bitwarden_organizations/lib.rs
1#![doc = include_str!("../README.md")]
2
3#[cfg(feature = "uniffi")]
4uniffi::setup_scaffolding!();
5#[cfg(feature = "uniffi")]
6mod uniffi_support;
7
8use chrono::{DateTime, Utc};
9use serde::{Deserialize, Serialize};
10use serde_repr::{Deserialize_repr, Serialize_repr};
11#[cfg(feature = "wasm")]
12use tsify::Tsify;
13use uuid::Uuid;
14#[cfg(feature = "wasm")]
15use wasm_bindgen::prelude::wasm_bindgen;
16
17/// The membership status of a user within an organization.
18#[derive(PartialEq, Serialize_repr, Deserialize_repr, Debug, Clone)]
19#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
20#[cfg_attr(feature = "wasm", wasm_bindgen)]
21#[repr(i8)]
22pub enum OrganizationUserStatusType {
23 /// The user's access has been revoked. This may occur at any time from any other status.
24 Revoked = -1,
25 /// The user has been invited but has not yet accepted.
26 Invited = 0,
27 /// The user has accepted the invitation but has not yet been confirmed by an admin.
28 Accepted = 1,
29 /// The user has been confirmed by an admin and has full access.
30 Confirmed = 2,
31 /// The user has been staged for provisioning but has not yet been invited.
32 Staged = 3,
33}
34
35/// The role of a user within an organization.
36#[derive(PartialEq, Serialize_repr, Deserialize_repr, Debug, Clone)]
37#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
38#[cfg_attr(feature = "wasm", wasm_bindgen)]
39#[repr(u8)]
40pub enum OrganizationUserType {
41 /// Full administrative control over the organization.
42 Owner = 0,
43 /// Administrative access with most management capabilities.
44 Admin = 1,
45 /// Standard organization member.
46 User = 2,
47 // 3 was Manager, which has been permanently deleted
48 /// User with a customized set of permissions as indicated by
49 /// [`ProfileOrganization::permissions`].
50 Custom = 4,
51}
52
53/// The type of provider.
54#[derive(Serialize_repr, Deserialize_repr, Debug, Clone)]
55#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
56#[cfg_attr(feature = "wasm", wasm_bindgen)]
57#[repr(u8)]
58pub enum ProviderType {
59 /// Managed Service Provider - sells and manages its clients' Bitwarden organizations.
60 Msp = 0,
61 /// Reseller partner - sells Bitwarden to its clients but does not have any administrative
62 /// access.
63 Reseller = 1,
64 /// Business unit provider - used to manage multiple organizations which form part of a single
65 /// large enterprise.
66 BusinessUnit = 2,
67}
68
69/// The method used to decrypt organization member data.
70#[derive(Serialize_repr, Deserialize_repr, Debug, Clone)]
71#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
72#[cfg_attr(feature = "wasm", wasm_bindgen)]
73#[repr(u8)]
74pub enum MemberDecryptionType {
75 /// Decryption using the user's master password.
76 MasterPassword = 0,
77 /// Decryption via Key Connector.
78 KeyConnector = 1,
79 /// Decryption via Trusted Device Encryption.
80 TrustedDeviceEncryption = 2,
81}
82
83/// The subscription tier of an organization.
84#[derive(Serialize_repr, Deserialize_repr, Debug, Clone)]
85#[cfg_attr(feature = "uniffi", derive(uniffi::Enum))]
86#[cfg_attr(feature = "wasm", wasm_bindgen)]
87#[repr(u8)]
88pub enum ProductTierType {
89 /// Free tier with limited features.
90 Free = 0,
91 /// Families plan for personal use.
92 Families = 1,
93 /// Teams plan for small organizations.
94 Teams = 2,
95 /// Enterprise plan with full features.
96 Enterprise = 3,
97 /// Starter tier for small teams.
98 TeamsStarter = 4,
99}
100
101/// Custom administrative permissions for an organization member with the
102/// [`OrganizationUserType::Custom`] role.
103#[derive(Default, Serialize, Deserialize, Debug, Clone)]
104#[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
105#[cfg_attr(feature = "wasm", derive(Tsify), tsify(into_wasm_abi, from_wasm_abi))]
106#[serde(rename_all = "camelCase", default)]
107pub struct Permissions {
108 /// Can view the organization's event logs.
109 pub access_event_logs: bool,
110 /// Can import and export organization vault data.
111 pub access_import_export: bool,
112 /// Can access organization reports.
113 pub access_reports: bool,
114 /// Can create new collections.
115 pub create_new_collections: bool,
116 /// Can edit any collection, including those they are not assigned to.
117 pub edit_any_collection: bool,
118 /// Can delete any collection, including those they are not assigned to.
119 pub delete_any_collection: bool,
120 /// Can manage groups within the organization.
121 pub manage_groups: bool,
122 /// Can manage SSO configuration.
123 pub manage_sso: bool,
124 /// Can manage organization policies.
