From 57acc1a926b02b4fc90e84788e682017add972b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Garc=C3=ADa?= Date: Mon, 2 Nov 2026 18:19:08 +0100 Subject: [PATCH] Document the v2 encryption feature flags --- .env.template | 6 ++++++ src/api/core/accounts.rs | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.env.template b/.env.template index 92362088..a65af3f2 100644 --- a/.env.template +++ b/.env.template @@ -410,6 +410,12 @@ ## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0) ## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers. ## Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet. +## - "pm-27278-v2-password-registration": Register new accounts with v2 encryption. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0, Android >= 2026.4.1, iOS >= 2026.5.1) +## - "enable-account-encryption-v2-jit-password-registration": Give SSO users who set their master password on their first login v2 encryption. (Web >= 2026.1.1, Desktop/Browser/CLI >= 2026.1.0, Android >= 2026.4.1, iOS >= 2026.6.0) +## - "force-upgrade-v2-encryption": Upgrade every v1 account to v2 encryption the next time it's unlocked in a web, desktop, browser or CLI client. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0) +## These three flags can't be undone: a v2 account stays v2, and it can only log in from clients that are 2025.11.0 or newer and send their version, which rules out some older and third-party clients. +## - "pm-30144-sdk-key-rotation": Only for clients up to 2026.10.0 (Desktop up to 2026.10.1): together with "force-upgrade-v2-encryption", a manual key rotation also upgrades a v1 account to v2. +## - "pm-31050-no-logout-key-upgrade-rotation": Only for clients 2026.6.0 to 2026.10.0 (Desktop up to 2026.10.1): sync instead of logging out after the upgrade to v2. Newer clients always do. # EXPERIMENTAL_CLIENT_FEATURE_FLAGS= ## Require new device emails. When a user logs in an email is required to be sent. diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs index 88389d6f..66c39372 100644 --- a/src/api/core/accounts.rs +++ b/src/api/core/accounts.rs @@ -1775,7 +1775,8 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No // Prevent logging out the client where the user requested this endpoint from. // If you do logout the user it will causes issues at the client side. // Adding the device uuid will prevent this. - // On an upgrade, the reason lets clients with `pm-31050-no-logout-key-upgrade-rotation` sync instead + // On an upgrade, the reason lets clients sync instead: always from 2026.10.1 (Desktop 2026.10.2), before only + // with `pm-31050-no-logout-key-upgrade-rotation` let reason = is_upgrade.then_some(LogOutReason::KeyRotation); nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await;