Test dylint

2025-10-27 00:10:02 +02:00 · 2024-11-09 17:31:22 +01:00
94 changed files with 5960 additions and 6471 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -5,7 +5,6 @@
 !.git
 !docker/healthcheck.sh
 !docker/start.sh
-!macros
 !migrations
 !src

--- a/.env.template
+++ b/.env.template
@@ -280,13 +280,12 @@
 ## The default for new users. If changed, it will be updated during login for existing users.
 # PASSWORD_ITERATIONS=600000

-## Controls whether users can set or show password hints. This setting applies globally to all users.
+## Controls whether users can set password hints. This setting applies globally to all users.
 # PASSWORD_HINTS_ALLOWED=true

 ## Controls whether a password hint should be shown directly in the web page if
-## SMTP service is not configured and password hints are allowed.
-## Not recommended for publicly-accessible instances because this provides
-## unauthenticated access to potentially sensitive data.
+## SMTP service is not configured. Not recommended for publicly-accessible instances
+## as this provides unauthenticated access to potentially sensitive data.
 # SHOW_PASSWORD_HINT=false

 #########################
@@ -350,9 +349,6 @@
 ## - "browser-fileless-import": Directly import credentials from other providers without a file.
 ## - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
 ## - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
-## - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
-## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
-## - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=fido2-vault-credentials

 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -411,14 +407,6 @@
 ## Multiple values must be separated with a whitespace.
 # ALLOWED_IFRAME_ANCESTORS=

-## Allowed connect-src (Know the risks!)
-## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
-## Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
-## This adds the configured value to the 'Content-Security-Policy' headers 'connect-src' value.
-## Multiple values must be separated with a whitespace. And only HTTPS values are allowed.
-## Example: "https://my-addy-io.domain.tld https://my-simplelogin.domain.tld"
-# ALLOWED_CONNECT_SRC=""
-
 ## Number of seconds, on average, between login requests from the same IP address before rate limiting kicks in.
 # LOGIN_RATELIMIT_SECONDS=60
 ## Allow a burst of requests of up to this size, while maintaining the average indicated by `LOGIN_RATELIMIT_SECONDS`.
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -47,7 +47,7 @@ jobs:
    steps:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
      # End Checkout the repo


@@ -75,7 +75,7 @@ jobs:

      # Only install the clippy and rustfmt components on the default rust-toolchain
      - name: "Install rust-toolchain version"
-        uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203 # master @ Dec 14, 2024, 5:49 AM GMT+1
+        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a # master @ Aug 8, 2024, 7:36 PM GMT+2
        if: ${{ matrix.channel == 'rust-toolchain' }}
        with:
          toolchain: "${{steps.toolchain.outputs.RUST_TOOLCHAIN}}"
@@ -85,7 +85,7 @@ jobs:

      # Install the any other channel to be used for which we do not execute clippy and rustfmt
      - name: "Install MSRV version"
-        uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203 # master @ Dec 14, 2024, 5:49 AM GMT+1
+        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a # master @ Aug 8, 2024, 7:36 PM GMT+2
        if: ${{ matrix.channel != 'rust-toolchain' }}
        with:
          toolchain: "${{steps.toolchain.outputs.RUST_TOOLCHAIN}}"
@@ -107,8 +107,7 @@ jobs:
      # End Show environment

      # Enable Rust Caching
-      - name: Rust Caching
-        uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
+      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
        with:
          # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
          # Like changing the build host from Ubuntu 20.04 to 22.04 for example.
@@ -118,39 +117,33 @@ jobs:

      # Run cargo tests
      # First test all features together, afterwards test them separately.
-      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc,query_logger"
-        id: test_sqlite_mysql_postgresql_mimalloc_logger
-        if: ${{ !cancelled() }}
-        run: |
-          cargo test --features sqlite,mysql,postgresql,enable_mimalloc,query_logger
-
      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc"
        id: test_sqlite_mysql_postgresql_mimalloc
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features sqlite,mysql,postgresql,enable_mimalloc

      - name: "test features: sqlite,mysql,postgresql"
        id: test_sqlite_mysql_postgresql
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features sqlite,mysql,postgresql

      - name: "test features: sqlite"
        id: test_sqlite
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features sqlite

      - name: "test features: mysql"
        id: test_mysql
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features mysql

      - name: "test features: postgresql"
        id: test_postgresql
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features postgresql
      # End Run cargo tests
@@ -159,7 +152,7 @@ jobs:
      # Run cargo clippy, and fail on warnings
      - name: "clippy features: sqlite,mysql,postgresql,enable_mimalloc"
        id: clippy
-        if: ${{ !cancelled() && matrix.channel == 'rust-toolchain' }}
+        if: ${{ always() && matrix.channel == 'rust-toolchain' }}
        run: |
          cargo clippy --features sqlite,mysql,postgresql,enable_mimalloc -- -D warnings
      # End Run cargo clippy
@@ -168,7 +161,7 @@ jobs:
      # Run cargo fmt (Only run on rust-toolchain defined version)
      - name: "check formatting"
        id: formatting
-        if: ${{ !cancelled() && matrix.channel == 'rust-toolchain' }}
+        if: ${{ always() && matrix.channel == 'rust-toolchain' }}
        run: |
          cargo fmt --all -- --check
      # End Run cargo fmt
@@ -183,7 +176,6 @@ jobs:
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "|Job|Status|" >> $GITHUB_STEP_SUMMARY
          echo "|---|------|" >> $GITHUB_STEP_SUMMARY
-          echo "|test (sqlite,mysql,postgresql,enable_mimalloc,query_logger)|${{ steps.test_sqlite_mysql_postgresql_mimalloc_logger.outcome }}|" >> $GITHUB_STEP_SUMMARY
          echo "|test (sqlite,mysql,postgresql,enable_mimalloc)|${{ steps.test_sqlite_mysql_postgresql_mimalloc.outcome }}|" >> $GITHUB_STEP_SUMMARY
          echo "|test (sqlite,mysql,postgresql)|${{ steps.test_sqlite_mysql_postgresql.outcome }}|" >> $GITHUB_STEP_SUMMARY
          echo "|test (sqlite)|${{ steps.test_sqlite.outcome }}|" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/hadolint.yml
+++ b/.github/workflows/hadolint.yml
@@ -13,12 +13,12 @@ jobs:
    steps:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
      # End Checkout the repo

      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,16 +27,11 @@ jobs:
        if: ${{ github.ref_type == 'branch' }}

  docker-build:
-    permissions:
-      packages: write
-      contents: read
-      attestations: write
-      id-token: write
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    needs: skip_check
    if: ${{ needs.skip_check.outputs.should_skip != 'true' && github.repository == 'dani-garcia/vaultwarden' }}
-    # Start a local docker registry to extract the compiled binaries to upload as artifacts and attest them
+    # Start a local docker registry to extract the final Alpine static build binaries
    services:
      registry:
        image: registry:2
@@ -63,18 +58,18 @@ jobs:
    steps:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
        with:
          fetch-depth: 0

      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
        with:
          platforms: "arm64,arm"

      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -164,13 +159,13 @@ jobs:
          #

      - name: Add localhost registry
+        if: ${{ matrix.base_image == 'alpine' }}
        shell: bash
        run: |
          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}localhost:5000/vaultwarden/server" | tee -a "${GITHUB_ENV}"

      - name: Bake ${{ matrix.base_image }} containers
-        id: bake_vw
-        uses: docker/bake-action@5ca506d06f70338a4968df87fd8bfee5cbfb84c7 # v6.0.0
+        uses: docker/bake-action@2e3d19baedb14545e5d41222653874f25d5b4dfb # v5.10.0
        env:
          BASE_TAGS: "${{ env.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -180,47 +175,16 @@ jobs:
        with:
          pull: true
          push: true
-          source: .
          files: docker/docker-bake.hcl
          targets: "${{ matrix.base_image }}-multi"
          set: |
            *.cache-from=${{ env.BAKE_CACHE_FROM }}
            *.cache-to=${{ env.BAKE_CACHE_TO }}

-      - name: Extract digest SHA
-        shell: bash
-        run: |
-          GET_DIGEST_SHA="$(jq -r '.["${{ matrix.base_image }}-multi"]."containerimage.digest"' <<< '${{ steps.bake_vw.outputs.metadata }}')"
-          echo "DIGEST_SHA=${GET_DIGEST_SHA}" | tee -a "${GITHUB_ENV}"
-
-      # Attest container images
-      - name: Attest - docker.io - ${{ matrix.base_image }}
-        if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
-        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
-        with:
-          subject-name: ${{ vars.DOCKERHUB_REPO }}
-          subject-digest: ${{ env.DIGEST_SHA }}
-          push-to-registry: true
-
-      - name: Attest - ghcr.io - ${{ matrix.base_image }}
-        if: ${{ env.HAVE_GHCR_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
-        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
-        with:
-          subject-name: ${{ vars.GHCR_REPO }}
-          subject-digest: ${{ env.DIGEST_SHA }}
-          push-to-registry: true
-
-      - name: Attest - quay.io - ${{ matrix.base_image }}
-        if: ${{ env.HAVE_QUAY_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
-        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
-        with:
-          subject-name: ${{ vars.QUAY_REPO }}
-          subject-digest: ${{ env.DIGEST_SHA }}
-          push-to-registry: true
-

      # Extract the Alpine binaries from the containers
      - name: Extract binaries
+        if: ${{ matrix.base_image == 'alpine' }}
        shell: bash
        run: |
          # Check which main tag we are going to build determined by github.ref_type
@@ -230,65 +194,59 @@ jobs:
            EXTRACT_TAG="testing"
          fi

-          # Check which base_image was used and append -alpine if needed
-          if [[ "${{ matrix.base_image }}" == "alpine" ]]; then
-            EXTRACT_TAG="${EXTRACT_TAG}-alpine"
-          fi
-
          # After each extraction the image is removed.
          # This is needed because using different platforms doesn't trigger a new pull/download

          # Extract amd64 binary
-          docker create --name amd64 --platform=linux/amd64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
-          docker cp amd64:/vaultwarden vaultwarden-amd64-${{ matrix.base_image }}
+          docker create --name amd64 --platform=linux/amd64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"
+          docker cp amd64:/vaultwarden vaultwarden-amd64
          docker rm --force amd64
-          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"

          # Extract arm64 binary
-          docker create --name arm64 --platform=linux/arm64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
-          docker cp arm64:/vaultwarden vaultwarden-arm64-${{ matrix.base_image }}
+          docker create --name arm64 --platform=linux/arm64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"
+          docker cp arm64:/vaultwarden vaultwarden-arm64
          docker rm --force arm64
-          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"

          # Extract armv7 binary
-          docker create --name armv7 --platform=linux/arm/v7 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
-          docker cp armv7:/vaultwarden vaultwarden-armv7-${{ matrix.base_image }}
+          docker create --name armv7 --platform=linux/arm/v7 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"
+          docker cp armv7:/vaultwarden vaultwarden-armv7
          docker rm --force armv7
-          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"

          # Extract armv6 binary
-          docker create --name armv6 --platform=linux/arm/v6 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
-          docker cp armv6:/vaultwarden vaultwarden-armv6-${{ matrix.base_image }}
+          docker create --name armv6 --platform=linux/arm/v6 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"
+          docker cp armv6:/vaultwarden vaultwarden-armv6
          docker rm --force armv6
-          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"

-      # Upload artifacts to Github Actions and Attest the binaries
-      - name: "Upload amd64 artifact ${{ matrix.base_image }}"
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0
+      # Upload artifacts to Github Actions
+      - name: "Upload amd64 artifact"
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ matrix.base_image == 'alpine' }}
        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-amd64-${{ matrix.base_image }}
-          path: vaultwarden-amd64-${{ matrix.base_image }}
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-amd64
+          path: vaultwarden-amd64

-      - name: "Upload arm64 artifact ${{ matrix.base_image }}"
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0
+      - name: "Upload arm64 artifact"
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ matrix.base_image == 'alpine' }}
        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-arm64-${{ matrix.base_image }}
-          path: vaultwarden-arm64-${{ matrix.base_image }}
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-arm64
+          path: vaultwarden-arm64

-      - name: "Upload armv7 artifact ${{ matrix.base_image }}"
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0
+      - name: "Upload armv7 artifact"
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ matrix.base_image == 'alpine' }}
        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv7-${{ matrix.base_image }}
-          path: vaultwarden-armv7-${{ matrix.base_image }}
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv7
+          path: vaultwarden-armv7

-      - name: "Upload armv6 artifact ${{ matrix.base_image }}"
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0
+      - name: "Upload armv6 artifact"
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ matrix.base_image == 'alpine' }}
        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv6-${{ matrix.base_image }}
-          path: vaultwarden-armv6-${{ matrix.base_image }}
-
-      - name: "Attest artifacts ${{ matrix.base_image }}"
-        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
-        with:
-          subject-path: vaultwarden-*
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv6
+          path: vaultwarden-armv6
      # End Upload artifacts to Github Actions
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -28,13 +28,10 @@ jobs:
      actions: read
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1

      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
-        env:
-          TRIVY_DB_REPOSITORY: docker.io/aquasec/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2
-          TRIVY_JAVA_DB_REPOSITORY: docker.io/aquasec/trivy-java-db:1,public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1
+        uses: aquasecurity/trivy-action@5681af892cd0f4997658e2bacc62bd0a894cf564 # v0.27.0
        with:
          scan-type: repo
          ignore-unfixed: true
@@ -43,6 +40,6 @@ jobs:
          severity: CRITICAL,HIGH

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@86b04fb0e47484f7282357688f21d5d0e32175fe # v3.27.5
+        uses: github/codeql-action/upload-sarif@2bbafcdd7fbf96243689e764c2f15d9735164f33 # v3.26.6
        with:
          sarif_file: 'trivy-results.sarif'
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,11 +1,9 @@
-workspace = { members = ["macros"] }
-
 [package]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.83.0"
+rust-version = "1.80.0"
 resolver = "2"

 repository = "https://github.com/dani-garcia/vaultwarden"
@@ -38,15 +36,13 @@ unstable = []

 [target."cfg(unix)".dependencies]
 # Logging
-syslog = "7.0.0"
+syslog = "6.1.1"

 [dependencies]
-macros = { path = "./macros" }
-
 # Logging
-log = "0.4.25"
-fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
-tracing = { version = "0.1.41", features = ["log"] } # Needed to have lettre and webauthn-rs trace logging to work
+log = "0.4.22"
+fern = { version = "0.7.0", features = ["syslog-6", "reopen-1"] }
+tracing = { version = "0.1.40", features = ["log"] } # Needed to have lettre and webauthn-rs trace logging to work

 # A `dotenv` implementation for Rust
 dotenvy = { version = "0.15.7", default-features = false }
@@ -57,7 +53,7 @@ once_cell = "1.20.2"
 # Numerical libraries
 num-traits = "0.2.19"
 num-derive = "0.4.2"
-bigdecimal = "0.4.7"
+bigdecimal = "0.4.5"

 # Web framework
 rocket = { version = "0.5.1", features = ["tls", "json"], default-features = false }
@@ -71,19 +67,16 @@ dashmap = "6.1.0"

 # Async futures
 futures = "0.3.31"
-tokio = { version = "1.43.0", features = ["rt-multi-thread", "fs", "io-util", "parking_lot", "time", "signal", "net"] }
+tokio = { version = "1.41.0", features = ["rt-multi-thread", "fs", "io-util", "parking_lot", "time", "signal", "net"] }

 # A generic serialization/deserialization framework
-serde = { version = "1.0.217", features = ["derive"] }
-serde_json = "1.0.137"
+serde = { version = "1.0.213", features = ["derive"] }
+serde_json = "1.0.132"

 # A safe, extensible ORM and Query builder
-diesel = { version = "2.2.6", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.2.4", features = ["chrono", "r2d2", "numeric"] }
 diesel_migrations = "2.2.0"
-diesel_logger = { version = "0.4.0", optional = true }
-
-derive_more = { version = "1.0.0", features = ["from", "into", "as_ref", "deref", "display"] }
-diesel-derive-newtype = "2.1.2"
+diesel_logger = { version = "0.3.0", optional = true }

 # Bundled/Static SQLite
 libsqlite3-sys = { version = "0.30.1", features = ["bundled"], optional = true }
@@ -93,18 +86,18 @@ rand = { version = "0.8.5", features = ["small_rng"] }
 ring = "0.17.8"

 # UUID generation
-uuid = { version = "1.12.1", features = ["v4"] }
+uuid = { version = "1.11.0", features = ["v4"] }

 # Date and time libraries
-chrono = { version = "0.4.39", features = ["clock", "serde"], default-features = false }
-chrono-tz = "0.10.1"
-time = "0.3.37"
+chrono = { version = "0.4.38", features = ["clock", "serde"], default-features = false }
+chrono-tz = "0.10.0"
+time = "0.3.36"

 # Job scheduler
 job_scheduler_ng = "2.0.5"

 # Data encoding library Hex/Base32/Base64
-data-encoding = "2.7.0"
+data-encoding = "2.6.0"

 # JWT library
 jsonwebtoken = "9.3.0"
@@ -113,38 +106,38 @@ jsonwebtoken = "9.3.0"
 totp-lite = "2.0.1"

 # Yubico Library
-yubico = { version = "0.12.0", features = ["online-tokio"], default-features = false }
+yubico = { version = "0.11.0", features = ["online-tokio"], default-features = false }

 # WebAuthn libraries
 webauthn-rs = "0.3.2"

 # Handling of URL's for WebAuthn and favicons
-url = "2.5.4"
+url = "2.5.2"

 # Email libraries
-lettre = { version = "0.11.11", features = ["smtp-transport", "sendmail-transport", "builder", "serde", "tokio1-native-tls", "hostname", "tracing", "tokio1"], default-features = false }
+lettre = { version = "0.11.10", features = ["smtp-transport", "sendmail-transport", "builder", "serde", "tokio1-native-tls", "hostname", "tracing", "tokio1"], default-features = false }
 percent-encoding = "2.3.1" # URL encoding library used for URL's in the emails
 email_address = "0.2.9"

 # HTML Template library
-handlebars = { version = "6.3.0", features = ["dir_source"] }
+handlebars = { version = "6.1.0", features = ["dir_source"] }

 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.12.12", features = ["native-tls-alpn", "stream", "json", "gzip", "brotli", "socks", "cookies"] }
-hickory-resolver = "0.24.2"
+reqwest = { version = "0.12.8", features = ["native-tls-alpn", "stream", "json", "gzip", "brotli", "socks", "cookies"] }
+hickory-resolver = "0.24.1"

 # Favicon extraction libraries
-html5gum = "0.7.0"
-regex = { version = "1.11.1", features = ["std", "perf", "unicode-perl"], default-features = false }
+html5gum = "0.5.7"
+regex = { version = "1.11.0", features = ["std", "perf", "unicode-perl"], default-features = false }
 data-url = "0.3.1"
-bytes = "1.9.0"
+bytes = "1.8.0"

 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "0.54.0", features = ["async"] }
+cached = { version = "0.53.1", features = ["async"] }

 # Used for custom short lived cookie jar during favicon extraction
 cookie = "0.18.1"
-cookie_store = "0.21.1"
+cookie_store = "0.21.0"

 # Used by U2F, JWT and PostgreSQL
 openssl = "0.10.68"
@@ -154,15 +147,15 @@ pico-args = "0.5.0"

 # Macro ident concatenation
 paste = "1.0.15"
-governor = "0.8.0"
+governor = "0.7.0"

 # Check client versions for specific features.
-semver = "1.0.25"
+semver = "1.0.23"

 # Allow overriding the default memory allocator
 # Mainly used for the musl builds, since the default musl malloc is very slow
 mimalloc = { version = "0.1.43", features = ["secure"], default-features = false, optional = true }
-which = "7.0.1"
+which = "6.0.3"

 # Argon2 library with support for the PHC format
 argon2 = "0.5.3"
@@ -170,13 +163,6 @@ argon2 = "0.5.3"
 # Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
 rpassword = "7.3.1"

-# Loading a dynamic CSS Stylesheet
-grass_compiler = { version = "0.13.4", default-features = false }
-
-[patch.crates-io]
-# Patch yubico to remove duplicate crates of older versions
-yubico = { git = "https://github.com/BlackDex/yubico-rs", rev = "00df14811f58155c0f02e3ab10f1570ed3e115c6" }
-
 # Strip debuginfo from the release builds
 # The symbols are the provide better panic traces
 # Also enable fat LTO and use 1 codegen unit for optimizations
@@ -227,8 +213,7 @@ noop_method_call = "deny"
 refining_impl_trait = { level = "deny", priority = -1 }
 rust_2018_idioms = { level = "deny", priority = -1 }
 rust_2021_compatibility = { level = "deny", priority = -1 }
-rust_2024_compatibility = { level = "deny", priority = -1 }
-edition_2024_expr_fragment_specifier = "allow" # Once changed to Rust 2024 this should be removed and macro's should be validated again
+# rust_2024_compatibility = { level = "deny", priority = -1 } # Enable once we are at MSRV 1.81.0
 single_use_lifetimes = "deny"
 trivial_casts = "deny"
 trivial_numeric_casts = "deny"
@@ -237,10 +222,9 @@ unused_import_braces = "deny"
 unused_lifetimes = "deny"
 unused_qualifications = "deny"
 variant_size_differences = "deny"
-# Allow the following lints since these cause issues with Rust v1.84.0 or newer
-# Building Vaultwarden with Rust v1.85.0 and edition 2024 also works without issues
-if_let_rescope = "allow"
-tail_expr_drop_order = "allow"
+# The lints below are part of the rust_2024_compatibility group
+static-mut-refs = "deny"
+unsafe-op-in-unsafe-fn = "deny"

 # https://rust-lang.github.io/rust-clippy/stable/index.html
 [lints.clippy]
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -21,7 +21,7 @@ notify us. We welcome working with you to resolve the issue promptly. Thanks in
 The following bug classes are out-of scope:

 - Bugs that are already reported on Vaultwarden's issue tracker (https://github.com/dani-garcia/vaultwarden/issues)
- Bugs that are not part of Vaultwarden, like on the web-vault or mobile and desktop clients. These issues need to be reported in the respective project issue tracker at https://github.com/bitwarden to which we are not associated
+- Bugs that are not part of Vaultwarden, like on the the web-vault or mobile and desktop clients. These issues need to be reported in the respective project issue tracker at https://github.com/bitwarden to which we are not associated
 - Issues in an upstream software dependency (ex: Rust, or External Libraries) which are already reported to the upstream maintainer
 - Attacks requiring physical access to a user's device
 - Issues related to software or protocols not under Vaultwarden's control
--- a/docker/DockerSettings.yaml
+++ b/docker/DockerSettings.yaml
@@ -1,13 +1,13 @@
 ---
-vault_version: "v2025.1.1"
-vault_image_digest: "sha256:cb6b2095a4afc1d9d243a33f6d09211f40e3d82c7ae829fd025df5ff175a4918"
-# Cross Compile Docker Helper Scripts v1.6.1
+vault_version: "v2024.6.2c"
+vault_image_digest: "sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b"
+# Cross Compile Docker Helper Scripts v1.5.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
-xx_image_digest: "sha256:9c207bead753dda9430bdd15425c6518fc7a03d866103c516a2c6889188f5894"
-rust_version: 1.84.0 # Rust version to be used
+xx_image_digest: "sha256:1978e7a58a1777cb0ef0dde76bad60b7914b21da57cfa88047875e4f364297aa"
+rust_version: 1.82.0 # Rust version to be used
 debian_version: bookworm # Debian release name to be used
-alpine_version: "3.21" # Alpine version to be used
+alpine_version: "3.20" # Alpine version to be used
 # For which platforms/architectures will we try to build images
 platforms: ["linux/amd64", "linux/arm64", "linux/arm/v7", "linux/arm/v6"]
 # Determine the build images per OS/Arch
--- a/docker/Dockerfile.alpine
+++ b/docker/Dockerfile.alpine
@@ -19,23 +19,23 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2025.1.1
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2025.1.1
-#     [docker.io/vaultwarden/web-vault@sha256:cb6b2095a4afc1d9d243a33f6d09211f40e3d82c7ae829fd025df5ff175a4918]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2024.6.2c
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2024.6.2c
+#     [docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:cb6b2095a4afc1d9d243a33f6d09211f40e3d82c7ae829fd025df5ff175a4918
-#     [docker.io/vaultwarden/web-vault:v2025.1.1]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b
+#     [docker.io/vaultwarden/web-vault:v2024.6.2c]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:cb6b2095a4afc1d9d243a33f6d09211f40e3d82c7ae829fd025df5ff175a4918 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b AS vault

 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.84.0 AS build_amd64
-FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.84.0 AS build_arm64
-FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.84.0 AS build_armv7
-FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.84.0 AS build_armv6
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.82.0 AS build_amd64
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.82.0 AS build_arm64
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.82.0 AS build_armv7
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.82.0 AS build_armv6

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -76,7 +76,6 @@ RUN source /env-cargo && \

 # Copies over *only* your manifests and build files
 COPY ./Cargo.* ./rust-toolchain.toml ./build.rs ./
-COPY ./macros ./macros

 ARG CARGO_PROFILE=release

@@ -127,7 +126,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
-FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.21
+FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.20

 ENV ROCKET_PROFILE="release" \
    ROCKET_ADDRESS=0.0.0.0 \
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@@ -19,24 +19,24 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2025.1.1
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2025.1.1
-#     [docker.io/vaultwarden/web-vault@sha256:cb6b2095a4afc1d9d243a33f6d09211f40e3d82c7ae829fd025df5ff175a4918]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2024.6.2c
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2024.6.2c
+#     [docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:cb6b2095a4afc1d9d243a33f6d09211f40e3d82c7ae829fd025df5ff175a4918
-#     [docker.io/vaultwarden/web-vault:v2025.1.1]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b
+#     [docker.io/vaultwarden/web-vault:v2024.6.2c]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:cb6b2095a4afc1d9d243a33f6d09211f40e3d82c7ae829fd025df5ff175a4918 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b AS vault

 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
 ## And these bash scripts do not have any significant difference if at all
-FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:9c207bead753dda9430bdd15425c6518fc7a03d866103c516a2c6889188f5894 AS xx
+FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:1978e7a58a1777cb0ef0dde76bad60b7914b21da57cfa88047875e4f364297aa AS xx

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.84.0-slim-bookworm AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.82.0-slim-bookworm AS build
 COPY --from=xx / /
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -116,7 +116,6 @@ RUN source /env-cargo && \

 # Copies over *only* your manifests and build files
 COPY ./Cargo.* ./rust-toolchain.toml ./build.rs ./
-COPY ./macros ./macros

 ARG CARGO_PROFILE=release

--- a/docker/Dockerfile.j2
+++ b/docker/Dockerfile.j2
@@ -143,7 +143,6 @@ RUN source /env-cargo && \

 # Copies over *only* your manifests and build files
 COPY ./Cargo.* ./rust-toolchain.toml ./build.rs ./
-COPY ./macros ./macros