125 pub manage_policies: bool,
126 /// Can manage organization members.
127 pub manage_users: bool,
128 /// Can manage the account recovery (password reset) feature.
129 pub manage_reset_password: bool,
130 /// Can manage SCIM (System for Cross-domain Identity Management) configuration.
131 pub manage_scim: bool,
132}
133
134/// Organization membership details from the user's profile sync.
135///
136/// Contains the full set of entitlements, plan features, and metadata for a single
137/// organization that the current user belongs to.
138#[derive(Serialize, Deserialize, Debug, Clone)]
139#[cfg_attr(feature = "uniffi", derive(uniffi::Record))]
140#[cfg_attr(feature = "wasm", derive(Tsify), tsify(into_wasm_abi, from_wasm_abi))]
141#[serde(rename_all = "camelCase")]
142pub struct ProfileOrganization {
143 /// Unique identifier for the organization.
144 pub id: Uuid,
145 /// Display name of the organization.
146 pub name: String,
147 /// The user's membership status in the organization.
148 pub status: OrganizationUserStatusType,
149 /// The user's role in the organization.
150 pub r#type: OrganizationUserType,
151 /// Whether the organization is currently enabled.
152 pub enabled: bool,
153 /// Whether the organization has access to policies features.
154 pub use_policies: bool,
155 /// Whether the organization has access to groups features.
156 pub use_groups: bool,
157 /// Whether the organization has access to directory sync features.
158 pub use_directory: bool,
159 /// Whether the organization has access to event logging features.
160 pub use_events: bool,
161 /// Whether the organization can enforce TOTP for members.
162 pub use_totp: bool,
163 /// Whether the organization has access to two-factor authentication features.
164 pub use_2fa: bool,
165 /// Whether the organization has access to the Bitwarden Public API.
166 pub use_api: bool,
167 /// Whether the organization has access to SSO features.
168 pub use_sso: bool,
169 /// Whether the organization can manage verified domains.
170 pub use_organization_domains: bool,
171 /// Whether the organization uses Key Connector for decryption.
172 pub use_key_connector: bool,
173 /// Whether the organization has access to SCIM provisioning.
174 pub use_scim: bool,
175 /// Whether the organization can use the [`OrganizationUserType::Custom`] role.
176 pub use_custom_permissions: bool,
177 /// Whether the organization has access to the account recovery (admin password reset) feature.
178 pub use_reset_password: bool,
179 /// Whether the organization has access to Secrets Manager.
180 pub use_secrets_manager: bool,
181 /// Whether the organization has access to Password Manager.
182 pub use_password_manager: bool,
183 /// Whether the organization can use the activate autofill policy.
184 pub use_activate_autofill_policy: bool,
185 /// Whether the organization can automatically confirm new members without manual admin
186 /// approval.
187 pub use_automatic_user_confirmation: bool,
188 /// Whether the organization can create a license file for a self-hosted instance.
189 pub self_host: bool,
190 /// Whether organization members receive premium features.
191 pub users_get_premium: bool,
192 /// The number of licensed seats for the organization.
193 pub seats: Option<u32>,
194 /// The maximum number of collections the organization can create.
195 pub max_collections: Option<u32>,
196 /// The maximum encrypted storage in gigabytes, if limited.
197 pub max_storage_gb: Option<u32>,
198 /// Whether the current user's account is bound to this organization via SSO.
199 pub sso_bound: bool,
200 /// The organization's SSO identifier.
201 pub identifier: Option<String>,
202 /// The current user's custom permissions, relevant when [`OrganizationUserType::Custom`] is
203 /// the user's `type`.
204 pub permissions: Permissions,
205 /// Whether the current user is enrolled in account recovery for this organization.
206 pub reset_password_enrolled: bool,
207 /// The current user's personal user ID.
208 pub user_id: Option<Uuid>,
209 /// The current user's organization membership ID.
210 pub organization_user_id: Option<Uuid>,
211 /// Whether the organization has both a public and private key configured.
212 pub has_public_and_private_keys: bool,
213 /// The ID of the provider managing this organization, if any.
214 pub provider_id: Option<Uuid>,
215 /// The name of the provider managing this organization, if any.
216 pub provider_name: Option<String>,
217 /// The type of provider managing this organization, if any.
218 pub provider_type: Option<ProviderType>,
219 /// Whether the current user accesses this organization through a provider.
220 pub is_provider_user: bool,
221 /// Whether the current user is a direct member of this organization (as opposed to
222 /// provider-only access).
223 pub is_member: bool,
224 /// The friendly name of a pending families sponsorship, if any.
225 pub family_sponsorship_friendly_name: Option<String>,
226 /// Whether the organization can sponsor a families plan for the current user.
227 pub family_sponsorship_available: bool,
228 /// The subscription tier of the organization.
229 pub product_tier_type: ProductTierType,
230 /// Whether Key Connector is enabled for this organization.
