Update crates, Rust and other dependencies (#7814 )

- Update Rust to v1.99.0 - Updated GitHub Actions - Updated DataTables Signed-off-by: BlackDex <black.dex@gmail.com>
Align API behaviour with upstream and return errors on malformed input (#7810 )
2026-10-23 01:58:09 +03:00 · 2026-10-05 14:39:21 +02:00 · 2026-10-05 14:38:01 +02:00 · 2026-10-04 22:16:55 +02:00 · 2026-10-03 23:05:56 +02:00 · 2026-10-03 14:01:26 +02:00
163 changed files with 22696 additions and 28435 deletions
@@ -1,7 +1,7 @@
-// Ignore everything
+# Ignore everything
 *
-// Allow what is needed
+# Allow what is needed
 !.git
 !docker/healthcheck.sh
 !docker/start.sh
@@ -50,10 +50,11 @@
 #########################
 ## Database URL
-## When using SQLite, this is the path to the DB file, and it defaults to
+## When using SQLite, this should use the sqlite:// scheme followed by the path
-## %DATA_FOLDER%/db.sqlite3. If DATA_FOLDER is set to an external location, this
+## to the DB file. It defaults to sqlite://%DATA_FOLDER%/db.sqlite3.
-## must be set to a local sqlite3 file path.
+## Bare paths without the sqlite:// scheme are supported for backwards compatibility,
-# DATABASE_URL=data/db.sqlite3
+## but only if the database file already exists.
 # DATABASE_URL=sqlite://data/db.sqlite3
 ## When using MySQL, specify an appropriate connection URI.
 ## Details: https://docs.diesel.rs/2.1.x/diesel/mysql/struct.MysqlConnection.html
 # DATABASE_URL=mysql://user:password@host[:port]/database_name
@@ -179,7 +180,7 @@
 ## Defaults to every minute. Set blank to disable this job.
 # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
 ##
-## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
+## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
 ## Defaults to every minute. Set blank to disable this job.
 # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
 #
@@ -315,6 +316,14 @@
 ## unauthenticated access to potentially sensitive data.
 # SHOW_PASSWORD_HINT=false
 #########################
 ### Client settings  ###
 #########################
 ## Control whether clients onboarding interstitials are suppressed
 ## (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals)
 # CLIENT_SUPPRESS_ONBOARDING=false
 #########################
 ### Advanced settings ###
 #########################
@@ -323,6 +332,16 @@
 ## Set to the string "none" (without quotes), to disable any headers and just use the remote IP
 # IP_HEADER=X-Real-IP
 ## Which addresses the header above is accepted from, defaults to "local".
 ## Anyone able to reach Vaultwarden can set the header, and the client IP is used for the login and
 ## admin rate limits, so it is only trusted when the request comes from a proxy listed here.
 ## "local" accepts it from any non global address, which covers a reverse proxy running on the same
 ## host or container network. Use "all" to accept it from anywhere, or list the addresses of your
 ## proxy as IPs and CIDR ranges if it connects from a public address.
 ## For a list header like X-Forwarded-For, the client IP is the rightmost address that isn't one of
 ## these proxies, so with several proxies in a row (a CDN in front of nginx, for example) list all of them.
 # IP_HEADER_TRUSTED_PROXIES=local
 ## Icon service
 ## The predefined icon services are: internal, bitwarden, duckduckgo, google.
 ## To specify a custom icon service, set a URL template with exactly one instance of `{}`,
@@ -373,20 +392,13 @@
 ##
 ## The following flags are available:
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
-## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
+## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
 ## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
 ## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
 ## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
 ## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
 ## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
 ## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
 ## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
 ## - "pm-30529-webauthn-related-origins":
-## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
-## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
-## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
-## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -459,6 +471,13 @@
 ## Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2.
 # LOGIN_RATELIMIT_MAX_BURST=10
 ## Number of seconds, on average, between requests from the same IP address to one of the rate limited
 ## unauthenticated endpoints, like the password hint, the account recovery mails or accessing a Send.
 # UNAUTHENTICATED_RATELIMIT_SECONDS=60
 ## Allow a burst of requests of up to this size, while maintaining the average indicated by `UNAUTHENTICATED_RATELIMIT_SECONDS`.
 ## This budget is shared between all of those endpoints, so it is more lenient than the login one.
 # UNAUTHENTICATED_RATELIMIT_MAX_BURST=50
 ## BETA FEATURE: Groups
 ## Controls whether group support is enabled for organizations
 ## This setting applies to organizations.
@@ -493,6 +512,9 @@
 ## Prevent users from logging in directly without going through SSO
 # SSO_ONLY=false
 ## Allow SSO flow to create account. You probably want to disable it when using a public provider.
 # SSO_SIGNUPS_ALLOWED=true
 ## On SSO Signup if a user with a matching email already exists make the association
 # SSO_SIGNUPS_MATCH_EMAIL=true
@@ -555,11 +577,6 @@
 # DUO_HOST=<API Hostname>
 ## After that, you should be able to follow the rest of the guide linked above,
 ## ignoring the fields that ask for the values that you already configured beforehand.
 ##
 ## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'.
 ## Duo no longer supports this, but it still works for some integrations.
 ## If you aren't sure, leave this alone.
 # DUO_USE_IFRAME=false
 ## Email 2FA settings
 ## Email token size
@@ -62,7 +62,7 @@ jobs:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -113,7 +113,7 @@ jobs:
      # Enable Rust Caching
      - name: Rust Caching
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
          # Like changing the build host from Ubuntu 20.04 to 22.04 for example.
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # End Checkout the repo
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -30,24 +30,25 @@ jobs:
          driver-opts: |
            network=host
      # Download hadolint - https://github.com/hadolint/hadolint/releases
      - name: Download hadolint
        run: |
          sudo curl -L https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-$(uname -s)-$(uname -m) -o /usr/local/bin/hadolint && \
          sudo chmod +x /usr/local/bin/hadolint
        env:
          HADOLINT_VERSION: 2.14.0
      # End Download hadolint
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # End Checkout the repo
      # Test Dockerfiles with hadolint
-      - name: Run hadolint
+      # Uses the Docker-based action (hadolint pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian)
-        run: hadolint docker/Dockerfile.{debian,alpine}
+      # so no binary is downloaded at runtime. Pinned by commit SHA for supply-chain safety.
      - name: Run hadolint on Dockerfile.debian
        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: docker/Dockerfile.debian
      - name: Run hadolint on Dockerfile.alpine
        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: docker/Dockerfile.alpine
      # End Test Dockerfiles with hadolint
      # Test Dockerfiles with docker build checks
@@ -58,13 +58,13 @@ jobs:
    steps:
      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
        with:
          platforms: "arm64,arm"
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -77,7 +77,7 @@ jobs:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        # We need fetch-depth of 0 so we also get all the tag metadata
        with:
          persist-credentials: false
@@ -106,7 +106,7 @@ jobs:
      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -121,7 +121,7 @@ jobs:
      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -137,7 +137,7 @@ jobs:
      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -185,7 +185,7 @@ jobs:
      - name: Bake ${{ matrix.base_image }} containers
        id: bake_vw
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
        env:
          BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -237,7 +237,7 @@ jobs:
      # Upload artifacts to Github Actions and Attest the binaries
      - name: Attest binaries
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: vaultwarden-${{ env.NORMALIZED_ARCH }}
@@ -249,7 +249,7 @@ jobs:
  merge-manifests:
    name: Merge manifests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    needs: docker-build
    environment: 
      name: release
@@ -272,7 +272,7 @@ jobs:
      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -287,7 +287,7 @@ jobs:
      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -303,7 +303,7 @@ jobs:
      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -365,7 +365,7 @@ jobs:
      # Attest container images
      - name: Attest - docker.io - ${{ matrix.base_image }}
        if: ${{ vars.DOCKERHUB_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ vars.DOCKERHUB_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -373,7 +373,7 @@ jobs:
      - name: Attest - ghcr.io - ${{ matrix.base_image }}
        if: ${{ vars.GHCR_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ vars.GHCR_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -381,7 +381,7 @@ jobs:
      - name: Attest - quay.io - ${{ matrix.base_image }}
        if: ${{ vars.QUAY_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ vars.QUAY_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -33,7 +33,7 @@ jobs:
    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
@@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH
      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          sarif_file: 'trivy-results.sarif'
@@ -16,11 +16,11 @@ jobs:
    steps:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # End Checkout the repo
      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@cf5f1c29a8ac336af8568821ec41919923b05a83 # v1.45.1
+        uses: crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
@@ -14,17 +14,17 @@ on:
 jobs:
  zizmor:
    name: Run zizmor
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    permissions:
      security-events: write # To write the security report
    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
@@ -18,9 +18,10 @@ repos:
  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
  - repo: https://github.com/crate-ci/typos
-    rev: cf5f1c29a8ac336af8568821ec41919923b05a83 # v1.45.1
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
    hooks:
      - id: typos
        always_run: true
  - repo: local
    hooks:
@@ -38,8 +39,7 @@ repos:
        entry: cargo test
        language: system
        args: [ "--features", "sqlite,mysql,postgresql", "--" ]
-        types_or: [ rust, file ]
+        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
        pass_filenames: false
      - id: cargo-clippy
        name: cargo clippy
@@ -47,8 +47,7 @@ repos:
        entry: cargo clippy
        language: system
        args: [ "--features", "sqlite,mysql,postgresql", "--", "-D", "warnings" ]
-        types_or: [ rust, file ]
+        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
        pass_filenames: false
      - id: check-docker-templates
        name: check docker templates
@@ -23,4 +23,6 @@ extend-ignore-re = [
    # https://github.com/bitwarden/server/blob/dff9f1cf538198819911cf2c20f8cda3307701c5/src/Notifications/HubHelpers.cs#L86
    # https://github.com/bitwarden/clients/blob/9612a4ac45063e372a6fbe87eb253c7cb3c588fb/libs/common/src/auth/services/anonymous-hub.service.ts#L45
    "AuthRequestResponseRecieved",
    # Ignore Punycode/IDN tests
    "xn--.+"
 ]
@@ -1,6 +1,6 @@
 [workspace.package]
-edition = "2021"
+edition = "2024"
-rust-version = "1.93.0"
+rust-version = "1.97.1"
 license = "AGPL-3.0-only"
 repository = "https://github.com/dani-garcia/vaultwarden"
 publish = false
@@ -12,9 +12,7 @@ members = ["macros"]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
 readme = "README.md"
 build = "build.rs"
 resolver = "2"
 repository.workspace = true
 edition.workspace = true
 rust-version.workspace = true
@@ -24,20 +22,32 @@ publish.workspace = true
 [features]
 default = [
    # "sqlite",
    # "sqlite_system",
    # "mysql",
    # "postgresql",
 ]
 # Empty to keep compatibility, prefer to set USE_SYSLOG=true
 enable_syslog = []
 # Please enable at least one of these DB backends.
 mysql = ["diesel/mysql", "diesel_migrations/mysql"]
 postgresql = ["diesel/postgres", "diesel_migrations/postgres"]
-sqlite = ["diesel/sqlite", "diesel_migrations/sqlite", "dep:libsqlite3-sys"]
+sqlite_system = ["diesel/sqlite", "diesel_migrations/sqlite"] # Dynamically link SQLite
 sqlite = ["sqlite_system", "libsqlite3-sys/bundled"] # Statically link SQLite into the binary instead of dynamically.
