?,
|
||||
}
|
||||
}
|
||||
|
||||
if ut != UpdateType::None {
|
||||
|
|
@ -554,7 +553,15 @@ pub async fn update_cipher_from_data(
|
|||
(_, _) => EventType::CipherUpdated,
|
||||
};
|
||||
|
||||
log_event(event_type, &cipher.uuid, org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, conn)
|
||||
log_event(
|
||||
event_type as i32,
|
||||
&cipher.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
headers.device.atype,
|
||||
&headers.ip.ip,
|
||||
conn,
|
||||
)
|
||||
.await;
|
||||
}
|
||||
nt.send_cipher_update(
|
||||
|
|
@ -843,7 +850,7 @@ async fn post_collections_update(
|
|||
.await;
|
||||
|
||||
log_event(
|
||||
EventType::CipherUpdatedCollections,
|
||||
EventType::CipherUpdatedCollections as i32,
|
||||
&cipher.uuid,
|
||||
org_uuid,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -923,7 +930,7 @@ async fn post_collections_admin(
|
|||
.await;
|
||||
|
||||
log_event(
|
||||
EventType::CipherUpdatedCollections,
|
||||
EventType::CipherUpdatedCollections as i32,
|
||||
&cipher.uuid,
|
||||
org_uuid,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -1328,7 +1335,7 @@ async fn save_attachment(
|
|||
|
||||
if let Some(org_id) = &cipher.organization_uuid {
|
||||
log_event(
|
||||
EventType::CipherAttachmentCreated,
|
||||
EventType::CipherAttachmentCreated as i32,
|
||||
&cipher.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -1689,7 +1696,7 @@ async fn purge_org_vault(
|
|||
nt.send_user_update(UpdateType::SyncVault, &user, headers.device.push_uuid.as_ref(), &conn).await;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationPurgedVault,
|
||||
EventType::OrganizationPurgedVault as i32,
|
||||
&organization.org_id,
|
||||
&organization.org_id,
|
||||
&user.uuid,
|
||||
|
|
@ -1817,9 +1824,9 @@ async fn delete_cipher_by_uuid(
|
|||
let event_type = if *delete_options == CipherDeleteOptions::SoftSingle
|
||||
|| *delete_options == CipherDeleteOptions::SoftMulti
|
||||
{
|
||||
EventType::CipherSoftDeleted
|
||||
EventType::CipherSoftDeleted as i32
|
||||
} else {
|
||||
EventType::CipherDeleted
|
||||
EventType::CipherDeleted as i32
|
||||
};
|
||||
|
||||
log_event(event_type, &cipher.uuid, &org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, conn)
|
||||
|
|
@ -1888,7 +1895,7 @@ async fn restore_cipher_by_uuid(
|
|||
|
||||
if let Some(org_id) = &cipher.organization_uuid {
|
||||
log_event(
|
||||
EventType::CipherRestored,
|
||||
EventType::CipherRestored as i32,
|
||||
&cipher.uuid.clone(),
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -1965,7 +1972,7 @@ async fn delete_cipher_attachment_by_id(
|
|||
|
||||
if let Some(ref org_id) = cipher.organization_uuid {
|
||||
log_event(
|
||||
EventType::CipherAttachmentDeleted,
|
||||
EventType::CipherAttachmentDeleted as i32,
|
||||
&cipher.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ use crate::{
|
|||
auth::{AdminHeaders, Headers},
|
||||
db::{
|
||||
DbConn, DbPool,
|
||||
models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
|
||||
models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId},
|
||||
},
|
||||
util::parse_date,
|
||||
};
|
||||
|
|
@ -267,7 +267,7 @@ async fn log_user_event_impl(
|
|||
}
|
||||
|
||||
pub async fn log_event(
|
||||
event_type: EventType,
|
||||
event_type: i32,
|
||||
source_uuid: &str,
|
||||
org_id: &OrganizationId,
|
||||
act_user_id: &UserId,
|
||||
|
|
@ -278,7 +278,7 @@ pub async fn log_event(
|
|||
if !CONFIG.org_events_enabled() {
|
||||
return;
|
||||
}
|
||||
log_event_impl(event_type as i32, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
|
||||
log_event_impl(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
|
||||
}
|
||||
|
||||
#[expect(clippy::too_many_arguments)]
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
use std::collections::{HashMap, HashSet};
|
||||
|
||||
use num_traits::FromPrimitive;
|
||||
use rocket::{Route, http::Status, serde::json::Json};
|
||||
use rocket::{Route, serde::json::Json};
|
||||
use serde_json::Value;
|
||||
|
||||
use crate::{
|
||||
|
|
@ -17,8 +17,7 @@ use crate::{
|
|||
models::{
|
||||
Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType,
|
||||
Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus, MembershipType,
|
||||
OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User,
|
||||
UserId,
|
||||
OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, User, UserId,
|
||||
},
|
||||
},
|
||||
mail,
|
||||
|
|
@ -133,6 +132,7 @@ struct FullCollectionData {
|
|||
name: String,
|
||||
groups: Vec<CollectionGroupData>,
|
||||
users: Vec<CollectionMembershipData>,
|
||||
id: Option<CollectionId>,
|
||||
external_id: Option<String>,
|
||||
}
|
||||
|
||||
|
|
@ -269,7 +269,7 @@ async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, c
|
|||
}
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserLeft,
|
||||
EventType::OrganizationUserLeft as i32,
|
||||
&membership.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -327,7 +327,7 @@ async fn post_organization(
|
|||
org.save(&conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUpdated,
|
||||
EventType::OrganizationUpdated as i32,
|
||||
org_id.as_ref(),
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -391,7 +391,7 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos
|
|||
}
|
||||
|
||||
if !headers.membership.has_full_access() {
|
||||
err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
|
||||
err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
|
||||
}
|
||||
|
||||
Ok(Json(json!({
|
||||
|
|
@ -514,7 +514,7 @@ async fn post_organization_collections(
|
|||
collection.save(&conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::CollectionCreated,
|
||||
EventType::CollectionCreated as i32,
|
||||
&collection.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -597,7 +597,7 @@ async fn post_bulk_access_collections(
|
|||
collection.save(&conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::CollectionUpdated,
|
||||
EventType::CollectionUpdated as i32,
|
||||
&collection.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -674,7 +674,7 @@ async fn post_organization_collection_update(
|
|||
collection.save(&conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::CollectionUpdated,
|
||||
EventType::CollectionUpdated as i32,
|
||||
&collection.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -723,7 +723,7 @@ async fn delete_organization_collection_impl(
|
|||
err!("Collection not found", "Collection does not exist or does not belong to this organization")
|
||||
};
|
||||
log_event(
|
||||
EventType::CollectionDeleted,
|
||||
EventType::CollectionDeleted as i32,
|
||||
&collection.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -887,11 +887,11 @@ struct OrgIdData {
|
|||
#[get("/ciphers/organization-details?<data..>")]
|
||||
async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: DbConn) -> JsonResult {
|
||||
if data.organization_id != headers.membership.org_uuid {
|
||||
err_code!("Resource not found.", "Organization id's do not match", Status::NotFound.code);
|
||||
err_code!("Resource not found.", "Organization id's do not match", rocket::http::Status::NotFound.code);
|
||||
}
|
||||
|
||||
if !headers.membership.has_full_access() {
|
||||
err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
|
||||
err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
|
||||
}
|
||||
|
||||
Ok(Json(json!({
|
||||
|
|
@ -955,7 +955,7 @@ async fn get_members(
|
|||
}
|
||||
|
||||
if !headers.membership.has_full_access() {
|
||||
err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
|
||||
err_code!("Resource not found.", "User does not have full access", rocket::http::Status::NotFound.code);
|
||||
}
|
||||
|
||||
let mut users_json = Vec::new();
|
||||
|
|
@ -1148,7 +1148,7 @@ async fn send_invite(
|
|||
}
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserInvited,
|
||||
EventType::OrganizationUserInvited as i32,
|
||||
&new_member.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -1447,7 +1447,7 @@ async fn confirm_invite_impl(
|
|||
OrgPolicy::check_user_allowed(&member_to_confirm, "confirm", conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserConfirmed,
|
||||
EventType::OrganizationUserConfirmed as i32,
|
||||
&member_to_confirm.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -1637,7 +1637,7 @@ async fn edit_member(
|
|||
}
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserUpdated,
|
||||
EventType::OrganizationUserUpdated as i32,
|
||||
&member_to_edit.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -1724,7 +1724,7 @@ async fn delete_member_impl(
|
|||
}
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserRemoved,
|
||||
EventType::OrganizationUserRemoved as i32,
|
||||
&member_to_delete.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -1793,22 +1793,11 @@ async fn bulk_public_keys(
|
|||
use super::ciphers::CipherData;
|
||||
use super::ciphers::update_cipher_from_data;
|
||||
|
||||
// The import endpoint only ever uses the name/id/external_id of a collection.
|
||||
// Bitwarden's own server ignores `groups`/`users` here too, so do not make them
|
||||
// mandatory: clients are free to leave them out.
