Remove legacy API endpoints and compatibility code dropped upstream (#7809)

Remove endpoints, response fields, feature flags and compatibility code
that upstream Bitwarden has removed and that no current client uses:

- Legacy POST /identity/accounts/register and POST /api/accounts/prelogin;
  register/finish is rate limited like the other unauthenticated endpoints.
- Legacy organization routes: PUT groups/{id}/users, PUT policies/{type}/vnext,
  PUT users/{id}/reset-password, GET billing/metadata, and the POST aliases of
  the organization, collection, group and member PUT/DELETE routes.
- POST /two-factor/disable (PUT stays).
- ResetMasterPassword, captchaBypassToken, the legacy registration name field,
  userIsManagedByOrganization/managedByOrganization and accessAll.
- The automatic email 2FA code for clients older than 2025.5.0.
- DUO_USE_IFRAME and the Duo Traditional Prompt code.
- Experimental client feature flags that no client reads anymore.
- Web vault CSS selectors for web vaults older than 2025.5.1.

Also accept the PascalCase fields Android 2026.9.0+ sends on registration
and password change, and align a few account, login/2FA and organization
checks with upstream.

Adds tests for the registration body formats.

src/api/core/accounts.rs

@@ -59,7 +59,6 @@ pub fn routes() -> Vec<rocket::Route> {
         delete_account,
         revision_date,
         password_hint,
-        post_prelogin,
         verify_password,
         post_api_key,
         rotate_api_key,
@@ -106,11 +105,8 @@ pub struct RegisterData {
 
     master_password_hint: Option<String>,
 
-    name: Option<String>,
-
     organization_user_id: Option<MembershipId>,
 
-    // Used only from the register/finish endpoint
     email_verification_token: Option<String>,
     accept_emergency_access_id: Option<EmergencyAccessId>,
     accept_emergency_access_invite_token: Option<String>,
@@ -163,7 +159,9 @@ struct RegisterDataOld {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RegisterDataCur {
+    #[serde(alias = "MasterPasswordAuthentication")]
     master_password_authentication: MasterPasswordAuthentication,
+    #[serde(alias = "MasterPasswordUnlock")]
     master_password_unlock: MasterPasswordUnlock,
 }
 
@@ -197,10 +195,12 @@ struct KeysData {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct MasterPasswordAuthentication {
+    #[serde(alias = "Kdf")]
     kdf: KDFData,
+    #[serde(alias = "Salt")]
     salt: String,
 
-    #[serde(alias = "masterPasswordAuthenticationHash")]
+    #[serde(alias = "masterPasswordAuthenticationHash", alias = "MasterPasswordAuthenticationHash")]
     hash: String,
 }
 
@@ -257,12 +257,11 @@ async fn is_email_2fa_required(member_id: Option<MembershipId>, conn: &DbConn) -
     false
 }
 
-pub async fn register(data: Json<RegisterData>, email_verification: bool, conn: DbConn) -> JsonResult {
-    let mut data: RegisterData = data.into_inner();
+pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
+    let data: RegisterData = data.into_inner();
     let email = data.email.to_lowercase();
 
-    let mut email_verified = false;
-
+    let mut name = None;
     let mut pending_emergency_access = None;
 
     if data.unprocessable() {
@@ -270,69 +269,65 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
     }
 
