update web-vault to v2024.6.2 and remove bitwarden_license/ from build

[stefan0xC]

New web-vault version: web-v2024.6.2

There were a lot of changes between v2024.5.1 and v2024.6.2

Since the payment method warning is now hidden behind a feature flag I've removed the code that patches it out (because the banner was also added to other parts of the code base and I think the patches are more maintainable this way). We might want to remove it manually again if the feature flag gets removed.

[BlackDex]

@stefan0xC, do we want to add the changes mentioned in #163 to this PR in a good way?
The main reason for not adding in the the previous one was that the tsconfig still had that path in it.
Since v2024.6.x that has been removed, and it now might be as easy as only removing that directory, and adding it to the exclude list for generating the patch.

[dfunkt]

Every time I sign in:

vaultwarden | [2024-06-19 12:25:35.493][request][INFO] GET /api/organizations/undefined/policies/token?token=undefined&email=undefine
vaultwarden | [2024-06-19 12:25:35.493][vaultwarden::auth][ERROR] Token is invalid
vaultwarden | [2024-06-19 12:25:35.493][response][INFO] (list_policies_token) GET /api/organizations/<org_id>/policies/token? => 400 Bad Request

The vault does load up nonetheless.

[stefan0xC]

@dfunkt That also happens on https://vault.bitwarden.com/

[stefan0xC]

Seems like the clients are now using the new /api/ciphers/<id>/collections_v2 endpoint:
bitwarden/clients@5075d08#diff-4c74e6c7632b75e87220181841dce1ffac6c0b1ba3430a2766c4def0fdc7decf

[BlackDex]

Seems like the clients are now using the new /api/ciphers/<id>/collections_v2 endpoint: bitwarden/clients@5075d08#diff-4c74e6c7632b75e87220181841dce1ffac6c0b1ba3430a2766c4def0fdc7decf

The other clients also seem to use this currently. dani-garcia/vaultwarden#4681
We probably need to fix this a.s.a.p.

[stefan0xC]

Updating to the new web-vault version (web-v2024.6.3) will take me a few days.

[stefan0xC]

The added logo (which is now used for the login screen) uses the tw-fill-text-headers class instead of tw-fill-primary-600 (as the Bitwarden logo does) to prevent a blue Vaultwarden logo (with light mode). As far as I've looked into it this tailwind color is not (yet) used anywhere in the web-vault (only in icons for the browser extension) so using it like this should be no problem for now.

[stefan0xC]

Since the web-vault requires a new endpoint I'd probably release a new vaultwarden version first before making a new bw_web_builds release (as some downstream packagers will always ship the latest release even if it's not compatible yet) or at least include a warning about that in the release notes.

[tessus]

It's impossible for a project to satisfy whetever policies they have downstream. While a new release might be a good idea anyway, I think just adding 2024.6.3 to the vw image might do the trick. In that case packagers will also understand the connection.

Btw, thanks for all your hard work. I will be in Austria this summer. Maybe I can buy you a beer...

[BlackDex]

It is also kinda chicken and egg issue here. Releasing a new Vaultwarden version should then be with an older web-vault.
After which we might want to release with the newer version just a day after or something.

We should just time it so that they are done on at least the same day.

[tessus]

IMO it is the packagers' responsibility to make sure that their packages are consistent and have dependencies in place. e.g. in RPM files you can do something like this...

This is from my webvault spec file:

Requires: vaultwarden >= 1.30.5^20240323.2d98aa30

The issue is, you cannot satisfy all requirements by all packagers or port systems. They have to make sure that their stuff is in order. It is not the upstream project dev's responsibility. Why? Because it is impossible. You might not even know all the downstream projects. Even if you do, where does it end? You have other things to worry about. While I understand the idea, it's still not doable, nor feasible.
e.g. if a packager releases something that does not work, it is not your fault, is it? Along the same lines, the same is true for packagers not releasing something.

You release when it's ready. The rest will fall into place.

[BlackDex]

I encountered some issues during testing, which is why I opted for not releasing this version.

Mainly viewing 2FA codes in the via the admin console interface doesn't seem to work.

Not sure if that is fixed if we build the current rc branch, which will be the next 2024.7 release soon.

It does seem to work on Bitwarden Cloud though.

[stefan0xC]

Mainly viewing 2FA codes in the via the admin console interface doesn't seem to work.

hm... that does not seem to work in v2024.5.1 either? I'll have to take a look what change of mine is responsible.

edit: seems like it's not a change of mine that is responsible but setting "productPlanType": 0 and also other values (like seats for the problem with the limited invitations that will be checked client-side).

[BlackDex]

Well 2024.7.0 is out anyways.

