ciphers.rs (47969B)
1 use super::folders::FolderData; 2 use crate::{ 3 api::{self, EmptyResult, JsonResult, PasswordOrOtpData}, 4 auth::Headers, 5 db::{ 6 DbConn, 7 models::{ 8 Cipher, Collection, CollectionCipher, CollectionUser, Favorite, Folder, FolderCipher, 9 OrgPolicy, OrgPolicyType, UserOrgType, UserOrganization, 10 }, 11 }, 12 error::Error, 13 util::NumberOrString, 14 }; 15 use chrono::{NaiveDateTime, Utc}; 16 use rocket::{ 17 Route, 18 form::{Form, FromForm}, 19 fs::TempFile, 20 serde::json::Json, 21 }; 22 use serde_json::Value; 23 use std::collections::{HashMap, HashSet}; 24 pub fn routes() -> Vec<Route> { 25 // Note that many routes have an `admin` variant; this seems to be 26 // because the stored procedure that upstream Bitwarden uses to determine 27 // whether the user can edit a cipher doesn't take into account whether 28 // the user is an org owner/admin. The `admin` variant first checks 29 // whether the user is an owner/admin of the relevant org, and if so, 30 // allows the operation unconditionally. 31 // 32 // vaultwarden factors in the org owner/admin status as part of 33 // determining the write accessibility of a cipher, so most 34 // admin/non-admin implementations can be shared. 35 routes![ 36 delete_all, 37 delete_attachment, 38 delete_attachment_admin, 39 delete_attachment_post, 40 delete_attachment_post_admin, 41 delete_cipher, 42 delete_cipher_admin, 43 delete_cipher_post, 44 delete_cipher_post_admin, 45 delete_cipher_put, 46 delete_cipher_put_admin, 47 delete_cipher_selected, 48 delete_cipher_selected_admin, 49 delete_cipher_selected_post, 50 delete_cipher_selected_post_admin, 51 delete_cipher_selected_put, 52 delete_cipher_selected_put_admin, 53 get_attachment, 54 get_cipher, 55 get_cipher_admin, 56 get_cipher_details, 57 get_ciphers, 58 move_cipher_selected, 59 move_cipher_selected_put, 60 post_attachment, 61 post_attachment_admin, 62 post_attachment_share, 63 post_attachment_v2, 64 post_attachment_v2_data, 65 post_cipher, 66 post_cipher_admin, 67 post_cipher_partial, 68 post_cipher_share, 69 post_ciphers, 70 post_ciphers_admin, 71 post_ciphers_create, 72 post_ciphers_import, 73 post_collections2_update, 74 post_collections_admin, 75 post_collections_update, 76 put_cipher, 77 put_cipher_admin, 78 put_cipher_partial, 79 put_cipher_share, 80 put_cipher_share_selected, 81 put_collections2_update, 82 put_collections_admin, 83 put_collections_update, 84 restore_cipher_put, 85 restore_cipher_put_admin, 86 restore_cipher_selected, 87 sync, 88 ] 89 } 90 91 #[derive(FromForm, Default)] 92 struct SyncData { 93 #[field(name = "excludeDomains")] 94 exclude_domains: bool, // Default: 'false' 95 } 96 97 #[get("/sync?<data..>")] 98 async fn sync(data: SyncData, headers: Headers, conn: DbConn) -> Json<Value> { 99 let user_json = headers.user.to_json(&conn).await; 100 // Get all ciphers which are visible by the user 101 let ciphers = Cipher::find_by_user_visible(&headers.user.uuid, &conn).await; 102 let cipher_sync_data = 103 CipherSyncData::new(&headers.user.uuid, CipherSyncType::User, &conn).await; 104 105 // Lets generate the ciphers_json using all the gathered info 106 let mut ciphers_json = Vec::with_capacity(ciphers.len()); 107 for c in ciphers { 108 ciphers_json.push( 109 c.to_json( 110 &headers.user.uuid, 111 Some(&cipher_sync_data), 112 CipherSyncType::User, 113 &conn, 114 ) 115 .await, 116 ); 117 } 118 let collections = Collection::find_by_user_uuid(headers.user.uuid.clone(), &conn).await; 119 let mut collections_json = Vec::with_capacity(collections.len()); 120 for c in collections { 121 collections_json.push( 122 c.to_json_details(&headers.user.uuid, Some(&cipher_sync_data), &conn) 123 .await, 124 ); 125 } 126 let folders_json: Vec<Value> = Folder::find_by_user(&headers.user.uuid, &conn) 127 .await 128 .iter() 129 .map(Folder::to_json) 130 .collect(); 131 let policies_json: Vec<Value> = OrgPolicy::find_confirmed_by_user(&headers.user.uuid, &conn) 132 .await 133 .iter() 134 .map(OrgPolicy::to_json) 135 .collect(); 136 let domains_json = if data.exclude_domains { 137 Value::Null 138 } else { 139 api::core::_get_eq_domains(headers, true).into_inner() 140 }; 141 Json(json!({ 142 "profile": user_json, 143 "folders": folders_json, 144 "collections": collections_json, 145 "policies": policies_json, 146 "ciphers": ciphers_json, 147 "domains": domains_json, 148 "sends": Vec::<Value>::new(), 149 "object": "sync" 150 })) 151 } 152 153 #[get("/ciphers")] 154 async fn get_ciphers(headers: Headers, conn: DbConn) -> Json<Value> { 155 let ciphers = Cipher::find_by_user_visible(&headers.user.uuid, &conn).await; 156 let cipher_sync_data = 157 CipherSyncData::new(&headers.user.uuid, CipherSyncType::User, &conn).await; 158 let mut ciphers_json = Vec::with_capacity(ciphers.len()); 159 for c in ciphers { 160 ciphers_json.push( 161 c.to_json( 162 &headers.user.uuid, 163 Some(&cipher_sync_data), 164 CipherSyncType::User, 165 &conn, 166 ) 167 .await, 168 ); 169 } 170 Json(json!({ 171 "data": ciphers_json, 172 "object": "list", 173 "continuationToken": null 174 })) 175 } 176 177 #[get("/ciphers/<uuid>")] 178 async fn get_cipher(uuid: &str, headers: Headers, conn: DbConn) -> JsonResult { 179 let Some(cipher) = Cipher::find_by_uuid(uuid, &conn).await else { 180 err!("Cipher doesn't exist") 181 }; 182 if !cipher 183 .is_accessible_to_user(&headers.user.uuid, &conn) 184 .await 185 { 186 err!