 ARG CARGO_PROFILE=release

--- a/docker/README.md
+++ b/docker/README.md
@@ -46,7 +46,7 @@ There also is an option to use an other docker container to provide support for
 ```bash
 # To install and activate
 docker run --privileged --rm tonistiigi/binfmt --install arm64,arm
-# To uninstall
+# To unistall
 docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 ```

--- a/docker/docker-bake.hcl
+++ b/docker/docker-bake.hcl
@@ -17,7 +17,7 @@ variable "SOURCE_REPOSITORY_URL" {
  default = null
 }

-// The commit hash of the current commit this build was triggered on
+// The commit hash of of the current commit this build was triggered on
 variable "SOURCE_COMMIT" {
  default = null
 }
--- a/dylint.toml
+++ b/dylint.toml
@@ -0,0 +1,2 @@
+[workspace.metadata.dylint]
+libraries = [{ path = "dylints/*" }]
--- a/dylints/README.md
+++ b/dylints/README.md
@@ -0,0 +1,7 @@
+# How to run Lints
+
+```sh
+cargo install cargo-dylint dylint-link
+
+RUSTFLAGS="-Aunreachable_patterns" cargo dylint --all -- --features sqlite
+```
--- a/dylints/non_authenticated_routes/.cargo/config.toml
+++ b/dylints/non_authenticated_routes/.cargo/config.toml
@@ -0,0 +1,2 @@
+[target.'cfg(all())']
+linker = "dylint-link"
--- a/dylints/non_authenticated_routes/.gitignore
+++ b/dylints/non_authenticated_routes/.gitignore
@@ -0,0 +1 @@
+/target
--- a/dylints/non_authenticated_routes/Cargo.lock
+++ b/dylints/non_authenticated_routes/Cargo.lock
--- a/dylints/non_authenticated_routes/Cargo.toml
+++ b/dylints/non_authenticated_routes/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "non_authenticated_routes"
+version = "0.1.0"
+authors = ["authors go here"]
+description = "description goes here"
+edition = "2021"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+clippy_utils = { git = "https://github.com/rust-lang/rust-clippy", rev = "4f0e46b74dbc8441daf084b6f141a7fe414672a2" }
+dylint_linting = "3.2.1"
+
+[dev-dependencies]
+dylint_testing = "3.2.1"
+
+[package.metadata.rust-analyzer]
+rustc_private = true
--- a/dylints/non_authenticated_routes/rust-toolchain
+++ b/dylints/non_authenticated_routes/rust-toolchain
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "nightly-2024-11-09"
+components = ["llvm-tools-preview", "rustc-dev"]
--- a/dylints/non_authenticated_routes/src/lib.rs
+++ b/dylints/non_authenticated_routes/src/lib.rs
@@ -0,0 +1,167 @@
+#![feature(rustc_private)]
+#![feature(let_chains)]
+
+extern crate rustc_arena;
+extern crate rustc_ast;
+extern crate rustc_ast_pretty;
+extern crate rustc_attr;
+extern crate rustc_data_structures;
+extern crate rustc_errors;
+extern crate rustc_hir;
+extern crate rustc_hir_pretty;
+extern crate rustc_index;
+extern crate rustc_infer;
+extern crate rustc_lexer;
+extern crate rustc_middle;
+extern crate rustc_mir_dataflow;
+extern crate rustc_parse;
+extern crate rustc_span;
+extern crate rustc_target;
+extern crate rustc_trait_selection;
+
+use clippy_utils::diagnostics::span_lint;
+use rustc_hir::{def_id::DefId, Item, ItemKind, QPath, TyKind};
+use rustc_lint::{LateContext, LateLintPass};
+use rustc_span::{symbol::Ident, Span, Symbol};
+
+dylint_linting::impl_late_lint! {
+    /// ### What it does
+    ///
+    /// ### Why is this bad?
+    ///
+    /// ### Known problems
+    /// Remove if none.
+    ///
+    /// ### Example
+    /// ```rust
+    /// // example code where a warning is issued
+    /// ```
+    /// Use instead:
+    /// ```rust
+    /// // example code that does not raise a warning
+    /// ```
+    pub NON_AUTHENTICATED_ROUTES,
+    Warn,
+    "description goes here",
+    NonAuthenticatedRoutes::default()
+}
+
+#[derive(Default)]
+pub struct NonAuthenticatedRoutes {
+    last_function_item: Option<(Ident, Span, bool)>,
+}
+
+// Collect all the attribute macros that are applied to the given span
+fn attr_def_ids(mut span: rustc_span::Span) -> Vec<(DefId, Symbol, Option<DefId>)> {
+    use rustc_span::hygiene::{walk_chain, ExpnKind, MacroKind};
+    use rustc_span::{ExpnData, SyntaxContext};
+
+    let mut def_ids = Vec::new();
+    while span.ctxt() != SyntaxContext::root() {
+        if let ExpnData {
+            kind: ExpnKind::Macro(MacroKind::Attr, macro_symbol),
+            macro_def_id: Some(def_id),
+            parent_module,
+            ..
+        } = span.ctxt().outer_expn_data()
+        {
+            def_ids.push((def_id, macro_symbol, parent_module));
+        }
+        span = walk_chain(span, SyntaxContext::root());
+    }
+    def_ids
+}
+
+const ROCKET_MACRO_EXCEPTIONS: [(&str, &str); 1] = [("rocket::catch", "catch")];
+
+const VALID_AUTH_HEADERS: [&str; 6] = [
+    "auth::Headers",
+    "auth::OrgHeaders",
+    "auth::AdminHeaders",
+    "auth::ManagerHeaders",
+    "auth::ManagerHeadersLoose",
+    "auth::OwnerHeaders",
+];
+
+impl<'tcx> LateLintPass<'tcx> for NonAuthenticatedRoutes {
+    fn check_item(&mut self, cx: &LateContext<'tcx>, item: &'tcx Item) {
+        if let ItemKind::Fn(sig, ..) = item.kind {
+            let mut has_auth_headers = false;
+
+            for input in sig.decl.inputs {
+                let TyKind::Path(QPath::Resolved(_, path)) = input.kind else {
+                    continue;
+                };
+
+                for seg in path.segments {
+                    if let Some(def_id) = seg.res.opt_def_id() {
+                        let def = cx.tcx.def_path_str(def_id);
+                        if VALID_AUTH_HEADERS.contains(&def.as_str()) {
+                            has_auth_headers = true;
+                        }
+                    }
+                }
+            }
+
+            self.last_function_item = Some((item.ident, sig.span, has_auth_headers));
+            return;
+        }
+
+        let ItemKind::Struct(_data, _generics) = item.kind else {
+            return;
+        };
+
+        let def_ids = attr_def_ids(item.span);
+
+        let mut is_rocket_route = false;
+
+        for (def_id, sym, parent) in &def_ids {
+            let def_id = cx.tcx.def_path_str(*def_id);
+            let sym = sym.as_str();
+            let parent = parent.map(|parent| cx.tcx.def_path_str(parent));
+
+            if ROCKET_MACRO_EXCEPTIONS.contains(&(&def_id, sym)) {
+                is_rocket_route = false;
+                break;
+            }
+
+            if def_id.starts_with("rocket::") || parent.as_deref() == Some("rocket_codegen") {
+                is_rocket_route = true;
+                break;
+            }
+        }
+
+        if !is_rocket_route {
+            return;
+        }
+
+        let Some((func_ident, func_span, has_auth_headers)) = self.last_function_item.take() else {
+            span_lint(cx, NON_AUTHENTICATED_ROUTES, item.span, "No function found before the expanded route");
+            return;
+        };
+
+        if func_ident != item.ident {
+            span_lint(
+                cx,
+                NON_AUTHENTICATED_ROUTES,
+                item.span,
+                "The function before the expanded route does not match the route",
+            );
+            return;
+        }
+
+        if !has_auth_headers {
+            span_lint(
+                cx,
+                NON_AUTHENTICATED_ROUTES,
+                func_span,
+                "This Rocket route does not have any authentication headers",
+            );
+        }
+    }
+}
+
+#[test]
+fn ui() {
+    dylint_testing::ui_test(env!("CARGO_PKG_NAME"), "ui");
+}
--- a/dylints/non_authenticated_routes/ui/main.rs
+++ b/dylints/non_authenticated_routes/ui/main.rs
@@ -0,0 +1 @@
+fn main() {}
--- a/migrations/mysql/2025-01-09-172300_add_manage/down.sql
+++ b/migrations/mysql/2025-01-09-172300_add_manage/down.sql
--- a/macros/Cargo.toml
+++ b/macros/Cargo.toml
@@ -1,13 +0,0 @@
-[package]
-name = "macros"
-version = "0.1.0"
-edition = "2021"
-
-[lib]
-name = "macros"
-path = "src/lib.rs"
-proc-macro = true
-
-[dependencies]
-quote = "1.0.38"
-syn = "2.0.96"
--- a/macros/src/lib.rs
+++ b/macros/src/lib.rs
@@ -1,58 +0,0 @@
-extern crate proc_macro;
-
-use proc_macro::TokenStream;
-use quote::quote;
-
-#[proc_macro_derive(UuidFromParam)]
-pub fn derive_uuid_from_param(input: TokenStream) -> TokenStream {
-    let ast = syn::parse(input).unwrap();
-
-    impl_derive_uuid_macro(&ast)
-}
-
-fn impl_derive_uuid_macro(ast: &syn::DeriveInput) -> TokenStream {
-    let name = &ast.ident;
-    let gen = quote! {
-        #[automatically_derived]
-        impl<'r> rocket::request::FromParam<'r> for #name {
-            type Error = ();
-
-            #[inline(always)]
-            fn from_param(param: &'r str) -> Result<Self, Self::Error> {
-                if uuid::Uuid::parse_str(param).is_ok() {
-                    Ok(Self(param.to_string()))
-                } else {
-                    Err(())
-                }
-            }
-        }
-    };
-    gen.into()
-}
-
-#[proc_macro_derive(IdFromParam)]
-pub fn derive_id_from_param(input: TokenStream) -> TokenStream {
-    let ast = syn::parse(input).unwrap();
-
-    impl_derive_safestring_macro(&ast)
-}
-
-fn impl_derive_safestring_macro(ast: &syn::DeriveInput) -> TokenStream {
-    let name = &ast.ident;
-    let gen = quote! {
-        #[automatically_derived]
-        impl<'r> rocket::request::FromParam<'r> for #name {
-            type Error = ();
-
-            #[inline(always)]
-            fn from_param(param: &'r str) -> Result<Self, Self::Error> {
-                if param.chars().all(|c| matches!(c, 'a'..='z' | 'A'..='Z' |'0'..='9' | '-')) {
-                    Ok(Self(param.to_string()))
-                } else {
-                    Err(())
-                }
-            }
-        }
-    };
-    gen.into()
-}
--- a/migrations/mysql/2025-01-09-172300_add_manage/up.sql
+++ b/migrations/mysql/2025-01-09-172300_add_manage/up.sql
@@ -1,5 +0,0 @@
-ALTER TABLE users_collections
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT FALSE;
-
-ALTER TABLE collections_groups
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT FALSE;
--- a/migrations/postgresql/2025-01-09-172300_add_manage/down.sql
+++ b/migrations/postgresql/2025-01-09-172300_add_manage/down.sql
--- a/migrations/postgresql/2025-01-09-172300_add_manage/up.sql
+++ b/migrations/postgresql/2025-01-09-172300_add_manage/up.sql
@@ -1,5 +0,0 @@
-ALTER TABLE users_collections
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT FALSE;
-
-ALTER TABLE collections_groups
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT FALSE;
--- a/migrations/sqlite/2025-01-09-172300_add_manage/down.sql
+++ b/migrations/sqlite/2025-01-09-172300_add_manage/down.sql
--- a/migrations/sqlite/2025-01-09-172300_add_manage/up.sql
+++ b/migrations/sqlite/2025-01-09-172300_add_manage/up.sql
@@ -1,5 +0,0 @@
-ALTER TABLE users_collections
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-
-ALTER TABLE collections_groups
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT 0; -- FALSE
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.84.0"
+channel = "1.82.0"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -50,7 +50,7 @@ pub fn routes() -> Vec<Route> {
        disable_user,
        enable_user,
        remove_2fa,
-        update_membership_type,
+        update_user_org_type,
        update_revision_users,
        post_config,
        delete_config,
@@ -62,7 +62,6 @@ pub fn routes() -> Vec<Route> {
        diagnostics,
        get_diagnostics_config,
        resend_user_invite,
-        get_diagnostics_http,
    ]
 }

@@ -99,7 +98,6 @@ const DT_FMT: &str = "%Y-%m-%d %H:%M:%S %Z";
 const BASE_TEMPLATE: &str = "admin/base";

 const ACTING_ADMIN_USER: &str = "vaultwarden-admin-00000-000000000000";
-pub const FAKE_ADMIN_UUID: &str = "00000000-0000-0000-0000-000000000000";

 fn admin_path() -> String {
    format!("{}{}", CONFIG.domain_path(), ADMIN_PATH)
@@ -171,7 +169,7 @@ struct LoginForm {
    redirect: Option<String>,
 }

-#[post("/", format = "application/x-www-form-urlencoded", data = "<data>")]
+#[post("/", data = "<data>")]
 fn post_admin_login(
    data: Form<LoginForm>,
    cookies: &CookieJar<'_>,
@@ -281,15 +279,15 @@ struct InviteData {
    email: String,
 }

-async fn get_user_or_404(user_id: &UserId, conn: &mut DbConn) -> ApiResult<User> {
-    if let Some(user) = User::find_by_uuid(user_id, conn).await {
+async fn get_user_or_404(uuid: &str, conn: &mut DbConn) -> ApiResult<User> {
+    if let Some(user) = User::find_by_uuid(uuid, conn).await {
        Ok(user)
    } else {
        err_code!("User doesn't exist", Status::NotFound.code);
    }
 }

-#[post("/invite", format = "application/json", data = "<data>")]
+#[post("/invite", data = "<data>")]
 async fn invite_user(data: Json<InviteData>, _token: AdminToken, mut conn: DbConn) -> JsonResult {
    let data: InviteData = data.into_inner();
    if User::find_by_mail(&data.email, &mut conn).await.is_some() {
@@ -300,9 +298,7 @@ async fn invite_user(data: Json<InviteData>, _token: AdminToken, mut conn: DbCon

    async fn _generate_invite(user: &User, conn: &mut DbConn) -> EmptyResult {
        if CONFIG.mail_enabled() {
-            let org_id: OrganizationId = FAKE_ADMIN_UUID.to_string().into();
-            let member_id: MembershipId = FAKE_ADMIN_UUID.to_string().into();
-            mail::send_invite(user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
+            mail::send_invite(user, None, None, &CONFIG.invitation_org_name(), None).await
        } else {
            let invitation = Invitation::new(&user.email);
            invitation.save(conn).await
@@ -315,7 +311,7 @@ async fn invite_user(data: Json<InviteData>, _token: AdminToken, mut conn: DbCon
    Ok(Json(user.to_json(&mut conn).await))
 }

-#[post("/test/smtp", format = "application/json", data = "<data>")]
+#[post("/test/smtp", data = "<data>")]
 async fn test_smtp(data: Json<InviteData>, _token: AdminToken) -> EmptyResult {
    let data: InviteData = data.into_inner();

@@ -384,29 +380,29 @@ async fn get_user_by_mail_json(mail: &str, _token: AdminToken, mut conn: DbConn)
    }
 }

-#[get("/users/<user_id>")]
-async fn get_user_json(user_id: UserId, _token: AdminToken, mut conn: DbConn) -> JsonResult {
-    let u = get_user_or_404(&user_id, &mut conn).await?;
+#[get("/users/<uuid>")]
+async fn get_user_json(uuid: &str, _token: AdminToken, mut conn: DbConn) -> JsonResult {
+    let u = get_user_or_404(uuid, &mut conn).await?;
    let mut usr = u.to_json(&mut conn).await;
    usr["userEnabled"] = json!(u.enabled);
    usr["createdAt"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
    Ok(Json(usr))
 }

-#[post("/users/<user_id>/delete", format = "application/json")]
-async fn delete_user(user_id: UserId, token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/delete")]
+async fn delete_user(uuid: &str, token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let user = get_user_or_404(uuid, &mut conn).await?;

-    // Get the membership records before deleting the actual user
-    let memberships = Membership::find_any_state_by_user(&user_id, &mut conn).await;
+    // Get the user_org records before deleting the actual user
+    let user_orgs = UserOrganization::find_any_state_by_user(uuid, &mut conn).await;
    let res = user.delete(&mut conn).await;

-    for membership in memberships {
+    for user_org in user_orgs {
        log_event(
            EventType::OrganizationUserRemoved as i32,
-            &membership.uuid,
-            &membership.org_uuid,
-            &ACTING_ADMIN_USER.into(),
+            &user_org.uuid,
+            &user_org.org_uuid,
+            ACTING_ADMIN_USER,
            14, // Use UnknownBrowser type
            &token.ip.ip,
            &mut conn,
@@ -417,9 +413,9 @@ async fn delete_user(user_id: UserId, token: AdminToken, mut conn: DbConn) -> Em
    res
 }

-#[post("/users/<user_id>/deauth", format = "application/json")]
-async fn deauth_user(user_id: UserId, _token: AdminToken, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/deauth")]
+async fn deauth_user(uuid: &str, _token: AdminToken, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let mut user = get_user_or_404(uuid, &mut conn).await?;

    nt.send_logout(&user, None).await;

@@ -438,9 +434,9 @@ async fn deauth_user(user_id: UserId, _token: AdminToken, mut conn: DbConn, nt:
    user.save(&mut conn).await
 }

-#[post("/users/<user_id>/disable", format = "application/json")]
-async fn disable_user(user_id: UserId, _token: AdminToken, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/disable")]
+async fn disable_user(uuid: &str, _token: AdminToken, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let mut user = get_user_or_404(uuid, &mut conn).await?;
    Device::delete_all_by_user(&user.uuid, &mut conn).await?;
    user.reset_security_stamp();
    user.enabled = false;
@@ -452,35 +448,33 @@ async fn disable_user(user_id: UserId, _token: AdminToken, mut conn: DbConn, nt:
    save_result
 }

-#[post("/users/<user_id>/enable", format = "application/json")]
-async fn enable_user(user_id: UserId, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/enable")]
+async fn enable_user(uuid: &str, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let mut user = get_user_or_404(uuid, &mut conn).await?;
    user.enabled = true;

    user.save(&mut conn).await
 }

-#[post("/users/<user_id>/remove-2fa", format = "application/json")]
-async fn remove_2fa(user_id: UserId, token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/remove-2fa")]
+async fn remove_2fa(uuid: &str, token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let mut user = get_user_or_404(uuid, &mut conn).await?;
    TwoFactor::delete_all_by_user(&user.uuid, &mut conn).await?;
-    two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &mut conn).await?;
+    two_factor::enforce_2fa_policy(&user, ACTING_ADMIN_USER, 14, &token.ip.ip, &mut conn).await?;
    user.totp_recover = None;
    user.save(&mut conn).await
 }

-#[post("/users/<user_id>/invite/resend", format = "application/json")]
-async fn resend_user_invite(user_id: UserId, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    if let Some(user) = User::find_by_uuid(&user_id, &mut conn).await {
+#[post("/users/<uuid>/invite/resend")]
+async fn resend_user_invite(uuid: &str, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    if let Some(user) = User::find_by_uuid(uuid, &mut conn).await {
        //TODO: replace this with user.status check when it will be available (PR#3397)
        if !user.password_hash.is_empty() {
            err_code!("User already accepted invitation", Status::BadRequest.code);
        }

        if CONFIG.mail_enabled() {
-            let org_id: OrganizationId = FAKE_ADMIN_UUID.to_string().into();
-            let member_id: MembershipId = FAKE_ADMIN_UUID.to_string().into();
-            mail::send_invite(&user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
+            mail::send_invite(&user, None, None, &CONFIG.invitation_org_name(), None).await
        } else {
            Ok(())
        }
@@ -490,41 +484,42 @@ async fn resend_user_invite(user_id: UserId, _token: AdminToken, mut conn: DbCon
 }

 #[derive(Debug, Deserialize)]
-struct MembershipTypeData {
+struct UserOrgTypeData {
    user_type: NumberOrString,
-    user_uuid: UserId,
-    org_uuid: OrganizationId,
+    user_uuid: String,
+    org_uuid: String,
 }

-#[post("/users/org_type", format = "application/json", data = "<data>")]
-async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let data: MembershipTypeData = data.into_inner();
+#[post("/users/org_type", data = "<data>")]
+async fn update_user_org_type(data: Json<UserOrgTypeData>, token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let data: UserOrgTypeData = data.into_inner();

-    let Some(mut member_to_edit) = Membership::find_by_user_and_org(&data.user_uuid, &data.org_uuid, &mut conn).await
-    else {
-        err!("The specified user isn't member of the organization")
-    };
+    let mut user_to_edit =
+        match UserOrganization::find_by_user_and_org(&data.user_uuid, &data.org_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err!("The specified user isn't member of the organization"),
+        };

-    let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
+    let new_type = match UserOrgType::from_str(&data.user_type.into_string()) {
        Some(new_type) => new_type as i32,
        None => err!("Invalid type"),
    };

-    if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
+    if user_to_edit.atype == UserOrgType::Owner && new_type != UserOrgType::Owner {
        // Removing owner permission, check that there is at least one other confirmed owner
-        if Membership::count_confirmed_by_org_and_type(&data.org_uuid, MembershipType::Owner, &mut conn).await <= 1 {
+        if UserOrganization::count_confirmed_by_org_and_type(&data.org_uuid, UserOrgType::Owner, &mut conn).await <= 1 {
            err!("Can't change the type of the last owner")
        }
    }

-    // This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type
+    // This check is also done at api::organizations::{accept_invite(), _confirm_invite, _activate_user(), edit_user()}, update_user_org_type
    // It returns different error messages per function.
-    if new_type < MembershipType::Admin {
-        match OrgPolicy::is_user_allowed(&member_to_edit.user_uuid, &member_to_edit.org_uuid, true, &mut conn).await {
+    if new_type < UserOrgType::Admin {
+        match OrgPolicy::is_user_allowed(&user_to_edit.user_uuid, &user_to_edit.org_uuid, true, &mut conn).await {
            Ok(_) => {}
            Err(OrgPolicyErr::TwoFactorMissing) => {
                if CONFIG.email_2fa_auto_fallback() {
-                    two_factor::email::find_and_activate_email_2fa(&member_to_edit.user_uuid, &mut conn).await?;
+                    two_factor::email::find_and_activate_email_2fa(&user_to_edit.user_uuid, &mut conn).await?;
                } else {
                    err!("You cannot modify this user to this type because they have not setup 2FA");
                }
@@ -537,20 +532,20 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke

    log_event(
        EventType::OrganizationUserUpdated as i32,
-        &member_to_edit.uuid,
+        &user_to_edit.uuid,
        &data.org_uuid,
-        &ACTING_ADMIN_USER.into(),
+        ACTING_ADMIN_USER,
        14, // Use UnknownBrowser type
        &token.ip.ip,
        &mut conn,
    )
    .await;

-    member_to_edit.atype = new_type;
-    member_to_edit.save(&mut conn).await
+    user_to_edit.atype = new_type;
+    user_to_edit.save(&mut conn).await
 }

-#[post("/users/update_revision", format = "application/json")]
+#[post("/users/update_revision")]
 async fn update_revision_users(_token: AdminToken, mut conn: DbConn) -> EmptyResult {
    User::update_all_revisions(&mut conn).await
 }
@@ -561,7 +556,7 @@ async fn organizations_overview(_token: AdminToken, mut conn: DbConn) -> ApiResu
    let mut organizations_json = Vec::with_capacity(organizations.len());
    for o in organizations {
        let mut org = o.to_json();
-        org["user_count"] = json!(Membership::count_by_org(&o.uuid, &mut conn).await);
+        org["user_count"] = json!(UserOrganization::count_by_org(&o.uuid, &mut conn).await);
        org["cipher_count"] = json!(Cipher::count_by_org(&o.uuid, &mut conn).await);
        org["collection_count"] = json!(Collection::count_by_org(&o.uuid, &mut conn).await);
        org["group_count"] = json!(Group::count_by_org(&o.uuid, &mut conn).await);
@@ -575,9 +570,9 @@ async fn organizations_overview(_token: AdminToken, mut conn: DbConn) -> ApiResu
    Ok(Html(text))
 }

-#[post("/organizations/<org_id>/delete", format = "application/json")]
-async fn delete_organization(org_id: OrganizationId, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let org = Organization::find_by_uuid(&org_id, &mut conn).await.map_res("Organization doesn't exist")?;
+#[post("/organizations/<uuid>/delete")]
+async fn delete_organization(uuid: &str, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let org = Organization::find_by_uuid(uuid, &mut conn).await.map_res("Organization doesn't exist")?;
    org.delete(&mut conn).await
 }

@@ -606,8 +601,9 @@ async fn get_json_api<T: DeserializeOwned>(url: &str) -> Result<T, Error> {
 }

 async fn has_http_access() -> bool {
-    let Ok(req) = make_http_request(Method::HEAD, "https://github.com/dani-garcia/vaultwarden") else {
-        return false;
+    let req = match make_http_request(Method::HEAD, "https://github.com/dani-garcia/vaultwarden") {
+        Ok(r) => r,
+        Err(_) => return false,
    };
    match req.send().await {
        Ok(r) => r.status().is_success(),
@@ -717,7 +713,6 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, mut conn: DbConn)
        "ip_header_name": ip_header_name,
        "ip_header_config": &CONFIG.ip_header(),
        "uses_proxy": uses_proxy,
-        "enable_websocket": &CONFIG.enable_websocket(),
        "db_type": *DB_TYPE,
        "db_version": get_sql_server_version(&mut conn).await,
        "admin_url": format!("{}/diagnostics", admin_url()),
@@ -733,27 +728,22 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, mut conn: DbConn)
    Ok(Html(text))
 }

-#[get("/diagnostics/config", format = "application/json")]
+#[get("/diagnostics/config")]
 fn get_diagnostics_config(_token: AdminToken) -> Json<Value> {
    let support_json = CONFIG.get_support_json();
    Json(support_json)
 }

-#[get("/diagnostics/http?<code>")]
-fn get_diagnostics_http(code: u16, _token: AdminToken) -> EmptyResult {
-    err_code!(format!("Testing error {code} response"), code);
-}
-
-#[post("/config", format = "application/json", data = "<data>")]
+#[post("/config", data = "<data>")]
 fn post_config(data: Json<ConfigBuilder>, _token: AdminToken) -> EmptyResult {
    let data: ConfigBuilder = data.into_inner();
-    if let Err(e) = CONFIG.update_config(data, true) {
+    if let Err(e) = CONFIG.update_config(data) {
        err!(format!("Unable to save config: {e:?}"))
    }
    Ok(())
 }

-#[post("/config/delete", format = "application/json")]
+#[post("/config/delete")]
 fn delete_config(_token: AdminToken) -> EmptyResult {
    if let Err(e) = CONFIG.delete_user_config() {
        err!(format!("Unable to delete config: {e:?}"))
@@ -761,7 +751,7 @@ fn delete_config(_token: AdminToken) -> EmptyResult {
    Ok(())
 }

-#[post("/config/backup_db", format = "application/json")]
+#[post("/config/backup_db")]
 async fn backup_db(_token: AdminToken, mut conn: DbConn) -> ApiResult<String> {
    if *CAN_BACKUP {
        match backup_database(&mut conn).await {
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
@@ -1,7 +1,5 @@
-use std::collections::HashSet;
-
 use crate::db::DbPool;
-use chrono::Utc;
+use chrono::{SecondsFormat, Utc};
 use rocket::serde::json::Json;
 use serde_json::Value;

@@ -15,7 +13,7 @@ use crate::{
    crypto,
    db::{models::*, DbConn},
    mail,
-    util::{format_date, NumberOrString},
+    util::NumberOrString,
    CONFIG,
 };

@@ -30,7 +28,6 @@ pub fn routes() -> Vec<rocket::Route> {
        profile,
        put_profile,
        post_profile,
-        put_avatar,
        get_public_keys,
        post_keys,
        post_password,
@@ -43,8 +40,9 @@ pub fn routes() -> Vec<rocket::Route> {
        post_verify_email_token,
        post_delete_recover,
        post_delete_recover_token,
-        post_delete_account,
+        post_device_token,
        delete_account,
+        post_delete_account,
        revision_date,
        password_hint,
        prelogin,
@@ -52,9 +50,7 @@ pub fn routes() -> Vec<rocket::Route> {
        api_key,
        rotate_api_key,
        get_known_device,
-        get_all_devices,
-        get_device,
-        post_device_token,
+        put_avatar,
        put_device_token,
        put_clear_device_token,
        post_clear_device_token,
@@ -81,7 +77,7 @@ pub struct RegisterData {
    name: Option<String>,
    token: Option<String>,
    #[allow(dead_code)]
-    organization_user_id: Option<MembershipId>,
+    organization_user_id: Option<String>,
 }

 #[derive(Debug, Deserialize)]
@@ -108,15 +104,15 @@ fn enforce_password_hint_setting(password_hint: &Option<String>) -> EmptyResult
    }
    Ok(())
 }
-async fn is_email_2fa_required(member_id: Option<MembershipId>, conn: &mut DbConn) -> bool {
+async fn is_email_2fa_required(org_user_uuid: Option<String>, conn: &mut DbConn) -> bool {
    if !CONFIG._enable_email_2fa() {
        return false;
    }
    if CONFIG.email_2fa_enforce_on_verified_invite() {
        return true;
    }
-    if member_id.is_some() {
-        return OrgPolicy::is_enabled_for_member(&member_id.unwrap(), OrgPolicyType::TwoFactorAuthentication, conn)
+    if org_user_uuid.is_some() {
+        return OrgPolicy::is_enabled_for_member(&org_user_uuid.unwrap(), OrgPolicyType::TwoFactorAuthentication, conn)
            .await;
    }
    false
@@ -163,9 +159,9 @@ pub async fn _register(data: Json<RegisterData>, mut conn: DbConn) -> JsonResult
                    err!("Registration email does not match invite email")
                }
            } else if Invitation::take(&email, &mut conn).await {
-                for membership in Membership::find_invited_by_user(&user.uuid, &mut conn).await.iter_mut() {
-                    membership.status = MembershipStatus::Accepted as i32;
-                    membership.save(&mut conn).await?;
+                for user_org in UserOrganization::find_invited_by_user(&user.uuid, &mut conn).await.iter_mut() {
+                    user_org.status = UserOrgStatus::Accepted as i32;
+                    user_org.save(&mut conn).await?;
                }
                user
            } else if CONFIG.is_signup_allowed(&email)
@@ -307,9 +303,9 @@ async fn put_avatar(data: Json<AvatarData>, headers: Headers, mut conn: DbConn)
    Ok(Json(user.to_json(&mut conn).await))
 }

-#[get("/users/<user_id>/public-key")]
-async fn get_public_keys(user_id: UserId, _headers: Headers, mut conn: DbConn) -> JsonResult {
-    let user = match User::find_by_uuid(&user_id, &mut conn).await {
+#[get("/users/<uuid>/public-key")]
+async fn get_public_keys(uuid: &str, _headers: Headers, mut conn: DbConn) -> JsonResult {
+    let user = match User::find_by_uuid(uuid, &mut conn).await {
        Some(user) if user.public_key.is_some() => user,
        Some(_) => err_code!("User has no public_key", Status::NotFound.code),
        None => err_code!("User doesn't exist", Status::NotFound.code),
@@ -368,12 +364,7 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, mut conn: D
        &data.new_master_password_hash,
        Some(data.key),
        true,
-        Some(vec![
-            String::from("post_rotatekey"),
-            String::from("get_contacts"),
-            String::from("get_public_keys"),
-            String::from("get_api_webauthn"),
-        ]),
+        Some(vec![String::from("post_rotatekey"), String::from("get_contacts"), String::from("get_public_keys")]),
    );

    let save_result = user.save(&mut conn).await;
@@ -381,7 +372,7 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, mut conn: D
    // Prevent logging out the client where the user requested this endpoint from.
    // If you do logout the user it will causes issues at the client side.
    // Adding the device uuid will prevent this.
-    nt.send_logout(&user, Some(headers.device.uuid.clone())).await;
+    nt.send_logout(&user, Some(headers.device.uuid)).await;

    save_result
 }
@@ -441,7 +432,7 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, mut conn: DbConn,
    user.set_password(&data.new_master_password_hash, Some(data.key), true, None);
    let save_result = user.save(&mut conn).await;

-    nt.send_logout(&user, Some(headers.device.uuid.clone())).await;
+    nt.send_logout(&user, Some(headers.device.uuid)).await;

    save_result
 }
@@ -452,21 +443,21 @@ struct UpdateFolderData {
    // There is a bug in 2024.3.x which adds a `null` item.
    // To bypass this we allow a Option here, but skip it during the updates
    // See: https://github.com/bitwarden/clients/issues/8453
-    id: Option<FolderId>,
+    id: Option<String>,
    name: String,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct UpdateEmergencyAccessData {
-    id: EmergencyAccessId,
+    id: String,
    key_encrypted: String,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct UpdateResetPasswordData {
-    organization_id: OrganizationId,
+    organization_id: String,
    reset_password_key: String,
 }

@@ -486,61 +477,6 @@ struct KeyData {
    private_key: String,
 }

-fn validate_keydata(
-    data: &KeyData,
-    existing_ciphers: &[Cipher],
-    existing_folders: &[Folder],
-    existing_emergency_access: &[EmergencyAccess],
-    existing_memberships: &[Membership],
-    existing_sends: &[Send],
-) -> EmptyResult {
-    // Check that we're correctly rotating all the user's ciphers
-    let existing_cipher_ids = existing_ciphers.iter().map(|c| &c.uuid).collect::<HashSet<&CipherId>>();
-    let provided_cipher_ids = data
-        .ciphers
-        .iter()
-        .filter(|c| c.organization_id.is_none())
-        .filter_map(|c| c.id.as_ref())
-        .collect::<HashSet<&CipherId>>();
-    if !provided_cipher_ids.is_superset(&existing_cipher_ids) {
-        err!("All existing ciphers must be included in the rotation")
-    }
-
-    // Check that we're correctly rotating all the user's folders
-    let existing_folder_ids = existing_folders.iter().map(|f| &f.uuid).collect::<HashSet<&FolderId>>();
-    let provided_folder_ids = data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
-    if !provided_folder_ids.is_superset(&existing_folder_ids) {
-        err!("All existing folders must be included in the rotation")
-    }
-
-    // Check that we're correctly rotating all the user's emergency access keys
-    let existing_emergency_access_ids =
-        existing_emergency_access.iter().map(|ea| &ea.uuid).collect::<HashSet<&EmergencyAccessId>>();
-    let provided_emergency_access_ids =
-        data.emergency_access_keys.iter().map(|ea| &ea.id).collect::<HashSet<&EmergencyAccessId>>();
-    if !provided_emergency_access_ids.is_superset(&existing_emergency_access_ids) {
-        err!("All existing emergency access keys must be included in the rotation")
-    }
-
-    // Check that we're correctly rotating all the user's reset password keys
-    let existing_reset_password_ids =
-        existing_memberships.iter().map(|m| &m.org_uuid).collect::<HashSet<&OrganizationId>>();
-    let provided_reset_password_ids =
-        data.reset_password_keys.iter().map(|rp| &rp.organization_id).collect::<HashSet<&OrganizationId>>();
-    if !provided_reset_password_ids.is_superset(&existing_reset_password_ids) {
-        err!("All existing reset password keys must be included in the rotation")
-    }
-
-    // Check that we're correctly rotating all the user's sends
-    let existing_send_ids = existing_sends.iter().map(|s| &s.uuid).collect::<HashSet<&SendId>>();
-    let provided_send_ids = data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
-    if !provided_send_ids.is_superset(&existing_send_ids) {
-        err!("All existing sends must be included in the rotation")
-    }
-
-    Ok(())
-}
-
 #[post("/accounts/key", data = "<data>")]
 async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
    // TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
@@ -556,36 +492,22 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,
    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
    Cipher::validate_cipher_data(&data.ciphers)?;

-    let user_id = &headers.user.uuid;
-
-    // TODO: Ideally we'd do everything after this point in a single transaction.
-
-    let mut existing_ciphers = Cipher::find_owned_by_user(user_id, &mut conn).await;
-    let mut existing_folders = Folder::find_by_user(user_id, &mut conn).await;
-    let mut existing_emergency_access = EmergencyAccess::find_all_by_grantor_uuid(user_id, &mut conn).await;
-    let mut existing_memberships = Membership::find_by_user(user_id, &mut conn).await;
-    // We only rotate the reset password key if it is set.
-    existing_memberships.retain(|m| m.reset_password_key.is_some());
-    let mut existing_sends = Send::find_by_user(user_id, &mut conn).await;
-
-    validate_keydata(
-        &data,
-        &existing_ciphers,
-        &existing_folders,
-        &existing_emergency_access,
-        &existing_memberships,
-        &existing_sends,
-    )?;
+    let user_uuid = &headers.user.uuid;

    // Update folder data
    for folder_data in data.folders {
        // Skip `null` folder id entries.
        // See: https://github.com/bitwarden/clients/issues/8453
        if let Some(folder_id) = folder_data.id {
-            let Some(saved_folder) = existing_folders.iter_mut().find(|f| f.uuid == folder_id) else {
-                err!("Folder doesn't exist")
+            let mut saved_folder = match Folder::find_by_uuid(&folder_id, &mut conn).await {
+                Some(folder) => folder,
+                None => err!("Folder doesn't exist"),
            };

+            if &saved_folder.user_uuid != user_uuid {
+                err!("The folder is not owned by the user")
+            }
+
            saved_folder.name = folder_data.name;
            saved_folder.save(&mut conn).await?
        }
@@ -593,11 +515,12 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,

    // Update emergency access data
    for emergency_access_data in data.emergency_access_keys {
-        let Some(saved_emergency_access) =
-            existing_emergency_access.iter_mut().find(|ea| ea.uuid == emergency_access_data.id)
-        else {
-            err!("Emergency access doesn't exist or is not owned by the user")
-        };
+        let mut saved_emergency_access =
+            match EmergencyAccess::find_by_uuid_and_grantor_uuid(&emergency_access_data.id, user_uuid, &mut conn).await
+            {
+                Some(emergency_access) => emergency_access,
+                None => err!("Emergency access doesn't exist or is not owned by the user"),
+            };

        saved_emergency_access.key_encrypted = Some(emergency_access_data.key_encrypted);
        saved_emergency_access.save(&mut conn).await?
@@ -605,23 +528,26 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,

    // Update reset password data
    for reset_password_data in data.reset_password_keys {
-        let Some(membership) =
-            existing_memberships.iter_mut().find(|m| m.org_uuid == reset_password_data.organization_id)
-        else {
-            err!("Reset password doesn't exist")
-        };
+        let mut user_org =
+            match UserOrganization::find_by_user_and_org(user_uuid, &reset_password_data.organization_id, &mut conn)
+                .await
+            {
+                Some(reset_password) => reset_password,
+                None => err!("Reset password doesn't exist"),
+            };

-        membership.reset_password_key = Some(reset_password_data.reset_password_key);
-        membership.save(&mut conn).await?
+        user_org.reset_password_key = Some(reset_password_data.reset_password_key);
+        user_org.save(&mut conn).await?
    }

    // Update send data
    for send_data in data.sends {
-        let Some(send) = existing_sends.iter_mut().find(|s| &s.uuid == send_data.id.as_ref().unwrap()) else {
-            err!("Send doesn't exist")
+        let mut send = match Send::find_by_uuid(send_data.id.as_ref().unwrap(), &mut conn).await {
+            Some(send) => send,
+            None => err!("Send doesn't exist"),
        };

-        update_send_from_data(send, send_data, &headers, &mut conn, &nt, UpdateType::None).await?;
+        update_send_from_data(&mut send, send_data, &headers, &mut conn, &nt, UpdateType::None).await?;
    }

    // Update cipher data
@@ -629,15 +555,20 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,

    for cipher_data in data.ciphers {
        if cipher_data.organization_id.is_none() {
-            let Some(saved_cipher) = existing_ciphers.iter_mut().find(|c| &c.uuid == cipher_data.id.as_ref().unwrap())
-            else {
-                err!("Cipher doesn't exist")
+            let mut saved_cipher = match Cipher::find_by_uuid(cipher_data.id.as_ref().unwrap(), &mut conn).await {
+                Some(cipher) => cipher,
+                None => err!("Cipher doesn't exist"),
            };

+            if saved_cipher.user_uuid.as_ref().unwrap() != user_uuid {
+                err!("The cipher is not owned by the user")
+            }
+
            // Prevent triggering cipher updates via WebSockets by settings UpdateType::None
            // The user sessions are invalidated because all the ciphers were re-encrypted and thus triggering an update could cause issues.
            // We force the users to logout after the user has been saved to try and prevent these issues.
-            update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &mut conn, &nt, UpdateType::None).await?
+            update_cipher_from_data(&mut saved_cipher, cipher_data, &headers, None, &mut conn, &nt, UpdateType::None)
+                .await?
        }
    }

@@ -653,7 +584,7 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, mut conn: DbConn,
    // Prevent logging out the client where the user requested this endpoint from.
    // If you do logout the user it will causes issues at the client side.
    // Adding the device uuid will prevent this.
-    nt.send_logout(&user, Some(headers.device.uuid.clone())).await;
+    nt.send_logout(&user, Some(headers.device.uuid)).await;

    save_result
 }
@@ -800,7 +731,7 @@ async fn post_verify_email(headers: Headers) -> EmptyResult {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct VerifyEmailTokenData {
-    user_id: UserId,
+    user_id: String,
    token: String,
 }

@@ -808,14 +739,16 @@ struct VerifyEmailTokenData {
 async fn post_verify_email_token(data: Json<VerifyEmailTokenData>, mut conn: DbConn) -> EmptyResult {
    let data: VerifyEmailTokenData = data.into_inner();

-    let Some(mut user) = User::find_by_uuid(&data.user_id, &mut conn).await else {
-        err!("User doesn't exist")
+    let mut user = match User::find_by_uuid(&data.user_id, &mut conn).await {
+        Some(user) => user,
+        None => err!("User doesn't exist"),
    };

-    let Ok(claims) = decode_verify_email(&data.token) else {
-        err!("Invalid claim")
+    let claims = match decode_verify_email(&data.token) {
+        Ok(claims) => claims,
+        Err(_) => err!("Invalid claim"),
    };
-    if claims.sub != *user.uuid {
+    if claims.sub != user.uuid {
        err!("Invalid claim");
    }
    user.verified_at = Some(Utc::now().naive_utc());
@@ -857,7 +790,7 @@ async fn post_delete_recover(data: Json<DeleteRecoverData>, mut conn: DbConn) ->
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct DeleteRecoverTokenData {
-    user_id: UserId,
+    user_id: String,
    token: String,
 }

@@ -865,15 +798,16 @@ struct DeleteRecoverTokenData {
 async fn post_delete_recover_token(data: Json<DeleteRecoverTokenData>, mut conn: DbConn) -> EmptyResult {
    let data: DeleteRecoverTokenData = data.into_inner();

-    let Ok(claims) = decode_delete(&data.token) else {
-        err!("Invalid claim")
+    let user = match User::find_by_uuid(&data.user_id, &mut conn).await {
+        Some(user) => user,
+        None => err!("User doesn't exist"),
    };

-    let Some(user) = User::find_by_uuid(&data.user_id, &mut conn).await else {
-        err!("User doesn't exist")
+    let claims = match decode_delete(&data.token) {
+        Ok(claims) => claims,
+        Err(_) => err!("Invalid claim"),
    };
-
-    if claims.sub != *user.uuid {
+    if claims.sub != user.uuid {
        err!("Invalid claim");
    }
    user.delete(&mut conn).await
@@ -908,7 +842,7 @@ struct PasswordHintData {

 #[post("/accounts/password-hint", data = "<data>")]
 async fn password_hint(data: Json<PasswordHintData>, mut conn: DbConn) -> EmptyResult {
-    if !CONFIG.password_hints_allowed() || (!CONFIG.mail_enabled() && !CONFIG.show_password_hint()) {
+    if !CONFIG.mail_enabled() && !CONFIG.show_password_hint() {
        err!("This server is not configured to provide password hints.");
    }

@@ -967,12 +901,14 @@ pub async fn _prelogin(data: Json<PreloginData>, mut conn: DbConn) -> Json<Value
        None => (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
    };

-    Json(json!({
+    let result = json!({
        "kdf": kdf_type,
        "kdfIterations": kdf_iter,
        "kdfMemory": kdf_mem,
        "kdfParallelism": kdf_para,
-    }))
+    });
+
+    Json(result)
 }

 // https://github.com/bitwarden/server/blob/master/src/Api/Models/Request/Accounts/SecretVerificationRequestModel.cs
@@ -1035,7 +971,7 @@ async fn get_known_device(device: KnownDevice, mut conn: DbConn) -> JsonResult {

 struct KnownDevice {
    email: String,
-    uuid: DeviceId,
+    uuid: String,
 }

 #[rocket::async_trait]
@@ -1044,8 +980,11 @@ impl<'r> FromRequest<'r> for KnownDevice {

    async fn from_request(req: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let email = if let Some(email_b64) = req.headers().get_one("X-Request-Email") {
-            let Ok(email_bytes) = data_encoding::BASE64URL_NOPAD.decode(email_b64.as_bytes()) else {
-                return Outcome::Error((Status::BadRequest, "X-Request-Email value failed to decode as base64url"));
+            let email_bytes = match data_encoding::BASE64URL_NOPAD.decode(email_b64.as_bytes()) {
+                Ok(bytes) => bytes,
+                Err(_) => {
+                    return Outcome::Error((Status::BadRequest, "X-Request-Email value failed to decode as base64url"));
+                }
            };
            match String::from_utf8(email_bytes) {
                Ok(email) => email,
@@ -1058,7 +997,7 @@ impl<'r> FromRequest<'r> for KnownDevice {
        };

        let uuid = if let Some(uuid) = req.headers().get_one("X-Device-Identifier") {
-            uuid.to_string().into()
+            uuid.to_string()
        } else {
            return Outcome::Error((Status::BadRequest, "X-Device-Identifier value is required"));
        };
@@ -1070,57 +1009,32 @@ impl<'r> FromRequest<'r> for KnownDevice {
    }
 }

-#[get("/devices")]
-async fn get_all_devices(headers: Headers, mut conn: DbConn) -> JsonResult {
-    let devices = Device::find_with_auth_request_by_user(&headers.user.uuid, &mut conn).await;
-    let devices = devices.iter().map(|device| device.to_json()).collect::<Vec<Value>>();
-
-    Ok(Json(json!({
-        "data": devices,
-        "continuationToken": null,
-        "object": "list"
-    })))
-}
-
-#[get("/devices/identifier/<device_id>")]
-async fn get_device(device_id: DeviceId, headers: Headers, mut conn: DbConn) -> JsonResult {
-    let Some(device) = Device::find_by_uuid_and_user(&device_id, &headers.user.uuid, &mut conn).await else {
-        err!("No device found");
-    };
-    Ok(Json(device.to_json()))
-}
-
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct PushToken {
    push_token: String,
 }

-#[post("/devices/identifier/<device_id>/token", data = "<data>")]
-async fn post_device_token(device_id: DeviceId, data: Json<PushToken>, headers: Headers, conn: DbConn) -> EmptyResult {
-    put_device_token(device_id, data, headers, conn).await
+#[post("/devices/identifier/<uuid>/token", data = "<data>")]
+async fn post_device_token(uuid: &str, data: Json<PushToken>, headers: Headers, conn: DbConn) -> EmptyResult {
+    put_device_token(uuid, data, headers, conn).await
 }

-#[put("/devices/identifier/<device_id>/token", data = "<data>")]
-async fn put_device_token(
-    device_id: DeviceId,
-    data: Json<PushToken>,
-    headers: Headers,
-    mut conn: DbConn,
-) -> EmptyResult {
+#[put("/devices/identifier/<uuid>/token", data = "<data>")]
+async fn put_device_token(uuid: &str, data: Json<PushToken>, headers: Headers, mut conn: DbConn) -> EmptyResult {
    let data = data.into_inner();
    let token = data.push_token;

-    let Some(mut device) = Device::find_by_uuid_and_user(&headers.device.uuid, &headers.user.uuid, &mut conn).await
-    else {
-        err!(format!("Error: device {device_id} should be present before a token can be assigned"))
+    let mut device = match Device::find_by_uuid_and_user(&headers.device.uuid, &headers.user.uuid, &mut conn).await {
+        Some(device) => device,
+        None => err!(format!("Error: device {uuid} should be present before a token can be assigned")),
    };

    // if the device already has been registered
    if device.is_registered() {
        // check if the new token is the same as the registered token
        if device.push_token.is_some() && device.push_token.unwrap() == token.clone() {
-            debug!("Device {} is already registered and token is the same", device_id);
+            debug!("Device {} is already registered and token is the same", uuid);
            return Ok(());
        } else {
            // Try to unregister already registered device
@@ -1139,8 +1053,8 @@ async fn put_device_token(
    Ok(())
 }

-#[put("/devices/identifier/<device_id>/clear-token")]
-async fn put_clear_device_token(device_id: DeviceId, mut conn: DbConn) -> EmptyResult {
+#[put("/devices/identifier/<uuid>/clear-token")]
+async fn put_clear_device_token(uuid: &str, mut conn: DbConn) -> EmptyResult {
    // This only clears push token
    // https://github.com/bitwarden/core/blob/master/src/Api/Controllers/DevicesController.cs#L109
    // https://github.com/bitwarden/core/blob/master/src/Core/Services/Implementations/DeviceService.cs#L37
@@ -1149,8 +1063,8 @@ async fn put_clear_device_token(device_id: DeviceId, mut conn: DbConn) -> EmptyR
        return Ok(());
    }

-    if let Some(device) = Device::find_by_uuid(&device_id, &mut conn).await {
-        Device::clear_push_token_by_uuid(&device_id, &mut conn).await?;
+    if let Some(device) = Device::find_by_uuid(uuid, &mut conn).await {
+        Device::clear_push_token_by_uuid(uuid, &mut conn).await?;
        unregister_push_device(device.push_uuid).await?;
    }

@@ -1158,47 +1072,43 @@ async fn put_clear_device_token(device_id: DeviceId, mut conn: DbConn) -> EmptyR
 }

 // On upstream server, both PUT and POST are declared. Implementing the POST method in case it would be useful somewhere
-#[post("/devices/identifier/<device_id>/clear-token")]
-async fn post_clear_device_token(device_id: DeviceId, conn: DbConn) -> EmptyResult {
-    put_clear_device_token(device_id, conn).await
+#[post("/devices/identifier/<uuid>/clear-token")]
+async fn post_clear_device_token(uuid: &str, conn: DbConn) -> EmptyResult {
+    put_clear_device_token(uuid, conn).await
 }

 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct AuthRequestRequest {
    access_code: String,
-    device_identifier: DeviceId,
+    device_identifier: String,
    email: String,
    public_key: String,
-    // Not used for now
-    // #[serde(alias = "type")]
-    // _type: i32,
+    #[serde(alias = "type")]
+    _type: i32,
 }

 #[post("/auth-requests", data = "<data>")]
 async fn post_auth_request(
    data: Json<AuthRequestRequest>,
-    client_headers: ClientHeaders,
+    headers: ClientHeaders,
    mut conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
    let data = data.into_inner();

-    let Some(user) = User::find_by_mail(&data.email, &mut conn).await else {
-        err!("AuthRequest doesn't exist", "User not found")
+    let user = match User::find_by_mail(&data.email, &mut conn).await {
+        Some(user) => user,
+        None => {
+            err!("AuthRequest doesn't exist")
+        }
    };

-    // Validate device uuid and type
-    match Device::find_by_uuid_and_user(&data.device_identifier, &user.uuid, &mut conn).await {
-        Some(device) if device.atype == client_headers.device_type => {}
-        _ => err!("AuthRequest doesn't exist", "Device verification failed"),
-    }
-
    let mut auth_request = AuthRequest::new(
        user.uuid.clone(),
        data.device_identifier.clone(),
-        client_headers.device_type,
-        client_headers.ip.ip.to_string(),
+        headers.device_type,
+        headers.ip.ip.to_string(),
        data.access_code,
        data.public_key,
    );
@@ -1213,7 +1123,7 @@ async fn post_auth_request(
        "requestIpAddress": auth_request.request_ip,
        "key": null,
        "masterPasswordHash": null,
-        "creationDate": format_date(&auth_request.creation_date),
+        "creationDate": auth_request.creation_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true),
        "responseDate": null,
        "requestApproved": false,
        "origin": CONFIG.domain_origin(),
@@ -1221,125 +1131,125 @@ async fn post_auth_request(
    })))
 }

-#[get("/auth-requests/<auth_request_id>")]
-async fn get_auth_request(auth_request_id: AuthRequestId, headers: Headers, mut conn: DbConn) -> JsonResult {
-    let Some(auth_request) = AuthRequest::find_by_uuid_and_user(&auth_request_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("AuthRequest doesn't exist", "Record not found or user uuid does not match")
+#[get("/auth-requests/<uuid>")]
+async fn get_auth_request(uuid: &str, mut conn: DbConn) -> JsonResult {
+    let auth_request = match AuthRequest::find_by_uuid(uuid, &mut conn).await {
+        Some(auth_request) => auth_request,
+        None => {
+            err!("AuthRequest doesn't exist")
+        }
    };

-    let response_date_utc = auth_request.response_date.map(|response_date| format_date(&response_date));
+    let response_date_utc = auth_request
+        .response_date
+        .map(|response_date| response_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true));

-    Ok(Json(json!({
-        "id": &auth_request_id,
-        "publicKey": auth_request.public_key,
-        "requestDeviceType": DeviceType::from_i32(auth_request.device_type).to_string(),
-        "requestIpAddress": auth_request.request_ip,
-        "key": auth_request.enc_key,
-        "masterPasswordHash": auth_request.master_password_hash,
-        "creationDate": format_date(&auth_request.creation_date),
-        "responseDate": response_date_utc,
-        "requestApproved": auth_request.approved,
-        "origin": CONFIG.domain_origin(),
-        "object":"auth-request"
-    })))
+    Ok(Json(json!(
+        {
+            "id": uuid,
+            "publicKey": auth_request.public_key,
+            "requestDeviceType": DeviceType::from_i32(auth_request.device_type).to_string(),
+            "requestIpAddress": auth_request.request_ip,
+            "key": auth_request.enc_key,
+            "masterPasswordHash": auth_request.master_password_hash,
+            "creationDate": auth_request.creation_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true),
+            "responseDate": response_date_utc,
+            "requestApproved": auth_request.approved,
+            "origin": CONFIG.domain_origin(),
+            "object":"auth-request"
+        }
+    )))
 }

 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct AuthResponseRequest {
-    device_identifier: DeviceId,
+    device_identifier: String,
    key: String,
    master_password_hash: Option<String>,
    request_approved: bool,
 }

-#[put("/auth-requests/<auth_request_id>", data = "<data>")]
+#[put("/auth-requests/<uuid>", data = "<data>")]
 async fn put_auth_request(
-    auth_request_id: AuthRequestId,
+    uuid: &str,
    data: Json<AuthResponseRequest>,
-    headers: Headers,
    mut conn: DbConn,
    ant: AnonymousNotify<'_>,
    nt: Notify<'_>,
 ) -> JsonResult {
    let data = data.into_inner();
-    let Some(mut auth_request) =
-        AuthRequest::find_by_uuid_and_user(&auth_request_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("AuthRequest doesn't exist", "Record not found or user uuid does not match")