|
||||
#[derive(Deserialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
struct ImportCollectionData {
|
||||
name: String,
|
||||
id: Option<CollectionId>,
|
||||
external_id: Option<String>,
|
||||
}
|
||||
|
||||
#[derive(Deserialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
struct ImportData {
|
||||
ciphers: Vec<CipherData>,
|
||||
collections: Vec<ImportCollectionData>,
|
||||
collections: Vec<FullCollectionData>,
|
||||
collection_relationships: Vec<RelationsData>,
|
||||
}
|
||||
|
||||
|
|
@ -2155,7 +2144,7 @@ async fn put_policy(
|
|||
}
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserRemoved,
|
||||
EventType::OrganizationUserRemoved as i32,
|
||||
&member.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2181,7 +2170,7 @@ async fn put_policy(
|
|||
policy.save(&conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::PolicyUpdated,
|
||||
EventType::PolicyUpdated as i32,
|
||||
policy.uuid.as_ref(),
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2350,7 +2339,7 @@ async fn revoke_member_impl(
|
|||
member.save(conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserRevoked,
|
||||
EventType::OrganizationUserRevoked as i32,
|
||||
&member.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2448,7 +2437,7 @@ async fn restore_member_impl(
|
|||
member.save(conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserRestored,
|
||||
EventType::OrganizationUserRestored as i32,
|
||||
&member.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2487,7 +2476,7 @@ async fn get_groups_data(
|
|||
|| Collection::has_manageable_collection_by_user(&org_id, &headers.membership.user_uuid, &conn).await
|
||||
};
|
||||
if !allowed {
|
||||
err_code!("Resource not found.", "User does not have access", Status::NotFound.code);
|
||||
err_code!("Resource not found.", "User does not have access", rocket::http::Status::NotFound.code);
|
||||
}
|
||||
|
||||
let groups: Vec<Value> = if CONFIG.org_groups_enabled() {
|
||||
|
|
@ -2616,7 +2605,7 @@ async fn post_groups(
|
|||
let group = group_request.to_group(&org_id);
|
||||
|
||||
log_event(
|
||||
EventType::GroupCreated,
|
||||
EventType::GroupCreated as i32,
|
||||
&group.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2657,7 +2646,7 @@ async fn put_group(
|
|||
GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::GroupUpdated,
|
||||
EventType::GroupUpdated as i32,
|
||||
&updated_group.uuid,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2690,7 +2679,7 @@ async fn add_update_group(
|
|||
user_entry.save(conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserUpdatedGroups,
|
||||
EventType::OrganizationUserUpdatedGroups as i32,
|
||||
&assigned_member,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2765,7 +2754,7 @@ async fn delete_group_impl(
|
|||
};
|
||||
|
||||
log_event(
|
||||
EventType::GroupDeleted,
|
||||
EventType::GroupDeleted as i32,
|
||||
&group.uuid,
|
||||
org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2876,7 +2865,7 @@ async fn put_group_members(
|
|||
user_entry.save(&conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserUpdatedGroups,
|
||||
EventType::OrganizationUserUpdatedGroups as i32,
|
||||
&assigned_member,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2914,7 +2903,7 @@ async fn post_delete_group_member(
|
|||
}
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserUpdatedGroups,
|
||||
EventType::OrganizationUserUpdatedGroups as i32,
|
||||
&member_id,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
|
|
@ -2938,8 +2927,8 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
|
|||
#[derive(Deserialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
struct OrganizationUserRecoverAccountRequest {
|
||||
new_master_password_hash: Option<String>,
|
||||
key: Option<String>,
|
||||
new_master_password_hash: String,
|
||||
key: String,
|
||||
|
||||
#[serde(default)]
|
||||
reset_master_password: bool,
|
||||
|
|
@ -2983,7 +2972,12 @@ async fn put_recover_account(
|
|||
conn: DbConn,
|
||||
nt: Notify<'_>,
|
||||
) -> EmptyResult {
|
||||
recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
|
||||
let req = data.into_inner();
|
||||
if req.reset_master_password && !req.reset_two_factor {
|
||||
recover_account(org_id, member_id, headers, req, conn, nt).await
|
||||
} else {
|
||||
err!("Unsupported operation")
|
||||
}
|
||||
}
|
||||
|
||||
// Deprecated since `v2026.4.2`
|
||||
|
|
@ -3003,7 +2997,7 @@ async fn recover_account(
|
|||
org_id: OrganizationId,
|
||||
member_id: MembershipId,
|
||||
headers: AdminHeaders,
|
||||
req: OrganizationUserRecoverAccountRequest,
|
||||
reset_request: OrganizationUserRecoverAccountRequest,
|
||||
conn: DbConn,
|
||||
nt: Notify<'_>,
|
||||
) -> EmptyResult {
|
||||
|
|
@ -3018,7 +3012,7 @@ async fn recover_account(
|
|||
err!("User to reset isn't member of required organization")
|
||||
};
|
||||
|
||||
let Some(mut user) = User::find_by_uuid(&member.user_uuid, &conn).await else {
|
||||
let Some(user) = User::find_by_uuid(&member.user_uuid, &conn).await else {
|
||||
err!("User not found")
|
||||
};
|
||||
|
||||
|
|
@ -3031,56 +3025,29 @@ async fn recover_account(
|
|||
err!("Organization user must be confirmed for password reset functionality");
|
||||
}
|
||||
|
||||
let fallback_2fa_email = if req.reset_two_factor && CONFIG.email_2fa_auto_fallback() {
|
||||
TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
|
||||
} else {
|
||||
false
|
||||
};
|
||||
|
||||
// Sending email first ensure working email configuration and the resulting user notification.
|
||||
// Also this might add some protection against security flaws and misuse
|
||||
if let Err(e) = mail::send_admin_account_recovery(
|
||||
&user.email,
|
||||
user.display_name(),
|
||||
&org.name,
|
||||
req.reset_master_password,
|
||||
req.reset_two_factor,
|
||||
fallback_2fa_email,
|
||||
)
|
||||
.await
|
||||
{
|
||||
// Sending email before resetting password to ensure working email configuration and the resulting
|
||||
// user notification. Also this might add some protection against security flaws and misuse
|
||||
if let Err(e) = mail::send_admin_reset_password(&user.email, user.display_name(), &org.name).await {
|
||||
err!(format!("Error sending user reset password email: {e:#?}"));
|
||||
}
|
||||
|
||||
if req.reset_master_password {
|
||||
if let Some(key) = req.key
|
||||
&& let Some(hash) = req.new_master_password_hash
|
||||
{
|
||||
user.set_password(hash.as_str(), Some(key), true, None, &conn).await?;
|
||||
} else {
|
||||
err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
|
||||
}
|
||||
}
|
||||
|
||||
if req.reset_two_factor {
|
||||
TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
|
||||
if !fallback_2fa_email || two_factor::email::find_and_activate_email_2fa(&user.uuid, &conn).await.is_err() {
|
||||
two_factor::enforce_2fa_policy(&user, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)
|
||||
let mut user = user;
|
||||
user.set_password(reset_request.new_master_password_hash.as_str(), Some(reset_request.key), true, None, &conn)
|
||||
.await?;
|
||||
}
|
||||
}
|
||||
|
||||
user.save(&conn).await?;
|
||||
|
||||
nt.send_logout(&user, None, &conn).await;
|
||||
|
||||
if req.reset_master_password {
|
||||
headers.log_event(EventType::OrganizationUserAdminResetPassword, &member_id, &org_id, &conn).await;
|
||||
}
|
||||
|
||||
if req.reset_two_factor {
|
||||
headers.log_event(EventType::OrganizationUserAdminResetTwoFactor, &member_id, &org_id, &conn).await;
|
||||
}
|
||||
log_event(
|
||||
EventType::OrganizationUserAdminResetPassword as i32,
|
||||
&member_id,
|
||||
&org_id,
|
||||
&headers.user.uuid,
|
||||
headers.device.atype,
|
||||
&headers.ip.ip,
|
||||
&conn,
|
||||
)
|
||||
.await;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
|
@ -3199,9 +3166,9 @@ async fn put_reset_password_enrollment(
|
|||
membership.save(&conn).await?;
|
||||
|
||||
let event_type = if membership.reset_password_key.is_some() {
|
||||
EventType::OrganizationUserResetPasswordEnroll
|
||||
EventType::OrganizationUserResetPasswordEnroll as i32
|
||||
} else {
|
||||
EventType::OrganizationUserResetPasswordWithdraw
|
||||
EventType::OrganizationUserResetPasswordWithdraw as i32
|
||||
};
|
||||
|
||||
log_event(event_type, &membership.uuid, &org_id, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)
|
||||
|
|
|
|||
|
|
@ -63,19 +63,13 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
|
|||
|
||||
let user = if let Some(email) = email {
|
||||
let Some(user) = User::find_by_mail(email, &conn).await else {
|
||||
err!(
|
||||
"Username or password is incorrect. Try again",
|
||||
format!("IP: {}. Username: {email}.", client_headers.ip.ip)
|
||||
)
|
||||
err!("Username or password is incorrect. Try again.")
|
||||
};
|
||||
|
||||
if let Some(master_password_hash) = master_password_hash {
|
||||
// Check password
|
||||
if !user.check_valid_password(master_password_hash) {
|
||||
err!(
|
||||
"Username or password is incorrect. Try again",
|
||||
format!("IP: {}. Username: {email}.", client_headers.ip.ip)
|
||||
)
|
||||
err!("Username or password is incorrect. Try again.")
|
||||
}
|
||||
} else if let Some(auth_request_id) = auth_request_id {
|
||||
let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
|
||||
|
|
@ -102,10 +96,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
|
|||
};
|
||||
// SSO login only sends device id, so we get the user by the most recently used device
|
||||
let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
|
||||
err!(
|
||||
"Username or password is incorrect. Try again",
|
||||
format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
|
||||
)
|
||||
err!("Username or password is incorrect. Try again.")
|
||||
};
|
||||
|
||||
user
|
||||
|
|
|
|||
|
|
@ -16,8 +16,8 @@ use crate::{
|
|||
db::{
|
||||
DbConn, DbPool,
|
||||
models::{
|
||||
Device, DeviceType, EventType, Membership, MembershipType, OrgPolicyType, Organization, OrganizationId,
|
||||
TwoFactor, TwoFactorIncomplete, TwoFactorType, User, UserId,
|
||||
DeviceType, EventType, Membership, MembershipType, OrgPolicyType, Organization, OrganizationId, TwoFactor,
|
||||
TwoFactorIncomplete, TwoFactorType, User, UserId,
|
||||
},
|
||||
},
|
||||
mail,
|
||||
|
|
@ -151,7 +151,6 @@ async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, c
|
|||
|
||||
if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
|
||||
twofactor.delete(&conn).await?;
|
||||
Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
|
||||
log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
|
||||
.await;
|
||||
}
|
||||
|
|
@ -191,7 +190,7 @@ pub async fn enforce_2fa_policy(
|
|||
member.save(conn).await?;
|
||||
|
||||
log_event(
|
||||
EventType::OrganizationUserRevoked,
|
||||
EventType::OrganizationUserRevoked as i32,
|
||||
&member.uuid,
|
||||
&member.org_uuid,
|
||||
act_user_id,
|
||||
|
|
@ -225,7 +224,15 @@ pub async fn enforce_2fa_policy_for_org(
|
|||
member.revoke();
|
||||
member.save(conn).await?;
|
||||
|
||||
log_event(EventType::OrganizationUserRevoked, &member.uuid, org_id, act_user_id, device_type, ip, conn)
|
||||
log_event(
|
||||
EventType::OrganizationUserRevoked as i32,
|
||||
&member.uuid,
|
||||
org_id,
|
||||
act_user_id,
|
||||
device_type,
|
||||
ip,
|
||||
conn,
|
||||
)
|
||||
.await;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ use num_traits::FromPrimitive;
|
|||
use rocket::{
|
||||
Route,
|
||||
form::{Form, FromForm},
|
||||
http::{Accept, Cookie, CookieJar, MediaType, SameSite},
|
||||
http::{Cookie, CookieJar, SameSite},
|
||||
response::Redirect,
|
||||
serde::json::Json,
|
||||
};
|
||||
|
|
@ -234,24 +234,6 @@ async fn sso_login(
|
|||
}
|
||||
)
|
||||
}
|
||||
Some((user, None))
|
||||
if user.private_key.is_none()
|
||||
&& !CONFIG.sso_signups_allowed()
|
||||
&& !CONFIG.is_email_domain_allowed(&user.email)
|
||||
&& !CONFIG.mail_enabled()
|
||||
&& Invitation::find_by_mail(&user.email, conn).await.is_none() =>
|
||||
{
|
||||
error!(
|
||||
"Login failure ({}), no invitation with email ({}) was found",
|
||||
user_infos.identifier, user.email
|
||||
);
|
||||
err_silent!(
|
||||
"Missing invitation",
|
||||
ErrorEvent {
|
||||
event: EventType::UserFailedLogIn
|
||||
}
|
||||
)
|
||||
}
|
||||
Some((user, None)) if user.private_key.is_some() && !CONFIG.sso_signups_match_email() => {
|
||||
error!(
|
||||
"Login failure ({}), existing non SSO user ({}) with same email ({}) and association is disabled",
|
||||
|
|
@ -299,15 +281,7 @@ async fn sso_login(
|
|||
// Will trigger 2FA flow if needed
|
||||
let (user, mut device, twofactor_token, sso_user) = match user_with_sso {
|
||||
None => {
|
||||
if !CONFIG.is_sso_signup_allowed(&user_infos.email) {
|
||||
if CONFIG.signups_domains_whitelist().is_empty() {
|
||||
err!(
|
||||
"Signups are disabled. You will need an invitation",
|
||||
ErrorEvent {
|
||||
event: EventType::UserFailedLogIn
|
||||
}
|
||||
);
|
||||
}
|
||||
if !CONFIG.is_email_domain_allowed(&user_infos.email) {
|
||||
err!(
|
||||
"Email domain not allowed",
|
||||
ErrorEvent {
|
||||
|
|
@ -905,12 +879,6 @@ async fn twofactor_auth(
|
|||
|
||||
// Remove all twofactors from the user
|
||||
TwoFactor::delete_all_by_user(&user.uuid, conn).await?;
|
||||
|
||||
// No device may keep skipping 2FA once every second factor is gone.