[stefan0xC]

Well 2024.7.0 is out anyways.

Sorry, I've been a bit busy lately. The new collapsible side menu needs some adjustment to the smaller vw logo because it's a) off-center and b) has the wrong color in admin-console in light mode:

Bitwarden does not have the issue because they use their bwi-shield icon which they provide via the bwi-font, or in other words:

bw_web_builds/patches/v2024.5.0.patch

Lines 765 to 774 in 26c122f

	+/* Replace the Bitwarden Shield at the top left with a Vaultwarden icon */
	+.bwi-shield:before {
	+ content: "" !important;
	+ width: 32px !important;
	+ height: 40px !important;
	+ display: block !important;
	+ background-image: url(../images/icon-white.png) !important;
	+ background-repeat: no-repeat;
	+ background-position-y: bottom;
	+}

has to be adapted/rewritten.

[dfunkt]

2024.7.0 has been pulled back anyway, apparently new releases are scheduled for next week:
https://www.reddit.com/r/Bitwarden/comments/1e6zsm9/answers_whats_going_on_with_the_latest_release/

[stefan0xC]

Ah, thanks. I was wondering about that (why they released it twice). I hadn't noticed that they have removed it.

[lukasj98]

Ah, thanks. I was wondering about that (why they released it twice). I hadn't noticed that they have removed it.

Now they are released again
2024.7.1

[lukasj98]

Maybe,directly implement 7.1 ?

[stefan0xC]

@lukasj98 I'm aware but what I said above #169 (comment) still applies.

[BlackDex]

Technically you should be able to use style-sheets from the html/css to adjust the style of a SVG.
But that might need adjustments to the SVG then too.

Not sure how that would work correctly, never tried that before.

[stefan0xC]

@BlackDex Well, Bitwarden moved from using a class to having two versions of the logo with fill="#175DDC" and fill="#FFF" (white). We don't have to follow what they do of course but it's maybe easier with fixed values (though that requires adaption of how we replace the two logos)).

[stefan0xC]

@BlackDex since the web-vault beginning with v2024.6.3 requires more changes to Vaultwarden, I've decided to downgrade the web-vault to v2024.6.2 for the time being, since that version seems to be still more compatible with Vaultwarden.

I've also backported bitwarden/clients@71e8fdb to allow enrollment in password recovery (dani-garcia/vaultwarden#4628). as far as I've tested it this works without any issues.

[BlackDex]

Nice! I just finished bulk collection endpoint, that seems to work.
I'll test this PR and see if there are any hold backs for releasing.

[dfunkt]

@stefan0xC: Check the VAULT_VERSION in your latest commits, you've seemingly reverted back to v2024.5.1.

[stefan0xC]

Every time I sign in:

vaultwarden | [2024-06-19 12:25:35.493][request][INFO] GET /api/organizations/undefined/policies/token?token=undefined&email=undefine
vaultwarden | [2024-06-19 12:25:35.493][vaultwarden::auth][ERROR] Token is invalid
vaultwarden | [2024-06-19 12:25:35.493][response][INFO] (list_policies_token) GET /api/organizations/<org_id>/policies/token? => 400 Bad Request

The vault does load up nonetheless.

hm. with v2024.6.2 this issue returns. I'll try to look if I can backport the fix for this too.

[lukasj98]

But why not 2024.7.1

[stefan0xC]

@lukasj98 see my comments above

[BlackDex]

Every time I sign in:

vaultwarden | [2024-06-19 12:25:35.493][request][INFO] GET /api/organizations/undefined/policies/token?token=undefined&email=undefine
vaultwarden | [2024-06-19 12:25:35.493][vaultwarden::auth][ERROR] Token is invalid
vaultwarden | [2024-06-19 12:25:35.493][response][INFO] (list_policies_token) GET /api/organizations/<org_id>/policies/token? => 400 Bad Request

The vault does load up nonetheless.

hm. with v2024.6.2 this issue returns. I'll try to look if I can backport the fix for this too.

I can solve this on the server-side. Tested it already so, not that big of an issue.

[ccben87]

New version out for web-vault v2024.7.3. The new version includes [PM-4154] Introduce Bulk Encrypt Service for Faster Unlock Times. I'm very keen to see this make it into Vaultwarden to see how much it improves performance!

[stefan0xC]

@ccben87 you mean web-v2024.7.3? I'll probably open a new PR once this is one has been merged.

[ccben87]

@ccben87 you mean web-v2024.7.3? I'll probably open a new PR once this is one has been merged.

Ah, yes, my bad. I made a typo. I meant to say 2024.7.3. I've edited my prior comment to prevent confusion.