 # Enable to use a vendored and statically linked openssl
 vendored_openssl = ["openssl/vendored"]
 # Enable MiMalloc memory allocator to replace the default malloc
 # This can improve performance for Alpine builds
 enable_mimalloc = ["dep:mimalloc"]
-s3 = ["opendal/services-s3", "dep:aws-config", "dep:aws-credential-types", "dep:aws-smithy-runtime-api", "dep:anyhow", "dep:http", "dep:reqsign"]
+s3 = [
    "opendal/services-s3",
    "dep:opendal-http-transport-reqwest",
    "dep:aws-config",
    "dep:aws-credential-types",
    "dep:aws-smithy-runtime-api",
    "dep:http",
    "dep:reqsign-aws-v4",
    "dep:reqsign-core",
 ]
 # OIDC specific features
 oidc-accept-rfc3339-timestamps = ["openidconnect/accept-rfc3339-timestamps"]
@@ -48,6 +58,7 @@ oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]
 unstable = []
 [target."cfg(unix)".dependencies]
 nix = { version = "0.31.3", features = ["fs"] }
 # Logging
 syslog = "7.0.0"
@@ -55,154 +66,212 @@ syslog = "7.0.0"
 macros = { path = "./macros" }
 # Logging
-log = "0.4.29"
+log = "0.4.34"
 fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
-tracing = { version = "0.1.44", features = ["log"] } # Needed to have lettre and webauthn-rs trace logging to work
+# We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
 tracing = { version = "0.1.44", features = ["log"] }
 # A `dotenv` implementation for Rust
 dotenvy = { version = "0.15.7", default-features = false }
 # Numerical libraries
 num-traits = "0.2.19"
-num-derive = "0.4.2"
+num-derive = "0.5.1"
-bigdecimal = "0.4.10"
+bigdecimal = "0.4.11"
 # Web framework
-rocket = { version = "0.5.1", features = ["tls", "json"], default-features = false }
+rocket = { version = "0.5.1", default-features = false, features = ["json", "tls"] }
-rocket_ws = { version ="0.1.1" }
+rocket_ws = { version = "0.1.1" }
 # WebSockets libraries
 rmpv = "1.3.1" # MessagePack library
 # Concurrent HashMap used for WebSocket messaging and favicons
-dashmap = "6.1.0"
+dashmap = "6.2.1"
 # Async futures
-futures = "0.3.32"
+futures = "0.3.34"
-tokio = { version = "1.52.1", features = ["rt-multi-thread", "fs", "io-util", "parking_lot", "time", "signal", "net"] }
+tokio = { version = "1.53.2", features = [
-tokio-util = { version = "0.7.18", features = ["compat"]}
+    "fs",
    "io-util",
    "net",
    "parking_lot",
    "rt-multi-thread",
    "signal",
    "time",
 ] }
 tokio-util = { version = "0.7.19", features = ["compat"] }
 # A generic serialization/deserialization framework
-serde = { version = "1.0.228", features = ["derive"] }
+serde = { version = "1.0.229", features = ["derive"] }
-serde_json = "1.0.149"
+serde_json = "1.0.151"
 # A safe, extensible ORM and Query builder
-# Currently pinned diesel to v2.3.3 as newer version break MySQL/MariaDB compatibility
+diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric"] }
-diesel = { version = "2.3.7", features = ["chrono", "r2d2", "numeric"] }
+diesel_migrations = "2.3.2"
 diesel_migrations = "2.3.1"
-derive_more = { version = "2.1.1", features = ["from", "into", "as_ref", "deref", "display"] }
+derive_more = { version = "2.1.1", features = [
-diesel-derive-newtype = "2.1.2"
+    "as_ref",
    "deref",
    "display",
    "from",
    "into",
 ] }
 diesel-derive-newtype = "2.1.3"
-# Bundled/Static SQLite
+# SQLite, statically bundled unless the `sqlite_system` feature is enabled
-libsqlite3-sys = { version = "0.36.0", features = ["bundled"], optional = true }
+libsqlite3-sys = { version = "0.38.2", optional = true }
 # Crypto-related libraries
-rand = "0.10.1"
+rand = "0.10.3"
 ring = "0.17.14"
 rustls = { version = "0.23.45", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"
 # UUID generation
-uuid = { version = "1.23.1", features = ["v4"] }
+uuid = { version = "1.27.0", features = ["v4"] }
 # Date and time libraries
-chrono = { version = "0.4.44", features = ["clock", "serde"], default-features = false }
+chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
 chrono-tz = "0.10.4"
-time = "0.3.47"
+time = "0.3.55"
 # Job scheduler
-job_scheduler_ng = "2.4.0"
+job_scheduler_ng = "2.5.0"
 # Data encoding library Hex/Base32/Base64
-data-encoding = "2.10.0"
+data-encoding = "2.11.1"
 # JWT library
-jsonwebtoken = { version = "10.3.0", features = ["use_pem", "rust_crypto"], default-features = false }
+jsonwebtoken = { version = "11.1.0", default-features = false, features = ["rust_crypto", "use_pem"] }
 # TOTP library
 totp-lite = "2.0.1"
 # Yubico Library
-yubico = { package = "yubico_ng", version = "0.14.1", features = ["online-tokio"], default-features = false }
+yubico_ng = { version = "1.0.0", default-features = false }
 # WebAuthn libraries
 # danger-allow-state-serialisation is needed to save the state in the db
 # danger-credential-internals is needed to support U2F to Webauthn migration
-webauthn-rs = { version = "0.5.4", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
+webauthn-rs = { version = "0.5.5", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
-webauthn-rs-proto = "0.5.4"
+webauthn-rs-proto = "0.5.5"
-webauthn-rs-core = "0.5.4"
+webauthn-rs-core = "0.5.5"
 # Handling of URL's for WebAuthn and favicons
 url = "2.5.8"
 # Email libraries
-lettre = { version = "0.11.21", features = ["smtp-transport", "sendmail-transport", "builder", "serde", "hostname", "tracing", "tokio1-rustls", "ring", "rustls-native-certs"], default-features = false }
+lettre = { version = "0.11.23", default-features = false, features = [
    # Misc
    "tracing",
    "serde",
    "builder",
    "hostname",
    # TLS/Security
    "ring",
    "rustls-native-certs",
    "tokio1-rustls",
    # Transport
    "smtp-transport",
    "sendmail-transport",
 ] }
 percent-encoding = "2.3.2" # URL encoding library used for URL's in the emails
 email_address = "0.2.9"
 # HTML Template library
-handlebars = { version = "6.4.0", features = ["dir_source"] }
+handlebars = { version = "6.4.4", features = ["dir_source"] }
 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.12.28", features = ["rustls-tls", "rustls-tls-native-roots", "stream", "json", "deflate", "gzip", "brotli", "zstd", "socks", "cookies", "charset", "http2", "system-proxy"], default-features = false}
+reqwest = { version = "0.13.5", default-features = false, features = [
-hickory-resolver = "0.26.0"
+    # Misc
    "charset",
    "cookies",
    "http2",
    "json",
    "form",
    "rustls-no-provider",
    "stream",
    # Compression
    "brotli",
    "deflate",
    "gzip",
    "zstd",
    # Proxy
    "socks",
    "system-proxy",
 ] }
 hickory-resolver = "0.26.3"
 # Favicon extraction libraries
-html5gum = "0.8.3"
+html5gum = "0.8.4"
-regex = { version = "1.12.3", features = ["std", "perf", "unicode-perl"], default-features = false }
+regex = { version = "1.13.1", default-features = false, features = [
    "perf",
    "std",
    "unicode-perl",
 ] }
 data-url = "0.3.2"
-bytes = "1.11.1"
+bytes = "1.12.1"
-svg-hush = "0.9.6"
+svg-hush = "0.9.7"
 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "0.59.0", features = ["async"] }
+cached = { version = "4.0.1", features = ["async"] }
 # Used for custom short lived cookie jar during favicon extraction
-cookie = "0.18.1"
+cookie = "0.18.2"
 cookie_store = "0.22.1"
 # Used by U2F, JWT and PostgreSQL
-openssl = "0.10.78"
+openssl = "0.10.81"
 # CLI argument parsing
 pico-args = "0.5.0"
 # Macro ident concatenation
-pastey = "0.2.1"
+pastey = "0.2.3"
 governor = "0.10.4"
 # CIDR parsing for the trusted proxies of the client IP header
 ipnet = "2.12.2"
 # OIDC for SSO
-openidconnect = { version = "4.0.1", features = ["reqwest", "rustls-tls"] }
+openidconnect = { version = "4.0.1", default-features = false }
-moka = { version = "0.12.15", features = ["future"] }
+moka = { version = "0.12.16", features = ["future"] }
 # Check client versions for specific features.
 semver = "1.0.28"
 # Allow overriding the default memory allocator
 # Mainly used for the musl builds, since the default musl malloc is very slow
-mimalloc = { version = "0.1.50", features = ["secure"], default-features = false, optional = true }
+mimalloc = { version = "0.1.52", optional = true, default-features = false, features = ["secure"] }
-which = "8.0.2"
+which = "8.0.6"
 # Argon2 library with support for the PHC format
-argon2 = "0.5.3"
+argon2 = "0.6.0"
 # Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
-rpassword = "7.4.0"
+rpassword = "7.5.4"
 # Loading a dynamic CSS Stylesheet
 grass_compiler = { version = "0.13.4", default-features = false }
 # File are accessed through Apache OpenDAL
-opendal = { version = "0.55.0", features = ["services-fs"], default-features = false }
+opendal = { version = "0.59.4", default-features = false, features = ["services-fs"] }
 opendal-http-transport-reqwest = { version = "0.59.4", default-features = false, features = ["rustls-no-provider"], optional = true }
 # For retrieving AWS credentials, including temporary SSO credentials
-anyhow = { version = "1.0.102", optional = true }
+aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
-aws-config = { version = "1.8.16", features = ["behavior-version-latest", "rt-tokio", "credentials-process", "sso"], default-features = false, optional = true }
+    "behavior-version-latest",
-aws-credential-types = { version = "1.2.14", optional = true }
+    "credentials-process",
-aws-smithy-runtime-api = { version = "1.12.0", optional = true }
+    "rt-tokio",
-http = { version = "1.4.0", optional = true }
+    "sso",
-reqsign = { version = "0.16.5", optional = true }
+] }
 aws-credential-types = { version = "1.3.0", optional = true }
 aws-smithy-runtime-api = { version = "1.19.0", optional = true }
 http = { version = "1.5.0", optional = true }
 reqsign-aws-v4 = { version = "3.3.1", optional = true }
 reqsign-core = { version = "3.3.2", optional = true }
 # Strip debuginfo from the release builds
 # The debug symbols are to provide better panic traces
@@ -262,75 +331,74 @@ unsafe_code = "forbid"
 non_ascii_idents = "forbid"
 # Deny
-deprecated_in_future = "deny"
+warnings = "deny" # Explicitly deny all warnings since we deny all warnings in the end
 # Deny lint groups
 deprecated_safe = { level = "deny", priority = -1 }
 future_incompatible = { level = "deny", priority = -1 }
 keyword_idents = { level = "deny", priority = -1 }
 let_underscore = { level = "deny", priority = -1 }
 nonstandard_style = { level = "deny", priority = -1 }
 noop_method_call = "deny"
 refining_impl_trait = { level = "deny", priority = -1 }
 rust_2018_idioms = { level = "deny", priority = -1 }
 rust_2021_compatibility = { level = "deny", priority = -1 }
 rust_2024_compatibility = { level = "deny", priority = -1 }
 unused = { level = "deny", priority = -1 }
 # Deny individual lints
 closure_returning_async_block = "deny"
 deprecated_in_future = "deny"
 single_use_lifetimes = "deny"
 trivial_casts = "deny"
 trivial_numeric_casts = "deny"
 unused = { level = "deny", priority = -1 }
 unused_import_braces = "deny"
 unused_lifetimes = "deny"
 unused_qualifications = "deny"
 variant_size_differences = "deny"
 # Allow the following lints since these cause issues with Rust v1.84.0 or newer
 # Building Vaultwarden with Rust v1.85.0 with edition 2024 also works without issues
 edition_2024_expr_fragment_specifier = "allow" # Once changed to Rust 2024 this should be removed and macro's should be validated again
 if_let_rescope = "allow"
 tail_expr_drop_order = "allow"
 # https://rust-lang.github.io/rust-clippy/stable/index.html
 [workspace.lints.clippy]
-# Warn
+# Warn only so you can still use these during development, but not in the final code
 dbg_macro = "warn"
 todo = "warn"
 # Ignore/Allow
 result_large_err = "allow"
-# Deny
+# Warn on these lint group (Some might be warn by default already though)
 # Will be denied during CI!
 complexity = { level = "warn", priority = -1 }
 pedantic = { level = "warn", priority = -1 }
 perf = { level = "warn", priority = -1 }
 style = { level = "warn", priority = -1 }
 suspicious = { level = "warn", priority = -1 }
 # Deny individual lints
 branches_sharing_code = "deny"
 case_sensitive_file_extension_comparisons = "deny"
 cast_lossless = "deny"
 clone_on_ref_ptr = "deny"
 equatable_if_let = "deny"
 excessive_precision = "deny"
 filter_map_next = "deny"
 float_cmp_const = "deny"
 implicit_clone = "deny"
 inefficient_to_string = "deny"
 iter_on_empty_collections = "deny"
 iter_on_single_items = "deny"
 linkedlist = "deny"
 macro_use_imports = "deny"
 manual_assert = "deny"
 manual_instant_elapsed = "deny"
 manual_string_new = "deny"
 match_wildcard_for_single_variants = "deny"
 mem_forget = "deny"
 needless_borrow = "deny"
 needless_collect = "deny"
 needless_continue = "deny"
 needless_lifetimes = "deny"
 option_option = "deny"
 redundant_clone = "deny"
 string_add_assign = "deny"
 unnecessary_join = "deny"
 unnecessary_self_imports = "deny"
 unnested_or_patterns = "deny"
 unused_async = "deny"
 unused_self = "deny"
 useless_let_if_seq = "deny"
 verbose_file_reads = "deny"
-zero_sized_map_values = "deny"
+str_to_string = "deny"
 # Pedantic Opt-Outs
 inline_always = "allow" # We use this sparsely
 struct_field_names = "allow" # Noisy and some items are Bitwarden controlled
 large_futures = "allow" # Causes a fail in some Rocket macro's, since we experience no issues, allow it
 too_many_lines = "allow" # For now, allow this, good to enable in the future and see if we can refactor
 unnecessary_wraps = "allow" # Too much false positives because of Rocket integrations
 # We do not use these doc items
 doc_link_with_quotes = "allow"
 doc_markdown = "allow"
 missing_errors_doc = "allow"
 missing_panics_doc = "allow"
 [lints]
 workspace = true
@@ -59,8 +59,9 @@ A nearly complete implementation of the Bitwarden Client API is provided, includ
 ## Usage
 > [!IMPORTANT]
-> The web-vault requires the use a secure context for the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API).
