{"record":{"id":"bade0ef62830eb0c","repo":"dani-garcia/vaultwarden","slug":"grantee-email-does-not-exists","errorCode":null,"errorMessage":"Grantee email does not exists","messagePattern":"Grantee email does not exists","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/api/core/emergency_access.rs","lineNumber":266,"sourceCode":"    if EmergencyAccess::find_by_grantor_uuid_and_grantee_uuid_or_email(\n        &grantor_user.uuid,\n        &grantee_user.uuid,\n        &grantee_user.email,\n        &conn,\n    )\n    .await\n    .is_some()\n    {\n        err!(format!(\"Grantee user already invited: {}\", &grantee_user.email))\n    }\n\n    let mut new_emergency_access =\n        EmergencyAccess::new(grantor_user.uuid, grantee_user.email, emergency_access_status, new_type, wait_time_days);\n    new_emergency_access.save(&conn).await?;\n\n    if CONFIG.mail_enabled() {\n        mail::send_emergency_access_invite(\n            &new_emergency_access.email.expect(\"Grantee email does not exists\"),\n            grantee_user.uuid,\n            new_emergency_access.uuid,\n            &grantor_user.name,\n            &grantor_user.email,\n        )\n        .await?;\n    } else if !new_user {\n        // if mail is not enabled immediately accept the invitation for existing users\n        new_emergency_access.accept_invite(&grantee_user.uuid, &email, &conn).await?;\n    }\n\n    Ok(())\n}\n\n#[post(\"/emergency-access/<emer_id>/reinvite\")]\nasync fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, conn: DbConn) -> EmptyResult {\n    check_emergency_access_enabled()?;\n","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/dani-garcia/vaultwarden/blob/0cefa4cca7c9f2a5579dd290f78193b543818c51/src/api/core/emergency_access.rs#L248-L284","documentation":"POST /emergency-access/invite with mail enabled: the invite is stored via EmergencyAccess::new(grantor_uuid, grantee_user.email /* String */, ...), which stores Some(email); the later new_emergency_access.email.expect(\"Grantee email does not exists\") is therefore a defensive branch that cannot fire on this code path. If a future refactor or a pre-existing row with NULL email made it fire, the invite request would panic while sending the notification mail.","triggerScenarios":"Not reachable through the current invite flow (email is always Some here). Would require rows with NULL email from manual edits, or EmergencyAccess::new changing to accept Option<String>.","commonSituations":"Surfaces in static analysis / panic audits rather than production logs; NULL-email rows could only come from direct DB tampering or migration glitches.","solutions":["No action needed for normal operation","If auditing: verify no NULL emails with SELECT uuid FROM emergency_access WHERE email IS NULL","Code hardening: replace .expect with a graceful error path"],"exampleFix":"// before\n&new_emergency_access.email.expect(\"Grantee email does not exists\"),\n// after\nmatch new_emergency_access.email.as_deref() {\n    Some(email) => email,\n    None => err!(\"Grantee email missing on emergency access invite\"),\n},","handlingStrategy":"validation","validationCode":"-- Detect rows that would trip the branch (should return zero rows)\nSELECT uuid, email FROM emergency_access WHERE email IS NULL OR email = '';","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never NULL out emergency_access.email in manual edits","Keep invite flows on the standard API","Re-run the check query after restores or migrations"],"tags":["rust","emergency-access","email","dead-code","defensive"],"backgroundTag":null,"analyzedSha":"0cefa4cca7c9f2a5579dd290f78193b543818c51","analyzedAt":"2026-08-16T07:44:56.102Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}