("Cipher is not owned by user") 187 } 188 Ok(Json( 189 cipher 190 .to_json(&headers.user.uuid, None, CipherSyncType::User, &conn) 191 .await, 192 )) 193 } 194 195 #[get("/ciphers/<uuid>/admin")] 196 async fn get_cipher_admin(uuid: &str, headers: Headers, conn: DbConn) -> JsonResult { 197 // TODO: Implement this correctly 198 get_cipher(uuid, headers, conn).await 199 } 200 201 #[get("/ciphers/<uuid>/details")] 202 async fn get_cipher_details(uuid: &str, headers: Headers, conn: DbConn) -> JsonResult { 203 get_cipher(uuid, headers, conn).await 204 } 205 206 #[derive(Deserialize)] 207 #[serde(rename_all = "camelCase")] 208 pub struct CipherData { 209 // id is optional as it is included only in bulk share 210 pub id: Option<String>, 211 // folder id is not included in import 212 folder_id: Option<String>, 213 // TODO: Some of these might appear all the time, no need for Option 214 #[serde(alias = "organizationID")] 215 pub organization_id: Option<String>, 216 key: Option<String>, 217 pub r#type: i32, 218 pub name: String, 219 pub notes: Option<String>, 220 fields: Option<Value>, 221 // Only one of these should exist, depending on type 222 login: Option<Value>, 223 secure_note: Option<Value>, 224 card: Option<Value>, 225 identity: Option<Value>, 226 favorite: Option<bool>, 227 reprompt: Option<i32>, 228 pub password_history: Option<Value>, 229 // These are used during key rotation 230 // 'Attachments' is unused, contains map of {id: filename} 231 #[allow(dead_code)] 232 attachments: Option<Value>, 233 #[allow(dead_code)] 234 attachments2: Option<HashMap<String, Attachments2Data>>, 235 // The revision datetime (in ISO 8601 format) of the client's local copy 236 // of the cipher. This is used to prevent a client from updating a cipher 237 // when it doesn't have the latest version, as that can result in data 238 // loss. It's not an error when no value is provided; this can happen 239 // when using older client versions, or if the operation doesn't involve 240 // updating an existing cipher. 241 last_known_revision_date: Option<String>, 242 } 243 244 #[derive(Deserialize)] 245 #[serde(rename_all = "camelCase")] 246 struct PartialCipherData { 247 folder_id: Option<String>, 248 favorite: bool, 249 } 250 251 #[derive(Deserialize)] 252 #[serde(rename_all = "camelCase")] 253 struct Attachments2Data { 254 #[allow(dead_code)] 255 file_name: String, 256 #[allow(dead_code)] 257 key: String, 258 } 259 260 /// Called when an org admin clones an org cipher. 261 #[post("/ciphers/admin", data = "<data>")] 262 async fn post_ciphers_admin( 263 data: Json<ShareCipherData>, 264 headers: Headers, 265 conn: DbConn, 266 ) -> JsonResult { 267 post_ciphers_create(data, headers, conn).await 268 } 269 270 /// Called when creating a new org-owned cipher, or cloning a cipher (whether 271 /// user- or org-owned). When cloning a cipher to a user-owned cipher, 272 /// `organizationId` is null. 273 #[post("/ciphers/create", data = "<data>")] 274 async fn post_ciphers_create( 275 data: Json<ShareCipherData>, 276 headers: Headers, 277 conn: DbConn, 278 ) -> JsonResult { 279 let mut data: ShareCipherData = data.into_inner(); 280 // Check if there are one more more collections selected when this cipher is part of an organization. 281 // err if this is not the case before creating an empty cipher. 282 if data.cipher.organization_id.is_some() && data.collection_ids.is_empty() { 283 err!("You must select at least one collection."); 284 } 285 // This check is usually only needed in update_cipher_from_data(), but we 286 // need it here as well to avoid creating an empty cipher in the call to 287 // cipher.save() below. 288 enforce_personal_ownership_policy(Some(&data.cipher), &headers, &conn).await?; 289 let mut cipher = Cipher::new(data.cipher.r#type, data.cipher.name.clone()); 290 cipher.user_uuid = Some(headers.user.uuid.clone()); 291 cipher.save(&conn).await?; 292 // When cloning a cipher, the Bitwarden clients seem to set this field 293 // based on the cipher being cloned (when creating a new cipher, it's set 294 // to null as expected). However, `cipher.created_at` is initialized to 295 // the current time, so the stale data check will end up failing down the 296 // line. Since this function only creates new ciphers (whether by cloning 297 // or otherwise), we can just ignore this field entirely. 298 data.cipher.last_known_revision_date = None; 299 share_cipher_by_uuid(&cipher.uuid, data, &headers, &conn).await 300 } 301 302 /// Called when creating a new user-owned cipher. 303 #[post("/ciphers", data = "<data>")] 304 async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn) -> JsonResult { 305 let mut data: CipherData = data.into_inner(); 306 // The web/browser clients set this field to null as expected, but the 307 // mobile clients seem to set the invalid value `0001-01-01T00:00:00`, 308 // which results in a warning message being logged. This field isn't 309 // needed when creating a new cipher, so just ignore it unconditionally. 310 data.last_known_revision_date = None; 311 let mut cipher = Cipher::new(data.r#type, data.name.clone()); 312 update_cipher_from_data(&mut cipher, data, &headers, None, &conn, false).await?; 313 Ok(Json( 314 cipher 315 .to_json(&headers.user.uuid, None, CipherSyncType::User, &conn) 316 .await, 317 )) 318 } 319 320 /// Enforces the personal ownership policy on user-owned ciphers, if applicable. 321 /// A non-owner/admin user belonging to an org with the personal ownership policy 322 /// enabled isn't allowed to create new user-owned ciphers or modify existing ones 323 /// (that were created before the policy was applicable to the user). The user is 324 /// allowed to delete or share such ciphers to an org, however. 325 /// 326 /// Ref: https://bitwarden.com/help/article/policies/#personal-ownership 327 async fn enforce_personal_ownership_policy( 328 data: Option<&CipherData>, 329 headers: &Headers, 330 conn: &DbConn, 331 ) -> EmptyResult { 332 if data.is_none() || data.unwrap().organization_id.is_none() { 333 let user_uuid = &headers.user.uuid; 334 let policy_type = OrgPolicyType::PersonalOwnership; 335 if OrgPolicy::is_applicable_to_user(user_uuid, policy_type, None, conn).await { 336 err!