|
||||
// `device` is cleared in memory too, since saving it later would restore its token.
|
||||
Device::clear_twofactor_remember_by_user(&user.uuid, conn).await?;
|
||||
device.delete_twofactor_remember();
|
||||
|
||||
enforce_2fa_policy(user, &user.uuid, device.atype, &ip.ip, conn).await?;
|
||||
|
||||
log_user_event(EventType::UserRecovered2fa as i32, &user.uuid, device.atype, &ip.ip, conn).await;
|
||||
|
|
@ -1056,13 +1024,13 @@ async fn json_err_twofactor(
|
|||
}
|
||||
|
||||
#[post("/accounts/prelogin", data = "<data>")]
|
||||
async fn post_prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
|
||||
prelogin(data, ip, conn).await
|
||||
async fn post_prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
|
||||
prelogin(data, conn).await
|
||||
}
|
||||
|
||||
#[post("/accounts/prelogin/password", data = "<data>")]
|
||||
async fn prelogin_password(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
|
||||
prelogin(data, ip, conn).await
|
||||
async fn prelogin_password(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
|
||||
prelogin(data, conn).await
|
||||
}
|
||||
|
||||
#[post("/accounts/register", data = "<data>")]
|
||||
|
|
@ -1083,18 +1051,11 @@ enum RegisterVerificationResponse {
|
|||
#[response(status = 204)]
|
||||
NoContent(()),
|
||||
Token(Json<String>),
|
||||
PlainToken(String),
|
||||
}
|
||||
|
||||
// Return JSON only when the client explicitly requests it, otherwise return plain text.
|
||||
fn accepts_json(accept: Option<&Accept>) -> bool {
|
||||
accept.is_some_and(|accept| accept.preferred().media_type() == &MediaType::JSON)
|
||||
}
|
||||
|
||||
#[post("/accounts/register/send-verification-email", data = "<data>")]
|
||||
async fn register_verification_email(
|
||||
data: Json<RegisterVerificationData>,
|
||||
accept: Option<&Accept>,
|
||||
ip: ClientIp,
|
||||
conn: DbConn,
|
||||
) -> ApiResult<RegisterVerificationResponse> {
|
||||
|
|
@ -1132,11 +1093,7 @@ async fn register_verification_email(
|
|||
} else {
|
||||
// If email verification is not required, return the token directly
|
||||
// the clients will use this token to finish the registration
|
||||
Ok(if accepts_json(accept) {
|
||||
RegisterVerificationResponse::Token(Json(token))
|
||||
} else {
|
||||
RegisterVerificationResponse::PlainToken(token)
|
||||
})
|
||||
Ok(RegisterVerificationResponse::Token(Json(token)))
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -301,6 +301,9 @@ pub fn static_files(filename: &str) -> Result<(ContentType, &'static [u8]), Erro
|
|||
"jdenticon-3.3.0.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/jdenticon-3.3.0.js"))),
|
||||
"datatables.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/datatables.js"))),
|
||||
"datatables.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/datatables.css"))),
|
||||
"jquery-4.0.0.slim.js" => {
|
||||
Ok((ContentType::JavaScript, include_bytes!("../static/scripts/jquery-4.0.0.slim.js")))
|
||||
}
|
||||
_ => err!(format!("Static file not found: {filename}")),
|
||||
}
|
||||
}
|
||||
|
|
|
|||
12
src/auth.rs
12
src/auth.rs
|
|
@ -23,14 +23,14 @@ use rocket::{
|
|||
|
||||
use crate::{
|
||||
CONFIG,
|
||||
api::{ApiResult, core::log_event},
|
||||
api::ApiResult,
|
||||
config::PathType,
|
||||
db::{
|
||||
DbConn,
|
||||
models::{
|
||||
AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
|
||||
EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
|
||||
SendFileId, SendId, User, UserId, UserStampException,
|
||||
Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId, SendFileId,
|
||||
SendId, User, UserId, UserStampException,
|
||||
},
|
||||
},
|
||||
error::Error,
|
||||
|
|
@ -822,12 +822,6 @@ pub struct AdminHeaders {
|
|||
pub org_id: OrganizationId,
|
||||
}
|
||||
|
||||
impl AdminHeaders {
|
||||
pub async fn log_event(&self, event_type: EventType, source_uuid: &str, org_id: &OrganizationId, conn: &DbConn) {
|
||||
log_event(event_type, source_uuid, org_id, &self.user.uuid, self.device.atype, &self.ip.ip, conn).await;
|
||||
}
|
||||
}
|
||||
|
||||
#[rocket::async_trait]
|
||||
impl<'r> FromRequest<'r> for AdminHeaders {
|
||||
type Error = &'static str;
|
||||
|
|
|
|||
|
|
@ -817,8 +817,6 @@ make_config! {
|
|||
sso_enabled: bool, true, def, false;
|
||||
/// Only SSO login |> Disable Email+Master Password login
|
||||
sso_only: bool, true, def, false;
|
||||
/// Allow SSO flow to create account |> You probably want to disable it when using a public provider
|
||||
sso_signups_allowed: bool, true, def, true;
|
||||
/// Allow email association |> Associate existing non-SSO user based on email
|
||||
sso_signups_match_email: bool, true, def, true;
|
||||
/// Allow unknown email verification status |> Allowing this with `SSO_SIGNUPS_MATCH_EMAIL=true` open potential account takeover.
|
||||
|
|
@ -1272,7 +1270,7 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
|
|||
if !cfg.disable_admin_token {
|
||||
match cfg.admin_token.as_ref() {
|
||||
Some(t) if t.starts_with("$argon2") => {
|
||||
if let Err(e) = argon2::password_hash::phc::PasswordHash::new(t) {
|
||||
if let Err(e) = argon2::password_hash::PasswordHash::new(t) {
|
||||
err!(format!("The configured Argon2 PHC in `ADMIN_TOKEN` is invalid: '{e}'"))
|
||||
}
|
||||
}
|
||||
|
|
@ -1425,7 +1423,6 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
|
|||
"desktop-ui-migration-milestone-4",
|
||||
// Auth Team
|
||||
"pm-5594-safari-account-switching",
|
||||
"pm-32413-multi-client-password-management",
|
||||
// Autofill Team
|
||||
"ssh-agent",
|
||||
"ssh-agent-v2",
|
||||
|
|
@ -1547,17 +1544,6 @@ impl Config {
|
|||
}
|
||||
}
|
||||
|
||||
/// Tests whether SSO signup is allowed for an email address, taking into
|
||||
/// account the sso_signups_allowed and signups_domains_whitelist settings.
|
||||
pub fn is_sso_signup_allowed(&self, email: &str) -> bool {
|
||||
if self.signups_domains_whitelist().is_empty() {
|
||||
self.sso_signups_allowed()
|
||||
} else {
|
||||
// The whitelist setting overrides the signups_allowed setting.
|
||||
self.is_email_domain_allowed(email)
|
||||
}
|
||||
}
|
||||
|
||||
// The registration link should be hidden if
|
||||
// - Signup is not allowed and email whitelist is empty unless mail is disabled and invitations are allowed
|
||||
// - The SSO is activated and password login is disabled.
|
||||
|
|
@ -1745,7 +1731,7 @@ where
|
|||
reg!("email/email_footer");
|
||||
reg!("email/email_footer_text");
|
||||
|
||||
reg!("email/admin_account_recovery", ".html");
|
||||
reg!("email/admin_reset_password", ".html");
|
||||
reg!("email/change_email_existing", ".html");
|
||||
reg!("email/change_email_invited", ".html");
|
||||
reg!("email/change_email", ".html");
|
||||
|
|
|
|||
|
|
@ -41,20 +41,17 @@ impl Archive {
|
|||
) -> EmptyResult {
|
||||
User::update_uuid_revision(user_uuid, conn).await;
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(archives::table)
|
||||
sqlite, mysql {
|
||||
diesel::replace_into(archives::table)
|
||||
.values((
|
||||
archives::user_uuid.eq(user_uuid),
|
||||
archives::cipher_uuid.eq(cipher_uuid),
|
||||
archives::archived_at.eq(archived_at),
|
||||
))
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.set(archives::archived_at.eq(archived_at))
|
||||
.execute(conn)
|
||||
.map_res("Error saving archive")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
postgresql {
|
||||
diesel::insert_into(archives::table)
|
||||
.values((
|
||||
archives::user_uuid.eq(user_uuid),
|
||||
|
|
|
|||
|
|
@ -82,16 +82,24 @@ impl Attachment {
|
|||
impl Attachment {
|
||||
pub async fn save(&self, conn: &DbConn) -> EmptyResult {
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(attachments::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(attachments::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(attachments::table)
|
||||
.filter(attachments::id.eq(&self.id))
|
||||
.set(self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving attachment")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving attachment")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(attachments::table)
|
||||
.values(self)
|
||||
.on_conflict(attachments::id)
|
||||
|
|
|
|||
|
|
@ -82,23 +82,31 @@ impl AuthRequest {
|
|||
}
|
||||
|
||||
impl AuthRequest {
|
||||
pub async fn save(&self, conn: &DbConn) -> EmptyResult {
|
||||
pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(auth_requests::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.set(self)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(auth_requests::table)
|
||||
.values(&*self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving auth_request")
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(auth_requests::table)
|
||||
.filter(auth_requests::uuid.eq(&self.uuid))
|
||||
.set(&*self)
|
||||
.execute(conn)
|
||||
.map_res("Error auth_request")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error auth_request")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(auth_requests::table)
|
||||
.values(self)
|
||||
.values(&*self)
|
||||
.on_conflict(auth_requests::uuid)
|
||||
.do_update()
|
||||
.set(self)
|
||||
.set(&*self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving auth_request")
|
||||
}
|
||||
|
|
|
|||
|
|
@ -440,16 +440,24 @@ impl Cipher {
|
|||
self.updated_at = Utc::now().naive_utc();
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(ciphers::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(ciphers::table)
|
||||
.values(&*self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(ciphers::table)
|
||||
.filter(ciphers::uuid.eq(&self.uuid))
|
||||
.set(&*self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving cipher")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving cipher")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(ciphers::table)
|
||||
.values(&*self)
|
||||
.on_conflict(ciphers::uuid)
|
||||
|
|
|
|||
|
|
@ -168,16 +168,24 @@ impl Collection {
|
|||
self.update_users_revision(conn).await;
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(collections::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(collections::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(collections::table)
|
||||
.filter(collections::uuid.eq(&self.uuid))
|
||||
.set(self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving collection")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving collection")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(collections::table)
|
||||
.values(self)
|
||||
.on_conflict(collections::uuid)
|
||||
|
|
@ -720,30 +728,53 @@ impl CollectionUser {
|
|||
) -> EmptyResult {
|
||||
User::update_uuid_revision(user_uuid, conn).await;
|
||||
|
||||
let values = (
|
||||
db_run! { conn:
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(users_collections::table)
|
||||
.values((
|
||||
users_collections::user_uuid.eq(user_uuid),
|
||||
users_collections::collection_uuid.eq(collection_uuid),
|
||||
users_collections::read_only.eq(read_only),
|
||||
users_collections::hide_passwords.eq(hide_passwords),
|
||||
users_collections::manage.eq(manage),
|
||||
);
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(users_collections::table)
|
||||
.values(values)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.set(values)
|
||||
))
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(users_collections::table)
|
||||
.filter(users_collections::user_uuid.eq(user_uuid))
|
||||
.filter(users_collections::collection_uuid.eq(collection_uuid))
|
||||
.set((
|
||||
users_collections::user_uuid.eq(user_uuid),
|
||||
users_collections::collection_uuid.eq(collection_uuid),
|
||||
users_collections::read_only.eq(read_only),
|
||||
users_collections::hide_passwords.eq(hide_passwords),
|
||||
users_collections::manage.eq(manage),
|
||||
))
|
||||
.execute(conn)
|
||||
.map_res("Error adding user to collection")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error adding user to collection")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(users_collections::table)
|
||||
.values(values)
|
||||
.values((
|
||||
users_collections::user_uuid.eq(user_uuid),
|
||||
users_collections::collection_uuid.eq(collection_uuid),
|
||||
users_collections::read_only.eq(read_only),
|
||||
users_collections::hide_passwords.eq(hide_passwords),
|
||||
users_collections::manage.eq(manage),
|
||||
))
|
||||
.on_conflict((users_collections::user_uuid, users_collections::collection_uuid))
|
||||
.do_update()
|
||||
.set(values)
|
||||
.set((
|
||||
users_collections::read_only.eq(read_only),
|
||||
users_collections::hide_passwords.eq(hide_passwords),
|
||||
users_collections::manage.eq(manage),
|
||||
))
|
||||
.execute(conn)
|
||||
.map_res("Error adding user to collection")
|
||||
}
|
||||
|
|
@ -878,18 +909,19 @@ impl CollectionCipher {
|
|||
Self::update_users_revision(collection_uuid, conn).await;
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(ciphers_collections::table)
|
||||
sqlite, mysql {
|
||||
// Not checking for ForeignKey Constraints here.
|
||||
// Table ciphers_collections does not have ForeignKey Constraints which would cause conflicts.
|
||||
// This table has no constraints pointing to itself, but only to others.
|
||||
diesel::replace_into(ciphers_collections::table)
|
||||
.values((
|
||||
ciphers_collections::cipher_uuid.eq(cipher_uuid),
|
||||
ciphers_collections::collection_uuid.eq(collection_uuid),
|
||||
))
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_nothing()
|
||||
.execute(conn)
|
||||
.map_res("Error adding cipher to collection")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
postgresql {
|
||||
diesel::insert_into(ciphers_collections::table)
|
||||
.values((
|
||||
ciphers_collections::cipher_uuid.eq(cipher_uuid),
|
||||
|
|
|
|||
|
|
@ -146,18 +146,15 @@ impl Device {
|
|||
}
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
sqlite, mysql {
|
||||
crate::util::retry(||
|
||||
diesel::insert_into(devices::table)
|
||||
diesel::replace_into(devices::table)
|
||||
.values(&*self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.set(&*self)
|
||||
.execute(conn),
|
||||
10,
|
||||
).map_res("Error saving device")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
postgresql {
|
||||
crate::util::retry(||
|
||||
diesel::insert_into(devices::table)
|
||||
.values(&*self)
|
||||
|
|
@ -269,22 +266,10 @@ impl Device {
|
|||
let devices = Self::find_by_user(user_uuid, conn).await;
|
||||
for mut device in devices {
|
||||
device.refresh_token = Device::generate_refresh_token();
|
||||
device.twofactor_remember = None;
|
||||
device.save(false, conn).await?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn clear_twofactor_remember_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
|
||||
conn.run(move |conn| {
|
||||
diesel::update(devices::table)
|
||||
.filter(devices::user_uuid.eq(user_uuid))
|
||||
.set(devices::twofactor_remember.eq::<Option<String>>(None))
|
||||
.execute(conn)
|
||||
.map_res("Error removing two factor remember tokens")
|
||||
})
|
||||
.await
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Display)]
|
||||
|
|
|
|||
|
|
@ -146,16 +146,24 @@ impl EmergencyAccess {
|
|||
self.updated_at = Utc::now().naive_utc();
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(emergency_access::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(emergency_access::table)
|
||||
.values(&*self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(emergency_access::table)
|
||||
.filter(emergency_access::uuid.eq(&self.uuid))
|
||||
.set(&*self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving emergency access")
|
||||
.map_res("Error updating emergency access")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving emergency access")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(emergency_access::table)
|
||||
.values(&*self)
|
||||
.on_conflict(emergency_access::uuid)
|
||||
|
|
|
|||
|
|
@ -43,7 +43,7 @@ pub struct Event {
|
|||
pub provider_org_uuid: Option<String>,
|
||||
}
|
||||
|
||||
// Upstream enum: https://github.com/bitwarden/server/blob/v2026.6.2/src/Core/Dirt/Enums/EventType.cs
|
||||
// Upstream enum: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/EventType.cs
|
||||
#[derive(Debug, Copy, Clone)]
|
||||
pub enum EventType {
|
||||
// User
|
||||
|
|
@ -108,12 +108,6 @@ pub enum EventType {
|
|||
OrganizationUserRejectedAuthRequest = 1514,
|
||||
OrganizationUserDeleted = 1515, // Both user and organization user data were deleted
|
||||
OrganizationUserLeft = 1516, // User voluntarily left the organization
|
||||
// OrganizationUserAutomaticallyConfirmed = 1517,
|
||||
// OrganizationUserSelfRevoked = 1518, // User self-revoked due to declining organization data ownership policy
|
||||
OrganizationUserAdminResetTwoFactor = 1519,
|
||||
// OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
|
||||
// OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
|
||||
// OrganizationUserNotificationBannerActionClicked = 1522,
|
||||
|
||||
// Organization
|
||||
OrganizationUpdated = 1600,
|
||||
|
|
@ -208,16 +202,13 @@ impl Event {
|
|||
/// Basic Queries
|
||||
pub async fn save(&self, conn: &DbConn) -> EmptyResult {
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(event::table)
|
||||
sqlite, mysql {
|
||||
diesel::replace_into(event::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.set(self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving event")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
postgresql {
|
||||
diesel::insert_into(event::table)
|
||||
.values(self)
|
||||
.on_conflict(event::uuid)
|
||||
|
|
|
|||
|
|
@ -77,16 +77,24 @@ impl Folder {
|
|||
self.updated_at = Utc::now().naive_utc();
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(folders::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(folders::table)
|
||||
.values(&*self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(folders::table)
|
||||
.filter(folders::uuid.eq(&self.uuid))
|
||||
.set(&*self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving folder")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving folder")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(folders::table)
|
||||
.values(&*self)
|
||||
.on_conflict(folders::uuid)
|
||||
|
|
@ -139,15 +147,16 @@ impl Folder {
|
|||
impl FolderCipher {
|
||||
pub async fn save(&self, conn: &DbConn) -> EmptyResult {
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(folders_ciphers::table)
|
||||
sqlite, mysql {
|
||||
// Not checking for ForeignKey Constraints here.
|
||||
// Table folders_ciphers does not have ForeignKey Constraints which would cause conflicts.
|
||||
// This table has no constraints pointing to itself, but only to others.
|
||||
diesel::replace_into(folders_ciphers::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_nothing()
|
||||
.execute(conn)
|
||||
.map_res("Error adding cipher to folder")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
postgresql {
|
||||
diesel::insert_into(folders_ciphers::table)
|
||||
.values(self)
|
||||
.on_conflict((folders_ciphers::cipher_uuid, folders_ciphers::folder_uuid))
|
||||
|
|
|
|||
|
|
@ -166,16 +166,24 @@ impl Group {
|
|||
self.revision_date = Utc::now().naive_utc();
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(groups::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(groups::table)
|
||||
.values(&*self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(groups::table)
|
||||
.filter(groups::uuid.eq(&self.uuid))
|
||||
.set(&*self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving group")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving group")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(groups::table)
|
||||
.values(&*self)
|
||||
.on_conflict(groups::uuid)
|
||||
|
|
@ -318,30 +326,53 @@ impl CollectionGroup {
|
|||
group_user.update_user_revision(conn).await;
|
||||
}
|
||||
|
||||
let values = (
|
||||
db_run! { conn:
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(collections_groups::table)
|
||||
.values((
|
||||
collections_groups::collections_uuid.eq(&self.collections_uuid),
|
||||
collections_groups::groups_uuid.eq(&self.groups_uuid),
|
||||
collections_groups::read_only.eq(&self.read_only),
|
||||
collections_groups::hide_passwords.eq(&self.hide_passwords),
|
||||
collections_groups::manage.eq(&self.manage),
|
||||
);
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(collections_groups::table)
|
||||
.values(values)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.set(values)
|
||||
))
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(collections_groups::table)
|
||||
.filter(collections_groups::collections_uuid.eq(&self.collections_uuid))
|
||||
.filter(collections_groups::groups_uuid.eq(&self.groups_uuid))
|
||||
.set((
|
||||
collections_groups::collections_uuid.eq(&self.collections_uuid),
|
||||
collections_groups::groups_uuid.eq(&self.groups_uuid),
|
||||
collections_groups::read_only.eq(&self.read_only),
|
||||
collections_groups::hide_passwords.eq(&self.hide_passwords),
|
||||
collections_groups::manage.eq(&self.manage),
|
||||
))
|
||||
.execute(conn)
|
||||
.map_res("Error adding group to collection")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error adding group to collection")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(collections_groups::table)
|
||||
.values(values)
|
||||
.values((
|
||||
collections_groups::collections_uuid.eq(&self.collections_uuid),
|
||||
collections_groups::groups_uuid.eq(&self.groups_uuid),
|
||||
collections_groups::read_only.eq(self.read_only),
|
||||
collections_groups::hide_passwords.eq(self.hide_passwords),
|
||||
collections_groups::manage.eq(self.manage),
|
||||
))
|
||||
.on_conflict((collections_groups::collections_uuid, collections_groups::groups_uuid))
|
||||
.do_update()
|
||||
.set(values)
|
||||
.set((
|
||||
collections_groups::read_only.eq(self.read_only),
|
||||
collections_groups::hide_passwords.eq(self.hide_passwords),
|
||||
collections_groups::manage.eq(self.manage),
|
||||
))
|
||||
.execute(conn)
|
||||
.map_res("Error adding group to collection")
|
||||
}
|
||||
|
|
@ -466,25 +497,43 @@ impl GroupUser {
|
|||
pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
|
||||
self.update_user_revision(conn).await;
|
||||
|
||||
let values = (
|
||||
db_run! { conn:
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(groups_users::table)
|
||||
.values((
|
||||
groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
|
||||
groups_users::groups_uuid.eq(&self.groups_uuid),
|
||||
);
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(groups_users::table)
|
||||
.values(values)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_nothing()
|
||||
))
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(groups_users::table)
|
||||
.filter(groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid))
|
||||
.filter(groups_users::groups_uuid.eq(&self.groups_uuid))
|
||||
.set((
|
||||
groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
|
||||
groups_users::groups_uuid.eq(&self.groups_uuid),
|
||||
))
|
||||
.execute(conn)
|
||||
.map_res("Error adding user to group")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error adding user to group")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(groups_users::table)
|
||||
.values(values)
|
||||
.values((
|
||||
groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
|
||||
groups_users::groups_uuid.eq(&self.groups_uuid),
|
||||
))
|
||||
.on_conflict((groups_users::users_organizations_uuid, groups_users::groups_uuid))
|
||||
.do_nothing()
|
||||
.do_update()
|
||||
.set((
|
||||
groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
|
||||
groups_users::groups_uuid.eq(&self.groups_uuid),
|
||||
))
|
||||
.execute(conn)
|
||||
.map_res("Error adding user to group")
|
||||
}
|
||||
|
|
|
|||
|
|
@ -318,13 +318,6 @@ impl OrgPolicy {
|
|||
}
|
||||
|
||||
pub async fn org_is_reset_password_auto_enroll(org_uuid: &OrganizationId, conn: &DbConn) -> bool {
|
||||
// Account recovery depends on outbound mail. When SMTP is disabled, treat the
|
||||
// auto-enroll policy as inactive so invites/registration are not forced to
|
||||
// supply a reset-password key (see check_reset_password_applicable).