     // First, validate the provided verification tokens
-    if email_verification {
-        match (
-            &data.email_verification_token,
-            &data.accept_emergency_access_id,
-            &data.accept_emergency_access_invite_token,
-            &data.organization_user_id,
-            &data.org_invite_token,
-        ) {
-            // Normal user registration, when email verification is required
-            (Some(email_verification_token), None, None, None, None) => {
-                let claims = crate::auth::decode_register_verify(email_verification_token)?;
-                if claims.sub != data.email {
-                    err!("Email verification token does not match email");
-                }
-
-                // During this call we don't get the name, so extract it from the claims
-                if claims.name.is_some() {
-                    data.name = claims.name;
-                }
-                email_verified = claims.verified;
-            }
-            // Emergency access registration
-            (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => {
-                if !CONFIG.emergency_access_allowed() {
-                    err!("Emergency access is not enabled.")
-                }
-
-                let claims = crate::auth::decode_emergency_access_invite(accept_emergency_access_invite_token)?;
-
-                if claims.email != data.email {
-                    err!("Claim email does not match email")
-                }
-                if &claims.emer_id != accept_emergency_access_id {
-                    err!("Claim emer_id does not match accept_emergency_access_id")
-                }
-
-                pending_emergency_access = Some((accept_emergency_access_id, claims));
-                email_verified = true;
-            }
-            // Org invite
-            (None, None, None, Some(organization_user_id), Some(org_invite_token)) => {
-                let claims = decode_invite(org_invite_token)?;
-
-                if claims.email != data.email {
-                    err!("Claim email does not match email")
-                }
-
-                if &claims.member_id != organization_user_id {
-                    err!("Claim org_user_id does not match organization_user_id")
-                }
-
-                email_verified = true;
+    let mut email_verified = match (
+        &data.email_verification_token,
+        &data.accept_emergency_access_id,
+        &data.accept_emergency_access_invite_token,
+        &data.organization_user_id,
+        &data.org_invite_token,
+    ) {
+        // Normal user registration, when email verification is required
+        (Some(email_verification_token), None, None, None, None) => {
+            let claims = crate::auth::decode_register_verify(email_verification_token)?;
+            if claims.sub != data.email {
+                err!("Email verification token does not match email");
             }
 
-            _ => {
-                err!("Registration is missing required parameters")
-            }
+            // During this call we don't get the name, so extract it from the claims
+            name = claims.name;
+            claims.verified
         }
-    }
+        // Emergency access registration
+        (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => {
+            if !CONFIG.emergency_access_allowed() {
+                err!("Emergency access is not enabled.")
+            }
+
+            let claims = crate::auth::decode_emergency_access_invite(accept_emergency_access_invite_token)?;
+
+            if claims.email != data.email {
+                err!("Claim email does not match email")
+            }
+            if &claims.emer_id != accept_emergency_access_id {
+                err!("Claim emer_id does not match accept_emergency_access_id")
+            }
+
+            pending_emergency_access = Some((accept_emergency_access_id, claims));
+            true
+        }
+        // Org invite
+        (None, None, None, Some(organization_user_id), Some(org_invite_token)) => {
+            let claims = decode_invite(org_invite_token)?;
+
+            if claims.email != data.email {
+                err!("Claim email does not match email")
+            }
+
+            if &claims.member_id != organization_user_id {
+                err!("Claim org_user_id does not match organization_user_id")
+            }
+
+            true
+        }
+
+        _ => {
+            err!("Registration is missing required parameters")
+        }
+    };
 
     // Check if the length of the username exceeds 50 characters (Same is Upstream Bitwarden)
     // This also prevents issues with very long usernames causing to large JWT's. See #2419
-    if let Some(ref name) = data.name
+    if let Some(ref name) = name
         && name.len() > 50
     {
         err!("The field Name must be a string with a maximum length of 50.");
@@ -394,7 +389,7 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
     user.password_hint = password_hint;
 
     // Add extra fields if present
-    if let Some(name) = data.name {
+    if let Some(name) = name {
         user.name = name;
     }
 
@@ -432,8 +427,7 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
     }
 
     Ok(Json(json!({
-      "object": "register",
-      "captchaBypassToken": "",
+      "object": "registerFinish",
     })))
 }
 
@@ -442,7 +436,7 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
     let data: SetPasswordData = data.into_inner();
     let mut user = headers.user;
 
-    if user.private_key.is_some() {
+    if user.private_key.is_some() || !user.password_hash.is_empty() {
         err!("Account already initialized, cannot set password")
     }
 
@@ -496,7 +490,6 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
 
     Ok(Json(json!({
       "object": "set-password",
-      "captchaBypassToken": "",
     })))
 }
 
@@ -581,6 +574,10 @@ async fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> Json
 
     let mut user = headers.user;
 
+    if user.private_key.is_some() || user.public_key.is_some() {
+        err!("User has existing keypair")
+    }
+
     user.private_key = Some(data.encrypted_private_key);
     user.public_key = Some(data.public_key);
 
@@ -702,8 +699,11 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct AuthenticationData {
+    #[serde(alias = "Salt")]
     salt: String,
+    #[serde(alias = "Kdf")]
     kdf: KDFData,
+    #[serde(alias = "MasterPasswordAuthenticationHash")]
     master_password_authentication_hash: String,
 }
 