( 337 "Due to an Enterprise Policy, you are restricted from saving items to your personal vault." 338 ) 339 } 340 } 341 Ok(()) 342 } 343 344 pub async fn update_cipher_from_data( 345 cipher: &mut Cipher, 346 data: CipherData, 347 headers: &Headers, 348 shared_to_collections: Option<Vec<String>>, 349 conn: &DbConn, 350 import_cipher: bool, 351 ) -> EmptyResult { 352 enforce_personal_ownership_policy(Some(&data), headers, conn).await?; 353 // Check that the client isn't updating an existing cipher with stale data. 354 // And only perform this check when not importing ciphers, else the date/time check will fail. 355 if !import_cipher { 356 if let Some(dt) = data.last_known_revision_date { 357 match NaiveDateTime::parse_from_str(&dt, "%+") { 358 // ISO 8601 format 359 Err(err) => warn!("Error parsing LastKnownRevisionDate '{}': {}", dt, err), 360 Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => { 361 err!( 362 "The client copy of this cipher is out of date. Resync the client and try again." 363 ) 364 } 365 Ok(_) => (), 366 } 367 } 368 } 369 if cipher.organization_uuid.is_some() && cipher.organization_uuid != data.organization_id { 370 err!("Organization mismatch. Please resync the client before updating the cipher") 371 } 372 if let Some(ref note) = data.notes { 373 if note.len() > 10_000 { 374 err!("The field Notes exceeds the maximum encrypted value length of 10000 characters.") 375 } 376 } 377 if let Some(org_id) = data.organization_id { 378 match UserOrganization::find_by_user_and_org(&headers.user.uuid, &org_id, conn).await { 379 None => err!("You don't have permission to add item to organization"), 380 Some(org_user) => { 381 if shared_to_collections.is_some() 382 || org_user.has_full_access() 383 || cipher 384 .is_write_accessible_to_user(&headers.user.uuid, conn) 385 .await 386 { 387 cipher.organization_uuid = Some(org_id); 388 // After some discussion in PR #1329 re-added the user_uuid = None again. 389 // TODO: Audit/Check the whole save/update cipher chain. 390 // Upstream uses the user_uuid to allow a cipher added by a user to an org to still allow the user to view/edit the cipher 391 // even when the user has hide-passwords configured as there policy. 392 // Removing the line below would fix that, but we have to check which effect this would have on the rest of the code. 393 cipher.user_uuid = None; 394 } else { 395 err!("You don't have permission to add cipher directly to organization") 396 } 397 } 398 } 399 } else { 400 cipher.user_uuid = Some(headers.user.uuid.clone()); 401 } 402 if let Some(ref folder_id) = data.folder_id { 403 match Folder::find_by_uuid(folder_id, conn).await { 404 Some(folder) => { 405 if folder.user_uuid != headers.user.uuid { 406 err!("Folder is not owned by user") 407 } 408 } 409 None => err!("Folder doesn't exist"), 410 } 411 } 412 // Cleanup cipher data, like removing the 'Response' key. 413 // This key is somewhere generated during Javascript so no way for us this fix this. 414 // Also, upstream only retrieves keys they actually want to store, and thus skip the 'Response' key. 415 // We do not mind which data is in it, the keep our model more flexible when there are upstream changes. 416 // But, we at least know we do not need to store and return this specific key. 417 fn _clean_cipher_data(mut json_data: Value) -> Value { 418 if json_data.is_array() { 419 json_data 420 .as_array_mut() 421 .unwrap() 422 .iter_mut() 423 .for_each(|ref mut f| { 424 f.as_object_mut().unwrap().remove("Response"); 425 }); 426 } 427 json_data 428 } 429 let type_data_opt = match data.r#type { 430 1i32 => data.login, 431 2i32 => data.secure_note, 432 3i32 => data.card, 433 4i32 => data.identity, 434 _ => err!("Invalid type"), 435 }; 436 let type_data = match type_data_opt { 437 Some(mut data_in_type) => { 438 // Remove the 'Response' key from the base object. 439 data_in_type.as_object_mut().unwrap().remove("Response"); 440 // Remove the 'Response' key from every Uri. 441 if data_in_type["Uris"].is_array() { 442 data_in_type["Uris"] = _clean_cipher_data(data_in_type["Uris"].clone()); 443 } 444 data_in_type 445 } 446 None => err!("Data missing"), 447 }; 448 cipher.key = data.key; 449 cipher.name = data.name; 450 cipher.notes = data.notes; 451 cipher.fields = data.fields.map(|f| _clean_cipher_data(f).to_string()); 452 cipher.data = type_data.to_string(); 453 cipher.password_history = data.password_history.map(|f| f.to_string()); 454 cipher.reprompt = data.reprompt; 455 cipher.save(conn).await?; 456 cipher 457 .move_to_folder(data.folder_id, &headers.user.uuid, conn) 458 .await?; 459 cipher 460 .set_favorite(data.favorite, &headers.user.uuid, conn) 461 .await?; 462 Ok(()) 463 } 464 465 #[derive(Deserialize)] 466 #[serde(rename_all = "camelCase")] 467 struct ImportData { 468 ciphers: Vec<CipherData>, 469 folders: Vec<FolderData>, 470 folder_relationships: Vec<RelationsData>, 471 } 472 473 #[derive(Deserialize)] 474 #[serde(rename_all = "camelCase")] 475 struct RelationsData { 476 // Cipher id 477 key: usize, 478 // Folder id 479 value: usize, 480 } 481 482 #[post("/ciphers/import", data = "<data>")] 483 async fn post_ciphers_import( 484 data: Json<ImportData>, 485 headers: Headers, 486 conn: DbConn, 487 ) -> EmptyResult { 488 enforce_personal_ownership_policy(None, &headers, &conn).await?; 489 let data: ImportData = data.into_inner(); 490 // Validate the import before continuing 491 // Bitwarden does not process the import if there is one item invalid. 