bitwarden_organizations/lib.rs
1#![doc = include_str!("../README.md")]
2
3#[cfg(feature = "uniffi")]
4uniffi::setup_scaffolding!();
5#[cfg(feature = "uniffi")]
6mod uniffi_support;
7
8use chrono::{DateTime, Utc};
9use serde::{Deserialize, Serialize};
10use serde_repr::{Deserialize_repr, Serialize_repr};
11#[cfg(feature = "wasm")]
12use tsify::Tsify;
13use uuid::Uuid;
14#[cfg(feature = "wasm")]
15use wasm_bindgen::prelude::wasm_bindgen;
16
17/// The membership status of a user within an organization.
18#[derive(PartialEq, Serialize_repr, Deserialize_repr, Debug, Clone)]
19#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
20#[cfg_attr(feature = "wasm", wasm_bindgen)]
21#[repr(i8)]
22pub enum OrganizationUserStatusType {
23 /// The user's access has been revoked. This may occur at any time from any other status.
24 Revoked = -1,
25 /// The user has been invited but has not yet accepted.
26 Invited = 0,
27 /// The user has accepted the invitation but has not yet been confirmed by an admin.
28 Accepted = 1,
29 /// The user has been confirmed by an admin and has full access.
30 Confirmed = 2,
31}
32
33/// The role of a user within an organization.
34#[derive(PartialEq, Serialize_repr, Deserialize_repr, Debug, Clone)]
35#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
36#[cfg_attr(feature = "wasm", wasm_bindgen)]
37#[repr(u8)]
38pub enum OrganizationUserType {
39 /// Full administrative control over the organization.
40 Owner = 0,
41 /// Administrative access with most management capabilities.
42 Admin = 1,
43 /// Standard organization member.
44 User = 2,
45 // 3 was Manager, which has been permanently deleted
46 /// User with a customized set of permissions as indicated by
47 /// [`ProfileOrganization::permissions`].
48 Custom = 4,
49}
50
51/// The type of provider.
52#[derive(Serialize_repr, Deserialize_repr, Debug, Clone)]
53#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
54#[cfg_attr(feature = "wasm", wasm_bindgen)]
55#[repr(u8)]
56pub enum ProviderType {
57 /// Managed Service Provider - sells and manages its clients' Bitwarden organizations.
58 Msp = 0,
59 /// Reseller partner - sells Bitwarden to its clients but does not have any administrative
60 /// access.
61 Reseller = 1,
62 /// Business unit provider - used to manage multiple organizations which form part of a single
63 /// large enterprise.
64 BusinessUnit = 2,
65}
66
67/// The method used to decrypt organization member data.
68#[derive(Serialize_repr, Deserialize_repr, Debug, Clone)]
69#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
70#[cfg_attr(feature = "wasm", wasm_bindgen)]
71#[repr(u8)]
72pub enum MemberDecryptionType {
73 /// Decryption using the user's master password.
74 MasterPassword = 0,
75 /// Decryption via Key Connector.
76 KeyConnector = 1,
77 /// Decryption via Trusted Device Encryption.
78 TrustedDeviceEncryption = 2,
79}
80
81/// The subscription tier of an organization.
82#[derive(Serialize_repr, Deserialize_repr, Debug, Clone)]
83#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
84#[cfg_attr(feature = "wasm", wasm_bindgen)]
85#[repr(u8)]
86pub enum ProductTierType {
87 /// Free tier with limited features.
88 Free = 0,
89 /// Families plan for personal use.
90 Families = 1,
91 /// Teams plan for small organizations.
92 Teams = 2,
93 /// Enterprise plan with full features.
94 Enterprise = 3,
95 /// Starter tier for small teams.
96 TeamsStarter = 4,
97}
98
99/// Custom administrative permissions for an organization member with the
100/// [`OrganizationUserType::Custom`] role.
101#[derive(Default, Serialize, Deserialize, Debug, Clone)]
102#[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
103#[cfg_attr(feature = "wasm", derive(Tsify), tsify(into_wasm_abi, from_wasm_abi))]
104#[serde(rename_all = "camelCase", default)]
105pub struct Permissions {
106 /// Can view the organization's event logs.
107 pub access_event_logs: bool,
108 /// Can import and export organization vault data.
109 pub access_import_export: bool,
110 /// Can access organization reports.
111 pub access_reports: bool,
112 /// Can create new collections.
113 pub create_new_collections: bool,
114 /// Can edit any collection, including those they are not assigned to.
115 pub edit_any_collection: bool,
116 /// Can delete any collection, including those they are not assigned to.
117 pub delete_any_collection: bool,
118 /// Can manage groups within the organization.
119 pub manage_groups: bool,
120 /// Can manage SSO configuration.
121 pub manage_sso: bool,
122 /// Can manage organization policies.
123 pub manage_policies: bool,
124 /// Can manage organization members.