231 pub key_connector_enabled: bool,
232 /// The URL of the Key Connector service, if enabled.
233 pub key_connector_url: Option<String>,
234 /// The date the families sponsorship was last synced, if applicable.
235 pub family_sponsorship_last_sync_date: Option<DateTime<Utc>>,
236 /// The date the families sponsorship expires, if applicable.
237 pub family_sponsorship_valid_until: Option<DateTime<Utc>>,
238 /// Whether the families sponsorship is scheduled for deletion.
239 pub family_sponsorship_to_delete: Option<bool>,
240 /// Whether the current user has access to Secrets Manager for this organization.
241 pub access_secrets_manager: bool,
242 /// Whether collection creation is restricted to owners and admins only.
243 ///
244 /// When `false`, any member can create collections and automatically receives manage
245 /// permissions over collections they create.
246 pub limit_collection_creation: bool,
247 /// Whether collection deletion is restricted to owners and admins only.
248 ///
249 /// When `true`, regular users cannot delete collections that they manage.
250 pub limit_collection_deletion: bool,
251 /// Whether item deletion is restricted to members with the Manage collection permission.
252 ///
253 /// When `false`, members with Edit permission can also delete items within their collections.
254 pub limit_item_deletion: bool,
255 /// Whether owners and admins have implicit manage permissions over all collections.
256 ///
257 /// When `true`, owners and admins can alter items, groups, and permissions across all
258 /// collections without requiring explicit collection assignments.
259 /// When `false`, admins can only access collections where they have been explicitly assigned.
260 pub allow_admin_access_to_all_collection_items: bool,
261 /// Whether the current user's account is managed by this organization.
262 pub user_is_managed_by_organization: bool,
263 /// Whether the organization has access to Access Intelligence features.
264 pub use_access_intelligence: bool,
265 /// Whether the organization can sponsor families plans for members (Families For Enterprises).
266 pub use_admin_sponsored_families: bool,
267 /// Whether Secrets Manager ads are disabled for users.
268 #[serde(rename = "useDisableSMAdsForUsers")]
269 pub use_disable_sm_ads_for_users: bool,
270 /// Whether the organization's Families For Enterprises sponsorship was initiated by an admin.
271 pub is_admin_initiated: bool,
272 /// Whether SSO login is currently enabled for this organization.
273 pub sso_enabled: bool,
274 /// The decryption type used for SSO members, if SSO is enabled.
275 pub sso_member_decryption_type: Option<MemberDecryptionType>,
276 /// Whether the organization has access to phishing blocker features.
277 pub use_phishing_blocker: bool,
278 /// Whether the organization has access to the My Items collection feature.
279 /// This allows users to store personal items in the organization vault
280 /// if the Centralize Organization Ownership policy is enabled.
281 pub use_my_items: bool,
282}
283
284impl Default for ProfileOrganization {
285 fn default() -> Self {
286 ProfileOrganization {
287 id: Uuid::nil(),
288 name: String::new(),
289 status: OrganizationUserStatusType::Confirmed,
290 r#type: OrganizationUserType::User,
291 enabled: true,
292 use_policies: false,
293 use_groups: false,
294 use_directory: false,
295 use_events: false,
296 use_totp: false,
297 use_2fa: false,
298 use_api: false,
299 use_sso: false,
300 use_organization_domains: false,
301 use_key_connector: false,
302 use_scim: false,
303 use_custom_permissions: false,
304 use_reset_password: false,
305 use_secrets_manager: false,
306 use_password_manager: false,
307 use_activate_autofill_policy: false,
308 use_automatic_user_confirmation: false,
309 self_host: false,
310 users_get_premium: false,
311 seats: Some(10),
312 max_collections: None,
313 max_storage_gb: None,
314 sso_bound: false,
315 identifier: None,
316 permissions: Permissions::default(),
317 reset_password_enrolled: false,
318 user_id: None,
319 organization_user_id: None,
320 has_public_and_private_keys: false,
321 provider_id: None,
322 provider_name: None,
323 provider_type: None,
324 is_provider_user: false,
325 is_member: true,
326 family_sponsorship_friendly_name: None,
327 family_sponsorship_available: false,
328 product_tier_type: ProductTierType::Free,
329 key_connector_enabled: false,
330 key_connector_url: None,
331 family_sponsorship_last_sync_date: None,
332 family_sponsorship_valid_until: None,
333 family_sponsorship_to_delete: None,
334 access_secrets_manager: false,
335 limit_collection_creation: false,
336 limit_collection_deletion: false,
337 limit_item_deletion: false,
338 allow_admin_access_to_all_collection_items: false,
339 user_is_managed_by_organization: false,
340 use_access_intelligence: false,
341 use_admin_sponsored_families: false,
342 use_disable_sm_ads_for_users: false,
343 is_admin_initiated: false,
344 sso_enabled: false,
345 sso_member_decryption_type: None,
346 use_phishing_blocker: false,
347 use_my_items: false,
348 }
349 }
350}