bitwarden_vault/cipher/cipher_client/admin/
restore.rs

1use bitwarden_api_api::{apis::ApiClient, models::CipherBulkRestoreRequestModel};
2use bitwarden_core::{ApiError, OrganizationId, key_management::KeySlotIds};
3use bitwarden_crypto::{CryptoError, KeyStore};
4use bitwarden_error::bitwarden_error;
5use thiserror::Error;
6#[cfg(feature = "wasm")]
7use wasm_bindgen::prelude::wasm_bindgen;
8
9use crate::{
10    Cipher, CipherId, CipherView, DecryptCipherListResult, VaultParseError,
11    cipher::cipher::{PartialCipher, StrictDecrypt},
12    cipher_client::admin::CipherAdminClient,
13};
14
15#[allow(missing_docs)]
16#[bitwarden_error(flat)]
17#[derive(Debug, Error)]
18pub enum RestoreCipherAdminError {
19    #[error(transparent)]
20    Api(#[from] ApiError),
21    #[error(transparent)]
22    VaultParse(#[from] VaultParseError),
23    #[error(transparent)]
24    Crypto(#[from] CryptoError),
25}
26
27/// Restores a soft-deleted cipher on the server, using the admin endpoint.
28pub async fn restore_as_admin(
29    cipher_id: CipherId,
30    api_client: &ApiClient,
31    key_store: &KeyStore<KeySlotIds>,
32    use_strict_decryption: bool,
33) -> Result<CipherView, RestoreCipherAdminError> {
34    let api = api_client.ciphers_api();
35
36    let cipher: Cipher = api
37        .put_restore_admin(cipher_id.into())
38        .await?
39        .merge_with_cipher(None)?;
40
41    Ok(if use_strict_decryption {
42        key_store.decrypt(&StrictDecrypt(cipher))?
43    } else {
44        key_store.decrypt(&cipher)?
45    })
46}
47
48/// Restores multiple soft-deleted ciphers on the server.
49pub async fn restore_many_as_admin(
50    cipher_ids: Vec<CipherId>,
51    org_id: OrganizationId,
52    api_client: &ApiClient,
53    key_store: &KeyStore<KeySlotIds>,
54    use_strict_decryption: bool,
55) -> Result<DecryptCipherListResult, RestoreCipherAdminError> {
56    let api = api_client.ciphers_api();
57
58    let ciphers: Vec<Cipher> = api
59        .put_restore_many_admin(Some(CipherBulkRestoreRequestModel {
60            ids: cipher_ids.into_iter().map(|id| id.to_string()).collect(),
61            organization_id: Some(org_id.into()),
62        }))
63        .await?
64        .data
65        .into_iter()
66        .flatten()
67        .map(|c| c.merge_with_cipher(None))
68        .collect::<Result<Vec<_>, _>>()?;
69
70    Ok(if use_strict_decryption {
71        let wrapped: Vec<StrictDecrypt<Cipher>> = ciphers.into_iter().map(StrictDecrypt).collect();
72        let (successes, failures) = key_store.decrypt_list_with_failures(&wrapped);
73        DecryptCipherListResult {
74            successes,
75            failures: failures.into_iter().map(|f| f.0.clone()).collect(),
76        }
77    } else {
78        let (successes, failures) = key_store.decrypt_list_with_failures(&ciphers);
79        DecryptCipherListResult {
80            successes,
81            failures: failures.into_iter().cloned().collect(),
82        }
83    })
84}
85
86#[cfg_attr(feature = "wasm", wasm_bindgen)]
87impl CipherAdminClient {
88    /// Restores a soft-deleted cipher on the server, using the admin endpoint.
89    pub async fn restore(
90        &self,
91        cipher_id: CipherId,
92    ) -> Result<CipherView, RestoreCipherAdminError> {
93        let api_client = &self.api_configurations.api_client;
94        let key_store = &self.key_store;
95
96        restore_as_admin(
97            cipher_id,
98            api_client,
99            key_store,
100            self.is_strict_decrypt().await,
101        )
102        .await
103    }
104    /// Restores multiple soft-deleted ciphers on the server.