125 pub manage_users: bool,
126 /// Can manage the account recovery (password reset) feature.
127 pub manage_reset_password: bool,
128 /// Can manage SCIM (System for Cross-domain Identity Management) configuration.
129 pub manage_scim: bool,
130}
131
132/// Organization membership details from the user's profile sync.
133///
134/// Contains the full set of entitlements, plan features, and metadata for a single
135/// organization that the current user belongs to.
136#[derive(Serialize, Deserialize, Debug, Clone)]
137#[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
138#[cfg_attr(feature = "wasm", derive(Tsify), tsify(into_wasm_abi, from_wasm_abi))]
139#[serde(rename_all = "camelCase")]
140pub struct ProfileOrganization {
141 /// Unique identifier for the organization.
142 pub id: Uuid,
143 /// Display name of the organization.
144 pub name: String,
145 /// The user's membership status in the organization.
146 pub status: OrganizationUserStatusType,
147 /// The user's role in the organization.
148 pub r#type: OrganizationUserType,
149 /// Whether the organization is currently enabled.
150 pub enabled: bool,
151 /// Whether the organization has access to policies features.
152 pub use_policies: bool,
153 /// Whether the organization has access to groups features.
154 pub use_groups: bool,
155 /// Whether the organization has access to directory sync features.
156 pub use_directory: bool,
157 /// Whether the organization has access to event logging features.
158 pub use_events: bool,
159 /// Whether the organization can enforce TOTP for members.
160 pub use_totp: bool,
161 /// Whether the organization has access to two-factor authentication features.
162 pub use_2fa: bool,
163 /// Whether the organization has access to the Bitwarden Public API.
164 pub use_api: bool,
165 /// Whether the organization has access to SSO features.
166 pub use_sso: bool,
167 /// Whether the organization can manage verified domains.
168 pub use_organization_domains: bool,
169 /// Whether the organization uses Key Connector for decryption.
170 pub use_key_connector: bool,
171 /// Whether the organization has access to SCIM provisioning.
172 pub use_scim: bool,
173 /// Whether the organization can use the [`OrganizationUserType::Custom`] role.
174 pub use_custom_permissions: bool,
175 /// Whether the organization has access to the account recovery (admin password reset) feature.
176 pub use_reset_password: bool,
177 /// Whether the organization has access to Secrets Manager.
178 pub use_secrets_manager: bool,
179 /// Whether the organization has access to Password Manager.
180 pub use_password_manager: bool,
181 /// Whether the organization can use the activate autofill policy.
182 pub use_activate_autofill_policy: bool,
183 /// Whether the organization can automatically confirm new members without manual admin
184 /// approval.
185 pub use_automatic_user_confirmation: bool,
186 /// Whether the organization can create a license file for a self-hosted instance.
187 pub self_host: bool,
188 /// Whether organization members receive premium features.
189 pub users_get_premium: bool,
190 /// The number of licensed seats for the organization.
191 pub seats: Option<u32>,
192 /// The maximum number of collections the organization can create.
193 pub max_collections: Option<u32>,
194 /// The maximum encrypted storage in gigabytes, if limited.
195 pub max_storage_gb: Option<u32>,
196 /// Whether the current user's account is bound to this organization via SSO.
197 pub sso_bound: bool,
198 /// The organization's SSO identifier.
199 pub identifier: Option<String>,
200 /// The current user's custom permissions, relevant when [`OrganizationUserType::Custom`] is
201 /// the user's `type`.
202 pub permissions: Permissions,
203 /// Whether the current user is enrolled in account recovery for this organization.
204 pub reset_password_enrolled: bool,
205 /// The current user's personal user ID.
206 pub user_id: Option<Uuid>,
207 /// The current user's organization membership ID.
208 pub organization_user_id: Option<Uuid>,
209 /// Whether the organization has both a public and private key configured.
210 pub has_public_and_private_keys: bool,
211 /// The ID of the provider managing this organization, if any.
212 pub provider_id: Option<Uuid>,
213 /// The name of the provider managing this organization, if any.
214 pub provider_name: Option<String>,
215 /// The type of provider managing this organization, if any.
216 pub provider_type: Option<ProviderType>,
217 /// Whether the current user accesses this organization through a provider.
218 pub is_provider_user: bool,
219 /// Whether the current user is a direct member of this organization (as opposed to
220 /// provider-only access).
221 pub is_member: bool,
222 /// The friendly name of a pending families sponsorship, if any.
223 pub family_sponsorship_friendly_name: Option<String>,
224 /// Whether the organization can sponsor a families plan for the current user.
225 pub family_sponsorship_available: bool,
226 /// The subscription tier of the organization.
227 pub product_tier_type: ProductTierType,
228 /// Whether Key Connector is enabled for this organization.
229 pub key_connector_enabled: bool,
230 /// The URL of the Key Connector service, if enabled.