+    let mut auth_request: AuthRequest = match AuthRequest::find_by_uuid(uuid, &mut conn).await {
+        Some(auth_request) => auth_request,
+        None => {
+            err!("AuthRequest doesn't exist")
+        }
    };

-    if auth_request.approved.is_some() {
-        err!("An authentication request with the same device already exists")
-    }
-
-    let response_date = Utc::now().naive_utc();
-    let response_date_utc = format_date(&response_date);
-
-    if data.request_approved {
-        auth_request.approved = Some(data.request_approved);
-        auth_request.enc_key = Some(data.key);
-        auth_request.master_password_hash = data.master_password_hash;
-        auth_request.response_device_id = Some(data.device_identifier.clone());
-        auth_request.response_date = Some(response_date);
-        auth_request.save(&mut conn).await?;
+    auth_request.approved = Some(data.request_approved);
+    auth_request.enc_key = Some(data.key);
+    auth_request.master_password_hash = data.master_password_hash;
+    auth_request.response_device_id = Some(data.device_identifier.clone());
+    auth_request.save(&mut conn).await?;

+    if auth_request.approved.unwrap_or(false) {
        ant.send_auth_response(&auth_request.user_uuid, &auth_request.uuid).await;
-        nt.send_auth_response(&auth_request.user_uuid, &auth_request.uuid, &data.device_identifier, &mut conn).await;
-    } else {
-        // If denied, there's no reason to keep the request
-        auth_request.delete(&mut conn).await?;
+        nt.send_auth_response(&auth_request.user_uuid, &auth_request.uuid, data.device_identifier, &mut conn).await;
    }

-    Ok(Json(json!({
-        "id": &auth_request_id,
-        "publicKey": auth_request.public_key,
-        "requestDeviceType": DeviceType::from_i32(auth_request.device_type).to_string(),
-        "requestIpAddress": auth_request.request_ip,
-        "key": auth_request.enc_key,
-        "masterPasswordHash": auth_request.master_password_hash,
-        "creationDate": format_date(&auth_request.creation_date),
-        "responseDate": response_date_utc,
-        "requestApproved": auth_request.approved,
-        "origin": CONFIG.domain_origin(),
-        "object":"auth-request"
-    })))
+    let response_date_utc = auth_request
+        .response_date
+        .map(|response_date| response_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true));
+
+    Ok(Json(json!(
+        {
+            "id": uuid,
+            "publicKey": auth_request.public_key,
+            "requestDeviceType": DeviceType::from_i32(auth_request.device_type).to_string(),
+            "requestIpAddress": auth_request.request_ip,
+            "key": auth_request.enc_key,
+            "masterPasswordHash": auth_request.master_password_hash,
+            "creationDate": auth_request.creation_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true),
+            "responseDate": response_date_utc,
+            "requestApproved": auth_request.approved,
+            "origin": CONFIG.domain_origin(),
+            "object":"auth-request"
+        }
+    )))
 }

-#[get("/auth-requests/<auth_request_id>/response?<code>")]
-async fn get_auth_request_response(
-    auth_request_id: AuthRequestId,
-    code: &str,
-    client_headers: ClientHeaders,
-    mut conn: DbConn,
-) -> JsonResult {
-    let Some(auth_request) = AuthRequest::find_by_uuid(&auth_request_id, &mut conn).await else {
-        err!("AuthRequest doesn't exist", "User not found")
+#[get("/auth-requests/<uuid>/response?<code>")]
+async fn get_auth_request_response(uuid: &str, code: &str, mut conn: DbConn) -> JsonResult {
+    let auth_request = match AuthRequest::find_by_uuid(uuid, &mut conn).await {
+        Some(auth_request) => auth_request,
+        None => {
+            err!("AuthRequest doesn't exist")
+        }
    };

-    if auth_request.device_type != client_headers.device_type
-        || auth_request.request_ip != client_headers.ip.ip.to_string()
-        || !auth_request.check_access_code(code)
-    {
-        err!("AuthRequest doesn't exist", "Invalid device, IP or code")
+    if !auth_request.check_access_code(code) {
+        err!("Access code invalid doesn't exist")
    }

-    let response_date_utc = auth_request.response_date.map(|response_date| format_date(&response_date));
+    let response_date_utc = auth_request
+        .response_date
+        .map(|response_date| response_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true));

-    Ok(Json(json!({
-        "id": &auth_request_id,
-        "publicKey": auth_request.public_key,
-        "requestDeviceType": DeviceType::from_i32(auth_request.device_type).to_string(),
-        "requestIpAddress": auth_request.request_ip,
-        "key": auth_request.enc_key,
-        "masterPasswordHash": auth_request.master_password_hash,
-        "creationDate": format_date(&auth_request.creation_date),
-        "responseDate": response_date_utc,
-        "requestApproved": auth_request.approved,
-        "origin": CONFIG.domain_origin(),
-        "object":"auth-request"
-    })))
+    Ok(Json(json!(
+        {
+            "id": uuid,
+            "publicKey": auth_request.public_key,
+            "requestDeviceType": DeviceType::from_i32(auth_request.device_type).to_string(),
+            "requestIpAddress": auth_request.request_ip,
+            "key": auth_request.enc_key,
+            "masterPasswordHash": auth_request.master_password_hash,
+            "creationDate": auth_request.creation_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true),
+            "responseDate": response_date_utc,
+            "requestApproved": auth_request.approved,
+            "origin": CONFIG.domain_origin(),
+            "object":"auth-request"
+        }
+    )))
 }

 #[get("/auth-requests")]
@@ -1351,7 +1261,7 @@ async fn get_auth_requests(headers: Headers, mut conn: DbConn) -> JsonResult {
            .iter()
            .filter(|request| request.approved.is_none())
            .map(|request| {
-            let response_date_utc = request.response_date.map(|response_date| format_date(&response_date));
+            let response_date_utc = request.response_date.map(|response_date| response_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true));

            json!({
                "id": request.uuid,
@@ -1360,7 +1270,7 @@ async fn get_auth_requests(headers: Headers, mut conn: DbConn) -> JsonResult {
                "requestIpAddress": request.request_ip,
                "key": request.enc_key,
                "masterPasswordHash": request.master_password_hash,
-                "creationDate": format_date(&request.creation_date),
+                "creationDate": request.creation_date.and_utc().to_rfc3339_opts(SecondsFormat::Micros, true),
                "responseDate": response_date_utc,
                "requestApproved": request.approved,
                "origin": CONFIG.domain_origin(),
--- a/src/api/core/ciphers.rs
+++ b/src/api/core/ciphers.rs
--- a/src/api/core/emergency_access.rs
+++ b/src/api/core/emergency_access.rs
@@ -93,10 +93,10 @@ async fn get_grantees(headers: Headers, mut conn: DbConn) -> Json<Value> {
 }

 #[get("/emergency-access/<emer_id>")]
-async fn get_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn get_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    match EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await {
+    match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
        Some(emergency_access) => Ok(Json(
            emergency_access.to_json_grantee_details(&mut conn).await.expect("Grantee user should exist but does not!"),
        )),
@@ -118,7 +118,7 @@ struct EmergencyAccessUpdateData {

 #[put("/emergency-access/<emer_id>", data = "<data>")]
 async fn put_emergency_access(
-    emer_id: EmergencyAccessId,
+    emer_id: &str,
    data: Json<EmergencyAccessUpdateData>,
    headers: Headers,
    conn: DbConn,
@@ -128,7 +128,7 @@ async fn put_emergency_access(

 #[post("/emergency-access/<emer_id>", data = "<data>")]
 async fn post_emergency_access(
-    emer_id: EmergencyAccessId,
+    emer_id: &str,
    data: Json<EmergencyAccessUpdateData>,
    headers: Headers,
    mut conn: DbConn,
@@ -137,11 +137,11 @@ async fn post_emergency_access(

    let data: EmergencyAccessUpdateData = data.into_inner();

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emergency_access) => emergency_access,
+            None => err!("Emergency access not valid."),
+        };

    let new_type = match EmergencyAccessType::from_str(&data.r#type.into_string()) {
        Some(new_type) => new_type as i32,
@@ -163,12 +163,12 @@ async fn post_emergency_access(
 // region delete

 #[delete("/emergency-access/<emer_id>")]
-async fn delete_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> EmptyResult {
+async fn delete_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> EmptyResult {
    check_emergency_access_enabled()?;

    let emergency_access = match (
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await,
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &headers.user.uuid, &mut conn).await,
+        EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await,
+        EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &headers.user.uuid, &mut conn).await,
    ) {
        (Some(grantor_emer), None) => {
            info!("Grantor deleted emergency access {emer_id}");
@@ -186,7 +186,7 @@ async fn delete_emergency_access(emer_id: EmergencyAccessId, headers: Headers, m
 }

 #[post("/emergency-access/<emer_id>/delete")]
-async fn post_delete_emergency_access(emer_id: EmergencyAccessId, headers: Headers, conn: DbConn) -> EmptyResult {
+async fn post_delete_emergency_access(emer_id: &str, headers: Headers, conn: DbConn) -> EmptyResult {
    delete_emergency_access(emer_id, headers, conn).await
 }

@@ -266,8 +266,8 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, mu
    if CONFIG.mail_enabled() {
        mail::send_emergency_access_invite(
            &new_emergency_access.email.expect("Grantee email does not exists"),
-            grantee_user.uuid,
-            new_emergency_access.uuid,
+            &grantee_user.uuid,
+            &new_emergency_access.uuid,
            &grantor_user.name,
            &grantor_user.email,
        )
@@ -281,25 +281,27 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, mu
 }

 #[post("/emergency-access/<emer_id>/reinvite")]
-async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> EmptyResult {
+async fn resend_invite(emer_id: &str, headers: Headers, mut conn: DbConn) -> EmptyResult {
    check_emergency_access_enabled()?;

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::Invited as i32 {
        err!("The grantee user is already accepted or confirmed to the organization");
    }

-    let Some(email) = emergency_access.email.clone() else {
-        err!("Email not valid.")
+    let email = match emergency_access.email.clone() {
+        Some(email) => email,
+        None => err!("Email not valid."),
    };

-    let Some(grantee_user) = User::find_by_mail(&email, &mut conn).await else {
-        err!("Grantee user not found.")
+    let grantee_user = match User::find_by_mail(&email, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantee user not found."),
    };

    let grantor_user = headers.user;
@@ -307,8 +309,8 @@ async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, mut conn: D
    if CONFIG.mail_enabled() {
        mail::send_emergency_access_invite(
            &email,
-            grantor_user.uuid,
-            emergency_access.uuid,
+            &grantor_user.uuid,
+            &emergency_access.uuid,
            &grantor_user.name,
            &grantor_user.email,
        )
@@ -331,12 +333,7 @@ struct AcceptData {
 }

 #[post("/emergency-access/<emer_id>/accept", data = "<data>")]
-async fn accept_invite(
-    emer_id: EmergencyAccessId,
-    data: Json<AcceptData>,
-    headers: Headers,
-    mut conn: DbConn,
-) -> EmptyResult {
+async fn accept_invite(emer_id: &str, data: Json<AcceptData>, headers: Headers, mut conn: DbConn) -> EmptyResult {
    check_emergency_access_enabled()?;

    let data: AcceptData = data.into_inner();
@@ -359,15 +356,16 @@ async fn accept_invite(

    // We need to search for the uuid in combination with the email, since we do not yet store the uuid of the grantee in the database.
    // The uuid of the grantee gets stored once accepted.
-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_email(&emer_id, &headers.user.email, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_email(emer_id, &headers.user.email, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    // get grantor user to send Accepted email
-    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    if emer_id == claims.emer_id
@@ -394,7 +392,7 @@ struct ConfirmData {

 #[post("/emergency-access/<emer_id>/confirm", data = "<data>")]
 async fn confirm_emergency_access(
-    emer_id: EmergencyAccessId,
+    emer_id: &str,
    data: Json<ConfirmData>,
    headers: Headers,
    mut conn: DbConn,
@@ -405,11 +403,11 @@ async fn confirm_emergency_access(
    let data: ConfirmData = data.into_inner();
    let key = data.key;

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &confirming_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &confirming_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::Accepted as i32
        || emergency_access.grantor_uuid != confirming_user.uuid
@@ -417,13 +415,15 @@ async fn confirm_emergency_access(
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&confirming_user.uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&confirming_user.uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    if let Some(grantee_uuid) = emergency_access.grantee_uuid.as_ref() {
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &mut conn).await else {
-            err!("Grantee user not found.")
+        let grantee_user = match User::find_by_uuid(grantee_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err!("Grantee user not found."),
        };

        emergency_access.status = EmergencyAccessStatus::Confirmed as i32;
@@ -446,22 +446,23 @@ async fn confirm_emergency_access(
 // region access emergency access

 #[post("/emergency-access/<emer_id>/initiate")]
-async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn initiate_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

    let initiating_user = headers.user;
-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &initiating_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &initiating_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::Confirmed as i32 {
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    let now = Utc::now().naive_utc();
@@ -484,26 +485,28 @@ async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 }

 #[post("/emergency-access/<emer_id>/approve")]
-async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn approve_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32 {
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&headers.user.uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&headers.user.uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    if let Some(grantee_uuid) = emergency_access.grantee_uuid.as_ref() {
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &mut conn).await else {
-            err!("Grantee user not found.")
+        let grantee_user = match User::find_by_uuid(grantee_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err!("Grantee user not found."),
        };

        emergency_access.status = EmergencyAccessStatus::RecoveryApproved as i32;
@@ -519,14 +522,14 @@ async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 }

 #[post("/emergency-access/<emer_id>/reject")]
-async fn reject_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn reject_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32
        && emergency_access.status != EmergencyAccessStatus::RecoveryApproved as i32
@@ -535,8 +538,9 @@ async fn reject_emergency_access(emer_id: EmergencyAccessId, headers: Headers, m
    }

    if let Some(grantee_uuid) = emergency_access.grantee_uuid.as_ref() {
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &mut conn).await else {
-            err!("Grantee user not found.")
+        let grantee_user = match User::find_by_uuid(grantee_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err!("Grantee user not found."),
        };

        emergency_access.status = EmergencyAccessStatus::Confirmed as i32;
@@ -556,14 +560,14 @@ async fn reject_emergency_access(emer_id: EmergencyAccessId, headers: Headers, m
 // region action

 #[post("/emergency-access/<emer_id>/view")]
-async fn view_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn view_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if !is_valid_request(&emergency_access, &headers.user.uuid, EmergencyAccessType::View) {
        err!("Emergency access not valid.")
@@ -594,22 +598,23 @@ async fn view_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut
 }

 #[post("/emergency-access/<emer_id>/takeover")]
-async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn takeover_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

    let requesting_user = headers.user;
-    let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &requesting_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &requesting_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if !is_valid_request(&emergency_access, &requesting_user.uuid, EmergencyAccessType::Takeover) {
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    let result = json!({
@@ -633,7 +638,7 @@ struct EmergencyAccessPasswordData {

 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
 async fn password_emergency_access(
-    emer_id: EmergencyAccessId,
+    emer_id: &str,
    data: Json<EmergencyAccessPasswordData>,
    headers: Headers,
    mut conn: DbConn,
@@ -645,18 +650,19 @@ async fn password_emergency_access(
    //let key = &data.Key;

    let requesting_user = headers.user;
-    let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &requesting_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &requesting_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if !is_valid_request(&emergency_access, &requesting_user.uuid, EmergencyAccessType::Takeover) {
        err!("Emergency access not valid.")
    }

-    let Some(mut grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let mut grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    // change grantor_user password
@@ -667,9 +673,9 @@ async fn password_emergency_access(
    TwoFactor::delete_all_by_user(&grantor_user.uuid, &mut conn).await?;

    // Remove grantor from all organisations unless Owner
-    for member in Membership::find_any_state_by_user(&grantor_user.uuid, &mut conn).await {
-        if member.atype != MembershipType::Owner as i32 {
-            member.delete(&mut conn).await?;
+    for user_org in UserOrganization::find_any_state_by_user(&grantor_user.uuid, &mut conn).await {
+        if user_org.atype != UserOrgType::Owner as i32 {
+            user_org.delete(&mut conn).await?;
        }
    }
    Ok(())
@@ -678,20 +684,21 @@ async fn password_emergency_access(
 // endregion

 #[get("/emergency-access/<emer_id>/policies")]
-async fn policies_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn policies_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    let requesting_user = headers.user;
-    let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &requesting_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &requesting_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if !is_valid_request(&emergency_access, &requesting_user.uuid, EmergencyAccessType::Takeover) {
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    let policies = OrgPolicy::find_confirmed_by_user(&grantor_user.uuid, &mut conn);
@@ -706,11 +713,11 @@ async fn policies_emergency_access(emer_id: EmergencyAccessId, headers: Headers,

 fn is_valid_request(
    emergency_access: &EmergencyAccess,
-    requesting_user_id: &UserId,
+    requesting_user_uuid: &str,
    requested_access_type: EmergencyAccessType,
 ) -> bool {
    emergency_access.grantee_uuid.is_some()
-        && emergency_access.grantee_uuid.as_ref().unwrap() == requesting_user_id
+        && emergency_access.grantee_uuid.as_ref().unwrap() == requesting_user_uuid
        && emergency_access.status == EmergencyAccessStatus::RecoveryApproved as i32
        && emergency_access.atype == requested_access_type as i32
 }
--- a/src/api/core/events.rs
+++ b/src/api/core/events.rs
@@ -8,7 +8,7 @@ use crate::{
    api::{EmptyResult, JsonResult},
    auth::{AdminHeaders, Headers},
    db::{
-        models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId},
+        models::{Cipher, Event, UserOrganization},
        DbConn, DbPool,
    },
    util::parse_date,
@@ -31,16 +31,7 @@ struct EventRange {

 // Upstream: https://github.com/bitwarden/server/blob/9ecf69d9cabce732cf2c57976dd9afa5728578fb/src/Api/Controllers/EventsController.cs#LL84C35-L84C41
 #[get("/organizations/<org_id>/events?<data..>")]
-async fn get_org_events(
-    org_id: OrganizationId,
-    data: EventRange,
-    headers: AdminHeaders,
-    mut conn: DbConn,
-) -> JsonResult {
-    if org_id != headers.org_id {
-        err!("Organization not found", "Organization id's do not match");
-    }
-
+async fn get_org_events(org_id: &str, data: EventRange, _headers: AdminHeaders, mut conn: DbConn) -> JsonResult {
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
@@ -53,7 +44,7 @@ async fn get_org_events(
            parse_date(&data.end)
        };

-        Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &mut conn)
+        Event::find_by_organization_uuid(org_id, &start_date, &end_date, &mut conn)
            .await
            .iter()
            .map(|e| e.to_json())
@@ -68,14 +59,14 @@ async fn get_org_events(
 }

 #[get("/ciphers/<cipher_id>/events?<data..>")]
-async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn get_cipher_events(cipher_id: &str, data: EventRange, headers: Headers, mut conn: DbConn) -> JsonResult {
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
        Vec::with_capacity(0)
    } else {
        let mut events_json = Vec::with_capacity(0);
-        if Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &mut conn).await {
+        if UserOrganization::user_has_ge_admin_access_to_cipher(&headers.user.uuid, cipher_id, &mut conn).await {
            let start_date = parse_date(&data.start);
            let end_date = if let Some(before_date) = &data.continuation_token {
                parse_date(before_date)
@@ -83,7 +74,7 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade
                parse_date(&data.end)
            };

-            events_json = Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &mut conn)
+            events_json = Event::find_by_cipher_uuid(cipher_id, &start_date, &end_date, &mut conn)
                .await
                .iter()
                .map(|e| e.to_json())
@@ -99,17 +90,14 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade
    })))
 }

-#[get("/organizations/<org_id>/users/<member_id>/events?<data..>")]
+#[get("/organizations/<org_id>/users/<user_org_id>/events?<data..>")]
 async fn get_user_events(
-    org_id: OrganizationId,
-    member_id: MembershipId,
+    org_id: &str,
+    user_org_id: &str,
    data: EventRange,
-    headers: AdminHeaders,
+    _headers: AdminHeaders,
    mut conn: DbConn,
 ) -> JsonResult {
-    if org_id != headers.org_id {
-        err!("Organization not found", "Organization id's do not match");
-    }
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
@@ -122,7 +110,7 @@ async fn get_user_events(
            parse_date(&data.end)
        };

-        Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &mut conn)
+        Event::find_by_org_and_user_org(org_id, user_org_id, &start_date, &end_date, &mut conn)
            .await
            .iter()
            .map(|e| e.to_json())
@@ -164,8 +152,8 @@ struct EventCollection {
    date: String,

    // Optional
-    cipher_id: Option<CipherId>,
-    organization_id: Option<OrganizationId>,
+    cipher_id: Option<String>,
+    organization_id: Option<String>,
 }

 // Upstream:
@@ -192,11 +180,11 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                .await;
            }
            1600..=1699 => {
-                if let Some(org_id) = &event.organization_id {
+                if let Some(org_uuid) = &event.organization_id {
                    _log_event(
                        event.r#type,
-                        org_id,
-                        org_id,
+                        org_uuid,
+                        org_uuid,
                        &headers.user.uuid,
                        headers.device.atype,
                        Some(event_date),
@@ -209,11 +197,11 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
            _ => {
                if let Some(cipher_uuid) = &event.cipher_id {
                    if let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &mut conn).await {
-                        if let Some(org_id) = cipher.organization_uuid {
+                        if let Some(org_uuid) = cipher.organization_uuid {
                            _log_event(
                                event.r#type,
                                cipher_uuid,
-                                &org_id,
+                                &org_uuid,
                                &headers.user.uuid,
                                headers.device.atype,
                                Some(event_date),
@@ -230,38 +218,38 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
    Ok(())
 }

-pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &mut DbConn) {
+pub async fn log_user_event(event_type: i32, user_uuid: &str, device_type: i32, ip: &IpAddr, conn: &mut DbConn) {
    if !CONFIG.org_events_enabled() {
        return;
    }
-    _log_user_event(event_type, user_id, device_type, None, ip, conn).await;
+    _log_user_event(event_type, user_uuid, device_type, None, ip, conn).await;
 }

 async fn _log_user_event(
    event_type: i32,
-    user_id: &UserId,
+    user_uuid: &str,
    device_type: i32,
    event_date: Option<NaiveDateTime>,
    ip: &IpAddr,
    conn: &mut DbConn,
 ) {
-    let orgs = Membership::get_orgs_by_user(user_id, conn).await;
+    let orgs = UserOrganization::get_org_uuid_by_user(user_uuid, conn).await;
    let mut events: Vec<Event> = Vec::with_capacity(orgs.len() + 1); // We need an event per org and one without an org

-    // Upstream saves the event also without any org_id.
+    // Upstream saves the event also without any org_uuid.
    let mut event = Event::new(event_type, event_date);
-    event.user_uuid = Some(user_id.clone());
-    event.act_user_uuid = Some(user_id.clone());
+    event.user_uuid = Some(String::from(user_uuid));
+    event.act_user_uuid = Some(String::from(user_uuid));
    event.device_type = Some(device_type);
    event.ip_address = Some(ip.to_string());
    events.push(event);

    // For each org a user is a member of store these events per org
-    for org_id in orgs {
+    for org_uuid in orgs {
        let mut event = Event::new(event_type, event_date);
-        event.user_uuid = Some(user_id.clone());
-        event.org_uuid = Some(org_id);
-        event.act_user_uuid = Some(user_id.clone());
+        event.user_uuid = Some(String::from(user_uuid));
+        event.org_uuid = Some(org_uuid);
+        event.act_user_uuid = Some(String::from(user_uuid));
        event.device_type = Some(device_type);
        event.ip_address = Some(ip.to_string());
        events.push(event);
@@ -273,8 +261,8 @@ async fn _log_user_event(
 pub async fn log_event(
    event_type: i32,
    source_uuid: &str,
-    org_id: &OrganizationId,
-    act_user_id: &UserId,
+    org_uuid: &str,
+    act_user_uuid: &str,
    device_type: i32,
    ip: &IpAddr,
    conn: &mut DbConn,
@@ -282,15 +270,15 @@ pub async fn log_event(
    if !CONFIG.org_events_enabled() {
        return;
    }
-    _log_event(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
+    _log_event(event_type, source_uuid, org_uuid, act_user_uuid, device_type, None, ip, conn).await;
 }

 #[allow(clippy::too_many_arguments)]
 async fn _log_event(
    event_type: i32,
    source_uuid: &str,
-    org_id: &OrganizationId,
-    act_user_id: &UserId,
+    org_uuid: &str,
+    act_user_uuid: &str,
    device_type: i32,
    event_date: Option<NaiveDateTime>,
    ip: &IpAddr,
@@ -302,31 +290,31 @@ async fn _log_event(
        // 1000..=1099 Are user events, they need to be logged via log_user_event()
        // Cipher Events
        1100..=1199 => {
-            event.cipher_uuid = Some(source_uuid.to_string().into());
+            event.cipher_uuid = Some(String::from(source_uuid));
        }
        // Collection Events
        1300..=1399 => {
-            event.collection_uuid = Some(source_uuid.to_string().into());
+            event.collection_uuid = Some(String::from(source_uuid));
        }
        // Group Events
        1400..=1499 => {
-            event.group_uuid = Some(source_uuid.to_string().into());
+            event.group_uuid = Some(String::from(source_uuid));
        }
        // Org User Events
        1500..=1599 => {
-            event.org_user_uuid = Some(source_uuid.to_string().into());
+            event.org_user_uuid = Some(String::from(source_uuid));
        }
        // 1600..=1699 Are organizational events, and they do not need the source_uuid
        // Policy Events
        1700..=1799 => {
-            event.policy_uuid = Some(source_uuid.to_string().into());
+            event.policy_uuid = Some(String::from(source_uuid));
        }
        // Ignore others
        _ => {}
    }

-    event.org_uuid = Some(org_id.clone());
-    event.act_user_uuid = Some(act_user_id.clone());
+    event.org_uuid = Some(String::from(org_uuid));
+    event.act_user_uuid = Some(String::from(act_user_uuid));
    event.device_type = Some(device_type);
    event.ip_address = Some(ip.to_string());
    event.save(conn).await.unwrap_or(());
--- a/src/api/core/folders.rs
+++ b/src/api/core/folders.rs
@@ -23,19 +23,25 @@ async fn get_folders(headers: Headers, mut conn: DbConn) -> Json<Value> {
    }))
 }

-#[get("/folders/<folder_id>")]
-async fn get_folder(folder_id: FolderId, headers: Headers, mut conn: DbConn) -> JsonResult {
-    match Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &mut conn).await {
-        Some(folder) => Ok(Json(folder.to_json())),
-        _ => err!("Invalid folder", "Folder does not exist or belongs to another user"),
+#[get("/folders/<uuid>")]
+async fn get_folder(uuid: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
+    let folder = match Folder::find_by_uuid(uuid, &mut conn).await {
+        Some(folder) => folder,
+        _ => err!("Invalid folder"),
+    };
+
+    if folder.user_uuid != headers.user.uuid {
+        err!("Folder belongs to another user")
    }
+
+    Ok(Json(folder.to_json()))
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct FolderData {
    pub name: String,
-    pub id: Option<FolderId>,
+    pub id: Option<String>,
 }

 #[post("/folders", data = "<data>")]
@@ -50,20 +56,14 @@ async fn post_folders(data: Json<FolderData>, headers: Headers, mut conn: DbConn
    Ok(Json(folder.to_json()))
 }

-#[post("/folders/<folder_id>", data = "<data>")]
-async fn post_folder(
-    folder_id: FolderId,
-    data: Json<FolderData>,
-    headers: Headers,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> JsonResult {
-    put_folder(folder_id, data, headers, conn, nt).await
+#[post("/folders/<uuid>", data = "<data>")]
+async fn post_folder(uuid: &str, data: Json<FolderData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
+    put_folder(uuid, data, headers, conn, nt).await
 }

-#[put("/folders/<folder_id>", data = "<data>")]
+#[put("/folders/<uuid>", data = "<data>")]
 async fn put_folder(
-    folder_id: FolderId,
+    uuid: &str,
    data: Json<FolderData>,
    headers: Headers,
    mut conn: DbConn,
@@ -71,10 +71,15 @@ async fn put_folder(
 ) -> JsonResult {
    let data: FolderData = data.into_inner();

-    let Some(mut folder) = Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &mut conn).await else {
-        err!("Invalid folder", "Folder does not exist or belongs to another user")
+    let mut folder = match Folder::find_by_uuid(uuid, &mut conn).await {
+        Some(folder) => folder,
+        _ => err!("Invalid folder"),
    };

+    if folder.user_uuid != headers.user.uuid {
+        err!("Folder belongs to another user")
+    }
+
    folder.name = data.name;

    folder.save(&mut conn).await?;
@@ -83,17 +88,22 @@ async fn put_folder(
    Ok(Json(folder.to_json()))
 }

-#[post("/folders/<folder_id>/delete")]
-async fn delete_folder_post(folder_id: FolderId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    delete_folder(folder_id, headers, conn, nt).await
+#[post("/folders/<uuid>/delete")]
+async fn delete_folder_post(uuid: &str, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    delete_folder(uuid, headers, conn, nt).await
 }

-#[delete("/folders/<folder_id>")]
-async fn delete_folder(folder_id: FolderId, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let Some(folder) = Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &mut conn).await else {
-        err!("Invalid folder", "Folder does not exist or belongs to another user")
+#[delete("/folders/<uuid>")]
+async fn delete_folder(uuid: &str, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let folder = match Folder::find_by_uuid(uuid, &mut conn).await {
+        Some(folder) => folder,
+        _ => err!("Invalid folder"),
    };

+    if folder.user_uuid != headers.user.uuid {
+        err!("Folder belongs to another user")
+    }
+
    // Delete the actual folder entry
    folder.delete(&mut conn).await?;

--- a/src/api/core/mod.rs
+++ b/src/api/core/mod.rs
@@ -18,7 +18,7 @@ pub use sends::purge_sends;
 pub fn routes() -> Vec<Route> {
    let mut eq_domains_routes = routes![get_eq_domains, post_eq_domains, put_eq_domains];
    let mut hibp_routes = routes![hibp_breach];
-    let mut meta_routes = routes![alive, now, version, config, get_api_webauthn];
+    let mut meta_routes = routes![alive, now, version, config];

    let mut routes = Vec::new();
    routes.append(&mut accounts::routes());
@@ -135,13 +135,12 @@ async fn put_eq_domains(data: Json<EquivDomainData>, headers: Headers, conn: DbC
 }

 #[get("/hibp/breach?<username>")]
-async fn hibp_breach(username: &str, _headers: Headers) -> JsonResult {
-    let username: String = url::form_urlencoded::byte_serialize(username.as_bytes()).collect();
-    if let Some(api_key) = crate::CONFIG.hibp_api_key() {
-        let url = format!(
-            "https://haveibeenpwned.com/api/v3/breachedaccount/{username}?truncateResponse=false&includeUnverified=false"
-        );
+async fn hibp_breach(username: &str) -> JsonResult {
+    let url = format!(
+        "https://haveibeenpwned.com/api/v3/breachedaccount/{username}?truncateResponse=false&includeUnverified=false"
+    );

+    if let Some(api_key) = crate::CONFIG.hibp_api_key() {
        let res = make_http_request(Method::GET, &url)?.header("hibp-api-key", api_key).send().await?;

        // If we get a 404, return a 404, it means no breached accounts
@@ -184,18 +183,6 @@ fn version() -> Json<&'static str> {
    Json(crate::VERSION.unwrap_or_default())
 }

-#[get("/webauthn")]
-fn get_api_webauthn(_headers: Headers) -> Json<Value> {
-    // Prevent a 404 error, which also causes key-rotation issues
-    // It looks like this is used when login with passkeys is enabled, which Vaultwarden does not (yet) support
-    // An empty list/data also works fine
-    Json(json!({
-        "object": "list",
-        "data": [],
-        "continuationToken": null
-    }))
-}
-
 #[get("/config")]
 fn config() -> Json<Value> {
    let domain = crate::CONFIG.domain();
@@ -210,8 +197,8 @@ fn config() -> Json<Value> {
        // This means they expect a version that closely matches the Bitwarden server version
        // We should make sure that we keep this updated when we support the new server features
        // Version history:
-        // - Individual cipher key encryption: 2024.2.0
-        "version": "2025.1.0",
+        // - Individual cipher key encryption: 2023.9.1
+        "version": "2024.2.0",
        "gitHash": option_env!("GIT_REV"),
        "server": {
          "name": "Vaultwarden",
--- a/src/api/core/organizations.rs
+++ b/src/api/core/organizations.rs
--- a/src/api/core/public.rs
+++ b/src/api/core/public.rs
@@ -52,36 +52,40 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
    let data = data.into_inner();

    for user_data in &data.members {
-        let mut user_created: bool = false;
        if user_data.deleted {
            // If user is marked for deletion and it exists, revoke it
-            if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &mut conn).await {
+            if let Some(mut user_org) =
+                UserOrganization::find_by_email_and_org(&user_data.email, &org_id, &mut conn).await
+            {
                // Only revoke a user if it is not the last confirmed owner
-                let revoked = if member.atype == MembershipType::Owner
-                    && member.status == MembershipStatus::Confirmed as i32
+                let revoked = if user_org.atype == UserOrgType::Owner
+                    && user_org.status == UserOrgStatus::Confirmed as i32
                {
-                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &mut conn).await <= 1
+                    if UserOrganization::count_confirmed_by_org_and_type(&org_id, UserOrgType::Owner, &mut conn).await
+                        <= 1
                    {
                        warn!("Can't revoke the last owner");
                        false
                    } else {
-                        member.revoke()
+                        user_org.revoke()
                    }
                } else {
-                    member.revoke()
+                    user_org.revoke()
                };

-                let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
+                let ext_modified = user_org.set_external_id(Some(user_data.external_id.clone()));
                if revoked || ext_modified {
-                    member.save(&mut conn).await?;
+                    user_org.save(&mut conn).await?;
                }
            }
        // If user is part of the organization, restore it
-        } else if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &mut conn).await {
-            let restored = member.restore();
-            let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
+        } else if let Some(mut user_org) =
+            UserOrganization::find_by_email_and_org(&user_data.email, &org_id, &mut conn).await
+        {
+            let restored = user_org.restore();
+            let ext_modified = user_org.set_external_id(Some(user_data.external_id.clone()));
            if restored || ext_modified {
-                member.save(&mut conn).await?;
+                user_org.save(&mut conn).await?;
            }
        } else {
            // If user is not part of the organization
@@ -93,25 +97,25 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
                    new_user.save(&mut conn).await?;

                    if !CONFIG.mail_enabled() {
-                        Invitation::new(&new_user.email).save(&mut conn).await?;
+                        let invitation = Invitation::new(&new_user.email);
+                        invitation.save(&mut conn).await?;
                    }
-                    user_created = true;
                    new_user
                }
            };
-            let member_status = if CONFIG.mail_enabled() || user.password_hash.is_empty() {
-                MembershipStatus::Invited as i32
+            let user_org_status = if CONFIG.mail_enabled() || user.password_hash.is_empty() {
+                UserOrgStatus::Invited as i32
            } else {
-                MembershipStatus::Accepted as i32 // Automatically mark user as accepted if no email invites
+                UserOrgStatus::Accepted as i32 // Automatically mark user as accepted if no email invites
            };

-            let mut new_member = Membership::new(user.uuid.clone(), org_id.clone());
-            new_member.set_external_id(Some(user_data.external_id.clone()));
-            new_member.access_all = false;
-            new_member.atype = MembershipType::User as i32;
-            new_member.status = member_status;
+            let mut new_org_user = UserOrganization::new(user.uuid.clone(), org_id.clone());
+            new_org_user.set_external_id(Some(user_data.external_id.clone()));
+            new_org_user.access_all = false;
+            new_org_user.atype = UserOrgType::User as i32;
+            new_org_user.status = user_org_status;

-            new_member.save(&mut conn).await?;
+            new_org_user.save(&mut conn).await?;

            if CONFIG.mail_enabled() {
                let (org_name, org_email) = match Organization::find_by_uuid(&org_id, &mut conn).await {
@@ -119,18 +123,8 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
                    None => err!("Error looking up organization"),
                };

-                if let Err(e) =
-                    mail::send_invite(&user, org_id.clone(), new_member.uuid.clone(), &org_name, Some(org_email)).await
-                {
-                    // Upon error delete the user, invite and org member records when needed
-                    if user_created {
-                        user.delete(&mut conn).await?;
-                    } else {
-                        new_member.delete(&mut conn).await?;
-                    }
-
-                    err!(format!("Error sending invite: {e:?} "));
-                }
+                mail::send_invite(&user, Some(org_id.clone()), Some(new_org_user.uuid), &org_name, Some(org_email))
+                    .await?;
            }
        }
    }
@@ -155,8 +149,9 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
            GroupUser::delete_all_by_group(&group_uuid, &mut conn).await?;

            for ext_id in &group_data.member_external_ids {
-                if let Some(member) = Membership::find_by_external_id_and_org(ext_id, &org_id, &mut conn).await {
-                    let mut group_user = GroupUser::new(group_uuid.clone(), member.uuid.clone());
+                if let Some(user_org) = UserOrganization::find_by_external_id_and_org(ext_id, &org_id, &mut conn).await
+                {
+                    let mut group_user = GroupUser::new(group_uuid.clone(), user_org.uuid.clone());
                    group_user.save(&mut conn).await?;
                }
            }
@@ -169,19 +164,20 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
    if data.overwrite_existing {
        // Generate a HashSet to quickly verify if a member is listed or not.
        let sync_members: HashSet<String> = data.members.into_iter().map(|m| m.external_id).collect();
-        for member in Membership::find_by_org(&org_id, &mut conn).await {
-            if let Some(ref user_external_id) = member.external_id {
+        for user_org in UserOrganization::find_by_org(&org_id, &mut conn).await {
+            if let Some(ref user_external_id) = user_org.external_id {
                if !sync_members.contains(user_external_id) {
-                    if member.atype == MembershipType::Owner && member.status == MembershipStatus::Confirmed as i32 {
+                    if user_org.atype == UserOrgType::Owner && user_org.status == UserOrgStatus::Confirmed as i32 {
                        // Removing owner, check that there is at least one other confirmed owner
-                        if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &mut conn).await
+                        if UserOrganization::count_confirmed_by_org_and_type(&org_id, UserOrgType::Owner, &mut conn)
+                            .await
                            <= 1
                        {
                            warn!("Can't delete the last owner");
                            continue;
                        }
                    }
-                    member.delete(&mut conn).await?;
+                    user_org.delete(&mut conn).await?;
                }
            }
        }
@@ -190,7 +186,7 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
    Ok(())
 }

-pub struct PublicToken(OrganizationId);
+pub struct PublicToken(String);

 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for PublicToken {
@@ -207,8 +203,9 @@ impl<'r> FromRequest<'r> for PublicToken {
            None => err_handler!("No access token provided"),
        };
        // Check JWT token is valid and get device and user from it
-        let Ok(claims) = auth::decode_api_org(access_token) else {
-            err_handler!("Invalid claim")
+        let claims = match auth::decode_api_org(access_token) {
+            Ok(claims) => claims,
+            Err(_) => err_handler!("Invalid claim"),
        };
        // Check if time is between claims.nbf and claims.exp
        let time_now = Utc::now().timestamp();
@@ -230,12 +227,13 @@ impl<'r> FromRequest<'r> for PublicToken {
            Outcome::Success(conn) => conn,
            _ => err_handler!("Error getting DB"),
        };
-        let Some(org_id) = claims.client_id.strip_prefix("organization.") else {
-            err_handler!("Malformed client_id")
+        let org_uuid = match claims.client_id.strip_prefix("organization.") {
+            Some(uuid) => uuid,
+            None => err_handler!("Malformed client_id"),
        };
-        let org_id: OrganizationId = org_id.to_string().into();
-        let Some(org_api_key) = OrganizationApiKey::find_by_org_uuid(&org_id, &conn).await else {
-            err_handler!("Invalid client_id")
+        let org_api_key = match OrganizationApiKey::find_by_org_uuid(org_uuid, &conn).await {
+            Some(org_api_key) => org_api_key,
+            None => err_handler!("Invalid client_id"),
        };
        if org_api_key.org_uuid != claims.client_sub {
            err_handler!("Token not issued for this org");
--- a/src/api/core/sends.rs
+++ b/src/api/core/sends.rs
@@ -12,7 +12,7 @@ use crate::{
    api::{ApiResult, EmptyResult, JsonResult, Notify, UpdateType},
    auth::{ClientIp, Headers, Host},
    db::{models::*, DbConn, DbPool},
-    util::NumberOrString,
+    util::{NumberOrString, SafeString},
    CONFIG,
 };

@@ -67,7 +67,7 @@ pub struct SendData {
    file_length: Option<NumberOrString>,

    // Used for key rotations
-    pub id: Option<SendId>,
+    pub id: Option<String>,
 }

 /// Enforces the `Disable Send` policy. A non-owner/admin user belonging to
@@ -79,9 +79,9 @@ pub struct SendData {
 /// There is also a Vaultwarden-specific `sends_allowed` config setting that
 /// controls this policy globally.
 async fn enforce_disable_send_policy(headers: &Headers, conn: &mut DbConn) -> EmptyResult {
-    let user_id = &headers.user.uuid;
+    let user_uuid = &headers.user.uuid;
    if !CONFIG.sends_allowed()
-        || OrgPolicy::is_applicable_to_user(user_id, OrgPolicyType::DisableSend, None, conn).await
+        || OrgPolicy::is_applicable_to_user(user_uuid, OrgPolicyType::DisableSend, None, conn).await
    {
        err!("Due to an Enterprise Policy, you are only able to delete an existing Send.")
    }
@@ -95,9 +95,9 @@ async fn enforce_disable_send_policy(headers: &Headers, conn: &mut DbConn) -> Em
 ///
 /// Ref: https://bitwarden.com/help/article/policies/#send-options
 async fn enforce_disable_hide_email_policy(data: &SendData, headers: &Headers, conn: &mut DbConn) -> EmptyResult {
-    let user_id = &headers.user.uuid;
+    let user_uuid = &headers.user.uuid;
    let hide_email = data.hide_email.unwrap_or(false);
-    if hide_email && OrgPolicy::is_hide_email_disabled(user_id, conn).await {
+    if hide_email && OrgPolicy::is_hide_email_disabled(user_uuid, conn).await {
        err!(
            "Due to an Enterprise Policy, you are not allowed to hide your email address \
              from recipients when creating or editing a Send."
@@ -106,7 +106,7 @@ async fn enforce_disable_hide_email_policy(data: &SendData, headers: &Headers, c
    Ok(())
 }

-fn create_send(data: SendData, user_id: UserId) -> ApiResult<Send> {
+fn create_send(data: SendData, user_uuid: String) -> ApiResult<Send> {
    let data_val = if data.r#type == SendType::Text as i32 {
        data.text
    } else if data.r#type == SendType::File as i32 {
@@ -129,7 +129,7 @@ fn create_send(data: SendData, user_id: UserId) -> ApiResult<Send> {
    }

    let mut send = Send::new(data.r#type, data.name, data_str, data.key, data.deletion_date.naive_utc());
-    send.user_uuid = Some(user_id);
+    send.user_uuid = Some(user_uuid);
    send.notes = data.notes;
    send.max_access_count = match data.max_access_count {
        Some(m) => Some(m.into_i32()?),
@@ -157,12 +157,18 @@ async fn get_sends(headers: Headers, mut conn: DbConn) -> Json<Value> {
    }))
 }

-#[get("/sends/<send_id>")]
-async fn get_send(send_id: SendId, headers: Headers, mut conn: DbConn) -> JsonResult {
-    match Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await {
-        Some(send) => Ok(Json(send.to_json())),
-        None => err!("Send not found", "Invalid send uuid or does not belong to user"),
+#[get("/sends/<uuid>")]
+async fn get_send(uuid: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
+    let send = match Send::find_by_uuid(uuid, &mut conn).await {
+        Some(send) => send,
+        None => err!("Send not found"),
+    };
+
+    if send.user_uuid.as_ref() != Some(&headers.user.uuid) {
+        err!("Send is not owned by user")
    }
+
+    Ok(Json(send.to_json()))
 }

 #[post("/sends", data = "<data>")]
@@ -249,7 +255,7 @@ async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, mut conn:
        err!("Send content is not a file");
    }

-    let file_id = crate::crypto::generate_send_file_id();
+    let file_id = crate::crypto::generate_send_id();
    let folder_path = tokio::fs::canonicalize(&CONFIG.sends_folder()).await?.join(&send.uuid);
    let file_path = folder_path.join(&file_id);
    tokio::fs::create_dir_all(&folder_path).await?;
@@ -324,7 +330,7 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, mut conn: DbC

    let mut send = create_send(data, headers.user.uuid)?;

-    let file_id = crate::crypto::generate_send_file_id();
+    let file_id = crate::crypto::generate_send_id();

    let mut data_value: Value = serde_json::from_str(&send.data)?;
    if let Some(o) = data_value.as_object_mut() {
@@ -346,16 +352,16 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, mut conn: DbC
 #[derive(Deserialize)]
 #[allow(non_snake_case)]
 pub struct SendFileData {
-    id: SendFileId,
+    id: String,
    size: u64,
    fileName: String,
 }

 // https://github.com/bitwarden/server/blob/66f95d1c443490b653e5a15d32977e2f5a3f9e32/src/Api/Tools/Controllers/SendsController.cs#L250
-#[post("/sends/<send_id>/file/<file_id>", format = "multipart/form-data", data = "<data>")]
+#[post("/sends/<send_uuid>/file/<file_id>", format = "multipart/form-data", data = "<data>")]
 async fn post_send_file_v2_data(
-    send_id: SendId,
-    file_id: SendFileId,
+    send_uuid: &str,
+    file_id: &str,
    data: Form<UploadDataV2<'_>>,
    headers: Headers,
    mut conn: DbConn,
@@ -365,14 +371,22 @@ async fn post_send_file_v2_data(

    let mut data = data.into_inner();

-    let Some(send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await else {
-        err!("Send not found. Unable to save the file.", "Invalid send uuid or does not belong to user.")
+    let Some(send) = Send::find_by_uuid(send_uuid, &mut conn).await else {
+        err!("Send not found. Unable to save the file.")
    };

    if send.atype != SendType::File as i32 {
        err!("Send is not a file type send.");
    }

+    let Some(send_user_id) = &send.user_uuid else {
+        err!("Sends are only supported for users at the moment.")
+    };
+
+    if send_user_id != &headers.user.uuid {
+        err!("Send doesn't belong to user.");
+    }
+
    let Ok(send_data) = serde_json::from_str::<SendFileData>(&send.data) else {
        err!("Unable to decode send data as json.")
    };
@@ -402,7 +416,7 @@ async fn post_send_file_v2_data(
        err!("Send file size does not match.", format!("Expected a file size of {} got {size}", send_data.size));
    }

-    let folder_path = tokio::fs::canonicalize(&CONFIG.sends_folder()).await?.join(send_id);
+    let folder_path = tokio::fs::canonicalize(&CONFIG.sends_folder()).await?.join(send_uuid);
    let file_path = folder_path.join(file_id);

    // Check if the file already exists, if that is the case do not overwrite it
@@ -442,8 +456,9 @@ async fn post_access(
    ip: ClientIp,
    nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(mut send) = Send::find_by_access_id(access_id, &mut conn).await else {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    let mut send = match Send::find_by_access_id(access_id, &mut conn).await {
+        Some(s) => s,
+        None => err_code!(SEND_INACCESSIBLE_MSG, 404),
    };

    if let Some(max_access_count) = send.max_access_count {
@@ -485,7 +500,7 @@ async fn post_access(
        UpdateType::SyncSendUpdate,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &String::from("00000000-0000-0000-0000-000000000000").into(),
+        &String::from("00000000-0000-0000-0000-000000000000"),
        &mut conn,
    )
    .await;
@@ -495,15 +510,16 @@ async fn post_access(

 #[post("/sends/<send_id>/access/file/<file_id>", data = "<data>")]
 async fn post_access_file(
-    send_id: SendId,
-    file_id: SendFileId,
+    send_id: &str,
+    file_id: &str,
    data: Json<SendAccessData>,
    host: Host,
    mut conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&send_id, &mut conn).await else {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    let mut send = match Send::find_by_uuid(send_id, &mut conn).await {
+        Some(s) => s,
+        None => err_code!(SEND_INACCESSIBLE_MSG, 404),
    };

    if let Some(max_access_count) = send.max_access_count {
@@ -542,12 +558,12 @@ async fn post_access_file(
        UpdateType::SyncSendUpdate,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &String::from("00000000-0000-0000-0000-000000000000").into(),
+        &String::from("00000000-0000-0000-0000-000000000000"),
        &mut conn,
    )
    .await;

-    let token_claims = crate::auth::generate_send_claims(&send_id, &file_id);
+    let token_claims = crate::auth::generate_send_claims(send_id, file_id);
    let token = crate::auth::encode_jwt(&token_claims);
    Ok(Json(json!({
        "object": "send-fileDownload",
@@ -557,7 +573,7 @@ async fn post_access_file(
 }

 #[get("/sends/<send_id>/<file_id>?<t>")]
-async fn download_send(send_id: SendId, file_id: SendFileId, t: &str) -> Option<NamedFile> {
+async fn download_send(send_id: SafeString, file_id: SafeString, t: &str) -> Option<NamedFile> {
    if let Ok(claims) = crate::auth::decode_send(t) {
        if claims.sub == format!("{send_id}/{file_id}") {
            return NamedFile::open(Path::new(&CONFIG.sends_folder()).join(send_id).join(file_id)).await.ok();
@@ -566,21 +582,16 @@ async fn download_send(send_id: SendId, file_id: SendFileId, t: &str) -> Option<
    None
 }

-#[put("/sends/<send_id>", data = "<data>")]
-async fn put_send(