@@ -1360,11 +1360,6 @@ pub struct PreloginData {
     email: String,
 }
 
-#[post("/accounts/prelogin", data = "<data>")]
-async fn post_prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
-    prelogin(data, ip, conn).await
-}
-
 pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
     crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
 
@@ -1856,3 +1851,62 @@ pub async fn purge_auth_requests(pool: DbPool) {
         error!("Failed to get DB connection while purging auth requests");
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_register_data_current_format() {
+        // Web and iOS since the master password authentication/unlock split
+        let data: RegisterData = serde_json::from_str(
+            r#"{
+                "email": "user@example.com",
+                "emailVerificationToken": "token",
+                "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"},
+                "masterPasswordAuthentication": {
+                    "kdf": {"kdfType": 0, "iterations": 600000},
+                    "salt": "user@example.com",
+                    "masterPasswordAuthenticationHash": "hash"
+                },
+                "masterPasswordUnlock": {
+                    "kdf": {"kdfType": 0, "iterations": 600000},
+                    "salt": "user@example.com",
+                    "masterKeyWrappedUserKey": "key"
+                }
+            }"#,
+        )
+        .unwrap();
+
+        assert!(!data.unprocessable());
+        assert_eq!(data.hash(), "hash");
+        assert_eq!(data.key(), "key");
+        assert_eq!(data.kdf().kdf_iterations, 600_000);
+        assert!(data.keys.is_some());
+        assert_eq!(data.email_verification_token.as_deref(), Some("token"));
+    }
+
+    #[test]
+    fn test_register_data_flat_format() {
+        // Android before 2026.9.0
+        let data: RegisterData = serde_json::from_str(
+            r#"{
+                "email": "user@example.com",
+                "emailVerificationToken": "token",
+                "masterPasswordHash": "hash",
+                "masterPasswordHint": null,
+                "userSymmetricKey": "key",
+                "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"},
+                "kdf": 0,
+                "kdfIterations": 600000
+            }"#,
+        )
+        .unwrap();
+
+        assert!(!data.unprocessable());
+        assert_eq!(data.hash(), "hash");
+        assert_eq!(data.key(), "key");
+        assert_eq!(data.kdf().kdf_iterations, 600_000);
+        assert!(data.keys.is_some());
+    }
+}

src/api/core/ciphers.rs

@@ -1869,7 +1869,7 @@ async fn delete_cipher_by_uuid(
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct CipherIdsData {
-    ids: Vec<CipherId>,
+    ids: HashSet<CipherId>,
 }
 
 async fn delete_multiple_ciphers(

src/api/core/organizations.rs

@@ -15,10 +15,10 @@ use crate::{
     db::{
         DbConn,
         models::{
-            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType,
-            Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus, MembershipType,
-            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User,
-            UserId,
+            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, Device,
+            EventType, Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus,
+            MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor,
+            TwoFactorType, User, UserId,
         },
     },
     mail,
@@ -31,7 +31,6 @@ pub fn routes() -> Vec<Route> {
         get_organization,
         create_organization,
         delete_organization,
-        post_delete_organization,
         leave_organization,
         get_user_collections,
         get_org_collections,
@@ -39,13 +38,10 @@ pub fn routes() -> Vec<Route> {
         get_org_collection_detail,
         get_collection_users,
         put_organization,
-        post_organization,
         post_organization_collections,
         post_bulk_access_collections,
-        post_organization_collection_update,
         put_organization_collection_update,
         delete_organization_collection,
-        post_organization_collection_delete,
         bulk_delete_organization_collections,
         post_bulk_collections,
         get_org_details,
@@ -60,7 +56,6 @@ pub fn routes() -> Vec<Route> {
         get_org_user_mini_details,
         get_user,
         edit_member,
-        put_member,
         delete_member,
         bulk_delete_member,
         post_org_import,
@@ -70,7 +65,6 @@ pub fn routes() -> Vec<Route> {
         get_master_password_policy,
         get_policy,
         put_policy,
-        put_policy_vnext,
         get_plans,
         post_org_keys,
         get_organization_keys,
@@ -86,22 +80,16 @@ pub fn routes() -> Vec<Route> {
         post_groups,
         get_group,
         put_group,
-        post_group,
         get_group_details,
         delete_group,
-        post_delete_group,
         bulk_delete_groups,
         get_group_members,
-        put_group_members,
-        post_delete_group_member,
         put_reset_password_enrollment,
         get_reset_password_details,
-        put_reset_password,
         put_recover_account,
         get_org_export,
         post_api_key,
         rotate_api_key,
-        get_billing_metadata,
         get_billing_warnings,
         get_auto_enroll_status,
         get_self_host_billing_metadata,
@@ -245,16 +233,6 @@ async fn delete_organization(
     }
 }
 
