Collection & CollectionCipher

Collections are organization-scoped buckets of ciphers. They are the only way to share ciphers inside an organisation; personal vaults use Folder instead.

Entities

• Collection (src/Core/AdminConsole/Entities/Collection.cs) — Id, OrganizationId, Name (encrypted), ExternalId (for SCIM mapping), RevisionDate, CreationDate. Persisted to dbo.Collection.
• CollectionCipher (src/Core/Entities/CollectionCipher.cs) — many-to-many between Collection and Cipher.
• CollectionUser (src/Core/AdminConsole/Entities/CollectionUser.cs) — direct member access: CollectionId, OrganizationUserId, ReadOnly, HidePasswords, Manage.
• CollectionGroup (src/Core/AdminConsole/Entities/CollectionGroup.cs) — group access with the same flags.

Permission flags

Flag	Meaning
ReadOnly	Caller may view but not edit.
HidePasswords	Caller may use ciphers (e.g. autofill) but not see plaintext-decryptable secrets like the password field.
Manage	Caller may add / remove ciphers and change permissions.

The effective permission is the OR of all paths from the user to the collection (direct CollectionUser row + every Group they're in via CollectionGroup).

Authorization handlers

BulkCollectionAuthorizationHandler and friends in src/Core/Vault/AuthorizationHandlers/ materialise the access graph for a request and cache it on the ICurrentContext. Authorization decisions on cipher CRUD use those preloaded permissions instead of re-querying.

Stored procedures

• Collection_ReadByUserId, Collection_ReadByOrganizationId.
• CollectionCipher_UpdateCollections, CollectionCipher_UpdateCollectionsForCiphers — bulk updates for sharing.
• CollectionUser_Update, CollectionGroup_Update.

Recent work

• Move collections to AC ownership — PR #7532 (2026-04-22) renamed namespaces.
• Bump Group.RevisionDate on edits and access changes — PR #7467 (2026-04-04) ensures sync.

Where it shows up

• See vault-and-ciphers for cipher-collection interactions.
• See organizations-and-policies for how memberships and groups feed in.