492 // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it. 493 // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks. 494 Cipher::validate_cipher_data(&data.ciphers)?; 495 let existing_folders: Vec<String> = Folder::find_by_user(&headers.user.uuid, &conn) 496 .await 497 .into_iter() 498 .map(|f| f.uuid) 499 .collect(); 500 let mut folders: Vec<String> = Vec::with_capacity(data.folders.len()); 501 for folder in data.folders { 502 let folder_uuid = 503 if folder.id.is_some() && existing_folders.contains(folder.id.as_ref().unwrap()) { 504 folder.id.unwrap() 505 } else { 506 let mut new_folder = Folder::new(headers.user.uuid.clone(), folder.name); 507 new_folder.save(&conn).await?; 508 new_folder.uuid 509 }; 510 folders.push(folder_uuid); 511 } 512 // Read the relations between folders and ciphers 513 let mut relations_map = HashMap::with_capacity(data.folder_relationships.len()); 514 for relation in data.folder_relationships { 515 relations_map.insert(relation.key, relation.value); 516 } 517 // Read and create the ciphers 518 for (index, mut cipher_data) in data.ciphers.into_iter().enumerate() { 519 let folder_uuid = relations_map.get(&index).map(|i| folders[*i].clone()); 520 cipher_data.folder_id = folder_uuid; 521 let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone()); 522 update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, true).await?; 523 } 524 let mut user = headers.user; 525 user.update_revision(&conn).await?; 526 Ok(()) 527 } 528 529 /// Called when an org admin modifies an existing org cipher. 530 #[put("/ciphers/<uuid>/admin", data = "<data>")] 531 async fn put_cipher_admin( 532 uuid: &str, 533 data: Json<CipherData>, 534 headers: Headers, 535 conn: DbConn, 536 ) -> JsonResult { 537 put_cipher(uuid, data, headers, conn).await 538 } 539 540 #[post("/ciphers/<uuid>/admin", data = "<data>")] 541 async fn post_cipher_admin( 542 uuid: &str, 543 data: Json<CipherData>, 544 headers: Headers, 545 conn: DbConn, 546 ) -> JsonResult { 547 post_cipher(uuid, data, headers, conn).await 548 } 549 550 #[post("/ciphers/<uuid>", data = "<data>")] 551 async fn post_cipher( 552 uuid: &str, 553 data: Json<CipherData>, 554 headers: Headers, 555 conn: DbConn, 556 ) -> JsonResult { 557 put_cipher(uuid, data, headers, conn).await 558 } 559 560 #[put("/ciphers/<uuid>", data = "<data>")] 561 async fn put_cipher( 562 uuid: &str, 563 data: Json<CipherData>, 564 headers: Headers, 565 conn: DbConn, 566 ) -> JsonResult { 567 let data: CipherData = data.into_inner(); 568 let Some(mut cipher) = Cipher::find_by_uuid(uuid, &conn).await else { 569 err!("Cipher doesn't exist") 570 }; 571 // TODO: Check if only the folder ID or favorite status is being changed. 572 // These are per-user properties that technically aren't part of the 573 // cipher itself, so the user shouldn't need write access to change these. 574 // Interestingly, upstream Bitwarden doesn't properly handle this either. 575 if !cipher 576 .is_write_accessible_to_user(&headers.user.uuid, &conn) 577 .await 578 { 579 err!("Cipher is not write accessible") 580 } 581 update_cipher_from_data(&mut cipher, data, &headers, None, &conn, false).await?; 582 Ok(Json( 583 cipher 584 .to_json(&headers.user.uuid, None, CipherSyncType::User, &conn) 585 .await, 586 )) 587 } 588 589 #[post("/ciphers/<uuid>/partial", data = "<data>")] 590 async fn post_cipher_partial( 591 uuid: &str, 592 data: Json<PartialCipherData>, 593 headers: Headers, 594 conn: DbConn, 595 ) -> JsonResult { 596 put_cipher_partial(uuid, data, headers, conn).await 597 } 598 599 // Only update the folder and favorite for the user, since this cipher is read-only 600 #[put("/ciphers/<uuid>/partial", data = "<data>")] 601 async fn put_cipher_partial( 602 uuid: &str, 603 data: Json<PartialCipherData>, 604 headers: Headers, 605 conn: DbConn, 606 ) -> JsonResult { 607 let data: PartialCipherData = data.into_inner(); 608 let Some(cipher) = Cipher::find_by_uuid(uuid, &conn).await else { 609 err!("Cipher doesn't exist") 610 }; 611 if let Some(ref folder_id) = data.folder_id { 612 match Folder::find_by_uuid(folder_id, &conn).await { 613 Some(folder) => { 614 if folder.user_uuid != headers.user.uuid { 615 err!("Folder is not owned by user") 616 } 617 } 618 None => err!("Folder doesn't exist"), 619 } 620 } 621 // Move cipher 622 cipher 623 .move_to_folder(data.folder_id.clone(), &headers.user.uuid, &conn) 624 .await?; 625 // Update favorite 626 cipher 627 .set_favorite(Some(data.favorite), &headers.user.uuid, &conn) 628 .await?; 629 Ok(Json( 630 cipher 631 .to_json(&headers.user.uuid, None, CipherSyncType::User, &conn) 632 .await, 633 )) 634 } 635 636 #[derive(Deserialize)] 637 #[serde(rename_all = "camelCase")] 638 struct CollectionsAdminData { 639 #[serde(alias = "CollectionIds")] 640 collection_ids: Vec<String>, 641 } 642 643 #[put("/ciphers/<uuid>/collections_v2", data = "<data>")] 644 async fn put_collections2_update( 645 uuid: &str, 646 data: Json<CollectionsAdminData>, 647 headers: Headers, 648 conn: DbConn, 649 ) -> JsonResult { 650 post_collections2_update(uuid, data, headers, conn).await 651 } 652 653 #[post("/ciphers/<uuid>/collections_v2", data = "<data>")] 654 async fn post_collections2_update( 655 uuid: &str, 656 data: Json<CollectionsAdminData>, 657 headers: Headers, 658 conn: DbConn, 659 ) -> JsonResult { 660 let cipher_details = post_collections_update(uuid, data, headers, conn).await?; 661 Ok(Json(json!({ 662 "object": "optionalCipherDetails", 663 "unavailable": false, 664 "cipher": *cipher_details 665 }))) 666 } 667 668 #[put("/ciphers/<uuid>/collections", data = "<data>")] 669 async fn put_collections_update( 670 uuid: &str, 671 data: Json<CollectionsAdminData>, 672 headers: Headers, 673 conn: DbConn, 674 ) -> JsonResult { 675 post_collections_update(uuid, data, headers, conn).await 676 } 677 678 #[post("/ciphers/<uuid>/collections", data = "<data>")] 679 async fn post_collections_update( 680 uuid: &str, 681 data: Json<CollectionsAdminData>, 682 headers: Headers, 683 conn: DbConn, 684 ) -> JsonResult { 685 let data: CollectionsAdminData = data.into_inner(); 686 let Some(cipher) = Cipher::find_by_uuid(uuid, &conn).await else { 687 err!