Bitwarden Version and Config Endpoint

[Hinton]

Hi everyone!

The Bitwarden team is currently working on finalizing the specification of a version and configuration endpoint. This endpoint will allow us to iterate quicker with new server functionality, improve bug reporting, and to configure client capabilities such as disabling user registration or display maintenance alerts.

Alongside these changes we are also adding a server field which would contain a name and url of the server implementation, which can be used for third-party servers. This information would be used only to inform the users they are using a non-official server for bug reporting purposes. Currently be shown on the about page in each client.

We understand that third-party servers have no obligation to implement the server field, but we would like to ask if this project would be willing to do so, since knowing the server implementation and version will be helpful in bug triaging which we believe will ultimately benefit everyone. This would replace the currently unused unofficialServer field that vaultwarden provides in identity tokens and sync responses.

Below is the current draft of the response from the endpoint

// /api/config
{
  "version": "1.50.0",
  "gitHash": "ec9dd8e",
  "server": {
    "name": "Vaultwarden",
    "url": "https://github.com/dani-garcia/vaultwarden"
  },
  "environment": [
    "api": "https://bitwarden.com/api",
    ...
  ],
  "config": { // Example configurations
    "disableUserRegistration": true,
    "attachmentFilesize": "500MB",
    "sendFilesize": "500MB",
    "alerts": [
	  {
	    "type": "warning",
	    "title": "Planned Maintenance Window",
	    "body": "Today 09:00 UTC"
	  }
    ]
  }
}

Let me know if you have any thoughts or questions related to this.

[BlackDex]

@Hinton,

Thanks for the heads-up.

Is there a bitwarden/web version we can already use to test this out?
If not having that specific endpoint, will that break the whole web-vault (or any other clients for that matter?)
Since we do not have that endpoint currently.

[Hinton]

We haven't begun implementing it yet, it's in the late planning stages. So we don't have anything available for testing and it's most likely a few releases away still.

Typically the web vault is released in lock with the server but as the other clients don't have that luxury we will need to gracefully handle the endpoint not existing for the other clients, which likely means the web vault should also support it. We'll know more once we begin implementing it.

[Hinton]

This has taken a while, but we now have the initial config endpoint, which got merged in bitwarden/server#2130.

The clients expects the following format:

{
  "version": "1.50.0",
  "gitHash": "ec9dd8e",
  "server": {
    "name": "Third Party Bitwarden Server",
    "url": "https://example.com/third-party-bitwarden-server"
  },
  "environment": [
      "vault": "",
      "api": "",
      "identity": "",
      "notifications": "",
      "sso": "",
  ]
}

And it's currently implemented in the browser extension which got merged in bitwarden/clients#3223. It currently only affects the about page where we display the server version + a small disclaimer asking the users to confirm with the Bitwarden server implementation before reporting bugs to our issue tracker.

We're hoping to add support to desktop and mobile in a bit + add the settings in the future.

[dani-garcia]

I've implemented it now on 818b254 it seems to be working on the browser extension as you mention:

I've had an issue with case sensitivity on linux when building the browser extension, as an import seems to have a different name than the file it represents and had to apply this patch (noOp -> noop):

--- a/apps/browser/src/listeners/onCommandListener.ts
+++ b/apps/browser/src/listeners/onCommandListener.ts
@@ -5,7 +5,7 @@ import { AuthService } from "@bitwarden/common/services/auth.service";
 import { CipherService } from "@bitwarden/common/services/cipher.service";
 import { ConsoleLogService } from "@bitwarden/common/services/consoleLog.service";
 import { EncryptService } from "@bitwarden/common/services/encrypt.service";
-import NoOpEventService from "@bitwarden/common/services/noOpEvent.service";
+import NoOpEventService from "@bitwarden/common/services/noopEvent.service";
 import { SearchService } from "@bitwarden/common/services/search.service";
 import { SettingsService } from "@bitwarden/common/services/settings.service";
 import { StateMigrationService } from "@bitwarden/common/services/stateMigration.service";

[Hinton]

Thanks for letting me know @dani-garcia. I've forwarded it to the team and it should be fixed shortly. I really don't like mixed casing in filenames.

[Hinton]

Fixed in bitwarden/clients#3468

[jjlin]

@Hinton

"config": { // Example configurations
  "disableUserRegistration": true,
  ...
}

I assume "disableUserRegistration": true would cause the Create Account button on the login page to be hidden or disabled?

It would also be nice to have "trashAutoDeleteDays": 30 show the warning message

     ⚠️ Items that have been in Trash more than 30 days will be automatically deleted.

while "trashAutoDeleteDays": null might show an info message like

     ℹ️ Automatic deletion of items in Trash is disabled.

[Hinton]

The config functionality is not yet implemented, but it will be something we will continually improve in the future.