1571 Commits

Author	SHA1	Message	Date
Kowalski Dragon (kowalski7cc)	082acbe5d4	SSO config to skip 2FA on login ... Signed-off-by: Kowalski Dragon (kowalski7cc) <kowalski7cc@users.noreply.github.com>	2026-02-15 12:47:31 +01:00
Mathijs van Veluw	36f0620fd1	Fix org-details issue (#6811) ... Fix an issue where it was possible for users who were not eligible to access all org ciphers to be able to download and extract the encrypted contents. Only Managers with full access and Admins and Owners should be able to access this endpoint. This change will block and prevent access for other users. Signed-off-by: BlackDex <black.dex@gmail.com>	2026-02-10 20:34:30 +01:00
Mathijs van Veluw	d09c45bb63	Misc updates, crates, rust, js, gha, vault (#6799)	2026-02-08 19:24:20 +01:00
Stefan Melmuk	feecfb20da	fix error message for purging auth requests (#6776)	2026-02-01 22:35:55 +01:00
Timshel	347279a12c	Empty AccountKeys when no private key (#6761) ... Co-authored-by: Timshel <timshel@users.noreply.github.com>	2026-02-01 22:35:22 +01:00
Helmut K. C. Tessarek	7f65a254b3	refactor: improve tooltips in diagnostics page (#6765) ... The term "seems to" is used too loosely in many of the tooltips, but in these 2 instances it is wrong wording. An update is either available or not. If there is no update, one could argue that "seems to" is valid, since the Internet could be down to check for a new version. But in this situation the update is availble. It is impossible that an update seems to be available.	2026-02-01 22:35:03 +01:00
Mathijs van Veluw	cc80f689ed	Update crates, web-vault, js, workflows (#6749) ... - Updated all crates - Updated web-vault to v2025.12.2 - Updated all JavaScript files - Updated all GitHub Action Workflows Also added the `concurrency` option to all workflows. Signed-off-by: BlackDex <black.dex@gmail.com>	2026-01-22 23:40:39 +01:00
Stefan Melmuk	4737192853	fix email as 2fa with auth requests (#6736) ... * fix email as 2fa with auth requests * increase expiry time of auth_requests to 15 minutes	2026-01-22 23:25:11 +01:00
Stefan Melmuk	0c6817cb4e	hide password hints via CSS (#6726)	2026-01-18 15:25:20 +01:00
Stefan Melmuk	25a71d913f	use email instead of empty name for webauhn (#6733) ... * if empty use email instead of name for webauhn * use email as display name if name is empty	2026-01-18 15:23:21 +01:00
Mathijs van Veluw	b2cd556f3e	Fix User API Key login (#6712) ... When using the latest Bitwarden CLI and logging in using the API Key, it expects some extra fields, same as for normal login. This PR adds those fields and login is possible again via API Key. Fixes #6709 Signed-off-by: BlackDex <black.dex@gmail.com>	2026-01-14 13:11:43 +01:00
Mathijs van Veluw	4352fffeec	Fix web-vault version check and update web-vault (#6686)	2026-01-09 13:21:10 +01:00
Stefan Melmuk	8d08697cf8	improve sso callback path (#6676) ... * normalize base_url for sso_callback_path * clean url when embedding images	2026-01-06 17:10:00 +00:00
Stefan Melmuk	9f1df42259	allow MasterPasswordHash for Android (#6673)	2026-01-06 14:24:05 +00:00
Stefan Melmuk	1e1f9957cd	return no content with status code 204 (#6665)	2026-01-05 18:52:24 +00:00
Daniel García	3e2cef7e8b	Try old refresh token if we fail to decode jwt (#6629)	2025-12-29 22:54:51 +01:00
Daniel García	a4907f3539	Add wrapped named variants to UserDecryptionOptions (#6598)	2025-12-27 23:35:04 +01:00
Mathijs van Veluw	d9c75508c2	Fix posting cipher with readonly collections (#6578) ... * Fix posting cipher with readonly collections This fix will check if a collection is writeable for the user, and if not error out early instead of creating the cipher first and leaving it. It will also save some database transactions. Fixes #6562 Signed-off-by: BlackDex <black.dex@gmail.com> * Adjust code to delete on error Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com>	2025-12-21 18:51:58 +01:00