("Cipher doesn't exist") 688 }; 689 if !cipher 690 .is_write_accessible_to_user(&headers.user.uuid, &conn) 691 .await 692 { 693 err!("Cipher is not write accessible") 694 } 695 696 let posted_collections = HashSet::<String>::from_iter(data.collection_ids); 697 let current_collections = HashSet::<String>::from_iter( 698 cipher 699 .get_collections(headers.user.uuid.clone(), &conn) 700 .await, 701 ); 702 703 for collection in posted_collections.symmetric_difference(¤t_collections) { 704 match Collection::find_by_uuid(collection, &conn).await { 705 None => err!("Invalid collection ID provided"), 706 Some(collection) => { 707 if collection 708 .is_writable_by_user(&headers.user.uuid, &conn) 709 .await 710 { 711 if posted_collections.contains(&collection.uuid) { 712 // Add to collection 713 CollectionCipher::save(&cipher.uuid, &collection.uuid, &conn).await?; 714 } else { 715 // Remove from collection 716 CollectionCipher::delete(&cipher.uuid, &collection.uuid, &conn).await?; 717 } 718 } else { 719 err!("No rights to modify the collection") 720 } 721 } 722 } 723 } 724 Ok(Json( 725 cipher 726 .to_json(&headers.user.uuid, None, CipherSyncType::User, &conn) 727 .await, 728 )) 729 } 730 731 #[put("/ciphers/<uuid>/collections-admin", data = "<data>")] 732 async fn put_collections_admin( 733 uuid: &str, 734 data: Json<CollectionsAdminData>, 735 headers: Headers, 736 conn: DbConn, 737 ) -> EmptyResult { 738 post_collections_admin(uuid, data, headers, conn).await 739 } 740 741 #[post("/ciphers/<uuid>/collections-admin", data = "<data>")] 742 async fn post_collections_admin( 743 uuid: &str, 744 data: Json<CollectionsAdminData>, 745 headers: Headers, 746 conn: DbConn, 747 ) -> EmptyResult { 748 let data: CollectionsAdminData = data.into_inner(); 749 let Some(cipher) = Cipher::find_by_uuid(uuid, &conn).await else { 750 err!("Cipher doesn't exist") 751 }; 752 if !cipher 753 .is_write_accessible_to_user(&headers.user.uuid, &conn) 754 .await 755 { 756 err!("Cipher is not write accessible") 757 } 758 let posted_collections = HashSet::<String>::from_iter(data.collection_ids); 759 let current_collections = HashSet::<String>::from_iter( 760 cipher 761 .get_admin_collections(headers.user.uuid.clone(), &conn) 762 .await, 763 ); 764 for collection in posted_collections.symmetric_difference(¤t_collections) { 765 match Collection::find_by_uuid(collection, &conn).await { 766 None => err!("Invalid collection ID provided"), 767 Some(collection) => { 768 if collection 769 .is_writable_by_user(&headers.user.uuid, &conn) 770 .await 771 { 772 if posted_collections.contains(&collection.uuid) { 773 // Add to collection 774 CollectionCipher::save(&cipher.uuid, &collection.uuid, &conn).await?; 775 } else { 776 // Remove from collection 777 CollectionCipher::delete(&cipher.uuid, &collection.uuid, &conn).await?; 778 } 779 } else { 780 err!("No rights to modify the collection") 781 } 782 } 783 } 784 } 785 Ok(()) 786 } 787 788 #[derive(Deserialize)] 789 #[serde(rename_all = "camelCase")] 790 struct ShareCipherData { 791 #[serde(alias = "Cipher")] 792 cipher: CipherData, 793 #[serde(alias = "CollectionIds")] 794 collection_ids: Vec<String>, 795 } 796 797 #[post("/ciphers/<uuid>/share", data = "<data>")] 798 async fn post_cipher_share( 799 uuid: &str, 800 data: Json<ShareCipherData>, 801 headers: Headers, 802 conn: DbConn, 803 ) -> JsonResult { 804 let data: ShareCipherData = data.into_inner(); 805 share_cipher_by_uuid(uuid, data, &headers, &conn).await 806 } 807 808 #[put("/ciphers/<uuid>/share", data = "<data>")] 809 async fn put_cipher_share( 810 uuid: &str, 811 data: Json<ShareCipherData>, 812 headers: Headers, 813 conn: DbConn, 814 ) -> JsonResult { 815 let data: ShareCipherData = data.into_inner(); 816 share_cipher_by_uuid(uuid, data, &headers, &conn).await 817 } 818 819 #[derive(Deserialize)] 820 #[serde(rename_all = "camelCase")] 821 struct ShareSelectedCipherData { 822 ciphers: Vec<CipherData>, 823 collection_ids: Vec<String>, 824 } 825 826 #[put("/ciphers/share", data = "<data>")] 827 async fn put_cipher_share_selected( 828 data: Json<ShareSelectedCipherData>, 829 headers: Headers, 830 conn: DbConn, 831 ) -> EmptyResult { 832 let mut data: ShareSelectedCipherData = data.into_inner(); 833 if data.ciphers.is_empty() { 834 err!("You must select at least one cipher.") 835 } 836 if data.collection_ids.is_empty() { 837 err!("You must select at least one collection.") 838 } 839 for cipher in &data.ciphers { 840 if cipher.id.is_none() { 841 err!("Request missing ids field"); 842 } 843 } 844 while let Some(cipher) = data.ciphers.pop() { 845 let mut shared_cipher_data = ShareCipherData { 846 cipher, 847 collection_ids: data.collection_ids.clone(), 848 }; 849 match shared_cipher_data.cipher.id.take() { 850 Some(id) => share_cipher_by_uuid(&id, shared_cipher_data, &headers, &conn).await?, 851 None => err!("Request missing ids field"), 852 }; 853 } 854 Ok(()) 855 } 856 857 async fn share_cipher_by_uuid( 858 uuid: &str, 859 data: ShareCipherData, 860 headers: &Headers, 861 conn: &DbConn, 862 ) -> JsonResult { 863 let mut cipher = match Cipher::find_by_uuid(uuid, conn).await { 864 Some(cipher) => { 865 if cipher 866 .is_write_accessible_to_user(&headers.user.uuid, conn) 867 .await 868 { 869 cipher 870 } else { 871 err!("Cipher is not write accessible") 872 } 873 } 874 None => err!("Cipher doesn't exist"), 875 }; 876 let mut shared_to_collections = Vec::new(); 877 if let Some(ref organization_uuid) = data.cipher.organization_id { 878 for col_uuid in &data.collection_ids { 879 match Collection::find_by_uuid_and_org(col_uuid, organization_uuid, conn).await { 880 None => err!