-#[post("/organizations/<org_id>/delete", data = "<data>")]
-async fn post_delete_organization(
-    org_id: OrganizationId,
-    data: Json<PasswordOrOtpData>,
-    headers: OwnerHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    delete_organization(org_id, data, headers, conn).await
-}
-
 #[post("/organizations/<org_id>/leave")]
 async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> EmptyResult {
     if headers.membership.status != MembershipStatus::Confirmed as i32 {
@@ -300,16 +278,6 @@ async fn put_organization(
     headers: OwnerHeaders,
     data: Json<OrganizationUpdateData>,
     conn: DbConn,
-) -> JsonResult {
-    post_organization(org_id, headers, data, conn).await
-}
-
-#[post("/organizations/<org_id>", data = "<data>")]
-async fn post_organization(
-    org_id: OrganizationId,
-    headers: OwnerHeaders,
-    data: Json<OrganizationUpdateData>,
-    conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
         err!("Organization not found", "Organization id's do not match");
@@ -640,17 +608,6 @@ async fn put_organization_collection_update(
     headers: ManagerHeaders,
     data: Json<FullCollectionData>,
     conn: DbConn,
-) -> JsonResult {
-    post_organization_collection_update(org_id, col_id, headers, data, conn).await
-}
-
-#[post("/organizations/<org_id>/collections/<col_id>", data = "<data>", rank = 2)]
-async fn post_organization_collection_update(
-    org_id: OrganizationId,
-    col_id: CollectionId,
-    headers: ManagerHeaders,
-    data: Json<FullCollectionData>,
-    conn: DbConn,
 ) -> JsonResult {
     if org_id != headers.org_id {
         err!("Organization not found", "Organization id's do not match");
@@ -746,16 +703,6 @@ async fn delete_organization_collection(
     delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
 }
 
-#[post("/organizations/<org_id>/collections/<col_id>/delete")]
-async fn post_organization_collection_delete(
-    org_id: OrganizationId,
-    col_id: CollectionId,
-    headers: ManagerHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
-}
-
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "camelCase")]
 struct BulkCollectionIds {
@@ -1532,17 +1479,6 @@ struct EditUserData {
 }
 
 #[put("/organizations/<org_id>/users/<member_id>", data = "<data>", rank = 1)]
-async fn put_member(
-    org_id: OrganizationId,
-    member_id: MembershipId,
-    data: Json<EditUserData>,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    edit_member(org_id, member_id, data, headers, conn).await
-}
-
-#[post("/organizations/<org_id>/users/<member_id>", data = "<data>", rank = 1)]
 async fn edit_member(
     org_id: OrganizationId,
     member_id: MembershipId,
@@ -1922,7 +1858,7 @@ async fn post_org_import(
 #[serde(rename_all = "camelCase")]
 struct BulkCollectionsData {
     organization_id: OrganizationId,
-    cipher_ids: Vec<CipherId>,
+    cipher_ids: HashSet<CipherId>,
     collection_ids: HashSet<CollectionId>,
     remove_collections: bool,
 }
@@ -2201,18 +2137,6 @@ async fn put_policy(
     Ok(Json(policy.to_json()))
 }
 
-// Deprecated with client v2026.5.0
-#[put("/organizations/<org_id>/policies/<pol_type>/vnext", data = "<data>")]
-async fn put_policy_vnext(
-    org_id: OrganizationId,
-    pol_type: i32,
-    data: Json<PutPolicy>,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> JsonResult {
-    put_policy(org_id, pol_type, data, headers, conn).await
-}
-
 #[get("/plans")]
 fn get_plans() -> Json<Value> {
     // Respond with a minimal json just enough to allow the creation of an new organization.
@@ -2241,12 +2165,6 @@ fn get_plans() -> Json<Value> {
     }))
 }
 