105    pub async fn restore_many(
106        &self,
107        cipher_ids: Vec<CipherId>,
108        org_id: OrganizationId,
109    ) -> Result<DecryptCipherListResult, RestoreCipherAdminError> {
110        let api_client = &self.api_configurations.api_client;
111        let key_store = &self.key_store;
112
113        restore_many_as_admin(
114            cipher_ids,
115            org_id,
116            api_client,
117            key_store,
118            self.is_strict_decrypt().await,
119        )
120        .await
121    }
122}
123
124#[cfg(test)]
125mod tests {
126    use bitwarden_api_api::{
127        apis::ApiClient,
128        models::{CipherMiniResponseModel, CipherMiniResponseModelListResponseModel},
129    };
130    use bitwarden_core::key_management::{KeySlotIds, SymmetricKeySlotId};
131    use bitwarden_crypto::{KeyStore, SymmetricCryptoKey, SymmetricKeyAlgorithm};
132    use chrono::Utc;
133
134    use super::*;
135    use crate::{Cipher, CipherId, Login};
136
137    const TEST_CIPHER_ID: &str = "5faa9684-c793-4a2d-8a12-b33900187097";
138    const TEST_CIPHER_ID_2: &str = "6faa9684-c793-4a2d-8a12-b33900187098";
139    const TEST_ORG_ID: &str = "1bc9ac1e-f5aa-45f2-94bf-b181009709b8";
140
141    fn generate_test_cipher() -> Cipher {
142        Cipher {
143            id: TEST_CIPHER_ID.parse().ok(),
144            name: Some("2.pMS6/icTQABtulw52pq2lg==|XXbxKxDTh+mWiN1HjH2N1w==|Q6PkuT+KX/axrgN9ubD5Ajk2YNwxQkgs3WJM0S0wtG8=".parse().unwrap()),
145            r#type: crate::CipherType::Login,
146            notes: Default::default(),
147            organization_id: Default::default(),
148            folder_id: Default::default(),
149            favorite: Default::default(),
150            reprompt: Default::default(),
151            fields: Default::default(),
152            collection_ids: Default::default(),
153            key: Default::default(),
154            login: Some(Login{
155                username: None,
156                password: None,
157                password_revision_date: None,
158                uris: None, totp: None,
159                autofill_on_page_load: None,
160                fido2_credentials: None,
161            }),
162            identity: Default::default(),
163            card: Default::default(),
164            secure_note: Default::default(),
165            ssh_key: Default::default(),
166            bank_account: Default::default(),
167            drivers_license: Default::default(),
168            passport: Default::default(),
169            organization_use_totp: Default::default(),
170            edit: Default::default(),
171            permissions: Default::default(),
172            view_password: Default::default(),
173            local_data: Default::default(),
174            attachments: Default::default(),
175            password_history: Default::default(),
176            creation_date: Default::default(),
177            deleted_date: Default::default(),
178            revision_date: Default::default(),
179            archived_date: Default::default(),
180            data: Default::default(),
181        }
182    }
183
184    #[tokio::test]
185    async fn test_restore_as_admin() {
186        let mut cipher = generate_test_cipher();
187        cipher.deleted_date = Some(Utc::now());
188
189        let api_client = {
190            let cipher = cipher.clone();
191            ApiClient::new_mocked(move |mock| {
192                mock.ciphers_api
193                    .expect_put_restore_admin()
194                    .returning(move |_model| {
195                        Ok(CipherMiniResponseModel {
196                            id: Some(TEST_CIPHER_ID.try_into().unwrap()),
197                            name: cipher.name.as_ref().map(ToString::to_string),
198                            r#type: Some(cipher.r#type.into()),
199                            creation_date: Some(cipher.creation_date.to_string()),
200                            revision_date: Some(Utc::now().to_rfc3339()),
201                            login: cipher.login.clone().map(|l| Box::new(l.into())),
202                            ..Default::default()
203                        })
204                    });
205            })
206        };
207
208        let store: KeyStore<KeySlotIds> = KeyStore::default();
209        #[allow(deprecated)]
210        let _ = store.context_mut().set_symmetric_key(
211            SymmetricKeySlotId::User,
212            SymmetricCryptoKey::make(SymmetricKeyAlgorithm::Aes256CbcHmac),