("Invalid collection ID provided"), 881 Some(collection) => { 882 if collection 883 .is_writable_by_user(&headers.user.uuid, conn) 884 .await 885 { 886 CollectionCipher::save(&cipher.uuid, &collection.uuid, conn).await?; 887 shared_to_collections.push(collection.uuid); 888 } else { 889 err!("No rights to modify the collection") 890 } 891 } 892 } 893 } 894 } 895 update_cipher_from_data( 896 &mut cipher, 897 data.cipher, 898 headers, 899 Some(shared_to_collections), 900 conn, 901 false, 902 ) 903 .await?; 904 Ok(Json( 905 cipher 906 .to_json(&headers.user.uuid, None, CipherSyncType::User, conn) 907 .await, 908 )) 909 } 910 911 const ATTACHMENTS_DISABLED_MSG: &str = "Attachments are disabled."; 912 /// v2 API for downloading an attachment. This just redirects the client to 913 /// the actual location of an attachment. 914 /// 915 /// Upstream added this v2 API to support direct download of attachments from 916 /// their object storage service. For self-hosted instances, it basically just 917 /// redirects to the same location as before the v2 API. 918 #[allow(unused_variables, clippy::needless_pass_by_value)] 919 #[get("/ciphers/<uuid>/attachment/<attachment_id>")] 920 fn get_attachment(uuid: &str, attachment_id: &str, _headers: Headers) -> Error { 921 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 922 } 923 924 #[derive(Deserialize)] 925 #[serde(rename_all = "camelCase")] 926 struct AttachmentRequestData { 927 #[allow(dead_code)] 928 key: String, 929 #[allow(dead_code)] 930 file_name: String, 931 #[allow(dead_code)] 932 file_size: NumberOrString, 933 #[allow(dead_code)] 934 admin_request: Option<bool>, // true when attaching from an org vault view 935 } 936 937 /// v2 API for creating an attachment associated with a cipher. 938 /// This redirects the client to the API it should use to upload the attachment. 939 /// For upstream's cloud-hosted service, it's an Azure object storage API. 940 /// For self-hosted instances, it's another API on the local instance. 941 #[allow(unused_variables, clippy::needless_pass_by_value)] 942 #[post("/ciphers/<uuid>/attachment/v2", data = "<data>")] 943 fn post_attachment_v2(uuid: &str, data: Json<AttachmentRequestData>, _headers: Headers) -> Error { 944 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 945 } 946 947 #[allow(dead_code)] 948 #[derive(FromForm)] 949 struct UploadData<'f> { 950 key: Option<String>, 951 data: TempFile<'f>, 952 } 953 954 /// v2 API for uploading the actual data content of an attachment. 955 /// This route needs a rank specified so that Rocket prioritizes the 956 /// /ciphers/<uuid>/attachment/v2 route, which would otherwise conflict 957 /// with this one. 958 #[allow(unused_variables, clippy::needless_pass_by_value)] 959 #[post( 960 "/ciphers/<uuid>/attachment/<attachment_id>", 961 format = "multipart/form-data", 962 data = "<data>", 963 rank = 1 964 )] 965 fn post_attachment_v2_data( 966 uuid: &str, 967 attachment_id: &str, 968 data: Form<UploadData<'_>>, 969 _headers: Headers, 970 ) -> Error { 971 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 972 } 973 974 /// Legacy API for creating an attachment associated with a cipher. 975 #[allow(unused_variables, clippy::needless_pass_by_value)] 976 #[post( 977 "/ciphers/<uuid>/attachment", 978 format = "multipart/form-data", 979 data = "<data>" 980 )] 981 fn post_attachment(uuid: &str, data: Form<UploadData<'_>>, _headers: Headers) -> Error { 982 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 983 } 984 985 #[allow(unused_variables, clippy::needless_pass_by_value)] 986 #[post( 987 "/ciphers/<uuid>/attachment-admin", 988 format = "multipart/form-data", 989 data = "<data>" 990 )] 991 fn post_attachment_admin(uuid: &str, data: Form<UploadData<'_>>, _headers: Headers) -> Error { 992 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 993 } 994 995 #[allow(unused_variables, clippy::needless_pass_by_value)] 996 #[post( 997 "/ciphers/<uuid>/attachment/<attachment_id>/share", 998 format = "multipart/form-data", 999 data = "<data>" 1000 )] 1001 fn post_attachment_share( 1002 uuid: &str, 1003 attachment_id: &str, 1004 data: Form<UploadData<'_>>, 1005 _headers: Headers, 1006 ) -> Error { 1007 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 1008 } 1009 1010 #[allow(unused_variables, clippy::needless_pass_by_value)] 1011 #[post("/ciphers/<uuid>/attachment/<attachment_id>/delete-admin")] 1012 fn delete_attachment_post_admin(uuid: &str, attachment_id: &str, _headers: Headers) -> Error { 1013 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 1014 } 1015 1016 #[allow(unused_variables, clippy::needless_pass_by_value)] 1017 #[post("/ciphers/<uuid>/attachment/<attachment_id>/delete")] 1018 fn delete_attachment_post(uuid: &str, attachment_id: &str, _headers: Headers) -> Error { 1019 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 1020 } 1021 1022 #[allow(unused_variables, clippy::needless_pass_by_value)] 1023 #[delete("/ciphers/<uuid>/attachment/<attachment_id>")] 1024 fn delete_attachment(uuid: &str, attachment_id: &str, _headers: Headers) -> Error { 1025 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 1026 } 1027 1028 #[allow(unused_variables, clippy::needless_pass_by_value)] 1029 #[delete("/ciphers/<uuid>/attachment/<attachment_id>/admin")] 1030 fn delete_attachment_admin(uuid: &str, attachment_id: &str, _headers: Headers) -> Error { 1031 Error::new(ATTACHMENTS_DISABLED_MSG, ATTACHMENTS_DISABLED_MSG) 1032 } 1033 1034 #[post("/ciphers/<uuid>/delete")] 1035 async fn delete_cipher_post(uuid: &str, headers: Headers, conn: DbConn) -> EmptyResult { 1036 _delete_cipher_by_uuid(uuid, &headers, &conn, false).await 1037 } 1038 