{{ "dangerZoneDesc" | i18n }}
diff --git a/apps/web/src/app/admin-console/organizations/settings/account.component.ts b/apps/web/src/app/admin-console/organizations/settings/account.component.ts
index 8900e626a3c..693e718231b 100644
--- a/apps/web/src/app/admin-console/organizations/settings/account.component.ts
+++ b/apps/web/src/app/admin-console/organizations/settings/account.component.ts
@@ -1,17 +1,19 @@
import { Component, ViewChild, ViewContainerRef } from "@angular/core";
import { FormBuilder, Validators } from "@angular/forms";
import { ActivatedRoute, Router } from "@angular/router";
-import { combineLatest, lastValueFrom, Subject, switchMap, takeUntil, from } from "rxjs";
+import { combineLatest, lastValueFrom, Subject, switchMap, takeUntil, from, of } from "rxjs";
import { ModalService } from "@bitwarden/angular/services/modal.service";
import { OrganizationApiServiceAbstraction } from "@bitwarden/common/admin-console/abstractions/organization/organization-api.service.abstraction";
import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
+import { OrganizationCollectionManagementUpdateRequest } from "@bitwarden/common/admin-console/models/request/organization-collection-management-update.request";
import { OrganizationKeysRequest } from "@bitwarden/common/admin-console/models/request/organization-keys.request";
import { OrganizationUpdateRequest } from "@bitwarden/common/admin-console/models/request/organization-update.request";
import { OrganizationResponse } from "@bitwarden/common/admin-console/models/response/organization.response";
+import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
+import { ConfigServiceAbstraction } from "@bitwarden/common/platform/abstractions/config/config.service.abstraction";
import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
-import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
import { Utils } from "@bitwarden/common/platform/misc/utils";
import { DialogService } from "@bitwarden/components";
@@ -38,8 +40,11 @@ export class AccountComponent {
loading = true;
canUseApi = false;
org: OrganizationResponse;
- formPromise: Promise
;
taxFormPromise: Promise;
+ showCollectionManagementSettings$ = this.configService.getFeatureFlag$(
+ FeatureFlag.FlexibleCollections,
+ false
+ );
// FormGroup validators taken from server Organization domain object
protected formGroup = this.formBuilder.group({
@@ -60,6 +65,10 @@ export class AccountComponent {
),
});
+ protected collectionManagementFormGroup = this.formBuilder.group({
+ limitCollectionCreationDeletion: [false],
+ });
+
protected organizationId: string;
protected publicKeyBuffer: Uint8Array;
@@ -71,27 +80,27 @@ export class AccountComponent {
private route: ActivatedRoute,
private platformUtilsService: PlatformUtilsService,
private cryptoService: CryptoService,
- private logService: LogService,
private router: Router,
private organizationService: OrganizationService,
private organizationApiService: OrganizationApiServiceAbstraction,
private dialogService: DialogService,
- private formBuilder: FormBuilder
+ private formBuilder: FormBuilder,
+ private configService: ConfigServiceAbstraction
) {}
async ngOnInit() {
this.selfHosted = this.platformUtilsService.isSelfHost();
- this.route.parent.parent.params
+ this.route.params
.pipe(
- switchMap((params) => {
+ switchMap((params) => this.organizationService.get$(params.organizationId)),
+ switchMap((organization) => {
return combineLatest([
- // Organization domain
- this.organizationService.get$(params.organizationId),
+ of(organization),
// OrganizationResponse for form population
- from(this.organizationApiService.get(params.organizationId)),
+ from(this.organizationApiService.get(organization.id)),
// Organization Public Key