+> The web-vault requires the use of HTTPS and a secure context for the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API). <br>
-> That means it will only work via `http://localhost:8000` (using the port from the example below) or if you [enable HTTPS](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS).
+> That means it will only work if you [enable HTTPS](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS). <br>
 > We also suggest to use a [reverse proxy](https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples).
 The recommended way to install and use Vaultwarden is via our container images which are published to [ghcr.io](https://github.com/dani-garcia/vaultwarden/pkgs/container/vaultwarden), [docker.io](https://hub.docker.com/r/vaultwarden/server) and [quay.io](https://quay.io/repository/vaultwarden/server).
 See [which container image to use](https://github.com/dani-garcia/vaultwarden/wiki/Which-container-image-to-use) for an explanation of the provided tags.
@@ -1,22 +1,21 @@
-use std::env;
+use std::{env, io::Error, process::Command};
 use std::process::Command;
 fn main() {
-    // This allow using #[cfg(sqlite)] instead of #[cfg(feature = "sqlite")], which helps when trying to add them through macros
+    // These allow using e.g. #[cfg(mysql)] instead of #[cfg(feature = "mysql")], which helps when trying to add them through macros
-    #[cfg(feature = "sqlite")]
+    #[cfg(feature = "sqlite_system")] // The `sqlite` feature implies this one.
    println!("cargo:rustc-cfg=sqlite");
    #[cfg(feature = "mysql")]
    println!("cargo:rustc-cfg=mysql");
    #[cfg(feature = "postgresql")]
    println!("cargo:rustc-cfg=postgresql");
-    #[cfg(feature = "s3")]
+    #[cfg(not(any(feature = "sqlite_system", feature = "mysql", feature = "postgresql")))]
    println!("cargo:rustc-cfg=s3");
    #[cfg(not(any(feature = "sqlite", feature = "mysql", feature = "postgresql")))]
    compile_error!(
        "You need to enable one DB backend. To build with previous defaults do: cargo build --features sqlite"
    );
    #[cfg(feature = "s3")]
    println!("cargo:rustc-cfg=s3");
    // Use check-cfg to let cargo know which cfg's we define,
    // and avoid warnings when they are used in the code.
    println!("cargo::rustc-check-cfg=cfg(sqlite)");
@@ -42,13 +41,12 @@ fn main() {
    }
 }
-fn run(args: &[&str]) -> Result<String, std::io::Error> {
+fn run(args: &[&str]) -> Result<String, Error> {
    let out = Command::new(args[0]).args(&args[1..]).output()?;
    if !out.status.success() {
        use std::io::Error;
        return Err(Error::other("Command not successful"));
    }
-    Ok(String::from_utf8(out.stdout).unwrap().trim().to_string())
+    Ok(String::from_utf8(out.stdout).unwrap().trim().to_owned())
 }
 /// This method reads info from Git, namely tags, branch, and revision
@@ -58,7 +56,7 @@ fn run(args: &[&str]) -> Result<String, std::io::Error> {
 ///    - `env!("GIT_BRANCH")`
 ///    - `env!("GIT_REV")`
 ///    - `env!("VW_VERSION")`
-fn version_from_git_info() -> Result<String, std::io::Error> {
+fn version_from_git_info() -> Result<String, Error> {
    // The exact tag for the current commit, can be empty when
    // the current commit doesn't have an associated tag
    let exact_tag = run(&["git", "describe", "--abbrev=0", "--tags", "--exact-match"]).ok();
@@ -1,13 +1,14 @@
 ---
-vault_version: "v2026.3.1"
+vault_version: "v2026.7.0"
-vault_image_digest: "sha256:c1b1f212333f95bff4ef8d00e8e3589c4ae8eda018691f28f8bddc7e971dd767"
+vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c"
 # Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
 xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
-rust_version: 1.95.0 # Rust version to be used
+# The `rust_version` variable is extracted from `rust-toolchain.toml`
 # rust_version: x.yy.z # Rust version to be used
 debian_version: trixie # Debian release name to be used
-alpine_version: "3.23" # Alpine version to be used
+alpine_version: "3.24" # Alpine version to be used
 # For which platforms/architectures will we try to build images
 platforms: ["linux/amd64", "linux/arm64", "linux/arm/v7", "linux/arm/v6"]
 # Determine the build images per OS/Arch
@@ -19,23 +19,23 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.3.1
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.3.1
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
-#     [docker.io/vaultwarden/web-vault@sha256:c1b1f212333f95bff4ef8d00e8e3589c4ae8eda018691f28f8bddc7e971dd767]
+#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:c1b1f212333f95bff4ef8d00e8e3589c4ae8eda018691f28f8bddc7e971dd767
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
-#     [docker.io/vaultwarden/web-vault:v2026.3.1]
+#     [docker.io/vaultwarden/web-vault:v2026.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:c1b1f212333f95bff4ef8d00e8e3589c4ae8eda018691f28f8bddc7e971dd767 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.95.0 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.99.0 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.95.0 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.99.0 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.95.0 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.99.0 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.95.0 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.99.0 AS build_armv6
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -57,7 +57,6 @@ ENV DEBIAN_FRONTEND=noninteractive \
    # Debian Trixie uses libpq v17
    PQ_LIB_DIR="/usr/local/musl/pq17/lib"
 # Create CARGO_HOME folder and don't download rust docs
 RUN mkdir -pv "${CARGO_HOME}" && \
    rustup set profile minimal
@@ -67,11 +66,11 @@ RUN USER=root cargo new --bin /app
 WORKDIR /app
 # Environment variables for Cargo on Alpine based builds
-RUN echo "export CARGO_TARGET=${RUST_MUSL_CROSS_TARGET}" >> /env-cargo && \
+RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -87,7 +86,7 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
    find . -not -path "./target*" -delete
@@ -98,13 +97,13 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
-    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
+    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -127,7 +126,8 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
-FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.23
+# hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.24
 ENV ROCKET_PROFILE="release" \
    ROCKET_ADDRESS=0.0.0.0 \
@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.3.1
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.3.1
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
-#     [docker.io/vaultwarden/web-vault@sha256:c1b1f212333f95bff4ef8d00e8e3589c4ae8eda018691f28f8bddc7e971dd767]
+#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:c1b1f212333f95bff4ef8d00e8e3589c4ae8eda018691f28f8bddc7e971dd767
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
-#     [docker.io/vaultwarden/web-vault:v2026.3.1]
+#     [docker.io/vaultwarden/web-vault:v2026.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:c1b1f212333f95bff4ef8d00e8e3589c4ae8eda018691f28f8bddc7e971dd767 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
@@ -36,7 +36,8 @@ FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.95.0-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.99.0-slim-trixie AS build
 # hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -51,7 +52,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
    TERM=xterm-256color \
    CARGO_HOME="/root/.cargo" \
    USER="root"
-# Install clang to get `xx-cargo` working
+# Install clang && xx-c-essentials to get `xx-cargo` working
 # Install pkg-config to allow amd64 builds to find all libraries
 # Install git so build.rs can determine the correct version
 # Install the libc cross packages based upon the debian-arch
@@ -59,19 +60,16 @@ RUN apt-get update && \
    apt-get install -y \
        --no-install-recommends \
        clang \
-        pkg-config \
+        git && \
        git \
        "libc6-$(xx-info debian-arch)-cross" \
        "libc6-dev-$(xx-info debian-arch)-cross" \
        "linux-libc-dev-$(xx-info debian-arch)-cross" && \
    xx-apt-get install -y \
        --no-install-recommends \
        gcc \
        libpq-dev \
        libpq5 \
        libssl-dev \
        libmariadb-dev \
-        zlib1g-dev && \
+        pkg-config \
        zlib1g-dev \
        xx-c-essentials && \
    # Run xx-cargo early, since it sometimes seems to break when run at a later stage
    echo "export CARGO_TARGET=$(xx-cargo --print-target-triple)" >> /env-cargo
@@ -83,30 +81,7 @@ RUN mkdir -pv "${CARGO_HOME}" && \
 RUN USER=root cargo new --bin /app
 WORKDIR /app
-# Environment variables for Cargo on Debian based builds
+RUN . /env-cargo && \
 ARG TARGET_PKG_CONFIG_PATH
 RUN source /env-cargo && \
    if xx-info is-cross ; then \
        # We can't use xx-cargo since that uses clang, which doesn't work for our libraries.
        # Because of this we generate the needed environment variables here which we can load in the needed steps.
        echo "export CC_$(echo "${CARGO_TARGET}" | tr '[:upper:]' '[:lower:]' | tr - _)=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
        echo "export CARGO_TARGET_$(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_LINKER=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
        echo "export CROSS_COMPILE=1" >> /env-cargo && \
        echo "export PKG_CONFIG_ALLOW_CROSS=1" >> /env-cargo && \
        # For some architectures `xx-info` returns a triple which doesn't matches the path on disk
        # In those cases you can override this by setting the `TARGET_PKG_CONFIG_PATH` build-arg
        if [[ -n "${TARGET_PKG_CONFIG_PATH}" ]]; then \
            echo "export TARGET_PKG_CONFIG_PATH=${TARGET_PKG_CONFIG_PATH}" >> /env-cargo ; \
        else \
            echo "export PKG_CONFIG_PATH=/usr/lib/$(xx-info)/pkgconfig" >> /env-cargo ; \
        fi && \
        echo "# End of env-cargo" >> /env-cargo ; \
    fi && \
    # Output the current contents of the file
    cat /env-cargo
 RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -121,8 +96,23 @@ ARG DB=sqlite,mysql,postgresql
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN source /env-cargo && \
+RUN . /env-cargo && \
-    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
+    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
    find . -not -path "./target*" -delete
 # Copies the complete project
@@ -132,13 +122,28 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
-    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
+    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
-    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
+    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -161,6 +166,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim
 ENV ROCKET_PROFILE="release" \
@@ -27,6 +27,24 @@
 #     $ docker image inspect --format "{{ '{{' }}.RepoTags}}" docker.io/vaultwarden/web-vault@{{ vault_image_digest }}
 #     [docker.io/vaultwarden/web-vault:{{ vault_version | replace('+', '_') }}]
 #
 {% macro xx_cargo_config() -%}
 # Configure xx-cargo for target pkg-config and Debian transitive library lookup
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}"
 {%- endmacro %}
 FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault
 {% if base == "debian" %}
@@ -47,6 +65,7 @@ FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].arch_image[arch] }} AS
 # hadolint ignore=DL3006
 FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].image }} AS build
 {% if base == "debian" %}
 # hadolint ignore=DL3067
 COPY --from=xx / /
 {% endif %}
 ARG TARGETARCH
@@ -66,10 +85,10 @@ ENV DEBIAN_FRONTEND=noninteractive \
    # Use PostgreSQL v17 during Alpine/MUSL builds instead of the default v16
    # Debian Trixie uses libpq v17
    PQ_LIB_DIR="/usr/local/musl/pq17/lib"
