Confused with the "Edit" and "Can Manage" permissions for collections

[zako577]

Hi!

I am a bit confused with the "Edit" and "Can Manage" permissions for an "User" in one collection.

• "Edit" permission is enough to be able to delete items of the collection?
• "Can Manage" permission must be provided to delete items of the collection? "Can Manage" provides additional permissions in the collection or in other collections (such as create new collections)?

I am reading the documentation of Bitwarden and
depending on the configuration of the organizacion "Edit" permission can delete items of the collection. However, I do not know (or I was not able to find) how vaultwarden decides to implement these "Edit" and "Can Manage" permissions.

[BlackDex]

Vaultwarden currently does not support the full range of RBAC/GBAC/CBAC or whatever it's called.

We still kinda uphold the old behavior of as much as possible.

• Admins and Owners can manage all and are by default a Can Manage on all collections.
• Managers can either manage everything, or just specific assigned collections.
• Users can only have an Edit role as they do not have the proper rights to manage collections.

If a user is a member of a group which assigned a Can Manage role to a collection, then we will downgrade that to Edit
Users need Edit roles to be able to adjust and delete vault items.

[zako577]

My mess is because in previous versions of vaultwarden Users with Edit role were unable to delete items in the collection via bitwarden applications and sometimes vaultwarden web. I did not know if it was a bug (User with Edit role should be able to delete items in the collection) or if the Edit role was modified and to delete items the Can Manage role was required. Because that is possible to configure in Bitwarden.

So, thanks to your answer, I understand that User with Edit role must be allowed to delete items in a collection.

[BlackDex]

Previous versions had a bug which was solved.
See #6004

[dkoukoutsis]

I have some similar questions, I see the Manager role does not exist in the latest version (1.34.3).
How can a user be given the "Manage Collection" and be able to Edit Access to that collection or create a nested one.
If he has the "User" role he can only edit items. If he's given the "Custom" role, he instantly gains "Manage Access" to all collections where he has the Edit or Manage collection role.
I expect what many admins want, is to be able to grant, to the same user, the Edit Role on some collections (just to edit and delete items) but on the same time, the Manage Collection on others (to be able to manage access and create nested collections).
Is there currently any way to achieve that?

[BlackDex]

No, not until we have converted everything to fully support the roles, which Vaultwarden currently does not.