-    send_id: SendId,
-    data: Json<SendData>,
-    headers: Headers,
-    mut conn: DbConn,
-    nt: Notify<'_>,
-) -> JsonResult {
+#[put("/sends/<id>", data = "<data>")]
+async fn put_send(id: &str, data: Json<SendData>, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> JsonResult {
    enforce_disable_send_policy(&headers, &mut conn).await?;

    let data: SendData = data.into_inner();
    enforce_disable_hide_email_policy(&data, &headers, &mut conn).await?;

-    let Some(mut send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await else {
-        err!("Send not found", "Send send_id is invalid or does not belong to user")
+    let mut send = match Send::find_by_uuid(id, &mut conn).await {
+        Some(s) => s,
+        None => err!("Send not found"),
    };

    update_send_from_data(&mut send, data, &headers, &mut conn, &nt, UpdateType::SyncSendUpdate).await?;
@@ -646,12 +657,17 @@ pub async fn update_send_from_data(
    Ok(())
 }

-#[delete("/sends/<send_id>")]
-async fn delete_send(send_id: SendId, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let Some(send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await else {
-        err!("Send not found", "Invalid send uuid, or does not belong to user")
+#[delete("/sends/<id>")]
+async fn delete_send(id: &str, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let send = match Send::find_by_uuid(id, &mut conn).await {
+        Some(s) => s,
+        None => err!("Send not found"),
    };

+    if send.user_uuid.as_ref() != Some(&headers.user.uuid) {
+        err!("Send is not owned by user")
+    }
+
    send.delete(&mut conn).await?;
    nt.send_send_update(
        UpdateType::SyncSendDelete,
@@ -665,14 +681,19 @@ async fn delete_send(send_id: SendId, headers: Headers, mut conn: DbConn, nt: No
    Ok(())
 }

-#[put("/sends/<send_id>/remove-password")]
-async fn put_remove_password(send_id: SendId, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> JsonResult {
+#[put("/sends/<id>/remove-password")]
+async fn put_remove_password(id: &str, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> JsonResult {
    enforce_disable_send_policy(&headers, &mut conn).await?;

-    let Some(mut send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await else {
-        err!("Send not found", "Invalid send uuid, or does not belong to user")
+    let mut send = match Send::find_by_uuid(id, &mut conn).await {
+        Some(s) => s,
+        None => err!("Send not found"),
    };

+    if send.user_uuid.as_ref() != Some(&headers.user.uuid) {
+        err!("Send is not owned by user")
+    }
+
    send.set_password(None);
    send.save(&mut conn).await?;
    nt.send_send_update(
--- a/src/api/core/two_factor/authenticator.rs
+++ b/src/api/core/two_factor/authenticator.rs
@@ -7,7 +7,7 @@ use crate::{
    auth::{ClientIp, Headers},
    crypto,
    db::{
-        models::{EventType, TwoFactor, TwoFactorType, UserId},
+        models::{EventType, TwoFactor, TwoFactorType},
        DbConn,
    },
    util::NumberOrString,
@@ -16,7 +16,7 @@ use crate::{
 pub use crate::config::CONFIG;

 pub fn routes() -> Vec<Route> {
-    routes![generate_authenticator, activate_authenticator, activate_authenticator_put, disable_authenticator]
+    routes![generate_authenticator, activate_authenticator, activate_authenticator_put,]
 }

 #[post("/two-factor/get-authenticator", data = "<data>")]
@@ -95,7 +95,7 @@ async fn activate_authenticator_put(data: Json<EnableAuthenticatorData>, headers
 }

 pub async fn validate_totp_code_str(
-    user_id: &UserId,
+    user_uuid: &str,
    totp_code: &str,
    secret: &str,
    ip: &ClientIp,
@@ -105,11 +105,11 @@ pub async fn validate_totp_code_str(
        err!("TOTP code is not a number");
    }

-    validate_totp_code(user_id, totp_code, secret, ip, conn).await
+    validate_totp_code(user_uuid, totp_code, secret, ip, conn).await
 }

 pub async fn validate_totp_code(
-    user_id: &UserId,
+    user_uuid: &str,
    totp_code: &str,
    secret: &str,
    ip: &ClientIp,
@@ -117,15 +117,16 @@ pub async fn validate_totp_code(
 ) -> EmptyResult {
    use totp_lite::{totp_custom, Sha1};

-    let Ok(decoded_secret) = BASE32.decode(secret.as_bytes()) else {
-        err!("Invalid TOTP secret")
+    let decoded_secret = match BASE32.decode(secret.as_bytes()) {
+        Ok(s) => s,
+        Err(_) => err!("Invalid TOTP secret"),
    };

-    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
-    {
-        Some(tf) => tf,
-        _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_string()),
-    };
+    let mut twofactor =
+        match TwoFactor::find_by_user_and_type(user_uuid, TwoFactorType::Authenticator as i32, conn).await {
+            Some(tf) => tf,
+            _ => TwoFactor::new(user_uuid.to_string(), TwoFactorType::Authenticator, secret.to_string()),
+        };

    // The amount of steps back and forward in time
    // Also check if we need to disable time drifted TOTP codes.
@@ -175,47 +176,3 @@ pub async fn validate_totp_code(
        }
    );
 }
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct DisableAuthenticatorData {
-    key: String,
-    master_password_hash: String,
-    r#type: NumberOrString,
-}
-
-#[delete("/two-factor/authenticator", data = "<data>")]
-async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, mut conn: DbConn) -> JsonResult {
-    let user = headers.user;
-    let type_ = data.r#type.into_i32()?;
-
-    if !user.check_valid_password(&data.master_password_hash) {
-        err!("Invalid password");
-    }
-
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &mut conn).await {
-        if twofactor.data == data.key {
-            twofactor.delete(&mut conn).await?;
-            log_user_event(
-                EventType::UserDisabled2fa as i32,
-                &user.uuid,
-                headers.device.atype,
-                &headers.ip.ip,
-                &mut conn,
-            )
-            .await;
-        } else {
-            err!(format!("TOTP key for user {} does not match recorded value, cannot deactivate", &user.email));
-        }
-    }
-
-    if TwoFactor::find_by_user(&user.uuid, &mut conn).await.is_empty() {
-        super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &mut conn).await?;
-    }
-
-    Ok(Json(json!({
-        "enabled": false,
-        "keys": type_,
-        "object": "twoFactorProvider"
-    })))
-}
--- a/src/api/core/two_factor/duo.rs
+++ b/src/api/core/two_factor/duo.rs
@@ -11,7 +11,7 @@ use crate::{
    auth::Headers,
    crypto,
    db::{
-        models::{EventType, TwoFactor, TwoFactorType, User, UserId},
+        models::{EventType, TwoFactor, TwoFactorType, User},
        DbConn,
    },
    error::MapResult,
@@ -228,12 +228,13 @@ const AUTH_PREFIX: &str = "AUTH";
 const DUO_PREFIX: &str = "TX";
 const APP_PREFIX: &str = "APP";

-async fn get_user_duo_data(user_id: &UserId, conn: &mut DbConn) -> DuoStatus {
+async fn get_user_duo_data(uuid: &str, conn: &mut DbConn) -> DuoStatus {
    let type_ = TwoFactorType::Duo as i32;

    // If the user doesn't have an entry, disabled
-    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await else {
-        return DuoStatus::Disabled(DuoData::global().is_some());
+    let twofactor = match TwoFactor::find_by_user_and_type(uuid, type_, conn).await {
+        Some(t) => t,
+        None => return DuoStatus::Disabled(DuoData::global().is_some()),
    };

    // If the user has the required values, we use those
@@ -332,12 +333,14 @@ fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -
        err!("Prefixes don't match")
    }

-    let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else {
-        err!("Invalid Duo cookie encoding")
+    let cookie_vec = match BASE64.decode(u_b64.as_bytes()) {
+        Ok(c) => c,
+        Err(_) => err!("Invalid Duo cookie encoding"),
    };

-    let Ok(cookie) = String::from_utf8(cookie_vec) else {
-        err!("Invalid Duo cookie encoding")
+    let cookie = match String::from_utf8(cookie_vec) {
+        Ok(c) => c,
+        Err(_) => err!("Invalid Duo cookie encoding"),
    };

    let cookie_split: Vec<&str> = cookie.split('|').collect();
--- a/src/api/core/two_factor/duo_oidc.rs
+++ b/src/api/core/two_factor/duo_oidc.rs
@@ -10,7 +10,7 @@ use crate::{
    api::{core::two_factor::duo::get_duo_keys_email, EmptyResult},
    crypto,
    db::{
-        models::{DeviceId, EventType, TwoFactorDuoContext},
+        models::{EventType, TwoFactorDuoContext},
        DbConn, DbPool,
    },
    error::Error,
@@ -211,7 +211,10 @@ impl DuoClient {
            nonce,
        };

-        let token = self.encode_duo_jwt(jwt_payload)?;
+        let token = match self.encode_duo_jwt(jwt_payload) {
+            Ok(token) => token,
+            Err(e) => return Err(e),
+        };

        let authz_endpoint = format!("https://{}/oauth/v1/authorize", self.api_host);
        let mut auth_url = match Url::parse(authz_endpoint.as_str()) {
@@ -379,7 +382,7 @@ fn make_callback_url(client_name: &str) -> Result<String, Error> {
 pub async fn get_duo_auth_url(
    email: &str,
    client_id: &str,
-    device_identifier: &DeviceId,
+    device_identifier: &String,
    conn: &mut DbConn,
 ) -> Result<String, Error> {
    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
@@ -417,7 +420,7 @@ pub async fn validate_duo_login(
    email: &str,
    two_factor_token: &str,
    client_id: &str,
-    device_identifier: &DeviceId,
+    device_identifier: &str,
    conn: &mut DbConn,
 ) -> EmptyResult {
    // Result supplied to us by clients in the form "<authz code>|<state>"
--- a/src/api/core/two_factor/email.rs
+++ b/src/api/core/two_factor/email.rs
@@ -10,7 +10,7 @@ use crate::{
    auth::Headers,
    crypto,
    db::{
-        models::{EventType, TwoFactor, TwoFactorType, User, UserId},
+        models::{EventType, TwoFactor, TwoFactorType, User},
        DbConn,
    },
    error::{Error, MapResult},
@@ -40,8 +40,9 @@ async fn send_email_login(data: Json<SendEmailLoginData>, mut conn: DbConn) -> E
    use crate::db::models::User;

    // Get the user
-    let Some(user) = User::find_by_mail(&data.email, &mut conn).await else {
-        err!("Username or password is incorrect. Try again.")
+    let user = match User::find_by_mail(&data.email, &mut conn).await {
+        Some(user) => user,
+        None => err!("Username or password is incorrect. Try again."),
    };

    // Check password
@@ -59,9 +60,10 @@ async fn send_email_login(data: Json<SendEmailLoginData>, mut conn: DbConn) -> E
 }

 /// Generate the token, save the data for later verification and send email to user
-pub async fn send_token(user_id: &UserId, conn: &mut DbConn) -> EmptyResult {
+pub async fn send_token(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
    let type_ = TwoFactorType::Email as i32;
-    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, type_, conn).await.map_res("Two factor not found")?;
+    let mut twofactor =
+        TwoFactor::find_by_user_and_type(user_uuid, type_, conn).await.map_res("Two factor not found")?;

    let generated_token = crypto::generate_email_token(CONFIG.email_token_size());

@@ -172,8 +174,9 @@ async fn email(data: Json<EmailData>, headers: Headers, mut conn: DbConn) -> Jso

    let mut email_data = EmailTokenData::from_json(&twofactor.data)?;

-    let Some(issued_token) = &email_data.last_token else {
-        err!("No token available")
+    let issued_token = match &email_data.last_token {
+        Some(t) => t,
+        _ => err!("No token available"),
    };

    if !crypto::ct_eq(issued_token, data.token) {
@@ -197,18 +200,19 @@ async fn email(data: Json<EmailData>, headers: Headers, mut conn: DbConn) -> Jso
 }

 /// Validate the email code when used as TwoFactor token mechanism
-pub async fn validate_email_code_str(user_id: &UserId, token: &str, data: &str, conn: &mut DbConn) -> EmptyResult {
+pub async fn validate_email_code_str(user_uuid: &str, token: &str, data: &str, conn: &mut DbConn) -> EmptyResult {
    let mut email_data = EmailTokenData::from_json(data)?;
-    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email as i32, conn)
+    let mut twofactor = TwoFactor::find_by_user_and_type(user_uuid, TwoFactorType::Email as i32, conn)
        .await
        .map_res("Two factor not found")?;
-    let Some(issued_token) = &email_data.last_token else {
-        err!(
+    let issued_token = match &email_data.last_token {
+        Some(t) => t,
+        _ => err!(
            "No token available",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
-        )
+        ),
    };

    if !crypto::ct_eq(issued_token, token) {
@@ -326,8 +330,8 @@ pub fn obscure_email(email: &str) -> String {
    format!("{}@{}", new_name, &domain)
 }

-pub async fn find_and_activate_email_2fa(user_id: &UserId, conn: &mut DbConn) -> EmptyResult {
-    if let Some(user) = User::find_by_uuid(user_id, conn).await {
+pub async fn find_and_activate_email_2fa(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
+    if let Some(user) = User::find_by_uuid(user_uuid, conn).await {
        activate_email_2fa(&user, conn).await
    } else {
        err!("User not found!");
--- a/src/api/core/two_factor/mod.rs
+++ b/src/api/core/two_factor/mod.rs
@@ -85,8 +85,9 @@ async fn recover(data: Json<RecoverTwoFactor>, client_headers: ClientHeaders, mu
    use crate::db::models::User;

    // Get the user
-    let Some(mut user) = User::find_by_mail(&data.email, &mut conn).await else {
-        err!("Username or password is incorrect. Try again.")
+    let mut user = match User::find_by_mail(&data.email, &mut conn).await {
+        Some(user) => user,
+        None => err!("Username or password is incorrect. Try again."),
    };

    // Check password
@@ -173,16 +174,17 @@ async fn disable_twofactor_put(data: Json<DisableTwoFactorData>, headers: Header

 pub async fn enforce_2fa_policy(
    user: &User,
-    act_user_id: &UserId,
+    act_uuid: &str,
    device_type: i32,
    ip: &std::net::IpAddr,
    conn: &mut DbConn,
 ) -> EmptyResult {
-    for member in
-        Membership::find_by_user_and_policy(&user.uuid, OrgPolicyType::TwoFactorAuthentication, conn).await.into_iter()
+    for member in UserOrganization::find_by_user_and_policy(&user.uuid, OrgPolicyType::TwoFactorAuthentication, conn)
+        .await
+        .into_iter()
    {
        // Policy only applies to non-Owner/non-Admin members who have accepted joining the org
-        if member.atype < MembershipType::Admin {
+        if member.atype < UserOrgType::Admin {
            if CONFIG.mail_enabled() {
                let org = Organization::find_by_uuid(&member.org_uuid, conn).await.unwrap();
                mail::send_2fa_removed_from_org(&user.email, &org.name).await?;
@@ -195,7 +197,7 @@ pub async fn enforce_2fa_policy(
                EventType::OrganizationUserRevoked as i32,
                &member.uuid,
                &member.org_uuid,
-                act_user_id,
+                act_uuid,
                device_type,
                ip,
                conn,
@@ -208,16 +210,16 @@ pub async fn enforce_2fa_policy(
 }

 pub async fn enforce_2fa_policy_for_org(
-    org_id: &OrganizationId,
-    act_user_id: &UserId,
+    org_uuid: &str,
+    act_uuid: &str,
    device_type: i32,
    ip: &std::net::IpAddr,
    conn: &mut DbConn,
 ) -> EmptyResult {
-    let org = Organization::find_by_uuid(org_id, conn).await.unwrap();
-    for member in Membership::find_confirmed_by_org(org_id, conn).await.into_iter() {
+    let org = Organization::find_by_uuid(org_uuid, conn).await.unwrap();
+    for member in UserOrganization::find_confirmed_by_org(org_uuid, conn).await.into_iter() {
        // Don't enforce the policy for Admins and Owners.
-        if member.atype < MembershipType::Admin && TwoFactor::find_by_user(&member.user_uuid, conn).await.is_empty() {
+        if member.atype < UserOrgType::Admin && TwoFactor::find_by_user(&member.user_uuid, conn).await.is_empty() {
            if CONFIG.mail_enabled() {
                let user = User::find_by_uuid(&member.user_uuid, conn).await.unwrap();
                mail::send_2fa_removed_from_org(&user.email, &org.name).await?;
@@ -229,8 +231,8 @@ pub async fn enforce_2fa_policy_for_org(
            log_event(
                EventType::OrganizationUserRevoked as i32,
                &member.uuid,
-                org_id,
-                act_user_id,
+                org_uuid,
+                act_uuid,
                device_type,
                ip,
                conn,
--- a/src/api/core/two_factor/protected_actions.rs
+++ b/src/api/core/two_factor/protected_actions.rs
@@ -6,7 +6,7 @@ use crate::{
    auth::Headers,
    crypto,
    db::{
-        models::{TwoFactor, TwoFactorType, UserId},
+        models::{TwoFactor, TwoFactorType},
        DbConn,
    },
    error::{Error, MapResult},
@@ -104,11 +104,11 @@ async fn verify_otp(data: Json<ProtectedActionVerify>, headers: Headers, mut con

 pub async fn validate_protected_action_otp(
    otp: &str,
-    user_id: &UserId,
+    user_uuid: &str,
    delete_if_valid: bool,
    conn: &mut DbConn,
 ) -> EmptyResult {
-    let pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions as i32, conn)
+    let pa = TwoFactor::find_by_user_and_type(user_uuid, TwoFactorType::ProtectedActions as i32, conn)
        .await
        .map_res("Protected action token not found, try sending the code again or restart the process")?;
    let mut pa_data = ProtectedActionData::from_json(&pa.data)?;
--- a/src/api/core/two_factor/webauthn.rs
+++ b/src/api/core/two_factor/webauthn.rs
@@ -11,7 +11,7 @@ use crate::{
    },
    auth::Headers,
    db::{
-        models::{EventType, TwoFactor, TwoFactorType, UserId},
+        models::{EventType, TwoFactor, TwoFactorType},
        DbConn,
    },
    error::Error,
@@ -148,7 +148,7 @@ async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Hea
    )?;

    let type_ = TwoFactorType::WebauthnRegisterChallenge;
-    TwoFactor::new(user.uuid.clone(), type_, serde_json::to_string(&state)?).save(&mut conn).await?;
+    TwoFactor::new(user.uuid, type_, serde_json::to_string(&state)?).save(&mut conn).await?;

    let mut challenge_value = serde_json::to_value(challenge.public_key)?;
    challenge_value["status"] = "ok".into();
@@ -309,16 +309,17 @@ async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, mut conn:
        err!("Invalid password");
    }

-    let Some(mut tf) =
-        TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &mut conn).await
-    else {
-        err!("Webauthn data not found!")
-    };
+    let mut tf =
+        match TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &mut conn).await {
+            Some(tf) => tf,
+            None => err!("Webauthn data not found!"),
+        };

    let mut data: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;

-    let Some(item_pos) = data.iter().position(|r| r.id == id) else {
-        err!("Webauthn entry not found")
+    let item_pos = match data.iter().position(|r| r.id == id) {
+        Some(p) => p,
+        None => err!("Webauthn entry not found"),
    };

    let removed_item = data.remove(item_pos);
@@ -352,20 +353,20 @@ async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, mut conn:
 }

 pub async fn get_webauthn_registrations(
-    user_id: &UserId,
+    user_uuid: &str,
    conn: &mut DbConn,
 ) -> Result<(bool, Vec<WebauthnRegistration>), Error> {
    let type_ = TwoFactorType::Webauthn as i32;
-    match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
+    match TwoFactor::find_by_user_and_type(user_uuid, type_, conn).await {
        Some(tf) => Ok((tf.enabled, serde_json::from_str(&tf.data)?)),
        None => Ok((false, Vec::new())), // If no data, return empty list
    }
 }

-pub async fn generate_webauthn_login(user_id: &UserId, conn: &mut DbConn) -> JsonResult {
+pub async fn generate_webauthn_login(user_uuid: &str, conn: &mut DbConn) -> JsonResult {
    // Load saved credentials
    let creds: Vec<Credential> =
-        get_webauthn_registrations(user_id, conn).await?.1.into_iter().map(|r| r.credential).collect();
+        get_webauthn_registrations(user_uuid, conn).await?.1.into_iter().map(|r| r.credential).collect();

    if creds.is_empty() {
        err!("No Webauthn devices registered")
@@ -376,7 +377,7 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &mut DbConn) -> Jso
    let (response, state) = WebauthnConfig::load().generate_challenge_authenticate_options(creds, Some(ext))?;

    // Save the challenge state for later validation
-    TwoFactor::new(user_id.clone(), TwoFactorType::WebauthnLoginChallenge, serde_json::to_string(&state)?)
+    TwoFactor::new(user_uuid.into(), TwoFactorType::WebauthnLoginChallenge, serde_json::to_string(&state)?)
        .save(conn)
        .await?;

@@ -384,9 +385,9 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &mut DbConn) -> Jso
    Ok(Json(serde_json::to_value(response.public_key)?))
 }

-pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &mut DbConn) -> EmptyResult {
+pub async fn validate_webauthn_login(user_uuid: &str, response: &str, conn: &mut DbConn) -> EmptyResult {
    let type_ = TwoFactorType::WebauthnLoginChallenge as i32;
-    let state = match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
+    let state = match TwoFactor::find_by_user_and_type(user_uuid, type_, conn).await {
        Some(tf) => {
            let state: AuthenticationState = serde_json::from_str(&tf.data)?;
            tf.delete(conn).await?;
@@ -403,7 +404,7 @@ pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &mu
    let rsp: PublicKeyCredentialCopy = serde_json::from_str(response)?;
    let rsp: PublicKeyCredential = rsp.into();

-    let mut registrations = get_webauthn_registrations(user_id, conn).await?.1;
+    let mut registrations = get_webauthn_registrations(user_uuid, conn).await?.1;

    // If the credential we received is migrated from U2F, enable the U2F compatibility
    //let use_u2f = registrations.iter().any(|r| r.migrated && r.credential.cred_id == rsp.raw_id.0);
@@ -413,7 +414,7 @@ pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &mu
        if &reg.credential.cred_id == cred_id {
            reg.credential.counter = auth_data.counter;

-            TwoFactor::new(user_id.clone(), TwoFactorType::Webauthn, serde_json::to_string(&registrations)?)
+            TwoFactor::new(user_uuid.to_string(), TwoFactorType::Webauthn, serde_json::to_string(&registrations)?)
                .save(conn)
                .await?;
            return Ok(());
--- a/src/api/core/two_factor/yubikey.rs
+++ b/src/api/core/two_factor/yubikey.rs
@@ -92,10 +92,10 @@ async fn generate_yubikey(data: Json<PasswordOrOtpData>, headers: Headers, mut c

    data.validate(&user, false, &mut conn).await?;

-    let user_id = &user.uuid;
+    let user_uuid = &user.uuid;
    let yubikey_type = TwoFactorType::YubiKey as i32;

-    let r = TwoFactor::find_by_user_and_type(user_id, yubikey_type, &mut conn).await;
+    let r = TwoFactor::find_by_user_and_type(user_uuid, yubikey_type, &mut conn).await;

    if let Some(r) = r {
        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
--- a/src/api/icons.rs
+++ b/src/api/icons.rs
@@ -19,7 +19,7 @@ use tokio::{
    io::{AsyncReadExt, AsyncWriteExt},
 };

-use html5gum::{Emitter, HtmlString, Readable, StringReader, Tokenizer};
+use html5gum::{Emitter, HtmlString, InfallibleTokenizer, Readable, StringReader, Tokenizer};

 use crate::{
    error::Error,
@@ -261,7 +261,11 @@ impl Icon {
    }
 }

-fn get_favicons_node(dom: Tokenizer<StringReader<'_>, FaviconEmitter>, icons: &mut Vec<Icon>, url: &url::Url) {
+fn get_favicons_node(
+    dom: InfallibleTokenizer<StringReader<'_>, FaviconEmitter>,
+    icons: &mut Vec<Icon>,
+    url: &url::Url,
+) {
    const TAG_LINK: &[u8] = b"link";
    const TAG_BASE: &[u8] = b"base";
    const TAG_HEAD: &[u8] = b"head";
@@ -270,7 +274,7 @@ fn get_favicons_node(dom: Tokenizer<StringReader<'_>, FaviconEmitter>, icons: &m

    let mut base_url = url.clone();
    let mut icon_tags: Vec<Tag> = Vec::new();
-    for Ok(token) in dom {
+    for token in dom {
        let tag_name: &[u8] = &token.tag.name;
        match tag_name {
            TAG_LINK => {
@@ -291,7 +295,9 @@ fn get_favicons_node(dom: Tokenizer<StringReader<'_>, FaviconEmitter>, icons: &m
            TAG_HEAD if token.closing => {
                break;
            }
-            _ => {}
+            _ => {
+                continue;
+            }
        }
    }

@@ -395,7 +401,7 @@ async fn get_icon_url(domain: &str) -> Result<IconUrlResult, Error> {
        // 384KB should be more than enough for the HTML, though as we only really need the HTML header.
        let limited_reader = stream_to_bytes_limit(content, 384 * 1024).await?.to_vec();

-        let dom = Tokenizer::new_with_emitter(limited_reader.to_reader(), FaviconEmitter::default());
+        let dom = Tokenizer::new_with_emitter(limited_reader.to_reader(), FaviconEmitter::default()).infallible();
        get_favicons_node(dom, &mut iconlist, &url);
    } else {
        // Add the default favicon.ico to the list with just the given domain
@@ -656,7 +662,7 @@ impl reqwest::cookie::CookieStore for Jar {
 /// The FaviconEmitter is using an optimized version of the DefaultEmitter.
 /// This prevents emitting tags like comments, doctype and also strings between the tags.
 /// But it will also only emit the tags we need and only if they have the correct attributes
-/// Therefore parsing the HTML content is faster.
+/// Therefor parsing the HTML content is faster.
 use std::collections::BTreeMap;

 #[derive(Default)]
--- a/src/api/identity.rs
+++ b/src/api/identity.rs
@@ -31,7 +31,7 @@ pub fn routes() -> Vec<Route> {
 async fn login(data: Form<ConnectData>, client_header: ClientHeaders, mut conn: DbConn) -> JsonResult {
    let data: ConnectData = data.into_inner();

-    let mut user_id: Option<UserId> = None;
+    let mut user_uuid: Option<String> = None;

    let login_result = match data.grant_type.as_ref() {
        "refresh_token" => {
@@ -48,7 +48,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, mut conn:
            _check_is_some(&data.device_name, "device_name cannot be blank")?;
            _check_is_some(&data.device_type, "device_type cannot be blank")?;

-            _password_login(data, &mut user_id, &mut conn, &client_header.ip).await
+            _password_login(data, &mut user_uuid, &mut conn, &client_header.ip).await
        }
        "client_credentials" => {
            _check_is_some(&data.client_id, "client_id cannot be blank")?;
@@ -59,17 +59,17 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, mut conn:
            _check_is_some(&data.device_name, "device_name cannot be blank")?;
            _check_is_some(&data.device_type, "device_type cannot be blank")?;

-            _api_key_login(data, &mut user_id, &mut conn, &client_header.ip).await
+            _api_key_login(data, &mut user_uuid, &mut conn, &client_header.ip).await
        }
        t => err!("Invalid type", t),
    };

-    if let Some(user_id) = user_id {
+    if let Some(user_uuid) = user_uuid {
        match &login_result {
            Ok(_) => {
                log_user_event(
                    EventType::UserLoggedIn as i32,
-                    &user_id,
+                    &user_uuid,
                    client_header.device_type,
                    &client_header.ip.ip,
                    &mut conn,
@@ -80,7 +80,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, mut conn:
                if let Some(ev) = e.get_event() {
                    log_user_event(
                        ev.event as i32,
-                        &user_id,
+                        &user_uuid,
                        client_header.device_type,
                        &client_header.ip.ip,
                        &mut conn,
@@ -111,7 +111,7 @@ async fn _refresh_login(data: ConnectData, conn: &mut DbConn) -> JsonResult {
    // Because this might get used in the future, and is add by the Bitwarden Server, lets keep it, but then commented out
    // See: https://github.com/dani-garcia/vaultwarden/issues/4156
    // ---
-    // let members = Membership::find_confirmed_by_user(&user.uuid, conn).await;
+    // let orgs = UserOrganization::find_confirmed_by_user(&user.uuid, conn).await;
    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec);
    device.save(conn).await?;

@@ -141,7 +141,7 @@ struct MasterPasswordPolicy {

 async fn _password_login(
    data: ConnectData,
-    user_id: &mut Option<UserId>,
+    user_uuid: &mut Option<String>,
    conn: &mut DbConn,
    ip: &ClientIp,
 ) -> JsonResult {
@@ -157,29 +157,28 @@ async fn _password_login(

    // Get the user
    let username = data.username.as_ref().unwrap().trim();
-    let Some(mut user) = User::find_by_mail(username, conn).await else {
-        err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {}.", ip.ip, username))
+    let mut user = match User::find_by_mail(username, conn).await {
+        Some(user) => user,
+        None => err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {}.", ip.ip, username)),
    };

-    // Set the user_id here to be passed back used for event logging.
-    *user_id = Some(user.uuid.clone());
-
-    // Check if the user is disabled
-    if !user.enabled {
-        err!(
-            "This user has been disabled",
-            format!("IP: {}. Username: {}.", ip.ip, username),
-            ErrorEvent {
-                event: EventType::UserFailedLogIn
-            }
-        )
-    }
+    // Set the user_uuid here to be passed back used for event logging.
+    *user_uuid = Some(user.uuid.clone());

+    // Check password
    let password = data.password.as_ref().unwrap();
-
-    // If we get an auth request, we don't check the user's password, but the access code of the auth request
-    if let Some(ref auth_request_id) = data.auth_request {
-        let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, conn).await else {
+    if let Some(auth_request_uuid) = data.auth_request.clone() {
+        if let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_uuid.as_str(), conn).await {
+            if !auth_request.check_access_code(password) {
+                err!(
+                    "Username or access code is incorrect. Try again",
+                    format!("IP: {}. Username: {}.", ip.ip, username),
+                    ErrorEvent {
+                        event: EventType::UserFailedLogIn,
+                    }
+                )
+            }
+        } else {
            err!(
                "Auth request not found. Try again.",
                format!("IP: {}. Username: {}.", ip.ip, username),
@@ -187,24 +186,6 @@ async fn _password_login(
                    event: EventType::UserFailedLogIn,
                }
            )
-        };
-
-        let expiration_time = auth_request.creation_date + chrono::Duration::minutes(5);
-        let request_expired = Utc::now().naive_utc() >= expiration_time;
-
-        if auth_request.user_uuid != user.uuid
-            || !auth_request.approved.unwrap_or(false)
-            || request_expired
-            || ip.ip.to_string() != auth_request.request_ip
-            || !auth_request.check_access_code(password)
-        {
-            err!(
-                "Username or access code is incorrect. Try again",
-                format!("IP: {}. Username: {}.", ip.ip, username),
-                ErrorEvent {
-                    event: EventType::UserFailedLogIn,
-                }
-            )
        }
    } else if !user.check_valid_password(password) {
        err!(
@@ -216,8 +197,8 @@ async fn _password_login(
        )
    }

-    // Change the KDF Iterations (only when not logging in with an auth request)
-    if data.auth_request.is_none() && user.password_iterations != CONFIG.password_iterations() {
+    // Change the KDF Iterations
+    if user.password_iterations != CONFIG.password_iterations() {
        user.password_iterations = CONFIG.password_iterations();
        user.set_password(password, None, false, None);

@@ -226,6 +207,17 @@ async fn _password_login(
        }
    }

+    // Check if the user is disabled
+    if !user.enabled {
+        err!(
+            "This user has been disabled",
+            format!("IP: {}. Username: {}.", ip.ip, username),
+            ErrorEvent {
+                event: EventType::UserFailedLogIn
+            }
+        )
+    }
+
    let now = Utc::now().naive_utc();

    if user.verified_at.is_none() && CONFIG.mail_enabled() && CONFIG.signups_verify() {
@@ -290,7 +282,7 @@ async fn _password_login(
    // Because this might get used in the future, and is add by the Bitwarden Server, lets keep it, but then commented out
    // See: https://github.com/dani-garcia/vaultwarden/issues/4156
    // ---
-    // let members = Membership::find_confirmed_by_user(&user.uuid, conn).await;
+    // let orgs = UserOrganization::find_confirmed_by_user(&user.uuid, conn).await;
    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec);
    device.save(conn).await?;

@@ -358,7 +350,7 @@ async fn _password_login(

 async fn _api_key_login(
    data: ConnectData,
-    user_id: &mut Option<UserId>,
+    user_uuid: &mut Option<String>,
    conn: &mut DbConn,
    ip: &ClientIp,
 ) -> JsonResult {
@@ -367,7 +359,7 @@ async fn _api_key_login(

    // Validate scope
    match data.scope.as_ref().unwrap().as_ref() {
-        "api" => _user_api_key_login(data, user_id, conn, ip).await,
+        "api" => _user_api_key_login(data, user_uuid, conn, ip).await,
        "api.organization" => _organization_api_key_login(data, conn, ip).await,
        _ => err!("Scope not supported"),
    }
@@ -375,22 +367,23 @@ async fn _api_key_login(

 async fn _user_api_key_login(
    data: ConnectData,
-    user_id: &mut Option<UserId>,
+    user_uuid: &mut Option<String>,
    conn: &mut DbConn,
    ip: &ClientIp,
 ) -> JsonResult {
    // Get the user via the client_id
    let client_id = data.client_id.as_ref().unwrap();
-    let Some(client_user_id) = client_id.strip_prefix("user.") else {
-        err!("Malformed client_id", format!("IP: {}.", ip.ip))
+    let client_user_uuid = match client_id.strip_prefix("user.") {
+        Some(uuid) => uuid,
+        None => err!("Malformed client_id", format!("IP: {}.", ip.ip)),
    };
-    let client_user_id: UserId = client_user_id.into();
-    let Some(user) = User::find_by_uuid(&client_user_id, conn).await else {
-        err!("Invalid client_id", format!("IP: {}.", ip.ip))
+    let user = match User::find_by_uuid(client_user_uuid, conn).await {
+        Some(user) => user,
+        None => err!("Invalid client_id", format!("IP: {}.", ip.ip)),
    };

-    // Set the user_id here to be passed back used for event logging.
-    *user_id = Some(user.uuid.clone());
+    // Set the user_uuid here to be passed back used for event logging.
+    *user_uuid = Some(user.uuid.clone());

    // Check if the user is disabled
    if !user.enabled {
@@ -440,7 +433,7 @@ async fn _user_api_key_login(
    // Because this might get used in the future, and is add by the Bitwarden Server, lets keep it, but then commented out
    // See: https://github.com/dani-garcia/vaultwarden/issues/4156
    // ---
-    // let members = Membership::find_confirmed_by_user(&user.uuid, conn).await;
+    // let orgs = UserOrganization::find_confirmed_by_user(&user.uuid, conn).await;
    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec);
    device.save(conn).await?;

@@ -469,12 +462,13 @@ async fn _user_api_key_login(
 async fn _organization_api_key_login(data: ConnectData, conn: &mut DbConn, ip: &ClientIp) -> JsonResult {
    // Get the org via the client_id
    let client_id = data.client_id.as_ref().unwrap();
-    let Some(org_id) = client_id.strip_prefix("organization.") else {
-        err!("Malformed client_id", format!("IP: {}.", ip.ip))
+    let org_uuid = match client_id.strip_prefix("organization.") {
+        Some(uuid) => uuid,
+        None => err!("Malformed client_id", format!("IP: {}.", ip.ip)),
    };
-    let org_id: OrganizationId = org_id.to_string().into();
-    let Some(org_api_key) = OrganizationApiKey::find_by_org_uuid(&org_id, conn).await else {
-        err!("Invalid client_id", format!("IP: {}.", ip.ip))
+    let org_api_key = match OrganizationApiKey::find_by_org_uuid(org_uuid, conn).await {
+        Some(org_api_key) => org_api_key,
+        None => err!("Invalid client_id", format!("IP: {}.", ip.ip)),
    };

    // Check API key.
@@ -615,7 +609,7 @@ fn _selected_data(tf: Option<TwoFactor>) -> ApiResult<String> {

 async fn _json_err_twofactor(
    providers: &[i32],
-    user_id: &UserId,
+    user_uuid: &str,
    data: &ConnectData,
    conn: &mut DbConn,
 ) -> ApiResult<Value> {
@@ -636,12 +630,12 @@ async fn _json_err_twofactor(
            Some(TwoFactorType::Authenticator) => { /* Nothing to do for TOTP */ }

            Some(TwoFactorType::Webauthn) if CONFIG.domain_set() => {
-                let request = webauthn::generate_webauthn_login(user_id, conn).await?;
+                let request = webauthn::generate_webauthn_login(user_uuid, conn).await?;
                result["TwoFactorProviders2"][provider.to_string()] = request.0;
            }

            Some(TwoFactorType::Duo) => {
-                let email = match User::find_by_uuid(user_id, conn).await {
+                let email = match User::find_by_uuid(user_uuid, conn).await {
                    Some(u) => u.email,
                    None => err!("User does not exist"),
                };
@@ -673,8 +667,9 @@ async fn _json_err_twofactor(
            }

            Some(tf_type @ TwoFactorType::YubiKey) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
-                    err!("No YubiKey devices registered")
+                let twofactor = match TwoFactor::find_by_user_and_type(user_uuid, tf_type as i32, conn).await {
+                    Some(tf) => tf,
+                    None => err!("No YubiKey devices registered"),
                };

                let yubikey_metadata: yubikey::YubikeyMetadata = serde_json::from_str(&twofactor.data)?;
@@ -685,13 +680,14 @@ async fn _json_err_twofactor(
            }

            Some(tf_type @ TwoFactorType::Email) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
-                    err!("No twofactor email registered")
+                let twofactor = match TwoFactor::find_by_user_and_type(user_uuid, tf_type as i32, conn).await {
+                    Some(tf) => tf,
+                    None => err!("No twofactor email registered"),
                };

                // Send email immediately if email is the only 2FA option
                if providers.len() == 1 {
-                    email::send_token(user_id, conn).await?
+                    email::send_token(user_uuid, conn).await?
                }

                let email_data = email::EmailTokenData::from_json(&twofactor.data)?;
@@ -746,7 +742,7 @@ struct ConnectData {

    #[field(name = uncased("device_identifier"))]
    #[field(name = uncased("deviceidentifier"))]
-    device_identifier: Option<DeviceId>,
+    device_identifier: Option<String>,
    #[field(name = uncased("device_name"))]
    #[field(name = uncased("devicename"))]
    device_name: Option<String>,
@@ -769,7 +765,7 @@ struct ConnectData {
    #[field(name = uncased("twofactorremember"))]
    two_factor_remember: Option<i32>,
    #[field(name = uncased("authrequest"))]
-    auth_request: Option<AuthRequestId>,
+    auth_request: Option<String>,
 }

 fn _check_is_some<T>(value: &Option<T>, msg: &str) -> EmptyResult {
--- a/src/api/notifications.rs
+++ b/src/api/notifications.rs
@@ -10,7 +10,7 @@ use rocket_ws::{Message, WebSocket};
 use crate::{
    auth::{ClientIp, WsAccessTokenHeader},
    db::{
-        models::{AuthRequestId, Cipher, CollectionId, DeviceId, Folder, Send as DbSend, User, UserId},
+        models::{Cipher, Folder, Send as DbSend, User},
        DbConn,
    },
    Error, CONFIG,
@@ -53,13 +53,13 @@ struct WsAccessToken {

 struct WSEntryMapGuard {
    users: Arc<WebSocketUsers>,
-    user_uuid: UserId,
+    user_uuid: String,
    entry_uuid: uuid::Uuid,
    addr: IpAddr,
 }

 impl WSEntryMapGuard {
-    fn new(users: Arc<WebSocketUsers>, user_uuid: UserId, entry_uuid: uuid::Uuid, addr: IpAddr) -> Self {
+    fn new(users: Arc<WebSocketUsers>, user_uuid: String, entry_uuid: uuid::Uuid, addr: IpAddr) -> Self {
        Self {
            users,
            user_uuid,
@@ -72,7 +72,7 @@ impl WSEntryMapGuard {
 impl Drop for WSEntryMapGuard {
    fn drop(&mut self) {
        info!("Closing WS connection from {}", self.addr);
-        if let Some(mut entry) = self.users.map.get_mut(self.user_uuid.as_ref()) {
+        if let Some(mut entry) = self.users.map.get_mut(&self.user_uuid) {
            entry.retain(|(uuid, _)| uuid != &self.entry_uuid);
        }
    }
@@ -101,7 +101,6 @@ impl Drop for WSAnonymousEntryMapGuard {
    }
 }

-#[allow(tail_expr_drop_order)]
 #[get("/hub?<data..>")]
 fn websockets_hub<'r>(
    ws: WebSocket,
@@ -130,7 +129,7 @@ fn websockets_hub<'r>(
        // Add a channel to send messages to this client to the map
        let entry_uuid = uuid::Uuid::new_v4();
        let (tx, rx) = tokio::sync::mpsc::channel::<Message>(100);
-        users.map.entry(claims.sub.to_string()).or_default().push((entry_uuid, tx));
+        users.map.entry(claims.sub.clone()).or_default().push((entry_uuid, tx));

        // Once the guard goes out of scope, the connection will have been closed and the entry will be deleted from the map
        (rx, WSEntryMapGuard::new(users, claims.sub, entry_uuid, addr))
@@ -157,6 +156,7 @@ fn websockets_hub<'r>(

                                        if serde_json::from_str(msg).ok() == Some(INITIAL_MESSAGE) {
                                            yield Message::binary(INITIAL_RESPONSE);
+                                            continue;
                                        }
                                    }

@@ -186,7 +186,6 @@ fn websockets_hub<'r>(
    })
 }

-#[allow(tail_expr_drop_order)]
 #[get("/anonymous-hub?<token..>")]
 fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> Result<rocket_ws::Stream!['r], Error> {
    let addr = ip.ip;
@@ -224,6 +223,7 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R

                                        if serde_json::from_str(msg).ok() == Some(INITIAL_MESSAGE) {
                                            yield Message::binary(INITIAL_RESPONSE);
+                                            continue;
                                        }
                                    }

@@ -290,7 +290,7 @@ fn serialize(val: Value) -> Vec<u8> {
 fn serialize_date(date: NaiveDateTime) -> Value {
    let seconds: i64 = date.and_utc().timestamp();
    let nanos: i64 = date.and_utc().timestamp_subsec_nanos().into();
-    let timestamp = (nanos << 34) | seconds;
+    let timestamp = nanos << 34 | seconds;

    let bs = timestamp.to_be_bytes();

@@ -328,8 +328,8 @@ pub struct WebSocketUsers {
 }

 impl WebSocketUsers {
-    async fn send_update(&self, user_id: &UserId, data: &[u8]) {
-        if let Some(user) = self.map.get(user_id.as_ref()).map(|v| v.clone()) {
+    async fn send_update(&self, user_uuid: &str, data: &[u8]) {
+        if let Some(user) = self.map.get(user_uuid).map(|v| v.clone()) {
            for (_, sender) in user.iter() {
                if let Err(e) = sender.send(Message::binary(data)).await {
                    error!("Error sending WS update {e}");
@@ -345,7 +345,7 @@ impl WebSocketUsers {
            return;
        }
        let data = create_update(
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
+            vec![("UserId".into(), user.uuid.clone().into()), ("Date".into(), serialize_date(user.updated_at))],
            ut,
            None,
        );
@@ -359,15 +359,15 @@ impl WebSocketUsers {
        }
    }

-    pub async fn send_logout(&self, user: &User, acting_device_id: Option<DeviceId>) {
+    pub async fn send_logout(&self, user: &User, acting_device_uuid: Option<String>) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
        let data = create_update(
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
+            vec![("UserId".into(), user.uuid.clone().into()), ("Date".into(), serialize_date(user.updated_at))],
            UpdateType::LogOut,
-            acting_device_id.clone(),
+            acting_device_uuid.clone(),
        );

        if CONFIG.enable_websocket() {
@@ -375,7 +375,7 @@ impl WebSocketUsers {
        }

        if CONFIG.push_enabled() {
-            push_logout(user, acting_device_id.clone());
+            push_logout(user, acting_device_uuid);
        }
    }

@@ -383,7 +383,7 @@ impl WebSocketUsers {
        &self,
        ut: UpdateType,
        folder: &Folder,
-        acting_device_id: &DeviceId,
+        acting_device_uuid: &String,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
@@ -392,12 +392,12 @@ impl WebSocketUsers {
        }
        let data = create_update(
            vec![
-                ("Id".into(), folder.uuid.to_string().into()),
-                ("UserId".into(), folder.user_uuid.to_string().into()),
+                ("Id".into(), folder.uuid.clone().into()),
+                ("UserId".into(), folder.user_uuid.clone().into()),
                ("RevisionDate".into(), serialize_date(folder.updated_at)),
            ],
            ut,
-            Some(acting_device_id.clone()),
+            Some(acting_device_uuid.into()),
        );

        if CONFIG.enable_websocket() {
@@ -405,7 +405,7 @@ impl WebSocketUsers {
        }

        if CONFIG.push_enabled() {
-            push_folder_update(ut, folder, acting_device_id, conn).await;
+            push_folder_update(ut, folder, acting_device_uuid, conn).await;
        }
    }

@@ -413,48 +413,48 @@ impl WebSocketUsers {
        &self,
        ut: UpdateType,
        cipher: &Cipher,
-        user_ids: &[UserId],
-        acting_device_id: &DeviceId,
-        collection_uuids: Option<Vec<CollectionId>>,
+        user_uuids: &[String],
+        acting_device_uuid: &String,
+        collection_uuids: Option<Vec<String>>,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
-        let org_id = convert_option(cipher.organization_uuid.as_deref());
+        let org_uuid = convert_option(cipher.organization_uuid.clone());
        // Depending if there are collections provided or not, we need to have different values for the following variables.
        // The user_uuid should be `null`, and the revision date should be set to now, else the clients won't sync the collection change.
-        let (user_id, collection_uuids, revision_date) = if let Some(collection_uuids) = collection_uuids {
+        let (user_uuid, collection_uuids, revision_date) = if let Some(collection_uuids) = collection_uuids {
            (
                Value::Nil,
-                Value::Array(collection_uuids.into_iter().map(|v| v.to_string().into()).collect::<Vec<Value>>()),
+                Value::Array(collection_uuids.into_iter().map(|v| v.into()).collect::<Vec<Value>>()),
                serialize_date(Utc::now().naive_utc()),
            )
        } else {
-            (convert_option(cipher.user_uuid.as_deref()), Value::Nil, serialize_date(cipher.updated_at))
+            (convert_option(cipher.user_uuid.clone()), Value::Nil, serialize_date(cipher.updated_at))
        };

        let data = create_update(
            vec![
-                ("Id".into(), cipher.uuid.to_string().into()),
-                ("UserId".into(), user_id),
-                ("OrganizationId".into(), org_id),
+                ("Id".into(), cipher.uuid.clone().into()),
+                ("UserId".into(), user_uuid),
+                ("OrganizationId".into(), org_uuid),
                ("CollectionIds".into(), collection_uuids),
                ("RevisionDate".into(), revision_date),
            ],
            ut,
-            Some(acting_device_id.clone()),
+            Some(acting_device_uuid.into()),
        );

        if CONFIG.enable_websocket() {
-            for uuid in user_ids {
+            for uuid in user_uuids {
                self.send_update(uuid, &data).await;
            }
        }

-        if CONFIG.push_enabled() && user_ids.len() == 1 {
-            push_cipher_update(ut, cipher, acting_device_id, conn).await;
+        if CONFIG.push_enabled() && user_uuids.len() == 1 {
+            push_cipher_update(ut, cipher, acting_device_uuid, conn).await;
        }
    }

@@ -462,20 +462,20 @@ impl WebSocketUsers {
        &self,
        ut: UpdateType,
        send: &DbSend,
-        user_ids: &[UserId],
-        acting_device_id: &DeviceId,
+        user_uuids: &[String],
+        acting_device_uuid: &String,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
-        let user_id = convert_option(send.user_uuid.as_deref());
+        let user_uuid = convert_option(send.user_uuid.clone());

        let data = create_update(
            vec![
-                ("Id".into(), send.uuid.to_string().into()),
-                ("UserId".into(), user_id),
+                ("Id".into(), send.uuid.clone().into()),
+                ("UserId".into(), user_uuid),
                ("RevisionDate".into(), serialize_date(send.revision_date)),
            ],
            ut,
@@ -483,20 +483,20 @@ impl WebSocketUsers {
        );

        if CONFIG.enable_websocket() {
-            for uuid in user_ids {
+            for uuid in user_uuids {
                self.send_update(uuid, &data).await;
            }
        }
-        if CONFIG.push_enabled() && user_ids.len() == 1 {
-            push_send_update(ut, send, acting_device_id, conn).await;
+        if CONFIG.push_enabled() && user_uuids.len() == 1 {
+            push_send_update(ut, send, acting_device_uuid, conn).await;
        }
    }

    pub async fn send_auth_request(
        &self,
-        user_id: &UserId,
+        user_uuid: &String,
        auth_request_uuid: &String,
-        acting_device_id: &DeviceId,
+        acting_device_uuid: &String,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
@@ -504,24 +504,24 @@ impl WebSocketUsers {
            return;
        }
        let data = create_update(
-            vec![("Id".into(), auth_request_uuid.clone().into()), ("UserId".into(), user_id.to_string().into())],
+            vec![("Id".into(), auth_request_uuid.clone().into()), ("UserId".into(), user_uuid.clone().into())],
            UpdateType::AuthRequest,
-            Some(acting_device_id.clone()),
+            Some(acting_device_uuid.to_string()),
        );
        if CONFIG.enable_websocket() {
-            self.send_update(user_id, &data).await;
+            self.send_update(user_uuid, &data).await;
        }

        if CONFIG.push_enabled() {
-            push_auth_request(user_id.clone(), auth_request_uuid.to_string(), conn).await;
+            push_auth_request(user_uuid.to_string(), auth_request_uuid.to_string(), conn).await;
        }
    }

    pub async fn send_auth_response(
        &self,
-        user_id: &UserId,
-        auth_request_id: &AuthRequestId,
-        approving_device_id: &DeviceId,
+        user_uuid: &String,
+        auth_response_uuid: &str,
+        approving_device_uuid: String,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
@@ -529,16 +529,17 @@ impl WebSocketUsers {
            return;
        }
        let data = create_update(
-            vec![("Id".into(), auth_request_id.to_string().into()), ("UserId".into(), user_id.to_string().into())],
+            vec![("Id".into(), auth_response_uuid.to_owned().into()), ("UserId".into(), user_uuid.clone().into())],
            UpdateType::AuthRequestResponse,
-            Some(approving_device_id.clone()),
+            approving_device_uuid.clone().into(),
        );
        if CONFIG.enable_websocket() {
-            self.send_update(user_id, &data).await;
+            self.send_update(auth_response_uuid, &data).await;
        }

        if CONFIG.push_enabled() {
-            push_auth_response(user_id, auth_request_id, approving_device_id, conn).await;
+            push_auth_response(user_uuid.to_string(), auth_response_uuid.to_string(), approving_device_uuid, conn)
+                .await;
        }
    }
 }
@@ -557,16 +558,16 @@ impl AnonymousWebSocketSubscriptions {
        }
    }

-    pub async fn send_auth_response(&self, user_id: &UserId, auth_request_id: &AuthRequestId) {
+    pub async fn send_auth_response(&self, user_uuid: &String, auth_response_uuid: &str) {
        if !CONFIG.enable_websocket() {
            return;
        }
        let data = create_anonymous_update(
-            vec![("Id".into(), auth_request_id.to_string().into()), ("UserId".into(), user_id.to_string().into())],
+            vec![("Id".into(), auth_response_uuid.to_owned().into()), ("UserId".into(), user_uuid.clone().into())],
            UpdateType::AuthRequestResponse,
-            user_id.clone(),
+            user_uuid.to_string(),
        );
-        self.send_update(auth_request_id, &data).await;
+        self.send_update(auth_response_uuid, &data).await;
    }
 }

@@ -578,14 +579,14 @@ impl AnonymousWebSocketSubscriptions {
    "ReceiveMessage", // Target
    [ // Arguments
        {
-            "ContextId": acting_device_id || Nil,
+            "ContextId": acting_device_uuid || Nil,
            "Type": ut as i32,
            "Payload": {}
        }
    ]
 ]
 */
-fn create_update(payload: Vec<(Value, Value)>, ut: UpdateType, acting_device_id: Option<DeviceId>) -> Vec<u8> {
+fn create_update(payload: Vec<(Value, Value)>, ut: UpdateType, acting_device_uuid: Option<String>) -> Vec<u8> {
    use rmpv::Value as V;

    let value = V::Array(vec![
@@ -594,7 +595,7 @@ fn create_update(payload: Vec<(Value, Value)>, ut: UpdateType, acting_device_id:
        V::Nil,
        "ReceiveMessage".into(),
        V::Array(vec![V::Map(vec![
-            ("ContextId".into(), acting_device_id.map(|v| v.to_string().into()).unwrap_or_else(|| V::Nil)),
+            ("ContextId".into(), acting_device_uuid.map(|v| v.into()).unwrap_or_else(|| V::Nil)),
            ("Type".into(), (ut as i32).into()),
            ("Payload".into(), payload.into()),
        ])]),
@@ -603,7 +604,7 @@ fn create_update(payload: Vec<(Value, Value)>, ut: UpdateType, acting_device_id:
    serialize(value)
 }

-fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id: UserId) -> Vec<u8> {
+fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id: String) -> Vec<u8> {
    use rmpv::Value as V;

    let value = V::Array(vec![
@@ -614,7 +615,7 @@ fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id
        V::Array(vec![V::Map(vec![
            ("Type".into(), (ut as i32).into()),
            ("Payload".into(), payload.into()),
-            ("UserId".into(), user_id.to_string().into()),
+            ("UserId".into(), user_id.into()),
        ])]),
    ]);

--- a/src/api/push.rs
+++ b/src/api/push.rs
@@ -7,9 +7,8 @@ use tokio::sync::RwLock;

 use crate::{
    api::{ApiResult, EmptyResult, UpdateType},
-    db::models::{AuthRequestId, Cipher, Device, DeviceId, Folder, Send, User, UserId},
+    db::models::{Cipher, Device, Folder, Send, User},
    http_client::make_http_request,
-    util::format_date,
    CONFIG,
 };

@@ -126,15 +125,15 @@ pub async fn register_push_device(device: &mut Device, conn: &mut crate::db::DbC
    Ok(())
 }

-pub async fn unregister_push_device(push_id: Option<String>) -> EmptyResult {
-    if !CONFIG.push_enabled() || push_id.is_none() {
+pub async fn unregister_push_device(push_uuid: Option<String>) -> EmptyResult {
+    if !CONFIG.push_enabled() || push_uuid.is_none() {
        return Ok(());
    }