-{% endif %}
+{%- endif %}
 {% if base == "debian" %}
-# Install clang to get `xx-cargo` working
+# Install clang && xx-c-essentials to get `xx-cargo` working
 # Install pkg-config to allow amd64 builds to find all libraries
 # Install git so build.rs can determine the correct version
 # Install the libc cross packages based upon the debian-arch
@@ -77,19 +96,16 @@ RUN apt-get update && \
    apt-get install -y \
        --no-install-recommends \
        clang \
-        pkg-config \
+        git && \
        git \
        "libc6-$(xx-info debian-arch)-cross" \
        "libc6-dev-$(xx-info debian-arch)-cross" \
        "linux-libc-dev-$(xx-info debian-arch)-cross" && \
    xx-apt-get install -y \
        --no-install-recommends \
        gcc \
        libpq-dev \
        libpq5 \
        libssl-dev \
        libmariadb-dev \
-        zlib1g-dev && \
+        pkg-config \
        zlib1g-dev \
        xx-c-essentials && \
    # Run xx-cargo early, since it sometimes seems to break when run at a later stage
    echo "export CARGO_TARGET=$(xx-cargo --print-target-triple)" >> /env-cargo
 {% endif %}
@@ -102,38 +118,14 @@ RUN mkdir -pv "${CARGO_HOME}" && \
 RUN USER=root cargo new --bin /app
 WORKDIR /app
-{% if base == "debian" %}
+{% if base == "alpine" %}
 # Environment variables for Cargo on Debian based builds
 ARG TARGET_PKG_CONFIG_PATH
 RUN source /env-cargo && \
    if xx-info is-cross ; then \
        # We can't use xx-cargo since that uses clang, which doesn't work for our libraries.
        # Because of this we generate the needed environment variables here which we can load in the needed steps.
        echo "export CC_$(echo "${CARGO_TARGET}" | tr '[:upper:]' '[:lower:]' | tr - _)=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
        echo "export CARGO_TARGET_$(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_LINKER=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
        echo "export CROSS_COMPILE=1" >> /env-cargo && \
        echo "export PKG_CONFIG_ALLOW_CROSS=1" >> /env-cargo && \
        # For some architectures `xx-info` returns a triple which doesn't matches the path on disk
        # In those cases you can override this by setting the `TARGET_PKG_CONFIG_PATH` build-arg
        if [[ -n "${TARGET_PKG_CONFIG_PATH}" ]]; then \
            echo "export TARGET_PKG_CONFIG_PATH=${TARGET_PKG_CONFIG_PATH}" >> /env-cargo ; \
        else \
            echo "export PKG_CONFIG_PATH=/usr/lib/$(xx-info)/pkgconfig" >> /env-cargo ; \
        fi && \
        echo "# End of env-cargo" >> /env-cargo ; \
    fi && \
    # Output the current contents of the file
    cat /env-cargo
 {% elif base == "alpine" %}
 # Environment variables for Cargo on Alpine based builds
-RUN echo "export CARGO_TARGET=${RUST_MUSL_CROSS_TARGET}" >> /env-cargo && \
+RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo
 {% endif %}
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -153,8 +145,12 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN source /env-cargo && \
+RUN . /env-cargo && \
 {% if base == "debian" %}
    {{ xx_cargo_config() }} && \
 {% elif base == "alpine" %}
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
 {% endif %}
    find . -not -path "./target*" -delete
 # Copies the complete project
@@ -164,13 +160,17 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN source /env-cargo && \
+RUN . /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
 {% if base == "debian" %}
    {{ xx_cargo_config() }} && \
 {% elif base == "alpine" %}
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
-    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
+{% endif %}
    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -193,6 +193,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM {{ runtime_stage_image[base] }}
 ENV ROCKET_PROFILE="release" \
@@ -3,17 +3,23 @@
 import os
 import argparse
 import json
 import tomllib
 import yaml
 import jinja2
 # Load settings file
-with open("DockerSettings.yaml", 'r') as yaml_file:
+with open('DockerSettings.yaml', 'r', encoding='utf-8') as yaml_file:
 	yaml_data = yaml.safe_load(yaml_file)
 # Extract the rust_version from the rust-toolchain.toml file
 script_dir = os.path.dirname(os.path.abspath(__file__))
 with open(os.path.join(script_dir, '..', 'rust-toolchain.toml'), 'rb') as toolchain_file:
    yaml_data["rust_version"] = tomllib.load(toolchain_file)["toolchain"]["channel"]
 settings_env = jinja2.Environment(
 	loader=jinja2.FileSystemLoader(os.getcwd()),
 )
-settings_yaml = yaml.safe_load(settings_env.get_template("DockerSettings.yaml").render(yaml_data))
+settings_yaml = yaml.safe_load(settings_env.get_template('DockerSettings.yaml').render(yaml_data))
 args_parser = argparse.ArgumentParser()
 args_parser.add_argument('template_file', help='Jinja2 template file to render.')
@@ -13,8 +13,8 @@ path = "src/lib.rs"
 proc-macro = true
 [dependencies]
-quote = "1.0.45"
+quote = "1.0.47"
-syn = "2.0.117"
+syn = "3.0.6"
 [lints]
 workspace = true
@@ -1,14 +1,15 @@
 use proc_macro::TokenStream;
 use quote::quote;
 use syn::{DeriveInput, parse_macro_input};
 #[proc_macro_derive(UuidFromParam)]
 pub fn derive_uuid_from_param(input: TokenStream) -> TokenStream {
-    let ast = syn::parse(input).unwrap();
+    let ast = parse_macro_input!(input as DeriveInput);
    impl_derive_uuid_macro(&ast)
 }
-fn impl_derive_uuid_macro(ast: &syn::DeriveInput) -> TokenStream {
+fn impl_derive_uuid_macro(ast: &DeriveInput) -> TokenStream {
    let name = &ast.ident;
    let gen_derive = quote! {
        #[automatically_derived]
@@ -30,12 +31,12 @@ fn impl_derive_uuid_macro(ast: &syn::DeriveInput) -> TokenStream {
 #[proc_macro_derive(IdFromParam)]
 pub fn derive_id_from_param(input: TokenStream) -> TokenStream {
-    let ast = syn::parse(input).unwrap();
+    let ast = parse_macro_input!(input as DeriveInput);
    impl_derive_safestring_macro(&ast)
 }
-fn impl_derive_safestring_macro(ast: &syn::DeriveInput) -> TokenStream {
+fn impl_derive_safestring_macro(ast: &DeriveInput) -> TokenStream {
    let name = &ast.ident;
    let gen_derive = quote! {
        #[automatically_derived]
@@ -0,0 +1 @@
 ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1,15 +1,31 @@
-- Dynamically create DROP FOREIGN KEY
+SELECT if (
-- Some versions of MySQL or MariaDB might fail if the key doesn't exists
+    EXISTS(
-- This checks if the key exists, and if so, will drop it.
+        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
-SET @drop_sso_fk = IF((SELECT true FROM information_schema.TABLE_CONSTRAINTS WHERE
+            WHERE TABLE_SCHEMA = DATABASE()
-    CONSTRAINT_SCHEMA = DATABASE() AND
+                AND TABLE_NAME = 'sso_users'
-    TABLE_NAME = 'sso_users' AND
+                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
-    CONSTRAINT_NAME = 'sso_users_ibfk_1' AND
+                AND CONSTRAINT_NAME = 'sso_users_ibfk_1'
-    CONSTRAINT_TYPE = 'FOREIGN KEY') = true,
+    )
-    'ALTER TABLE sso_users DROP FOREIGN KEY sso_users_ibfk_1',
+    ,'ALTER TABLE sso_users DROP FOREIGN KEY `sso_users_ibfk_1`'
-    'SELECT 1');
+    ,'SELECT "info: FK sso_users_ibfk_1 does not exist."'
-PREPARE stmt FROM @drop_sso_fk;
+) INTO @drop_stmt;
-EXECUTE stmt;
+PREPARE drop_stmt FROM @drop_stmt;
-DEALLOCATE PREPARE stmt;
+EXECUTE drop_stmt;
 SELECT if (
    EXISTS(
        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
            WHERE TABLE_SCHEMA = DATABASE()
                AND TABLE_NAME = 'sso_users'
                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
                AND CONSTRAINT_NAME = '1'
    )
    ,'ALTER TABLE sso_users DROP FOREIGN KEY `1`'
    ,'SELECT "info: FK sso_users 1 does not exist."'
 ) INTO @drop_stmt;
 PREPARE drop_stmt FROM @drop_stmt;
 EXECUTE drop_stmt;
 DEALLOCATE PREPARE drop_stmt;
 ALTER TABLE sso_users ADD FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE;
@@ -0,0 +1 @@
 DROP TABLE IF EXISTS archives;
@@ -0,0 +1,10 @@
 DROP TABLE IF EXISTS archives;
 CREATE TABLE archives (
    user_uuid   CHAR(36) NOT NULL,
    cipher_uuid CHAR(36) NOT NULL,
    archived_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    PRIMARY KEY (user_uuid, cipher_uuid),
    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE,
    FOREIGN KEY (cipher_uuid) REFERENCES ciphers (uuid) ON DELETE CASCADE
 );
@@ -0,0 +1 @@
 ALTER TABLE sso_auth DROP COLUMN binding_hash;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth DROP COLUMN code_response_error;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth ADD COLUMN code_response_error TEXT;
@@ -0,0 +1 @@
 ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -0,0 +1 @@
 DROP TABLE IF EXISTS archives;
@@ -0,0 +1,8 @@
 DROP TABLE IF EXISTS archives;
 CREATE TABLE archives (
    user_uuid   CHAR(36) NOT NULL REFERENCES users (uuid) ON DELETE CASCADE,
    cipher_uuid CHAR(36) NOT NULL REFERENCES ciphers (uuid) ON DELETE CASCADE,
    archived_at TIMESTAMP NOT NULL DEFAULT now(),
    PRIMARY KEY (user_uuid, cipher_uuid)
 );
@@ -0,0 +1 @@
 ALTER TABLE sso_auth DROP COLUMN binding_hash;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth DROP COLUMN IF EXISTS code_response_error;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth ADD COLUMN IF NOT EXISTS code_response_error TEXT;
@@ -0,0 +1 @@
 ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -0,0 +1 @@
 DROP TABLE IF EXISTS archives;
@@ -0,0 +1,8 @@
 DROP TABLE IF EXISTS archives;
 CREATE TABLE archives (
    user_uuid   CHAR(36) NOT NULL REFERENCES users (uuid) ON DELETE CASCADE,
    cipher_uuid CHAR(36) NOT NULL REFERENCES ciphers (uuid) ON DELETE CASCADE,
    archived_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    PRIMARY KEY (user_uuid, cipher_uuid)
 );
@@ -0,0 +1 @@
 ALTER TABLE sso_auth DROP COLUMN binding_hash;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth DROP COLUMN code_response_error;
@@ -0,0 +1 @@
 ALTER TABLE sso_auth ADD COLUMN code_response_error TEXT;
@@ -0,0 +1 @@
 ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -21,11 +21,19 @@ TEST_USER3=test3
 TEST_USER3_PASSWORD=${TEST_USER3}
 TEST_USER3_MAIL=${TEST_USER3}@yopmail.com
 TEST_USER4=test4
 TEST_USER4_PASSWORD=${TEST_USER4}
 TEST_USER4_MAIL=${TEST_USER4}@yopmail.com
 TEST_USER5=test5
 TEST_USER5_PASSWORD=${TEST_USER5}
 TEST_USER5_MAIL=${TEST_USER5}@yopmail.com
 ###################
 # Keycloak Config #
 ###################
-KEYCLOAK_ADMIN=admin
+KC_BOOTSTRAP_ADMIN_USERNAME=admin
-KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
+KC_BOOTSTRAP_ADMIN_PASSWORD=${KC_BOOTSTRAP_ADMIN_USERNAME}
 KC_HTTP_HOST=127.0.0.1
 KC_HTTP_PORT=8080
@@ -39,8 +47,10 @@ DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
 ######################
 ROCKET_ADDRESS=0.0.0.0
 ROCKET_PORT=8000
-DOMAIN=http://localhost:${ROCKET_PORT}
+ROCKET_TLS={certs="/data/ssl/localhost.crt",key="/data/ssl/localhost.key"}
 DOMAIN=https://127.0.0.1:${ROCKET_PORT}
 LOG_LEVEL=info,oidcwarden::sso=debug
 SSO_DEBUG_TOKENS=true
 I_REALLY_WANT_VOLATILE_STORAGE=true
 SSO_ENABLED=true
@@ -1,8 +1,8 @@
 # Integration tests
 This allows running integration tests using [Playwright](https://playwright.dev/).