- from(this.organizationApiService.getKeys(params.organizationId)),
+ from(this.organizationApiService.getKeys(organization.id)),
]);
}),
takeUntil(this.destroy$)
@@ -102,6 +111,16 @@ export class AccountComponent {
this.canEditSubscription = organization.canEditSubscription;
this.canUseApi = organization.useApi;
+ // Update disabled states - reactive forms prefers not using disabled attribute
+ if (!this.selfHosted) {
+ this.formGroup.get("orgName").enable();
+ }
+
+ if (!this.selfHosted || this.canEditSubscription) {
+ this.formGroup.get("billingEmail").enable();
+ this.formGroup.get("businessName").enable();
+ }
+
// Org Response
this.org = orgResponse;
@@ -114,16 +133,9 @@ export class AccountComponent {
billingEmail: this.org.billingEmail,
businessName: this.org.businessName,
});
-
- // Update disabled states - reactive forms prefers not using disabled attribute
- if (!this.selfHosted) {
- this.formGroup.get("orgName").enable();
- }
-
- if (!this.selfHosted || this.canEditSubscription) {
- this.formGroup.get("billingEmail").enable();
- this.formGroup.get("businessName").enable();
- }
+ this.collectionManagementFormGroup.patchValue({
+ limitCollectionCreationDeletion: this.org.limitCollectionCreationDeletion,
+ });
this.loading = false;
});
@@ -153,11 +165,25 @@ export class AccountComponent {
request.keys = new OrganizationKeysRequest(orgKeys[0], orgKeys[1].encryptedString);
}
- this.formPromise = this.organizationApiService.save(this.organizationId, request);
- await this.formPromise;
+ await this.organizationApiService.save(this.organizationId, request);
+
this.platformUtilsService.showToast("success", null, this.i18nService.t("organizationUpdated"));
};
+ submitCollectionManagement = async () => {
+ const request = new OrganizationCollectionManagementUpdateRequest();
+ request.limitCreateDeleteOwnerAdmin =
+ this.collectionManagementFormGroup.value.limitCollectionCreationDeletion;
+
+ await this.organizationApiService.updateCollectionManagement(this.organizationId, request);
+
+ this.platformUtilsService.showToast(
+ "success",
+ null,
+ this.i18nService.t("collectionManagementUpdated")
+ );
+ };
+
async deleteOrganization() {
const dialog = openDeleteOrganizationDialog(this.dialogService, {
data: {
diff --git a/apps/web/src/app/admin-console/organizations/shared/components/access-selector/access-selector.component.ts b/apps/web/src/app/admin-console/organizations/shared/components/access-selector/access-selector.component.ts
index d2d1768a67c..2b954063b2a 100644
--- a/apps/web/src/app/admin-console/organizations/shared/components/access-selector/access-selector.component.ts
+++ b/apps/web/src/app/admin-console/organizations/shared/components/access-selector/access-selector.component.ts
@@ -122,6 +122,10 @@ export class AccessSelectorComponent implements ControlValueAccessor, OnInit, On
{ perm: CollectionPermission.Edit, labelId: "canEdit" },
{ perm: CollectionPermission.EditExceptPass, labelId: "canEditExceptPass" },
];
+ private canManagePermissionListItem = {
+ perm: CollectionPermission.Manage,
+ labelId: "canManage",
+ };
protected initialPermission = CollectionPermission.View;
disabled: boolean;
@@ -192,6 +196,11 @@ export class AccessSelectorComponent implements ControlValueAccessor, OnInit, On
*/
@Input() showGroupColumn: boolean;
+ /**
+ * Enable Flexible Collections changes (feature flag)
+ */
+ @Input() flexibleCollectionsEnabled: boolean;
+
constructor(
private readonly formBuilder: FormBuilder,
private readonly i18nService: I18nService
@@ -254,7 +263,7 @@ export class AccessSelectorComponent implements ControlValueAccessor, OnInit, On
this.pauseChangeNotification = false;
}
- ngOnInit() {
+ async ngOnInit() {
// Watch the internal formArray for changes and propagate them
