[Web 2026.9.0] Support new Emergency Access password payload (#7746)

* Support new emergency access password payload

* Apply PR 7747 review changes to emergency access

* Add Playwright test for emergency access takeover

src/api/core/accounts.rs

@@ -93,6 +93,15 @@ pub struct KDFData {
     kdf_parallelism: Option<i32>,
 }
 
+impl KDFData {
+    pub(super) fn matches_user(&self, user: &User) -> bool {
+        self.kdf == user.client_kdf_type
+            && self.kdf_iterations == user.client_kdf_iter
+            && self.kdf_memory == user.client_kdf_memory
+            && self.kdf_parallelism == user.client_kdf_parallelism
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RegisterData {
@@ -717,21 +726,35 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult {
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct AuthenticationData {
+pub(super) struct AuthenticationData {
     #[serde(alias = "Salt")]
     salt: String,
     #[serde(alias = "Kdf")]
-    kdf: KDFData,
+    pub(super) kdf: KDFData,
     #[serde(alias = "MasterPasswordAuthenticationHash")]
-    master_password_authentication_hash: String,
+    pub(super) master_password_authentication_hash: String,
+}
+
+impl AuthenticationData {
+    pub(super) fn check(&self, user: &User, unlock: &UnlockData) -> EmptyResult {
+        if self.kdf != unlock.kdf {
+            err!("KDF settings must be equal for authentication and unlock")
+        }
+
+        if self.salt != user.master_password_salt() || self.salt != unlock.salt {
+            err!("Invalid master password salt")
+        }
+
+        Ok(())
+    }
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct UnlockData {
+pub(super) struct UnlockData {
     salt: String,
     kdf: KDFData,
-    master_key_wrapped_user_key: String,
+    pub(super) master_key_wrapped_user_key: String,
 }
 
 #[derive(Deserialize)]
@@ -750,13 +773,7 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, conn: DbConn, nt:
         err!("Invalid password")
     }
 
-    if data.authentication_data.kdf != data.unlock_data.kdf {
-        err!("KDF settings must be equal for authentication and unlock")
-    }
-
-    if headers.user.email != data.authentication_data.salt || headers.user.email != data.unlock_data.salt {
-        err!("Invalid master password salt")
-    }
+    data.authentication_data.check(&headers.user, &data.unlock_data)?;
 
     let mut user = headers.user;
 

src/api/core/emergency_access.rs

@@ -6,7 +6,10 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult,
-        core::{CipherSyncData, CipherSyncType},
+        core::{
+            CipherSyncData, CipherSyncType,
+            accounts::{AuthenticationData, UnlockData},
+        },
     },
     auth::{Headers, decode_emergency_access_invite},
     db::{
@@ -615,6 +618,7 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
         "kdfMemory": grantor_user.client_kdf_memory,
         "kdfParallelism": grantor_user.client_kdf_parallelism,
         "keyEncrypted": &emergency_access.key_encrypted,
+        "salt": grantor_user.master_password_salt(),
         "object": "emergencyAccessTakeover",
     });
 
@@ -624,8 +628,13 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EmergencyAccessPasswordData {
-    new_master_password_hash: String,
-    key: String,
+    // Legacy payload
+    new_master_password_hash: Option<String>,
+    key: Option<String>,
+
+    // Current payload
+    authentication_data: Option<AuthenticationData>,
+    unlock_data: Option<UnlockData>,
 }
 
 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
@@ -638,8 +647,6 @@ async fn password_emergency_access(
     check_emergency_access_enabled()?;
 
     let data: EmergencyAccessPasswordData = data.into_inner();
-    let new_master_password_hash = &data.new_master_password_hash;
-    //let key = &data.Key;
 
     let requesting_user = headers.user;
     let Some(emergency_access) =
@@ -656,8 +663,23 @@ async fn password_emergency_access(
         err!("Grantor user not found.")
     };
 
+    let (new_master_password_hash, new_key) =
+        if let (Some(authentication_data), Some(unlock_data)) = (data.authentication_data, data.unlock_data) {
+            authentication_data.check(&grantor_user, &unlock_data)?;
+
+            if !authentication_data.kdf.matches_user(&grantor_user) {
+                err!("KDF settings do not match the grantor account")
+            }
+
+            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
+        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
+            (new_master_password_hash, new_key)
+        } else {
+            err!("Invalid request!")
+        };
+
     // change grantor_user password
-    grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
+    grantor_user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
     grantor_user.save(&conn).await?;
 
     // Disable TwoFactor providers since they will otherwise block logins

src/db/models/user.rs

@@ -170,6 +170,10 @@ impl User {
         )
     }
 
+    pub fn master_password_salt(&self) -> String {
+        self.email.trim().to_lowercase()
+    }
+
     pub fn check_valid_recovery_code(&self, recovery_code: &str) -> bool {
         if let Some(ref totp_recover) = self.totp_recover {
             crypto::ct_eq(recovery_code, totp_recover.to_lowercase())

src/static/templates/email/send_emergency_access_invite.html.hbs

@@ -9,7 +9,7 @@ Emergency access for {{{grantor_name}}}
     </tr>
     <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
        <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none; text-align: center;" valign="top" align="center">
-          <a href="{{{url}}}"
+          <a data-testid="emergency" href="{{{url}}}"
              clicktracking=off target="_blank" style="color: #ffffff; text-decoration: none; text-align: center; cursor: pointer; display: inline-block; border-radius: 5px; background-color: #3c8dbc; border-color: #3c8dbc; border-style: solid; border-width: 10px 20px; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
           Become emergency contact
           </a>