-
+\
-It uses its own `test.env` with different ports to not collide with a running dev instance.
+It usse its own [test.env](/test/scenarios/test.env) with different ports to not collide with a running dev instance.
 ## Install
@@ -11,11 +11,11 @@ Databases (`Mariadb`, `Mysql` and `Postgres`) and `Playwright` will run in conta
 ### Running Playwright outside docker
-It is possible to run `Playwright` outside of the container, this removes the need to rebuild the image for each change.
+It's possible to run `Playwright` outside of the container, this remove the need to rebuild the image for each change.
-You will additionally need `nodejs` then run:
+You'll additionally need `nodejs` then run:
 ```bash
-npm ci --ignore-scripts
+npm ci --ignore-scripts --allow-git=none --allow-remote=none
 npx playwright install-deps
 npx playwright install firefox
 ```
@@ -65,7 +65,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
 ```bash
-PW_KEEP_SERVICE_RUNNNING=true npx playwright test
+PW_KEEP_SERVICE_RUNNING=true npx playwright test
 ```
 ### Running specific tests
@@ -77,7 +77,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite login
 ```
-To run only a specifc test (It might fail if it has dependency):
+To run only a specific test (It might fail if it has dependency):
 ```bash
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite -g "Account creation"
@@ -92,7 +92,7 @@ This does not start the server, you will need to start it manually.
 ```bash
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
-npx playwright codegen "http://127.0.0.1:8003"
+npx playwright codegen "https://127.0.0.1:8000" --ignore-https-errors
 ```
 ## Override web-vault
@@ -112,12 +112,11 @@ You can check the result running:
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
 ```
-Then check `http://127.0.0.1:8003/admin/diagnostics` with `admin`.
+Then check `https://127.0.0.1:8003/admin/diagnostics` with `admin`.
 # OpenID Connect test setup
-Additionally this `docker-compose` template allows to run locally Vaultwarden,
+Additionally this `docker-compose` template allow to run locally `Vaultwarden`, [Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.
 [Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.
 ## Setup
@@ -131,18 +130,17 @@ Then start the stack (the `profile` is required to run `Vaultwarden`) :
 ```bash
 > docker compose --profile vaultwarden --env-file .env up
 ....
-keycloakSetup_1  | Logging into http://127.0.0.1:8080 as user admin of realm master
+keycloakSetup_1  | Logging into https://127.0.0.1:8080 as user admin of realm master
 keycloakSetup_1  | Created new realm with id 'test'
 keycloakSetup_1  | 74af4933-e386-4e64-ba15-a7b61212c45e
 oidc_keycloakSetup_1 exited with code 0
 ```
-Wait until `oidc_keycloakSetup_1 exited with code 0` which indicates the correct setup of the Keycloak realm, client and user
+Wait until `oidc_keycloakSetup_1 exited with code 0` which indicate the correct setup of the Keycloak realm, client and user (It's normal for this container to stop once the configuration is done).
 (It is normal for this container to stop once the configuration is done).
 Then you can access :
- `Vaultwarden` on http://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
+- `Vaultwarden` on https://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
 - `Keycloak` on http://0.0.0.0:8080/admin/master/console/ with the default user `admin/admin`
 - `Maildev` on http://0.0.0.0:1080
@@ -171,7 +169,7 @@ docker compose --profile vaultwarden --env-file .env build VaultwardenPrebuild V
 All configuration for `keycloak` / `Vaultwarden` / `keycloak_setup.sh` can be found in [.env](.env.template).
 The content of the file will be loaded as environment variables in all containers.
- `keycloak` [configuration](https://www.keycloak.org/server/all-config) includes `KEYCLOAK_ADMIN` / `KEYCLOAK_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
+- `keycloak` [configuration](https://www.keycloak.org/server/all-config) include `KC_BOOTSTRAP_ADMIN_USERNAME` / `KC_BOOTSTRAP_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
 - All `Vaultwarden` configuration can be set (EX: `SMTP_*`)
 ## Cleanup
@@ -17,7 +17,7 @@ done
 set -e
-kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
+kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KC_BOOTSTRAP_ADMIN_USERNAME" --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" --client admin-cli
 kcadm.sh create realms -s realm="$TEST_REALM" -s enabled=true -s "accessTokenLifespan=600"
 kcadm.sh create clients -r test -s "clientId=$SSO_CLIENT_ID" -s "secret=$SSO_CLIENT_SECRET" -s "redirectUris=[\"$DOMAIN/*\"]" -i
@@ -39,6 +39,6 @@ kcadm.sh create realms -s realm="$DUMMY_REALM" -s enabled=true -s "accessTokenLi
 # THEN in another terminal:
 # docker exec -it keycloakSetup-dev /bin/bash
 # export PATH=$PATH:/opt/keycloak/bin
-# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
+# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KC_BOOTSTRAP_ADMIN_USERNAME" --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" --client admin-cli
 # ENJOY
 # Doc: https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/admin-cli.html
@@ -28,7 +28,7 @@ RUN mkdir /playwright
 WORKDIR /playwright
 COPY package.json package-lock.json .
-RUN npm ci --ignore-scripts && npx playwright install-deps && npx playwright install firefox
+RUN npm ci --ignore-scripts --allow-git=none --allow-remote=none && npx playwright install-deps && npx playwright install firefox
 COPY docker-compose.yml test.env ./
 COPY compose ./compose
@@ -35,6 +35,7 @@ WORKDIR /
 COPY --from=prebuilt /start.sh .
 COPY --from=prebuilt /vaultwarden .
 COPY --from=build /data ./data
 COPY --from=build /web-vault ./web-vault
 ENTRYPOINT ["/start.sh"]
@@ -22,3 +22,14 @@ if [[ ! -z "$REPO_URL" ]] && [[ ! -z "$COMMIT_HASH" ]] ; then
    mv build /web-vault
 fi
 # Lower the KDF iterations default for faster tests.
 sed -i 's/(6e5,2e6,6e5)/(1e5,2e6,1e5)/' /web-vault/app/main.*.js
 # Generate a self signed cert
 mkdir -p /data/ssl; cd /data/ssl
 openssl req -x509 -out localhost.crt -keyout localhost.key \
  -newkey rsa:2048 -nodes -sha256 \
  -subj '/CN=localhost' -extensions EXT -config <( \
   printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
@@ -24,12 +24,15 @@ services:
    environment:
      - ADMIN_TOKEN
      - DATABASE_URL
      - CLIENT_SUPPRESS_ONBOARDING
      - EMAIL_2FA_AUTO_FALLBACK
      - I_REALLY_WANT_VOLATILE_STORAGE
      - LOG_LEVEL
      - LOGIN_RATELIMIT_MAX_BURST
      - SMTP_HOST
      - SMTP_FROM
      - SMTP_DEBUG
      - SSO_AUTH_ONLY_NOT_SESSION
      - SSO_DEBUG_TOKENS
      - SSO_ENABLED
      - SSO_FRONTEND
@@ -58,7 +61,7 @@ services:
  Mariadb:
    profiles: ["playwright"]
    container_name: playwright_mariadb
-    image: mariadb:11.2.4
+    image: mariadb:12.2.2
    env_file: test.env
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
@@ -70,7 +73,7 @@ services:
  Mysql:
    profiles: ["playwright"]
    container_name: playwright_mysql
-    image: mysql:8.4.1
+    image: mysql:9.7.0
    env_file: test.env
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
@@ -82,7 +85,7 @@ services:
  Postgres:
    profiles: ["playwright"]
    container_name: playwright_postgres
-    image: postgres:16.3
+    image: postgres:18.4
    env_file: test.env
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
@@ -94,7 +97,7 @@ services:
  Maildev:
    profiles: ["vaultwarden", "maildev"]
    container_name: maildev
-    image: timshel/maildev:3.0.4
+    image: timshel/maildev:3.2.19
    ports:
      - ${SMTP_PORT}:1025
      - 1080:1080
@@ -102,7 +105,7 @@ services:
  Keycloak:
    profiles: ["keycloak", "vaultwarden"]
    container_name: keycloak-${ENV:-dev}
-    image: quay.io/keycloak/keycloak:26.3.4
+    image: quay.io/keycloak/keycloak:26.6.2
    network_mode: "host"
    command:
      - start-dev
@@ -112,12 +115,12 @@ services:
    profiles: ["keycloak", "vaultwarden"]
    container_name: keycloakSetup-${ENV:-dev}
    image: keycloak_setup-${ENV:-dev}
    network_mode: "host"
    build:
      context: compose/keycloak
      dockerfile: Dockerfile
      args:
-        KEYCLOAK_VERSION: 26.3.4
+        KEYCLOAK_VERSION: 26.6.2
    network_mode: "host"
    depends_on:
      - Keycloak
    restart: "no"
@@ -1,4 +1,4 @@
-import { firefox, type FullConfig } from '@playwright/test';
+import { type FullConfig } from '@playwright/test';
 import { execSync } from 'node:child_process';
 import fs from 'fs';
@@ -207,7 +207,7 @@ export async function startVault(browser: Browser, testInfo: TestInfo, env = {},
 }
 export async function stopVault(force: boolean = false) {
-    if( force === false && process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
+    if( force === false && process.env.PW_KEEP_SERVICE_RUNNING === "true" ) {
        console.log(`Keep vaultwarden running on: ${process.env.DOMAIN}`);
    } else {
        console.log(`Vaultwarden stopping`);
@@ -231,6 +231,7 @@ export async function checkNotification(page: Page, hasText: string) {
 }
 export async function cleanLanding(page: Page) {
    await page.context().clearCookies();
    await page.goto('/', { waitUntil: 'domcontentloaded' });
    await expect(page.getByRole('button').nth(0)).toBeVisible();
@@ -248,15 +249,3 @@ export async function logout(test: Test, page: Page, user: { name: string }) {
        await expect(page.getByRole('heading', { name: 'Log in' })).toBeVisible();
    });
 }
 export async function ignoreExtension(page: Page) {
    await page.waitForLoadState('domcontentloaded');
    try {
        await page.getByRole('button', { name: 'Add it later' }).click({timeout: 5_000});
        await page.getByRole('link', { name: 'Skip to web app' }).click();
    } catch (error) {
        console.log('Extension setup not visible. Continuing');
    }
 }
@@ -8,14 +8,14 @@
    "author": "",
    "license": "ISC",
    "devDependencies": {
-        "@playwright/test": "1.56.1",
+        "@playwright/test": "1.60.0",
-        "dotenv": "17.2.3",
+        "dotenv": "17.4.2",
-        "dotenv-expand": "12.0.3",
+        "dotenv-expand": "13.0.0",
-        "maildev": "npm:@timshel_npm/maildev@3.2.5"
+        "maildev": "npm:@timshel_npm/maildev@3.2.19"
    },
    "dependencies": {
-        "mysql2": "3.15.3",
+        "mysql2": "3.22.3",
-        "otpauth": "9.4.1",
+        "otpauth": "9.5.1",
-        "pg": "8.16.3"
+        "pg": "8.21.0"
    }
 }
@@ -25,10 +25,12 @@ export default defineConfig({
    /* Long global timeout for complex tests
     * But short action/nav/expect timeouts to fail on specific step (raise locally if not enough).