-#[get("/organizations/<_org_id>/billing/metadata")]
-fn get_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json<Value> {
-    // Prevent a 404 error, which also causes Javascript errors.
-    Json(empty_data_json())
-}
-
 #[get("/organizations/<_org_id>/billing/vnext/warnings")]
 fn get_billing_warnings(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json<Value> {
     Json(json!({
@@ -2266,14 +2184,6 @@ fn get_self_host_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHe
     }))
 }
 
-fn empty_data_json() -> Value {
-    json!({
-        "object": "list",
-        "data": [],
-        "continuationToken": null
-    })
-}
-
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "camelCase")]
 struct BulkRevokeMembershipIds {
@@ -2592,17 +2502,6 @@ impl CollectionData {
     }
 }
 
-#[post("/organizations/<org_id>/groups/<group_id>", data = "<data>")]
-async fn post_group(
-    org_id: OrganizationId,
-    group_id: GroupId,
-    data: Json<GroupRequest>,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> JsonResult {
-    put_group(org_id, group_id, data, headers, conn).await
-}
-
 #[post("/organizations/<org_id>/groups", data = "<data>")]
 async fn post_groups(
     org_id: OrganizationId,
@@ -2712,7 +2611,6 @@ async fn add_update_group(
         "id": group.uuid,
         "organizationId": group.organizations_uuid,
         "name": group.name,
-        "accessAll": group.access_all,
         "externalId": group.external_id,
         "object": "group"
     })))
@@ -2739,16 +2637,6 @@ async fn get_group_details(
     Ok(Json(group.to_json_details(&conn).await))
 }
 
-#[post("/organizations/<org_id>/groups/<group_id>/delete")]
-async fn post_delete_group(
-    org_id: OrganizationId,
-    group_id: GroupId,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    delete_group_impl(&org_id, &group_id, &headers, &conn).await
-}
-
 #[delete("/organizations/<org_id>/groups/<group_id>")]
 async fn delete_group(org_id: OrganizationId, group_id: GroupId, headers: AdminHeaders, conn: DbConn) -> EmptyResult {
     delete_group_impl(&org_id, &group_id, &headers, &conn).await
@@ -2850,90 +2738,6 @@ async fn get_group_members(
     Ok(Json(json!(group_members)))
 }
 
-#[put("/organizations/<org_id>/groups/<group_id>/users", data = "<data>")]
-async fn put_group_members(
-    org_id: OrganizationId,
-    group_id: GroupId,
-    headers: AdminHeaders,
-    data: Json<Vec<MembershipId>>,
-    conn: DbConn,
-) -> EmptyResult {
-    if org_id != headers.org_id {
-        err!("Organization not found", "Organization id's do not match");
-    }
-    if !CONFIG.org_groups_enabled() {
-        err!("Group support is disabled");
-    }
-
-    if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() {
-        err!("Group could not be found!", "Group uuid is invalid or does not belong to the organization")
-    }
-
-    let assigned_members = data.into_inner();
-
-    let org_memberships = Membership::find_by_org(&org_id, &conn).await;
-    let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
-    if let Some(e) = assigned_members.iter().find(|m| !org_membership_ids.contains(m)) {
-        err!("Invalid member", format!("Member {} does not belong to organization {}!", e, org_id))
-    }
-
-    GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?;
-    for assigned_member in assigned_members {
-        let mut user_entry = GroupUser::new(group_id.clone(), assigned_member.clone());
-        user_entry.save(&conn).await?;
-
-        log_event(
-            EventType::OrganizationUserUpdatedGroups,
-            &assigned_member,
-            &org_id,
-            &headers.user.uuid,
-            headers.device.atype,
-            &headers.ip.ip,
-            &conn,
-        )
-        .await;
-    }
-
-    Ok(())
-}
-
-#[post("/organizations/<org_id>/groups/<group_id>/delete-user/<member_id>")]
-async fn post_delete_group_member(
-    org_id: OrganizationId,
-    group_id: GroupId,
-    member_id: MembershipId,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    if org_id != headers.org_id {
-        err!("Organization not found", "Organization id's do not match");
-    }
-    if !CONFIG.org_groups_enabled() {
-        err!("Group support is disabled");
-    }
-
-    if Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await.is_none() {
-        err!("User could not be found or does not belong to the organization.");
-    }
-
-    if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() {
-        err!("Group could not be found or does not belong to the organization.");
-    }
-
-    log_event(
-        EventType::OrganizationUserUpdatedGroups,
-        &member_id,
-        &org_id,
-        &headers.user.uuid,
-        headers.device.atype,
-        &headers.ip.ip,
-        &conn,
-    )
-    .await;
-
-    GroupUser::delete_by_group_and_member(&group_id, &member_id, &conn).await
-}
-
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserResetPasswordEnrollmentRequest {
@@ -2993,19 +2797,6 @@ async fn put_recover_account(
     recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
 }
 
-// Deprecated since `v2026.4.2`
-#[put("/organizations/<org_id>/users/<member_id>/reset-password", data = "<data>")]
-async fn put_reset_password(
-    org_id: OrganizationId,
-    member_id: MembershipId,
-    headers: AdminHeaders,
-    data: Json<OrganizationUserRecoverAccountRequest>,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> EmptyResult {
-    recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
-}
-
 async fn recover_account(
     org_id: OrganizationId,
     member_id: MembershipId,
@@ -3072,6 +2863,7 @@ async fn recover_account(
 
     if req.reset_two_factor {
         TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
+        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
         if !fallback_2fa_email || two_factor::email::find_and_activate_email_2fa(&user.uuid, &conn).await.is_err() {
             two_factor::enforce_2fa_policy(&user, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                 .await?;
@@ -3240,7 +3032,7 @@ async fn api_key(
     org_id: &OrganizationId,
     data: Json<PasswordOrOtpData>,
     rotate: bool,
-    headers: AdminHeaders,
+    headers: OwnerHeaders,
     conn: DbConn,
 ) -> JsonResult {
     if org_id != &headers.org_id {
@@ -3249,7 +3041,7 @@ async fn api_key(
     let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
 
-    // Validate the admin users password/otp
+    // Validate the owner users password/otp
     data.validate(&user, true, &conn).await?;
 
     let org_api_key = if let Some(mut org_api_key) = OrganizationApiKey::find_by_org_uuid(org_id, &conn).await {
@@ -3277,7 +3069,7 @@ async fn api_key(
 async fn post_api_key(
     org_id: OrganizationId,
     data: Json<PasswordOrOtpData>,
-    headers: AdminHeaders,
+    headers: OwnerHeaders,
     conn: DbConn,
 ) -> JsonResult {
     api_key(&org_id, data, false, headers, conn).await
@@ -3287,7 +3079,7 @@ async fn post_api_key(
 async fn rotate_api_key(
     org_id: OrganizationId,
     data: Json<PasswordOrOtpData>,
-    headers: AdminHeaders,
+    headers: OwnerHeaders,
     conn: DbConn,
 ) -> JsonResult {
     api_key(&org_id, data, true, headers, conn).await

src/api/core/two_factor/authenticator.rs

@@ -7,7 +7,7 @@ use crate::{
     crypto,
     db::{
         DbConn,
-        models::{EventType, TwoFactor, TwoFactorType, UserId},
+        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
     },
     util::NumberOrString,
 };
@@ -200,6 +200,7 @@ async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: He
     if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
         if twofactor.data == data.key {
             twofactor.delete(&conn).await?;
+            Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
             log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                 .await;
         } else {

src/api/core/two_factor/duo.rs

@@ -1,5 +1,4 @@
 use chrono::Utc;
-use data_encoding::BASE64;
 use rocket::{Route, serde::json::Json};
 
 use crate::{
@@ -222,13 +221,6 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
     Ok(())
 }
 
-const DUO_EXPIRE: i64 = 300;
-const APP_EXPIRE: i64 = 3600;
-
-const AUTH_PREFIX: &str = "AUTH";
-const DUO_PREFIX: &str = "TX";
-const APP_PREFIX: &str = "APP";
-
 async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
     let type_ = TwoFactorType::Duo as i32;
 
@@ -251,118 +243,13 @@ async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
     DuoStatus::Disabled(false)
 }
 
