Skip to content

PROPOSED FIX #39: short-circuit GET api/organizations/{id} when non-Owner - #53

Open
nipil wants to merge 2 commits into
numberly:mainfrom
nipil:fix_get_organization_for_non_owners
Open

nipil wants to merge 2 commits into
numberly:mainfrom
nipil:fix_get_organization_for_non_owners

Conversation

@nipil

@nipil nipil commented Oct 18, 2026

Copy link
Copy Markdown

Proposed fix for #39

Cause: the above route seem to require Owner access to organization https://github.com/dani-garcia/vaultwarden/blob/1.37.4/src/api/core/organizations.rs#L264

Effect : As an admin of the organization, i get a 401 error when calling the route without this fix ; With the provided fix, i get a usable downstream Organization from get_organization() built from information from a ProfileOrganization i provide from sync data.

Only drawback: BillingEmail is set to empty string because we have nothing to set it from.

nipil added 2 commits October 18, 2026 21:37
Route seem to require Owner access to organization
https://github.com/dani-garcia/vaultwarden/blob/1.37.4/src/api/core/organizations.rs#L264

As an admin of the organization, i get a 401 error when calling the
route without this fix

Only drawback: BillingEmail is set to empty string because we have
nothing to set it from
Same fix but automatic instead of explicit

Choose at your convenance between this and the previous commit
@nipil

nipil commented Oct 18, 2026

Copy link
Copy Markdown
Author

Provided another solution in a second commit, which provides automatic handling instead of explicit caller choice.

IMHO

  • the first commit (with an additional argument) requires of the caller to provide an additional argument, but skips an Organization search loop; only advantage is if you are part of numerous organizations, then you spare a little time
  • the second commit provides a more transparent (works for any user type using autodetection) but we have to search for the organization in the (already cached?) sync profile organization data, which costs (very?) little time, if user is part of numerous organizations on the server.

Both look fine to me, but the automatic one is more user friendly, i guess.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant