Spiegel von
https://github.com/dani-garcia/vaultwarden.git
synchronisiert 2024-08-19 18:35:24 +02:00
differentiate the /collection endpoints
Dieser Commit ist enthalten in:
Ursprung
37b2143813
Commit
e97088c119
2 geänderte Dateien mit 144 neuen und 25 gelöschten Zeilen
|
@ -703,7 +703,7 @@ async fn put_collections_update(
|
||||||
conn: DbConn,
|
conn: DbConn,
|
||||||
nt: Notify<'_>,
|
nt: Notify<'_>,
|
||||||
) -> EmptyResult {
|
) -> EmptyResult {
|
||||||
post_collections_admin(uuid, data, headers, conn, nt).await
|
post_collections_update(uuid, data, headers, conn, nt).await
|
||||||
}
|
}
|
||||||
|
|
||||||
#[post("/ciphers/<uuid>/collections", data = "<data>")]
|
#[post("/ciphers/<uuid>/collections", data = "<data>")]
|
||||||
|
@ -711,10 +711,65 @@ async fn post_collections_update(
|
||||||
uuid: &str,
|
uuid: &str,
|
||||||
data: Json<CollectionsAdminData>,
|
data: Json<CollectionsAdminData>,
|
||||||
headers: Headers,
|
headers: Headers,
|
||||||
conn: DbConn,
|
mut conn: DbConn,
|
||||||
nt: Notify<'_>,
|
nt: Notify<'_>,
|
||||||
) -> EmptyResult {
|
) -> EmptyResult {
|
||||||
post_collections_admin(uuid, data, headers, conn, nt).await
|
let data: CollectionsAdminData = data.into_inner();
|
||||||
|
|
||||||
|
let cipher = match Cipher::find_by_uuid(uuid, &mut conn).await {
|
||||||
|
Some(cipher) => cipher,
|
||||||
|
None => err!("Cipher doesn't exist"),
|
||||||
|
};
|
||||||
|
|
||||||
|
if !cipher.is_write_accessible_to_user(&headers.user.uuid, &mut conn).await {
|
||||||
|
err!("Cipher is not write accessible")
|
||||||
|
}
|
||||||
|
|
||||||
|
let posted_collections = HashSet::<String>::from_iter(data.collection_ids);
|
||||||
|
let current_collections =
|
||||||
|
HashSet::<String>::from_iter(cipher.get_collections(headers.user.uuid.clone(), &mut conn).await);
|
||||||
|
|
||||||
|
for collection in posted_collections.symmetric_difference(¤t_collections) {
|
||||||
|
match Collection::find_by_uuid(collection, &mut conn).await {
|
||||||
|
None => err!("Invalid collection ID provided"),
|
||||||
|
Some(collection) => {
|
||||||
|
if collection.is_writable_by_user(&headers.user.uuid, &mut conn).await {
|
||||||
|
if posted_collections.contains(&collection.uuid) {
|
||||||
|
// Add to collection
|
||||||
|
CollectionCipher::save(&cipher.uuid, &collection.uuid, &mut conn).await?;
|
||||||
|
} else {
|
||||||
|
// Remove from collection
|
||||||
|
CollectionCipher::delete(&cipher.uuid, &collection.uuid, &mut conn).await?;
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
err!("No rights to modify the collection")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
nt.send_cipher_update(
|
||||||
|
UpdateType::SyncCipherUpdate,
|
||||||
|
&cipher,
|
||||||
|
&cipher.update_users_revision(&mut conn).await,
|
||||||
|
&headers.device.uuid,
|
||||||
|
Some(Vec::from_iter(posted_collections)),
|
||||||
|
&mut conn,
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
log_event(
|
||||||
|
EventType::CipherUpdatedCollections as i32,
|
||||||
|
&cipher.uuid,
|
||||||
|
&cipher.organization_uuid.unwrap(),
|
||||||
|
&headers.user.uuid,
|
||||||
|
headers.device.atype,
|
||||||
|
&headers.ip.ip,
|
||||||
|
&mut conn,
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
#[put("/ciphers/<uuid>/collections-admin", data = "<data>")]
|
#[put("/ciphers/<uuid>/collections-admin", data = "<data>")]
|
||||||
|
@ -749,7 +804,7 @@ async fn post_collections_admin(
|
||||||
|
|
||||||
let posted_collections = HashSet::<String>::from_iter(data.collection_ids);
|
let posted_collections = HashSet::<String>::from_iter(data.collection_ids);
|
||||||
let current_collections =
|
let current_collections =
|
||||||
HashSet::<String>::from_iter(cipher.get_collections(headers.user.uuid.clone(), &mut conn).await);
|
HashSet::<String>::from_iter(cipher.get_admin_collections(headers.user.uuid.clone(), &mut conn).await);