|
||||
if !CONFIG.mail_enabled() {
|
||||
return false;
|
||||
}
|
||||
|
||||
match OrgPolicy::find_by_org_and_type(org_uuid, OrgPolicyType::ResetPassword, conn).await {
|
||||
Some(policy) => match serde_json::from_str::<ResetPasswordDataModel>(&policy.data) {
|
||||
Ok(opts) => {
|
||||
|
|
|
|||
|
|
@ -353,16 +353,25 @@ impl Organization {
|
|||
}
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(organizations::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(organizations::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(organizations::table)
|
||||
.filter(organizations::uuid.eq(&self.uuid))
|
||||
.set(self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving organization")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving organization")
|
||||
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(organizations::table)
|
||||
.values(self)
|
||||
.on_conflict(organizations::uuid)
|
||||
|
|
@ -744,16 +753,24 @@ impl Membership {
|
|||
User::update_uuid_revision(&self.user_uuid, conn).await;
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(users_organizations::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(users_organizations::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(users_organizations::table)
|
||||
.filter(users_organizations::uuid.eq(&self.uuid))
|
||||
.set(self)
|
||||
.execute(conn)
|
||||
.map_res("Error adding user to organization")
|
||||
},
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error adding user to organization")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
postgresql {
|
||||
diesel::insert_into(users_organizations::table)
|
||||
.values(self)
|
||||
.on_conflict(users_organizations::uuid)
|
||||
|
|
@ -1169,16 +1186,25 @@ impl Membership {
|
|||
impl OrganizationApiKey {
|
||||
pub async fn save(&self, conn: &DbConn) -> EmptyResult {
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(organization_api_key::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(organization_api_key::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(organization_api_key::table)
|
||||
.filter(organization_api_key::uuid.eq(&self.uuid))
|
||||
.set(self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving organization")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving organization")
|
||||
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(organization_api_key::table)
|
||||
.values(self)
|
||||
.on_conflict((organization_api_key::uuid, organization_api_key::org_uuid))
|
||||
|
|
|
|||
|
|
@ -202,16 +202,24 @@ impl Send {
|
|||
self.revision_date = Utc::now().naive_utc();
|
||||
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(sends::table)
|
||||
sqlite, mysql {
|
||||
match diesel::replace_into(sends::table)
|
||||
.values(&*self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_update()
|
||||
.execute(conn)
|
||||
{
|
||||
Ok(_) => Ok(()),
|
||||
// Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
|
||||
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
|
||||
diesel::update(sends::table)
|
||||
.filter(sends::uuid.eq(&self.uuid))
|
||||
.set(&*self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving send")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
Err(e) => Err(e.into()),
|
||||
}.map_res("Error saving send")
|
||||
}
|
||||
postgresql {
|
||||
diesel::insert_into(sends::table)
|
||||
.values(&*self)
|
||||
.on_conflict(sends::uuid)
|
||||
|
|
|
|||
|
|
@ -463,17 +463,15 @@ impl Invitation {
|
|||
}
|
||||
|
||||
db_run! { conn:
|
||||
sqlite, mysql {
|
||||
// Not checking for ForeignKey Constraints here
|
||||
// Table invitations does not have any ForeignKey Constraints.
|
||||
mysql {
|
||||
diesel::insert_into(invitations::table)
|
||||
diesel::replace_into(invitations::table)
|
||||
.values(self)
|
||||
.on_conflict(diesel::dsl::DuplicatedKeys)
|
||||
.do_nothing()
|
||||
.execute(conn)
|
||||
.map_res("Error saving invitation")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
postgresql {
|
||||
diesel::insert_into(invitations::table)
|
||||
.values(self)
|
||||
.on_conflict(invitations::email)
|
||||
|
|
@ -530,13 +528,13 @@ pub struct UserId(String);
|
|||
impl SsoUser {
|
||||
pub async fn save(&self, conn: &DbConn) -> EmptyResult {
|
||||
db_run! { conn:
|
||||
mysql {
|
||||
diesel::insert_into(sso_users::table)
|
||||
sqlite, mysql {
|
||||
diesel::replace_into(sso_users::table)
|
||||
.values(self)
|
||||
.execute(conn)
|
||||
.map_res("Error saving SSO user")
|
||||
}
|
||||
postgresql, sqlite {
|
||||
postgresql {
|
||||
diesel::insert_into(sso_users::table)
|
||||
.values(self)
|
||||
.execute(conn)
|
||||
|
|
|
|||
|
|
@ -14,10 +14,7 @@ use reqwest::{
|
|||
};
|
||||
use url::Host;
|
||||
|
||||
use crate::{
|
||||
CONFIG,
|
||||
util::{get_env_bool, is_global},
|
||||
};
|
||||
use crate::{CONFIG, util::is_global};
|
||||
|
||||
pub fn make_http_request(method: reqwest::Method, url: &str) -> Result<reqwest::RequestBuilder, crate::Error> {
|
||||
static INSTANCE: LazyLock<Client> =
|
||||
|
|
@ -39,7 +36,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
|
|||
let mut headers = header::HeaderMap::new();
|
||||
headers.insert(header::USER_AGENT, header::HeaderValue::from_static("Vaultwarden"));
|
||||
|
||||
let redirect_policy = reqwest::redirect::Policy::custom(move |attempt| {
|
||||
let redirect_policy = reqwest::redirect::Policy::custom(|attempt| {
|
||||
if attempt.previous().len() >= 5 {
|
||||
return attempt.error("Too many redirects");
|
||||
}
|
||||
|
|
@ -48,7 +45,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
|
|||
return attempt.error("Invalid host");
|
||||
};
|
||||
|
||||
if enforce_block && let Err(e) = should_block_host(&host) {
|
||||
if let Err(e) = should_block_host(&host) {
|
||||
return attempt.error(e);
|
||||
}
|
||||
|
||||
|
|
@ -62,14 +59,6 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
|
|||
.timeout(Duration::from_secs(10))
|
||||
}
|
||||
|
||||
fn dns_prefer_ipv6() -> bool {
|
||||
// CONFIG may require DNS to initialize, so avoid forcing it during bootstrap.
|
||||
match LazyLock::get(&CONFIG) {
|
||||
Some(config) => config.dns_prefer_ipv6(),
|
||||
None => get_env_bool("DNS_PREFER_IPV6").unwrap_or(false),
|
||||
}
|
||||
}
|
||||
|
||||
fn should_block_ip(ip: IpAddr) -> bool {
|
||||
if !CONFIG.http_request_block_non_global_ips() {
|
||||
return false;
|
||||
|
|
@ -269,8 +258,12 @@ impl CustomDnsResolver {
|
|||
fn new() -> Arc<Self> {
|
||||
TokioResolver::builder(TokioRuntimeProvider::default())
|
||||
.and_then(|mut builder| {
|
||||
// Query both families; the preferred order is applied per lookup below.
|
||||
// Hickory's default since v0.26 is `Ipv6AndIpv4`, which sorts IPv6 first
|
||||
// This might cause issues on IPv4 only systems or containers
|
||||
// Unless someone enabled DNS_PREFER_IPV6, use Ipv4AndIpv6, which returns IPv4 first which was our previous default
|
||||
if !CONFIG.dns_prefer_ipv6() {
|
||||
builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
|
||||
}
|
||||
builder.build()
|
||||
})
|
||||
.inspect_err(|e| warn!("Error creating Hickory resolver, falling back to default: {e:?}"))
|
||||
|
|
@ -296,17 +289,6 @@ impl CustomDnsResolver {
|
|||
}
|
||||
}
|
||||
|
||||
fn sort_addresses(addresses: &mut [SocketAddr], prefer_ipv6: bool) {
|
||||
// `sort_by_key` orders `false` before `true`.
|
||||
// When IPv6 is preferred, IPv6 addresses return `false` for `is_ipv4()` and sort first.
|
||||
// When IPv4 is preferred, IPv4 addresses return `false` for `is_ipv6()` and sort first.
|
||||
if prefer_ipv6 {
|
||||
addresses.sort_by_key(SocketAddr::is_ipv4);
|
||||
} else {
|
||||
addresses.sort_by_key(SocketAddr::is_ipv6);
|
||||
}
|
||||
}
|
||||
|
||||
fn pre_resolve(name: &str, enforce_block: bool) -> Result<(), CustomHttpClientError> {
|
||||
let Ok(host) = get_valid_host(name) else {
|
||||
return Err(CustomHttpClientError::Invalid {
|
||||
|
|
@ -338,9 +320,7 @@ impl Resolve for CustomDns {
|
|||
let this = Arc::clone(&self.resolver);
|
||||
Box::pin(async move {
|
||||
let name = name.as_str();
|
||||
let mut results = this.resolve_domain(name, enforce_block).await?;
|
||||
// Recheck after bootstrap so long-lived clients adopt the loaded config.