     */
-    timeout: 120 * 1000,
+    timeout: 240 * 1000,
-    actionTimeout: 20 * 1000,
+    actionTimeout: 40 * 1000,
-    navigationTimeout: 20 * 1000,
+    navigationTimeout: 40 * 1000,
-    expect: { timeout: 20 * 1000 },
+    expect: { timeout: 40 * 1000 },
    "permissions": ["clipboard-read"],
    /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
    use: {
@@ -37,6 +39,10 @@ export default defineConfig({
        browserName: 'firefox',
        locale: 'en-GB',
        timezoneId: 'Europe/London',
        ignoreHTTPSErrors: true,
        launchOptions: {
            args: ['--ignore-certificate-errors']
        },
        /* Always collect trace (other values add random test failures) See https://playwright.dev/docs/trace-viewer */
        trace: 'on',
@@ -10,7 +10,7 @@ DOCKER_BUILDKIT=1
 #####################
 # Playwright Config #
 #####################
-PW_KEEP_SERVICE_RUNNNING=${PW_KEEP_SERVICE_RUNNNING:-false}
+PW_KEEP_SERVICE_RUNNING=${PW_KEEP_SERVICE_RUNNING:-false}
 PW_SMTP_FROM=vaultwarden@playwright.test
 #####################
@@ -38,8 +38,8 @@ TEST_USER3_MAIL=${TEST_USER3}@example.com
 ###################
 # Keycloak Config #
 ###################
-KEYCLOAK_ADMIN=admin
+KC_BOOTSTRAP_ADMIN_USERNAME=admin
-KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
+KC_BOOTSTRAP_ADMIN_PASSWORD=${KC_BOOTSTRAP_ADMIN_USERNAME}
 KC_HTTP_HOST=127.0.0.1
 KC_HTTP_PORT=8081
@@ -52,10 +52,12 @@ DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
 # Vaultwarden Config #
 ######################
 ROCKET_PORT=8003
-DOMAIN=http://localhost:${ROCKET_PORT}
+ROCKET_TLS={certs="/data/ssl/localhost.crt",key="/data/ssl/localhost.key"}
 DOMAIN=https://127.0.0.1:${ROCKET_PORT}
 LOG_LEVEL=info,oidcwarden::sso=debug
 LOGIN_RATELIMIT_MAX_BURST=100
 ADMIN_TOKEN=admin
 CLIENT_SUPPRESS_ONBOARDING=true
 SMTP_SECURITY=off
 SMTP_PORT=${MAILDEV_SMTP_PORT}
@@ -1,6 +1,8 @@
 import { test, expect, type TestInfo } from '@playwright/test';
 import * as utils from "../global-utils";
 import * as orgs from './setups/orgs';
 import { createAccount } from './setups/user';
 let users = utils.loadEnv();
@@ -16,20 +18,12 @@ test.afterAll('Teardown', async ({}) => {
 test('Create', async ({ page }) => {
    await createAccount(test, page, users.user1);
-    await test.step('Create Org', async () => {
+    await orgs.create(test, page, 'New organisation');
        await page.getByRole('link', { name: 'New organisation' }).click();
        await page.getByLabel('Organisation name (required)').fill('Test');
        await page.getByRole('button', { name: 'Submit' }).click();
        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
        await utils.checkNotification(page, 'Organisation created');
    });
    await test.step('Create Collection', async () => {
-        await page.getByRole('link', { name: 'Collections' }).click();
+        await page.getByRole('button', { name: 'New', exact: true }).click();
        await page.getByRole('button', { name: 'New' }).click();
        await page.getByRole('menuitem', { name: 'Collection' }).click();
-        await page.getByLabel('Name (required)').fill('RandomCollec');
+        await page.getByRole('textbox', { name: 'Name * (required)', exact: true }).fill('RandomCollec');
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Created collection RandomCollec');
        await expect(page.getByRole('button', { name: 'RandomCollec' })).toBeVisible();
@@ -0,0 +1,56 @@
 import { test, expect, type Page, type TestInfo } from '@playwright/test';
 import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
 import { activateTOTP, disableTOTP } from './setups/2fa';
 let users = utils.loadEnv();
 let totp;
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {});
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
 });
 test('Change Key settings', async ({ page }) => {
    await createAccount(test, page, users.user1);
    await test.step('Change SHA-256 Iterations', async () => {
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Keys' }).click();
        await page.getByRole('spinbutton', { name: 'KDF iterations * (required)'}).fill('700000');
        await page.getByRole('button', { name: 'Update encryption settings' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Update settings' }).click();
        await page.getByRole('heading', { name: 'Log in' }).click();
    });
    await logUser(test, page, users.user1);
    await test.step('Switch to Argon2', async () => {
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Keys' }).click();
        await page.locator('.ng-arrow-wrapper').click();
        await page.getByText('Argon2id').click();
        await page.getByRole('spinbutton', { name: 'KDF memory (MB) * (required)'}).fill('16');
        await page.getByRole('spinbutton', { name: 'KDF iterations * (required)'}).fill('2');
        await page.getByRole('spinbutton', { name: 'KDF parallelism * (required)'}).fill('1');
        await page.getByRole('button', { name: 'Update encryption settings' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Update settings' }).click();
        await page.getByRole('heading', { name: 'Log in' }).click();
    });
    await logUser(test, page, users.user1);
 });
@@ -41,13 +41,10 @@ test('Account creation', async ({ page }) => {
 test('Login', async ({ context, page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
-    await logUser(test, page, users.user1, mailBuffer);
+    await logUser(test, page, users.user1, { mailBuffer });
    await test.step('verify email', async () => {
-        await page.getByText('Verify your account\'s email').click();
+        await page.getByRole('button', { name: "Send email" }).click();
        await expect(page.getByText('Verify your account\'s email')).toBeVisible();
        await page.getByRole('button', { name: 'Send email' }).click();
        await utils.checkNotification(page, 'Check your email inbox for a verification link');
        const verify = await mailBuffer.expect((m) => m.subject === "Verify Your Email");
@@ -78,26 +75,10 @@ test('Activate 2fa', async ({ page }) => {
 test('2fa', async ({ page }) => {
    const emails = mailserver.buffer(users.user1.email);
-    await test.step('login', async () => {
+    await logUser(test, page, users.user1, {
-        await page.goto('/');
+        mailBuffer: emails,
-
+        mail2fa: true,
-        await page.getByLabel(/Email address/).fill(users.user1.email);
+    });
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByLabel('Master password').fill(users.user1.password);
        await page.getByRole('button', { name: 'Log in with master password' }).click();
        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
        const code = await retrieveEmailCode(test, page, emails);
        await page.getByLabel(/Verification code/).fill(code);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Add it later' }).click();
        await page.getByRole('link', { name: 'Skip to web app' }).click();
        await expect(page).toHaveTitle(/Vaults/);
    })
    await disableEmail(test, page, users.user1);
    emails.close();
 });
@@ -37,8 +37,8 @@ test('Authenticator 2fa', async ({ page }) => {
        await page.getByLabel(/Email address/).fill(users.user1.email);
        await page.getByRole('button', { name: 'Continue' }).click();
-        await page.getByLabel('Master password').fill(users.user1.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
-        await page.getByRole('button', { name: 'Log in with master password' }).click();
+        await page.getByRole('button', { name: 'Log in', exact: true }).click();
        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
@@ -4,6 +4,7 @@ import { MailDev } from 'maildev';
 import * as utils from '../global-utils';
 import * as orgs from './setups/orgs';
 import { createAccount, logUser } from './setups/user';
 import { activateTOTP } from './setups/2fa';
 let users = utils.loadEnv();
@@ -20,6 +21,7 @@ test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
        EMAIL_2FA_AUTO_FALLBACK: "true",
    });
    mail1Buffer = mailServer.buffer(users.user1.email);
@@ -40,6 +42,16 @@ test('Invite users', async ({ page }) => {
    await createAccount(test, page, users.user1, mail1Buffer);
    await orgs.create(test, page, 'Test');
    await test.step(`Set account recovery`, async () => {
        await orgs.policies(test, page, 'Test');
        await page.getByRole('button', { name: 'Account recovery' }).click();
        await page.getByRole('checkbox', { name: 'Turn on' }).check();
        await page.getByRole('checkbox', { name: 'Automatically enroll new' }).check();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Edited policy Account recovery');
    });
    await orgs.members(test, page, 'Test');
    await orgs.invite(test, page, 'Test', users.user2.email);
    await orgs.invite(test, page, 'Test', users.user3.email, {
@@ -56,18 +68,16 @@ test('invited with new account', async ({ page }) => {
        await page.goto(link);
        await expect(page).toHaveTitle(/Create account | Vaultwarden Web/);
-        //await page.getByLabel('Name').fill(users.user2.name);
+        // await page.getByLabel('Name').fill(users.user2.name);
-        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
-        await page.getByLabel('Confirm master password (').fill(users.user2.password);
+        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Your new account has been created');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
        // Redirected to the vault
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
        // await utils.checkNotification(page, 'You have been logged in!');
        await utils.checkNotification(page, 'Successfully accepted your invitation');
    });
    await test.step('Check mails', async () => {
@@ -90,21 +100,19 @@ test('invited with existing account', async ({ page }) => {
    await page.getByRole('button', { name: 'Continue' }).click();
    // Unlock page
-    await page.getByLabel('Master password').fill(users.user3.password);
+    await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user3.password);
-    await page.getByRole('button', { name: 'Log in with master password' }).click();
+    await page.getByRole('button', { name: 'Log in', exact: true }).click();
    await utils.checkNotification(page, 'Invitation accepted');
    await utils.ignoreExtension(page);
    // We are now in the default vault page
    await expect(page).toHaveTitle(/Vaultwarden Web/);
    await utils.checkNotification(page, 'Successfully accepted your invitation');
    await mail3Buffer.expect((m) => m.subject === 'New Device Logged In From Firefox');
    await mail1Buffer.expect((m) => m.subject.includes('Invitation to Test accepted'));
 });
 test('Confirm invited user', async ({ page }) => {
-    await logUser(test, page, users.user1, mail1Buffer);
+    await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
    await orgs.members(test, page, 'Test');
    await orgs.confirm(test, page, 'Test', users.user2.email);
@@ -113,7 +121,40 @@ test('Confirm invited user', async ({ page }) => {
 });
 test('Organization is visible', async ({ page }) => {
-    await logUser(test, page, users.user2, mail2Buffer);
+    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
    await page.getByRole('button', { name: 'vault: Test', exact: true }).click();
    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
 });
 test('Recover user password', async ({ page }) => {
    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
    await activateTOTP(test, page, users.user2);
    await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
    let newPassword = "TotoNewPassword";
    await orgs.members(test, page, 'Test');
    await test.step(`Recover ${users.user2.email}`, async () => {
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
        await page.getByRole('row').filter({hasText: users.user2.email}).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Recover account' }).click();
        await page.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
        await page.getByRole('textbox', { name: 'Confirm new master password * (' }).fill(newPassword);
        await page.getByRole('checkbox', { name: 'Reset two-step login' }).check();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Account recovery success');
        await mail2Buffer.expect((m) => m.subject.includes('Admin account recovery from Test organization'));
    });
    let user2 = {
        email: users.user2.email,
        name: users.user2.name,
        password: newPassword,
    };
    await logUser(test, page, user2, {
        mailBuffer: mail2Buffer,
        mail2fa: true,
        notNewDevice: true,
    });
 });
@@ -0,0 +1,110 @@
 import { test, expect, type Page, type TestInfo } from '@playwright/test';
 import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
 let users = utils.loadEnv();
 let totp;
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {});
    const context = await browser.newContext();
    const page = await context.newPage();
    await createAccount(test, page, users.user1);
    await context.close();
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
 });
 test('Password', async ({ context, page }, testInfo: TestInfo) => {
    const label = 'Test Password';
    await logUser(test, page, users.user1);
    await test.step('Create password entry', async () => {
        await page.getByRole('button', { name: 'New item' }).click();
        await page.getByRole('textbox', { name: 'Item name * (required)' }).fill(label);
        await page.getByRole('textbox', { name: 'Username' }).fill(users.user1.name);
        await page.getByRole('textbox', { name: 'Password' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Item added');
        await page.getByRole('button', { name: 'Close' }).click();
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Check', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByRole('button', { name: label }).click();
        await page.getByTestId('copy-username').click();
        await utils.checkNotification(page, 'Username copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(users.user1.name)
        await page.getByTestId('copy-password').click();
        await utils.checkNotification(page, 'Password copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(users.user1.password)
        await page.getByRole('button', { name: 'Close' }).click();
    });
    await test.step('Delete', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Delete' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
        await utils.checkNotification(page, 'Item sent to bin');
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Deleted', async () => {
        await expect(page.getByRole('row').filter({ hasText: label })).toHaveCount(0)
    });
 });
