Crate bitwarden_pam 

Bitwarden PAM

Commercial crate implementing Privileged Access Management (PAM) functionality against the Bitwarden server.

PAM lets organizations put privileged Bitwarden collections behind explicit, auditable access requirements. Rather than a member holding standing access to a sensitive credential, access is gated by an access rule and granted for a bounded period (a lease).

Access rules

An access rule governs privileged access to a set of collections. Each rule bundles together:

• Conditions that must be satisfied before access is granted - for example requiring human approval, or restricting access to an allow-list of CIDR ranges.
• Lease parameters controlling access once granted: a default and maximum lease duration, whether a lease may be extended (and for how long), and whether a cipher may have at most one active lease at a time.
• The collections the rule governs.

The AccessRulesClient, reached via the PamClient, provides CRUD operations over these rules:

use bitwarden_pam::{AccessCondition, AccessRuleAddEditRequest, PamClientExt};

// `client` is a bitwarden_core::Client that has been authenticated.
let access_rules = client.pam().access_rules();

let created = access_rules
    .create(
        organization_id,
        AccessRuleAddEditRequest {
            name: "Production database".to_string(),
            description: Some("Requires approval and an internal IP".to_string()),
            enabled: true,
            conditions: vec![
                AccessCondition::HumanApproval,
                AccessCondition::IpAllowlist {
                    cidrs: vec!["10.0.0.0/8".to_string()],
                },
            ],
            single_active_lease: true,
            default_lease_duration_seconds: Some(3600),
            max_lease_duration_seconds: Some(28_800),
            allows_extensions: true,
            max_extension_duration_seconds: Some(3600),
            collections: vec![collection_id],
        },
    )
    .await?;

let all_rules = access_rules.list(organization_id).await?;

Requests are validated locally before being sent, so malformed input fails fast with a typed AccessRuleValidationError instead of a server round trip.

Modules

access_rules 🔒

PAM access rule CRUD operations.

pam_client 🔒

Structs

AccessRuleAddEditRequest

Request to create or edit an access rule.

AccessRuleId

NewType wrapper for AccessRuleId

AccessRuleView

A decrypted view of an access rule, as returned by the server.

AccessRulesClient

Client for PAM access rule CRUD operations.

PamClient

Entry point for Privileged Access Management (PAM) operations.

Enums

AccessCondition

A single condition that gates access under an access rule.

AccessRuleError

Errors returned from super::AccessRulesClient operations.

AccessRuleValidationError

Errors returned when a locally-constructed AccessRuleAddEditRequest fails validation before being sent to the server.

Traits

PamClientExt

Extension trait that exposes PamClient on Client.

Functions

is_valid_cidr

Returns true when value is a CIDR range in canonical form: address/prefix where the address parses strictly (RFC dotted-quad IPv4 / RFC 4291 IPv6, no leading-zero octets, hex octets, partial addresses, or zone IDs), the prefix is a plain decimal integer in range, and no host bits are set (e.g. 10.0.0.0/8 is valid, 10.0.0.1/8 is not).