Merge ebebf3b865 into 2697fe8aba

src/api/core/ciphers.rs

@@ -86,6 +86,7 @@ pub fn routes() -> Vec<Route> {
         post_collections_update,
         post_collections_admin,
         put_collections_admin,
+        post_bulk_collections
     ]
 }
 
@@ -724,6 +725,19 @@ struct CollectionsAdminData {
     collection_ids: Vec<CollectionId>,
 }
 
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct BulkCollectionsData {
+    #[serde(alias = "OrganizationId")]
+    organization_id: OrganizationId,
+    #[serde(alias = "CollectionIds")]
+    collection_ids: Vec<CollectionId>,
+    #[serde(alias = "CipherIds")]
+    cipher_ids: Vec<CipherId>,
+    #[serde(alias = "RemoveCollections")]
+    remove_collections: bool,
+}
+
 #[put("/ciphers/<cipher_id>/collections_v2", data = "<data>")]
 async fn put_collections2_update(
     cipher_id: CipherId,
@@ -751,6 +765,66 @@ async fn post_collections2_update(
     })))
 }
 
+#[post("/ciphers/bulk_collections", data = "<data>")]
+async fn post_bulk_collections(
+    data: Json<BulkCollectionsData>,
+    headers: Headers,
+    mut conn: DbConn,
+    nt: Notify<'_>,
+) -> EmptyResult {
+    let data: BulkCollectionsData = data.into_inner();
+
+    for cipher in &data.cipher_ids {
+        let Some(cipher) = Cipher::find_by_uuid(cipher, &mut conn).await else {
+            err!("Cipher doesn't exist")
+        };
+
+        if !cipher.is_write_accessible_to_user(&headers.user.uuid, &mut conn).await {
+            err!("Cipher is not write accessible")
+        }
+
+        for collection in &data.collection_ids {
+            match Collection::find_by_uuid_and_org(collection, &data.organization_id, &mut conn).await {
+                None => err!("Invalid collection ID provided"),
+                Some(collection) => {
+                    if collection.is_writable_by_user(&headers.user.uuid, &mut conn).await {
+                        if data.remove_collections {
+                            CollectionCipher::delete(&cipher.uuid, &collection.uuid, &mut conn).await?;
+                        } else {
+                            CollectionCipher::save(&cipher.uuid, &collection.uuid, &mut conn).await?;
+                        }
+                    } else {
+                        err!("No rights to modify the collection")
+                    }
+                }
+            }
+        }
+
+        nt.send_cipher_update(
+            UpdateType::SyncCipherUpdate,
+            &cipher,
+            &cipher.update_users_revision(&mut conn).await,
+            &headers.device.uuid,
+            Some(data.collection_ids.clone()),
+            &mut conn,
+        )
+        .await;
+    
+        log_event(
+            EventType::CipherUpdatedCollections as i32,
+            &cipher.uuid,
+            &cipher.organization_uuid.clone().unwrap(),
+            &headers.user.uuid,
+            headers.device.atype,
+            &headers.ip.ip,
+            &mut conn,
+        )
+        .await;
+    }
+
+    Ok(())
+}
+
 #[put("/ciphers/<cipher_id>/collections", data = "<data>")]
 async fn put_collections_update(
     cipher_id: CipherId,