{"record":{"id":"a57c9b4b1232462e","repo":"dani-garcia/vaultwarden","slug":"error-loading-organization-group-full-access-information-for","errorCode":null,"errorMessage":"Error loading organization group full access information for user","messagePattern":"Error loading organization group full access information for user","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/db/models/group.rs","lineNumber":256,"sourceCode":"    }\n    //Returns all organizations the user has full access to\n    pub async fn get_orgs_by_user_with_full_access(user_uuid: &UserId, conn: &DbConn) -> Vec<OrganizationId> {\n        conn.run(move |conn| {\n            groups_users::table\n                .inner_join(\n                    users_organizations::table.on(users_organizations::uuid.eq(groups_users::users_organizations_uuid)),\n                )\n                .inner_join(\n                    groups::table.on(groups::uuid\n                        .eq(groups_users::groups_uuid)\n                        .and(groups::organizations_uuid.eq(users_organizations::org_uuid))),\n                )\n                .filter(users_organizations::user_uuid.eq(user_uuid))\n                .filter(groups::access_all.eq(true))\n                .select(groups::organizations_uuid)\n                .distinct()\n                .load::<OrganizationId>(conn)\n                .expect(\"Error loading organization group full access information for user\")\n        })\n        .await\n    }\n\n    pub async fn is_in_full_access_group(user_uuid: &UserId, org_uuid: &OrganizationId, conn: &DbConn) -> bool {\n        conn.run(move |conn| {\n            groups::table\n                .inner_join(groups_users::table.on(groups_users::groups_uuid.eq(groups::uuid)))\n                .inner_join(\n                    users_organizations::table.on(users_organizations::uuid\n                        .eq(groups_users::users_organizations_uuid)\n                        .and(users_organizations::org_uuid.eq(groups::organizations_uuid))),\n                )\n                .filter(users_organizations::user_uuid.eq(user_uuid))\n                .filter(groups::organizations_uuid.eq(org_uuid))\n                .filter(groups::access_all.eq(true))\n                .select(groups::access_all)\n                .first::<bool>(conn)","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/dani-garcia/vaultwarden/blob/cc67d644f62605cb46f4d16c4a2eed1a861cc8bb/src/db/models/group.rs#L238-L274","documentation":"Panic from `.expect()` on the Diesel query in `Group::get_orgs_by_user_with_full_access`, which joins users_organizations and groups to find orgs where the user's groups have `access_all = true`. A database-level failure aborts the call. The multi-table join makes this vulnerable to schema drift in any of the joined tables.","triggerScenarios":"Calling `get_orgs_by_user_with_full_access` when the DB is down, `groups` or `users_organizations` lack expected columns (e.g. `access_all`), or the connection errors mid-query.","commonSituations":"Schema predating group support (missing groups/access_all columns) after upgrade without migrations; DB restart under load; dialect-specific DISTINCT/SELECT issues after switching backends.","solutions":["Run pending migrations so groups and users_organizations schemas match the code","Verify DB connectivity and credentials","Check logs for the underlying Diesel error","Manually verify the join SQL runs against the backend if a dialect issue is suspected"],"exampleFix":"// before\n.load::<OrganizationId>(conn).expect(\"Error loading organization group full access information for user\")\n// after\n.load::<OrganizationId>(conn).unwrap_or_else(|e| { error!(\"full-access orgs query failed: {e}\"); Vec::new() })","handlingStrategy":"try-catch","validationCode":"// ensure groups.access_all column exists\n// SELECT access_all FROM groups LIMIT 1;","typeGuard":null,"tryCatchPattern":"// pre-validate schema before join-heavy queries\nif !column_exists(\"groups\", \"access_all\").await { return Vec::new(); }\nGroup::get_orgs_by_user_with_full_access(user_uuid, conn).await","preventionTips":["Check migration completeness after every upgrade","Keep users_organizations and groups migrations applied together","Test DISTINCT/join SQL against your actual backend (MySQL vs Postgres)","Log underlying Diesel errors to diagnose quickly"],"tags":["database","panic","groups","join"],"backgroundTag":"database-query-failed","analyzedSha":"cc67d644f62605cb46f4d16c4a2eed1a861cc8bb","analyzedAt":"2026-09-19T08:28:46.370Z","contentChangedAt":"2026-09-19T08:28:46.370Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}