1039 #[post("/ciphers/<uuid>/delete-admin")] 1040 async fn delete_cipher_post_admin(uuid: &str, headers: Headers, conn: DbConn) -> EmptyResult { 1041 _delete_cipher_by_uuid(uuid, &headers, &conn, false).await 1042 } 1043 1044 #[put("/ciphers/<uuid>/delete")] 1045 async fn delete_cipher_put(uuid: &str, headers: Headers, conn: DbConn) -> EmptyResult { 1046 _delete_cipher_by_uuid(uuid, &headers, &conn, true).await 1047 } 1048 1049 #[put("/ciphers/<uuid>/delete-admin")] 1050 async fn delete_cipher_put_admin(uuid: &str, headers: Headers, conn: DbConn) -> EmptyResult { 1051 _delete_cipher_by_uuid(uuid, &headers, &conn, true).await 1052 } 1053 1054 #[delete("/ciphers/<uuid>")] 1055 async fn delete_cipher(uuid: &str, headers: Headers, conn: DbConn) -> EmptyResult { 1056 _delete_cipher_by_uuid(uuid, &headers, &conn, false).await 1057 } 1058 1059 #[delete("/ciphers/<uuid>/admin")] 1060 async fn delete_cipher_admin(uuid: &str, headers: Headers, conn: DbConn) -> EmptyResult { 1061 _delete_cipher_by_uuid(uuid, &headers, &conn, false).await 1062 } 1063 1064 #[delete("/ciphers", data = "<data>")] 1065 async fn delete_cipher_selected( 1066 data: Json<CipherIdsData>, 1067 headers: Headers, 1068 conn: DbConn, 1069 ) -> EmptyResult { 1070 _delete_multiple_ciphers(data, headers, conn, false).await // permanent delete 1071 } 1072 1073 #[post("/ciphers/delete", data = "<data>")] 1074 async fn delete_cipher_selected_post( 1075 data: Json<CipherIdsData>, 1076 headers: Headers, 1077 conn: DbConn, 1078 ) -> EmptyResult { 1079 _delete_multiple_ciphers(data, headers, conn, false).await // permanent delete 1080 } 1081 1082 #[put("/ciphers/delete", data = "<data>")] 1083 async fn delete_cipher_selected_put( 1084 data: Json<CipherIdsData>, 1085 headers: Headers, 1086 conn: DbConn, 1087 ) -> EmptyResult { 1088 _delete_multiple_ciphers(data, headers, conn, true).await // soft delete 1089 } 1090 1091 #[delete("/ciphers/admin", data = "<data>")] 1092 async fn delete_cipher_selected_admin( 1093 data: Json<CipherIdsData>, 1094 headers: Headers, 1095 conn: DbConn, 1096 ) -> EmptyResult { 1097 _delete_multiple_ciphers(data, headers, conn, false).await // permanent delete 1098 } 1099 1100 #[post("/ciphers/delete-admin", data = "<data>")] 1101 async fn delete_cipher_selected_post_admin( 1102 data: Json<CipherIdsData>, 1103 headers: Headers, 1104 conn: DbConn, 1105 ) -> EmptyResult { 1106 _delete_multiple_ciphers(data, headers, conn, false).await // permanent delete 1107 } 1108 1109 #[put("/ciphers/delete-admin", data = "<data>")] 1110 async fn delete_cipher_selected_put_admin( 1111 data: Json<CipherIdsData>, 1112 headers: Headers, 1113 conn: DbConn, 1114 ) -> EmptyResult { 1115 _delete_multiple_ciphers(data, headers, conn, true).await // soft delete 1116 } 1117 1118 #[put("/ciphers/<uuid>/restore")] 1119 async fn restore_cipher_put(uuid: &str, headers: Headers, conn: DbConn) -> JsonResult { 1120 _restore_cipher_by_uuid(uuid, &headers, &conn).await 1121 } 1122 1123 #[put("/ciphers/<uuid>/restore-admin")] 1124 async fn restore_cipher_put_admin(uuid: &str, headers: Headers, conn: DbConn) -> JsonResult { 1125 _restore_cipher_by_uuid(uuid, &headers, &conn).await 1126 } 1127 1128 #[put("/ciphers/restore", data = "<data>")] 1129 async fn restore_cipher_selected( 1130 data: Json<CipherIdsData>, 1131 headers: Headers, 1132 conn: DbConn, 1133 ) -> JsonResult { 1134 _restore_multiple_ciphers(data, &headers, &conn).await 1135 } 1136 1137 #[derive(Deserialize)] 1138 #[serde(rename_all = "camelCase")] 1139 struct MoveCipherData { 1140 folder_id: Option<String>, 1141 ids: Vec<String>, 1142 } 1143 1144 #[post("/ciphers/move", data = "<data>")] 1145 async fn move_cipher_selected( 1146 data: Json<MoveCipherData>, 1147 headers: Headers, 1148 conn: DbConn, 1149 ) -> EmptyResult { 1150 let data = data.into_inner(); 1151 let user_uuid = headers.user.uuid; 1152 if let Some(ref folder_id) = data.folder_id { 1153 match Folder::find_by_uuid(folder_id, &conn).await { 1154 Some(folder) => { 1155 if folder.user_uuid != user_uuid { 1156 err!("Folder is not owned by user") 1157 } 1158 } 1159 None => err!("Folder doesn't exist"), 1160 } 1161 } 1162 for uuid in data.ids { 1163 let Some(cipher) = Cipher::find_by_uuid(&uuid, &conn).await else { 1164 err!("Cipher doesn't exist") 1165 }; 1166 if !cipher.is_accessible_to_user(&user_uuid, &conn).await { 1167 err!("Cipher is not accessible by user") 1168 } 1169 // Move cipher 1170 cipher 1171 .move_to_folder(data.folder_id.clone(), &user_uuid, &conn) 1172 .await?; 1173 } 1174 Ok(()) 1175 } 1176 1177 #[put("/ciphers/move", data = "<data>")] 1178 async fn move_cipher_selected_put( 1179 data: Json<MoveCipherData>, 1180 headers: Headers, 1181 conn: DbConn, 1182 ) -> EmptyResult { 1183 move_cipher_selected(data, headers, conn).await 1184 } 1185 1186 #[derive(FromForm)] 1187 struct OrganizationId { 1188 #[field(name = "organizationId")] 1189 org_id: String, 1190 } 1191 1192 #[post("/ciphers/purge?<organization..>", data = "<data>")] 1193 async fn delete_all( 1194 organization: Option<OrganizationId>, 1195 data: Json<PasswordOrOtpData>, 1196 headers: Headers, 1197 conn: DbConn, 1198 ) -> EmptyResult { 1199 let data: PasswordOrOtpData = data.into_inner(); 1200 let mut user = headers.user; 1201 data.validate(&user)?; 1202 if let Some(org_data) = organization { 1203 // Organization ID in query params, purging organization vault 1204 match UserOrganization::find_by_user_and_org(&user.uuid, &org_data.org_id, &conn).await { 1205 None => err!("You don't have permission to purge the organization vault"), 1206 Some(user_org) => { 1207 if user_org.atype == UserOrgType::Owner { 1208 Cipher::delete_all_by_organization(&org_data.org_id, &conn).await?; 1209 Ok(()) 1210 } else { 1211 err!