    let auth_push_token = get_auth_push_token().await?;

    let auth_header = format!("Bearer {}", &auth_push_token);

-    match make_http_request(Method::DELETE, &(CONFIG.push_relay_uri() + "/push/" + &push_id.unwrap()))?
+    match make_http_request(Method::DELETE, &(CONFIG.push_relay_uri() + "/push/" + &push_uuid.unwrap()))?
        .header(AUTHORIZATION, auth_header)
        .send()
        .await
@@ -148,48 +147,51 @@ pub async fn unregister_push_device(push_id: Option<String>) -> EmptyResult {
 pub async fn push_cipher_update(
    ut: UpdateType,
    cipher: &Cipher,
-    acting_device_id: &DeviceId,
+    acting_device_uuid: &String,
    conn: &mut crate::db::DbConn,
 ) {
    // We shouldn't send a push notification on cipher update if the cipher belongs to an organization, this isn't implemented in the upstream server too.
    if cipher.organization_uuid.is_some() {
        return;
    };
-    let Some(user_id) = &cipher.user_uuid else {
-        debug!("Cipher has no uuid");
-        return;
+    let user_uuid = match &cipher.user_uuid {
+        Some(c) => c,
+        None => {
+            debug!("Cipher has no uuid");
+            return;
+        }
    };

-    if Device::check_user_has_push_device(user_id, conn).await {
+    if Device::check_user_has_push_device(user_uuid, conn).await {
        send_to_push_relay(json!({
-            "userId": user_id,
+            "userId": user_uuid,
            "organizationId": (),
-            "deviceId": acting_device_id,
-            "identifier": acting_device_id,
+            "deviceId": acting_device_uuid,
+            "identifier": acting_device_uuid,
            "type": ut as i32,
            "payload": {
-                "Id": cipher.uuid,
-                "UserId": cipher.user_uuid,
-                "OrganizationId": (),
-                "RevisionDate": format_date(&cipher.updated_at)
+                "id": cipher.uuid,
+                "userId": cipher.user_uuid,
+                "organizationId": (),
+                "revisionDate": cipher.updated_at
            }
        }))
        .await;
    }
 }

-pub fn push_logout(user: &User, acting_device_id: Option<DeviceId>) {
-    let acting_device_id: Value = acting_device_id.map(|v| v.to_string().into()).unwrap_or_else(|| Value::Null);
+pub fn push_logout(user: &User, acting_device_uuid: Option<String>) {
+    let acting_device_uuid: Value = acting_device_uuid.map(|v| v.into()).unwrap_or_else(|| Value::Null);

    tokio::task::spawn(send_to_push_relay(json!({
        "userId": user.uuid,
        "organizationId": (),
-        "deviceId": acting_device_id,
-        "identifier": acting_device_id,
+        "deviceId": acting_device_uuid,
+        "identifier": acting_device_uuid,
        "type": UpdateType::LogOut as i32,
        "payload": {
-            "UserId": user.uuid,
-            "Date": format_date(&user.updated_at)
+            "userId": user.uuid,
+            "date": user.updated_at
        }
    })));
 }
@@ -202,8 +204,8 @@ pub fn push_user_update(ut: UpdateType, user: &User) {
        "identifier": (),
        "type": ut as i32,
        "payload": {
-            "UserId": user.uuid,
-            "Date": format_date(&user.updated_at)
+            "userId": user.uuid,
+            "date": user.updated_at
        }
    })));
 }
@@ -211,38 +213,38 @@ pub fn push_user_update(ut: UpdateType, user: &User) {
 pub async fn push_folder_update(
    ut: UpdateType,
    folder: &Folder,
-    acting_device_id: &DeviceId,
+    acting_device_uuid: &String,
    conn: &mut crate::db::DbConn,
 ) {
    if Device::check_user_has_push_device(&folder.user_uuid, conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
            "userId": folder.user_uuid,
            "organizationId": (),
-            "deviceId": acting_device_id,
-            "identifier": acting_device_id,
+            "deviceId": acting_device_uuid,
+            "identifier": acting_device_uuid,
            "type": ut as i32,
            "payload": {
-                "Id": folder.uuid,
-                "UserId": folder.user_uuid,
-                "RevisionDate": format_date(&folder.updated_at)
+                "id": folder.uuid,
+                "userId": folder.user_uuid,
+                "revisionDate": folder.updated_at
            }
        })));
    }
 }

-pub async fn push_send_update(ut: UpdateType, send: &Send, acting_device_id: &DeviceId, conn: &mut crate::db::DbConn) {
+pub async fn push_send_update(ut: UpdateType, send: &Send, acting_device_uuid: &String, conn: &mut crate::db::DbConn) {
    if let Some(s) = &send.user_uuid {
        if Device::check_user_has_push_device(s, conn).await {
            tokio::task::spawn(send_to_push_relay(json!({
                "userId": send.user_uuid,
                "organizationId": (),
-                "deviceId": acting_device_id,
-                "identifier": acting_device_id,
+                "deviceId": acting_device_uuid,
+                "identifier": acting_device_uuid,
                "type": ut as i32,
                "payload": {
-                    "Id": send.uuid,
-                    "UserId": send.user_uuid,
-                    "RevisionDate": format_date(&send.revision_date)
+                    "id": send.uuid,
+                    "userId": send.user_uuid,
+                    "revisionDate": send.revision_date
                }
            })));
        }
@@ -284,38 +286,38 @@ async fn send_to_push_relay(notification_data: Value) {
    };
 }

-pub async fn push_auth_request(user_id: UserId, auth_request_id: String, conn: &mut crate::db::DbConn) {
-    if Device::check_user_has_push_device(&user_id, conn).await {
+pub async fn push_auth_request(user_uuid: String, auth_request_uuid: String, conn: &mut crate::db::DbConn) {
+    if Device::check_user_has_push_device(user_uuid.as_str(), conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
-            "userId": user_id,
+            "userId": user_uuid,
            "organizationId": (),
            "deviceId": null,
            "identifier": null,
            "type": UpdateType::AuthRequest as i32,
            "payload": {
-                "Id": auth_request_id,
-                "UserId": user_id,
+                "id": auth_request_uuid,
+                "userId": user_uuid,
            }
        })));
    }
 }

 pub async fn push_auth_response(
-    user_id: &UserId,
-    auth_request_id: &AuthRequestId,
-    approving_device_id: &DeviceId,
+    user_uuid: String,
+    auth_request_uuid: String,
+    approving_device_uuid: String,
    conn: &mut crate::db::DbConn,
 ) {
-    if Device::check_user_has_push_device(user_id, conn).await {
+    if Device::check_user_has_push_device(user_uuid.as_str(), conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
-            "userId": user_id,
+            "userId": user_uuid,
            "organizationId": (),
-            "deviceId": approving_device_id,
-            "identifier": approving_device_id,
+            "deviceId": approving_device_uuid,
+            "identifier": approving_device_uuid,
            "type": UpdateType::AuthRequestResponse as i32,
            "payload": {
-                "Id": auth_request_id,
-                "UserId": user_id,
+                "id": auth_request_uuid,
+                "userId": user_uuid,
            }
        })));
    }
--- a/src/api/web.rs
+++ b/src/api/web.rs
@@ -1,20 +1,13 @@
 use std::path::{Path, PathBuf};

-use rocket::{
-    fs::NamedFile,
-    http::ContentType,
-    response::{content::RawCss as Css, content::RawHtml as Html, Redirect},
-    serde::json::Json,
-    Catcher, Route,
-};
+use rocket::{fs::NamedFile, http::ContentType, response::content::RawHtml as Html, serde::json::Json, Catcher, Route};
 use serde_json::Value;

 use crate::{
    api::{core::now, ApiResult, EmptyResult},
    auth::decode_file_download,
-    db::models::{AttachmentId, CipherId},
    error::Error,
-    util::Cached,
+    util::{Cached, SafeString},
    CONFIG,
 };

@@ -23,7 +16,7 @@ pub fn routes() -> Vec<Route> {
    // crate::utils::LOGGED_ROUTES to make sure they appear in the log
    let mut routes = routes![attachments, alive, alive_head, static_files];
    if CONFIG.web_vault_enabled() {
-        routes.append(&mut routes![web_index, web_index_direct, web_index_head, app_id, web_files, vaultwarden_css]);
+        routes.append(&mut routes![web_index, web_index_head, app_id, web_files]);
    }

    #[cfg(debug_assertions)]
@@ -52,65 +45,11 @@ fn not_found() -> ApiResult<Html<String>> {
    Ok(Html(text))
 }

-#[get("/css/vaultwarden.css")]
-fn vaultwarden_css() -> Cached<Css<String>> {
-    let css_options = json!({
-        "signup_disabled": !CONFIG.signups_allowed() && CONFIG.signups_domains_whitelist().is_empty(),
-        "mail_enabled": CONFIG.mail_enabled(),
-        "yubico_enabled": CONFIG._enable_yubico() && (CONFIG.yubico_client_id().is_some() == CONFIG.yubico_secret_key().is_some()),
-        "emergency_access_allowed": CONFIG.emergency_access_allowed(),
-        "sends_allowed": CONFIG.sends_allowed(),
-        "load_user_scss": true,
-    });
-
-    let scss = match CONFIG.render_template("scss/vaultwarden.scss", &css_options) {
-        Ok(t) => t,
-        Err(e) => {
-            // Something went wrong loading the template. Use the fallback
-            warn!("Loading scss/vaultwarden.scss.hbs or scss/user.vaultwarden.scss.hbs failed. {e}");
-            CONFIG
-                .render_fallback_template("scss/vaultwarden.scss", &css_options)
-                .expect("Fallback scss/vaultwarden.scss.hbs to render")
-        }
-    };
-
-    let css = match grass_compiler::from_string(
-        scss,
-        &grass_compiler::Options::default().style(grass_compiler::OutputStyle::Compressed),
-    ) {
-        Ok(css) => css,
-        Err(e) => {
-            // Something went wrong compiling the scss. Use the fallback
-            warn!("Compiling the Vaultwarden SCSS styles failed. {e}");
-            let mut css_options = css_options;
-            css_options["load_user_scss"] = json!(false);
-            let scss = CONFIG
-                .render_fallback_template("scss/vaultwarden.scss", &css_options)
-                .expect("Fallback scss/vaultwarden.scss.hbs to render");
-            grass_compiler::from_string(
-                scss,
-                &grass_compiler::Options::default().style(grass_compiler::OutputStyle::Compressed),
-            )
-            .expect("SCSS to compile")
-        }
-    };
-
-    // Cache for one day should be enough and not too much
-    Cached::ttl(Css(css), 86_400, false)
-}
-
 #[get("/")]
 async fn web_index() -> Cached<Option<NamedFile>> {
    Cached::short(NamedFile::open(Path::new(&CONFIG.web_vault_folder()).join("index.html")).await.ok(), false)
 }

-// Make sure that `/index.html` redirect to actual domain path.
-// If not, this might cause issues with the web-vault
-#[get("/index.html")]
-fn web_index_direct() -> Redirect {
-    Redirect::to(format!("{}/", CONFIG.domain_path()))
-}
-
 #[head("/")]
 fn web_index_head() -> EmptyResult {
    // Add an explicit HEAD route to prevent uptime monitoring services from
@@ -159,16 +98,16 @@ async fn web_files(p: PathBuf) -> Cached<Option<NamedFile>> {
    Cached::long(NamedFile::open(Path::new(&CONFIG.web_vault_folder()).join(p)).await.ok(), true)
 }

-#[get("/attachments/<cipher_id>/<file_id>?<token>")]
-async fn attachments(cipher_id: CipherId, file_id: AttachmentId, token: String) -> Option<NamedFile> {
+#[get("/attachments/<uuid>/<file_id>?<token>")]
+async fn attachments(uuid: SafeString, file_id: SafeString, token: String) -> Option<NamedFile> {
    let Ok(claims) = decode_file_download(&token) else {
        return None;
    };
-    if claims.sub != cipher_id || claims.file_id != file_id {
+    if claims.sub != *uuid || claims.file_id != *file_id {
        return None;
    }

-    NamedFile::open(Path::new(&CONFIG.attachments_folder()).join(cipher_id.as_ref()).join(file_id.as_ref())).await.ok()
+    NamedFile::open(Path::new(&CONFIG.attachments_folder()).join(uuid).join(file_id)).await.ok()
 }

 // We use DbConn here to let the alive healthcheck also verify the database connection.
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -14,10 +14,6 @@ use std::{
    net::IpAddr,
 };

-use crate::db::models::{
-    AttachmentId, CipherId, CollectionId, DeviceId, EmergencyAccessId, MembershipId, OrgApiKeyId, OrganizationId,
-    SendFileId, SendId, UserId,
-};
 use crate::{error::Error, CONFIG};

 const JWT_ALGORITHM: Algorithm = Algorithm::RS256;
@@ -154,7 +150,7 @@ pub struct LoginJwtClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: UserId,
+    pub sub: String,

    pub premium: bool,
    pub name: String,
@@ -175,7 +171,7 @@ pub struct LoginJwtClaims {
    // user security_stamp
    pub sstamp: String,
    // device uuid
-    pub device: DeviceId,
+    pub device: String,
    // [ "api", "offline_access" ]
    pub scope: Vec<String>,
    // [ "Application" ]
@@ -191,19 +187,19 @@ pub struct InviteJwtClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: UserId,
+    pub sub: String,

    pub email: String,
-    pub org_id: OrganizationId,
-    pub member_id: MembershipId,
+    pub org_id: Option<String>,
+    pub user_org_id: Option<String>,
    pub invited_by_email: Option<String>,
 }

 pub fn generate_invite_claims(
-    user_id: UserId,
+    uuid: String,
    email: String,
-    org_id: OrganizationId,
-    member_id: MembershipId,
+    org_id: Option<String>,
+    user_org_id: Option<String>,
    invited_by_email: Option<String>,
 ) -> InviteJwtClaims {
    let time_now = Utc::now();
@@ -212,10 +208,10 @@ pub fn generate_invite_claims(
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
        iss: JWT_INVITE_ISSUER.to_string(),
-        sub: user_id,
+        sub: uuid,
        email,
        org_id,
-        member_id,
+        user_org_id,
        invited_by_email,
    }
 }
@@ -229,18 +225,18 @@ pub struct EmergencyAccessInviteJwtClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: UserId,
+    pub sub: String,

    pub email: String,
-    pub emer_id: EmergencyAccessId,
+    pub emer_id: String,
    pub grantor_name: String,
    pub grantor_email: String,
 }

 pub fn generate_emergency_access_invite_claims(
-    user_id: UserId,
+    uuid: String,
    email: String,
-    emer_id: EmergencyAccessId,
+    emer_id: String,
    grantor_name: String,
    grantor_email: String,
 ) -> EmergencyAccessInviteJwtClaims {
@@ -250,7 +246,7 @@ pub fn generate_emergency_access_invite_claims(
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
        iss: JWT_EMERGENCY_ACCESS_INVITE_ISSUER.to_string(),
-        sub: user_id,
+        sub: uuid,
        email,
        emer_id,
        grantor_name,
@@ -267,24 +263,21 @@ pub struct OrgApiKeyLoginJwtClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: OrgApiKeyId,
+    pub sub: String,

    pub client_id: String,
-    pub client_sub: OrganizationId,
+    pub client_sub: String,
    pub scope: Vec<String>,
 }

-pub fn generate_organization_api_key_login_claims(
-    org_api_key_uuid: OrgApiKeyId,
-    org_id: OrganizationId,
-) -> OrgApiKeyLoginJwtClaims {
+pub fn generate_organization_api_key_login_claims(uuid: String, org_id: String) -> OrgApiKeyLoginJwtClaims {
    let time_now = Utc::now();
    OrgApiKeyLoginJwtClaims {
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_hours(1).unwrap()).timestamp(),
        iss: JWT_ORG_API_KEY_ISSUER.to_string(),
-        sub: org_api_key_uuid,
-        client_id: format!("organization.{}", org_id),
+        sub: uuid,
+        client_id: format!("organization.{org_id}"),
        client_sub: org_id,
        scope: vec!["api.organization".into()],
    }
@@ -299,18 +292,18 @@ pub struct FileDownloadClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: CipherId,
+    pub sub: String,

-    pub file_id: AttachmentId,
+    pub file_id: String,
 }

-pub fn generate_file_download_claims(cipher_id: CipherId, file_id: AttachmentId) -> FileDownloadClaims {
+pub fn generate_file_download_claims(uuid: String, file_id: String) -> FileDownloadClaims {
    let time_now = Utc::now();
    FileDownloadClaims {
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
        iss: JWT_FILE_DOWNLOAD_ISSUER.to_string(),
-        sub: cipher_id,
+        sub: uuid,
        file_id,
    }
 }
@@ -338,14 +331,14 @@ pub fn generate_delete_claims(uuid: String) -> BasicJwtClaims {
    }
 }

-pub fn generate_verify_email_claims(user_id: UserId) -> BasicJwtClaims {
+pub fn generate_verify_email_claims(uuid: String) -> BasicJwtClaims {
    let time_now = Utc::now();
    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
    BasicJwtClaims {
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
        iss: JWT_VERIFYEMAIL_ISSUER.to_string(),
-        sub: user_id.to_string(),
+        sub: uuid,
    }
 }

@@ -359,7 +352,7 @@ pub fn generate_admin_claims() -> BasicJwtClaims {
    }
 }

-pub fn generate_send_claims(send_id: &SendId, file_id: &SendFileId) -> BasicJwtClaims {
+pub fn generate_send_claims(send_id: &str, file_id: &str) -> BasicJwtClaims {
    let time_now = Utc::now();
    BasicJwtClaims {
        nbf: time_now.timestamp(),
@@ -378,7 +371,7 @@ use rocket::{
 };

 use crate::db::{
-    models::{Collection, Device, Membership, MembershipStatus, MembershipType, User, UserStampException},
+    models::{Collection, Device, User, UserOrgStatus, UserOrgType, UserOrganization, UserStampException},
    DbConn,
 };

@@ -478,32 +471,36 @@ impl<'r> FromRequest<'r> for Headers {
        };

        // Check JWT token is valid and get device and user from it
-        let Ok(claims) = decode_login(access_token) else {
-            err_handler!("Invalid claim")
+        let claims = match decode_login(access_token) {
+            Ok(claims) => claims,
+            Err(_) => err_handler!("Invalid claim"),
        };

-        let device_id = claims.device;
-        let user_id = claims.sub;
+        let device_uuid = claims.device;
+        let user_uuid = claims.sub;

        let mut conn = match DbConn::from_request(request).await {
            Outcome::Success(conn) => conn,
            _ => err_handler!("Error getting DB"),
        };

-        let Some(device) = Device::find_by_uuid_and_user(&device_id, &user_id, &mut conn).await else {
-            err_handler!("Invalid device id")
+        let device = match Device::find_by_uuid_and_user(&device_uuid, &user_uuid, &mut conn).await {
+            Some(device) => device,
+            None => err_handler!("Invalid device id"),
        };

-        let Some(user) = User::find_by_uuid(&user_id, &mut conn).await else {
-            err_handler!("Device has no user associated")
+        let user = match User::find_by_uuid(&user_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err_handler!("Device has no user associated"),
        };

        if user.security_stamp != claims.sstamp {
            if let Some(stamp_exception) =
                user.stamp_exception.as_deref().and_then(|s| serde_json::from_str::<UserStampException>(s).ok())
            {
-                let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                    err_handler!("Error getting current route for stamp exception")
+                let current_route = match request.route().and_then(|r| r.name.as_deref()) {
+                    Some(name) => name,
+                    _ => err_handler!("Error getting current route for stamp exception"),
                };

                // Check if the stamp exception has expired first.
@@ -541,8 +538,8 @@ pub struct OrgHeaders {
    pub host: String,
    pub device: Device,
    pub user: User,
-    pub membership_type: MembershipType,
-    pub membership: Membership,
+    pub org_user_type: UserOrgType,
+    pub org_user: UserOrganization,
    pub ip: ClientIp,
 }

@@ -556,28 +553,35 @@ impl<'r> FromRequest<'r> for OrgHeaders {
        // org_id is usually the second path param ("/organizations/<org_id>"),
        // but there are cases where it is a query value.
        // First check the path, if this is not a valid uuid, try the query values.
-        let url_org_id: Option<OrganizationId> = {
-            if let Some(Ok(org_id)) = request.param::<OrganizationId>(1) {
-                Some(org_id.clone())
-            } else if let Some(Ok(org_id)) = request.query_value::<OrganizationId>("organizationId") {
-                Some(org_id.clone())
-            } else {
-                None
+        let url_org_id: Option<&str> = {
+            let mut url_org_id = None;
+            if let Some(Ok(org_id)) = request.param::<&str>(1) {
+                if uuid::Uuid::parse_str(org_id).is_ok() {
+                    url_org_id = Some(org_id);
+                }
            }
+
+            if let Some(Ok(org_id)) = request.query_value::<&str>("organizationId") {
+                if uuid::Uuid::parse_str(org_id).is_ok() {
+                    url_org_id = Some(org_id);
+                }
+            }
+
+            url_org_id
        };

        match url_org_id {
-            Some(org_id) if uuid::Uuid::parse_str(&org_id).is_ok() => {
+            Some(org_id) => {
                let mut conn = match DbConn::from_request(request).await {
                    Outcome::Success(conn) => conn,
                    _ => err_handler!("Error getting DB"),
                };

                let user = headers.user;
-                let membership = match Membership::find_by_user_and_org(&user.uuid, &org_id, &mut conn).await {
-                    Some(member) => {
-                        if member.status == MembershipStatus::Confirmed as i32 {
-                            member
+                let org_user = match UserOrganization::find_by_user_and_org(&user.uuid, org_id, &mut conn).await {
+                    Some(user) => {
+                        if user.status == UserOrgStatus::Confirmed as i32 {
+                            user
                        } else {
                            err_handler!("The current user isn't confirmed member of the organization")
                        }
@@ -589,15 +593,15 @@ impl<'r> FromRequest<'r> for OrgHeaders {
                    host: headers.host,
                    device: headers.device,
                    user,
-                    membership_type: {
-                        if let Some(org_usr_type) = MembershipType::from_i32(membership.atype) {
+                    org_user_type: {
+                        if let Some(org_usr_type) = UserOrgType::from_i32(org_user.atype) {
                            org_usr_type
                        } else {
                            // This should only happen if the DB is corrupted
                            err_handler!("Unknown user type in the database")
                        }
                    },
-                    membership,
+                    org_user,
                    ip: headers.ip,
                })
            }
@@ -610,9 +614,9 @@ pub struct AdminHeaders {
    pub host: String,
    pub device: Device,
    pub user: User,
-    pub membership_type: MembershipType,
+    pub org_user_type: UserOrgType,
+    pub client_version: Option<String>,
    pub ip: ClientIp,
-    pub org_id: OrganizationId,
 }

 #[rocket::async_trait]
@@ -621,14 +625,15 @@ impl<'r> FromRequest<'r> for AdminHeaders {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.membership_type >= MembershipType::Admin {
+        let client_version = request.headers().get_one("Bitwarden-Client-Version").map(String::from);
+        if headers.org_user_type >= UserOrgType::Admin {
            Outcome::Success(Self {
                host: headers.host,
                device: headers.device,
                user: headers.user,
-                membership_type: headers.membership_type,
+                org_user_type: headers.org_user_type,
+                client_version,
                ip: headers.ip,
-                org_id: headers.membership.org_uuid,
            })
        } else {
            err_handler!("You need to be Admin or Owner to call this endpoint")
@@ -650,16 +655,16 @@ impl From<AdminHeaders> for Headers {
 // col_id is usually the fourth path param ("/organizations/<org_id>/collections/<col_id>"),
 // but there could be cases where it is a query value.
 // First check the path, if this is not a valid uuid, try the query values.
-fn get_col_id(request: &Request<'_>) -> Option<CollectionId> {
+fn get_col_id(request: &Request<'_>) -> Option<String> {
    if let Some(Ok(col_id)) = request.param::<String>(3) {
        if uuid::Uuid::parse_str(&col_id).is_ok() {
-            return Some(col_id.into());
+            return Some(col_id);
        }
    }

    if let Some(Ok(col_id)) = request.query_value::<String>("collectionId") {
        if uuid::Uuid::parse_str(&col_id).is_ok() {
-            return Some(col_id.into());
+            return Some(col_id);
        }
    }

@@ -674,7 +679,6 @@ pub struct ManagerHeaders {
    pub device: Device,
    pub user: User,
    pub ip: ClientIp,
-    pub org_id: OrganizationId,
 }

 #[rocket::async_trait]
@@ -683,7 +687,7 @@ impl<'r> FromRequest<'r> for ManagerHeaders {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.membership_type >= MembershipType::Manager {
+        if headers.org_user_type >= UserOrgType::Manager {
            match get_col_id(request) {
                Some(col_id) => {
                    let mut conn = match DbConn::from_request(request).await {
@@ -691,7 +695,7 @@ impl<'r> FromRequest<'r> for ManagerHeaders {
                        _ => err_handler!("Error getting DB"),
                    };

-                    if !Collection::can_access_collection(&headers.membership, &col_id, &mut conn).await {
+                    if !Collection::can_access_collection(&headers.org_user, &col_id, &mut conn).await {
                        err_handler!("The current user isn't a manager for this collection")
                    }
                }
@@ -703,7 +707,6 @@ impl<'r> FromRequest<'r> for ManagerHeaders {
                device: headers.device,
                user: headers.user,
                ip: headers.ip,
-                org_id: headers.membership.org_uuid,
            })
        } else {
            err_handler!("You need to be a Manager, Admin or Owner to call this endpoint")
@@ -728,7 +731,7 @@ pub struct ManagerHeadersLoose {
    pub host: String,
    pub device: Device,
    pub user: User,
-    pub membership: Membership,
+    pub org_user: UserOrganization,
    pub ip: ClientIp,
 }

@@ -738,12 +741,12 @@ impl<'r> FromRequest<'r> for ManagerHeadersLoose {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.membership_type >= MembershipType::Manager {
+        if headers.org_user_type >= UserOrgType::Manager {
            Outcome::Success(Self {
                host: headers.host,
                device: headers.device,
                user: headers.user,
-                membership: headers.membership,
+                org_user: headers.org_user,
                ip: headers.ip,
            })
        } else {
@@ -766,14 +769,14 @@ impl From<ManagerHeadersLoose> for Headers {
 impl ManagerHeaders {
    pub async fn from_loose(
        h: ManagerHeadersLoose,
-        collections: &Vec<CollectionId>,
+        collections: &Vec<String>,
        conn: &mut DbConn,
    ) -> Result<ManagerHeaders, Error> {
        for col_id in collections {
-            if uuid::Uuid::parse_str(col_id.as_ref()).is_err() {
+            if uuid::Uuid::parse_str(col_id).is_err() {
                err!("Collection Id is malformed!");
            }
-            if !Collection::can_access_collection(&h.membership, col_id, conn).await {
+            if !Collection::can_access_collection(&h.org_user, col_id, conn).await {
                err!("You don't have access to all collections!");
            }
        }
@@ -783,7 +786,6 @@ impl ManagerHeaders {
            device: h.device,
            user: h.user,
            ip: h.ip,
-            org_id: h.membership.org_uuid,
        })
    }
 }
@@ -792,7 +794,6 @@ pub struct OwnerHeaders {
    pub device: Device,
    pub user: User,
    pub ip: ClientIp,
-    pub org_id: OrganizationId,
 }

 #[rocket::async_trait]
@@ -801,12 +802,11 @@ impl<'r> FromRequest<'r> for OwnerHeaders {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.membership_type == MembershipType::Owner {
+        if headers.org_user_type == UserOrgType::Owner {
            Outcome::Success(Self {
                device: headers.device,
                user: headers.user,
                ip: headers.ip,
-                org_id: headers.membership.org_uuid,
            })
        } else {
            err_handler!("You need to be Owner to call this endpoint")
@@ -814,30 +814,6 @@ impl<'r> FromRequest<'r> for OwnerHeaders {
    }
 }

-pub struct OrgMemberHeaders {
-    pub host: String,
-    pub user: User,
-    pub org_id: OrganizationId,
-}
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for OrgMemberHeaders {
-    type Error = &'static str;
-
-    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.membership_type >= MembershipType::User {
-            Outcome::Success(Self {
-                host: headers.host,
-                user: headers.user,
-                org_id: headers.membership.org_uuid,
-            })
-        } else {
-            err_handler!("You need to be a Member of the Organization to call this endpoint")
-        }
-    }
-}
-
 //
 // Client IP address detection
 //
@@ -924,24 +900,3 @@ impl<'r> FromRequest<'r> for WsAccessTokenHeader {
        })
    }
 }
-
-pub struct ClientVersion(pub semver::Version);
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for ClientVersion {
-    type Error = &'static str;
-
-    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let headers = request.headers();
-
-        let Some(version) = headers.get_one("Bitwarden-Client-Version") else {
-            err_handler!("No Bitwarden-Client-Version header provided")
-        };
-
-        let Ok(version) = semver::Version::parse(version) else {
-            err_handler!("Invalid Bitwarden-Client-Version header provided")
-        };
-
-        Outcome::Success(ClientVersion(version))
-    }
-}
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,10 +1,8 @@
-use std::{
-    env::consts::EXE_SUFFIX,
-    process::exit,
-    sync::{
-        atomic::{AtomicBool, Ordering},
-        RwLock,
-    },
+use std::env::consts::EXE_SUFFIX;
+use std::process::exit;
+use std::sync::{
+    atomic::{AtomicBool, Ordering},
+    RwLock,
 };

 use job_scheduler_ng::Schedule;
@@ -14,7 +12,7 @@ use reqwest::Url;
 use crate::{
    db::DbConnType,
    error::Error,
-    util::{get_env, get_env_bool, get_web_vault_version, is_valid_email, parse_experimental_client_feature_flags},
+    util::{get_env, get_env_bool, parse_experimental_client_feature_flags},
 };

 static CONFIG_FILE: Lazy<String> = Lazy::new(|| {
@@ -116,14 +114,6 @@ macro_rules! make_config {
                serde_json::from_str(&config_str).map_err(Into::into)
            }

-            fn clear_non_editable(&mut self) {
-                $($(
-                    if !$editable {
-                        self.$name = None;
-                    }
-                )+)+
-            }
-
            /// Merges the values of both builders into a new builder.
            /// If both have the same element, `other` wins.
            fn merge(&self, other: &Self, show_overrides: bool, overrides: &mut Vec<String>) -> Self {
@@ -248,7 +238,6 @@ macro_rules! make_config {
                // Besides Pass, only String types will be masked via _privacy_mask.
                const PRIVACY_CONFIG: &[&str] = &[
                    "allowed_iframe_ancestors",
-                    "allowed_connect_src",
                    "database_url",
                    "domain_origin",
                    "domain_path",
@@ -259,7 +248,6 @@ macro_rules! make_config {
                    "smtp_from",
                    "smtp_host",
                    "smtp_username",
-                    "_smtp_img_src",
                ];

                let cfg = {
@@ -509,11 +497,11 @@ make_config! {
        /// Password iterations |> Number of server-side passwords hashing iterations for the password hash.
        /// The default for new users. If changed, it will be updated during login for existing users.
        password_iterations:    i32,    true,   def,    600_000;
-        /// Allow password hints |> Controls whether users can set or show password hints. This setting applies globally to all users.
+        /// Allow password hints |> Controls whether users can set password hints. This setting applies globally to all users.
        password_hints_allowed: bool,   true,   def,    true;
-        /// Show password hint (Know the risks!) |> Controls whether a password hint should be shown directly in the web page
-        /// if SMTP service is not configured and password hints are allowed. Not recommended for publicly-accessible instances
-        /// because this provides unauthenticated access to potentially sensitive data.
+        /// Show password hint |> Controls whether a password hint should be shown directly in the web page
+        /// if SMTP service is not configured. Not recommended for publicly-accessible instances as this
+        /// provides unauthenticated access to potentially sensitive data.
        show_password_hint:     bool,   true,   def,    false;

        /// Admin token/Argon2 PHC |> The plain text token or Argon2 PHC string used to authenticate in this very same page. Changing it here will not deauthorize the current session!
@@ -621,9 +609,6 @@ make_config! {
        /// Allowed iframe ancestors (Know the risks!) |> Allows other domains to embed the web vault into an iframe, useful for embedding into secure intranets
        allowed_iframe_ancestors: String, true, def,    String::new();

-        /// Allowed connect-src (Know the risks!) |> Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
-        allowed_connect_src:      String, true, def,    String::new();
-
        /// Seconds between login requests |> Number of seconds, on average, between login and 2FA requests from the same IP address before rate limiting kicks in
        login_ratelimit_seconds:       u64, false, def, 60;
        /// Max burst size for login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `login_ratelimit_seconds`. Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2
@@ -687,7 +672,7 @@ make_config! {
        /// Use Sendmail |> Whether to send mail via the `sendmail` command
        use_sendmail:                  bool,   true,   def,     false;
        /// Sendmail Command |> Which sendmail command to use. The one found in the $PATH is used if not specified.
-        sendmail_command:              String, false,  option;
+        sendmail_command:              String, true,   option;
        /// Host
        smtp_host:                     String, true,   option;
        /// DEPRECATED smtp_ssl |> DEPRECATED - Please use SMTP_SECURITY
@@ -775,13 +760,6 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
        );
    }

-    let connect_src = cfg.allowed_connect_src.to_lowercase();
-    for url in connect_src.split_whitespace() {
-        if !url.starts_with("https://") || Url::parse(url).is_err() {
-            err!("ALLOWED_CONNECT_SRC variable contains one or more invalid URLs. Only FQDN's starting with https are allowed");
-        }
-    }
-
    let whitelist = &cfg.signups_domains_whitelist;
    if !whitelist.is_empty() && whitelist.split(',').any(|d| d.trim().is_empty()) {
        err!("`SIGNUPS_DOMAINS_WHITELIST` contains empty tokens");
@@ -833,16 +811,8 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
    }

    // TODO: deal with deprecated flags so they can be removed from this list, cf. #4263
-    const KNOWN_FLAGS: &[&str] = &[
-        "autofill-overlay",
-        "autofill-v2",
-        "browser-fileless-import",
-        "extension-refresh",
-        "fido2-vault-credentials",
-        "inline-menu-positioning-improvements",
-        "ssh-key-vault-item",
-        "ssh-agent",
-    ];
+    const KNOWN_FLAGS: &[&str] =
+        &["autofill-overlay", "autofill-v2", "browser-fileless-import", "extension-refresh", "fido2-vault-credentials"];
    let configured_flags = parse_experimental_client_feature_flags(&cfg.experimental_client_feature_flags);
    let invalid_flags: Vec<_> = configured_flags.keys().filter(|flag| !KNOWN_FLAGS.contains(&flag.as_str())).collect();
    if !invalid_flags.is_empty() {
@@ -903,12 +873,12 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
            let command = cfg.sendmail_command.clone().unwrap_or_else(|| format!("sendmail{EXE_SUFFIX}"));

            let mut path = std::path::PathBuf::from(&command);
-            // Check if we can find the sendmail command to execute when no absolute path is given
+
            if !path.is_absolute() {
-                let Ok(which_path) = which::which(&command) else {
-                    err!(format!("sendmail command {command} not found in $PATH"))
-                };
-                path = which_path;
+                match which::which(&command) {
+                    Ok(result) => path = result,
+                    Err(_) => err!(format!("sendmail command {command:?} not found in $PATH")),
+                }
            }

            match path.metadata() {
@@ -942,8 +912,8 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
            }
        }

-        if (cfg.smtp_host.is_some() || cfg.use_sendmail) && !is_valid_email(&cfg.smtp_from) {
-            err!(format!("SMTP_FROM '{}' is not a valid email address", cfg.smtp_from))
+        if (cfg.smtp_host.is_some() || cfg.use_sendmail) && !cfg.smtp_from.contains('@') {
+            err!("SMTP_FROM does not contain a mandatory @ sign")
        }

        if cfg._enable_email_2fa && cfg.email_token_size < 6 {
@@ -1156,17 +1126,12 @@ impl Config {
        })
    }

-    pub fn update_config(&self, other: ConfigBuilder, ignore_non_editable: bool) -> Result<(), Error> {
+    pub fn update_config(&self, other: ConfigBuilder) -> Result<(), Error> {
        // Remove default values
        //let builder = other.remove(&self.inner.read().unwrap()._env);

        // TODO: Remove values that are defaults, above only checks those set by env and not the defaults
-        let mut builder = other;
-
-        // Remove values that are not editable
-        if ignore_non_editable {
-            builder.clear_non_editable();
-        }
+        let builder = other;

        // Serialize now before we consume the builder
        let config_str = serde_json::to_string_pretty(&builder)?;
@@ -1201,7 +1166,7 @@ impl Config {
            let mut _overrides = Vec::new();
            usr.merge(&other, false, &mut _overrides)
        };
-        self.update_config(builder, false)
+        self.update_config(builder)
    }

    /// Tests whether an email's domain is allowed. A domain is allowed if it
@@ -1304,16 +1269,11 @@ impl Config {
            let hb = load_templates(CONFIG.templates_folder());
            hb.render(name, data).map_err(Into::into)
        } else {
-            let hb = &self.inner.read().unwrap().templates;
+            let hb = &CONFIG.inner.read().unwrap().templates;
            hb.render(name, data).map_err(Into::into)
        }
    }

-    pub fn render_fallback_template<T: serde::ser::Serialize>(&self, name: &str, data: &T) -> Result<String, Error> {
-        let hb = &self.inner.read().unwrap().templates;
-        hb.render(&format!("fallback_{name}"), data).map_err(Into::into)
-    }
-
    pub fn set_rocket_shutdown_handle(&self, handle: rocket::Shutdown) {
        self.inner.write().unwrap().rocket_shutdown_handle = Some(handle);
    }
@@ -1342,8 +1302,6 @@ where
    // Register helpers
    hb.register_helper("case", Box::new(case_helper));
    hb.register_helper("to_json", Box::new(to_json));
-    hb.register_helper("webver", Box::new(webver));
-    hb.register_helper("vwver", Box::new(vwver));

    macro_rules! reg {
        ($name:expr) => {{
@@ -1354,11 +1312,6 @@ where
            reg!($name);
            reg!(concat!($name, $ext));
        }};
-        (@withfallback $name:expr) => {{
-            let template = include_str!(concat!("static/templates/", $name, ".hbs"));
-            hb.register_template_string($name, template).unwrap();
-            hb.register_template_string(concat!("fallback_", $name), template).unwrap();
-        }};
    }

    // First register default templates here
@@ -1402,9 +1355,6 @@ where

    reg!("404");

-    reg!(@withfallback "scss/vaultwarden.scss");
-    reg!("scss/user.vaultwarden.scss");
-
    // And then load user templates to overwrite the defaults
    // Use .hbs extension for the files
    // Templates get registered with their relative name
@@ -1447,42 +1397,3 @@ fn to_json<'reg, 'rc>(
    out.write(&json)?;
    Ok(())
 }
-
-// Configure the web-vault version as an integer so it can be used as a comparison smaller or greater then.
-// The default is based upon the version since this feature is added.
-static WEB_VAULT_VERSION: Lazy<semver::Version> = Lazy::new(|| {
-    let vault_version = get_web_vault_version();
-    // Use a single regex capture to extract version components
-    let re = regex::Regex::new(r"(\d{4})\.(\d{1,2})\.(\d{1,2})").unwrap();
-    re.captures(&vault_version)
-        .and_then(|c| {
-            (c.len() == 4).then(|| {
-                format!("{}.{}.{}", c.get(1).unwrap().as_str(), c.get(2).unwrap().as_str(), c.get(3).unwrap().as_str())
-            })
-        })
-        .and_then(|v| semver::Version::parse(&v).ok())
-        .unwrap_or_else(|| semver::Version::parse("2024.6.2").unwrap())
-});
-
-// Configure the Vaultwarden version as an integer so it can be used as a comparison smaller or greater then.
-// The default is based upon the version since this feature is added.
-static VW_VERSION: Lazy<semver::Version> = Lazy::new(|| {
-    let vw_version = crate::VERSION.unwrap_or("1.32.5");
-    // Use a single regex capture to extract version components
-    let re = regex::Regex::new(r"(\d{1})\.(\d{1,2})\.(\d{1,2})").unwrap();
-    re.captures(vw_version)
-        .and_then(|c| {
-            (c.len() == 4).then(|| {
-                format!("{}.{}.{}", c.get(1).unwrap().as_str(), c.get(2).unwrap().as_str(), c.get(3).unwrap().as_str())
-            })
-        })
-        .and_then(|v| semver::Version::parse(&v).ok())
-        .unwrap_or_else(|| semver::Version::parse("1.32.5").unwrap())
-});
-
-handlebars::handlebars_helper!(webver: | web_vault_version: String |
-    semver::VersionReq::parse(&web_vault_version).expect("Invalid web-vault version compare string").matches(&WEB_VAULT_VERSION)
-);
-handlebars::handlebars_helper!(vwver: | vw_version: String |
-    semver::VersionReq::parse(&vw_version).expect("Invalid Vaultwarden version compare string").matches(&VW_VERSION)
-);
--- a/src/crypto.rs
+++ b/src/crypto.rs
@@ -6,7 +6,7 @@ use std::num::NonZeroU32;
 use data_encoding::{Encoding, HEXLOWER};
 use ring::{digest, hmac, pbkdf2};

-const DIGEST_ALG: pbkdf2::Algorithm = pbkdf2::PBKDF2_HMAC_SHA256;
+static DIGEST_ALG: pbkdf2::Algorithm = pbkdf2::PBKDF2_HMAC_SHA256;
 const OUTPUT_LEN: usize = digest::SHA256_OUTPUT_LEN;

 pub fn hash_password(secret: &[u8], salt: &[u8], iterations: u32) -> Vec<u8> {
@@ -84,15 +84,14 @@ pub fn generate_id<const N: usize>() -> String {
    encode_random_bytes::<N>(HEXLOWER)
 }

-pub fn generate_send_file_id() -> String {
-    // Send File IDs are globally scoped, so make them longer to avoid collisions.
+pub fn generate_send_id() -> String {
+    // Send IDs are globally scoped, so make them longer to avoid collisions.
    generate_id::<32>() // 256 bits
 }

-use crate::db::models::AttachmentId;
-pub fn generate_attachment_id() -> AttachmentId {
+pub fn generate_attachment_id() -> String {
    // Attachment IDs are scoped to a cipher, so they can be smaller.
-    AttachmentId(generate_id::<10>()) // 80 bits
+    generate_id::<10>() // 80 bits
 }

 /// Generates a numeric token for email-based verifications.
--- a/src/db/mod.rs
+++ b/src/db/mod.rs
@@ -373,18 +373,24 @@ pub async fn backup_database(conn: &mut DbConn) -> Result<String, Error> {
            err!("PostgreSQL and MySQL/MariaDB do not support this backup feature");
        }
        sqlite {
-            let db_url = CONFIG.database_url();
-            let db_path = std::path::Path::new(&db_url).parent().unwrap();
-            let backup_file = db_path
-                .join(format!("db_{}.sqlite3", chrono::Utc::now().format("%Y%m%d_%H%M%S")))
-                .to_string_lossy()
-                .into_owned();
-            diesel::sql_query(format!("VACUUM INTO '{backup_file}'")).execute(conn)?;
-            Ok(backup_file)
+            backup_sqlite_database(conn)
        }
    }
 }

+#[cfg(sqlite)]
+pub fn backup_sqlite_database(conn: &mut diesel::sqlite::SqliteConnection) -> Result<String, Error> {
+    use diesel::RunQueryDsl;
+    let db_url = CONFIG.database_url();
+    let db_path = std::path::Path::new(&db_url).parent().unwrap();
+    let backup_file = db_path
+        .join(format!("db_{}.sqlite3", chrono::Utc::now().format("%Y%m%d_%H%M%S")))
+        .to_string_lossy()
+        .into_owned();
+    diesel::sql_query(format!("VACUUM INTO '{backup_file}'")).execute(conn)?;
+    Ok(backup_file)
+}
+
 /// Get the SQL Server version
 pub async fn get_sql_server_version(conn: &mut DbConn) -> String {
    db_run! {@raw conn:
--- a/src/db/models/attachment.rs
+++ b/src/db/models/attachment.rs
@@ -1,12 +1,9 @@
 use std::io::ErrorKind;

 use bigdecimal::{BigDecimal, ToPrimitive};
-use derive_more::{AsRef, Deref, Display};
 use serde_json::Value;

-use super::{CipherId, OrganizationId, UserId};
 use crate::CONFIG;
-use macros::IdFromParam;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -14,8 +11,8 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(id))]
    pub struct Attachment {
-        pub id: AttachmentId,
-        pub cipher_uuid: CipherId,
+        pub id: String,
+        pub cipher_uuid: String,
        pub file_name: String, // encrypted
        pub file_size: i64,
        pub akey: Option<String>,
@@ -24,13 +21,7 @@ db_object! {

 /// Local methods
 impl Attachment {
-    pub const fn new(
-        id: AttachmentId,
-        cipher_uuid: CipherId,
-        file_name: String,
-        file_size: i64,
-        akey: Option<String>,
-    ) -> Self {
+    pub const fn new(id: String, cipher_uuid: String, file_name: String, file_size: i64, akey: Option<String>) -> Self {
        Self {
            id,
            cipher_uuid,
@@ -126,14 +117,14 @@ impl Attachment {
        }}
    }

-    pub async fn delete_all_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for attachment in Attachment::find_by_cipher(cipher_uuid, conn).await {
            attachment.delete(conn).await?;
        }
        Ok(())
    }

-    pub async fn find_by_id(id: &AttachmentId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_id(id: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            attachments::table
                .filter(attachments::id.eq(id.to_lowercase()))
@@ -143,7 +134,7 @@ impl Attachment {
        }}
    }

-    pub async fn find_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            attachments::table
                .filter(attachments::cipher_uuid.eq(cipher_uuid))
@@ -153,7 +144,7 @@ impl Attachment {
        }}
    }

-    pub async fn size_by_user(user_uuid: &UserId, conn: &mut DbConn) -> i64 {
+    pub async fn size_by_user(user_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            let result: Option<BigDecimal> = attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -170,7 +161,7 @@ impl Attachment {
        }}
    }

-    pub async fn count_by_user(user_uuid: &UserId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_user(user_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -181,7 +172,7 @@ impl Attachment {
        }}
    }

-    pub async fn size_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn size_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            let result: Option<BigDecimal> = attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -198,7 +189,7 @@ impl Attachment {
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -212,11 +203,7 @@ impl Attachment {
    // This will return all attachments linked to the user or org
    // There is no filtering done here if the user actually has access!
    // It is used to speed up the sync process, and the matching is done in a different part.
-    pub async fn find_all_by_user_and_orgs(
-        user_uuid: &UserId,
-        org_uuids: &Vec<OrganizationId>,
-        conn: &mut DbConn,
-    ) -> Vec<Self> {
+    pub async fn find_all_by_user_and_orgs(user_uuid: &str, org_uuids: &Vec<String>, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -229,20 +216,3 @@ impl Attachment {
        }}
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    IdFromParam,
-)]
-pub struct AttachmentId(pub String);
--- a/src/db/models/auth_request.rs
+++ b/src/db/models/auth_request.rs
@@ -1,9 +1,5 @@
-use super::{DeviceId, OrganizationId, UserId};
-use crate::{crypto::ct_eq, util::format_date};
+use crate::crypto::ct_eq;
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{AsRef, Deref, Display, From};
-use macros::UuidFromParam;
-use serde_json::Value;

 db_object! {
    #[derive(Debug, Identifiable, Queryable, Insertable, AsChangeset, Deserialize, Serialize)]
@@ -11,15 +7,15 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct AuthRequest {
-        pub uuid: AuthRequestId,
-        pub user_uuid: UserId,
-        pub organization_uuid: Option<OrganizationId>,
+        pub uuid: String,
+        pub user_uuid: String,
+        pub organization_uuid: Option<String>,

-        pub request_device_identifier: DeviceId,
+        pub request_device_identifier: String,
        pub device_type: i32,  // https://github.com/bitwarden/server/blob/master/src/Core/Enums/DeviceType.cs

        pub request_ip: String,
-        pub response_device_id: Option<DeviceId>,
+        pub response_device_id: Option<String>,

        pub access_code: String,
        pub public_key: String,
@@ -37,8 +33,8 @@ db_object! {

 impl AuthRequest {
    pub fn new(
-        user_uuid: UserId,
-        request_device_identifier: DeviceId,
+        user_uuid: String,
+        request_device_identifier: String,
        device_type: i32,
        request_ip: String,
        access_code: String,
@@ -47,7 +43,7 @@ impl AuthRequest {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: AuthRequestId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            user_uuid,
            organization_uuid: None,

@@ -65,13 +61,6 @@ impl AuthRequest {
            authentication_date: None,
        }
    }
-
-    pub fn to_json_for_pending_device(&self) -> Value {
-        json!({
-            "id": self.uuid,
-            "creationDate": format_date(&self.creation_date),
-        })
-    }
 }

 use crate::db::DbConn;
@@ -112,7 +101,7 @@ impl AuthRequest {
        }
    }

-    pub async fn find_by_uuid(uuid: &AuthRequestId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            auth_requests::table
                .filter(auth_requests::uuid.eq(uuid))
@@ -122,18 +111,7 @@ impl AuthRequest {
        }}
    }

-    pub async fn find_by_uuid_and_user(uuid: &AuthRequestId, user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
-        db_run! {conn: {
-            auth_requests::table
-                .filter(auth_requests::uuid.eq(uuid))
-                .filter(auth_requests::user_uuid.eq(user_uuid))
-                .first::<AuthRequestDb>(conn)
-                .ok()
-                .from_db()
-        }}
-    }
-
-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            auth_requests::table
                .filter(auth_requests::user_uuid.eq(user_uuid))
@@ -141,20 +119,6 @@ impl AuthRequest {
        }}
    }

-    pub async fn find_by_user_and_requested_device(
-        user_uuid: &UserId,
-        device_uuid: &DeviceId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
-        db_run! {conn: {
-            auth_requests::table
-                .filter(auth_requests::user_uuid.eq(user_uuid))
-                .filter(auth_requests::request_device_identifier.eq(device_uuid))
-                .order_by(auth_requests::creation_date.desc())
-                .first::<AuthRequestDb>(conn).ok().from_db()
-        }}
-    }
-
    pub async fn find_created_before(dt: &NaiveDateTime, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            auth_requests::table
@@ -182,21 +146,3 @@ impl AuthRequest {
        }
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct AuthRequestId(String);
--- a/src/db/models/cipher.rs
+++ b/src/db/models/cipher.rs
@@ -1,15 +1,13 @@
 use crate::util::LowerCase;
 use crate::CONFIG;
-use chrono::{NaiveDateTime, TimeDelta, Utc};
-use derive_more::{AsRef, Deref, Display, From};
+use chrono::{DateTime, NaiveDateTime, TimeDelta, Utc};
 use serde_json::Value;

 use super::{
-    Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership, MembershipStatus,
-    MembershipType, OrganizationId, User, UserId,
+    Attachment, CollectionCipher, Favorite, FolderCipher, Group, User, UserOrgStatus, UserOrgType, UserOrganization,
 };
+
 use crate::api::core::{CipherData, CipherSyncData, CipherSyncType};
-use macros::UuidFromParam;

 use std::borrow::Cow;

@@ -19,12 +17,12 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct Cipher {
-        pub uuid: CipherId,
+        pub uuid: String,
        pub created_at: NaiveDateTime,
        pub updated_at: NaiveDateTime,

-        pub user_uuid: Option<UserId>,
-        pub organization_uuid: Option<OrganizationId>,
+        pub user_uuid: Option<String>,
+        pub organization_uuid: Option<String>,

        pub key: Option<String>,

@@ -32,8 +30,7 @@ db_object! {
        Login = 1,
        SecureNote = 2,
        Card = 3,
-        Identity = 4,
-        SshKey = 5
+        Identity = 4
        */
        pub atype: i32,
        pub name: String,
@@ -48,9 +45,10 @@ db_object! {
    }
 }

+#[allow(dead_code)]
 pub enum RepromptType {
    None = 0,
-    Password = 1,
+    Password = 1, // not currently used in server
 }

 /// Local methods
@@ -59,7 +57,7 @@ impl Cipher {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: CipherId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            created_at: now,
            updated_at: now,

@@ -137,7 +135,7 @@ impl Cipher {
    pub async fn to_json(
        &self,
        host: &str,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&CipherSyncData>,
        sync_type: CipherSyncType,
        conn: &mut DbConn,
@@ -158,16 +156,16 @@ impl Cipher {

        // We don't need these values at all for Organizational syncs
        // Skip any other database calls if this is the case and just return false.
-        let (read_only, hide_passwords, _) = if sync_type == CipherSyncType::User {
+        let (read_only, hide_passwords) = if sync_type == CipherSyncType::User {
            match self.get_access_restrictions(user_uuid, cipher_sync_data, conn).await {
-                Some((ro, hp, mn)) => (ro, hp, mn),
+                Some((ro, hp)) => (ro, hp),
                None => {
                    error!("Cipher ownership assertion failure");
-                    (true, true, false)
+                    (true, true)
                }
            }
        } else {
-            (false, false, false)
+            (false, false)
        };

        let fields_json: Vec<_> = self
@@ -218,13 +216,11 @@ impl Cipher {
