Crate bitwarden_pam

Expand description

§Bitwarden PAM

Commercial crate implementing Privileged Access Management (PAM) functionality against the Bitwarden server.

PAM lets organizations put privileged Bitwarden collections behind explicit, auditable access requirements. Rather than a member holding standing access to a sensitive credential, access is gated by an access rule and granted for a bounded period (a lease).

§Access rules

An access rule governs privileged access to a set of collections. Each rule bundles together:

Conditions that must be satisfied before access is granted - for example requiring human approval, or restricting access to an allow-list of CIDR ranges.
Lease parameters controlling access once granted: a default and maximum lease duration, whether a lease may be extended (and for how long), and whether a cipher may have at most one active lease at a time.
The collections the rule governs.

The AccessRulesClient, reached via the PamClient, provides CRUD operations over these rules:

use bitwarden_pam::{AccessCondition, AccessRuleAddEditRequest, PamClientExt};

// `client` is a bitwarden_core::Client that has been authenticated.
let access_rules = client.pam().access_rules();

let created = access_rules
    .create(
        organization_id,
        AccessRuleAddEditRequest {
            name: "Production database".to_string(),
            description: Some("Requires approval and an internal IP".to_string()),
            enabled: true,
            conditions: vec![
                AccessCondition::HumanApproval,
                AccessCondition::IpAllowlist {
                    cidrs: vec!["10.0.0.0/8".to_string()],
                },
            ],
            single_active_lease: true,
            default_lease_duration_seconds: Some(3600),
            max_lease_duration_seconds: Some(28_800),
            allows_extensions: true,
            max_extension_duration_seconds: Some(3600),
            collections: vec![collection_id],
        },
    )
    .await?;

let all_rules = access_rules.list(organization_id).await?;

Requests are validated locally before being sent, so malformed input fails fast with a typed AccessRuleValidationError instead of a server round trip.

Modules§

access_requests 🔒: PAM access request operations.
access_rules 🔒: PAM access rule CRUD operations.
approvals 🔒: PAM approver operations.
error 🔒
leases 🔒: PAM access lease operations.
pam_client 🔒
rotation 🔒: PAM credential rotation operations.

Structs§

AccessApprover: The identity of a human approver, denormalized by the server.
AccessConnector: An access connector: the unattended agent that performs credential rotations for an organization.
AccessConnectorDetail: A connector together with its recent rotation activity.
AccessConnectorId: NewType wrapper for AccessConnectorId
AccessConnectorRegistrationResponse: The result of registering a connector, including its one-time token.
AccessConnectorsClient: Client for PAM access connector operations.
AccessDecisionRequest: An approver’s decision on a pending access request.
AccessLeaseExtensionRequest: Request to extend an active lease.
AccessLeaseId: NewType wrapper for AccessLeaseId
AccessLeaseRevokeRequest: Request to revoke (end) a lease before it expires.
AccessLeaseView: An access lease, as its requester sees it.
AccessPreCheckView: The resolved approval outcome for a cipher, read without submitting a request.
AccessRequestCreateRequest: Request to lease a cipher.
AccessRequestDecisionView: A single decision recorded on an access request’s decision log.
AccessRequestId: NewType wrapper for AccessRequestId
AccessRequestResultView: The result of submitting a cipher-lease request.
AccessRequestSummaryView: A just-submitted access request, as its requester sees it; a lighter sibling of AccessRequestView.
AccessRequestView: An access request, as returned by the server.
AccessRequestsClient: Client for a requester’s PAM access requests.
AccessRuleAddEditRequest: Request to create or edit an access rule.
AccessRuleId: NewType wrapper for AccessRuleId
AccessRuleView: An access rule, as returned by the server.
AccessRulesClient: Client for PAM access rule CRUD operations.
ApprovalsClient: Client for a PAM approver’s queue. The requester side is AccessRequestsClient.
CipherAccessStateView: A single-snapshot read of the caller’s access state for one cipher, powering the cipher-view banner and the vault-row badge.
LeasesClient: Client for reading and managing a requester’s PAM access leases. Leases are minted by AccessRequestsClient::activate.
PamClient: Entry point for Privileged Access Management (PAM) operations.
PasswordPolicy: Password generation policy for a target system. For Manual systems it is guidance for the operator that nothing enforces. Lives only in the sealed blob.
RotationAttempt: One connector’s execution of the rotation sequence for a job.
RotationAttemptId: NewType wrapper for RotationAttemptId
RotationClient: Entry point for PAM credential rotation.
RotationConfigActions: The actions a rotation config offers right now, derived together so no pair contradicts.
RotationConfigCreateRequest: Request to create or update a rotation config.
RotationConfigDetailView: A config together with its rotation history.
RotationConfigId: NewType wrapper for RotationConfigId
RotationConfigSealedFields: Security-relevant fields of a rotation config; the server only stores them sealed.
RotationConfigView: A managed credential: the link between a vault cipher and the target system its credential is rotated against, with its sealed fields unsealed.
RotationConfigsClient: Client for PAM managed-credential (rotation config) operations.
RotationJob: One dispatch of the rotation workflow for a config. Each claim records an attempt, so a retried or released job carries several.
RotationJobId: NewType wrapper for RotationJobId
RotationScheduleClient: The WASM-facing surface for the schedule helpers.
TargetSystemCreateError: Failure from TargetSystemsClient::create.
TargetSystemId: NewType wrapper for TargetSystemId
TargetSystemSealedFields: Security-relevant fields of a target system; the server only stores them sealed.
TargetSystemView: A target system a credential can be rotated against, with its sealed fields unsealed.
TargetSystemsClient: Client for PAM rotation target-system operations.
VerifiedJob: A claim cross-checked by WorkSnapshot::verify; private fields keep it constructible only there.
WorkSnapshot: The work snapshot returned by a successful claim; WorkSnapshot::verify checks it before any field is trusted.