-// let (ik, sk, ak, host) = get_duo_keys();
-pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String, String)> {
+// let (ik, sk, host) = get_duo_keys_email();
+pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String)> {
     let data = match User::find_by_mail(email, conn).await {
         Some(u) => get_user_duo_data(&u.uuid, conn).await.data(),
         _ => DuoData::global(),
     }
     .map_res("Can't fetch Duo Keys")?;
 
-    Ok((data.ik, data.sk, CONFIG.get_duo_akey().await, data.host))
-}
-
-pub async fn generate_duo_signature(email: &str, conn: &DbConn) -> ApiResult<(String, String)> {
-    let now = Utc::now().timestamp();
-
-    let (ik, sk, ak, host) = get_duo_keys_email(email, conn).await?;
-
-    let duo_sign = sign_duo_values(&sk, email, &ik, DUO_PREFIX, now + DUO_EXPIRE);
-    let app_sign = sign_duo_values(&ak, email, &ik, APP_PREFIX, now + APP_EXPIRE);
-
-    Ok((format!("{duo_sign}:{app_sign}"), host))
-}
-
-fn sign_duo_values(key: &str, email: &str, ikey: &str, prefix: &str, expire: i64) -> String {
-    let val = format!("{email}|{ikey}|{expire}");
-    let cookie = format!("{prefix}|{}", BASE64.encode(val.as_bytes()));
-
-    format!("{cookie}|{}", crypto::hmac_sign(key, &cookie))
-}
-
-pub async fn validate_duo_login(email: &str, response: &str, conn: &DbConn) -> EmptyResult {
-    let split: Vec<&str> = response.split(':').collect();
-    if split.len() != 2 {
-        err!(
-            "Invalid response length",
-            ErrorEvent {
-                event: EventType::UserFailedLogIn2fa
-            }
-        );
-    }
-
-    let auth_sig = split[0];
-    let app_sig = split[1];
-
-    let now = Utc::now().timestamp();
-
-    let (ik, sk, ak, _host) = get_duo_keys_email(email, conn).await?;
-
-    let auth_user = parse_duo_values(&sk, auth_sig, &ik, AUTH_PREFIX, now)?;
-    let app_user = parse_duo_values(&ak, app_sig, &ik, APP_PREFIX, now)?;
-
-    if !crypto::ct_eq(&auth_user, app_user) || !crypto::ct_eq(&auth_user, email) {
-        err!(
-            "Error validating duo authentication",
-            ErrorEvent {
-                event: EventType::UserFailedLogIn2fa
-            }
-        )
-    }
-
-    Ok(())
-}
-
-fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -> ApiResult<String> {
-    let split: Vec<&str> = val.split('|').collect();
-    if split.len() != 3 {
-        err!("Invalid value length")
-    }
-
-    let u_prefix = split[0];
-    let u_b64 = split[1];
-    let u_sig = split[2];
-
-    let sig = crypto::hmac_sign(key, &format!("{u_prefix}|{u_b64}"));
-
-    if !crypto::ct_eq(crypto::hmac_sign(key, &sig), crypto::hmac_sign(key, u_sig)) {
-        err!("Duo signatures don't match")
-    }
-
-    if u_prefix != prefix {
-        err!("Prefixes don't match")
-    }
-
-    let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else {
-        err!("Invalid Duo cookie encoding")
-    };
-
-    let Ok(cookie) = String::from_utf8(cookie_vec) else {
-        err!("Invalid Duo cookie encoding")
-    };
-
-    let cookie_split: Vec<&str> = cookie.split('|').collect();
-    if cookie_split.len() != 3 {
-        err!("Invalid cookie length")
-    }
-
-    let username = cookie_split[0];
-    let u_ikey = cookie_split[1];
-    let expire = cookie_split[2];
-
-    if !crypto::ct_eq(ikey, u_ikey) {
-        err!("Invalid ikey")
-    }
-
-    let expire: i64 = if let Ok(e) = expire.parse() {
-        e
-    } else {
-        err!("Invalid expire time")
-    };
-
-    if time >= expire {
-        err!("Expired authorization")
-    }
-
-    Ok(username.into())
+    Ok((data.ik, data.sk, data.host))
 }

src/api/core/two_factor/duo_oidc.rs

@@ -383,7 +383,7 @@ pub async fn get_duo_auth_url(
     device_identifier: &DeviceId,
     conn: &DbConn,
 ) -> Result<String, Error> {
-    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
 
     let callback_url = match make_callback_url(client_id) {
         Ok(url) => url,
@@ -435,7 +435,7 @@ pub async fn validate_duo_login(
     let code = split[0];
     let state = split[1];
 