("You don't have permission to purge the organization vault"); 1212 } 1213 } 1214 } 1215 } else { 1216 // No organization ID in query params, purging user vault 1217 // Delete ciphers and their attachments 1218 for cipher in Cipher::find_owned_by_user(&user.uuid, &conn).await { 1219 cipher.delete(&conn).await?; 1220 } 1221 // Delete folders 1222 for f in Folder::find_by_user(&user.uuid, &conn).await { 1223 f.delete(&conn).await?; 1224 } 1225 user.update_revision(&conn).await?; 1226 Ok(()) 1227 } 1228 } 1229 1230 async fn _delete_cipher_by_uuid( 1231 uuid: &str, 1232 headers: &Headers, 1233 conn: &DbConn, 1234 soft_delete: bool, 1235 ) -> EmptyResult { 1236 let Some(mut cipher) = Cipher::find_by_uuid(uuid, conn).await else { 1237 err!("Cipher doesn't exist") 1238 }; 1239 if !cipher 1240 .is_write_accessible_to_user(&headers.user.uuid, conn) 1241 .await 1242 { 1243 err!("Cipher can't be deleted by user") 1244 } 1245 if soft_delete { 1246 cipher.deleted_at = Some(Utc::now().naive_utc()); 1247 cipher.save(conn).await?; 1248 } else { 1249 cipher.delete(conn).await?; 1250 } 1251 Ok(()) 1252 } 1253 1254 #[derive(Deserialize)] 1255 #[serde(rename_all = "camelCase")] 1256 struct CipherIdsData { 1257 ids: Vec<String>, 1258 } 1259 1260 async fn _delete_multiple_ciphers( 1261 data: Json<CipherIdsData>, 1262 headers: Headers, 1263 conn: DbConn, 1264 soft_delete: bool, 1265 ) -> EmptyResult { 1266 let data = data.into_inner(); 1267 for uuid in data.ids { 1268 if let error @ Err(_) = _delete_cipher_by_uuid(&uuid, &headers, &conn, soft_delete).await { 1269 return error; 1270 } 1271 } 1272 Ok(()) 1273 } 1274 1275 async fn _restore_cipher_by_uuid(uuid: &str, headers: &Headers, conn: &DbConn) -> JsonResult { 1276 let Some(mut cipher) = Cipher::find_by_uuid(uuid, conn).await else { 1277 err!("Cipher doesn't exist") 1278 }; 1279 if !cipher 1280 .is_write_accessible_to_user(&headers.user.uuid, conn) 1281 .await 1282 { 1283 err!("Cipher can't be restored by user") 1284 } 1285 cipher.deleted_at = None; 1286 cipher.save(conn).await?; 1287 Ok(Json( 1288 cipher 1289 .to_json(&headers.user.uuid, None, CipherSyncType::User, conn) 1290 .await, 1291 )) 1292 } 1293 1294 async fn _restore_multiple_ciphers( 1295 data: Json<CipherIdsData>, 1296 headers: &Headers, 1297 conn: &DbConn, 1298 ) -> JsonResult { 1299 let data = data.into_inner(); 1300 let mut ciphers: Vec<Value> = Vec::new(); 1301 for uuid in data.ids { 1302 match _restore_cipher_by_uuid(&uuid, headers, conn).await { 1303 Ok(json) => ciphers.push(json.into_inner()), 1304 err => return err, 1305 } 1306 } 1307 Ok(Json(json!({ 1308 "data": ciphers, 1309 "object": "list", 1310 "continuationToken": null 1311 }))) 1312 } 1313 /// This will hold all the necessary data to improve a full sync of all the ciphers 1314 /// It can be used during the `Cipher::to_json()` call. 1315 /// It will prevent the so called N+1 SQL issue by running just a few queries which will hold all the data needed. 1316 /// This will not improve the speed of a single cipher.to_json() call that much, so better not to use it for those calls. 1317 pub struct CipherSyncData { 1318 pub cipher_folders: HashMap<String, String>, 1319 pub cipher_favorites: HashSet<String>, 1320 pub cipher_collections: HashMap<String, Vec<String>>, 1321 pub user_organizations: HashMap<String, UserOrganization>, 1322 pub user_collections: HashMap<String, CollectionUser>, 1323 } 1324 1325 #[derive(Eq, PartialEq)] 1326 pub enum CipherSyncType { 1327 User, 1328 Organization, 1329 } 1330 1331 impl CipherSyncData { 1332 pub async fn new(user_uuid: &str, sync_type: CipherSyncType, conn: &DbConn) -> Self { 1333 let cipher_folders: HashMap<String, String>; 1334 let cipher_favorites: HashSet<String>; 1335 match sync_type { 1336 // User Sync supports Folders and Favorites 1337 CipherSyncType::User => { 1338 // Generate a HashMap with the Cipher UUID as key and the Folder UUID as value 1339 cipher_folders = FolderCipher::find_by_user(user_uuid, conn) 1340 .await 1341 .into_iter() 1342 .collect(); 1343 // Generate a HashSet of all the Cipher UUID's which are marked as favorite 1344 cipher_favorites = Favorite::get_all_cipher_uuid_by_user(user_uuid, conn) 1345 .await 1346 .into_iter() 1347 .collect(); 1348 } 1349 // Organization Sync does not support Folders and Favorites. 1350 // If these are set, it will cause issues in the web-vault. 1351 CipherSyncType::Organization => { 1352 cipher_folders = HashMap::with_capacity(0); 1353 cipher_favorites = HashSet::with_capacity(0); 1354 } 1355 } 1356 // Generate a HashMap with the Cipher UUID as key and one or more Collection UUID's 1357 let user_cipher_collections = 1358 Cipher::get_collections_with_cipher_by_user(user_uuid.to_owned(), conn).await; 1359 let mut cipher_collections: HashMap<String, Vec<String>> = 1360 HashMap::with_capacity(user_cipher_collections.len()); 1361 for (cipher, collection) in user_cipher_collections { 1362 cipher_collections 1363 .entry(cipher) 1364 .or_default() 1365 .push(collection); 1366 } 1367 // Generate a HashMap with the Organization UUID as key and the UserOrganization record 1368 let user_organizations: HashMap<String, UserOrganization> = 1369 UserOrganization::find_by_user(user_uuid, conn) 1370 .await 1371 .into_iter() 1372 .map(|uo| (uo.org_uuid.clone(), uo)) 1373 .collect(); 1374 // Generate a HashMap with the User_Collections UUID as key and the CollectionUser record 1375 let user_collections: HashMap<String, CollectionUser> = 1376 CollectionUser::find_by_user(user_uuid, conn) 1377 .await 1378 .into_iter() 1379 .map(|uc| (uc.collection_uuid.clone(), uc)) 1380 .collect(); 1381 Self { 1382 cipher_folders, 1383 cipher_favorites, 1384 cipher_collections, 1385 user_organizations, 1386 user_collections, 1387 } 1388 } 1389 }