Email notification to the Send owner when a Send gets downloaded

[KosukeFukumori]

Problem

When sharing a file or text via Send, the owner currently has no way of knowing whether the recipient has actually retrieved it. The accessCount field exists, but you have to open the vault and check it manually. Especially for Sends with a short deletion date, it would be useful to know "the recipient got it, I can stop worrying" — similar to the download notifications offered by common file transfer services.

Proposal

A new Vaultwarden-specific global setting SEND_DOWNLOAD_NOTIFY (default: off) which, when enabled, notifies the owner of a Send via email when a recipient downloads it (file Sends, triggered when the download URL gets requested) or views it (text Sends):

• off: no notification (default, current behavior)
• always: notify on every download/view, including the current access count
• first: only notify on the first download/view of each Send

The notification only contains metadata the server already knows (date, IP address, send type, send id, creation date, access count). Since the Send name and contents are encrypted client-side and the server cannot decrypt them, the zero-knowledge design is not affected.

Implementation notes

I have a working implementation ready to submit as a PR:

• Server-only: no web-vault or client changes required, works with both the new send-access-token flow (web-2026.6.0+) and the legacy endpoints
• No DB migration: reuses the existing access_count for the "first" detection
• Opt-in via config (env var or admin page), validated like SMTP_SECURITY
• Mails are sent asynchronously (tokio::spawn), so recipients are never blocked or informed about the notification
• One known limitation: with the new token flow, access_count increments when the access token gets issued, so in first mode a file Send whose page was opened repeatedly without downloading won't trigger a notification on the eventual first download

Would this feature be acceptable for upstream? Happy to open the PR and adjust the design based on feedback.

[RaphaelRoumezin]

This sounds like a good feature, but this project usually tries to not go ahead of the Bitwarden features, as it's already behind. Plus, this would be a better feature if it was configurable by the end user, which is out of scope for this repo.
And I also hardly see Bitwarden having a feature like that, as it would not be very privacy-oriented. Having the Sends system-logged when opened could be interesting though, for auditing purposes.
So I don't really see it as something that could get merged, but I'm not a maintainer, so don't take my word for it.