this.selectionList.formArray.valueChanges.pipe(takeUntil(this.destroy$)).subscribe((v) => {
if (!this.notifyOnChange || this.pauseChangeNotification) {
@@ -268,6 +277,10 @@ export class AccessSelectorComponent implements ControlValueAccessor, OnInit, On
}
this.notifyOnChange(v);
});
+
+ if (this.flexibleCollectionsEnabled) {
+ this.permissionList.push(this.canManagePermissionListItem);
+ }
}
ngOnDestroy() {
diff --git a/apps/web/src/app/admin-console/organizations/shared/components/access-selector/access-selector.models.ts b/apps/web/src/app/admin-console/organizations/shared/components/access-selector/access-selector.models.ts
index f4ba620ed08..4e434a05c37 100644
--- a/apps/web/src/app/admin-console/organizations/shared/components/access-selector/access-selector.models.ts
+++ b/apps/web/src/app/admin-console/organizations/shared/components/access-selector/access-selector.models.ts
@@ -1,19 +1,21 @@
+import { OrganizationUserUserDetailsResponse } from "@bitwarden/common/admin-console/abstractions/organization-user/responses";
import {
OrganizationUserStatusType,
OrganizationUserType,
} from "@bitwarden/common/admin-console/enums";
import { SelectItemView } from "@bitwarden/components";
-import { CollectionAccessSelectionView } from "../../../core";
+import { CollectionAccessSelectionView, GroupView } from "../../../core";
/**
- * Permission options that replace/correspond with readOnly and hidePassword server fields.
+ * Permission options that replace/correspond with manage, readOnly, and hidePassword server fields.
*/
export enum CollectionPermission {
View = "view",
ViewExceptPass = "viewExceptPass",
Edit = "edit",
EditExceptPass = "editExceptPass",
+ Manage = "manage",
}
export enum AccessItemType {
@@ -82,7 +84,9 @@ export type AccessItemValue = {
* @param value
*/
export const convertToPermission = (value: CollectionAccessSelectionView) => {
- if (value.readOnly) {
+ if (value.manage) {
+ return CollectionPermission.Manage;
+ } else if (value.readOnly) {
return value.hidePasswords ? CollectionPermission.ViewExceptPass : CollectionPermission.View;
} else {
return value.hidePasswords ? CollectionPermission.EditExceptPass : CollectionPermission.Edit;
@@ -91,7 +95,7 @@ export const convertToPermission = (value: CollectionAccessSelectionView) => {
/**
* Converts an AccessItemValue back into a CollectionAccessView class using the CollectionPermission
- * to determine the values for `readOnly` and `hidePassword`
+ * to determine the values for `manage`, `readOnly`, and `hidePassword`
* @param value
*/
export const convertToSelectionView = (value: AccessItemValue) => {
@@ -99,6 +103,7 @@ export const convertToSelectionView = (value: AccessItemValue) => {
id: value.id,
readOnly: readOnly(value.permission),
hidePasswords: hidePassword(value.permission),
+ manage: value.permission === CollectionPermission.Manage,
});
};
@@ -107,3 +112,29 @@ const readOnly = (perm: CollectionPermission) =>
const hidePassword = (perm: CollectionPermission) =>
[CollectionPermission.ViewExceptPass, CollectionPermission.EditExceptPass].includes(perm);
+
+export function mapGroupToAccessItemView(group: GroupView): AccessItemView {
+ return {
+ id: group.id,
+ type: AccessItemType.Group,
+ listName: group.name,
+ labelName: group.name,
+ accessAllItems: group.accessAll,
+ readonly: group.accessAll,
+ };
+}
+
+// TODO: Use view when user apis are migrated to a service
+export function mapUserToAccessItemView(user: OrganizationUserUserDetailsResponse): AccessItemView {
+ return {
+ id: user.id,
+ type: AccessItemType.Member,
+ email: user.email,
+ role: user.type,
+ listName: user.name?.length > 0 ? `${user.name} (${user.email})` : user.email,
+ labelName: user.name ?? user.email,
+ status: user.status,
+ accessAllItems: user.accessAll,
+ readonly: user.accessAll,
