Add partial role support for manager only using web-vault v2024.12.0

[BlackDex]

• Add the custom role which replaces the manager role
• Added mini-details endpoint used by v2024.12.0

These changes try to add the custom role in such a way that it stays compatible with the older manager role. It will convert a manager role into a custom role, and if a manager has access-all rights, it will enable the correct custom roles. Upon saving it will convert these back to the old format.

What this does is making sure you are able to revert back to an older version of Vaultwarden without issues. This way we can support newer web-vault's and still be compatible with a previous Vaultwarden version if needed.

In the future this needs to be changed to full role support though.

[BlackDex]

This PR needs a web-vault built from this PR dani-garcia/bw_web_builds#186
I'm have yet to fix the CSS, since it now still hides some elements which need to be visible.

But it would be nice if some people are able to test this PR using a web-vault built from the PR linked above.

[tessus]

In the future this needs to be changed to full role support though.

May I suggest to add more comments to the code, where your changes from this PR have to be reverted when full role support is implemented. Unless you you'll keep the compat layer even then.

It is quite possible to forget to remove/change current code/behavior when the "future" changes are not close to this PR. Please ignore, if I am way off.

[BlackDex]

@tessus done :)

@stefan0xC I have fixed the icon in the collapsed menu.

[BlackDex]

As mentioned before, this PR needs a new web-vault version for which a PR can be found here:

• Update to v2024.12 and Dynamic CSS bw_web_builds#186

CI builds of this web-vault can be downloaded here:

• https://github.com/dani-garcia/bw_web_builds/actions/runs/12017534352 in the artifacts section.

[tessus]

If this is the only PR required for the new web vault, is it possible to merge this and then release the new web vault - maybe this weekend?
I've been running it (and the web vault from the artifact link) for a few days now and didn't run into any issues. Although I am sure I haven't tested all edge cases and every single functionality.

[BlackDex]

I'd rather first fix a native client issue and release a version and after that merge this.

I also think it is better to first release the web-vault and then add that release to this PR.

[dfunkt]

Not sure if this belongs here or in the web vault PR, but I seem to be offered the option to log in with a passkey (which obviously doesn't work):

[BlackDex]

Not sure if this belongs here or in the web vault PR, but I seem to be offered the option to log in with a passkey (which obviously doesn't work):

Thanks! I fixed it just now.

[dfunkt]

Now that I think about it, shouldn't the create account line also be hidden? I have signups disabled.

[BlackDex]

Now that I think about it, shouldn't the create account line also be hidden? I have signups disabled.

Also fixed now :)

[BlackDex]

I'm checking to see if we can update to v2024.12.0. There seem to be some minor changes and some endpoints added.

[BlackDex]

Code is adjusted to support v2024.12.0 now. Not too much changed.

[tessus]

I'd rather first fix a native client issue and release a version and after that merge this.

The native client issue has been fixed and a new version has been released.

Is it possible to merge this now and release the new web-vault 2024.12.0 (or the other way around as you suggested)?

[larena1]

I'd rather first fix a native client issue and release a version and after that merge this.

The native client issue has been fixed and a new version has been released.

Is it possible to merge this now and release the new web-vault 2024.12.0 (or the other way around as you suggested)?

What's the matter with you and the new web vault version? Isn't the current one working for you?

If not then just try to build and run it yourself

[tessus]

If not then just try to build and run it yourself

I already do. If you had read my earlier comments, you would have known.

[larena1]

If not then just try to build and run it yourself

I already do. If you had read my earlier comments, you would have known.

I'm just trying to understand why you're so keen on this being merged for the second time already.

[stefan0xC]

@BlackDex the endpoint /api/organizations/<org_id>/groups/details seems to be missing, which appears to break my ability to edit users with web-v2024.12.0.

[BlackDex]

No it's not. It is there.
Let me check.

[BlackDex]

@stefan0xC seems to work for me:

[response][INFO] (get_groups_details) GET /api/organizations/<org_id>/groups/details => 200 OK

Be sure to pull in the latest commit and are on:

git rev-parse HEAD
b0920a621c01f255753f3a878c0851d2addc861e

[stefan0xC]

Ah, you're right. It's there. I just confused the error message:

[stefan0xC]

@BlackDex if the group has accessAll it works

{
  "accessAll": true,
  "collections": [],
  "externalId": null,
  "id": "41917ddc-7cf7-47d0-bd7f-7b24d21c2b71",
  "name": "manager group",
  "object": "groupDetails",
  "organizationId": "152bd996-19f9-40ee-b991-e52333a7e719"
}

but it fails when the group has permissions for individual collections:

{
  "accessAll": false,
  "collections": [
    {
      "hidePasswords": true,
      "id": "f39e653f-3191-4312-887d-931889be5d20",
      "manage": false,
      "readOnly": false
    },
    {
      "hidePasswords": true,
      "id": "ca4b77ab-c849-47f4-a6f3-c4ebde35d5f0",
      "manage": false,
      "readOnly": true
    }
  ],
  "externalId": null,
  "id": "41917ddc-7cf7-47d0-bd7f-7b24d21c2b71",
  "name": "manager group",
  "object": "groupDetails",
  "organizationId": "152bd996-19f9-40ee-b991-e52333a7e719"
}

[BlackDex]

@stefan0xC What happens then exactly?
It doesn't work? And is it mixed with with an accessAll?

[stefan0xC]

@stefan0xC What happens then exactly? It doesn't work? And is it mixed with with an accessAll?

The exception happened when I tried to open the Custom user member (which used to be a Manager role without accessAll) or the group. But now after changing the group I can't seem to be able to replicate the issue anymore, even if I change the permissions back.

edit: I'm unable to reproduce the issue. It might have been caused by using an in-between version of the web-vault...