|
||||
sort_addresses(&mut results, dns_prefer_ipv6());
|
||||
let results = this.resolve_domain(name, enforce_block).await?;
|
||||
if results.is_empty() {
|
||||
warn!("Unable to resolve {name} to any valid IP address");
|
||||
}
|
||||
|
|
@ -359,29 +339,10 @@ pub(crate) mod aws {
|
|||
};
|
||||
use reqwest::Client;
|
||||
|
||||
use super::get_reqwest_client_builder;
|
||||
|
||||
// Adapter that wraps reqwest to be compatible with the AWS SDK
|
||||
#[derive(Debug)]
|
||||
pub(crate) struct AwsReqwestConnector {
|
||||
client: Client,
|
||||
}
|
||||
|
||||
impl AwsReqwestConnector {
|
||||
pub(crate) fn new() -> Self {
|
||||
let client = get_reqwest_client_builder(false).build().expect("Failed to build AWS HTTP client");
|
||||
Self {
|
||||
client,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn connector_error(error: reqwest::Error) -> ConnectorError {
|
||||
if error.is_timeout() {
|
||||
ConnectorError::timeout(Box::new(error))
|
||||
} else {
|
||||
ConnectorError::io(Box::new(error))
|
||||
}
|
||||
pub(crate) client: Client,
|
||||
}
|
||||
|
||||
impl HttpConnector for AwsReqwestConnector {
|
||||
|
|
@ -401,10 +362,10 @@ pub(crate) mod aws {
|
|||
req_builder = req_builder.body(body_bytes.to_vec());
|
||||
}
|
||||
|
||||
let response = req_builder.send().await.map_err(connector_error)?;
|
||||
let response = req_builder.send().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
|
||||
|
||||
let status = response.status().into();
|
||||
let bytes = response.bytes().await.map_err(connector_error)?;
|
||||
let bytes = response.bytes().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
|
||||
|
||||
Ok(HttpResponse::new(status, bytes.into()))
|
||||
};
|
||||
|
|
@ -430,7 +391,7 @@ pub(crate) mod aws {
|
|||
mod tests {
|
||||
use super::*;
|
||||
use crate::util::is_global_hardcoded;
|
||||
use std::net::{Ipv4Addr, Ipv6Addr};
|
||||
use std::net::Ipv4Addr;
|
||||
use url::Host;
|
||||
|
||||
// ===
|
||||
|
|
@ -443,26 +404,6 @@ mod tests {
|
|||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn dns_setup_does_not_initialize_config() {
|
||||
assert!(LazyLock::get(&CONFIG).is_none());
|
||||
drop(CustomDns::instance(false));
|
||||
assert!(LazyLock::get(&CONFIG).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn dns_preference_orders_addresses() {
|
||||
let ipv4 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);
|
||||
let ipv6 = SocketAddr::new(IpAddr::V6(Ipv6Addr::LOCALHOST), 0);
|
||||
let mut addresses = [ipv6, ipv4];
|
||||
|
||||
sort_addresses(&mut addresses, false);
|
||||
assert_eq!(addresses, [ipv4, ipv6]);
|
||||
|
||||
sort_addresses(&mut addresses, true);
|
||||
assert_eq!(addresses, [ipv6, ipv4]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn dotted_decimal_loopback_normalizes() {
|
||||
let ip = parse_to_ip("127.0.0.1").unwrap();
|
||||
|
|
|
|||
14
src/mail.rs
14
src/mail.rs
|
|
@ -633,24 +633,14 @@ pub async fn send_test(address: &str) -> EmptyResult {
|
|||
send_email(address, &subject, body_html, body_text).await
|
||||
}
|
||||
|
||||
pub async fn send_admin_account_recovery(
|
||||
address: &str,
|
||||
user_name: &str,
|
||||
org_name: &str,
|
||||
reset_password: bool,
|
||||
reset_2fa: bool,
|
||||
fallback_2fa_email: bool,
|
||||
) -> EmptyResult {
|
||||
pub async fn send_admin_reset_password(address: &str, user_name: &str, org_name: &str) -> EmptyResult {
|
||||
let (subject, body_html, body_text) = get_text(
|
||||
"email/admin_account_recovery",
|
||||
"email/admin_reset_password",
|
||||
json!({
|
||||
"url": CONFIG.domain(),
|
||||
"img_src": CONFIG._smtp_img_src(),
|
||||
"user_name": user_name,
|
||||
"org_name": org_name,
|
||||
"reset_password": reset_password,
|
||||
"reset_2fa": reset_2fa,
|
||||
"fallback_2fa_email": fallback_2fa_email,
|
||||
}),
|
||||
)?;
|
||||
send_email(address, &subject, body_html, body_text).await
|
||||
|
|
|
|||
|
|
@ -137,7 +137,9 @@ fn parse_args() {
|
|||
|
||||
if let Some(command) = pargs.subcommand().unwrap_or_default() {
|
||||
if command == "hash" {
|
||||
use argon2::{Algorithm::Argon2id, Argon2, ParamsBuilder, PasswordHasher, Version::V0x13};
|
||||
use argon2::{
|
||||
Algorithm::Argon2id, Argon2, ParamsBuilder, PasswordHasher, Version::V0x13, password_hash::SaltString,
|
||||
};
|
||||
|
||||
let mut argon2_params = ParamsBuilder::new();
|
||||
let preset: Option<String> = pargs.opt_value_from_str(["-p", "--preset"]).unwrap_or_default();
|
||||
|
|
@ -170,10 +172,10 @@ fn parse_args() {
|
|||
}
|
||||
|
||||
let argon2 = Argon2::new(Argon2id, V0x13, argon2_params.build().unwrap());
|
||||
let salt = crypto::get_random_bytes::<32>();
|
||||
let salt = SaltString::encode_b64(&crypto::get_random_bytes::<32>()).unwrap();
|
||||
|
||||
let argon2_timer = tokio::time::Instant::now();
|
||||
if let Ok(password_hash) = argon2.hash_password_with_salt(password.as_bytes(), &salt) {
|
||||
if let Ok(password_hash) = argon2.hash_password(password.as_bytes(), &salt) {
|
||||
println!(
|
||||
"\n\
|
||||
ADMIN_TOKEN='{password_hash}'\n\n\
|
||||
|
|
|
|||
7
src/static/scripts/admin_organizations.js
vendored
7
src/static/scripts/admin_organizations.js
vendored
|
|
@ -1,5 +1,5 @@
|
|||
"use strict";
|
||||
/* global DataTable, _post:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
|
||||
/* global jQuery, _post:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
|
||||
|
||||
function deleteOrganization(event) {
|
||||
event.preventDefault();
|
||||
|
|
@ -41,8 +41,7 @@ function initActions() {
|
|||
|
||||
// onLoad events
|
||||
document.addEventListener("DOMContentLoaded", (/*event*/) => {
|
||||
const columnCount = document.getElementById("orgs-table").querySelectorAll("thead th").length;
|
||||
new DataTable("#orgs-table", {
|
||||
jQuery("#orgs-table").DataTable({
|
||||
"drawCallback": function() {
|
||||
initActions();
|
||||
},
|
||||
|
|
@ -54,7 +53,7 @@ document.addEventListener("DOMContentLoaded", (/*event*/) => {
|
|||
],
|
||||
"pageLength": -1, // Default show all
|
||||
"columnDefs": [{
|
||||
"targets": [columnCount - 2, columnCount - 1], // Do not include the last two columns into the search/order features
|
||||
"targets": [4,5],
|
||||
"searchable": false,
|
||||
"orderable": false
|
||||
}]
|
||||
|
|
|
|||
66
src/static/scripts/admin_users.js
vendored
66
src/static/scripts/admin_users.js
vendored
|
|
@ -1,5 +1,5 @@
|
|||
"use strict";
|
||||
/* global DataTable, _post:readable, _delete:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
|
||||
/* global jQuery, _post:readable, _delete:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
|
||||
|
||||
function deleteUser(event) {
|
||||
event.preventDefault();
|
||||
|
|
@ -179,6 +179,34 @@ const ORG_TYPES = {
|
|||
},
|
||||
};
|
||||
|
||||
// Special sort function to sort dates in ISO format
|
||||
jQuery.extend(jQuery.fn.dataTableExt.oSort, {
|
||||
"date-iso-pre": function(a) {
|
||||
let x;
|
||||
const sortDate = a.replace(/(<([^>]+)>)/gi, "").trim();
|
||||
if (sortDate !== "") {
|
||||
const dtParts = sortDate.split(" ");
|
||||
const timeParts = (undefined != dtParts[1]) ? dtParts[1].split(":") : ["00", "00", "00"];
|
||||
const dateParts = dtParts[0].split("-");
|
||||
x = (dateParts[0] + dateParts[1] + dateParts[2] + timeParts[0] + timeParts[1] + ((undefined != timeParts[2]) ? timeParts[2] : 0)) * 1;
|
||||
if (isNaN(x)) {
|
||||
x = 0;
|
||||
}
|
||||
} else {
|
||||
x = Infinity;
|
||||
}
|
||||
return x;
|
||||
},
|
||||
|
||||
"date-iso-asc": function(a, b) {
|
||||
return a - b;
|
||||
},
|
||||
|
||||
"date-iso-desc": function(a, b) {
|
||||
return b - a;
|
||||
}
|
||||
});
|
||||
|
||||
const userOrgTypeDialog = document.getElementById("userOrgTypeDialog");
|
||||
// Fill the form and title
|
||||
userOrgTypeDialog.addEventListener("show.bs.modal", function(event) {
|
||||
|
|
@ -257,36 +285,11 @@ function initUserTable() {
|
|||
}
|
||||
}
|
||||
|
||||
// Special sort function to sort dates in ISO format and have anything else as 0
|
||||
DataTable.ext.type.order["date-iso-pre"] = function (a) {
|
||||
let x;
|
||||
const sortDate = a.replace(/(<([^>]+)>)/gi, "").trim();
|
||||
if (sortDate !== "") {
|
||||
const dtParts = sortDate.split(" ");
|
||||
const timeParts = (undefined != dtParts[1]) ? dtParts[1].split(":") : ["00", "00", "00"];
|
||||
const dateParts = dtParts[0].split("-");
|
||||
x = (dateParts[0] + dateParts[1] + dateParts[2] + timeParts[0] + timeParts[1] + ((undefined != timeParts[2]) ? timeParts[2] : 0)) * 1;
|
||||
if (isNaN(x)) {
|
||||
x = 0;
|
||||
}
|
||||
} else {
|
||||
x = Infinity;
|
||||
}
|
||||
return x;
|
||||
};
|
||||
|
||||
// onLoad events
|
||||
document.addEventListener("DOMContentLoaded", (/*event*/) => {
|
||||
DataTable.ext.type.detect.unshift(function (data) {
|
||||
if (typeof data !== "string") { return null; }
|
||||
return data.indexOf("data-sort-type=\"date-iso\"") !== -1
|
||||
? "date-iso"
|
||||
: null;
|
||||
});
|
||||
|
||||
const columnCount = document.getElementById("users-table").querySelectorAll("thead th").length;
|
||||
new DataTable("#users-table", {
|
||||
"typeDetect": true,
|
||||
const size = jQuery("#users-table > thead th").length;
|
||||
const ssoOffset = size-7;
|
||||
jQuery("#users-table").DataTable({
|
||||
"drawCallback": function() {
|
||||
initUserTable();
|
||||
},
|
||||
|
|
@ -298,7 +301,10 @@ document.addEventListener("DOMContentLoaded", (/*event*/) => {
|
|||
],
|
||||
"pageLength": -1, // Default show all
|
||||
"columnDefs": [{
|
||||
"targets": columnCount - 1, // Do not include the last column into the search/order features
|
||||
"targets": [1 + ssoOffset, 2 + ssoOffset],
|
||||
"type": "date-iso"
|
||||
}, {
|
||||
"targets": size-1,
|
||||
"searchable": false,
|
||||
"orderable": false
|
||||
}]
|
||||
|
|
|
|||
160
src/static/scripts/datatables.css
vendored
160
src/static/scripts/datatables.css
vendored
|
|
@ -4,32 +4,25 @@
|
|||
*
|
||||
* To rebuild or modify this file with the latest versions of the included
|
||||
* software please visit:
|
||||
* https://datatables.net/download/#bs5/dt-3.0.3
|
||||
* https://datatables.net/download/#bs5/dt-2.3.8
|
||||
*
|
||||
* Included libraries:
|
||||
* DataTables 3.0.3
|
||||
* DataTables 2.3.8
|
||||
*/
|
||||
|
||||
/*! DataTables Bootstrap 5 integration
|
||||
* © SpryMedia Ltd - datatables.net/license
|
||||
*/
|
||||
:root {
|
||||
--dt_background-selected: 13, 110, 253;
|
||||
--dt_color-selected: 255, 255, 255;
