Crate bitwarden_pam

Expand description

§Bitwarden PAM

Commercial crate implementing Privileged Access Management (PAM) functionality against the Bitwarden server.

PAM lets organizations put privileged Bitwarden collections behind explicit, auditable access requirements. Rather than a member holding standing access to a sensitive credential, access is gated by an access rule and granted for a bounded period (a lease).

§Access rules

An access rule governs privileged access to a set of collections. Each rule bundles together:

Conditions that must be satisfied before access is granted - for example requiring human approval, or restricting access to an allow-list of CIDR ranges.
Lease parameters controlling access once granted: a default and maximum lease duration, whether a lease may be extended (and for how long), and whether a cipher may have at most one active lease at a time.
The collections the rule governs.

The AccessRulesClient, reached via the PamClient, provides CRUD operations over these rules:

use bitwarden_pam::{AccessCondition, AccessRuleAddEditRequest, PamClientExt};

// `client` is a bitwarden_core::Client that has been authenticated.
let access_rules = client.pam().access_rules();

let created = access_rules
    .create(
        organization_id,
        AccessRuleAddEditRequest {
            name: "Production database".to_string(),
            description: Some("Requires approval and an internal IP".to_string()),
            enabled: true,
            conditions: vec![
                AccessCondition::HumanApproval,
                AccessCondition::IpAllowlist {
                    cidrs: vec!["10.0.0.0/8".to_string()],
                },
            ],
            single_active_lease: true,
            default_lease_duration_seconds: Some(3600),
            max_lease_duration_seconds: Some(28_800),
            allows_extensions: true,
            max_extension_duration_seconds: Some(3600),
            collections: vec![collection_id],
        },
    )
    .await?;

let all_rules = access_rules.list(organization_id).await?;

Requests are validated locally before being sent, so malformed input fails fast with a typed AccessRuleValidationError instead of a server round trip.

Modules§

access_requests 🔒: PAM access request operations.
access_rules 🔒: PAM access rule CRUD operations.
error 🔒
leases 🔒: PAM access lease operations.
pam_client 🔒

Structs§

AccessApprover: The identity of a human approver, denormalized by the server.
AccessLeaseExtensionRequest: Request to extend an active lease.
AccessLeaseId: NewType wrapper for AccessLeaseId
AccessLeaseRevokeRequest: Request to revoke (end) a lease before it expires.
AccessLeaseView: A decrypted view of an access lease, as its requester sees it.
AccessPreCheckView: The resolved approval outcome for a cipher, read without submitting a request.
AccessRequestCreateRequest: Request to lease a cipher.
AccessRequestDecisionView: A single decision recorded on an access request’s decision log.
AccessRequestId: NewType wrapper for AccessRequestId
AccessRequestResultView: The result of submitting a cipher-lease request.
AccessRequestSummaryView: A decrypted view of an access request as its requester sees it right after submitting it.
AccessRequestView: A decrypted view of an access request, as its requester sees it.
AccessRequestsClient: Client for a requester’s PAM access requests.
AccessRuleAddEditRequest: Request to create or edit an access rule.
AccessRuleId: NewType wrapper for AccessRuleId
AccessRuleView: A decrypted view of an access rule, as returned by the server.
AccessRulesClient: Client for PAM access rule CRUD operations.
CipherAccessStateView: A single-snapshot read of the caller’s access state for one cipher, powering the cipher-view banner and the vault-row badge.
LeasesClient: Client for reading and managing a requester’s PAM access leases.
PamClient: Entry point for Privileged Access Management (PAM) operations.

Enums§

AccessApprovalMode: The approval path a lease request will take, surfaced by pre_check so the client can present the right workflow before the requester commits.
AccessCondition: A single condition that gates access under an access rule.
AccessDecider: Who made a decision on an access request.
AccessDecisionVerdict: An approver’s verdict on an access request decision.
AccessLeaseStatus: The lifecycle state of an access lease.
AccessRequestStatus: The lifecycle state of an access request.
AccessRuleError: Errors returned from super::AccessRulesClient operations.
AccessRuleValidationError: Errors returned when a locally-constructed AccessRuleAddEditRequest fails validation before being sent to the server.
LeasingError: Errors returned from the PAM leasing clients (AccessRequestsClient and LeasesClient).

Traits§

PamClientExt: Extension trait that exposes PamClient on Client.

Functions§

is_valid_cidr: Returns true when value is a CIDR range in canonical form: address/prefix where the address parses strictly (RFC dotted-quad IPv4 / RFC 4291 IPv6, no leading-zero octets, hex octets, partial addresses, or zone IDs), the prefix is a plain decimal integer in range, and no host bits are set (e.g. 10.0.0.0/8 is valid, 10.0.0.1/8 is not).