Enums§

AccessApprovalMode: The approval path an access request takes.
AccessBadgeState: The single badge to show for a gated cipher: an active lease outranks an approved request, which outranks a pending one. Has no unavailable or expired state, since the access-state response covers only the caller.
AccessCondition: A single condition that gates access under an access rule.
AccessConnectorStatus: Lifecycle state of an access connector. Removing a connector for good is a delete, not a status.
AccessDecider: Who made a decision on an access request.
AccessDecisionVerdict: An approver’s verdict on an access request decision.
AccessLeaseError: Errors returned from super::LeasesClient operations.
AccessLeaseStatus: The lifecycle state of an access lease.
AccessLeaseTermination: How an access lease’s grant ended before its window closed.
AccessRequestError: Errors returned from super::AccessRequestsClient operations.
AccessRequestStatus: The lifecycle state of an access request.
AccessRequestWindowError: Errors from validating an AccessRequestCreateRequest before it is sent to the server.
AccessRuleError: Errors returned from super::AccessRulesClient operations.
AccessRuleValidationError: Errors from validating an AccessRuleAddEditRequest before it is sent to the server.
ApprovalError: Errors returned from super::ApprovalsClient operations.
PamDecodeError: Errors from decoding a PAM server response into a domain view.
QuartzSchedulePreset: A named rotation schedule, for presentation only; the server stores only the cron string.
RotationAttemptStatus: Per-attempt outcome within a rotation job.
RotationError: Errors returned from the PAM rotation clients.
RotationFailureCode: Why a rotation attempt failed, as the connector reports it. On the wire it is a snake_case token, which the server stores as the start of RotationAttempt::failure_reason.
RotationJobStatus: Overall status of a rotation job.
RotationSource: What triggered a rotation job.
RotationSyncState: Whether a failed rotation attempt left the target system’s credential changed.
RotationValidationError: Errors from validating a rotation request before it is sent to the server.
SealRejection: Why WorkSnapshot::verify refused a claim. Carries no claim or blob values, only which check failed.
SessionTerminationOutcome: Whether the connector terminated the account’s active sessions after rotating.
TargetSystemCreateRequest: Request to create or update a target system. Method and kind can’t change after creation, but TargetSystemsClient::update still takes the full shape.
TargetSystemKind: The technology a target system represents. Only meaningful for Automatic systems; a manual rotation has no integration. Lives only in the sealed blob.
TargetSystemMethod: How a target system’s credential is rotated.
TargetSystemStatus: Lifecycle state of a target system.
WorkSnapshotError: Errors from parsing a claim response. They never include payload content.

Constants§

DEFAULT_REQUEST_ACCESS_DURATION_SECONDS: Duration, in seconds, to pre-select when the pre-check response names no default; mirrors the server’s global default.
MAX_REQUEST_ACCESS_WINDOW_SECONDS: Maximum span, in seconds, of an access request’s activation window - mirrors the server’s LeaseDurationBounds.GlobalMaxSeconds (one year). Applies to both the automatic path’s duration_seconds and the human path’s start/end span.

Traits§

PamClientExt: Extension trait that exposes PamClient on [Client].

Functions§

default_request_access_duration_seconds: DEFAULT_REQUEST_ACCESS_DURATION_SECONDS, for callers that cannot read a Rust const.
is_likely_quartz_cron: Reports whether a string is shaped like a Quartz cron expression. Checks only field count and character set; the server is authoritative.
is_valid_cidr: Returns true for a canonical CIDR range such as 10.0.0.0/8, with no host bits set. Ambiguous forms (leading-zero or hex octets, IPv4-mapped IPv6) are rejected so client and server agree on which network a rule matches.
max_request_access_window_seconds: MAX_REQUEST_ACCESS_WINDOW_SECONDS, for callers that cannot read a Rust const.
preset_for_cron: Derives the preset that best describes a stored cron expression. Absent or blank is QuartzSchedulePreset::None, an exact match (ignoring surrounding whitespace) is that preset, and anything else is Custom.
rotation_config_actions: Derives the actions a config offers, given the status of its target system. Pass None while the target system has not loaded; every dependent predicate then fails closed.