|
||||
--dt_link_color-selected: 228, 228, 228;
|
||||
--dt-row_background: transparent;
|
||||
--dt-row_background-selected: var(--dt_background-selected);
|
||||
--dt-row-text_color-selected: var(--dt_color-selected);
|
||||
--dt-row-link_color-selected: var(--dt_link_color-selected);
|
||||
--dt-row_background-stripe: 0, 0, 0;
|
||||
--dt-row_background-hover: 0, 0, 0;
|
||||
--dt-column-ordering_background: 0, 0, 0;
|
||||
--dt-header-cell_align-items: center;
|
||||
--dt-header-cell_vertical-align: middle;
|
||||
--dt-html_background: white;
|
||||
--dt-row-selected: 13, 110, 253;
|
||||
--dt-row-selected-text: 255, 255, 255;
|
||||
--dt-row-selected-link: 228, 228, 228;
|
||||
--dt-row-stripe: 0, 0, 0;
|
||||
--dt-row-hover: 0, 0, 0;
|
||||
--dt-column-ordering: 0, 0, 0;
|
||||
--dt-header-align-items: center;
|
||||
--dt-header-vertical-align: middle;
|
||||
--dt-html-background: white;
|
||||
}
|
||||
:root.dark {
|
||||
--dt-html_background: rgb(33, 37, 41);
|
||||
--dt-html-background: rgb(33, 37, 41);
|
||||
}
|
||||
|
||||
table.dataTable tbody td.dt-control {
|
||||
|
|
@ -51,13 +44,16 @@ table.dataTable tbody tr.dt-hasChild td.dt-control:before {
|
|||
border-bottom: 0px solid transparent;
|
||||
border-right: 5px solid transparent;
|
||||
}
|
||||
table.dataTable tfoot:empty {
|
||||
display: none;
|
||||
}
|
||||
|
||||
:root.dark table.dataTable td.dt-control:before,
|
||||
html.dark table.dataTable td.dt-control:before,
|
||||
:root[data-bs-theme=dark] table.dataTable td.dt-control:before,
|
||||
:root[data-theme=dark] table.dataTable td.dt-control:before {
|
||||
border-left-color: rgba(255, 255, 255, 0.5);
|
||||
}
|
||||
:root.dark table.dataTable tr.dt-hasChild td.dt-control:before,
|
||||
html.dark table.dataTable tr.dt-hasChild td.dt-control:before,
|
||||
:root[data-bs-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before,
|
||||
:root[data-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before {
|
||||
border-top-color: rgba(255, 255, 255, 0.5);
|
||||
|
|
@ -88,25 +84,6 @@ div.dt-scroll-body tfoot tr td div.dt-scroll-sizing {
|
|||
overflow: hidden !important;
|
||||
}
|
||||
|
||||
/*! DataTables Bootstrap 5 integration
|
||||
* © SpryMedia Ltd - datatables.net/license
|
||||
*/
|
||||
:root {
|
||||
--dt-order-arrow_color: rgb(51, 51, 51);
|
||||
--dt-order-arrow_color-current: rgb(51, 51, 51);
|
||||
--dt-order-arrow-height: 7px;
|
||||
--dt-order-arrow_opacity: 0.125;
|
||||
--dt-order-arrow_opacity-current: 0.65;
|
||||
--dt-order-arrow-width: 8px;
|
||||
--dt-order-arrow-gap: 1px;
|
||||
--dt-order-header_outline-hover: 2px solid rgba(0, 0, 0, 0.05);
|
||||
}
|
||||
:root.dark, :root[data-bs-theme=dark], :root[data-theme=dark] {
|
||||
--dt-order-arrow_color: rgb(229, 233, 238);
|
||||
--dt-order-arrow_color-current: rgb(229, 233, 238);
|
||||
--dt-order-header_outline-hover: 2px solid rgba(255, 255, 255, 0.05);
|
||||
}
|
||||
|
||||
table.dataTable thead > tr > th:active,
|
||||
table.dataTable thead > tr > td:active {
|
||||
outline: none;
|
||||
|
|
@ -114,18 +91,20 @@ table.dataTable thead > tr > td:active {
|
|||
table.dataTable thead > tr > th.dt-orderable-asc .dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:before,
|
||||
table.dataTable thead > tr > td.dt-orderable-asc .dt-column-order:before,
|
||||
table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:before {
|
||||
bottom: calc(50% + var(--dt-order-arrow-gap));
|
||||
border-bottom: var(--dt-order-arrow-height) solid var(--dt-order-arrow_color);
|
||||
border-left: calc(var(--dt-order-arrow-width) / 2) solid transparent;
|
||||
border-right: calc(var(--dt-order-arrow-width) / 2) solid transparent;
|
||||
position: absolute;
|
||||
display: block;
|
||||
bottom: 50%;
|
||||
content: "\25B2";
|
||||
content: "\25B2"/"";
|
||||
}
|
||||
table.dataTable thead > tr > th.dt-orderable-desc .dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:after,
|
||||
table.dataTable thead > tr > td.dt-orderable-desc .dt-column-order:after,
|
||||
table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order:after {
|
||||
top: calc(50% + 1px);
|
||||
border-top: var(--dt-order-arrow-height) solid var(--dt-order-arrow_color);
|
||||
border-left: calc(var(--dt-order-arrow-width) / 2) solid transparent;
|
||||
border-right: calc(var(--dt-order-arrow-width) / 2) solid transparent;
|
||||
position: absolute;
|
||||
display: block;
|
||||
top: 50%;
|
||||
content: "\25BC";
|
||||
content: "\25BC"/"";
|
||||
}
|
||||
table.dataTable thead > tr > th.dt-orderable-asc .dt-column-order, table.dataTable thead > tr > th.dt-orderable-desc .dt-column-order, table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order,
|
||||
table.dataTable thead > tr > td.dt-orderable-asc .dt-column-order,
|
||||
|
|
@ -133,8 +112,8 @@ table.dataTable thead > tr > td.dt-orderable-desc .dt-column-order,
|
|||
table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order,
|
||||
table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order {
|
||||
position: relative;
|
||||
width: var(--dt-order-arrow-width);
|
||||
align-self: stretch;
|
||||
width: 12px;
|
||||
height: 20px;
|
||||
}
|
||||
table.dataTable thead > tr > th.dt-orderable-asc .dt-column-order:before, table.dataTable thead > tr > th.dt-orderable-asc .dt-column-order:after, table.dataTable thead > tr > th.dt-orderable-desc .dt-column-order:before, table.dataTable thead > tr > th.dt-orderable-desc .dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:after,
|
||||
table.dataTable thead > tr > td.dt-orderable-asc .dt-column-order:before,
|
||||
|
|
@ -145,14 +124,10 @@ table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:before,
|
|||
table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:after,
|
||||
table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order:before,
|
||||
table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order:after {
|
||||
position: absolute;
|
||||
display: block;
|
||||
content: " ";
|
||||
height: 0;
|
||||
width: 0;
|
||||
left: 0;
|
||||
color: var(--dt-order-arrow_color);
|
||||
opacity: var(--dt-order-arrow_opacity);
|
||||
opacity: 0.125;
|
||||
line-height: 9px;
|
||||
font-size: 0.8em;
|
||||
}
|
||||
table.dataTable thead > tr > th.dt-orderable-asc, table.dataTable thead > tr > th.dt-orderable-desc,
|
||||
table.dataTable thead > tr > td.dt-orderable-asc,
|
||||
|
|
@ -162,18 +137,13 @@ table.dataTable thead > tr > td.dt-orderable-desc {
|
|||
table.dataTable thead > tr > th.dt-orderable-asc:hover, table.dataTable thead > tr > th.dt-orderable-desc:hover,
|
||||
table.dataTable thead > tr > td.dt-orderable-asc:hover,
|
||||
table.dataTable thead > tr > td.dt-orderable-desc:hover {
|
||||
outline: var(--dt-order-header_outline-hover);
|
||||
outline: 2px solid rgba(0, 0, 0, 0.05);
|
||||
outline-offset: -2px;
|
||||
}
|
||||
table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:before,
|
||||
table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:before {
|
||||
border-bottom-color: var(--dt-order-arrow_color-current);
|
||||
opacity: var(--dt-order-arrow_opacity-current);
|
||||
}
|
||||
table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:after,
|
||||
table.dataTable thead > tr > th.dt-ordering-asc .dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-desc .dt-column-order:after,
|
||||
table.dataTable thead > tr > td.dt-ordering-asc .dt-column-order:before,
|
||||
table.dataTable thead > tr > td.dt-ordering-desc .dt-column-order:after {
|
||||
border-top-color: var(--dt-order-arrow_color-current);
|
||||
opacity: var(--dt-order-arrow_opacity-current);
|
||||
opacity: 0.6;
|
||||
}
|
||||
table.dataTable thead > tr > th.dt-orderable-none:not(.dt-ordering-asc, .dt-ordering-desc) .dt-column-order:empty, table.dataTable thead > tr > th.sorting_desc_disabled .dt-column-order:after, table.dataTable thead > tr > th.sorting_asc_disabled .dt-column-order:before,
|
||||
table.dataTable thead > tr > td.dt-orderable-none:not(.dt-ordering-asc, .dt-ordering-desc) .dt-column-order:empty,
|
||||
|
|
@ -196,7 +166,7 @@ table.dataTable tfoot > tr > td div.dt-column-header,
|
|||
table.dataTable tfoot > tr > td div.dt-column-footer {
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: var(--dt-header-cell_align-items);
|
||||
align-items: var(--dt-header-align-items);
|
||||
gap: 4px;
|
||||
}
|
||||
table.dataTable thead > tr > th div.dt-column-header .dt-column-title,
|
||||
|
|
@ -232,14 +202,7 @@ div.dt-scroll-body > table.dataTable > thead > tr > td {
|
|||
:root[data-bs-theme=dark] table.dataTable thead > tr > th.dt-orderable-desc:hover,
|
||||
:root[data-bs-theme=dark] table.dataTable thead > tr > td.dt-orderable-asc:hover,
|
||||
:root[data-bs-theme=dark] table.dataTable thead > tr > td.dt-orderable-desc:hover {
|
||||
outline: var(--dt-order-header_outline-hover);
|
||||
}
|
||||
|
||||
/*! DataTables Bootstrap 5 integration
|
||||
* © SpryMedia Ltd - datatables.net/license
|
||||
*/
|
||||
:root {
|
||||
--dt-processing-circle_background: var(--dt_background-selected);
|
||||
outline: 2px solid rgba(255, 255, 255, 0.05);
|
||||
}
|
||||
|
||||
div.dt-processing {
|
||||
|
|
@ -265,7 +228,8 @@ div.dt-processing > div:last-child > div {
|
|||
width: 13px;
|
||||
height: 13px;
|
||||
border-radius: 50%;
|
||||
background: rgb(var(--dt-processing-circle_background));
|
||||
background: rgb(13, 110, 253);
|
||||
background: rgb(var(--dt-row-selected));
|
||||
animation-timing-function: cubic-bezier(0, 1, 1, 0);
|
||||
}
|
||||
div.dt-processing > div:last-child > div:nth-child(1) {
|
||||
|
|
@ -378,7 +342,7 @@ table.dataTable thead td,
|
|||
table.dataTable tfoot th,
|
||||
table.dataTable tfoot td {
|
||||
text-align: left;
|
||||
vertical-align: var(--dt-header-cell_vertical-align);
|
||||
vertical-align: var(--dt-header-vertical-align);
|
||||
}
|
||||
table.dataTable thead th.dt-head-left,
|
||||
table.dataTable thead td.dt-head-left,
|
||||
|
|
@ -461,16 +425,11 @@ table.dataTable tbody td.dt-body-nowrap {
|
|||
white-space: nowrap;
|
||||
}
|
||||
|
||||
:root {
|
||||
--dt_background-selected: 13, 110, 253;
|
||||
}
|
||||
|
||||
:root[data-bs-theme=dark] {
|
||||
--dt-row_background-hover: 255, 255, 255;
|
||||
--dt-row_background-stripe: 255, 255, 255;
|
||||
--dt-column-ordering_background: 255, 255, 255;
|
||||
}
|
||||
|
||||
/*! Bootstrap 5 integration for DataTables
|
||||
*
|
||||
* ©2020 SpryMedia Ltd, all rights reserved.