 test('SSH Key', async ({ context, page }, testInfo: TestInfo) => {
    const label = 'Test SSH key';
    await logUser(test, page, users.user1);
    const privateKey = await test.step('Create key entry', async () => {
        await page.getByRole('button', { name: 'New', exact: true }).click();
        await page.getByRole('menuitem', { name: 'SSH key' }).click();
        await page.getByRole('textbox', { name: 'Item name * (required)' }).fill('Test SSH key');
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Item added');
        await page.getByRole('button', { name: 'Copy private key' }).click();
        await utils.checkNotification(page, 'Private key copied');
        return await page.evaluate(() => navigator.clipboard.readText());
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Check', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByRole('button', { name: label }).click();
        await page.getByRole('button', { name: 'Copy private key' }).click();
        await utils.checkNotification(page, 'Private key copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(privateKey)
        await page.getByRole('button', { name: 'Close' }).click();
    });
    await test.step('Delete', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Delete' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
        await utils.checkNotification(page, 'Item sent to bin');
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Deleted', async () => {
        await expect(page.getByRole('row').filter({ hasText: label })).toHaveCount(0)
    })
 });
@@ -0,0 +1,72 @@
 import { test, expect, type Page, type TestInfo } from '@playwright/test';
 import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount } from './setups/user';
 let users = utils.loadEnv();
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {});
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
 });
 test('Send', async ({ browser, page }) => {
    await createAccount(test, page, users.user1);
    const send_url = await test.step('Create', async () => {
        await page.getByRole('link', { name: 'Send' }).click();
        await expect(page.locator('#main-content').getByText('Send', { exact: true })).toBeVisible();
        await page.getByRole('button', { name: 'New Send', exact: true }).click();
        await page.getByRole('menuitem', { name: 'Text' }).click();
        await page.getByRole('textbox', { name: 'Send name * (required)' }).fill('Test');
        await page.getByRole('textbox', { name: 'Text to share * (required)' }).fill('test');
        await page.getByRole('button', { name: 'Save' }).click();
        await page.locator('footer').getByRole('button', { name: 'Copy link' }).click();
        return await page.evaluate(() => navigator.clipboard.readText());
    });
    const context2 = await browser.newContext();
    const page2 = await context2.newPage();
    await test.step('View', async () => {
        await page2.goto(send_url, { waitUntil: 'domcontentloaded' });
        await expect(page2.getByRole('heading', { name: 'View Send' })).toBeVisible();
        await expect(await page2.getByRole('paragraph').filter({ hasText: 'Test' })).toBeVisible();
    });
    const pwd_url = await test.step('Create with password', async () => {
        await page.getByRole('link', { name: 'Send' }).click();
        await expect(page.locator('#main-content').getByText('Send', { exact: true })).toBeVisible();
        await page.getByRole('button', { name: 'New' }).click();
        await page.getByRole('menuitem', { name: 'Text' }).click();
        await page.getByRole('textbox', { name: 'Send name * (required)' }).fill('Password');
        await page.getByRole('textbox', { name: 'Text to share * (required)' }).fill('password');
        await page.getByRole('combobox', { name: 'Who can view' }).click();
        await page.getByText('Anyone with a password set by you').click();
        await page.getByRole('textbox', { name: 'Password * (required)', exact: true }).fill('password');
        await page.getByRole('button', { name: 'Save' }).click();
        await page.locator('footer').getByRole('button', { name: 'Copy link' }).click();
        return await page.evaluate(() => navigator.clipboard.readText());
    });
    await test.step('View with password', async () => {
        await page2.goto(pwd_url, { waitUntil: 'domcontentloaded' });
        await expect(page2.getByRole('heading', { name: 'Enter the password to view' })).toBeVisible();
        await page2.getByRole('textbox', { name: 'Password * (required)' }).fill('password');
        await page2.getByRole('button', { name: 'Continue' }).click();
        await expect(page2.getByRole('heading', { name: 'View Send' })).toBeVisible();
        await expect(await page2.getByRole('paragraph').filter({ hasText: 'Password' })).toBeVisible();
    });
 });
@@ -11,10 +11,11 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByLabel('Master password (required)').fill(user.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
-        const secret = await page.getByLabel('Key').innerText();
+        const secret = await page.getByLabel('Key', { exact: true }).innerText();
        let totp = new OTPAuth.TOTP({ secret, period: 30 });
        await page.getByLabel(/Verification code/).fill(totp.generate());
@@ -33,8 +34,8 @@ export async function disableTOTP(test: Test, page: Page, user: { password: stri
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByLabel('Master password (required)').click();
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).click()
-        await page.getByLabel('Master password (required)').fill(user.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Turn off' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
@@ -49,7 +50,7 @@ export async function activateEmail(test: Test, page: Page, user: { name: string
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: 'Enter a code sent to your email' }).getByRole('button').click();
-        await page.getByLabel('Master password (required)').fill(user.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Send email' }).click();
    });
@@ -81,8 +82,8 @@ export async function disableEmail(test: Test, page: Page, user: { password: str
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: 'Email' }).getByRole('button').click();
-        await page.getByLabel('Master password (required)').click();
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).click()
-        await page.getByLabel('Master password (required)').fill(user.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Turn off' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
@@ -0,0 +1,21 @@
 import { expect, type Browser, Page } from '@playwright/test';
 import * as utils from '../../global-utils';
 utils.loadEnv();
 export async function login(test, page: Page) {
    await test.step(`Admin login`, async () => {
        await page.goto('/admin');
        await page.getByRole('textbox', { name: 'Enter admin token' }).fill(process.env.ADMIN_TOKEN);
        await page.getByRole('button', { name: 'Enter' }).click();
    });
 }
 export async function invite(test, page: Page, email: string) {
    await test.step(`Invite user with ${email}`, async () => {
        await page.getByRole('link', { name: 'Users' }).click();
        await page.getByRole('textbox', { name: 'Enter email' }).fill(email);
        await page.getByRole('button', { name: 'Invite' }).click();
        await expect(page.getByRole('row', { name: email })).toHaveText(/Invited/);
    });
 }
@@ -5,7 +5,7 @@ const utils = require('../../global-utils');
 utils.loadEnv();
 test('DB teardown ?', async ({ serviceName }) => {
-    if( process.env.PW_KEEP_SERVICE_RUNNNING !== "true" ) {
+    if( process.env.PW_KEEP_SERVICE_RUNNING !== "true" ) {
        utils.stopComposeService(serviceName);
    }
 });
@@ -3,11 +3,14 @@ import { expect, type Browser,Page } from '@playwright/test';
 import * as utils from '../../global-utils';
 export async function create(test, page: Page, name: string) {
-    await test.step('Create Org', async () => {
+    await test.step(`Create Org ${name}`, async () => {
-        await page.locator('a').filter({ hasText: 'Password Manager' }).first().click();
+        let pm_locator = page.locator('a').filter({ hasText: 'Password Manager' });
        if( await pm_locator.count() > 0 ){
            pm_locator.first().click();
        }
        await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        await page.getByRole('link', { name: 'New organisation' }).click();
-        await page.getByLabel('Organisation name (required)').fill(name);
+        await page.getByRole('textbox', { name: 'Organisation name * (required)', exact: true }).fill(name);
        await page.getByRole('button', { name: 'Submit' }).click();
        await utils.checkNotification(page, 'Organisation created');
@@ -18,7 +21,7 @@ export async function policies(test, page: Page, name: string) {
    await test.step(`Navigate to ${name} policies`, async () => {
        await page.locator('a').filter({ hasText: 'Admin Console' }).first().click();
        await page.locator('org-switcher').getByLabel(/Toggle collapse/).click();
-        await page.locator('org-switcher').getByRole('link', { name: `${name}` }).first().click();
+        await page.locator('org-switcher > bit-nav-group > div > bit-nav-item').filter({ hasText: `${name}` }).first().click();
        await expect(page.getByRole('heading', { name: `${name} collections` })).toBeVisible();
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Policies' }).click();
@@ -30,11 +33,11 @@ export async function members(test, page: Page, name: string) {
    await test.step(`Navigate to ${name} members`, async () => {
        await page.locator('a').filter({ hasText: 'Admin Console' }).first().click();
        await page.locator('org-switcher').getByLabel(/Toggle collapse/).click();
-        await page.locator('org-switcher').getByRole('link', { name: `${name}` }).first().click();
+        await page.locator('org-switcher > bit-nav-group > div > bit-nav-item').filter({ hasText: `${name}` }).first().click();
        await expect(page.getByRole('heading', { name: `${name} collections` })).toBeVisible();
-        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
+        await page.getByRole('link', { name: 'Members' }).click();
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
-        await expect(page.getByRole('cell', { name: 'All' })).toBeVisible();
+        await expect(page.getByRole('columnheader', { name: 'Select all' })).toBeVisible();
    });
 }
@@ -42,13 +45,13 @@ export async function invite(test, page: Page, name: string, email: string) {
    await test.step(`Invite ${email}`, async () => {
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
        await page.getByRole('button', { name: 'Invite member' }).click();
-        await page.getByLabel('Email (required)').fill(email);
+        await page.getByRole('textbox', { name: 'Email * (required)', exact: true }).fill(email);
        await page.getByRole('tab', { name: 'Collections' }).click();
        await page.getByRole('combobox', { name: 'Permission' }).click();
        await page.getByText('Edit items', { exact: true }).click();
-        await page.getByLabel('Select collections').click();
+        await page.getByRole('combobox', { name: 'Select collections' }).click();
-        await page.getByText('Default collection').click();
+        await page.getByLabel('Options List').getByText('Default collection').click();
-        await page.getByRole('cell', { name: 'Collection', exact: true }).click();
+        await page.getByRole('columnheader', { name: 'Collection', exact: true }).click();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'User(s) invited');
    });
@@ -6,7 +6,7 @@ const utils = require('../../global-utils');
 utils.loadEnv();
 test('Keycloak teardown', async () => {
-    if( process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
+    if( process.env.PW_KEEP_SERVICE_RUNNING === "true" ) {
        console.log("Keep Keycloak running");
    } else {
        console.log("Keycloak stopping");
@@ -15,11 +15,8 @@ export async function logNewUser(
    options: { mailBuffer?: MailBuffer } = {}
 ) {
    await test.step(`Create user ${user.name}`, async () => {
        await page.context().clearCookies();
        await test.step('Landing page', async () => {
            await utils.cleanLanding(page);
            await page.locator("input[type=email].vw-email-sso").fill(user.email);
            await page.getByRole('button', { name: /Use single sign-on/ }).click();
        });
@@ -33,26 +30,24 @@ export async function logNewUser(
        await test.step('Create Vault account', async () => {
            await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-            await page.getByLabel('Master password (required)', { exact: true }).fill(user.password);
+            await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
-            await page.getByLabel('Confirm master password (').fill(user.password);
+            await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(user.password);
            await page.getByRole('button', { name: 'Create account' }).click();
        });
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
        await test.step('Default vault page', async () => {
            await expect(page).toHaveTitle(/Vaultwarden Web/);
            await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        });
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        if( options.mailBuffer ){
            let mailBuffer = options.mailBuffer;
            await test.step('Check emails', async () => {
                await mailBuffer.expect((m) => m.subject === "Welcome");
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
                await mailBuffer.expect((m) => m.subject === "Welcome");
            });
        }
    });
@@ -69,16 +64,14 @@ export async function logUser(
        mailBuffer ?: MailBuffer,
        totp?: OTPAuth.TOTP,
        mail2fa?: boolean,
        notNewDevice?: boolean,
    } = {}
 ) {
    let mailBuffer = options.mailBuffer;
    await test.step(`Log user ${user.email}`, async () => {
        await page.context().clearCookies();
        await test.step('Landing page', async () => {
            await utils.cleanLanding(page);
            await page.locator("input[type=email].vw-email-sso").fill(user.email);
            await page.getByRole('button', { name: /Use single sign-on/ }).click();
        });
@@ -117,14 +110,12 @@ export async function logUser(
            await page.getByRole('button', { name: 'Unlock' }).click();
        });
        await utils.ignoreExtension(page);
        await test.step('Default vault page', async () => {
            await expect(page).toHaveTitle(/Vaultwarden Web/);