231 pub key_connector_url: Option<String>,
232 /// The date the families sponsorship was last synced, if applicable.
233 pub family_sponsorship_last_sync_date: Option<DateTime<Utc>>,
234 /// The date the families sponsorship expires, if applicable.
235 pub family_sponsorship_valid_until: Option<DateTime<Utc>>,
236 /// Whether the families sponsorship is scheduled for deletion.
237 pub family_sponsorship_to_delete: Option<bool>,
238 /// Whether the current user has access to Secrets Manager for this organization.
239 pub access_secrets_manager: bool,
240 /// Whether collection creation is restricted to owners and admins only.
241 ///
242 /// When `false`, any member can create collections and automatically receives manage
243 /// permissions over collections they create.
244 pub limit_collection_creation: bool,
245 /// Whether collection deletion is restricted to owners and admins only.
246 ///
247 /// When `true`, regular users cannot delete collections that they manage.
248 pub limit_collection_deletion: bool,
249 /// Whether item deletion is restricted to members with the Manage collection permission.
250 ///
251 /// When `false`, members with Edit permission can also delete items within their collections.
252 pub limit_item_deletion: bool,
253 /// Whether owners and admins have implicit manage permissions over all collections.
254 ///
255 /// When `true`, owners and admins can alter items, groups, and permissions across all
256 /// collections without requiring explicit collection assignments.
257 /// When `false`, admins can only access collections where they have been explicitly assigned.
258 pub allow_admin_access_to_all_collection_items: bool,
259 /// Whether the current user's account is managed by this organization.
260 pub user_is_managed_by_organization: bool,
261 /// Whether the organization has access to Access Intelligence features.
262 pub use_access_intelligence: bool,
263 /// Whether the organization can sponsor families plans for members (Families For Enterprises).
264 pub use_admin_sponsored_families: bool,
265 /// Whether Secrets Manager ads are disabled for users.
266 #[serde(rename = "useDisableSMAdsForUsers")]
267 pub use_disable_sm_ads_for_users: bool,
268 /// Whether the organization's Families For Enterprises sponsorship was initiated by an admin.
269 pub is_admin_initiated: bool,
270 /// Whether SSO login is currently enabled for this organization.
271 pub sso_enabled: bool,
272 /// The decryption type used for SSO members, if SSO is enabled.
273 pub sso_member_decryption_type: Option<MemberDecryptionType>,
274 /// Whether the organization has access to phishing blocker features.
275 pub use_phishing_blocker: bool,
276 /// Whether the organization has access to the My Items collection feature.
277 /// This allows users to store personal items in the organization vault
278 /// if the Centralize Organization Ownership policy is enabled.
279 pub use_my_items: bool,
280}
281
282impl Default for ProfileOrganization {
283 fn default() -> Self {
284 ProfileOrganization {
285 id: Uuid::nil(),
286 name: String::new(),
287 status: OrganizationUserStatusType::Confirmed,
288 r#type: OrganizationUserType::User,
289 enabled: true,
290 use_policies: false,
291 use_groups: false,
292 use_directory: false,
293 use_events: false,
294 use_totp: false,
295 use_2fa: false,
296 use_api: false,
297 use_sso: false,
298 use_organization_domains: false,
299 use_key_connector: false,
300 use_scim: false,
301 use_custom_permissions: false,
302 use_reset_password: false,
303 use_secrets_manager: false,
304 use_password_manager: false,
305 use_activate_autofill_policy: false,
306 use_automatic_user_confirmation: false,
307 self_host: false,
308 users_get_premium: false,
309 seats: Some(10),
310 max_collections: None,
311 max_storage_gb: None,
312 sso_bound: false,
313 identifier: None,
314 permissions: Permissions::default(),
315 reset_password_enrolled: false,
316 user_id: None,
317 organization_user_id: None,
318 has_public_and_private_keys: false,
319 provider_id: None,
320 provider_name: None,
321 provider_type: None,
322 is_provider_user: false,
323 is_member: true,
324 family_sponsorship_friendly_name: None,
325 family_sponsorship_available: false,
326 product_tier_type: ProductTierType::Free,
327 key_connector_enabled: false,
328 key_connector_url: None,
329 family_sponsorship_last_sync_date: None,
330 family_sponsorship_valid_until: None,
331 family_sponsorship_to_delete: None,
332 access_secrets_manager: false,
333 limit_collection_creation: false,
334 limit_collection_deletion: false,
335 limit_item_deletion: false,
336 allow_admin_access_to_all_collection_items: false,
337 user_is_managed_by_organization: false,
338 use_access_intelligence: false,
339 use_admin_sponsored_families: false,
340 use_disable_sm_ads_for_users: false,
341 is_admin_initiated: false,
342 sso_enabled: false,
343 sso_member_decryption_type: None,
344 use_phishing_blocker: false,
345 use_my_items: false,
346 }
347 }
348}