|
||||
* License: MIT datatables.net/license/mit
|
||||
*/
|
||||
table.table.dataTable {
|
||||
clear: both;
|
||||
margin-bottom: 0;
|
||||
|
|
@ -484,26 +443,31 @@ table.table.dataTable > :not(caption) > * > * {
|
|||
background-color: var(--bs-table-bg);
|
||||
}
|
||||
table.table.dataTable > tbody > tr {
|
||||
background-color: var(--dt-row_background);
|
||||
background-color: transparent;
|
||||
}
|
||||
table.table.dataTable > tbody > tr.selected > * {
|
||||
box-shadow: inset 0 0 0 9999px rgb(var(--dt-row_background-selected));
|
||||
color: rgb(var(--dt-row-text_color-selected));
|
||||
box-shadow: inset 0 0 0 9999px rgb(13, 110, 253);
|
||||
box-shadow: inset 0 0 0 9999px rgb(var(--dt-row-selected));
|
||||
color: rgb(255, 255, 255);
|
||||
color: rgb(var(--dt-row-selected-text));
|
||||
}
|
||||
table.table.dataTable > tbody > tr.selected a {
|
||||
color: rgb(var(--dt-row-link_color-selected));
|
||||
color: rgb(228, 228, 228);
|
||||
color: rgb(var(--dt-row-selected-link));
|
||||
}
|
||||
table.table.dataTable.table-striped > tbody > tr:nth-of-type(2n+1) > * {
|
||||
box-shadow: inset 0 0 0 9999px rgba(var(--dt-row_background-stripe), 0.05);
|
||||
box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-stripe), 0.05);
|
||||
}
|
||||
table.table.dataTable.table-striped > tbody > tr:nth-of-type(2n+1).selected > * {
|
||||
box-shadow: inset 0 0 0 9999px rgba(var(--dt-row_background-selected), 0.95);
|
||||
box-shadow: inset 0 0 0 9999px rgba(13, 110, 253, 0.95);
|
||||
box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-selected), 0.95);
|
||||
}
|
||||
table.table.dataTable.table-hover > tbody > tr:hover > * {
|
||||
box-shadow: inset 0 0 0 9999px rgba(var(--dt-row_background-hover), 0.075);
|
||||
box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-hover), 0.075);
|
||||
}
|
||||
table.table.dataTable.table-hover > tbody > tr.selected:hover > * {
|
||||
box-shadow: inset 0 0 0 9999px rgba(var(--dt-row_background-selected), 0.975);
|
||||
box-shadow: inset 0 0 0 9999px rgba(13, 110, 253, 0.975);
|
||||
box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-selected), 0.975);
|
||||
}
|
||||
|
||||
div.dt-container div.dt-layout-start > *:not(:last-child) {
|
||||
|
|
@ -652,4 +616,10 @@ div.table-responsive > div.dt-container > div.row > div[class^=col-]:last-child
|
|||
padding-right: 0;
|
||||
}
|
||||
|
||||
:root[data-bs-theme=dark] {
|
||||
--dt-row-hover: 255, 255, 255;
|
||||
--dt-row-stripe: 255, 255, 255;
|
||||
--dt-column-ordering: 255, 255, 255;
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
23588
src/static/scripts/datatables.js
vendored
23588
src/static/scripts/datatables.js
vendored
File diff suppressed because it is too large
Load diff
6856
src/static/scripts/jquery-4.0.0.slim.js
vendored
Normal file
6856
src/static/scripts/jquery-4.0.0.slim.js
vendored
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -10,7 +10,7 @@
|
|||
<th class="vw-entries">Entries</th>
|
||||
<th class="vw-attachments">Attachments</th>
|
||||
<th class="vw-misc">Misc</th>
|
||||
<th class="vw-actions text-end">Actions</th>
|
||||
<th class="vw-actions">Actions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
|
|
@ -59,6 +59,7 @@
|
|||
</main>
|
||||
|
||||
<link rel="stylesheet" href="{{urlpath}}/vw_static/datatables.css" />
|
||||
<script src="{{urlpath}}/vw_static/jquery-4.0.0.slim.js"></script>
|
||||
<script src="{{urlpath}}/vw_static/datatables.js"></script>
|
||||
<script src="{{urlpath}}/vw_static/admin_organizations.js"></script>
|
||||
<script src="{{urlpath}}/vw_static/jdenticon-3.3.0.js"></script>
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
<th class="vw-entries">Entries</th>
|
||||
<th class="vw-attachments">Attachments</th>
|
||||
<th class="vw-organizations">Organizations</th>
|
||||
<th class="vw-actions text-end">Actions</th>
|
||||
<th class="vw-actions">Actions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
|
|
@ -47,10 +47,10 @@
|
|||
</td>
|
||||
{{/if}}
|
||||
<td>
|
||||
<span class="d-block" data-sort-type="date-iso">{{created_at}}</span>
|
||||
<span class="d-block">{{created_at}}</span>
|
||||
</td>
|
||||
<td>
|
||||
<span class="d-block" data-sort-type="date-iso">{{last_active}}</span>
|
||||
<span class="d-block">{{last_active}}</span>
|
||||
</td>
|
||||
<td>
|
||||
<span class="d-block">{{cipher_count}}</span>
|
||||
|
|
@ -153,6 +153,7 @@
|
|||
</main>
|
||||
|
||||
<link rel="stylesheet" href="{{urlpath}}/vw_static/datatables.css" />
|
||||
<script src="{{urlpath}}/vw_static/jquery-4.0.0.slim.js"></script>
|
||||
<script src="{{urlpath}}/vw_static/datatables.js"></script>
|
||||
<script src="{{urlpath}}/vw_static/admin_users.js"></script>
|
||||
<script src="{{urlpath}}/vw_static/jdenticon-3.3.0.js"></script>
|
||||
|
|
|
|||
|
|
@ -1,12 +0,0 @@
|
|||
Admin account recovery from {{org_name}} organization
|
||||
<!---------------->
|
||||
{{#if reset_password}}
|
||||
The master password for {{user_name}} has been changed.
|
||||
{{/if}}
|
||||
{{#if reset_2fa}}
|
||||
Your two-step verification providers have been reset.{{#if fallback_2fa_email}} Email two factor has been activated as a fallback.{{/if}}
|
||||
{{/if}}
|
||||
|
||||
If you did not initiate this request, please reach out to your administrator immediately.
|
||||
|
||||
{{> email/email_footer_text }}
|
||||
4
src/static/templates/email/admin_reset_password.hbs
Normal file
4
src/static/templates/email/admin_reset_password.hbs
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
Master Password Has Been Changed
|
||||
<!---------------->
|
||||
The master password for {{user_name}} has been changed by an administrator in your {{org_name}} organization. If you did not initiate this request, please reach out to your administrator immediately.
|
||||
{{> email/email_footer_text }}
|
||||
|
|
@ -1,17 +1,10 @@
|
|||
Admin account recovery from {{org_name}} organization
|
||||
Master Password Has Been Changed
|
||||
<!---------------->
|
||||
{{> email/email_header }}
|
||||
<table width="100%" cellpadding="0" cellspacing="0" style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
|
||||
<tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
|
||||
<td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
|
||||
{{#if reset_password}}
|
||||
The master password for <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{user_name}}</b> has been changed.
|
||||
{{/if}}
|
||||
{{#if reset_2fa}}
|
||||
Your two-step verification providers have been reset.{{#if fallback_2fa_email}} Email two factor has been activated as a fallback.{{/if}}
|
||||
{{/if}}
|
||||
<br>
|
||||
If you did not initiate this request, please reach out to your administrator immediately.
|
||||
The master password for <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{user_name}}</b> has been changed by an administrator in your <b style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">{{org_name}}</b> organization. If you did not initiate this request, please reach out to your administrator immediately.
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
|
@ -77,18 +77,10 @@ pub(crate) fn operator_for_path(path: &str) -> Result<opendal::Operator, crate::
|
|||
|
||||
#[cfg(s3)]
|
||||
mod s3 {
|
||||
use std::sync::LazyLock;
|
||||
|
||||
use opendal_http_transport_reqwest::ReqwestTransport;
|
||||
use reqwest::Url;
|
||||
|
||||
use crate::error::Error;
|
||||
|
||||
static HTTP_CLIENT: LazyLock<reqwest::Client> = LazyLock::new(|| {
|
||||
// Storage endpoints are administrator-configured and may be private.
|
||||
crate::http_client::get_reqwest_client_builder(false).build().expect("Failed to build OpenDAL HTTP client")
|
||||
});
|
||||
|
||||
pub(super) fn is_uri(path: &str) -> bool {
|
||||
path.starts_with("s3://")
|
||||
}
|
||||
|
|
@ -185,7 +177,12 @@ mod s3 {
|
|||
|
||||
let chain = DEFAULT_CREDENTIAL_CHAIN
|
||||
.get_or_init(|| {
|
||||
let conf = ProviderConfig::default().with_http_client(AwsReqwestConnector::new());
|
||||
let reqwest_client = reqwest::Client::builder().build().unwrap();
|
||||
let connector = AwsReqwestConnector {
|
||||
client: reqwest_client,
|
||||
};
|
||||
|
||||
let conf = ProviderConfig::default().with_http_client(connector);
|
||||
|
||||
DefaultCredentialsChain::builder().configure(conf).build()
|
||||
})
|
||||
|
|
@ -239,9 +236,7 @@ mod s3 {
|
|||
builder.credential_provider_chain(ProvideCredentialChain::new().push(OpenDALS3CredentialProvider));
|
||||
}
|
||||
|
||||
let http_transport = opendal::HttpTransporter::new(ReqwestTransport::new(HTTP_CLIENT.clone()));
|
||||
let context = opendal::OperationContext::new().with_http_transport(http_transport);
|
||||
Ok(opendal::Operator::new(builder)?.with_context(context))
|
||||
Ok(opendal::Operator::new(builder)?)
|
||||
}
|
||||
|
||||
fn uri_has_option(uri: &opendal::OperatorUri, names: &[&str]) -> bool {
|
||||
|
|
|
|||
|
|
@ -537,7 +537,10 @@ pub fn is_valid_email(email: &str) -> bool {
|
|||
let Ok(email_url) = url::Url::parse(&format!("https://{}", email.domain())) else {
|
||||
return false;
|
||||
};
|
||||
email_url.domain().is_some() && email_url.path() == "/" && email_url.query().is_none()
|
||||
if email_url.path().ne("/") || email_url.domain().is_none() || email_url.query().is_some() {
|
||||
return false;
|
||||
}
|
||||
true
|
||||
}
|
||||
|
||||
//
|
||||
|
|
|
|||
Loading…
Reference in a new issue