-    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
 
     // Get the context by the state reported by the client. If we don't have one,
     // it means the context is either missing or expired.

src/api/core/two_factor/email.rs

@@ -65,7 +65,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
         let Some(user) = User::find_by_mail(email, &conn).await else {
             err!(
                 "Username or password is incorrect. Try again",
-                format!("IP: {}. Username: {email}.", client_headers.ip.ip)
+                format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
             )
         };
 
@@ -74,7 +74,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
             if !user.check_valid_password(master_password_hash) {
                 err!(
                     "Username or password is incorrect. Try again",
-                    format!("IP: {}. Username: {email}.", client_headers.ip.ip)
+                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
                 )
             }
         } else if let Some(auth_request_id) = auth_request_id {
@@ -188,7 +188,7 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
     }
 
     let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
-    let twofactor_data = EmailTokenData::new(data.email, generated_token);
+    let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));
 
     // Uses EmailVerificationChallenge as type to show that it's not verified yet.
     let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
@@ -322,10 +322,10 @@ pub struct EmailTokenData {
 }
 
 impl EmailTokenData {
-    pub fn new(email: String, token: String) -> EmailTokenData {
+    pub fn new(email: String, token: Option<String>) -> EmailTokenData {
         EmailTokenData {
             email,
-            last_token: Some(token),
+            last_token: token,
             token_sent: Utc::now().timestamp(),
             attempts: 0,
         }
@@ -363,7 +363,8 @@ pub async fn activate_email_2fa(user: &User, conn: &DbConn) -> EmptyResult {
     if user.verified_at.is_none() {
         err!("Auto-enabling of email 2FA failed because the users email address has not been verified!");
     }
-    let twofactor_data = EmailTokenData::new(user.email.clone(), String::new());
+    // The token is set when the first code is sent
+    let twofactor_data = EmailTokenData::new(user.email.clone(), None);
     let twofactor = TwoFactor::new(user.uuid.clone(), TwoFactorType::Email, twofactor_data.to_json());
     twofactor.save(conn).await
 }

src/api/core/two_factor/mod.rs

@@ -69,13 +69,7 @@ pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data
 }
 
 pub fn routes() -> Vec<Route> {
-    let mut routes = routes![
-        get_twofactor,
-        get_recover,
-        disable_twofactor,
-        disable_twofactor_put,
-        get_device_verification_settings,
-    ];
+    let mut routes = routes![get_twofactor, get_recover, disable_twofactor, get_device_verification_settings];
 
     routes.append(&mut authenticator::routes());
     routes.append(&mut duo::routes());
@@ -134,7 +128,7 @@ struct DisableTwoFactorData {
     r#type: NumberOrString,
 }
 
-#[post("/two-factor/disable", data = "<data>")]
+#[put("/two-factor/disable", data = "<data>")]
 async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
     let data: DisableTwoFactorData = data.into_inner();
     let user = headers.user;
@@ -167,11 +161,6 @@ async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, c
     })))
 }
 
-#[put("/two-factor/disable", data = "<data>")]
-async fn disable_twofactor_put(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
-    disable_twofactor(data, headers, conn).await
-}
-
 pub async fn enforce_2fa_policy(
     user: &User,
     act_user_id: &UserId,

src/api/core/two_factor/webauthn.rs

@@ -24,7 +24,7 @@ use crate::{
     crypto::ct_eq,
     db::{
         DbConn,
-        models::{EventType, TwoFactor, TwoFactorType, UserId},
+        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
     },
     error::Error,
     util::NumberOrString,
@@ -338,6 +338,7 @@ async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, conn: DbCo
     tf.data = serde_json::to_string(&data)?;
     tf.save(&conn).await?;
     drop(tf);
+    Device::clear_twofactor_remember_by_user(&headers.user.uuid, &conn).await?;
 
     // If entry is migrated from u2f, delete the u2f entry as well
     if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await