Restrict the possibility for users to clear the recycle bin

[RaphaelRoumezin]

In my deployment, I've restricted the user capacity to empty the recycle bin manually through Nginx rules, which can now only be done by the trash auto-emptying server routine:

    map "$request_method:$uri" $request_blocklist_user {
        default 0;
        # These rules block API endpoints for emptying trash
        # Made to match the endpoints labeled as "permanent delete" in the source
        # See functions at https://github.com/dani-garcia/vaultwarden/blob/main/src/api/core/ciphers.rs#L1454
        ~^POST:/api/ciphers/[0-9a-f\-]+/delete 1;
        ~^DELETE:/api/ciphers 1;
        ~^POST:/api/ciphers/delete 1;
    }

    if ($request_blocklist_user) {
        return 400;
    }

In an enterprise context, this allows for mistake recovery, and prevents bad actors from deleting credentials that may ultimately only be stored on Vaultwarden. This pairs well with the password history feature.

Would this feature be interesting to integrate directly to Vaultwarden, as a server-wide configuration ? I'd be happy to make a PR for it.

[stefan0xC]

I think there is a collection management option "Restrict item deletion to members with the Manage collection permission." which we currently don't support. If you could create a PR to implement this I think that would be great.

[RaphaelRoumezin]

Implementing those last 3 options seems doable, but I believe the first option "Allow owners and admins to manage all collections and items from the Admin Console" is already the case in the current implementation.
If it is the case, should I still implement it, and maybe set it to 1 by default, because otherwise this might break some installations ?

[stefan0xC]

It currently is the case yes so it would be turned on but Bitwarden also allows to toggle this option off. I believe they handle this case by checking if there are users or groups that have the Can manage before restricting owners for a collection but we could also make this not configurable yet if you want to keep the scope of your PR a bit more manageable.

[RaphaelRoumezin]

Started working in #7452

[RaphaelRoumezin]

Also, this doesn't really match what I wanted in the first place, which is to be able to allow soft delete but prevent hard delete, and only leave the trash cleaning server routine the ability to permanently delete credentials.