Add partial role support for manager only using web-vault v2024.12.0

[BlackDex]

• Add the custom role which replaces the manager role
• Added mini-details endpoint used by v2024.12.0

These changes try to add the custom role in such a way that it stays compatible with the older manager role. It will convert a manager role into a custom role, and if a manager has access-all rights, it will enable the correct custom roles. Upon saving it will convert these back to the old format.

What this does is making sure you are able to revert back to an older version of Vaultwarden without issues. This way we can support newer web-vault's and still be compatible with a previous Vaultwarden version if needed.

In the future this needs to be changed to full role support though.

[BlackDex]

This PR needs a web-vault built from this PR dani-garcia/bw_web_builds#186
I'm have yet to fix the CSS, since it now still hides some elements which need to be visible.

But it would be nice if some people are able to test this PR using a web-vault built from the PR linked above.

[tessus]

In the future this needs to be changed to full role support though.

May I suggest to add more comments to the code, where your changes from this PR have to be reverted when full role support is implemented. Unless you you'll keep the compat layer even then.

It is quite possible to forget to remove/change current code/behavior when the "future" changes are not close to this PR. Please ignore, if I am way off.

[BlackDex]

@tessus done :)

@stefan0xC I have fixed the icon in the collapsed menu.

[BlackDex]

As mentioned before, this PR needs a new web-vault version for which a PR can be found here:

• Update to v2024.12 and Dynamic CSS bw_web_builds#186

CI builds of this web-vault can be downloaded here:

• https://github.com/dani-garcia/bw_web_builds/actions/runs/12017534352 in the artifacts section.

[tessus]

If this is the only PR required for the new web vault, is it possible to merge this and then release the new web vault - maybe this weekend?
I've been running it (and the web vault from the artifact link) for a few days now and didn't run into any issues. Although I am sure I haven't tested all edge cases and every single functionality.

[BlackDex]

I'd rather first fix a native client issue and release a version and after that merge this.

I also think it is better to first release the web-vault and then add that release to this PR.

[dfunkt]

Not sure if this belongs here or in the web vault PR, but I seem to be offered the option to log in with a passkey (which obviously doesn't work):

[BlackDex]

Not sure if this belongs here or in the web vault PR, but I seem to be offered the option to log in with a passkey (which obviously doesn't work):

Thanks! I fixed it just now.

[dfunkt]

Now that I think about it, shouldn't the create account line also be hidden? I have signups disabled.

[BlackDex]

Now that I think about it, shouldn't the create account line also be hidden? I have signups disabled.

Also fixed now :)

[BlackDex]

I'm checking to see if we can update to v2024.12.0. There seem to be some minor changes and some endpoints added.

[BlackDex]

Code is adjusted to support v2024.12.0 now. Not too much changed.

[tessus]

I'd rather first fix a native client issue and release a version and after that merge this.

The native client issue has been fixed and a new version has been released.

Is it possible to merge this now and release the new web-vault 2024.12.0 (or the other way around as you suggested)?

[larena1]

I'd rather first fix a native client issue and release a version and after that merge this.

The native client issue has been fixed and a new version has been released.

Is it possible to merge this now and release the new web-vault 2024.12.0 (or the other way around as you suggested)?

What's the matter with you and the new web vault version? Isn't the current one working for you?

If not then just try to build and run it yourself

[BlackDex]

@stefan0xC What happens then exactly?
It doesn't work? And is it mixed with with an accessAll?

[stefan0xC]

@stefan0xC What happens then exactly? It doesn't work? And is it mixed with with an accessAll?

The exception happened when I tried to open the Custom user member (which used to be a Manager role without accessAll) or the group. But now after changing the group I can't seem to be able to replicate the issue anymore, even if I change the permissions back.

edit: I'm unable to reproduce the issue. It might have been caused by using an in-between version of the web-vault...

[BlackDex]

@stefan0xC & @dfunkt, i have been testing a bit more, but i can't find anything strange my self.
If you have anything which should be solved or issues encountered, please let me know, else will try to merge this soonisch.

[stefan0xC]

I don't think I can find anything else. I mean that a Manager that does not have access to all collection will not have access to the admin console is probably expected. One question I would have left is if we should not make this a permanent change and save the manage permission in the CollectionUser / GroupUser relations accordingly? Since that seems a bit weird to just keep deriving it. But I wonder if that's possible without implementing custom permissions as well.

[BlackDex]

I'd rather do that while implementing the other rights too.
Because it also need some auth/header rights changes too.

[dfunkt]

I've been using this PR for the past few weeks, no further problems to report.