|
||||||
|
|
||||||
for collection in posted_collections.symmetric_difference(¤t_collections) {
|
for collection in posted_collections.symmetric_difference(¤t_collections) {
|
||||||
match Collection::find_by_uuid(collection, &mut conn).await {
|
match Collection::find_by_uuid(collection, &mut conn).await {
|
||||||
|
|
|
@ -206,7 +206,7 @@ impl Cipher {
|
||||||
Cow::from(Vec::with_capacity(0))
|
Cow::from(Vec::with_capacity(0))
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
Cow::from(self.get_collections(user_uuid.to_string(), conn).await)
|
Cow::from(self.get_admin_collections(user_uuid.to_string(), conn).await)
|
||||||
};
|
};
|
||||||
|
|
||||||
// There are three types of cipher response models in upstream
|
// There are three types of cipher response models in upstream
|
||||||
|
@ -776,6 +776,7 @@ impl Cipher {
|
||||||
if CONFIG.org_groups_enabled() {
|
if CONFIG.org_groups_enabled() {
|
||||||
db_run! {conn: {
|
db_run! {conn: {
|
||||||
ciphers_collections::table
|
ciphers_collections::table
|
||||||
|
.filter(ciphers_collections::cipher_uuid.eq(&self.uuid))
|
||||||
.inner_join(collections::table.on(
|
.inner_join(collections::table.on(
|
||||||
collections::uuid.eq(ciphers_collections::collection_uuid)
|
collections::uuid.eq(ciphers_collections::collection_uuid)
|
||||||
))
|
))
|
||||||
|
@ -795,11 +796,12 @@ impl Cipher {
|
||||||
collections_groups::collections_uuid.eq(ciphers_collections::collection_uuid)
|
collections_groups::collections_uuid.eq(ciphers_collections::collection_uuid)
|
||||||
.and(collections_groups::groups_uuid.eq(groups::uuid))
|
.and(collections_groups::groups_uuid.eq(groups::uuid))
|
||||||
))
|
))
|
||||||
.filter(ciphers_collections::cipher_uuid.eq(&self.uuid))
|
|
||||||
.filter(users_organizations::access_all.eq(true) // User has access all
|
.filter(users_organizations::access_all.eq(true) // User has access all
|
||||||
.or(users_collections::user_uuid.eq(user_id)) // User has access to collection
|
.or(users_collections::user_uuid.eq(user_id) // User has access to collection
|
||||||
|
.and(users_collections::read_only.eq(false)))
|
||||||
.or(groups::access_all.eq(true)) // Access via groups
|
.or(groups::access_all.eq(true)) // Access via groups
|
||||||
.or(collections_groups::collections_uuid.is_not_null()) // Access via groups
|
.or(collections_groups::collections_uuid.is_not_null() // Access via groups
|
||||||
|
.and(collections_groups::read_only.eq(false)))
|
||||||
)
|
)
|
||||||
.select(ciphers_collections::collection_uuid)
|
.select(ciphers_collections::collection_uuid)
|
||||||
.load::<String>(conn).unwrap_or_default()
|
.load::<String>(conn).unwrap_or_default()
|
||||||
|
@ -807,23 +809,85 @@ impl Cipher {
|
||||||
} else {
|
} else {
|
||||||
db_run! {conn: {
|
db_run! {conn: {
|
||||||
ciphers_collections::table
|
ciphers_collections::table
|
||||||
.inner_join(collections::table.on(
|
.filter(ciphers_collections::cipher_uuid.eq(&self.uuid))
|
||||||
collections::uuid.eq(ciphers_collections::collection_uuid)
|
.inner_join(collections::table.on(
|
||||||
))
|
collections::uuid.eq(ciphers_collections::collection_uuid)
|
||||||
.inner_join(users_organizations::table.on(
|
))
|
||||||
users_organizations::org_uuid.eq(collections::org_uuid)
|
.inner_join(users_organizations::table.on(
|
||||||
.and(users_organizations::user_uuid.eq(user_id.clone()))
|
users_organizations::org_uuid.eq(collections::org_uuid)
|
||||||
))
|
.and(users_organizations::user_uuid.eq(user_id.clone()))
|
||||||
.left_join(users_collections::table.on(
|
))
|
||||||
users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
|
.left_join(users_collections::table.on(
|
||||||
.and(users_collections::user_uuid.eq(user_id.clone()))
|
users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
|
||||||
))
|
.and(users_collections::user_uuid.eq(user_id.clone()))
|
||||||