                        Some(p) if p.is_string() => Some(d.data),
                        _ => None,
                    })
-                    .map(|mut d| match d.get("lastUsedDate").and_then(|l| l.as_str()) {
-                        Some(l) => {
-                            d["lastUsedDate"] = json!(crate::util::validate_and_format_date(l));
-                            d
-                        }
+                    .map(|d| match d.get("lastUsedDate").and_then(|l| l.as_str()) {
+                        Some(l) if DateTime::parse_from_rfc3339(l).is_ok() => d,
                        _ => {
-                            d["lastUsedDate"] = json!("1970-01-01T00:00:00.000000Z");
+                            let mut d = d;
+                            d["lastUsedDate"] = json!("1970-01-01T00:00:00.000Z");
                            d
                        }
                    })
@@ -243,23 +239,12 @@ impl Cipher {
        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
        if self.atype == 1 {
-            // Upstream always has an `uri` key/value
-            type_data_json["uri"] = Value::Null;
-            if let Some(uris) = type_data_json["uris"].as_array_mut() {
-                if !uris.is_empty() {
-                    // Fix uri match values first, they are only allowed to be a number or null
-                    // If it is a string, convert it to an int or null if that fails
-                    for uri in &mut *uris {
-                        if uri["match"].is_string() {
-                            let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
-                                Ok(n) => json!(n),
-                                _ => Value::Null,
-                            };
-                            uri["match"] = match_value;
-                        }
-                    }
-                    type_data_json["uri"] = uris[0]["uri"].clone();
-                }
+            if type_data_json["uris"].is_array() {
+                let uri = type_data_json["uris"][0]["uri"].clone();
+                type_data_json["uri"] = uri;
+            } else {
+                // Upstream always has an Uri key/value
+                type_data_json["uri"] = Value::Null;
            }
        }

@@ -274,19 +259,6 @@ impl Cipher {
            }
        }

-        // Fix invalid SSH Entries
-        // This breaks at least the native mobile client if invalid
-        // The only way to fix this is by setting type_data_json to `null`
-        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
-        if self.atype == 5
-            && (type_data_json["keyFingerprint"].as_str().is_none_or(|v| v.is_empty())
-                || type_data_json["privateKey"].as_str().is_none_or(|v| v.is_empty())
-                || type_data_json["publicKey"].as_str().is_none_or(|v| v.is_empty()))
-        {
-            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
-            type_data_json = Value::Null;
-        }
-
        // Clone the type_data and add some default value.
        let mut data_json = type_data_json.clone();

@@ -304,7 +276,7 @@ impl Cipher {
                Cow::from(Vec::with_capacity(0))
            }
        } else {
-            Cow::from(self.get_admin_collections(user_uuid.clone(), conn).await)
+            Cow::from(self.get_admin_collections(user_uuid.to_string(), conn).await)
        };

        // There are three types of cipher response models in upstream
@@ -321,7 +293,7 @@ impl Cipher {
            "creationDate": format_date(&self.created_at),
            "revisionDate": format_date(&self.updated_at),
            "deletedDate": self.deleted_at.map_or(Value::Null, |d| Value::String(format_date(&d))),
-            "reprompt": self.reprompt.filter(|r| *r == RepromptType::None as i32 || *r == RepromptType::Password as i32).unwrap_or(RepromptType::None as i32),
+            "reprompt": self.reprompt.unwrap_or(RepromptType::None as i32),
            "organizationId": self.organization_uuid,
            "key": self.key,
            "attachments": attachments_json,
@@ -345,7 +317,6 @@ impl Cipher {
            "secureNote": null,
            "card": null,
            "identity": null,
-            "sshKey": null,
        });

        // These values are only needed for user/default syncs
@@ -353,7 +324,7 @@ impl Cipher {
        // Skip adding these fields in that case
        if sync_type == CipherSyncType::User {
            json_object["folderId"] = json!(if let Some(cipher_sync_data) = cipher_sync_data {
-                cipher_sync_data.cipher_folders.get(&self.uuid).cloned()
+                cipher_sync_data.cipher_folders.get(&self.uuid).map(|c| c.to_string())
            } else {
                self.get_folder_uuid(user_uuid, conn).await
            });
@@ -374,7 +345,6 @@ impl Cipher {
            2 => "secureNote",
            3 => "card",
            4 => "identity",
-            5 => "sshKey",
            _ => panic!("Wrong type"),
        };

@@ -382,7 +352,7 @@ impl Cipher {
        json_object
    }

-    pub async fn update_users_revision(&self, conn: &mut DbConn) -> Vec<UserId> {
+    pub async fn update_users_revision(&self, conn: &mut DbConn) -> Vec<String> {
        let mut user_uuids = Vec::new();
        match self.user_uuid {
            Some(ref user_uuid) => {
@@ -393,16 +363,17 @@ impl Cipher {
                // Belongs to Organization, need to update affected users
                if let Some(ref org_uuid) = self.organization_uuid {
                    // users having access to the collection
-                    let mut collection_users = Membership::find_by_cipher_and_org(&self.uuid, org_uuid, conn).await;
+                    let mut collection_users =
+                        UserOrganization::find_by_cipher_and_org(&self.uuid, org_uuid, conn).await;
                    if CONFIG.org_groups_enabled() {
                        // members of a group having access to the collection
                        let group_users =
-                            Membership::find_by_cipher_and_org_with_group(&self.uuid, org_uuid, conn).await;
+                            UserOrganization::find_by_cipher_and_org_with_group(&self.uuid, org_uuid, conn).await;
                        collection_users.extend(group_users);
                    }
-                    for member in collection_users {
-                        User::update_uuid_revision(&member.user_uuid, conn).await;
-                        user_uuids.push(member.user_uuid.clone())
+                    for user_org in collection_users {
+                        User::update_uuid_revision(&user_org.user_uuid, conn).await;
+                        user_uuids.push(user_org.user_uuid.clone())
                    }
                }
            }
@@ -460,7 +431,7 @@ impl Cipher {
        }}
    }

-    pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_organization(org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        // TODO: Optimize this by executing a DELETE directly on the database, instead of first fetching.
        for cipher in Self::find_by_org(org_uuid, conn).await {
            cipher.delete(conn).await?;
@@ -468,7 +439,7 @@ impl Cipher {
        Ok(())
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for cipher in Self::find_owned_by_user(user_uuid, conn).await {
            cipher.delete(conn).await?;
        }
@@ -486,59 +457,52 @@ impl Cipher {
        }
    }

-    pub async fn move_to_folder(
-        &self,
-        folder_uuid: Option<FolderId>,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn move_to_folder(&self, folder_uuid: Option<String>, user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;

        match (self.get_folder_uuid(user_uuid, conn).await, folder_uuid) {
            // No changes
            (None, None) => Ok(()),
-            (Some(ref old_folder), Some(ref new_folder)) if old_folder == new_folder => Ok(()),
+            (Some(ref old), Some(ref new)) if old == new => Ok(()),

            // Add to folder
-            (None, Some(new_folder)) => FolderCipher::new(new_folder, self.uuid.clone()).save(conn).await,
+            (None, Some(new)) => FolderCipher::new(&new, &self.uuid).save(conn).await,

            // Remove from folder
-            (Some(old_folder), None) => {
-                match FolderCipher::find_by_folder_and_cipher(&old_folder, &self.uuid, conn).await {
-                    Some(old_folder) => old_folder.delete(conn).await,
-                    None => err!("Couldn't move from previous folder"),
-                }
-            }
+            (Some(old), None) => match FolderCipher::find_by_folder_and_cipher(&old, &self.uuid, conn).await {
+                Some(old) => old.delete(conn).await,
+                None => err!("Couldn't move from previous folder"),
+            },

            // Move to another folder
-            (Some(old_folder), Some(new_folder)) => {
-                if let Some(old_folder) = FolderCipher::find_by_folder_and_cipher(&old_folder, &self.uuid, conn).await {
-                    old_folder.delete(conn).await?;
+            (Some(old), Some(new)) => {
+                if let Some(old) = FolderCipher::find_by_folder_and_cipher(&old, &self.uuid, conn).await {
+                    old.delete(conn).await?;
                }
-                FolderCipher::new(new_folder, self.uuid.clone()).save(conn).await
+                FolderCipher::new(&new, &self.uuid).save(conn).await
            }
        }
    }

    /// Returns whether this cipher is directly owned by the user.
-    pub fn is_owned_by_user(&self, user_uuid: &UserId) -> bool {
+    pub fn is_owned_by_user(&self, user_uuid: &str) -> bool {
        self.user_uuid.is_some() && self.user_uuid.as_ref().unwrap() == user_uuid
    }

    /// Returns whether this cipher is owned by an org in which the user has full access.
    async fn is_in_full_access_org(
        &self,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&CipherSyncData>,
        conn: &mut DbConn,
    ) -> bool {
        if let Some(ref org_uuid) = self.organization_uuid {
            if let Some(cipher_sync_data) = cipher_sync_data {
-                if let Some(cached_member) = cipher_sync_data.members.get(org_uuid) {
-                    return cached_member.has_full_access();
+                if let Some(cached_user_org) = cipher_sync_data.user_organizations.get(org_uuid) {
+                    return cached_user_org.has_full_access();
                }
-            } else if let Some(member) = Membership::find_by_user_and_org(user_uuid, org_uuid, conn).await {
-                return member.has_full_access();
+            } else if let Some(user_org) = UserOrganization::find_by_user_and_org(user_uuid, org_uuid, conn).await {
+                return user_org.has_full_access();
            }
        }
        false
@@ -547,7 +511,7 @@ impl Cipher {
    /// Returns whether this cipher is owned by an group in which the user has full access.
    async fn is_in_full_access_group(
        &self,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&CipherSyncData>,
        conn: &mut DbConn,
    ) -> bool {
@@ -567,14 +531,14 @@ impl Cipher {
    /// Returns the user's access restrictions to this cipher. A return value
    /// of None means that this cipher does not belong to the user, and is
    /// not in any collection the user has access to. Otherwise, the user has
-    /// access to this cipher, and Some(read_only, hide_passwords, manage) represents
+    /// access to this cipher, and Some(read_only, hide_passwords) represents
    /// the access restrictions.
    pub async fn get_access_restrictions(
        &self,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&CipherSyncData>,
        conn: &mut DbConn,
-    ) -> Option<(bool, bool, bool)> {
+    ) -> Option<(bool, bool)> {
        // Check whether this cipher is directly owned by the user, or is in
        // a collection that the user has full access to. If so, there are no
        // access restrictions.
@@ -582,21 +546,21 @@ impl Cipher {
            || self.is_in_full_access_org(user_uuid, cipher_sync_data, conn).await
            || self.is_in_full_access_group(user_uuid, cipher_sync_data, conn).await
        {
-            return Some((false, false, true));
+            return Some((false, false));
        }

        let rows = if let Some(cipher_sync_data) = cipher_sync_data {
-            let mut rows: Vec<(bool, bool, bool)> = Vec::new();
+            let mut rows: Vec<(bool, bool)> = Vec::new();
            if let Some(collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
                for collection in collections {
                    //User permissions
-                    if let Some(cu) = cipher_sync_data.user_collections.get(collection) {
-                        rows.push((cu.read_only, cu.hide_passwords, cu.manage));
+                    if let Some(uc) = cipher_sync_data.user_collections.get(collection) {
+                        rows.push((uc.read_only, uc.hide_passwords));
                    }

                    //Group permissions
                    if let Some(cg) = cipher_sync_data.user_collections_groups.get(collection) {
-                        rows.push((cg.read_only, cg.hide_passwords, cg.manage));
+                        rows.push((cg.read_only, cg.hide_passwords));
                    }
                }
            }
@@ -623,21 +587,15 @@ impl Cipher {
        // booleans and this behavior isn't portable anyway.
        let mut read_only = true;
        let mut hide_passwords = true;
-        let mut manage = false;
-        for (ro, hp, mn) in rows.iter() {
+        for (ro, hp) in rows.iter() {
            read_only &= ro;
            hide_passwords &= hp;
-            manage &= mn;
        }

-        Some((read_only, hide_passwords, manage))
+        Some((read_only, hide_passwords))
    }

-    async fn get_user_collections_access_flags(
-        &self,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Vec<(bool, bool, bool)> {
+    async fn get_user_collections_access_flags(&self, user_uuid: &str, conn: &mut DbConn) -> Vec<(bool, bool)> {
        db_run! {conn: {
            // Check whether this cipher is in any collections accessible to the
            // user. If so, retrieve the access flags for each collection.
@@ -648,17 +606,13 @@ impl Cipher {
                .inner_join(users_collections::table.on(
                    ciphers_collections::collection_uuid.eq(users_collections::collection_uuid)
                        .and(users_collections::user_uuid.eq(user_uuid))))
-                .select((users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
-                .load::<(bool, bool, bool)>(conn)
+                .select((users_collections::read_only, users_collections::hide_passwords))
+                .load::<(bool, bool)>(conn)
                .expect("Error getting user access restrictions")
        }}
    }

-    async fn get_group_collections_access_flags(
-        &self,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Vec<(bool, bool, bool)> {
+    async fn get_group_collections_access_flags(&self, user_uuid: &str, conn: &mut DbConn) -> Vec<(bool, bool)> {
        if !CONFIG.org_groups_enabled() {
            return Vec::new();
        }
@@ -678,49 +632,49 @@ impl Cipher {
                    users_organizations::uuid.eq(groups_users::users_organizations_uuid)
                ))
                .filter(users_organizations::user_uuid.eq(user_uuid))
-                .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage))
-                .load::<(bool, bool, bool)>(conn)
+                .select((collections_groups::read_only, collections_groups::hide_passwords))
+                .load::<(bool, bool)>(conn)
                .expect("Error getting group access restrictions")
        }}
    }

-    pub async fn is_write_accessible_to_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_write_accessible_to_user(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        match self.get_access_restrictions(user_uuid, None, conn).await {
-            Some((read_only, _hide_passwords, manage)) => !read_only || manage,
+            Some((read_only, _hide_passwords)) => !read_only,
            None => false,
        }
    }

-    pub async fn is_accessible_to_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_accessible_to_user(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        self.get_access_restrictions(user_uuid, None, conn).await.is_some()
    }

    // Returns whether this cipher is a favorite of the specified user.
-    pub async fn is_favorite(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_favorite(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        Favorite::is_favorite(&self.uuid, user_uuid, conn).await
    }

    // Sets whether this cipher is a favorite of the specified user.
-    pub async fn set_favorite(&self, favorite: Option<bool>, user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn set_favorite(&self, favorite: Option<bool>, user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        match favorite {
            None => Ok(()), // No change requested.
            Some(status) => Favorite::set_favorite(status, &self.uuid, user_uuid, conn).await,
        }
    }

-    pub async fn get_folder_uuid(&self, user_uuid: &UserId, conn: &mut DbConn) -> Option<FolderId> {
+    pub async fn get_folder_uuid(&self, user_uuid: &str, conn: &mut DbConn) -> Option<String> {
        db_run! {conn: {
            folders_ciphers::table
                .inner_join(folders::table)
                .filter(folders::user_uuid.eq(&user_uuid))
                .filter(folders_ciphers::cipher_uuid.eq(&self.uuid))
                .select(folders_ciphers::folder_uuid)
-                .first::<FolderId>(conn)
+                .first::<String>(conn)
                .ok()
        }}
    }

-    pub async fn find_by_uuid(uuid: &CipherId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::uuid.eq(uuid))
@@ -730,11 +684,7 @@ impl Cipher {
        }}
    }

-    pub async fn find_by_uuid_and_org(
-        cipher_uuid: &CipherId,
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_org(cipher_uuid: &str, org_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::uuid.eq(cipher_uuid))
@@ -757,7 +707,7 @@ impl Cipher {
    // true, then the non-interesting ciphers will not be returned. As a
    // result, those ciphers will not appear in "My Vault" for the org
    // owner/admin, but they can still be accessed via the org vault view.
-    pub async fn find_by_user(user_uuid: &UserId, visible_only: bool, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, visible_only: bool, conn: &mut DbConn) -> Vec<Self> {
        if CONFIG.org_groups_enabled() {
            db_run! {conn: {
                let mut query = ciphers::table
@@ -767,7 +717,7 @@ impl Cipher {
                    .left_join(users_organizations::table.on(
                            ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable())
                            .and(users_organizations::user_uuid.eq(user_uuid))
-                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
+                            .and(users_organizations::status.eq(UserOrgStatus::Confirmed as i32))
                            ))
                    .left_join(users_collections::table.on(
                            ciphers_collections::collection_uuid.eq(users_collections::collection_uuid)
@@ -794,7 +744,7 @@ impl Cipher {

                if !visible_only {
                    query = query.or_filter(
-                        users_organizations::atype.le(MembershipType::Admin as i32) // Org admin/owner
+                        users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin/owner
                        );
                }

@@ -812,7 +762,7 @@ impl Cipher {
                    .left_join(users_organizations::table.on(
                            ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable())
                            .and(users_organizations::user_uuid.eq(user_uuid))
-                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
+                            .and(users_organizations::status.eq(UserOrgStatus::Confirmed as i32))
                            ))
                    .left_join(users_collections::table.on(
                            ciphers_collections::collection_uuid.eq(users_collections::collection_uuid)
@@ -826,7 +776,7 @@ impl Cipher {

                    if !visible_only {
                        query = query.or_filter(
-                            users_organizations::atype.le(MembershipType::Admin as i32) // Org admin/owner
+                            users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin/owner
                            );
                    }

@@ -839,12 +789,12 @@ impl Cipher {
    }

    // Find all ciphers visible to the specified user.
-    pub async fn find_by_user_visible(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user_visible(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        Self::find_by_user(user_uuid, true, conn).await
    }

    // Find all ciphers directly owned by the specified user.
-    pub async fn find_owned_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_owned_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            ciphers::table
                .filter(
@@ -855,7 +805,7 @@ impl Cipher {
        }}
    }

-    pub async fn count_owned_by_user(user_uuid: &UserId, conn: &mut DbConn) -> i64 {
+    pub async fn count_owned_by_user(user_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::user_uuid.eq(user_uuid))
@@ -866,7 +816,7 @@ impl Cipher {
        }}
    }

-    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_org(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::organization_uuid.eq(org_uuid))
@@ -874,7 +824,7 @@ impl Cipher {
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::organization_uuid.eq(org_uuid))
@@ -885,7 +835,7 @@ impl Cipher {
        }}
    }

-    pub async fn find_by_folder(folder_uuid: &FolderId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_folder(folder_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            folders_ciphers::table.inner_join(ciphers::table)
                .filter(folders_ciphers::folder_uuid.eq(folder_uuid))
@@ -903,7 +853,7 @@ impl Cipher {
        }}
    }

-    pub async fn get_collections(&self, user_uuid: UserId, conn: &mut DbConn) -> Vec<CollectionId> {
+    pub async fn get_collections(&self, user_id: String, conn: &mut DbConn) -> Vec<String> {
        if CONFIG.org_groups_enabled() {
            db_run! {conn: {
                ciphers_collections::table
@@ -913,11 +863,11 @@ impl Cipher {
                    ))
                    .left_join(users_organizations::table.on(
                        users_organizations::org_uuid.eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                        .and(users_organizations::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(users_collections::table.on(
                        users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid.clone()))
+                        .and(users_collections::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(groups_users::table.on(
                        groups_users::users_organizations_uuid.eq(users_organizations::uuid)
@@ -928,14 +878,14 @@ impl Cipher {
                        .and(collections_groups::groups_uuid.eq(groups::uuid))
                    ))
                    .filter(users_organizations::access_all.eq(true) // User has access all
-                        .or(users_collections::user_uuid.eq(user_uuid) // User has access to collection
+                        .or(users_collections::user_uuid.eq(user_id) // User has access to collection
                            .and(users_collections::read_only.eq(false)))
                        .or(groups::access_all.eq(true)) // Access via groups
                        .or(collections_groups::collections_uuid.is_not_null() // Access via groups
                            .and(collections_groups::read_only.eq(false)))
                    )
                    .select(ciphers_collections::collection_uuid)
-                    .load::<CollectionId>(conn).unwrap_or_default()
+                    .load::<String>(conn).unwrap_or_default()
            }}
        } else {
            db_run! {conn: {
@@ -946,23 +896,23 @@ impl Cipher {
                    ))
                    .inner_join(users_organizations::table.on(
                        users_organizations::org_uuid.eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                        .and(users_organizations::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(users_collections::table.on(
                        users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid.clone()))
+                        .and(users_collections::user_uuid.eq(user_id.clone()))
                    ))
                    .filter(users_organizations::access_all.eq(true) // User has access all
-                        .or(users_collections::user_uuid.eq(user_uuid) // User has access to collection
+                        .or(users_collections::user_uuid.eq(user_id) // User has access to collection
                            .and(users_collections::read_only.eq(false)))
                    )
                    .select(ciphers_collections::collection_uuid)
-                    .load::<CollectionId>(conn).unwrap_or_default()
+                    .load::<String>(conn).unwrap_or_default()
            }}
        }
    }

-    pub async fn get_admin_collections(&self, user_uuid: UserId, conn: &mut DbConn) -> Vec<CollectionId> {
+    pub async fn get_admin_collections(&self, user_id: String, conn: &mut DbConn) -> Vec<String> {
        if CONFIG.org_groups_enabled() {
            db_run! {conn: {
                ciphers_collections::table
@@ -972,11 +922,11 @@ impl Cipher {
                    ))
                    .left_join(users_organizations::table.on(
                        users_organizations::org_uuid.eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                        .and(users_organizations::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(users_collections::table.on(
                        users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid.clone()))
+                        .and(users_collections::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(groups_users::table.on(
                        groups_users::users_organizations_uuid.eq(users_organizations::uuid)
@@ -987,15 +937,15 @@ impl Cipher {
                        .and(collections_groups::groups_uuid.eq(groups::uuid))
                    ))
                    .filter(users_organizations::access_all.eq(true) // User has access all
-                        .or(users_collections::user_uuid.eq(user_uuid) // User has access to collection
+                        .or(users_collections::user_uuid.eq(user_id) // User has access to collection
                            .and(users_collections::read_only.eq(false)))
                        .or(groups::access_all.eq(true)) // Access via groups
                        .or(collections_groups::collections_uuid.is_not_null() // Access via groups
                            .and(collections_groups::read_only.eq(false)))
-                        .or(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
+                        .or(users_organizations::atype.le(UserOrgType::Admin as i32)) // User is admin or owner
                    )
                    .select(ciphers_collections::collection_uuid)
-                    .load::<CollectionId>(conn).unwrap_or_default()
+                    .load::<String>(conn).unwrap_or_default()
            }}
        } else {
            db_run! {conn: {
@@ -1006,29 +956,26 @@ impl Cipher {
                    ))
                    .inner_join(users_organizations::table.on(
                        users_organizations::org_uuid.eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                        .and(users_organizations::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(users_collections::table.on(
                        users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid.clone()))
+                        .and(users_collections::user_uuid.eq(user_id.clone()))
                    ))
                    .filter(users_organizations::access_all.eq(true) // User has access all
-                        .or(users_collections::user_uuid.eq(user_uuid) // User has access to collection
+                        .or(users_collections::user_uuid.eq(user_id) // User has access to collection
                            .and(users_collections::read_only.eq(false)))
-                        .or(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
+                        .or(users_organizations::atype.le(UserOrgType::Admin as i32)) // User is admin or owner
                    )
                    .select(ciphers_collections::collection_uuid)
-                    .load::<CollectionId>(conn).unwrap_or_default()
+                    .load::<String>(conn).unwrap_or_default()
            }}
        }
    }

    /// Return a Vec with (cipher_uuid, collection_uuid)
    /// This is used during a full sync so we only need one query for all collections accessible.
-    pub async fn get_collections_with_cipher_by_user(
-        user_uuid: UserId,
-        conn: &mut DbConn,
-    ) -> Vec<(CipherId, CollectionId)> {
+    pub async fn get_collections_with_cipher_by_user(user_id: String, conn: &mut DbConn) -> Vec<(String, String)> {
        db_run! {conn: {
            ciphers_collections::table
            .inner_join(collections::table.on(
@@ -1036,12 +983,12 @@ impl Cipher {
            ))
            .inner_join(users_organizations::table.on(
                users_organizations::org_uuid.eq(collections::org_uuid).and(
-                    users_organizations::user_uuid.eq(user_uuid.clone())
+                    users_organizations::user_uuid.eq(user_id.clone())
                )
            ))
            .left_join(users_collections::table.on(
                users_collections::collection_uuid.eq(ciphers_collections::collection_uuid).and(
-                    users_collections::user_uuid.eq(user_uuid.clone())
+                    users_collections::user_uuid.eq(user_id.clone())
                )
            ))
            .left_join(groups_users::table.on(
@@ -1055,32 +1002,14 @@ impl Cipher {
                    collections_groups::groups_uuid.eq(groups::uuid)
                )
            ))
-            .or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection
+            .or_filter(users_collections::user_uuid.eq(user_id)) // User has access to collection
            .or_filter(users_organizations::access_all.eq(true)) // User has access all
-            .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
+            .or_filter(users_organizations::atype.le(UserOrgType::Admin as i32)) // User is admin or owner
            .or_filter(groups::access_all.eq(true)) //Access via group
            .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group
            .select(ciphers_collections::all_columns)
            .distinct()
-            .load::<(CipherId, CollectionId)>(conn).unwrap_or_default()
+            .load::<(String, String)>(conn).unwrap_or_default()
        }}
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct CipherId(String);
--- a/src/db/models/collection.rs
+++ b/src/db/models/collection.rs
@@ -1,20 +1,15 @@
-use derive_more::{AsRef, Deref, Display, From};
 use serde_json::Value;

-use super::{
-    CipherId, CollectionGroup, GroupUser, Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId,
-    User, UserId,
-};
+use super::{CollectionGroup, GroupUser, User, UserOrgStatus, UserOrgType, UserOrganization};
 use crate::CONFIG;
-use macros::UuidFromParam;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = collections)]
    #[diesel(primary_key(uuid))]
    pub struct Collection {
-        pub uuid: CollectionId,
-        pub org_uuid: OrganizationId,
+        pub uuid: String,
+        pub org_uuid: String,
        pub name: String,
        pub external_id: Option<String>,
    }
@@ -23,27 +18,26 @@ db_object! {
    #[diesel(table_name = users_collections)]
    #[diesel(primary_key(user_uuid, collection_uuid))]
    pub struct CollectionUser {
-        pub user_uuid: UserId,
-        pub collection_uuid: CollectionId,
+        pub user_uuid: String,
+        pub collection_uuid: String,
        pub read_only: bool,
        pub hide_passwords: bool,
-        pub manage: bool,
    }

    #[derive(Identifiable, Queryable, Insertable)]
    #[diesel(table_name = ciphers_collections)]
    #[diesel(primary_key(cipher_uuid, collection_uuid))]
    pub struct CollectionCipher {
-        pub cipher_uuid: CipherId,
-        pub collection_uuid: CollectionId,
+        pub cipher_uuid: String,
+        pub collection_uuid: String,
    }
 }

 /// Local methods
 impl Collection {
-    pub fn new(org_uuid: OrganizationId, name: String, external_id: Option<String>) -> Self {
+    pub fn new(org_uuid: String, name: String, external_id: Option<String>) -> Self {
        let mut new_model = Self {
-            uuid: CollectionId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            org_uuid,
            name,
            external_id: None,
@@ -80,30 +74,22 @@ impl Collection {

    pub async fn to_json_details(
        &self,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&crate::api::core::CipherSyncData>,
        conn: &mut DbConn,
    ) -> Value {
-        let (read_only, hide_passwords, manage) = if let Some(cipher_sync_data) = cipher_sync_data {
-            match cipher_sync_data.members.get(&self.org_uuid) {
-                // Only for Manager types Bitwarden returns true for the manage option
-                // Owners and Admins always have true. Users are not able to have full access
-                Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager),
-                Some(m) => {
+        let (read_only, hide_passwords, can_manage) = if let Some(cipher_sync_data) = cipher_sync_data {
+            match cipher_sync_data.user_organizations.get(&self.org_uuid) {
+                // Only for Manager types Bitwarden returns true for the can_manage option
+                // Owners and Admins always have true
+                Some(uo) if uo.has_full_access() => (false, false, uo.atype >= UserOrgType::Manager),
+                Some(uo) => {
                    // Only let a manager manage collections when the have full read/write access
-                    let is_manager = m.atype == MembershipType::Manager;
-                    if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) {
-                        (
-                            cu.read_only,
-                            cu.hide_passwords,
-                            cu.manage || (is_manager && !cu.read_only && !cu.hide_passwords),
-                        )
+                    let is_manager = uo.atype == UserOrgType::Manager;
+                    if let Some(uc) = cipher_sync_data.user_collections.get(&self.uuid) {
+                        (uc.read_only, uc.hide_passwords, is_manager && !uc.read_only && !uc.hide_passwords)
                    } else if let Some(cg) = cipher_sync_data.user_collections_groups.get(&self.uuid) {
-                        (
-                            cg.read_only,
-                            cg.hide_passwords,
-                            cg.manage || (is_manager && !cg.read_only && !cg.hide_passwords),
-                        )
+                        (cg.read_only, cg.hide_passwords, is_manager && !cg.read_only && !cg.hide_passwords)
                    } else {
                        (false, false, false)
                    }
@@ -111,16 +97,19 @@ impl Collection {
                _ => (true, true, false),
            }
        } else {
-            match Membership::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await {
-                Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager),
-                Some(_) if self.is_manageable_by_user(user_uuid, conn).await => (false, false, true),
-                Some(m) => {
-                    let is_manager = m.atype == MembershipType::Manager;
+            match UserOrganization::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await {
+                Some(ou) if ou.has_full_access() => (false, false, ou.atype >= UserOrgType::Manager),
+                Some(ou) => {
+                    let is_manager = ou.atype == UserOrgType::Manager;
                    let read_only = !self.is_writable_by_user(user_uuid, conn).await;
                    let hide_passwords = self.hide_passwords_for_user(user_uuid, conn).await;
                    (read_only, hide_passwords, is_manager && !read_only && !hide_passwords)
                }
-                _ => (true, true, false),
+                _ => (
+                    !self.is_writable_by_user(user_uuid, conn).await,
+                    self.hide_passwords_for_user(user_uuid, conn).await,
+                    false,
+                ),
            }
        };

@@ -128,17 +117,17 @@ impl Collection {
        json_object["object"] = json!("collectionDetails");
        json_object["readOnly"] = json!(read_only);
        json_object["hidePasswords"] = json!(hide_passwords);
-        json_object["manage"] = json!(manage);
+        json_object["manage"] = json!(can_manage);
        json_object
    }

-    pub async fn can_access_collection(member: &Membership, col_id: &CollectionId, conn: &mut DbConn) -> bool {
-        member.has_status(MembershipStatus::Confirmed)
-            && (member.has_full_access()
-                || CollectionUser::has_access_to_collection_by_user(col_id, &member.user_uuid, conn).await
+    pub async fn can_access_collection(org_user: &UserOrganization, col_id: &str, conn: &mut DbConn) -> bool {
+        org_user.has_status(UserOrgStatus::Confirmed)
+            && (org_user.has_full_access()
+                || CollectionUser::has_access_to_collection_by_user(col_id, &org_user.user_uuid, conn).await
                || (CONFIG.org_groups_enabled()
-                    && (GroupUser::has_full_access_by_member(&member.org_uuid, &member.uuid, conn).await
-                        || GroupUser::has_access_to_collection_by_member(col_id, &member.uuid, conn).await)))
+                    && (GroupUser::has_full_access_by_member(&org_user.org_uuid, &org_user.uuid, conn).await
+                        || GroupUser::has_access_to_collection_by_member(col_id, &org_user.uuid, conn).await)))
    }
 }

@@ -196,7 +185,7 @@ impl Collection {
        }}
    }

-    pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_organization(org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for collection in Self::find_by_organization(org_uuid, conn).await {
            collection.delete(conn).await?;
        }
@@ -204,12 +193,12 @@ impl Collection {
    }

    pub async fn update_users_revision(&self, conn: &mut DbConn) {
-        for member in Membership::find_by_collection_and_org(&self.uuid, &self.org_uuid, conn).await.iter() {
-            User::update_uuid_revision(&member.user_uuid, conn).await;
+        for user_org in UserOrganization::find_by_collection_and_org(&self.uuid, &self.org_uuid, conn).await.iter() {
+            User::update_uuid_revision(&user_org.user_uuid, conn).await;
        }
    }

-    pub async fn find_by_uuid(uuid: &CollectionId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            collections::table
                .filter(collections::uuid.eq(uuid))
@@ -219,7 +208,7 @@ impl Collection {
        }}
    }

-    pub async fn find_by_user_uuid(user_uuid: UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user_uuid(user_uuid: String, conn: &mut DbConn) -> Vec<Self> {
        if CONFIG.org_groups_enabled() {
            db_run! { conn: {
                collections::table
@@ -245,7 +234,7 @@ impl Collection {
                    )
                ))
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .filter(
                    users_collections::user_uuid.eq(user_uuid).or( // Directly accessed collection
@@ -276,7 +265,7 @@ impl Collection {
                    )
                ))
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .filter(
                    users_collections::user_uuid.eq(user_uuid).or( // Directly accessed collection
@@ -290,19 +279,15 @@ impl Collection {
        }
    }

-    pub async fn find_by_organization_and_user_uuid(
-        org_uuid: &OrganizationId,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Vec<Self> {
+    pub async fn find_by_organization_and_user_uuid(org_uuid: &str, user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        Self::find_by_user_uuid(user_uuid.to_owned(), conn)
            .await
            .into_iter()
-            .filter(|c| &c.org_uuid == org_uuid)
+            .filter(|c| c.org_uuid == org_uuid)
            .collect()
    }

-    pub async fn find_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_organization(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            collections::table
                .filter(collections::org_uuid.eq(org_uuid))
@@ -312,7 +297,7 @@ impl Collection {
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            collections::table
                .filter(collections::org_uuid.eq(org_uuid))
@@ -323,11 +308,7 @@ impl Collection {
        }}
    }

-    pub async fn find_by_uuid_and_org(
-        uuid: &CollectionId,
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_org(uuid: &str, org_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            collections::table
                .filter(collections::uuid.eq(uuid))
@@ -339,7 +320,7 @@ impl Collection {
        }}
    }

-    pub async fn find_by_uuid_and_user(uuid: &CollectionId, user_uuid: UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid_and_user(uuid: &str, user_uuid: String, conn: &mut DbConn) -> Option<Self> {
        if CONFIG.org_groups_enabled() {
            db_run! { conn: {
                collections::table
@@ -368,7 +349,7 @@ impl Collection {
                .filter(
                    users_collections::collection_uuid.eq(uuid).or( // Directly accessed collection
                        users_organizations::access_all.eq(true).or( // access_all in Organization
-                            users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                            users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                    )).or(
                        groups::access_all.eq(true) // access_all in groups
                    ).or( // access via groups
@@ -397,7 +378,7 @@ impl Collection {
                .filter(
                    users_collections::collection_uuid.eq(uuid).or( // Directly accessed collection
                        users_organizations::access_all.eq(true).or( // access_all in Organization
-                            users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                            users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                    ))
                ).select(collections::all_columns)
                .first::<CollectionDb>(conn).ok()
@@ -406,7 +387,7 @@ impl Collection {
        }
    }

-    pub async fn is_writable_by_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_writable_by_user(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        let user_uuid = user_uuid.to_string();
        if CONFIG.org_groups_enabled() {
            db_run! { conn: {
@@ -430,7 +411,7 @@ impl Collection {
                        collections_groups::groups_uuid.eq(groups_users::groups_uuid)
                        .and(collections_groups::collections_uuid.eq(collections::uuid))
                    ))
-                    .filter(users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                    .filter(users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                        .or(users_organizations::access_all.eq(true)) // access_all via membership
                        .or(users_collections::collection_uuid.eq(&self.uuid) // write access given to collection
                            .and(users_collections::read_only.eq(false)))
@@ -455,7 +436,7 @@ impl Collection {
                        users_collections::collection_uuid.eq(collections::uuid)
                        .and(users_collections::user_uuid.eq(user_uuid))
                    ))
-                    .filter(users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                    .filter(users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                        .or(users_organizations::access_all.eq(true)) // access_all via membership
                        .or(users_collections::collection_uuid.eq(&self.uuid) // write access given to collection
                            .and(users_collections::read_only.eq(false)))
@@ -468,7 +449,7 @@ impl Collection {
        }
    }

-    pub async fn hide_passwords_for_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn hide_passwords_for_user(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        let user_uuid = user_uuid.to_string();
        db_run! { conn: {
            collections::table
@@ -497,7 +478,7 @@ impl Collection {
            .filter(
                users_collections::collection_uuid.eq(&self.uuid).and(users_collections::hide_passwords.eq(true)).or(// Directly accessed collection
                    users_organizations::access_all.eq(true).or( // access_all in Organization
-                        users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                        users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                )).or(
                    groups::access_all.eq(true) // access_all in groups
                ).or( // access via groups
@@ -513,61 +494,11 @@ impl Collection {
            .unwrap_or(0) != 0
        }}
    }
-
-    pub async fn is_manageable_by_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
-        let user_uuid = user_uuid.to_string();
-        db_run! { conn: {
-            collections::table
-            .left_join(users_collections::table.on(
-                users_collections::collection_uuid.eq(collections::uuid).and(
-                    users_collections::user_uuid.eq(user_uuid.clone())
-                )
-            ))
-            .left_join(users_organizations::table.on(
-                collections::org_uuid.eq(users_organizations::org_uuid).and(
-                    users_organizations::user_uuid.eq(user_uuid)
-                )
-            ))
-            .left_join(groups_users::table.on(
-                groups_users::users_organizations_uuid.eq(users_organizations::uuid)
-            ))
-            .left_join(groups::table.on(
-                groups::uuid.eq(groups_users::groups_uuid)
-            ))
-            .left_join(collections_groups::table.on(
-                collections_groups::groups_uuid.eq(groups_users::groups_uuid).and(
-                    collections_groups::collections_uuid.eq(collections::uuid)
-                )
-            ))
-            .filter(collections::uuid.eq(&self.uuid))
-            .filter(
-                users_collections::collection_uuid.eq(&self.uuid).and(users_collections::manage.eq(true)).or(// Directly accessed collection
-                    users_organizations::access_all.eq(true).or( // access_all in Organization
-                        users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
-                )).or(
-                    groups::access_all.eq(true) // access_all in groups
-                ).or( // access via groups
-                    groups_users::users_organizations_uuid.eq(users_organizations::uuid).and(
-                        collections_groups::collections_uuid.is_not_null().and(
-                            collections_groups::manage.eq(true))
-                    )
-                )
-            )
-            .count()
-            .first::<i64>(conn)
-            .ok()
-            .unwrap_or(0) != 0
-        }}
-    }
 }

 /// Database methods
 impl CollectionUser {
-    pub async fn find_by_organization_and_user_uuid(
-        org_uuid: &OrganizationId,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Vec<Self> {
+    pub async fn find_by_organization_and_user_uuid(org_uuid: &str, user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            users_collections::table
                .filter(users_collections::user_uuid.eq(user_uuid))
@@ -580,29 +511,24 @@ impl CollectionUser {
        }}
    }

-    pub async fn find_by_organization_swap_user_uuid_with_member_uuid(
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> Vec<CollectionMembership> {
-        let col_users = db_run! { conn: {
+    pub async fn find_by_organization(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
+        db_run! { conn: {
            users_collections::table
                .inner_join(collections::table.on(collections::uuid.eq(users_collections::collection_uuid)))
                .filter(collections::org_uuid.eq(org_uuid))
                .inner_join(users_organizations::table.on(users_organizations::user_uuid.eq(users_collections::user_uuid)))
-                .select((users_organizations::uuid, users_collections::collection_uuid, users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
+                .select((users_organizations::uuid, users_collections::collection_uuid, users_collections::read_only, users_collections::hide_passwords))
                .load::<CollectionUserDb>(conn)
                .expect("Error loading users_collections")
                .from_db()
-        }};
-        col_users.into_iter().map(|c| c.into()).collect()
+        }}
    }

    pub async fn save(
-        user_uuid: &UserId,
-        collection_uuid: &CollectionId,
+        user_uuid: &str,
+        collection_uuid: &str,
        read_only: bool,
        hide_passwords: bool,
-        manage: bool,
        conn: &mut DbConn,
    ) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;
@@ -615,7 +541,6 @@ impl CollectionUser {
                        users_collections::collection_uuid.eq(collection_uuid),
                        users_collections::read_only.eq(read_only),
                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
                    ))
                    .execute(conn)
                {
@@ -630,7 +555,6 @@ impl CollectionUser {
                                users_collections::collection_uuid.eq(collection_uuid),
                                users_collections::read_only.eq(read_only),
                                users_collections::hide_passwords.eq(hide_passwords),
-                                users_collections::manage.eq(manage),
                            ))
                            .execute(conn)
                            .map_res("Error adding user to collection")
@@ -645,14 +569,12 @@ impl CollectionUser {
                        users_collections::collection_uuid.eq(collection_uuid),
                        users_collections::read_only.eq(read_only),
                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
                    ))
                    .on_conflict((users_collections::user_uuid, users_collections::collection_uuid))
                    .do_update()
                    .set((
                        users_collections::read_only.eq(read_only),
                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
                    ))
                    .execute(conn)
                    .map_res("Error adding user to collection")
@@ -674,7 +596,7 @@ impl CollectionUser {
        }}
    }

-    pub async fn find_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_collection(collection_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            users_collections::table
                .filter(users_collections::collection_uuid.eq(collection_uuid))
@@ -685,25 +607,24 @@ impl CollectionUser {
        }}
    }

-    pub async fn find_by_collection_swap_user_uuid_with_member_uuid(
-        collection_uuid: &CollectionId,
+    pub async fn find_by_collection_swap_user_uuid_with_org_user_uuid(
+        collection_uuid: &str,
        conn: &mut DbConn,
-    ) -> Vec<CollectionMembership> {
-        let col_users = db_run! { conn: {
+    ) -> Vec<Self> {
+        db_run! { conn: {
            users_collections::table
                .filter(users_collections::collection_uuid.eq(collection_uuid))
                .inner_join(users_organizations::table.on(users_organizations::user_uuid.eq(users_collections::user_uuid)))
-                .select((users_organizations::uuid, users_collections::collection_uuid, users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
+                .select((users_organizations::uuid, users_collections::collection_uuid, users_collections::read_only, users_collections::hide_passwords))
                .load::<CollectionUserDb>(conn)
                .expect("Error loading users_collections")
                .from_db()
-        }};
-        col_users.into_iter().map(|c| c.into()).collect()
+        }}
    }

    pub async fn find_by_collection_and_user(
-        collection_uuid: &CollectionId,
-        user_uuid: &UserId,
+        collection_uuid: &str,
+        user_uuid: &str,
        conn: &mut DbConn,
    ) -> Option<Self> {
        db_run! { conn: {
@@ -717,7 +638,7 @@ impl CollectionUser {
        }}
    }

-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            users_collections::table
                .filter(users_collections::user_uuid.eq(user_uuid))
@@ -728,7 +649,7 @@ impl CollectionUser {
        }}
    }

-    pub async fn delete_all_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_collection(collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for collection in CollectionUser::find_by_collection(collection_uuid, conn).await.iter() {
            User::update_uuid_revision(&collection.user_uuid, conn).await;
        }
@@ -740,11 +661,7 @@ impl CollectionUser {
        }}
    }

-    pub async fn delete_all_by_user_and_org(
-        user_uuid: &UserId,
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn delete_all_by_user_and_org(user_uuid: &str, org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let collectionusers = Self::find_by_organization_and_user_uuid(org_uuid, user_uuid, conn).await;

        db_run! { conn: {
@@ -760,18 +677,14 @@ impl CollectionUser {
        }}
    }

-    pub async fn has_access_to_collection_by_user(
-        col_id: &CollectionId,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> bool {
+    pub async fn has_access_to_collection_by_user(col_id: &str, user_uuid: &str, conn: &mut DbConn) -> bool {
        Self::find_by_collection_and_user(col_id, user_uuid, conn).await.is_some()
    }
 }

 /// Database methods
 impl CollectionCipher {
-    pub async fn save(cipher_uuid: &CipherId, collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn save(cipher_uuid: &str, collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        Self::update_users_revision(collection_uuid, conn).await;

        db_run! { conn:
@@ -801,7 +714,7 @@ impl CollectionCipher {
        }
    }

-    pub async fn delete(cipher_uuid: &CipherId, collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete(cipher_uuid: &str, collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        Self::update_users_revision(collection_uuid, conn).await;

        db_run! { conn: {
@@ -815,7 +728,7 @@ impl CollectionCipher {
        }}
    }

-    pub async fn delete_all_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(ciphers_collections::table.filter(ciphers_collections::cipher_uuid.eq(cipher_uuid)))
                .execute(conn)
@@ -823,7 +736,7 @@ impl CollectionCipher {
        }}
    }

-    pub async fn delete_all_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_collection(collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(ciphers_collections::table.filter(ciphers_collections::collection_uuid.eq(collection_uuid)))
                .execute(conn)
@@ -831,63 +744,9 @@ impl CollectionCipher {
        }}
    }

-    pub async fn update_users_revision(collection_uuid: &CollectionId, conn: &mut DbConn) {
+    pub async fn update_users_revision(collection_uuid: &str, conn: &mut DbConn) {
        if let Some(collection) = Collection::find_by_uuid(collection_uuid, conn).await {
            collection.update_users_revision(conn).await;
        }
    }
 }
-
-// Added in case we need the membership_uuid instead of the user_uuid
-pub struct CollectionMembership {
-    pub membership_uuid: MembershipId,
-    pub collection_uuid: CollectionId,
-    pub read_only: bool,
-    pub hide_passwords: bool,
-    pub manage: bool,
-}
-
-impl CollectionMembership {
-    pub fn to_json_details_for_member(&self, membership_type: i32) -> Value {
-        json!({
-            "id": self.membership_uuid,
-            "readOnly": self.read_only,
-            "hidePasswords": self.hide_passwords,
-            "manage": membership_type >= MembershipType::Admin
-                || self.manage
-                || (membership_type == MembershipType::Manager
-                    && !self.read_only
-                    && !self.hide_passwords),
-        })
-    }
-}
-
-impl From<CollectionUser> for CollectionMembership {
-    fn from(c: CollectionUser) -> Self {
-        Self {
-            membership_uuid: c.user_uuid.to_string().into(),
-            collection_uuid: c.collection_uuid,
-            read_only: c.read_only,
-            hide_passwords: c.hide_passwords,
-            manage: c.manage,
-        }
-    }
-}
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct CollectionId(String);
--- a/src/db/models/device.rs
+++ b/src/db/models/device.rs
@@ -1,10 +1,7 @@
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{Display, From};
-use serde_json::Value;

-use super::{AuthRequest, UserId};
-use crate::{crypto, util::format_date, CONFIG};
-use macros::IdFromParam;
+use crate::{crypto, CONFIG};
+use core::fmt;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -12,11 +9,11 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid, user_uuid))]
    pub struct Device {
-        pub uuid: DeviceId,
+        pub uuid: String,
        pub created_at: NaiveDateTime,
        pub updated_at: NaiveDateTime,

-        pub user_uuid: UserId,
+        pub user_uuid: String,

        pub name: String,
        pub atype: i32,         // https://github.com/bitwarden/server/blob/dcc199bcce4aa2d5621f6fab80f1b49d8b143418/src/Core/Enums/DeviceType.cs
@@ -24,13 +21,14 @@ db_object! {
        pub push_token: Option<String>,

        pub refresh_token: String,
+
        pub twofactor_remember: Option<String>,
    }
 }

 /// Local methods
 impl Device {
-    pub fn new(uuid: DeviceId, user_uuid: UserId, name: String, atype: i32) -> Self {
+    pub fn new(uuid: String, user_uuid: String, name: String, atype: i32) -> Self {
        let now = Utc::now().naive_utc();

        Self {
@@ -49,18 +47,6 @@ impl Device {
        }
    }

-    pub fn to_json(&self) -> Value {
-        json!({
-            "id": self.uuid,
-            "name": self.name,
-            "type": self.atype,
-            "identifier": self.push_uuid,
-            "creationDate": format_date(&self.created_at),
-            "isTrusted": false,
-            "object":"device"
-        })
-    }
-
    pub fn refresh_twofactor_remember(&mut self) -> String {
        use data_encoding::BASE64;
        let twofactor_remember = crypto::encode_random_bytes::<180>(BASE64);
@@ -89,12 +75,12 @@ impl Device {
        // Also These key/value pairs are not used anywhere by either Vaultwarden or Bitwarden Clients
        // Because these might get used in the future, and they are added by the Bitwarden Server, lets keep it, but then commented out
        // ---
-        // fn arg: members: Vec<super::Membership>,
+        // fn arg: orgs: Vec<super::UserOrganization>,
        // ---
-        // let orgowner: Vec<_> = members.iter().filter(|m| m.atype == 0).map(|o| o.org_uuid.clone()).collect();
-        // let orgadmin: Vec<_> = members.iter().filter(|m| m.atype == 1).map(|o| o.org_uuid.clone()).collect();
-        // let orguser: Vec<_> = members.iter().filter(|m| m.atype == 2).map(|o| o.org_uuid.clone()).collect();
-        // let orgmanager: Vec<_> = members.iter().filter(|m| m.atype == 3).map(|o| o.org_uuid.clone()).collect();
+        // let orgowner: Vec<_> = orgs.iter().filter(|o| o.atype == 0).map(|o| o.org_uuid.clone()).collect();
+        // let orgadmin: Vec<_> = orgs.iter().filter(|o| o.atype == 1).map(|o| o.org_uuid.clone()).collect();
+        // let orguser: Vec<_> = orgs.iter().filter(|o| o.atype == 2).map(|o| o.org_uuid.clone()).collect();
+        // let orgmanager: Vec<_> = orgs.iter().filter(|o| o.atype == 3).map(|o| o.org_uuid.clone()).collect();

        // Create the JWT claims struct, to send to the client
        use crate::auth::{encode_jwt, LoginJwtClaims, DEFAULT_VALIDITY, JWT_LOGIN_ISSUER};
@@ -137,36 +123,6 @@ impl Device {
    }
 }

-pub struct DeviceWithAuthRequest {
-    pub device: Device,
-    pub pending_auth_request: Option<AuthRequest>,
-}
-
-impl DeviceWithAuthRequest {
-    pub fn to_json(&self) -> Value {
-        let auth_request = match &self.pending_auth_request {
-            Some(auth_request) => auth_request.to_json_for_pending_device(),
-            None => Value::Null,
-        };
-        json!({
-            "id": self.device.uuid,
-            "name": self.device.name,
-            "type": self.device.atype,
-            "identifier": self.device.push_uuid,
-            "creationDate": format_date(&self.device.created_at),
-            "devicePendingAuthRequest": auth_request,
-            "isTrusted": false,
-            "object": "device",
-        })
-    }
-
-    pub fn from(c: Device, a: Option<AuthRequest>) -> Self {
-        Self {
-            device: c,
-            pending_auth_request: a,
-        }
-    }
-}
 use crate::db::DbConn;

 use crate::api::EmptyResult;
@@ -194,7 +150,7 @@ impl Device {
        }
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(devices::table.filter(devices::user_uuid.eq(user_uuid)))
                .execute(conn)
@@ -202,7 +158,7 @@ impl Device {
        }}
    }

-    pub async fn find_by_uuid_and_user(uuid: &DeviceId, user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid_and_user(uuid: &str, user_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::uuid.eq(uuid))
@@ -213,17 +169,7 @@ impl Device {
        }}
    }

-    pub async fn find_with_auth_request_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<DeviceWithAuthRequest> {
-        let devices = Self::find_by_user(user_uuid, conn).await;
-        let mut result = Vec::new();
-        for device in devices {
-            let auth_request = AuthRequest::find_by_user_and_requested_device(user_uuid, &device.uuid, conn).await;
-            result.push(DeviceWithAuthRequest::from(device, auth_request));
-        }
-        result
-    }
-
-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::user_uuid.eq(user_uuid))
@@ -233,7 +179,7 @@ impl Device {
        }}
    }

-    pub async fn find_by_uuid(uuid: &DeviceId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::uuid.eq(uuid))
@@ -243,7 +189,7 @@ impl Device {
        }}
    }

-    pub async fn clear_push_token_by_uuid(uuid: &DeviceId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn clear_push_token_by_uuid(uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::update(devices::table)
                .filter(devices::uuid.eq(uuid))
@@ -262,7 +208,7 @@ impl Device {
        }}
    }

-    pub async fn find_latest_active_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_latest_active_by_user(user_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::user_uuid.eq(user_uuid))
@@ -273,7 +219,7 @@ impl Device {
        }}
    }

-    pub async fn find_push_devices_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_push_devices_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::user_uuid.eq(user_uuid))
@@ -284,7 +230,7 @@ impl Device {
        }}
    }

-    pub async fn check_user_has_push_device(user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn check_user_has_push_device(user_uuid: &str, conn: &mut DbConn) -> bool {
        db_run! { conn: {
            devices::table
            .filter(devices::user_uuid.eq(user_uuid))
@@ -297,62 +243,68 @@ impl Device {
    }
 }

-#[derive(Display)]
 pub enum DeviceType {
-    #[display("Android")]
    Android = 0,
-    #[display("iOS")]
    Ios = 1,
-    #[display("Chrome Extension")]
    ChromeExtension = 2,
-    #[display("Firefox Extension")]
    FirefoxExtension = 3,
-    #[display("Opera Extension")]
    OperaExtension = 4,
-    #[display("Edge Extension")]
    EdgeExtension = 5,
-    #[display("Windows")]
    WindowsDesktop = 6,
-    #[display("macOS")]
    MacOsDesktop = 7,
-    #[display("Linux")]
    LinuxDesktop = 8,
-    #[display("Chrome")]
    ChromeBrowser = 9,
-    #[display("Firefox")]
    FirefoxBrowser = 10,
-    #[display("Opera")]
    OperaBrowser = 11,
-    #[display("Edge")]
    EdgeBrowser = 12,
-    #[display("Internet Explorer")]
    IEBrowser = 13,
-    #[display("Unknown Browser")]
    UnknownBrowser = 14,
-    #[display("Android")]
    AndroidAmazon = 15,
-    #[display("UWP")]
    Uwp = 16,
-    #[display("Safari")]
    SafariBrowser = 17,
-    #[display("Vivaldi")]
    VivaldiBrowser = 18,
-    #[display("Vivaldi Extension")]
    VivaldiExtension = 19,
-    #[display("Safari Extension")]
    SafariExtension = 20,
-    #[display("SDK")]
    Sdk = 21,
-    #[display("Server")]
    Server = 22,
-    #[display("Windows CLI")]
    WindowsCLI = 23,
-    #[display("macOS CLI")]
    MacOsCLI = 24,
-    #[display("Linux CLI")]
    LinuxCLI = 25,
 }

+impl fmt::Display for DeviceType {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            DeviceType::Android => write!(f, "Android"),
+            DeviceType::Ios => write!(f, "iOS"),
+            DeviceType::ChromeExtension => write!(f, "Chrome Extension"),
+            DeviceType::FirefoxExtension => write!(f, "Firefox Extension"),
+            DeviceType::OperaExtension => write!(f, "Opera Extension"),
+            DeviceType::EdgeExtension => write!(f, "Edge Extension"),
+            DeviceType::WindowsDesktop => write!(f, "Windows"),
+            DeviceType::MacOsDesktop => write!(f, "macOS"),
+            DeviceType::LinuxDesktop => write!(f, "Linux"),
+            DeviceType::ChromeBrowser => write!(f, "Chrome"),
+            DeviceType::FirefoxBrowser => write!(f, "Firefox"),
+            DeviceType::OperaBrowser => write!(f, "Opera"),
+            DeviceType::EdgeBrowser => write!(f, "Edge"),
+            DeviceType::IEBrowser => write!(f, "Internet Explorer"),
+            DeviceType::UnknownBrowser => write!(f, "Unknown Browser"),
+            DeviceType::AndroidAmazon => write!(f, "Android"),
+            DeviceType::Uwp => write!(f, "UWP"),
+            DeviceType::SafariBrowser => write!(f, "Safari"),
+            DeviceType::VivaldiBrowser => write!(f, "Vivaldi"),
+            DeviceType::VivaldiExtension => write!(f, "Vivaldi Extension"),
+            DeviceType::SafariExtension => write!(f, "Safari Extension"),
+            DeviceType::Sdk => write!(f, "SDK"),
+            DeviceType::Server => write!(f, "Server"),
+            DeviceType::WindowsCLI => write!(f, "Windows CLI"),
+            DeviceType::MacOsCLI => write!(f, "macOS CLI"),
+            DeviceType::LinuxCLI => write!(f, "Linux CLI"),
+        }
+    }
+}
+
 impl DeviceType {
    pub fn from_i32(value: i32) -> DeviceType {
        match value {
@@ -386,8 +338,3 @@ impl DeviceType {
        }
    }
 }
-
-#[derive(
-    Clone, Debug, DieselNewType, Display, From, FromForm, Hash, PartialEq, Eq, Serialize, Deserialize, IdFromParam,
-)]
-pub struct DeviceId(String);
--- a/src/db/models/emergency_access.rs
+++ b/src/db/models/emergency_access.rs
@@ -1,10 +1,9 @@
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{AsRef, Deref, Display, From};
 use serde_json::Value;

-use super::{User, UserId};
 use crate::{api::EmptyResult, db::DbConn, error::MapResult};
-use macros::UuidFromParam;
+
+use super::User;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -12,9 +11,9 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct EmergencyAccess {
-        pub uuid: EmergencyAccessId,
-        pub grantor_uuid: UserId,
-        pub grantee_uuid: Option<UserId>,
+        pub uuid: String,
+        pub grantor_uuid: String,
+        pub grantee_uuid: Option<String>,
        pub email: Option<String>,
        pub key_encrypted: Option<String>,
        pub atype: i32, //EmergencyAccessType
@@ -30,11 +29,11 @@ db_object! {
 // Local methods

 impl EmergencyAccess {
-    pub fn new(grantor_uuid: UserId, email: String, status: i32, atype: i32, wait_time_days: i32) -> Self {
+    pub fn new(grantor_uuid: String, email: String, status: i32, atype: i32, wait_time_days: i32) -> Self {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: EmergencyAccessId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            grantor_uuid,
            grantee_uuid: None,
            email: Some(email),
@@ -83,7 +82,7 @@ impl EmergencyAccess {
    }

    pub async fn to_json_grantee_details(&self, conn: &mut DbConn) -> Option<Value> {
-        let grantee_user = if let Some(grantee_uuid) = &self.grantee_uuid {
+        let grantee_user = if let Some(grantee_uuid) = self.grantee_uuid.as_deref() {
            User::find_by_uuid(grantee_uuid, conn).await.expect("Grantee user not found.")
        } else if let Some(email) = self.email.as_deref() {
            match User::find_by_mail(email, conn).await {
@@ -212,7 +211,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for ea in Self::find_all_by_grantor_uuid(user_uuid, conn).await {
            ea.delete(conn).await?;
        }
@@ -240,8 +239,8 @@ impl EmergencyAccess {
    }

    pub async fn find_by_grantor_uuid_and_grantee_uuid_or_email(
-        grantor_uuid: &UserId,
-        grantee_uuid: &UserId,
+        grantor_uuid: &str,
+        grantee_uuid: &str,
        email: &str,
        conn: &mut DbConn,
    ) -> Option<Self> {
@@ -263,11 +262,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_by_uuid_and_grantor_uuid(
-        uuid: &EmergencyAccessId,
-        grantor_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_grantor_uuid(uuid: &str, grantor_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::uuid.eq(uuid))
@@ -277,11 +272,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_by_uuid_and_grantee_uuid(
-        uuid: &EmergencyAccessId,
-        grantee_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_grantee_uuid(uuid: &str, grantee_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::uuid.eq(uuid))
@@ -291,11 +282,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_by_uuid_and_grantee_email(
-        uuid: &EmergencyAccessId,
-        grantee_email: &str,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_grantee_email(uuid: &str, grantee_email: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::uuid.eq(uuid))
@@ -305,7 +292,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_all_by_grantee_uuid(grantee_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_all_by_grantee_uuid(grantee_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::grantee_uuid.eq(grantee_uuid))
@@ -332,7 +319,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_all_by_grantor_uuid(grantor_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_all_by_grantor_uuid(grantor_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::grantor_uuid.eq(grantor_uuid))
@@ -340,12 +327,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn accept_invite(
-        &mut self,
-        grantee_uuid: &UserId,
-        grantee_email: &str,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn accept_invite(&mut self, grantee_uuid: &str, grantee_email: &str, conn: &mut DbConn) -> EmptyResult {
        if self.email.is_none() || self.email.as_ref().unwrap() != grantee_email {
            err!("User email does not match invite.");
        }
@@ -355,28 +337,10 @@ impl EmergencyAccess {
        }

        self.status = EmergencyAccessStatus::Accepted as i32;
-        self.grantee_uuid = Some(grantee_uuid.clone());
+        self.grantee_uuid = Some(String::from(grantee_uuid));
        self.email = None;
        self.save(conn).await
    }
 }

 // endregion
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct EmergencyAccessId(String);
--- a/src/db/models/event.rs
+++ b/src/db/models/event.rs
@@ -1,9 +1,9 @@
-use chrono::{NaiveDateTime, TimeDelta, Utc};
-//use derive_more::{AsRef, Deref, Display, From};
+use crate::db::DbConn;
 use serde_json::Value;

-use super::{CipherId, CollectionId, GroupId, MembershipId, OrgPolicyId, OrganizationId, UserId};
-use crate::{api::EmptyResult, db::DbConn, error::MapResult, CONFIG};
+use crate::{api::EmptyResult, error::MapResult, CONFIG};
+
+use chrono::{NaiveDateTime, TimeDelta, Utc};

 // https://bitwarden.com/help/event-logs/

@@ -15,20 +15,20 @@ db_object! {
    #[diesel(table_name = event)]
    #[diesel(primary_key(uuid))]
    pub struct Event {
-        pub uuid: EventId,
+        pub uuid: String,
        pub event_type: i32, // EventType
-        pub user_uuid: Option<UserId>,
-        pub org_uuid: Option<OrganizationId>,
-        pub cipher_uuid: Option<CipherId>,
-        pub collection_uuid: Option<CollectionId>,
-        pub group_uuid: Option<GroupId>,
-        pub org_user_uuid: Option<MembershipId>,
-        pub act_user_uuid: Option<UserId>,
+        pub user_uuid: Option<String>,
+        pub org_uuid: Option<String>,
+        pub cipher_uuid: Option<String>,
+        pub collection_uuid: Option<String>,
+        pub group_uuid: Option<String>,
+        pub org_user_uuid: Option<String>,
+        pub act_user_uuid: Option<String>,
        // Upstream enum: https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Core/Enums/DeviceType.cs
        pub device_type: Option<i32>,
        pub ip_address: Option<String>,
        pub event_date: NaiveDateTime,
-        pub policy_uuid: Option<OrgPolicyId>,
+        pub policy_uuid: Option<String>,
        pub provider_uuid: Option<String>,
        pub provider_user_uuid: Option<String>,
        pub provider_org_uuid: Option<String>,
@@ -128,7 +128,7 @@ impl Event {
        };

        Self {
-            uuid: EventId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            event_type,
            user_uuid: None,
            org_uuid: None,
@@ -246,7 +246,7 @@ impl Event {
    /// ##############
    /// Custom Queries
    pub async fn find_by_organization_uuid(
-        org_uuid: &OrganizationId,
+        org_uuid: &str,
        start: &NaiveDateTime,
        end: &NaiveDateTime,
        conn: &mut DbConn,
@@ -263,7 +263,7 @@ impl Event {
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            event::table
                .filter(event::org_uuid.eq(org_uuid))
@@ -274,16 +274,16 @@ impl Event {
        }}
    }

-    pub async fn find_by_org_and_member(
-        org_uuid: &OrganizationId,
-        member_uuid: &MembershipId,
+    pub async fn find_by_org_and_user_org(
+        org_uuid: &str,
+        user_org_uuid: &str,
        start: &NaiveDateTime,
        end: &NaiveDateTime,
        conn: &mut DbConn,
    ) -> Vec<Self> {
        db_run! { conn: {
            event::table
-                .inner_join(users_organizations::table.on(users_organizations::uuid.eq(member_uuid)))
+                .inner_join(users_organizations::table.on(users_organizations::uuid.eq(user_org_uuid)))
                .filter(event::org_uuid.eq(org_uuid))
                .filter(event::event_date.between(start, end))
                .filter(event::user_uuid.eq(users_organizations::user_uuid.nullable()).or(event::act_user_uuid.eq(users_organizations::user_uuid.nullable())))
@@ -297,7 +297,7 @@ impl Event {
    }

    pub async fn find_by_cipher_uuid(
-        cipher_uuid: &CipherId,
+        cipher_uuid: &str,
        start: &NaiveDateTime,
        end: &NaiveDateTime,
        conn: &mut DbConn,
@@ -327,6 +327,3 @@ impl Event {
        }
    }
 }
-
-#[derive(Clone, Debug, DieselNewType, FromForm, Hash, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EventId(String);
--- a/src/db/models/favorite.rs
+++ b/src/db/models/favorite.rs
@@ -1,12 +1,12 @@
-use super::{CipherId, User, UserId};
+use super::User;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable)]
    #[diesel(table_name = favorites)]
    #[diesel(primary_key(user_uuid, cipher_uuid))]
    pub struct Favorite {
-        pub user_uuid: UserId,
-        pub cipher_uuid: CipherId,
+        pub user_uuid: String,
+        pub cipher_uuid: String,
    }
 }

@@ -17,7 +17,7 @@ use crate::error::MapResult;

 impl Favorite {
    // Returns whether the specified cipher is a favorite of the specified user.
-    pub async fn is_favorite(cipher_uuid: &CipherId, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_favorite(cipher_uuid: &str, user_uuid: &str, conn: &mut DbConn) -> bool {
        db_run! { conn: {
            let query = favorites::table
                .filter(favorites::cipher_uuid.eq(cipher_uuid))
@@ -29,12 +29,7 @@ impl Favorite {
    }

    // Sets whether the specified cipher is a favorite of the specified user.
-    pub async fn set_favorite(
-        favorite: bool,
-        cipher_uuid: &CipherId,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn set_favorite(favorite: bool, cipher_uuid: &str, user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let (old, new) = (Self::is_favorite(cipher_uuid, user_uuid, conn).await, favorite);
        match (old, new) {
            (false, true) => {
@@ -67,7 +62,7 @@ impl Favorite {
    }

    // Delete all favorite entries associated with the specified cipher.
-    pub async fn delete_all_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(favorites::table.filter(favorites::cipher_uuid.eq(cipher_uuid)))
                .execute(conn)
@@ -76,7 +71,7 @@ impl Favorite {
    }

    // Delete all favorite entries associated with the specified user.
-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(favorites::table.filter(favorites::user_uuid.eq(user_uuid)))
                .execute(conn)
@@ -86,12 +81,12 @@ impl Favorite {

    /// Return a vec with (cipher_uuid) this will only contain favorite flagged ciphers
    /// This is used during a full sync so we only need one query for all favorite cipher matches.
-    pub async fn get_all_cipher_uuid_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<CipherId> {
+    pub async fn get_all_cipher_uuid_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<String> {
        db_run! { conn: {
            favorites::table
                .filter(favorites::user_uuid.eq(user_uuid))
                .select(favorites::cipher_uuid)
-                .load::<CipherId>(conn)
+                .load::<String>(conn)
                .unwrap_or_default()
        }}
    }
--- a/src/db/models/folder.rs
+++ b/src/db/models/folder.rs
@@ -1,19 +1,17 @@
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{AsRef, Deref, Display, From};
 use serde_json::Value;

-use super::{CipherId, User, UserId};
-use macros::UuidFromParam;
+use super::User;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = folders)]
    #[diesel(primary_key(uuid))]
    pub struct Folder {
-        pub uuid: FolderId,
+        pub uuid: String,
        pub created_at: NaiveDateTime,
        pub updated_at: NaiveDateTime,
-        pub user_uuid: UserId,
+        pub user_uuid: String,
        pub name: String,
    }

@@ -21,18 +19,18 @@ db_object! {
    #[diesel(table_name = folders_ciphers)]
    #[diesel(primary_key(cipher_uuid, folder_uuid))]
    pub struct FolderCipher {
-        pub cipher_uuid: CipherId,
-        pub folder_uuid: FolderId,
+        pub cipher_uuid: String,
+        pub folder_uuid: String,
    }
 }

 /// Local methods
 impl Folder {
-    pub fn new(user_uuid: UserId, name: String) -> Self {
+    pub fn new(user_uuid: String, name: String) -> Self {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: FolderId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            created_at: now,
            updated_at: now,

@@ -54,10 +52,10 @@ impl Folder {
 }

 impl FolderCipher {
-    pub fn new(folder_uuid: FolderId, cipher_uuid: CipherId) -> Self {
+    pub fn new(folder_uuid: &str, cipher_uuid: &str) -> Self {
        Self {
-            folder_uuid,
-            cipher_uuid,
+            folder_uuid: folder_uuid.to_string(),
+            cipher_uuid: cipher_uuid.to_string(),
        }
    }
 }
@@ -115,25 +113,24 @@ impl Folder {
        }}
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for folder in Self::find_by_user(user_uuid, conn).await {
            folder.delete(conn).await?;
        }
        Ok(())
    }

-    pub async fn find_by_uuid_and_user(uuid: &FolderId, user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            folders::table
                .filter(folders::uuid.eq(uuid))
-                .filter(folders::user_uuid.eq(user_uuid))
                .first::<FolderDb>(conn)
                .ok()
                .from_db()
        }}
    }

-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            folders::table
                .filter(folders::user_uuid.eq(user_uuid))
@@ -179,7 +176,7 @@ impl FolderCipher {
        }}
    }

-    pub async fn delete_all_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(folders_ciphers::table.filter(folders_ciphers::cipher_uuid.eq(cipher_uuid)))
                .execute(conn)
@@ -187,7 +184,7 @@ impl FolderCipher {
        }}
    }

-    pub async fn delete_all_by_folder(folder_uuid: &FolderId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_folder(folder_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(folders_ciphers::table.filter(folders_ciphers::folder_uuid.eq(folder_uuid)))
                .execute(conn)
@@ -195,11 +192,7 @@ impl FolderCipher {
        }}
    }

-    pub async fn find_by_folder_and_cipher(
-        folder_uuid: &FolderId,
-        cipher_uuid: &CipherId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_folder_and_cipher(folder_uuid: &str, cipher_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            folders_ciphers::table
                .filter(folders_ciphers::folder_uuid.eq(folder_uuid))
@@ -210,7 +203,7 @@ impl FolderCipher {
        }}
    }

-    pub async fn find_by_folder(folder_uuid: &FolderId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_folder(folder_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            folders_ciphers::table
                .filter(folders_ciphers::folder_uuid.eq(folder_uuid))
@@ -222,32 +215,14 @@ impl FolderCipher {

    /// Return a vec with (cipher_uuid, folder_uuid)
    /// This is used during a full sync so we only need one query for all folder matches.
-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<(CipherId, FolderId)> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<(String, String)> {
        db_run! { conn: {
            folders_ciphers::table
                .inner_join(folders::table)
                .filter(folders::user_uuid.eq(user_uuid))
                .select(folders_ciphers::all_columns)
-                .load::<(CipherId, FolderId)>(conn)
+                .load::<(String, String)>(conn)
                .unwrap_or_default()
        }}
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct FolderId(String);
--- a/src/db/models/group.rs
+++ b/src/db/models/group.rs
@@ -1,10 +1,8 @@
-use super::{CollectionId, Membership, MembershipId, OrganizationId, User, UserId};
+use super::{User, UserOrgType, UserOrganization};
 use crate::api::EmptyResult;
 use crate::db::DbConn;
 use crate::error::MapResult;
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{AsRef, Deref, Display, From};
-use macros::UuidFromParam;
 use serde_json::Value;

 db_object! {
@@ -12,8 +10,8 @@ db_object! {
    #[diesel(table_name = groups)]
    #[diesel(primary_key(uuid))]
    pub struct Group {
-        pub uuid: GroupId,
-        pub organizations_uuid: OrganizationId,
+        pub uuid: String,
+        pub organizations_uuid: String,
        pub name: String,
        pub access_all: bool,
        pub external_id: Option<String>,
@@ -25,34 +23,28 @@ db_object! {
    #[diesel(table_name = collections_groups)]
    #[diesel(primary_key(collections_uuid, groups_uuid))]
    pub struct CollectionGroup {
-        pub collections_uuid: CollectionId,
-        pub groups_uuid: GroupId,
+        pub collections_uuid: String,
+        pub groups_uuid: String,
        pub read_only: bool,
        pub hide_passwords: bool,
-        pub manage: bool,
    }

    #[derive(Identifiable, Queryable, Insertable)]
    #[diesel(table_name = groups_users)]
    #[diesel(primary_key(groups_uuid, users_organizations_uuid))]
    pub struct GroupUser {
-        pub groups_uuid: GroupId,
-        pub users_organizations_uuid: MembershipId
+        pub groups_uuid: String,
+        pub users_organizations_uuid: String
    }
 }

 /// Local methods
 impl Group {
-    pub fn new(
-        organizations_uuid: OrganizationId,
-        name: String,
-        access_all: bool,
-        external_id: Option<String>,
-    ) -> Self {
+    pub fn new(organizations_uuid: String, name: String, access_all: bool, external_id: Option<String>) -> Self {
        let now = Utc::now().naive_utc();

        let mut new_model = Self {
-            uuid: GroupId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            organizations_uuid,
            name,
            access_all,
@@ -81,10 +73,7 @@ impl Group {
        })
    }

-    pub async fn to_json_details(&self, conn: &mut DbConn) -> Value {
-        // If both read_only and hide_passwords are false, then manage should be true
-        // You can't have an entry with read_only and manage, or hide_passwords and manage
-        // Or an entry with everything to false
+    pub async fn to_json_details(&self, user_org_type: &i32, conn: &mut DbConn) -> Value {
        let collections_groups: Vec<Value> = CollectionGroup::find_by_group(&self.uuid, conn)
            .await
            .iter()
@@ -93,7 +82,7 @@ impl Group {
                    "id": entry.collections_uuid,
                    "readOnly": entry.read_only,
                    "hidePasswords": entry.hide_passwords,
-                    "manage": entry.manage,
+                    "manage": *user_org_type >= UserOrgType::Admin || (*user_org_type == UserOrgType::Manager && !entry.read_only && !entry.hide_passwords)
                })
            })
            .collect();
@@ -119,38 +108,18 @@ impl Group {
 }

 impl CollectionGroup {
-    pub fn new(
-        collections_uuid: CollectionId,
-        groups_uuid: GroupId,
-        read_only: bool,
-        hide_passwords: bool,
-        manage: bool,
-    ) -> Self {
+    pub fn new(collections_uuid: String, groups_uuid: String, read_only: bool, hide_passwords: bool) -> Self {
        Self {
            collections_uuid,
            groups_uuid,
            read_only,
            hide_passwords,
-            manage,
        }
    }
-
-    pub fn to_json_details_for_group(&self) -> Value {
-        // If both read_only and hide_passwords are false, then manage should be true
-        // You can't have an entry with read_only and manage, or hide_passwords and manage
-        // Or an entry with everything to false
-        // For backwards compaibility and migration proposes we keep checking read_only and hide_password
-        json!({
-            "id": self.groups_uuid,
-            "readOnly": self.read_only,
-            "hidePasswords": self.hide_passwords,
-            "manage": self.manage || (!self.read_only && !self.hide_passwords),
-        })
-    }
 }

 impl GroupUser {
-    pub fn new(groups_uuid: GroupId, users_organizations_uuid: MembershipId) -> Self {
+    pub fn new(groups_uuid: String, users_organizations_uuid: String) -> Self {
        Self {
            groups_uuid,
            users_organizations_uuid,
@@ -194,27 +163,27 @@ impl Group {
        }
    }

-    pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_organization(org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for group in Self::find_by_organization(org_uuid, conn).await {
            group.delete(conn).await?;
        }
        Ok(())
    }

-    pub async fn find_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_organization(organizations_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            groups::table
-                .filter(groups::organizations_uuid.eq(org_uuid))
+                .filter(groups::organizations_uuid.eq(organizations_uuid))
                .load::<GroupDb>(conn)
                .expect("Error loading groups")
                .from_db()
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(organizations_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            groups::table
-                .filter(groups::organizations_uuid.eq(org_uuid))
+                .filter(groups::organizations_uuid.eq(organizations_uuid))
                .count()
                .first::<i64>(conn)
                .ok()
@@ -222,22 +191,17 @@ impl Group {
        }}
    }

-    pub async fn find_by_uuid_and_org(uuid: &GroupId, org_uuid: &OrganizationId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            groups::table
                .filter(groups::uuid.eq(uuid))
-                .filter(groups::organizations_uuid.eq(org_uuid))
                .first::<GroupDb>(conn)
                .ok()
                .from_db()
        }}
    }

-    pub async fn find_by_external_id_and_org(
-        external_id: &str,
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_external_id_and_org(external_id: &str, org_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            groups::table
                .filter(groups::external_id.eq(external_id))
@@ -248,7 +212,7 @@ impl Group {
        }}
    }
    //Returns all organizations the user has full access to
-    pub async fn get_orgs_by_user_with_full_access(user_uuid: &UserId, conn: &mut DbConn) -> Vec<OrganizationId> {
+    pub async fn gather_user_organizations_full_access(user_uuid: &str, conn: &mut DbConn) -> Vec<String> {
        db_run! { conn: {
            groups_users::table
                .inner_join(users_organizations::table.on(
@@ -261,12 +225,12 @@ impl Group {
                .filter(groups::access_all.eq(true))
                .select(groups::organizations_uuid)
                .distinct()
-                .load::<OrganizationId>(conn)
+                .load::<String>(conn)
                .expect("Error loading organization group full access information for user")
        }}
    }

-    pub async fn is_in_full_access_group(user_uuid: &UserId, org_uuid: &OrganizationId, conn: &mut DbConn) -> bool {
+    pub async fn is_in_full_access_group(user_uuid: &str, org_uuid: &str, conn: &mut DbConn) -> bool {
        db_run! { conn: {
            groups::table
                .inner_join(groups_users::table.on(
@@ -295,13 +259,13 @@ impl Group {
        }}
    }

-    pub async fn update_revision(uuid: &GroupId, conn: &mut DbConn) {
+    pub async fn update_revision(uuid: &str, conn: &mut DbConn) {
        if let Err(e) = Self::_update_revision(uuid, &Utc::now().naive_utc(), conn).await {
            warn!("Failed to update revision for {}: {:#?}", uuid, e);
        }
    }

-    async fn _update_revision(uuid: &GroupId, date: &NaiveDateTime, conn: &mut DbConn) -> EmptyResult {
+    async fn _update_revision(uuid: &str, date: &NaiveDateTime, conn: &mut DbConn) -> EmptyResult {
        db_run! {conn: {
            crate::util::retry(|| {
                diesel::update(groups::table.filter(groups::uuid.eq(uuid)))
@@ -328,7 +292,6 @@ impl CollectionGroup {
                        collections_groups::groups_uuid.eq(&self.groups_uuid),
                        collections_groups::read_only.eq(&self.read_only),
                        collections_groups::hide_passwords.eq(&self.hide_passwords),
-                        collections_groups::manage.eq(&self.manage),
                    ))
                    .execute(conn)
                {
@@ -343,7 +306,6 @@ impl CollectionGroup {
                                collections_groups::groups_uuid.eq(&self.groups_uuid),
                                collections_groups::read_only.eq(&self.read_only),
                                collections_groups::hide_passwords.eq(&self.hide_passwords),
-                                collections_groups::manage.eq(&self.manage),
                            ))
                            .execute(conn)
                            .map_res("Error adding group to collection")
@@ -358,14 +320,12 @@ impl CollectionGroup {
                        collections_groups::groups_uuid.eq(&self.groups_uuid),
                        collections_groups::read_only.eq(self.read_only),
                        collections_groups::hide_passwords.eq(self.hide_passwords),
-                        collections_groups::manage.eq(self.manage),
                    ))
                    .on_conflict((collections_groups::collections_uuid, collections_groups::groups_uuid))
                    .do_update()
                    .set((
                        collections_groups::read_only.eq(self.read_only),
                        collections_groups::hide_passwords.eq(self.hide_passwords),
-                        collections_groups::manage.eq(self.manage),
                    ))
                    .execute(conn)
                    .map_res("Error adding group to collection")
@@ -373,7 +333,7 @@ impl CollectionGroup {
        }
    }

-    pub async fn find_by_group(group_uuid: &GroupId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_group(group_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            collections_groups::table
                .filter(collections_groups::groups_uuid.eq(group_uuid))
@@ -383,7 +343,7 @@ impl CollectionGroup {
        }}
    }

-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            collections_groups::table
                .inner_join(groups_users::table.on(
@@ -400,7 +360,7 @@ impl CollectionGroup {
        }}
    }

-    pub async fn find_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_collection(collection_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            collections_groups::table
                .filter(collections_groups::collections_uuid.eq(collection_uuid))
@@ -426,7 +386,7 @@ impl CollectionGroup {
        }}
    }

-    pub async fn delete_all_by_group(group_uuid: &GroupId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_group(group_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let group_users = GroupUser::find_by_group(group_uuid, conn).await;
        for group_user in group_users {
            group_user.update_user_revision(conn).await;
@@ -440,7 +400,7 @@ impl CollectionGroup {
        }}
    }

-    pub async fn delete_all_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_collection(collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let collection_assigned_to_groups = CollectionGroup::find_by_collection(collection_uuid, conn).await;
        for collection_assigned_to_group in collection_assigned_to_groups {
            let group_users = GroupUser::find_by_group(&collection_assigned_to_group.groups_uuid, conn).await;
@@ -505,7 +465,7 @@ impl GroupUser {
        }
    }

-    pub async fn find_by_group(group_uuid: &GroupId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_group(group_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            groups_users::table
                .filter(groups_users::groups_uuid.eq(group_uuid))
@@ -515,10 +475,10 @@ impl GroupUser {
        }}
    }

-    pub async fn find_by_member(member_uuid: &MembershipId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(users_organizations_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            groups_users::table
-                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
+                .filter(groups_users::users_organizations_uuid.eq(users_organizations_uuid))
                .load::<GroupUserDb>(conn)
                .expect("Error loading groups for user")
                .from_db()
@@ -526,8 +486,8 @@ impl GroupUser {
    }

    pub async fn has_access_to_collection_by_member(
-        collection_uuid: &CollectionId,
-        member_uuid: &MembershipId,
+        collection_uuid: &str,
+        member_uuid: &str,
        conn: &mut DbConn,
    ) -> bool {
        db_run! { conn: {
@@ -543,11 +503,7 @@ impl GroupUser {
        }}
    }

-    pub async fn has_full_access_by_member(
-        org_uuid: &OrganizationId,
-        member_uuid: &MembershipId,
-        conn: &mut DbConn,
-    ) -> bool {
+    pub async fn has_full_access_by_member(org_uuid: &str, member_uuid: &str, conn: &mut DbConn) -> bool {
        db_run! { conn: {
            groups_users::table
                .inner_join(groups::table.on(
@@ -563,32 +519,32 @@ impl GroupUser {
    }

    pub async fn update_user_revision(&self, conn: &mut DbConn) {
-        match Membership::find_by_uuid(&self.users_organizations_uuid, conn).await {
-            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
-            None => warn!("Member could not be found!"),
+        match UserOrganization::find_by_uuid(&self.users_organizations_uuid, conn).await {
+            Some(user) => User::update_uuid_revision(&user.user_uuid, conn).await,
+            None => warn!("User could not be found!"),
        }
    }

-    pub async fn delete_by_group_and_member(
-        group_uuid: &GroupId,
-        member_uuid: &MembershipId,
+    pub async fn delete_by_group_id_and_user_id(
+        group_uuid: &str,
+        users_organizations_uuid: &str,
        conn: &mut DbConn,
    ) -> EmptyResult {
-        match Membership::find_by_uuid(member_uuid, conn).await {
-            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
-            None => warn!("Member could not be found!"),
+        match UserOrganization::find_by_uuid(users_organizations_uuid, conn).await {
+            Some(user) => User::update_uuid_revision(&user.user_uuid, conn).await,
+            None => warn!("User could not be found!"),
        };

        db_run! { conn: {
            diesel::delete(groups_users::table)
                .filter(groups_users::groups_uuid.eq(group_uuid))
-                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
+                .filter(groups_users::users_organizations_uuid.eq(users_organizations_uuid))
                .execute(conn)
                .map_res("Error deleting group users")
        }}
    }

-    pub async fn delete_all_by_group(group_uuid: &GroupId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_group(group_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let group_users = GroupUser::find_by_group(group_uuid, conn).await;
        for group_user in group_users {
            group_user.update_user_revision(conn).await;
@@ -602,35 +558,17 @@ impl GroupUser {
        }}
    }

-    pub async fn delete_all_by_member(member_uuid: &MembershipId, conn: &mut DbConn) -> EmptyResult {
-        match Membership::find_by_uuid(member_uuid, conn).await {
-            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
-            None => warn!("Member could not be found!"),
+    pub async fn delete_all_by_user(users_organizations_uuid: &str, conn: &mut DbConn) -> EmptyResult {
+        match UserOrganization::find_by_uuid(users_organizations_uuid, conn).await {
+            Some(user) => User::update_uuid_revision(&user.user_uuid, conn).await,
+            None => warn!("User could not be found!"),
        }

        db_run! { conn: {
            diesel::delete(groups_users::table)
-                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
+                .filter(groups_users::users_organizations_uuid.eq(users_organizations_uuid))
                .execute(conn)
                .map_res("Error deleting user groups")
        }}
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct GroupId(String);
--- a/src/db/models/mod.rs
+++ b/src/db/models/mod.rs
@@ -16,26 +16,20 @@ mod two_factor_duo_context;
 mod two_factor_incomplete;
 mod user;

-pub use self::attachment::{Attachment, AttachmentId};
-pub use self::auth_request::{AuthRequest, AuthRequestId};
-pub use self::cipher::{Cipher, CipherId, RepromptType};
-pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
-pub use self::device::{Device, DeviceId, DeviceType};
-pub use self::emergency_access::{EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType};
+pub use self::attachment::Attachment;
+pub use self::auth_request::AuthRequest;
+pub use self::cipher::Cipher;
+pub use self::collection::{Collection, CollectionCipher, CollectionUser};
+pub use self::device::{Device, DeviceType};
+pub use self::emergency_access::{EmergencyAccess, EmergencyAccessStatus, EmergencyAccessType};
 pub use self::event::{Event, EventType};
 pub use self::favorite::Favorite;
-pub use self::folder::{Folder, FolderCipher, FolderId};
-pub use self::group::{CollectionGroup, Group, GroupId, GroupUser};
-pub use self::org_policy::{OrgPolicy, OrgPolicyErr, OrgPolicyId, OrgPolicyType};
-pub use self::organization::{
-    Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization, OrganizationApiKey,
-    OrganizationId,
-};
-pub use self::send::{
-    id::{SendFileId, SendId},
-    Send, SendType,
-};
+pub use self::folder::{Folder, FolderCipher};
+pub use self::group::{CollectionGroup, Group, GroupUser};
+pub use self::org_policy::{OrgPolicy, OrgPolicyErr, OrgPolicyType};
+pub use self::organization::{Organization, OrganizationApiKey, UserOrgStatus, UserOrgType, UserOrganization};
+pub use self::send::{Send, SendType};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, User, UserId, UserKdfType, UserStampException};
+pub use self::user::{Invitation, User, UserKdfType, UserStampException};
--- a/src/db/models/org_policy.rs
+++ b/src/db/models/org_policy.rs
@@ -1,4 +1,3 @@
-use derive_more::{AsRef, From};
 use serde::Deserialize;
 use serde_json::Value;

@@ -6,15 +5,15 @@ use crate::api::EmptyResult;
 use crate::db::DbConn;
 use crate::error::MapResult;

-use super::{Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, TwoFactor, UserId};
+use super::{TwoFactor, UserOrgStatus, UserOrgType, UserOrganization};

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = org_policies)]
    #[diesel(primary_key(uuid))]
    pub struct OrgPolicy {
-        pub uuid: OrgPolicyId,
-        pub org_uuid: OrganizationId,
+        pub uuid: String,
+        pub org_uuid: String,
        pub atype: i32,
        pub enabled: bool,
        pub data: String,
@@ -63,9 +62,9 @@ pub enum OrgPolicyErr {

 /// Local methods
 impl OrgPolicy {
-    pub fn new(org_uuid: OrganizationId, atype: OrgPolicyType, data: String) -> Self {
+    pub fn new(org_uuid: String, atype: OrgPolicyType, data: String) -> Self {
        Self {
-            uuid: OrgPolicyId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            org_uuid,
            atype: atype as i32,
            enabled: false,
@@ -143,7 +142,17 @@ impl OrgPolicy {
        }}
    }

-    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
+        db_run! { conn: {
+            org_policies::table
+                .filter(org_policies::uuid.eq(uuid))
+                .first::<OrgPolicyDb>(conn)
+                .ok()
+                .from_db()
+        }}
+    }
+
+    pub async fn find_by_org(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            org_policies::table
                .filter(org_policies::org_uuid.eq(org_uuid))
@@ -153,7 +162,7 @@ impl OrgPolicy {
        }}
    }

-    pub async fn find_confirmed_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_confirmed_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            org_policies::table
                .inner_join(
@@ -162,7 +171,7 @@ impl OrgPolicy {
                            .and(users_organizations::user_uuid.eq(user_uuid)))
                )
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .select(org_policies::all_columns)
                .load::<OrgPolicyDb>(conn)
@@ -171,11 +180,7 @@ impl OrgPolicy {
        }}
    }

-    pub async fn find_by_org_and_type(
-        org_uuid: &OrganizationId,
-        policy_type: OrgPolicyType,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_org_and_type(org_uuid: &str, policy_type: OrgPolicyType, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            org_policies::table
                .filter(org_policies::org_uuid.eq(org_uuid))
@@ -186,7 +191,7 @@ impl OrgPolicy {
        }}
    }

-    pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_organization(org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(org_policies::table.filter(org_policies::org_uuid.eq(org_uuid)))
                .execute(conn)
@@ -195,7 +200,7 @@ impl OrgPolicy {
    }

    pub async fn find_accepted_and_confirmed_by_user_and_active_policy(
-        user_uuid: &UserId,
+        user_uuid: &str,
        policy_type: OrgPolicyType,
        conn: &mut DbConn,
    ) -> Vec<Self> {
@@ -207,10 +212,10 @@ impl OrgPolicy {
                            .and(users_organizations::user_uuid.eq(user_uuid)))
                )
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Accepted as i32)
+                    users_organizations::status.eq(UserOrgStatus::Accepted as i32)
                )
                .or_filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .filter(org_policies::atype.eq(policy_type as i32))
                .filter(org_policies::enabled.eq(true))
@@ -222,7 +227,7 @@ impl OrgPolicy {
    }

    pub async fn find_confirmed_by_user_and_active_policy(
-        user_uuid: &UserId,
+        user_uuid: &str,
        policy_type: OrgPolicyType,
        conn: &mut DbConn,
    ) -> Vec<Self> {
@@ -234,7 +239,7 @@ impl OrgPolicy {
                            .and(users_organizations::user_uuid.eq(user_uuid)))
                )
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .filter(org_policies::atype.eq(policy_type as i32))
                .filter(org_policies::enabled.eq(true))
@@ -249,21 +254,21 @@ impl OrgPolicy {
    /// and the user is not an owner or admin of that org. This is only useful for checking
    /// applicability of policy types that have these particular semantics.
    pub async fn is_applicable_to_user(
-        user_uuid: &UserId,
+        user_uuid: &str,
        policy_type: OrgPolicyType,
-        exclude_org_uuid: Option<&OrganizationId>,
+        exclude_org_uuid: Option<&str>,
        conn: &mut DbConn,
    ) -> bool {
        for policy in
            OrgPolicy::find_accepted_and_confirmed_by_user_and_active_policy(user_uuid, policy_type, conn).await
        {
            // Check if we need to skip this organization.
-            if exclude_org_uuid.is_some() && *exclude_org_uuid.unwrap() == policy.org_uuid {
+            if exclude_org_uuid.is_some() && exclude_org_uuid.unwrap() == policy.org_uuid {
                continue;
            }

-            if let Some(user) = Membership::find_by_user_and_org(user_uuid, &policy.org_uuid, conn).await {
-                if user.atype < MembershipType::Admin {
+            if let Some(user) = UserOrganization::find_by_user_and_org(user_uuid, &policy.org_uuid, conn).await {
+                if user.atype < UserOrgType::Admin {
                    return true;
                }
            }
@@ -272,8 +277,8 @@ impl OrgPolicy {
    }

    pub async fn is_user_allowed(
-        user_uuid: &UserId,
-        org_uuid: &OrganizationId,
+        user_uuid: &str,
+        org_uuid: &str,
        exclude_current_org: bool,
        conn: &mut DbConn,
    ) -> OrgPolicyResult {
@@ -301,7 +306,7 @@ impl OrgPolicy {
        Ok(())
    }

-    pub async fn org_is_reset_password_auto_enroll(org_uuid: &OrganizationId, conn: &mut DbConn) -> bool {
+    pub async fn org_is_reset_password_auto_enroll(org_uuid: &str, conn: &mut DbConn) -> bool {
        match OrgPolicy::find_by_org_and_type(org_uuid, OrgPolicyType::ResetPassword, conn).await {
            Some(policy) => match serde_json::from_str::<ResetPasswordDataModel>(&policy.data) {
                Ok(opts) => {
@@ -317,12 +322,12 @@ impl OrgPolicy {

    /// Returns true if the user belongs to an org that has enabled the `DisableHideEmail`
    /// option of the `Send Options` policy, and the user is not an owner or admin of that org.
-    pub async fn is_hide_email_disabled(user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_hide_email_disabled(user_uuid: &str, conn: &mut DbConn) -> bool {
        for policy in
            OrgPolicy::find_confirmed_by_user_and_active_policy(user_uuid, OrgPolicyType::SendOptions, conn).await
        {
-            if let Some(user) = Membership::find_by_user_and_org(user_uuid, &policy.org_uuid, conn).await {
-                if user.atype < MembershipType::Admin {
+            if let Some(user) = UserOrganization::find_by_user_and_org(user_uuid, &policy.org_uuid, conn).await {
+                if user.atype < UserOrgType::Admin {
                    match serde_json::from_str::<SendOptionsPolicyData>(&policy.data) {
                        Ok(opts) => {
                            if opts.disable_hide_email {
@@ -337,19 +342,12 @@ impl OrgPolicy {
        false
    }

-    pub async fn is_enabled_for_member(
-        member_uuid: &MembershipId,
-        policy_type: OrgPolicyType,
-        conn: &mut DbConn,
-    ) -> bool {
-        if let Some(member) = Membership::find_by_uuid(member_uuid, conn).await {
-            if let Some(policy) = OrgPolicy::find_by_org_and_type(&member.org_uuid, policy_type, conn).await {
+    pub async fn is_enabled_for_member(org_user_uuid: &str, policy_type: OrgPolicyType, conn: &mut DbConn) -> bool {
+        if let Some(membership) = UserOrganization::find_by_uuid(org_user_uuid, conn).await {
+            if let Some(policy) = OrgPolicy::find_by_org_and_type(&membership.org_uuid, policy_type, conn).await {
                return policy.enabled;
            }
        }
        false
    }
 }
-
-#[derive(Clone, Debug, AsRef, DieselNewType, From, FromForm, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct OrgPolicyId(String);
--- a/src/db/models/organization.rs
+++ b/src/db/models/organization.rs
--- a/src/db/models/send.rs
+++ b/src/db/models/send.rs
@@ -3,8 +3,7 @@ use serde_json::Value;

 use crate::util::LowerCase;

-use super::{OrganizationId, User, UserId};
-use id::SendId;
+use super::User;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -12,10 +11,11 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct Send {
-        pub uuid: SendId,
+        pub uuid: String,
+
+        pub user_uuid: Option<String>,
+        pub organization_uuid: Option<String>,

-        pub user_uuid: Option<UserId>,
-        pub organization_uuid: Option<OrganizationId>,

        pub name: String,
        pub notes: Option<String>,
@@ -51,7 +51,7 @@ impl Send {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: SendId::from(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            user_uuid: None,
            organization_uuid: None,

@@ -243,7 +243,7 @@ impl Send {
        }
    }

-    pub async fn update_users_revision(&self, conn: &mut DbConn) -> Vec<UserId> {
+    pub async fn update_users_revision(&self, conn: &mut DbConn) -> Vec<String> {
        let mut user_uuids = Vec::new();
        match &self.user_uuid {
            Some(user_uuid) => {
@@ -257,7 +257,7 @@ impl Send {
        user_uuids
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for send in Self::find_by_user(user_uuid, conn).await {
            send.delete(conn).await?;
        }
@@ -268,19 +268,20 @@ impl Send {
        use data_encoding::BASE64URL_NOPAD;
        use uuid::Uuid;

-        let Ok(uuid_vec) = BASE64URL_NOPAD.decode(access_id.as_bytes()) else {
-            return None;
+        let uuid_vec = match BASE64URL_NOPAD.decode(access_id.as_bytes()) {
+            Ok(v) => v,
+            Err(_) => return None,
        };

        let uuid = match Uuid::from_slice(&uuid_vec) {
-            Ok(u) => SendId::from(u.to_string()),
+            Ok(u) => u.to_string(),
            Err(_) => return None,
        };

        Self::find_by_uuid(&uuid, conn).await
    }

-    pub async fn find_by_uuid(uuid: &SendId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            sends::table
                .filter(sends::uuid.eq(uuid))
@@ -290,18 +291,7 @@ impl Send {
        }}
    }

-    pub async fn find_by_uuid_and_user(uuid: &SendId, user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
-        db_run! {conn: {
-            sends::table
-                .filter(sends::uuid.eq(uuid))
-                .filter(sends::user_uuid.eq(user_uuid))
-                .first::<SendDb>(conn)
-                .ok()
-                .from_db()
-        }}
-    }
-
-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            sends::table
                .filter(sends::user_uuid.eq(user_uuid))
@@ -309,7 +299,7 @@ impl Send {
        }}
    }

-    pub async fn size_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Option<i64> {
+    pub async fn size_by_user(user_uuid: &str, conn: &mut DbConn) -> Option<i64> {
        let sends = Self::find_by_user(user_uuid, conn).await;

        #[derive(serde::Deserialize)]
@@ -332,7 +322,7 @@ impl Send {
        Some(total)
    }

-    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_org(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            sends::table
                .filter(sends::organization_uuid.eq(org_uuid))
@@ -349,48 +339,3 @@ impl Send {
        }}
    }
 }
-
-// separate namespace to avoid name collision with std::marker::Send
-pub mod id {
-    use derive_more::{AsRef, Deref, Display, From};
-    use macros::{IdFromParam, UuidFromParam};
-    use std::marker::Send;
-    use std::path::Path;
-
-    #[derive(
-        Clone,
-        Debug,
-        AsRef,
-        Deref,
-        DieselNewType,
-        Display,
-        From,
-        FromForm,
-        Hash,
-        PartialEq,
-        Eq,
-        Serialize,
-        Deserialize,
-        UuidFromParam,
-    )]
-    pub struct SendId(String);
-
-    impl AsRef<Path> for SendId {
-        #[inline]
-        fn as_ref(&self) -> &Path {
-            Path::new(&self.0)
-        }
-    }
-
-    #[derive(
-        Clone, Debug, AsRef, Deref, Display, From, FromForm, Hash, PartialEq, Eq, Serialize, Deserialize, IdFromParam,
-    )]
-    pub struct SendFileId(String);
-
-    impl AsRef<Path> for SendFileId {
-        #[inline]
-        fn as_ref(&self) -> &Path {
-            Path::new(&self.0)
-        }
-    }
-}
--- a/src/db/models/two_factor.rs
+++ b/src/db/models/two_factor.rs
@@ -1,6 +1,5 @@
 use serde_json::Value;

-use super::UserId;
 use crate::{api::EmptyResult, db::DbConn, error::MapResult};

 db_object! {
@@ -8,8 +7,8 @@ db_object! {
    #[diesel(table_name = twofactor)]
    #[diesel(primary_key(uuid))]
    pub struct TwoFactor {
-        pub uuid: TwoFactorId,
-        pub user_uuid: UserId,
+        pub uuid: String,
+        pub user_uuid: String,
        pub atype: i32,
        pub enabled: bool,
        pub data: String,
@@ -42,9 +41,9 @@ pub enum TwoFactorType {

 /// Local methods
 impl TwoFactor {
-    pub fn new(user_uuid: UserId, atype: TwoFactorType, data: String) -> Self {
+    pub fn new(user_uuid: String, atype: TwoFactorType, data: String) -> Self {
        Self {
-            uuid: TwoFactorId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            user_uuid,
            atype: atype as i32,
            enabled: true,
@@ -119,7 +118,7 @@ impl TwoFactor {
        }}
    }

-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            twofactor::table
                .filter(twofactor::user_uuid.eq(user_uuid))
@@ -130,7 +129,7 @@ impl TwoFactor {
        }}
    }

-    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: i32, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_user_and_type(user_uuid: &str, atype: i32, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            twofactor::table
                .filter(twofactor::user_uuid.eq(user_uuid))
@@ -141,7 +140,7 @@ impl TwoFactor {
        }}
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(twofactor::table.filter(twofactor::user_uuid.eq(user_uuid)))
                .execute(conn)
@@ -218,6 +217,3 @@ impl TwoFactor {
        Ok(())
    }
 }
-
-#[derive(Clone, Debug, DieselNewType, FromForm, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct TwoFactorId(String);
--- a/src/db/models/two_factor_incomplete.rs
+++ b/src/db/models/two_factor_incomplete.rs
@@ -1,26 +1,17 @@
 use chrono::{NaiveDateTime, Utc};

-use crate::{
-    api::EmptyResult,
-    auth::ClientIp,
-    db::{
-        models::{DeviceId, UserId},
-        DbConn,
-    },
-    error::MapResult,
-    CONFIG,
-};
+use crate::{api::EmptyResult, auth::ClientIp, db::DbConn, error::MapResult, CONFIG};

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = twofactor_incomplete)]
    #[diesel(primary_key(user_uuid, device_uuid))]
    pub struct TwoFactorIncomplete {
-        pub user_uuid: UserId,
+        pub user_uuid: String,
        // This device UUID is simply what's claimed by the device. It doesn't
        // necessarily correspond to any UUID in the devices table, since a device
        // must complete 2FA login before being added into the devices table.
-        pub device_uuid: DeviceId,
+        pub device_uuid: String,
        pub device_name: String,
        pub device_type: i32,
        pub login_time: NaiveDateTime,
@@ -30,8 +21,8 @@ db_object! {

 impl TwoFactorIncomplete {
    pub async fn mark_incomplete(
-        user_uuid: &UserId,
-        device_uuid: &DeviceId,
+        user_uuid: &str,
+        device_uuid: &str,
        device_name: &str,
        device_type: i32,
        ip: &ClientIp,
@@ -64,7 +55,7 @@ impl TwoFactorIncomplete {
        }}
    }

-    pub async fn mark_complete(user_uuid: &UserId, device_uuid: &DeviceId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn mark_complete(user_uuid: &str, device_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
            return Ok(());
        }
@@ -72,11 +63,7 @@ impl TwoFactorIncomplete {
        Self::delete_by_user_and_device(user_uuid, device_uuid, conn).await
    }

-    pub async fn find_by_user_and_device(
-        user_uuid: &UserId,
-        device_uuid: &DeviceId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_user_and_device(user_uuid: &str, device_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            twofactor_incomplete::table
                .filter(twofactor_incomplete::user_uuid.eq(user_uuid))
@@ -101,11 +88,7 @@ impl TwoFactorIncomplete {
        Self::delete_by_user_and_device(&self.user_uuid, &self.device_uuid, conn).await
    }

-    pub async fn delete_by_user_and_device(
-        user_uuid: &UserId,
-        device_uuid: &DeviceId,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn delete_by_user_and_device(user_uuid: &str, device_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(twofactor_incomplete::table
                           .filter(twofactor_incomplete::user_uuid.eq(user_uuid))
@@ -115,7 +98,7 @@ impl TwoFactorIncomplete {
        }}
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(twofactor_incomplete::table.filter(twofactor_incomplete::user_uuid.eq(user_uuid)))
                .execute(conn)
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -1,19 +1,9 @@
+use crate::util::{format_date, get_uuid, retry};
 use chrono::{NaiveDateTime, TimeDelta, Utc};
-use derive_more::{AsRef, Deref, Display, From};
 use serde_json::Value;

-use super::{
-    Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor, TwoFactorIncomplete,
-};
-use crate::{
-    api::EmptyResult,
-    crypto,
-    db::DbConn,
-    error::MapResult,
-    util::{format_date, get_uuid, retry},
-    CONFIG,
-};
-use macros::UuidFromParam;
+use crate::crypto;
+use crate::CONFIG;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -21,7 +11,7 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct User {
-        pub uuid: UserId,
+        pub uuid: String,
        pub enabled: bool,
        pub created_at: NaiveDateTime,
        pub updated_at: NaiveDateTime,
@@ -101,7 +91,7 @@ impl User {
        let email = email.to_lowercase();

        Self {
-            uuid: UserId(get_uuid()),
+            uuid: get_uuid(),
            enabled: true,
            created_at: now,
            updated_at: now,
@@ -224,11 +214,20 @@ impl User {
    }
 }

+use super::{
+    Cipher, Device, EmergencyAccess, Favorite, Folder, Send, TwoFactor, TwoFactorIncomplete, UserOrgType,
+    UserOrganization,
+};
+use crate::db::DbConn;
+
+use crate::api::EmptyResult;
+use crate::error::MapResult;
+
 /// Database methods
 impl User {
    pub async fn to_json(&self, conn: &mut DbConn) -> Value {
        let mut orgs_json = Vec::new();
-        for c in Membership::find_confirmed_by_user(&self.uuid, conn).await {
+        for c in UserOrganization::find_confirmed_by_user(&self.uuid, conn).await {
            orgs_json.push(c.to_json(conn).await);
        }

@@ -267,8 +266,8 @@ impl User {
    }

    pub async fn save(&mut self, conn: &mut DbConn) -> EmptyResult {
-        if !crate::util::is_valid_email(&self.email) {
-            err!(format!("User email {} is not a valid email address", self.email))
+        if self.email.trim().is_empty() {
+            err!("User email can't be empty")
        }

        self.updated_at = Utc::now().naive_utc();
@@ -305,18 +304,19 @@ impl User {
    }

    pub async fn delete(self, conn: &mut DbConn) -> EmptyResult {
-        for member in Membership::find_confirmed_by_user(&self.uuid, conn).await {
-            if member.atype == MembershipType::Owner
-                && Membership::count_confirmed_by_org_and_type(&member.org_uuid, MembershipType::Owner, conn).await <= 1
+        for user_org in UserOrganization::find_confirmed_by_user(&self.uuid, conn).await {
+            if user_org.atype == UserOrgType::Owner
+                && UserOrganization::count_confirmed_by_org_and_type(&user_org.org_uuid, UserOrgType::Owner, conn).await
+                    <= 1
            {
                err!("Can't delete last owner")
            }
        }

-        super::Send::delete_all_by_user(&self.uuid, conn).await?;
+        Send::delete_all_by_user(&self.uuid, conn).await?;
        EmergencyAccess::delete_all_by_user(&self.uuid, conn).await?;
        EmergencyAccess::delete_all_by_grantee_email(&self.email, conn).await?;
-        Membership::delete_all_by_user(&self.uuid, conn).await?;
+        UserOrganization::delete_all_by_user(&self.uuid, conn).await?;
        Cipher::delete_all_by_user(&self.uuid, conn).await?;
        Favorite::delete_all_by_user(&self.uuid, conn).await?;
        Folder::delete_all_by_user(&self.uuid, conn).await?;
@@ -332,7 +332,7 @@ impl User {
        }}
    }

-    pub async fn update_uuid_revision(uuid: &UserId, conn: &mut DbConn) {
+    pub async fn update_uuid_revision(uuid: &str, conn: &mut DbConn) {
        if let Err(e) = Self::_update_revision(uuid, &Utc::now().naive_utc(), conn).await {
            warn!("Failed to update revision for {}: {:#?}", uuid, e);
        }
@@ -357,7 +357,7 @@ impl User {
        Self::_update_revision(&self.uuid, &self.updated_at, conn).await
    }

-    async fn _update_revision(uuid: &UserId, date: &NaiveDateTime, conn: &mut DbConn) -> EmptyResult {
+    async fn _update_revision(uuid: &str, date: &NaiveDateTime, conn: &mut DbConn) -> EmptyResult {
        db_run! {conn: {
            retry(|| {
                diesel::update(users::table.filter(users::uuid.eq(uuid)))
@@ -379,7 +379,7 @@ impl User {
        }}
    }

-    pub async fn find_by_uuid(uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            users::table.filter(users::uuid.eq(uuid)).first::<UserDb>(conn).ok().from_db()
        }}
@@ -408,8 +408,8 @@ impl Invitation {
    }

    pub async fn save(&self, conn: &mut DbConn) -> EmptyResult {
-        if !crate::util::is_valid_email(&self.email) {
-            err!(format!("Invitation email {} is not a valid email address", self.email))
+        if self.email.trim().is_empty() {
+            err!("Invitation email can't be empty")
        }

        db_run! {conn:
@@ -458,23 +458,3 @@ impl Invitation {
        }
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    DieselNewType,
-    FromForm,
-    PartialEq,
-    Eq,
-    Hash,
-    Serialize,
-    Deserialize,
-    AsRef,
-    Deref,
-    Display,
-    From,
-    UuidFromParam,
-)]
-#[deref(forward)]
-#[from(forward)]
-pub struct UserId(String);
--- a/src/db/schemas/mysql/schema.rs
+++ b/src/db/schemas/mysql/schema.rs
@@ -226,7 +226,6 @@ table! {
        collection_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

@@ -296,7 +295,6 @@ table! {
        groups_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

--- a/src/db/schemas/postgresql/schema.rs
+++ b/src/db/schemas/postgresql/schema.rs
@@ -226,7 +226,6 @@ table! {
        collection_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

@@ -296,7 +295,6 @@ table! {
        groups_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

--- a/src/db/schemas/sqlite/schema.rs
+++ b/src/db/schemas/sqlite/schema.rs
@@ -226,7 +226,6 @@ table! {
        collection_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

@@ -296,7 +295,6 @@ table! {
        groups_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

--- a/src/mail.rs
+++ b/src/mail.rs
@@ -1,6 +1,7 @@
+use std::str::FromStr;
+
 use chrono::NaiveDateTime;
 use percent_encoding::{percent_encode, NON_ALPHANUMERIC};
-use std::{env::consts::EXE_SUFFIX, str::FromStr};

 use lettre::{
    message::{Attachment, Body, Mailbox, Message, MultiPart, SinglePart},
@@ -16,7 +17,7 @@ use crate::{
        encode_jwt, generate_delete_claims, generate_emergency_access_invite_claims, generate_invite_claims,
        generate_verify_email_claims,
    },
-    db::models::{Device, DeviceType, EmergencyAccessId, MembershipId, OrganizationId, User, UserId},
+    db::models::{Device, DeviceType, User},
    error::Error,
    CONFIG,
 };
@@ -25,7 +26,7 @@ fn sendmail_transport() -> AsyncSendmailTransport<Tokio1Executor> {
    if let Some(command) = CONFIG.sendmail_command() {
        AsyncSendmailTransport::new_with_command(command)
    } else {
-        AsyncSendmailTransport::new_with_command(format!("sendmail{EXE_SUFFIX}"))
+        AsyncSendmailTransport::new()
    }
 }

@@ -95,31 +96,7 @@ fn smtp_transport() -> AsyncSmtpTransport<Tokio1Executor> {
    smtp_client.build()
 }

-// This will sanitize the string values by stripping all the html tags to prevent XSS and HTML Injections
-fn sanitize_data(data: &mut serde_json::Value) {
-    use regex::Regex;
-    use std::sync::LazyLock;
-    static RE: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"<[^>]+>").unwrap());
-
-    match data {
-        serde_json::Value::String(s) => *s = RE.replace_all(s, "").to_string(),
-        serde_json::Value::Object(obj) => {
-            for d in obj.values_mut() {
-                sanitize_data(d);
-            }
-        }
-        serde_json::Value::Array(arr) => {
-            for d in arr.iter_mut() {
-                sanitize_data(d);
-            }
-        }
-        _ => {}
-    }
-}
-
 fn get_text(template_name: &'static str, data: serde_json::Value) -> Result<(String, String, String), Error> {
-    let mut data = data;
-    sanitize_data(&mut data);
    let (subject_html, body_html) = get_template(&format!("{template_name}.html"), &data)?;
    let (_subject_text, body_text) = get_template(template_name, &data)?;
    Ok((subject_html, body_html, body_text))
@@ -139,10 +116,6 @@ fn get_template(template_name: &str, data: &serde_json::Value) -> Result<(String
        None => err!("Template doesn't contain body"),
    };

-    if text_split.next().is_some() {
-        err!("Template contains more than one body");
-    }
-
    Ok((subject, body))
 }

@@ -165,8 +138,8 @@ pub async fn send_password_hint(address: &str, hint: Option<String>) -> EmptyRes
    send_email(address, &subject, body_html, body_text).await
 }

-pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_delete_claims(user_id.to_string());
+pub async fn send_delete_account(address: &str, uuid: &str) -> EmptyResult {
+    let claims = generate_delete_claims(uuid.to_string());
    let delete_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -174,7 +147,7 @@ pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult
        json!({
            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
-            "user_id": user_id,
+            "user_id": uuid,
            "email": percent_encode(address.as_bytes(), NON_ALPHANUMERIC).to_string(),
            "token": delete_token,
        }),
@@ -183,8 +156,8 @@ pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult
    send_email(address, &subject, body_html, body_text).await
 }

-pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_verify_email_claims(user_id.clone());
+pub async fn send_verify_email(address: &str, uuid: &str) -> EmptyResult {
+    let claims = generate_verify_email_claims(uuid.to_string());
    let verify_email_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -192,7 +165,7 @@ pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {
        json!({
            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
-            "user_id": user_id,
+            "user_id": uuid,
            "email": percent_encode(address.as_bytes(), NON_ALPHANUMERIC).to_string(),
            "token": verify_email_token,
        }),
@@ -213,8 +186,8 @@ pub async fn send_welcome(address: &str) -> EmptyResult {
    send_email(address, &subject, body_html, body_text).await
 }

-pub async fn send_welcome_must_verify(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_verify_email_claims(user_id.clone());
+pub async fn send_welcome_must_verify(address: &str, uuid: &str) -> EmptyResult {
+    let claims = generate_verify_email_claims(uuid.to_string());
    let verify_email_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -222,7 +195,7 @@ pub async fn send_welcome_must_verify(address: &str, user_id: &UserId) -> EmptyR
        json!({
            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
-            "user_id": user_id,
+            "user_id": uuid,
            "token": verify_email_token,
        }),
    )?;
@@ -258,8 +231,8 @@ pub async fn send_single_org_removed_from_org(address: &str, org_name: &str) ->

 pub async fn send_invite(
    user: &User,
-    org_id: OrganizationId,
-    member_id: MembershipId,
+    org_id: Option<String>,
+    org_user_id: Option<String>,
    org_name: &str,
    invited_by_email: Option<String>,
 ) -> EmptyResult {
@@ -267,7 +240,7 @@ pub async fn send_invite(
        user.uuid.clone(),
        user.email.clone(),
        org_id.clone(),
-        member_id.clone(),
+        org_user_id.clone(),
        invited_by_email,
    );
    let invite_token = encode_jwt(&claims);
@@ -277,23 +250,25 @@ pub async fn send_invite(
        query_params
            .append_pair("email", &user.email)
            .append_pair("organizationName", org_name)
-            .append_pair("organizationId", &org_id)
-            .append_pair("organizationUserId", &member_id)
+            .append_pair("organizationId", org_id.as_deref().unwrap_or("_"))
+            .append_pair("organizationUserId", org_user_id.as_deref().unwrap_or("_"))
            .append_pair("token", &invite_token);
        if user.private_key.is_some() {
            query_params.append_pair("orgUserHasExistingUser", "true");
        }
    }

-    let Some(query_string) = query.query() else {
-        err!("Failed to build invite URL query parameters")
+    let query_string = match query.query() {
+        None => err!(format!("Failed to build invite URL query parameters")),
+        Some(query) => query,
    };

+    // `url.Url` would place the anchor `#` after the query parameters
+    let url = format!("{}/#/accept-organization/?{}", CONFIG.domain(), query_string);
    let (subject, body_html, body_text) = get_text(
        "email/send_org_invite",
        json!({
-            // `url.Url` would place the anchor `#` after the query parameters
-            "url": format!("{}/#/accept-organization/?{}", CONFIG.domain(), query_string),
+            "url": url,
            "img_src": CONFIG._smtp_img_src(),
            "org_name": org_name,
        }),
@@ -304,41 +279,30 @@ pub async fn send_invite(

 pub async fn send_emergency_access_invite(
    address: &str,
-    user_id: UserId,
-    emer_id: EmergencyAccessId,
+    uuid: &str,
+    emer_id: &str,
    grantor_name: &str,
    grantor_email: &str,
 ) -> EmptyResult {
    let claims = generate_emergency_access_invite_claims(
-        user_id,
+        String::from(uuid),
        String::from(address),
-        emer_id.clone(),
+        String::from(emer_id),
        String::from(grantor_name),
        String::from(grantor_email),
    );

-    // Build the query here to ensure proper escaping
-    let mut query = url::Url::parse("https://query.builder").unwrap();
-    {
-        let mut query_params = query.query_pairs_mut();
-        query_params
-            .append_pair("id", &emer_id.to_string())
-            .append_pair("name", grantor_name)
-            .append_pair("email", address)
-            .append_pair("token", &encode_jwt(&claims));
-    }
-
-    let Some(query_string) = query.query() else {
-        err!("Failed to build emergency invite URL query parameters")
-    };
+    let invite_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
        "email/send_emergency_access_invite",
        json!({
-            // `url.Url` would place the anchor `#` after the query parameters
-            "url": format!("{}/#/accept-emergency/?{query_string}", CONFIG.domain()),
+            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
+            "emer_id": emer_id,
+            "email": percent_encode(address.as_bytes(), NON_ALPHANUMERIC).to_string(),
            "grantor_name": grantor_name,
+            "token": invite_token,
        }),
    )?;

@@ -594,13 +558,13 @@ async fn send_with_selected_transport(email: Message) -> EmptyResult {
            // Match some common errors and make them more user friendly
            Err(e) => {
                if e.is_client() {
-                    debug!("Sendmail client error: {:?}", e);
+                    debug!("Sendmail client error: {:#?}", e);
                    err!(format!("Sendmail client error: {e}"));
                } else if e.is_response() {
-                    debug!("Sendmail response error: {:?}", e);
+                    debug!("Sendmail response error: {:#?}", e);
                    err!(format!("Sendmail response error: {e}"));
                } else {
-                    debug!("Sendmail error: {:?}", e);
+                    debug!("Sendmail error: {:#?}", e);
                    err!(format!("Sendmail error: {e}"));
                }
            }
--- a/src/main.rs
+++ b/src/main.rs
@@ -24,8 +24,6 @@ extern crate log;
 extern crate diesel;
 #[macro_use]
 extern crate diesel_migrations;
-#[macro_use]
-extern crate diesel_derive_newtype;

 use std::{
    collections::HashMap,
@@ -69,7 +67,7 @@ pub use util::is_running_in_container;

 #[rocket::main]
 async fn main() -> Result<(), Error> {
-    parse_args().await;
+    parse_args();
    launch_info();

    let level = init_logging()?;
@@ -117,7 +115,7 @@ PRESETS:                  m=         t=          p=

 pub const VERSION: Option<&str> = option_env!("VW_VERSION");

-async fn parse_args() {
+fn parse_args() {
    let mut pargs = pico_args::Arguments::from_env();
    let version = VERSION.unwrap_or("(Version info from Git not present)");

@@ -188,7 +186,7 @@ async fn parse_args() {
                exit(1);
            }
        } else if command == "backup" {
-            match backup_sqlite().await {
+            match backup_sqlite() {
                Ok(f) => {
                    println!("Backup to '{f}' was successful");
                    exit(0);
@@ -203,20 +201,25 @@ async fn parse_args() {
    }
 }

-async fn backup_sqlite() -> Result<String, Error> {
-    use crate::db::{backup_database, DbConnType};
-    if DbConnType::from_url(&CONFIG.database_url()).map(|t| t == DbConnType::sqlite).unwrap_or(false) {
-        // Establish a connection to the sqlite database
-        let mut conn = db::DbPool::from_config()
-            .expect("SQLite database connection failed")
-            .get()
-            .await
-            .expect("Unable to get SQLite db pool");
+fn backup_sqlite() -> Result<String, Error> {
+    #[cfg(sqlite)]
+    {
+        use crate::db::{backup_sqlite_database, DbConnType};
+        if DbConnType::from_url(&CONFIG.database_url()).map(|t| t == DbConnType::sqlite).unwrap_or(false) {
+            use diesel::Connection;
+            let url = CONFIG.database_url();

-        let backup_file = backup_database(&mut conn).await?;
-        Ok(backup_file)
-    } else {
-        err_silent!("The database type is not SQLite. Backups only works for SQLite databases")
+            // Establish a connection to the sqlite database
+            let mut conn = diesel::sqlite::SqliteConnection::establish(&url)?;
+            let backup_file = backup_sqlite_database(&mut conn)?;
+            Ok(backup_file)
+        } else {
+            err_silent!("The database type is not SQLite. Backups only works for SQLite databases")
+        }
+    }
+    #[cfg(not(sqlite))]
+    {
+        err_silent!("The 'sqlite' feature is not enabled. Backups only works for SQLite databases")
    }
 }

@@ -607,7 +610,7 @@ async fn launch_rocket(pool: db::DbPool, extra_debug: bool) -> Result<(), Error>
                // If we need more signals to act upon, we might want to use select! here.
                // With only one item to listen for this is enough.
                let _ = signal_user1.recv().await;
-                match backup_sqlite().await {
+                match backup_sqlite() {
                    Ok(f) => info!("Backup to '{f}' was successful"),
                    Err(e) => error!("Backup failed. {e:?}"),
                }
--- a/src/static/scripts/admin.css
+++ b/src/static/scripts/admin.css
@@ -38,8 +38,8 @@ img {
    max-width: 130px;
 }
 #users-table .vw-actions, #orgs-table .vw-actions {
-    min-width: 135px;
-    max-width: 140px;
+    min-width: 130px;
+    max-width: 130px;
 }
 #users-table .vw-org-cell {
    max-height: 120px;
--- a/src/static/scripts/admin_diagnostics.js
+++ b/src/static/scripts/admin_diagnostics.js
@@ -7,8 +7,6 @@ var timeCheck = false;
 var ntpTimeCheck = false;
 var domainCheck = false;
 var httpsCheck = false;
-var websocketCheck = false;
-var httpResponseCheck = false;

 // ================================
 // Date & Time Check
@@ -78,15 +76,18 @@ async function generateSupportString(event, dj) {
    event.preventDefault();
    event.stopPropagation();

-    let supportString = "### Your environment (Generated via diagnostics page)\n\n";
+    let supportString = "### Your environment (Generated via diagnostics page)\n";

    supportString += `* Vaultwarden version: v${dj.current_release}\n`;
    supportString += `* Web-vault version: v${dj.web_vault_version}\n`;
    supportString += `* OS/Arch: ${dj.host_os}/${dj.host_arch}\n`;
    supportString += `* Running within a container: ${dj.running_within_container} (Base: ${dj.container_base_image})\n`;
-    supportString += `* Database type: ${dj.db_type}\n`;
-    supportString += `* Database version: ${dj.db_version}\n`;
-    supportString += `* Environment settings overridden!: ${dj.overrides !== ""}\n`;
+    supportString += "* Environment settings overridden: ";
+    if (dj.overrides != "") {
+        supportString += "true\n";
+    } else {
+        supportString += "false\n";
+    }
    supportString += `* Uses a reverse proxy: ${dj.ip_header_exists}\n`;
    if (dj.ip_header_exists) {
        supportString += `* IP Header check: ${dj.ip_header_match} (${dj.ip_header_name})\n`;
@@ -98,12 +99,11 @@ async function generateSupportString(event, dj) {
    supportString += `* Server/NTP Time Check: ${ntpTimeCheck}\n`;
    supportString += `* Domain Configuration Check: ${domainCheck}\n`;
    supportString += `* HTTPS Check: ${httpsCheck}\n`;
-    if (dj.enable_websocket) {
-        supportString += `* Websocket Check: ${websocketCheck}\n`;
-    } else {
-        supportString += "* Websocket Check: disabled\n";
-    }
-    supportString += `* HTTP Response Checks: ${httpResponseCheck}\n`;
+    supportString += `* Database type: ${dj.db_type}\n`;
+    supportString += `* Database version: ${dj.db_version}\n`;
+    supportString += "* Clients used: \n";
+    supportString += "* Reverse proxy and version: \n";
+    supportString += "* Other relevant information: \n";

    const jsonResponse = await fetch(`${BASE_URL}/admin/diagnostics/config`, {
        "headers": { "Accept": "application/json" }
@@ -113,30 +113,10 @@ async function generateSupportString(event, dj) {
        throw new Error(jsonResponse);
    }
    const configJson = await jsonResponse.json();
+    supportString += "\n### Config (Generated via diagnostics page)\n<details><summary>Show Running Config</summary>\n";
+    supportString += `\n**Environment settings which are overridden:** ${dj.overrides}\n`;
+    supportString += "\n\n```json\n" + JSON.stringify(configJson, undefined, 2) + "\n```\n</details>\n";

-    // Start Config and Details section within a details block which is collapsed by default
-    supportString += "\n### Config & Details (Generated via diagnostics page)\n\n";
-    supportString += "<details><summary>Show Config & Details</summary>\n";
-
-    // Add overrides if they exists
-    if (dj.overrides != "") {
-        supportString += `\n**Environment settings which are overridden:** ${dj.overrides}\n`;
-    }
-
-    // Add http response check messages if they exists
-    if (httpResponseCheck === false) {
-        supportString += "\n**Failed HTTP Checks:**\n";
-        // We use `innerText` here since that will convert <br> into new-lines
-        supportString += "\n```yaml\n" + document.getElementById("http-response-errors").innerText.trim() + "\n```\n";
-    }
-
-    // Add the current config in json form
-    supportString += "\n**Config:**\n";
-    supportString += "\n```json\n" + JSON.stringify(configJson, undefined, 2) + "\n```\n";
-
-    supportString += "\n</details>\n";
-
-    // Add the support string to the textbox so it can be viewed and copied
    document.getElementById("support-string").textContent = supportString;
    document.getElementById("support-string").classList.remove("d-none");
    document.getElementById("copy-support").classList.remove("d-none");
@@ -219,165 +199,6 @@ function checkDns(dns_resolved) {
    }
 }

-async function fetchCheckUrl(url) {
-    try {
-        const response = await fetch(url);
-        return { headers: response.headers, status: response.status, text: await response.text() };
-    } catch (error) {
-        console.error(`Error fetching ${url}: ${error}`);
-        return { error };
-    }
-}
-
-function checkSecurityHeaders(headers, omit) {
-    let securityHeaders = {
-        "x-frame-options": ["SAMEORIGIN"],
-        "x-content-type-options": ["nosniff"],
-        "referrer-policy": ["same-origin"],
-        "x-xss-protection": ["0"],
-        "x-robots-tag": ["noindex", "nofollow"],
-        "cross-origin-resource-policy": ["same-origin"],
-        "content-security-policy": [
-            "default-src 'none'",
-            "font-src 'self'",
-            "manifest-src 'self'",
-            "base-uri 'self'",
-            "form-action 'self'",
-            "object-src 'self' blob:",
-            "script-src 'self' 'wasm-unsafe-eval'",
-            "style-src 'self' 'unsafe-inline'",
-            "child-src 'self' https://*.duosecurity.com https://*.duofederal.com",
-            "frame-src 'self' https://*.duosecurity.com https://*.duofederal.com",
-            "frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://*",
-            "img-src 'self' data: https://haveibeenpwned.com",
-            "connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net",
-        ]
-    };
-
-    let messages = [];
-    for (let header in securityHeaders) {
-        // Skip some headers for specific endpoints if needed
-        if (typeof omit === "object" && omit.includes(header) === true) {
-            continue;
-        }
-        // If the header exists, check if the contents matches what we expect it to be
-        let headerValue = headers.get(header);
-        if (headerValue !== null) {
-            securityHeaders[header].forEach((expectedValue) => {
-                if (headerValue.indexOf(expectedValue) === -1) {
-                    messages.push(`'${header}' does not contain '${expectedValue}'`);
-                }
-            });
-        } else {
-            messages.push(`'${header}' is missing!`);
-        }
-    }
-    return messages;
-}
-
-async function checkHttpResponse() {
-    const [apiConfig, webauthnConnector, notFound, notFoundApi, badRequest, unauthorized, forbidden] = await Promise.all([
-        fetchCheckUrl(`${BASE_URL}/api/config`),
-        fetchCheckUrl(`${BASE_URL}/webauthn-connector.html`),
-        fetchCheckUrl(`${BASE_URL}/admin/does-not-exist`),
-        fetchCheckUrl(`${BASE_URL}/admin/diagnostics/http?code=404`),
-        fetchCheckUrl(`${BASE_URL}/admin/diagnostics/http?code=400`),
-        fetchCheckUrl(`${BASE_URL}/admin/diagnostics/http?code=401`),
-        fetchCheckUrl(`${BASE_URL}/admin/diagnostics/http?code=403`),
-    ]);
-
-    const respErrorElm = document.getElementById("http-response-errors");
-
-    // Check and validate the default API header responses
-    let apiErrors = checkSecurityHeaders(apiConfig.headers);
-    if (apiErrors.length >= 1) {
-        respErrorElm.innerHTML += "<b>API calls:</b><br>";
-        apiErrors.forEach((errMsg) => {
-            respErrorElm.innerHTML += `<b>Header:</b> ${errMsg}<br>`;
-        });
-    }
-
-    // Check the special `-connector.html` headers, these should have some headers omitted.
-    const omitConnectorHeaders = ["x-frame-options", "content-security-policy"];
-    let connectorErrors = checkSecurityHeaders(webauthnConnector.headers, omitConnectorHeaders);
-    omitConnectorHeaders.forEach((header) => {
-        if (webauthnConnector.headers.get(header) !== null) {
-            connectorErrors.push(`'${header}' is present while it should not`);
-        }
-    });
-    if (connectorErrors.length >= 1) {
-        respErrorElm.innerHTML += "<b>2FA Connector calls:</b><br>";
-        connectorErrors.forEach((errMsg) => {
-            respErrorElm.innerHTML += `<b>Header:</b> ${errMsg}<br>`;
-        });
-    }
-
-    // Check specific error code responses if they are not re-written by a reverse proxy
-    let responseErrors = [];
-    if (notFound.status !== 404 || notFound.text.indexOf("return to the web-vault") === -1) {
-        responseErrors.push("404 (Not Found) HTML is invalid");
-    }
-
-    if (notFoundApi.status !== 404 || notFoundApi.text.indexOf("\"message\":\"Testing error 404 response\",") === -1) {
-        responseErrors.push("404 (Not Found) JSON is invalid");
-    }
-
-    if (badRequest.status !== 400 || badRequest.text.indexOf("\"message\":\"Testing error 400 response\",") === -1) {
-        responseErrors.push("400 (Bad Request) is invalid");
-    }
-
-    if (unauthorized.status !== 401 || unauthorized.text.indexOf("\"message\":\"Testing error 401 response\",") === -1) {
-        responseErrors.push("401 (Unauthorized) is invalid");
-    }
-
-    if (forbidden.status !== 403 || forbidden.text.indexOf("\"message\":\"Testing error 403 response\",") === -1) {
-        responseErrors.push("403 (Forbidden) is invalid");
-    }
-
-    if (responseErrors.length >= 1) {
-        respErrorElm.innerHTML += "<b>HTTP error responses:</b><br>";
-        responseErrors.forEach((errMsg) => {
-            respErrorElm.innerHTML += `<b>Response to:</b> ${errMsg}<br>`;
-        });
-    }
-
-    if (responseErrors.length >= 1 || connectorErrors.length >= 1 || apiErrors.length >= 1) {
-        document.getElementById("http-response-warning").classList.remove("d-none");
-    } else {
-        httpResponseCheck = true;
-        document.getElementById("http-response-success").classList.remove("d-none");
-    }
-}
-
-async function fetchWsUrl(wsUrl) {
-    return new Promise((resolve, reject) => {
-        try {
-            const ws = new WebSocket(wsUrl);
-            ws.onopen = () => {
-                ws.close();
-                resolve(true);
-            };
-
-            ws.onerror = () => {
-                reject(false);
-            };
-        } catch (_) {
-            reject(false);
-        }
-    });
-}
-
-async function checkWebsocketConnection() {
-    // Test Websocket connections via the anonymous (login with device) connection
-    const isConnected = await fetchWsUrl(`${BASE_URL}/notifications/anonymous-hub?token=admin-diagnostics`).catch(() => false);
-    if (isConnected) {
-        websocketCheck = true;
-        document.getElementById("websocket-success").classList.remove("d-none");
-    } else {
-        document.getElementById("websocket-error").classList.remove("d-none");
-    }
-}
-
 function init(dj) {
    // Time check
    document.getElementById("time-browser-string").textContent = browserUTC;
@@ -404,12 +225,6 @@ function init(dj) {

    // DNS Check
    checkDns(dj.dns_resolved);
-
-    checkHttpResponse();
-
-    if (dj.enable_websocket) {
-        checkWebsocketConnection();
-    }
 }

 // onLoad events
--- a/src/static/scripts/admin_users.js
+++ b/src/static/scripts/admin_users.js
@@ -152,7 +152,7 @@ const ORG_TYPES = {
        "name": "User",
        "bg": "blue"
    },
-    "4": {
+    "3": {
        "name": "Manager",
        "bg": "green"
    },
--- a/src/static/scripts/datatables.css
+++ b/src/static/scripts/datatables.css
@@ -4,10 +4,10 @@
 *
 * To rebuild or modify this file with the latest versions of the included
 * software please visit:
- *   https://datatables.net/download/#bs5/dt-2.1.8
+ *   https://datatables.net/download/#bs5/dt-2.0.8
 *
 * Included libraries:
- *   DataTables 2.1.8
+ *   DataTables 2.0.8
 */

@charset "UTF-8";
@@ -45,21 +45,15 @@ table.dataTable tr.dt-hasChild td.dt-control:before {
 }

 html.dark table.dataTable td.dt-control:before,
-:root[data-bs-theme=dark] table.dataTable td.dt-control:before,
-:root[data-theme=dark] table.dataTable td.dt-control:before {
+:root[data-bs-theme=dark] table.dataTable td.dt-control:before {
  border-left-color: rgba(255, 255, 255, 0.5);
 }
 html.dark table.dataTable tr.dt-hasChild td.dt-control:before,
-:root[data-bs-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before,
-:root[data-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before {
+:root[data-bs-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before {
  border-top-color: rgba(255, 255, 255, 0.5);
  border-left-color: transparent;
 }

-div.dt-scroll {
-  width: 100%;
-}
-
 div.dt-scroll-body thead tr,
 div.dt-scroll-body tfoot tr {
  height: 0;
@@ -383,31 +377,6 @@ table.table.dataTable.table-hover > tbody > tr.selected:hover > * {
  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-selected), 0.975);
 }

-div.dt-container div.dt-layout-start > *:not(:last-child) {
-  margin-right: 1em;
-}
-div.dt-container div.dt-layout-end > *:not(:first-child) {
-  margin-left: 1em;
-}
-div.dt-container div.dt-layout-full {
-  width: 100%;
-}
-div.dt-container div.dt-layout-full > *:only-child {
-  margin-left: auto;
-  margin-right: auto;
-}
-div.dt-container div.dt-layout-table > div {
-  display: block !important;
-}
-
-@media screen and (max-width: 767px) {
-  div.dt-container div.dt-layout-start > *:not(:last-child) {
-    margin-right: 0;
-  }
-  div.dt-container div.dt-layout-end > *:not(:first-child) {
-    margin-left: 0;
-  }
-}
 div.dt-container div.dt-length label {
  font-weight: normal;
  text-align: left;
@@ -431,6 +400,9 @@ div.dt-container div.dt-search input {
  display: inline-block;
  width: auto;
 }
+div.dt-container div.dt-info {
+  padding-top: 0.85em;
+}
 div.dt-container div.dt-paging {
  margin: 0;
 }
--- a/src/static/scripts/datatables.js
+++ b/src/static/scripts/datatables.js
--- a/src/static/templates/admin/diagnostics.hbs
+++ b/src/static/templates/admin/diagnostics.hbs
@@ -132,21 +132,6 @@
                        <span class="d-block" title="We have direct internet access, no outgoing proxy configured."><b>No</b></span>
                    {{/unless}}
                    </dd>
-                    <dt class="col-sm-5">Websocket enabled
-                        {{#if page_data.enable_websocket}}
-                        <span class="badge bg-success d-none" id="websocket-success" title="Websocket connection is working.">Ok</span>
-                        <span class="badge bg-danger d-none" id="websocket-error" title="Websocket connection error, validate your reverse proxy configuration!">Error</span>
-                        {{/if}}
-                    </dt>
-                    <dd class="col-sm-7">
-                    {{#if page_data.enable_websocket}}
-                        <span class="d-block" title="Websocket connections are enabled (ENABLE_WEBSOCKET is true)."><b>Yes</b></span>
-                    {{/if}}
-                    {{#unless page_data.enable_websocket}}
-                        <span class="d-block" title="Websocket connections are disabled (ENABLE_WEBSOCKET is false)."><b>No</b></span>
-                    {{/unless}}
-                    </dd>
-
                    <dt class="col-sm-5">DNS (github.com)
                        <span class="badge bg-success d-none" id="dns-success" title="DNS Resolving works!">Ok</span>
                        <span class="badge bg-danger d-none" id="dns-warning" title="DNS Resolving failed. Please fix.">Error</span>
@@ -182,14 +167,6 @@
                        <span id="domain-server" class="d-block"><b>Server:</b> <span id="domain-server-string">{{page_data.admin_url}}</span></span>
                        <span id="domain-browser" class="d-block"><b>Browser:</b> <span id="domain-browser-string"></span></span>
                    </dd>
-
-                    <dt class="col-sm-5">HTTP Response validation
-                        <span class="badge bg-success d-none" id="http-response-success" title="All headers and HTTP request responses seem to be ok.">Ok</span>
-                        <span class="badge bg-danger d-none" id="http-response-warning" title="Some headers or HTTP request responses return invalid data!">Error</span>
-                    </dt>
-                    <dd class="col-sm-7">
-                        <span id="http-response-errors" class="d-block"></span>
-                    </dd>
                </dl>
            </div>
        </div>
--- a/src/static/templates/admin/users.hbs
+++ b/src/static/templates/admin/users.hbs
@@ -19,7 +19,7 @@
                    <tr>
                        <td>
                            <svg width="48" height="48" class="float-start me-2 rounded" data-jdenticon-value="{{email}}">
-                            <div>
+                            <div class="float-start">
                                <strong>{{name}}</strong>
                                <span class="d-block">{{email}}</span>
                                <span class="d-block">
--- a/src/static/templates/email/send_emergency_access_invite.hbs
+++ b/src/static/templates/email/send_emergency_access_invite.hbs
@@ -2,7 +2,7 @@ Emergency access for {{{grantor_name}}}
 <!---------------->
 You have been invited to become an emergency contact for {{grantor_name}}. To accept this invite, click the following link:

-Click here to join: {{{url}}}
+Click here to join: {{url}}/#/accept-emergency/?id={{emer_id}}&name={{grantor_name}}&email={{email}}&token={{token}}

 If you do not wish to become an emergency contact for {{grantor_name}}, you can safely ignore this email.
 {{> email/email_footer_text }}
--- a/src/static/templates/email/send_emergency_access_invite.html.hbs
+++ b/src/static/templates/email/send_emergency_access_invite.html.hbs
@@ -9,7 +9,7 @@ Emergency access for {{{grantor_name}}}
    </tr>
    <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
       <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none; text-align: center;" valign="top" align="center">
-          <a href="{{{url}}}"
+          <a href="{{url}}/#/accept-emergency/?id={{emer_id}}&name={{grantor_name}}&email={{email}}&token={{token}}"
             clicktracking=off target="_blank" style="color: #ffffff; text-decoration: none; text-align: center; cursor: pointer; display: inline-block; border-radius: 5px; background-color: #3c8dbc; border-color: #3c8dbc; border-style: solid; border-width: 10px 20px; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
          Become emergency contact
          </a>
@@ -21,4 +21,4 @@ Emergency access for {{{grantor_name}}}
       </td>
    </tr>
 </table>
-{{> email/email_footer }}
+{{> email/email_footer }}
--- a/src/static/templates/scss/user.vaultwarden.scss.hbs
+++ b/src/static/templates/scss/user.vaultwarden.scss.hbs
@@ -1 +0,0 @@
-/* See the wiki for examples and details: https://github.com/dani-garcia/vaultwarden/wiki/Customize-Vaultwarden-CSS */
--- a/src/static/templates/scss/vaultwarden.scss.hbs
+++ b/src/static/templates/scss/vaultwarden.scss.hbs
@@ -1,134 +0,0 @@
-/**** START Static Vaultwarden changes ****/
-/* This combines all selectors extending it into one */
-%vw-hide {
-  display: none !important;
-}
-
-/* This allows searching for the combined style in the browsers dev-tools (look into the head tag) */
-.vw-hide,
-head {
-  @extend %vw-hide;
-}
-
-/* Hide the Subscription Page tab */
-bit-nav-item[route="settings/subscription"] {
-  @extend %vw-hide;
-}
-
-/* Hide any link pointing to Free Bitwarden Families */
-a[href$="/settings/sponsored-families"] {
-  @extend %vw-hide;
-}
-
-/* Hide the `Enterprise Single Sign-On` button on the login page */
-a[routerlink="/sso"] {
-  @extend %vw-hide;
-}
-
-/* Hide Two-Factor menu in Organization settings */
-bit-nav-item[route="settings/two-factor"],
-a[href$="/settings/two-factor"] {
-  @extend %vw-hide;
-}
-
-/* Hide Business Owned checkbox */
-app-org-info > form:nth-child(1) > div:nth-child(3) {
-  @extend %vw-hide;
-}
-
-/* Hide the `This account is owned by a business` checkbox and label */
-#ownedBusiness,
-label[for^="ownedBusiness"] {
-  @extend %vw-hide;
-}
-
-/* Hide Business Name */
-app-org-account form div bit-form-field.tw-block:nth-child(3) {
-  @extend %vw-hide;
-}
-
-/* Hide organization plans */
-app-organization-plans > form > bit-section:nth-child(2) {
-  @extend %vw-hide;
-}
-
-/* Hide Collection Management Form */
-app-org-account form.ng-untouched:nth-child(6) {
-  @extend %vw-hide;
-}
-
-/* Hide 'Member Access' Report Card from Org Reports */
-app-org-reports-home > app-report-list > div.tw-inline-grid > div:nth-child(6) {
-  @extend %vw-hide;
-}
-
-/* Hide Device Verification form at the Two Step Login screen */
-app-security > app-two-factor-setup > form {
-  @extend %vw-hide;
-}
-
-/* Hide unsupported Custom Role options */
-bit-dialog div.tw-ml-4:has(bit-form-control input),
-bit-dialog div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) {
-  @extend %vw-hide;
-}
-
-/* Hide Log in with passkey */
-app-login div.tw-flex:nth-child(4) {
-  @extend %vw-hide;
-}
-
-/* Change collapsed menu icon to Vaultwarden */
-bit-nav-logo bit-nav-item a:before {
-  content: "";
-  background-image: url("../images/icon-white.svg");
-  background-repeat: no-repeat;
-  background-position: center center;
-  height: 32px;
-  display: block;
-}
-bit-nav-logo bit-nav-item .bwi-shield {
-  @extend %vw-hide;
-}
-/**** END Static Vaultwarden Changes ****/
-/**** START Dynamic Vaultwarden Changes ****/
-{{#if signup_disabled}}
-/* Hide the register link on the login screen */
-app-login form div + div + div + div + hr,
-app-login form div + div + div + div + hr + p {
-  @extend %vw-hide;
-}
-{{/if}}
-
-{{#unless mail_enabled}}
-/* Hide `Email` 2FA if mail is not enabled */
-app-two-factor-setup ul.list-group.list-group-2fa li.list-group-item:nth-child(1) {
-  @extend %vw-hide;
-}
-{{/unless}}
-
-{{#unless yubico_enabled}}
-/* Hide `YubiKey OTP security key` 2FA if it is not enabled */
-app-two-factor-setup ul.list-group.list-group-2fa li.list-group-item:nth-child(4) {
-  @extend %vw-hide;
-}
-{{/unless}}
-
-{{#unless emergency_access_allowed}}
-/* Hide Emergency Access if not allowed */
-bit-nav-item[route="settings/emergency-access"] {
-  @extend %vw-hide;
-}
-{{/unless}}
-
-{{#unless sends_allowed}}
-/* Hide Sends if not allowed */
-bit-nav-item[route="sends"] {
-  @extend %vw-hide;
-}
-{{/unless}}
-/**** End Dynamic Vaultwarden Changes ****/
-/**** Include a special user stylesheet for custom changes ****/
-{{#if load_user_scss}}
-{{> scss/user.vaultwarden.scss }}
-{{/if}}
--- a/src/util.rs
+++ b/src/util.rs
@@ -1,12 +1,13 @@
 //
 // Web Headers and caching
 //
-use std::{collections::HashMap, io::Cursor, path::Path};
+use std::{collections::HashMap, io::Cursor, ops::Deref, path::Path};

 use num_traits::ToPrimitive;
 use rocket::{
    fairing::{Fairing, Info, Kind},
    http::{ContentType, Header, HeaderMap, Method, Status},
+    request::FromParam,
    response::{self, Responder},
    Data, Orbit, Request, Response, Rocket,
 };
@@ -50,13 +51,9 @@ impl Fairing for AppHeaders {
            }
        }

-        // NOTE: When modifying or adding security headers be sure to also update the diagnostic checks in `src/static/scripts/admin_diagnostics.js` in `checkSecurityHeaders`
        res.set_raw_header("Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()");
        res.set_raw_header("Referrer-Policy", "same-origin");
        res.set_raw_header("X-Content-Type-Options", "nosniff");
-        res.set_raw_header("X-Robots-Tag", "noindex, nofollow");
-        res.set_raw_header("Cross-Origin-Resource-Policy", "same-origin");
-
        // Obsolete in modern browsers, unsafe (XS-Leak), and largely replaced by CSP
        res.set_raw_header("X-XSS-Protection", "0");

@@ -76,9 +73,7 @@ impl Fairing for AppHeaders {
            // # Mail Relay: https://bitwarden.com/blog/add-privacy-and-security-using-email-aliases-with-bitwarden/
            // app.simplelogin.io, app.addy.io, api.fastmail.com, quack.duckduckgo.com
            let csp = format!(
-                "default-src 'none'; \
-                font-src 'self'; \
-                manifest-src 'self'; \
+                "default-src 'self'; \
                base-uri 'self'; \
                form-action 'self'; \
                object-src 'self' blob:; \
@@ -101,11 +96,10 @@ impl Fairing for AppHeaders {
                  https://app.addy.io/api/ \
                  https://api.fastmail.com/ \
                  https://api.forwardemail.net \
-                  {allowed_connect_src};\
+                  ;\
                ",
                icon_service_csp = CONFIG._icon_service_csp(),
-                allowed_iframe_ancestors = CONFIG.allowed_iframe_ancestors(),
-                allowed_connect_src = CONFIG.allowed_connect_src(),
+                allowed_iframe_ancestors = CONFIG.allowed_iframe_ancestors()
            );
            res.set_raw_header("Content-Security-Policy", csp);
            res.set_raw_header("X-Frame-Options", "SAMEORIGIN");
@@ -226,6 +220,42 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for Cache
    }
 }

+pub struct SafeString(String);
+
+impl fmt::Display for SafeString {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+impl Deref for SafeString {
+    type Target = String;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl AsRef<Path> for SafeString {
+    #[inline]
+    fn as_ref(&self) -> &Path {
+        Path::new(&self.0)
+    }
+}
+
+impl<'r> FromParam<'r> for SafeString {
+    type Error = ();
+
+    #[inline(always)]
+    fn from_param(param: &'r str) -> Result<Self, Self::Error> {
+        if param.chars().all(|c| matches!(c, 'a'..='z' | 'A'..='Z' |'0'..='9' | '-')) {
+            Ok(SafeString(param.to_string()))
+        } else {
+            Err(())
+        }
+    }
+}
+
 // Log all the routes from the main paths list, and the attachments endpoint
 // Effectively ignores, any static file route, and the alive endpoint
 const LOGGED_ROUTES: [&str; 7] = ["/api", "/admin", "/identity", "/icons", "/attachments", "/events", "/notifications"];
@@ -408,19 +438,13 @@ pub fn get_env_bool(key: &str) -> Option<bool> {

 use chrono::{DateTime, Local, NaiveDateTime, TimeZone};

+// Format used by Bitwarden API
+const DATETIME_FORMAT: &str = "%Y-%m-%dT%H:%M:%S%.6fZ";
+
 /// Formats a UTC-offset `NaiveDateTime` in the format used by Bitwarden API
 /// responses with "date" fields (`CreationDate`, `RevisionDate`, etc.).
 pub fn format_date(dt: &NaiveDateTime) -> String {
-    dt.and_utc().to_rfc3339_opts(chrono::SecondsFormat::Micros, true)
-}
-
-/// Validates and formats a RFC3339 timestamp
-/// If parsing fails it will return the start of the unix datetime
-pub fn validate_and_format_date(dt: &str) -> String {
-    match DateTime::parse_from_rfc3339(dt) {
-        Ok(dt) => dt.to_rfc3339_opts(chrono::SecondsFormat::Micros, true),
-        _ => String::from("1970-01-01T00:00:00.000000Z"),
-    }
+    dt.format(DATETIME_FORMAT).to_string()
 }

 /// Formats a `DateTime<Local>` using the specified format string.
@@ -462,24 +486,7 @@ pub fn format_datetime_http(dt: &DateTime<Local>) -> String {
 }

 pub fn parse_date(date: &str) -> NaiveDateTime {
-    DateTime::parse_from_rfc3339(date).unwrap().naive_utc()
-}
-
-/// Returns true or false if an email address is valid or not
-///
-/// Some extra checks instead of only using email_address
-/// This prevents from weird email formats still excepted but in the end invalid
-pub fn is_valid_email(email: &str) -> bool {
-    let Ok(email) = email_address::EmailAddress::from_str(email) else {
-        return false;
-    };
-    let Ok(email_url) = url::Url::parse(&format!("https://{}", email.domain())) else {
-        return false;
-    };
-    if email_url.path().ne("/") || email_url.domain().is_none() || email_url.query().is_some() {
-        return false;
-    }
-    true
+    NaiveDateTime::parse_from_str(date, DATETIME_FORMAT).unwrap()
 }

 //
				`@@ -1 +0,0 @@`
				`/* See the wiki for examples and details: https://github.com/dani-garcia/vaultwarden/wiki/Customize-Vaultwarden-CSS */`