dani-garcia/vaultwarden · error

Error loading organization group full access information…

Error message

Error loading organization group full access information for user

What it means

Panic from `.expect()` on the Diesel query in `Group::get_orgs_by_user_with_full_access`, which joins users_organizations and groups to find orgs where the user's groups have `access_all = true`. A database-level failure aborts the call. The multi-table join makes this vulnerable to schema drift in any of the joined tables.

Solutions

1. Run pending migrations so groups and users_organizations schemas match the code
2. Verify DB connectivity and credentials
3. Check logs for the underlying Diesel error
4. Manually verify the join SQL runs against the backend if a dialect issue is suspected

Example fix

// before
.load::<OrganizationId>(conn).expect("Error loading organization group full access information for user")
// after
.load::<OrganizationId>(conn).unwrap_or_else(|e| { error!("full-access orgs query failed: {e}"); Vec::new() })

// ensure groups.access_all column exists
// SELECT access_all FROM groups LIMIT 1;

// pre-validate schema before join-heavy queries
if !column_exists("groups", "access_all").await { return Vec::new(); }
Group::get_orgs_by_user_with_full_access(user_uuid, conn).await

When it happens

Trigger: Calling `get_orgs_by_user_with_full_access` when the DB is down, `groups` or `users_organizations` lack expected columns (e.g. `access_all`), or the connection errors mid-query.

Common situations: Schema predating group support (missing groups/access_all columns) after upgrade without migrations; DB restart under load; dialect-specific DISTINCT/SELECT issues after switching backends.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• Error loading collection groups
• Error loading collections
• Error loading groups
• Error loading user collection groups
• Error creating organization API Key

AI-assisted analysis of dani-garcia/vaultwarden@cc67d644f6 (2026-09-19). Data as JSON: /api/errors/a57c9b4b1232462e. Report an issue: GitHub.

Appendix: source

Thrown at src/db/models/group.rs:256

    }
    //Returns all organizations the user has full access to
    pub async fn get_orgs_by_user_with_full_access(user_uuid: &UserId, conn: &DbConn) -> Vec<OrganizationId> {
        conn.run(move |conn| {
            groups_users::table
                .inner_join(
                    users_organizations::table.on(users_organizations::uuid.eq(groups_users::users_organizations_uuid)),
                )
                .inner_join(
                    groups::table.on(groups::uuid
                        .eq(groups_users::groups_uuid)
                        .and(groups::organizations_uuid.eq(users_organizations::org_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
                .filter(groups::access_all.eq(true))
                .select(groups::organizations_uuid)
                .distinct()
                .load::<OrganizationId>(conn)
                .expect("Error loading organization group full access information for user")
        })
        .await
    }

    pub async fn is_in_full_access_group(user_uuid: &UserId, org_uuid: &OrganizationId, conn: &DbConn) -> bool {
        conn.run(move |conn| {
            groups::table
                .inner_join(groups_users::table.on(groups_users::groups_uuid.eq(groups::uuid)))
                .inner_join(
                    users_organizations::table.on(users_organizations::uuid
                        .eq(groups_users::users_organizations_uuid)
                        .and(users_organizations::org_uuid.eq(groups::organizations_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
                .filter(groups::organizations_uuid.eq(org_uuid))
                .filter(groups::access_all.eq(true))
                .select(groups::access_all)
                .first::<bool>(conn)

View on GitHub (pinned to cc67d644f6)