.filter(ciphers_collections::cipher_uuid.eq(&self.uuid))
|
))
|
||||||
.filter(users_organizations::access_all.eq(true) // User has access all
|
.filter(users_organizations::access_all.eq(true) // User has access all
|
||||||
.or(users_collections::user_uuid.eq(user_id)) // User has access to collection
|
.or(users_collections::user_uuid.eq(user_id) // User has access to collection
|
||||||
)
|
.and(users_collections::read_only.eq(false)))
|
||||||
.select(ciphers_collections::collection_uuid)
|
)
|
||||||
.load::<String>(conn).unwrap_or_default()
|
.select(ciphers_collections::collection_uuid)
|
||||||
|
.load::<String>(conn).unwrap_or_default()
|
||||||
|
}}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn get_admin_collections(&self, user_id: String, conn: &mut DbConn) -> Vec<String> {
|
||||||
|
if CONFIG.org_groups_enabled() {
|
||||||
|
db_run! {conn: {
|
||||||
|
ciphers_collections::table
|
||||||
|
.filter(ciphers_collections::cipher_uuid.eq(&self.uuid))
|
||||||
|
.inner_join(collections::table.on(
|
||||||
|
collections::uuid.eq(ciphers_collections::collection_uuid)
|
||||||
|
))
|
||||||
|
.left_join(users_organizations::table.on(
|
||||||
|
users_organizations::org_uuid.eq(collections::org_uuid)
|
||||||
|
.and(users_organizations::user_uuid.eq(user_id.clone()))
|
||||||
|
))
|
||||||
|
.left_join(users_collections::table.on(
|
||||||
|
users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
|
||||||
|
.and(users_collections::user_uuid.eq(user_id.clone()))
|
||||||
|
))
|
||||||
|
.left_join(groups_users::table.on(
|
||||||
|
groups_users::users_organizations_uuid.eq(users_organizations::uuid)
|
||||||
|
))
|
||||||
|
.left_join(groups::table.on(groups::uuid.eq(groups_users::groups_uuid)))
|
||||||
|
.left_join(collections_groups::table.on(
|
||||||
|
collections_groups::collections_uuid.eq(ciphers_collections::collection_uuid)
|
||||||
|
.and(collections_groups::groups_uuid.eq(groups::uuid))
|
||||||
|
))
|
||||||
|
.filter(users_organizations::access_all.eq(true) // User has access all
|
||||||
|
.or(users_collections::user_uuid.eq(user_id) // User has access to collection
|
||||||
|
.and(users_collections::read_only.eq(false)))
|
||||||
|
.or(groups::access_all.eq(true)) // Access via groups
|
||||||
|
.or(collections_groups::collections_uuid.is_not_null() // Access via groups
|
||||||
|
.and(collections_groups::read_only.eq(false)))
|
||||||
|
.or(users_organizations::atype.le(UserOrgType::Admin as i32)) // User is admin or owner
|
||||||
|
)
|
||||||
|
.select(ciphers_collections::collection_uuid)
|
||||||
|
.load::<String>(conn).unwrap_or_default()
|
||||||
|
}}
|
||||||
|
} else {
|
||||||
|
db_run! {conn: {
|
||||||
|
ciphers_collections::table
|
||||||
|
.filter(ciphers_collections::cipher_uuid.eq(&self.uuid))
|
||||||
|
.inner_join(collections::table.on(
|
||||||
|
collections::uuid.eq(ciphers_collections::collection_uuid)
|
||||||
|
))
|
||||||
|
.inner_join(users_organizations::table.on(
|
||||||
|
users_organizations::org_uuid.eq(collections::org_uuid)
|
||||||
|
.and(users_organizations::user_uuid.eq(user_id.clone()))
|
||||||
|
))
|
||||||
|
.left_join(users_collections::table.on(
|
||||||
|
users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
|
||||||
|
.and(users_collections::user_uuid.eq(user_id.clone()))
|
||||||
|
))
|
||||||
|
.filter(users_organizations::access_all.eq(true) // User has access all
|
||||||
|
.or(users_collections::user_uuid.eq(user_id) // User has access to collection
|
||||||
|
.and(users_collections::read_only.eq(false)))
|
||||||
|
.or(users_organizations::atype.le(UserOrgType::Admin as i32)) // User is admin or owner
|
||||||
|
)
|
||||||
|
.select(ciphers_collections::collection_uuid)
|
||||||
|
.load::<String>(conn).unwrap_or_default()
|
||||||
}}
|
}}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Laden …
In neuem Issue referenzieren