213        );
214        let start_time = Utc::now();
215        let updated_cipher =
216            restore_as_admin(TEST_CIPHER_ID.parse().unwrap(), &api_client, &store, false)
217                .await
218                .unwrap();
219        let end_time = Utc::now();
220
221        assert!(updated_cipher.deleted_date.is_none());
222        assert!(
223            updated_cipher.revision_date >= start_time && updated_cipher.revision_date <= end_time
224        );
225    }
226
227    #[tokio::test]
228    async fn test_restore_many_as_admin() {
229        let cipher_id_2: CipherId = TEST_CIPHER_ID_2.parse().unwrap();
230        let mut cipher_1 = generate_test_cipher();
231        cipher_1.deleted_date = Some(Utc::now());
232        let mut cipher_2 = generate_test_cipher();
233        cipher_2.deleted_date = Some(Utc::now());
234        cipher_2.id = Some(cipher_id_2);
235
236        let api_client = ApiClient::new_mocked(move |mock| {
237            mock.ciphers_api
238                .expect_put_restore_many_admin()
239                .returning(move |_model| {
240                    Ok(CipherMiniResponseModelListResponseModel {
241                        object: None,
242                        data: Some(vec![
243                            CipherMiniResponseModel {
244                                id: cipher_1.id.map(|id| id.into()),
245                                name: cipher_1.name.as_ref().map(ToString::to_string),
246                                r#type: Some(cipher_1.r#type.into()),
247                                login: cipher_1.login.clone().map(|l| Box::new(l.into())),
248                                creation_date: cipher_1.creation_date.to_string().into(),
249                                deleted_date: None,
250                                revision_date: Some(Utc::now().to_rfc3339()),
251                                ..Default::default()
252                            },
253                            CipherMiniResponseModel {
254                                id: cipher_2.id.map(|id| id.into()),
255                                name: cipher_2.name.as_ref().map(ToString::to_string),
256                                r#type: Some(cipher_2.r#type.into()),
257                                login: cipher_2.login.clone().map(|l| Box::new(l.into())),
258                                creation_date: cipher_2.creation_date.to_string().into(),
259                                deleted_date: None,
260                                revision_date: Some(Utc::now().to_rfc3339()),
261                                ..Default::default()
262                            },
263                        ]),
264                        continuation_token: None,
265                    })
266                });
267        });
268        let store: KeyStore<KeySlotIds> = KeyStore::default();
269        #[allow(deprecated)]
270        let _ = store.context_mut().set_symmetric_key(
271            SymmetricKeySlotId::User,
272            SymmetricCryptoKey::make(SymmetricKeyAlgorithm::Aes256CbcHmac),
273        );
274
275        let start_time = Utc::now();
276        let ciphers = restore_many_as_admin(
277            vec![
278                TEST_CIPHER_ID.parse().unwrap(),
279                TEST_CIPHER_ID_2.parse().unwrap(),
280            ],
281            TEST_ORG_ID.parse().unwrap(),
282            &api_client,
283            &store,
284            false,
285        )
286        .await
287        .unwrap();
288        let end_time = Utc::now();
289
290        assert_eq!(ciphers.successes.len(), 2,);
291        assert_eq!(ciphers.failures.len(), 0,);
292        assert_eq!(
293            ciphers.successes[0].id,
294            Some(TEST_CIPHER_ID.parse().unwrap()),
295        );
296        assert_eq!(
297            ciphers.successes[1].id,
298            Some(TEST_CIPHER_ID_2.parse().unwrap()),
299        );
300        assert_eq!(ciphers.successes[0].deleted_date, None,);
301        assert_eq!(ciphers.successes[1].deleted_date, None,);
302
303        assert!(
304            ciphers.successes[0].revision_date >= start_time
305                && ciphers.successes[0].revision_date <= end_time
306        );
307        assert!(
308            ciphers.successes[1].revision_date >= start_time
309                && ciphers.successes[1].revision_date <= end_time
310        );
311    }
312}
bitwarden_vault/cipher/cipher_client/admin/restore.rs

bitwarden_vault/cipher/cipher_client/admin/
restore.rs