+ };
+}
diff --git a/apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.html b/apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.html
index e39dcb12ef9..41e785a6eba 100644
--- a/apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.html
+++ b/apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.html
@@ -64,6 +64,12 @@
+
+ {{ "managePermissionRequired" | i18n }}
+
diff --git a/apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.ts b/apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.ts
index 7a0240ab629..898831c2204 100644
--- a/apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.ts
+++ b/apps/web/src/app/vault/components/collection-dialog/collection-dialog.component.ts
@@ -1,8 +1,10 @@
import { DIALOG_DATA, DialogConfig, DialogRef } from "@angular/cdk/dialog";
-import { Component, Inject, OnDestroy, OnInit } from "@angular/core";
-import { FormBuilder, Validators } from "@angular/forms";
+import { ChangeDetectorRef, Component, Inject, OnDestroy, OnInit } from "@angular/core";
+import { AbstractControl, FormBuilder, Validators } from "@angular/forms";
import {
combineLatest,
+ firstValueFrom,
+ from,
map,
Observable,
of,
@@ -14,23 +16,27 @@ import {
import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
import { OrganizationUserService } from "@bitwarden/common/admin-console/abstractions/organization-user/organization-user.service";
-import { OrganizationUserUserDetailsResponse } from "@bitwarden/common/admin-console/abstractions/organization-user/responses";
import { Organization } from "@bitwarden/common/admin-console/models/domain/organization";
+import { FeatureFlag } from "@bitwarden/common/enums/feature-flag.enum";
+import { ConfigServiceAbstraction } from "@bitwarden/common/platform/abstractions/config/config.service.abstraction";
import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
import { Utils } from "@bitwarden/common/platform/misc/utils";
import { CollectionResponse } from "@bitwarden/common/vault/models/response/collection.response";
import { CollectionView } from "@bitwarden/common/vault/models/view/collection.view";
-import { DialogService, BitValidators } from "@bitwarden/components";
+import { BitValidators, DialogService } from "@bitwarden/components";
import { GroupService, GroupView } from "../../../admin-console/organizations/core";
import { PermissionMode } from "../../../admin-console/organizations/shared/components/access-selector/access-selector.component";
import {
- AccessItemView,
- AccessItemValue,
AccessItemType,
- convertToSelectionView,
+ AccessItemValue,
+ AccessItemView,
+ CollectionPermission,
convertToPermission,
+ convertToSelectionView,
+ mapGroupToAccessItemView,
+ mapUserToAccessItemView,
} from "../../../admin-console/organizations/shared/components/access-selector/access-selector.models";
import { CollectionAdminService } from "../../core/collection-admin.service";
import { CollectionAdminView } from "../../core/views/collection-admin.view";
@@ -64,6 +70,11 @@ export enum CollectionDialogAction {
templateUrl: "collection-dialog.component.html",
})
export class CollectionDialogComponent implements OnInit, OnDestroy {
+ protected flexibleCollectionsEnabled$ = this.configService.getFeatureFlag$(
+ FeatureFlag.FlexibleCollections,
+ false
+ );
+
private destroy$ = new Subject();
protected organizations$: Observable;
@@ -94,7 +105,9 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
private i18nService: I18nService,
private platformUtilsService: PlatformUtilsService,
private organizationUserService: OrganizationUserService,
- private dialogService: DialogService
+ private dialogService: DialogService,
+ private changeDetectorRef: ChangeDetectorRef,
+ private configService: ConfigServiceAbstraction
) {