Daniel García	5c91058ba0	Add UserDecryptionOptions on /sync too (#6574)	2025-12-20 00:37:46 +01:00
Mathijs van Veluw	229b58fe4e	Update crates and Rust (#6551) ... * Update crates and Rust - Updated all the crates - Updated Rust to v1.92.0 - Updated to Alpine v3.23 - Adjusted some nightly clippy lints Signed-off-by: BlackDex <black.dex@gmail.com> * Add new updates Signed-off-by: BlackDex <black.dex@gmail.com> * Updated more crates and fix mariadb Updated more crates Also removed older MariaDB library since Diesel has fixed this in the v2.3.5 version. Signed-off-by: BlackDex <black.dex@gmail.com> * Fix icon-fetch error Signed-off-by: BlackDex <black.dex@gmail.com> * Update GHA workflows Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com>	2025-12-19 17:38:13 +01:00
Daniel García	061d320c7f	Add new accountKeys and masterPasswordUnlock fields (#6572) ... * Add new accountKeys and masterPasswordUnlock fields * Fmt	2025-12-19 13:34:43 +01:00
Stefan Melmuk	2c73c6c2f2	support UriMatchDefaults policy (#6570)	2025-12-19 12:07:58 +01:00
Stefan Melmuk	57bdab1550	add empty /api/tasks endpoint (#6557)	2025-12-14 15:32:21 +01:00
Stefan Melmuk	4ad8baf7be	fix email as 2fa for sso (#6495) ... * fix email as 2fa for sso * allow saving device without updating `updated_at` * check if email is some * allow device to be saved in postgresql * use twofactor_incomplete table * no need to update device.updated_at	2025-12-06 22:22:33 +01:00
Timshel	8f689d8795	Improve sso auth flow (#6205) ... Co-authored-by: Timshel <timshel@users.noreply.github.com>	2025-12-06 22:20:04 +01:00
Timshel	2d91a9460b	Fix admin invite with SSO (#6498) ... Co-authored-by: Timshel <timshel@users.noreply.github.com>	2025-12-06 22:14:20 +01:00
Timshel	e81e6a5060	Android want response property in camelCase (#6513) ... Co-authored-by: Timshel <timshel@480s>	2025-12-06 22:13:51 +01:00
Timshel	76d0856bbe	Org.put_policy type not in body anymore (#6514) ... Co-authored-by: Timshel <timshel@480s>	2025-12-06 22:12:46 +01:00
Mathijs van Veluw	cb2f5741ac	Some small admin js/css updates (#6501) ... * Some small admin js/css updates - Updated JS libraries - Fixed some eslint errors - Small update on the theme icon's to be a bit smaller and better sized. Used OXVG via OXVGUI to shrink and optimze them. Probably Fixes #6493 Signed-off-by: BlackDex <black.dex@gmail.com> * Adjust the size of the moon to be more inline with the other icons Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com>	2025-11-29 22:57:57 +01:00
Mathijs van Veluw	c9d527d84f	Add option to prefer IPv6 resolving (#6494) ... This PR adds an option to prefer IPv6 resolving before IPv4. On IPv6 only systems this could be very useful, but will not solve IPv4 only domains of course. For that you need a DNS64 + NAT64 solution Fixes #6301 Signed-off-by: BlackDex <black.dex@gmail.com>	2025-11-26 01:26:10 +01:00
Mathijs van Veluw	7c7f4f5d4f	Update crates and Rust version (#6485) ... * Update crates and Rust version - Update all crates (where possible) Adjusted code where needed - Fixed some nightly clippy lints Signed-off-by: BlackDex <black.dex@gmail.com> * Fix some issues/comments Signed-off-by: BlackDex <black.dex@gmail.com> * Update some crates Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com> Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>	2025-11-23 22:03:30 +01:00
Stefan Melmuk	aad1f19b45	fix email as 2fa provider (#6473)	2025-11-23 21:55:20 +01:00
Timshel	35e1a306f3	Fix around singleorg policy (#6247) ... Co-authored-by: Timshel <timshel@users.noreply.github.com>	2025-11-23 21:54:37 +01:00
Mathijs van Veluw	7f7b412220	Fix icon redirect caching (#6487) ... As reported in #6477, redirection of favicon's didn't allowed caching. This commit fixes this by adding the `Cached` wrapper around the response. It will use the same TTL's used for downloading icon's locally. Also removed `_` as valid domain character, these should not be used in FQDN's at all. Those only serve as special chars used in domain labels, mostly used in SRV or TXT records. Fixes #6477 Signed-off-by: BlackDex <black.dex@gmail.com>	2025-11-23 21:50:31 +01:00
Ephemera42	319d982113	Add pm-25373-windows-biometrics-v2 feature flag (#6468)	2025-11-14 18:46:50 +01:00
Stefan Melmuk	95a0c667e4	remove invalid emergency access dummy value (#6463)	2025-11-14 18:46:42 +01:00
Joep Duin	b519832086	Fix: admin theme emoji alignment (#6459) ... * Fix: admin theme dropdown emoji alignment * Sprites	2025-11-14 18:46:31 +01:00
Mathijs van Veluw	2ee40d6105	Fix KDF Change with new web-vault (#6458) ... The newer web-vault's use a different json to update the KDF settings. This commit fixes this by updating the struct and adjust the validation settings. Fixes #6457 Signed-off-by: BlackDex <black.dex@gmail.com>	2025-11-11 19:37:32 +01:00
Mathijs van Veluw	9017ca265a	Optimizations and build speedup (#6339) ... * Optimizations and build speedup With this commit I have changed several components to be more efficient. This can be less llvm-lines generated or less `clone()` calls. ### Config - Re-ordered the `make_config` macro to be more efficient - Created a custom Deserializer for `ConfigBuilder` less code and more efficient - Use struct's for the `prepare_json` function instead of generating a custom JSON object. This generates less code and is more efficient. - Updated the `get_support_string` function to handle the masking differently. This generates less code and also was able to remove some sub-macro-calls ### Error - Added an extra new call to prevent duplicate Strings in generated macro code. This generated less llvm-lines and seems to be more efficient. - Created a custom Serializer for `ApiError` and `CompactApiError` This makes that struct smaller in size, so better for memory, but also less llvm-lines. ### General - Removed `once_lock` and replace it all with Rust's std LazyLock - Added and fixed some Clippy lints which reduced `clone()` calls for example. - Updated build profiles for more efficiency Also added a new profile specifically for CI, which should decrease the build check - Updated several GitHub Workflows for better security and use the new `ci` build profile - Updated to Rust v1.90.0 which uses a new linker `rust-lld` which should help in faster building - Updated the Cargo.toml for all crates to better use the `workspace` variables - Added a `typos` Workflow and Pre-Commit, which should help in detecting spell error's. Also fixed a few found by it. Signed-off-by: BlackDex <black.dex@gmail.com> * Fix release profile Signed-off-by: BlackDex <black.dex@gmail.com> * Update typos and remove mimalloc check from pre-commit checks Signed-off-by: BlackDex <black.dex@gmail.com> * Misc fixes and updated typos Signed-off-by: BlackDex <black.dex@gmail.com> * Update crates and workflows Signed-off-by: BlackDex <black.dex@gmail.com> * Fix formating and pre-commit Signed-off-by: BlackDex <black.dex@gmail.com> * Update to Rust v1.91 and update crates Signed-off-by: BlackDex <black.dex@gmail.com> * Update web-vault to v2025.10.1 and xx to v1.8.0 Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com>	2025-11-01 22:21:04 +01:00
Mathijs van Veluw	8d30285160	Fix issue with key-rotation and emergency-access (#6421) ... When a user has an unconfirmed emergency-access user, and tries to do a key-rotation, the validation fails. The reason is that Bitwarden only returns new keys for confirmed users, not for invited or accepted. This commit fixes this by only requesting confirmed or higher status emergency-access users. Signed-off-by: BlackDex <black.dex@gmail.com>	2025-11-01 22:20:38 +01:00
Daniel García	3cd3d33d00	Improve protected actions (#6411) ... * Improve protected actions * Match usage on two factor * Use saturating add * Don't delete token when tracking attempts	2025-10-29 21:41:34 +01:00
Mathijs van Veluw	2ee5819b56	Use Diesels MultiConnections Derive (#6279) ... * Use Diesels MultiConnections Derive With this PR we remove almost all custom macro's to create the multiple database type code. This is now handled by Diesel it self. This removed the need of the following functions/macro's: - `db_object!` - `::to_db` - `.from_db()` It is also possible to just use one schema instead of multiple per type. Also done: - Refactored the SQLite backup function - Some formatting of queries so every call is one a separate line, this looks a bit better - Declare `conn` as mut inside each `db_run!` instead of having to declare it as `mut` in functions or calls - Added an `ACTIVE_DB_TYPE` static which holds the currently active database type - Removed `diesel_logger` crate and use Diesel's `set_default_instrumentation()` If you want debug queries you can now simply change the log level of `vaultwarden::db::query_logger` - Use PostgreSQL v17 in the Alpine images to match the Debian Trixie version - Optimized the Workflows since `diesel_logger` isn't needed anymore And on the extra plus-side, this lowers the compile-time and binary size too. Signed-off-by: BlackDex <black.dex@gmail.com> * Adjust query_logger and some other small items Signed-off-by: BlackDex <black.dex@gmail.com> * Remove macro, replaced with an function Signed-off-by: BlackDex <black.dex@gmail.com> * Implement custom connection manager Signed-off-by: BlackDex <black.dex@gmail.com> * Updated some crates to keep up2date Signed-off-by: BlackDex <black.dex@gmail.com> * Small adjustment Signed-off-by: BlackDex <black.dex@gmail.com> * crate updates Signed-off-by: BlackDex <black.dex@gmail.com> * Update crates Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com>	2025-10-29 21:04:30 +01:00
Stefan Melmuk	a85b48512c	add seat limit for the invite dialog (#6371)	2025-10-21 20:23:46 +02:00
Stefan Melmuk	fe1a8f7738	add missing media-src directive (#6381)	2025-10-21 19:22:37 +02:00
Stefan Melmuk	d43edb8f17	add mail address change warning for invited accounts (#6377) ... add a new mail template to differentiate between existing accounts and only invited accounts, so that they can easier delete the existing placeholder account	2025-10-21 19:21:47 +02:00
Timshel	8043f7eca7	Fix Org identifier (#6364) ... * Fix Org identifier * Org invitation default to SSO when SSO_ENABLED	2025-10-21 19:20:18 +02:00
Timshel	e659a61581	Add auth_request pending endpoint (#6368)	2025-10-21 19:17:52 +02:00
Stefan Melmuk	2d54cc61df	add new billing warnings endpoint (#6369)	2025-10-21 19:16:27 +02:00
Timshel	3f010a50af	Change OIDC dummy identifier (#6263) ... * Change OIDC dummy identifier * Update src/sso.rs Co-authored-by: Helmut K. C. Tessarek <tessarek@evermeet.cx> * Use Org uuid as identifier --------- Co-authored-by: Helmut K. C. Tessarek <tessarek@evermeet.cx> Co-authored-by: Mathijs van Veluw <black.dex@gmail.com>	2025-10-13 21:28:37 +02:00
Timshel	e83faad8d2	Fix sso_user dropped on User::save (#6262) ... * Admin delete SSO association prompt * User.save don't use replace_into * User.save use upsert with sqlite * User.save use upsert with mysql	2025-10-13 21:25:53 +02:00