Deleting a collection - Backend says Yes, Frontend says No. Can we fix that?

[uedvt359]

Hi all,

Any user with the Custom/Manager role is allowed to create a new collection, but unless they also have the "manage all collections" sub-role, they won't be able to delete their own collections. This seems to be a limitation of the frontend only - calling DELETE on /api/organizations/<uuid>/collections/<uuid> (with the correct bearer token) works. But there is no button in the UI that allows a non-all manager to trigger it.

There are two places in the web vault where collections should be able to get deleted

• when visiting a collection (/#/vault?collectionId=<uuid>), there is a drop-down menu next to the collection title
  
  • the "delete" menu entry is simply missing
• then displaying the list of all (top-level) collections (/#/vault?collectionId=all), after bulk-selecting collections
  
  • the delete menu entry is there, but clicking it triggers a error box " You lack the necessary permissions to perform this action.", without even triggering a HTTP request.

How does the UI decide whether or not to display a delete icon / attempt to delete selected collections? Is it possible for Vaultwarden to override this piece of information?

[uedvt359]

/api/accounts/profile has a per-organization limitCollectionDeletion attribute - this sounds promising. according the the source, this is hard-coded to true, though. Would it be possible to change this value? this upstream code suggests to me that it would do what i'd expect from it: because of the this.manage check, this should only apply to collections that the current user is already added to as can-manage.

[uedvt359]

@BlackDex : could you please provide your input on this (especially why "limitCollectionDeletion" is hardcoded to true)? if i'm interpreting the bitwarden client code correctly, this little change would allow much more flexibility with less privileged users.

[BlackDex]

All that this says to me is that the only bug we currently have is not checking that flag and allowing you to delete something which we either shouldn't allow or need to verify better.

Or there is a bug in client, which for some reason blocks this, but should allow it.

There will be no global config via ENV's for this, as these should be done per organization, and there is a form for this which we currently hide since we do not support this form.

I'm not saying there isn't something wrong, but simply adding those flags isn't correct either without the proper server-side checks.

[uedvt359]

it's just very unfortunate that the result of this is that users with permission manager/custom are allowed to create a collection, but then aren't allowed to delete it.

[BlackDex]

As mentioned in my previous post. To have a fully correctly working set of rules, we need to adjust everything so that we can allow custom rules. Until someone starts to implement that, there currently are difference between Bitwarden and Vaultwarden on how these rights are handled.

[uedvt359]

@BlackDex : would you (or any of the other core contributors) be willing to work on this, in exchange for a negotiable amount of money?

[BlackDex]

If i would do this project for money, then i selected the wrong project i think haha.
It's not a money issue for me, though donations are always welcomed and appreciated no matter how small ☕

I just currently do not have the time to engage such a large item combined with other tasks which also need to be done to keep Vaultwarden compatible and up-to-date.

Sure, we probably need to add this sometime from my opinion, but it's a large task as i mentioned earlier.