this.tabIndex = params.initialTab ?? CollectionDialogTabType.Info;
}
@@ -118,7 +131,11 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
} else {
// Opened from the org vault
this.formGroup.patchValue({ selectedOrg: this.params.organizationId });
- this.loadOrg(this.params.organizationId, this.params.collectionIds);
+ await this.loadOrg(this.params.organizationId, this.params.collectionIds);
+ }
+
+ if (await firstValueFrom(this.flexibleCollectionsEnabled$)) {
+ this.formGroup.controls.access.addValidators(validateCanManagePermission);
}
}
@@ -139,51 +156,76 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
organization: organization$,
collections: this.collectionService.getAll(orgId),
collectionDetails: this.params.collectionId
- ? this.collectionService.get(orgId, this.params.collectionId)
+ ? from(this.collectionService.get(orgId, this.params.collectionId))
: of(null),
groups: groups$,
users: this.organizationUserService.getAllUsers(orgId),
+ flexibleCollections: this.flexibleCollectionsEnabled$,
})
.pipe(takeUntil(this.formGroup.controls.selectedOrg.valueChanges), takeUntil(this.destroy$))
- .subscribe(({ organization, collections, collectionDetails, groups, users }) => {
- this.organization = organization;
- this.accessItems = [].concat(
- groups.map(mapGroupToAccessItemView),
- users.data.map(mapUserToAccessItemView)
- );
+ .subscribe(
+ ({ organization, collections, collectionDetails, groups, users, flexibleCollections }) => {
+ this.organization = organization;
+ this.accessItems = [].concat(
+ groups.map(mapGroupToAccessItemView),
+ users.data.map(mapUserToAccessItemView)
+ );
- if (collectionIds) {
- collections = collections.filter((c) => collectionIds.includes(c.id));
- }
+ // Force change detection to update the access selector's items
+ this.changeDetectorRef.detectChanges();
- if (this.params.collectionId) {
- this.collection = collections.find((c) => c.id === this.collectionId);
- this.nestOptions = collections.filter((c) => c.id !== this.collectionId);
-
- if (!this.collection) {
- throw new Error("Could not find collection to edit.");
+ if (collectionIds) {
+ collections = collections.filter((c) => collectionIds.includes(c.id));
}
- const { name, parent } = parseName(this.collection);
- if (parent !== undefined && !this.nestOptions.find((c) => c.name === parent)) {
- this.deletedParentName = parent;
+ if (this.params.collectionId) {
+ this.collection = collections.find((c) => c.id === this.collectionId);
+ this.nestOptions = collections.filter((c) => c.id !== this.collectionId);
+
+ if (!this.collection) {
+ throw new Error("Could not find collection to edit.");
+ }
+
+ const { name, parent } = parseName(this.collection);
+ if (parent !== undefined && !this.nestOptions.find((c) => c.name === parent)) {
+ this.deletedParentName = parent;
+ }
+
+ const accessSelections = mapToAccessSelections(collectionDetails);
+ this.formGroup.patchValue({
+ name,
+ externalId: this.collection.externalId,
+ parent,
+ access: accessSelections,
+ });
+ } else {
+ this.nestOptions = collections;
+ const parent = collections.find((c) => c.id === this.params.parentCollectionId);
+ const currentOrgUserId = users.data.find(
+ (u) => u.userId === this.organization?.userId
+ )?.id;
+ const initialSelection: AccessItemValue[] =
+ currentOrgUserId !== undefined
+ ? [
+ {
+ id: currentOrgUserId,
+ type: AccessItemType.Member,
+ permission: flexibleCollections
+ ? CollectionPermission.Manage
+ : CollectionPermission.Edit,
+ },
+ ]
+ : [];
+
+ this.formGroup.patchValue({
+ parent: parent?.name ?? undefined,
+ access: initialSelection,
+ });
}
- const accessSelections = mapToAccessSelections(collectionDetails);
- this.formGroup.patchValue({
- name,
- externalId: this.collection.externalId,
- parent,
- access: accessSelections,
- });
- } else {
- this.nestOptions = collections;
- const parent = collections.find((c) => c.id === this.params.parentCollectionId);
- this.formGroup.patchValue({ parent: parent?.name ?? undefined });
+ this.loading = false;
}
-
- this.loading = false;
- });
+ );
}
protected get collectionId() {
@@ -202,12 +244,20 @@ export class CollectionDialogComponent implements OnInit, OnDestroy {
this.formGroup.markAllAsTouched();
if (this.formGroup.invalid) {
- if (this.tabIndex === CollectionDialogTabType.Access) {
+ const accessTabError = this.formGroup.controls.access.hasError("managePermissionRequired");
+
+ if (this.tabIndex === CollectionDialogTabType.Access && !accessTabError) {
this.platformUtilsService.showToast(
"error",
null,
this.i18nService.t("fieldOnTabRequiresAttention", this.i18nService.t("collectionInfo"))
);
+ } else if (this.tabIndex === CollectionDialogTabType.Info && accessTabError) {
+ this.platformUtilsService.showToast(
+ "error",
+ null,
+ this.i18nService.t("fieldOnTabRequiresAttention", this.i18nService.t("access"))
+ );
}
return;
}
@@ -284,32 +334,6 @@ function parseName(collection: CollectionView) {
return { name, parent };
}
-function mapGroupToAccessItemView(group: GroupView): AccessItemView {
- return {
- id: group.id,
- type: AccessItemType.Group,
- listName: group.name,
- labelName: group.name,
- accessAllItems: group.accessAll,
- readonly: group.accessAll,
- };
-}
-
-// TODO: Use view when user apis are migrated to a service
-function mapUserToAccessItemView(user: OrganizationUserUserDetailsResponse): AccessItemView {
- return {
- id: user.id,
- type: AccessItemType.Member,
- email: user.email,
- role: user.type,
- listName: user.name?.length > 0 ? `${user.name} (${user.email})` : user.email,
- labelName: user.name ?? user.email,
- status: user.status,
- accessAllItems: user.accessAll,
- readonly: user.accessAll,
- };
-}
-
function mapToAccessSelections(collectionDetails: CollectionAdminView): AccessItemValue[] {
if (collectionDetails == undefined) {
return [];
@@ -328,6 +352,16 @@ function mapToAccessSelections(collectionDetails: CollectionAdminView): AccessIt
);
}
+/**
+ * Validator to ensure that at least one access item has Manage permission
+ */
+function validateCanManagePermission(control: AbstractControl) {
+ const access = control.value as AccessItemValue[];
+ const hasManagePermission = access.some((a) => a.permission === CollectionPermission.Manage);
+
+ return hasManagePermission ? null : { managePermissionRequired: true };
+}
+
/**
* Strongly typed helper to open a CollectionDialog
* @param dialogService Instance of the dialog service that will be used to open the dialog
diff --git a/apps/web/src/app/vault/components/vault-items/vault-item-event.ts b/apps/web/src/app/vault/components/vault-items/vault-item-event.ts
index a72734d93da..b12076e3597 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-item-event.ts
+++ b/apps/web/src/app/vault/components/vault-items/vault-item-event.ts
@@ -6,6 +6,7 @@ import { VaultItem } from "./vault-item";
export type VaultItemEvent =
| { type: "viewAttachments"; item: CipherView }
| { type: "viewCollections"; item: CipherView }
+ | { type: "bulkEditCollectionAccess"; items: CollectionView[] }
| { type: "viewCollectionAccess"; item: CollectionView }
| { type: "viewEvents"; item: CipherView }
| { type: "editCollection"; item: CollectionView }
diff --git a/apps/web/src/app/vault/components/vault-items/vault-items.component.html b/apps/web/src/app/vault/components/vault-items/vault-items.component.html
index 4010ccced30..7430bbdbc87 100644
--- a/apps/web/src/app/vault/components/vault-items/vault-items.component.html
+++ b/apps/web/src/app/vault/components/vault-items/vault-items.component.html
@@ -34,6 +34,15 @@
{{ "moveSelected" | i18n }}
+