            await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        });
-        if( mailBuffer ){
+        if( mailBuffer && !options.notNewDevice ){
            await test.step('Check email', async () => {
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
            });
@@ -3,6 +3,7 @@ import { expect, type Browser, Page } from '@playwright/test';
 import { type MailBuffer } from 'maildev';
 import * as utils from '../../global-utils';
 import { retrieveEmailCode } from './2fa';
 export async function createAccount(test, page: Page, user: { email: string, name: string, password: string }, mailBuffer?: MailBuffer) {
    await test.step(`Create user ${user.name}`, async () => {
@@ -17,12 +18,11 @@ export async function createAccount(test, page: Page, user: { email: string, nam
        await page.getByRole('button', { name: 'Continue' }).click();
        // Vault finish Creation
-        await page.getByLabel('Master password (required)', { exact: true }).fill(user.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
-        await page.getByLabel('Confirm master password (').fill(user.password);
+        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(user.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Your new account has been created')
        await utils.ignoreExtension(page);
        // We are now in the default vault page
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
@@ -35,7 +35,16 @@ export async function createAccount(test, page: Page, user: { email: string, nam
    });
 }
-export async function logUser(test, page: Page, user: { email: string, password: string }, mailBuffer?: MailBuffer) {
+export async function logUser(
    test,
    page: Page,
    user: { email: string, password: string },
    options: {
        mailBuffer ?: MailBuffer,
        mail2fa?: boolean,
        notNewDevice?: boolean,
    } = {}
 ) {
    await test.step(`Log user ${user.email}`, async () => {
        await utils.cleanLanding(page);
@@ -43,16 +52,23 @@ export async function logUser(test, page: Page, user: { email: string, password:
        await page.getByRole('button', { name: 'Continue' }).click();
        // Unlock page
-        await page.getByLabel('Master password').fill(user.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
-        await page.getByRole('button', { name: 'Log in with master password' }).click();
+        await page.getByRole('button', { name: 'Log in', exact: true }).click();
-        await utils.ignoreExtension(page);
+        if( options.mail2fa ){
            await test.step('2FA check', async () => {
                await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
                let code = await retrieveEmailCode(test, page, options.mailBuffer);
                await page.getByLabel(/Verification code/).fill(code);
                await page.getByRole('button', { name: 'Continue' }).click();
            });
        }
        // We are now in the default vault page
        await expect(page).toHaveTitle(/Vaultwarden Web/);
-        if( mailBuffer ){
+        if( options.mailBuffer && !options.notNewDevice ){
-            await mailBuffer.expect((m) => m.subject === "New Device Logged In From Firefox");
+            await options.mailBuffer.expect((m) => m.subject === "New Device Logged In From Firefox");
        }
    });
 }
@@ -1,6 +1,7 @@
 import { test, expect, type TestInfo } from '@playwright/test';
 import { MailDev } from 'maildev';
 import * as admin from "./setups/admin";
 import { logNewUser, logUser } from './setups/sso';
 import { activateEmail, disableEmail } from './setups/2fa';
 import * as utils from "../global-utils";
@@ -19,7 +20,7 @@ test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {
        SSO_ENABLED: true,
-        SSO_ONLY: false,
+        SSO_ONLY: true,
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
    });
@@ -32,22 +33,64 @@ test.afterAll('Teardown', async ({}) => {
    }
 });
-test('Create and activate 2FA', async ({ page }) => {
+test('2FA email', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
    await logNewUser(test, page, users.user1, {mailBuffer: mailBuffer});
    await activateEmail(test, page, users.user1, mailBuffer);
-    mailBuffer.close();
+    await logUser(test, page, users.user1, {mailBuffer: mailBuffer, mail2fa: true, notNewDevice: true});
 });
 test('Log and disable', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
    await logUser(test, page, users.user1, {mailBuffer: mailBuffer, mail2fa: true});
    await disableEmail(test, page, users.user1);
    mailBuffer.close();
 });
 test('Admin invite', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user2.email);
    await admin.login(test, page);
    await admin.invite(test, page, users.user2.email);
    const link = await test.step('Extract email link', async () => {
        const invited = await mailBuffer.expect((m) => m.subject === "Join Vaultwarden");
        await page.setContent(invited.html);
        return await page.getByTestId("invite").getAttribute("href");
    });
    await test.step('Redirect to Keycloak', async () => {
        await page.goto(link);
    });
    await test.step('Keycloak login', async () => {
        await expect(page.getByRole('heading', { name: 'Sign in to your account' })).toBeVisible();
        await page.getByLabel(/Username/).fill(users.user2.name);
        await page.getByLabel('Password', { exact: true }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Sign In' }).click();
    });
    await test.step('Create Vault account', async () => {
        await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
    });
    await test.step('Check mails', async () => {
        await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
        await mailBuffer.expect((m) => m.subject === "Welcome");
    });
    mailBuffer.close();
 });
@@ -33,8 +33,8 @@ test('Non SSO login', async ({ page }) => {
    await page.getByRole('button', { name: 'Other' }).click();
    // Unlock page
-    await page.getByLabel('Master password').fill(users.user1.password);
+    await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
-    await page.getByRole('button', { name: 'Log in with master password' }).click();
+    await page.getByRole('button', { name: 'Log in', exact: true }).click();
    // We are now in the default vault page
    await expect(page).toHaveTitle(/Vaultwarden Web/);
@@ -58,6 +58,7 @@ test('Non SSO login impossible', async ({ page, browser }, testInfo: TestInfo) =
    // Landing page
    await page.goto('/');
    await page.locator("input[type=email].vw-email-sso").fill(users.user1.email);
    // Check that SSO login is available
    await expect(page.getByRole('button', { name: /Use single sign-on/ })).toHaveCount(1);
@@ -66,7 +67,6 @@ test('Non SSO login impossible', async ({ page, browser }, testInfo: TestInfo) =
    await expect(page.getByRole('button', { name: 'Other' })).toHaveCount(0);
 });
 test('No SSO login', async ({ page }, testInfo: TestInfo) => {
    await utils.restartVault(page, testInfo, {
        SSO_ENABLED: false
@@ -74,12 +74,14 @@ test('No SSO login', async ({ page }, testInfo: TestInfo) => {
    // Landing page
    await page.goto('/');
    await page.getByLabel(/Email address/).fill(users.user1.email);
    // No SSO button (rely on a correct selector checked in previous test)
    await page.getByLabel('Master password');
    await expect(page.getByRole('button', { name: /Use single sign-on/ })).toHaveCount(0);
    // Can continue to Master password
    await page.getByLabel(/Email address/).fill(users.user1.email);
    await page.getByRole('button', { name: 'Continue' }).click();
-    await expect(page.getByRole('button', { name: 'Log in with master password' })).toHaveCount(1);
+    await expect(page.getByRole('button', { name: 'Log in' })).toHaveCount(1);
 });
@@ -67,17 +67,16 @@ test('invited with new account', async ({ page }) => {
    await test.step('Create Vault account', async () => {
        await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
-        await page.getByLabel('Confirm master password (').fill(users.user2.password);
+        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle(/Vaultwarden Web/);
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
    });
    await test.step('Check mails', async () => {
@@ -95,6 +94,7 @@ test('invited with existing account', async ({ page }) => {
    await test.step('Redirect to Keycloak', async () => {
        await page.goto(link);
        await page.getByRole('button', { name: /Use single sign-on/ }).click();
    });
    await test.step('Keycloak login', async () => {
@@ -108,13 +108,11 @@ test('invited with existing account', async ({ page }) => {
        await expect(page).toHaveTitle('Vaultwarden Web');
        await page.getByLabel('Master password').fill(users.user3.password);
        await page.getByRole('button', { name: 'Unlock' }).click();
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle(/Vaultwarden Web/);
        await utils.checkNotification(page, 'Successfully accepted your invitation');
    });
    await test.step('Check mails', async () => {
@@ -49,7 +49,7 @@ test('Organization is visible', async ({ page }) => {
    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
 });
-test('Enforce password policy', async ({ page }) => {
+test('Activate password policy', async ({ page }) => {
    await logUser(test, page, users.user1);
    await orgs.policies(test, page, '/Test');
@@ -61,16 +61,27 @@ test('Enforce password policy', async ({ page }) => {
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Edited policy Master password requirements.');
    });
-
+});
-    await utils.logout(test, page, users.user1);
+
-
+test('Unlock trigger policyy', async ({ page }) => {
-    await test.step(`Unlock trigger policy`, async () => {
+    await page.goto('/', { waitUntil: 'domcontentloaded' });
-        await page.locator("input[type=email].vw-email-sso").fill(users.user1.email);
+
-        await page.getByRole('button', { name: 'Use single sign-on' }).click();
+    await page.locator("input[type=email].vw-email-sso").fill(users.user2.email);
-
+    await page.getByRole('button', { name: /Use single sign-on/ }).click();
-        await page.getByRole('textbox', { name: 'Master password (required)' }).fill(users.user1.password);
+
-        await page.getByRole('button', { name: 'Unlock' }).click();
+    await test.step('Keycloak login', async () => {
-
+        await expect(page.getByRole('heading', { name: 'Sign in to your account' })).toBeVisible();
-        await expect(page.getByRole('heading', { name: 'Update master password' })).toBeVisible();
+        await page.getByLabel(/Username/).fill(users.user2.name);
-    });
+        await page.getByLabel('Password', { exact: true }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Sign In' }).click();
    });
    await test.step('Unlock vault', async () => {
        await expect(page).toHaveTitle('Vaultwarden Web');
        await expect(page.getByRole('heading', { name: 'Your vault is locked' })).toBeVisible();
        await page.getByLabel('Master password').fill(users.user2.password);
        await page.getByRole('button', { name: 'Unlock' }).click();
    });
    await expect(page.getByRole('heading', { name: 'Update master password' })).toBeVisible();
 });
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.95.0"
+channel = "1.99.0"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
@@ -1,4 +1,4 @@
-edition = "2021"
+edition = "2024"
 max_width = 120
 newline_style = "Unix"
 use_small_heuristics = "Off"
@@ -2,40 +2,40 @@ use std::{env, sync::LazyLock};
 use reqwest::Method;
 use rocket::{
    Catcher, Route,
    form::Form,
    http::{Cookie, CookieJar, MediaType, SameSite, Status},
    request::{FromRequest, Outcome, Request},
-    response::{content::RawHtml as Html, Redirect},
+    response::{Redirect, content::RawHtml as Html},
    serde::json::Json,
    Catcher, Route,
 };
 use serde::de::DeserializeOwned;
 use serde_json::Value;
 use crate::{
    CONFIG, VERSION,
    api::{
        ApiResult, EmptyResult, JsonResult, Notify,
        core::{log_event, two_factor},
-        unregister_push_device, ApiResult, EmptyResult, JsonResult, Notify,
+        unregister_push_device,
    },
-    auth::{decode_admin, encode_jwt, generate_admin_claims, ClientIp, Secure},
+    auth::{ClientIp, Secure, decode_admin, encode_jwt, generate_admin_claims},
    config::ConfigBuilder,
    db::{
-        backup_sqlite, get_sql_server_version,
+        ACTIVE_DB_TYPE, DbConn, DbConnType, backup_sqlite, get_sql_server_version,
        models::{
            Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
            MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
        },
        DbConn, DbConnType, ACTIVE_DB_TYPE,
    },
    error::{Error, MapResult},
    http_client::make_http_request,
    mail,
    sso::FAKE_SSO_IDENTIFIER,
    util::{
-        container_base_image, format_naive_datetime_local, get_active_web_release, get_display_size,
+        FeatureFlagFilter, NumberOrString, container_base_image, format_naive_datetime_local, get_active_web_release,
-        is_running_in_container, parse_experimental_client_feature_flags, FeatureFlagFilter, NumberOrString,
+        get_display_size, is_running_in_container, parse_experimental_client_feature_flags,
    },
    CONFIG, VERSION,
 };
 pub fn routes() -> Vec<Route> {
@@ -93,8 +93,7 @@ static DB_TYPE: LazyLock<&str> = LazyLock::new(|| match ACTIVE_DB_TYPE.get() {
 });
 #[cfg(sqlite)]
-static CAN_BACKUP: LazyLock<bool> =
+static CAN_BACKUP: LazyLock<bool> = LazyLock::new(|| ACTIVE_DB_TYPE.get().is_some_and(|t| *t == DbConnType::Sqlite));
    LazyLock::new(|| ACTIVE_DB_TYPE.get().map(|t| *t == DbConnType::Sqlite).unwrap_or(false));
 #[cfg(not(sqlite))]
 static CAN_BACKUP: LazyLock<bool> = LazyLock::new(|| false);
@@ -200,13 +199,7 @@ fn post_admin_login(
    }
    // If the token is invalid, redirect to login page
-    if !_validate_token(&data.token) {
+    if validate_token(&data.token) {
        error!("Invalid admin token. IP: {}", ip.ip);
        Err(AdminResponse::Unauthorized(render_admin_login(
            Some("Invalid admin token, please try again."),
            redirect.as_deref(),
        )))
    } else {
        // If the token received is valid, generate JWT and save it as a cookie
        let claims = generate_admin_claims();
        let jwt = encode_jwt(&claims);
@@ -224,15 +217,21 @@ fn post_admin_login(
        } else {
            Err(AdminResponse::Ok(render_admin_page()))
        }
    } else {
        error!("Invalid admin token. IP: {}", ip.ip);
        Err(AdminResponse::Unauthorized(render_admin_login(
            Some("Invalid admin token, please try again."),
            redirect.as_deref(),
        )))
    }
 }
-fn _validate_token(token: &str) -> bool {
+fn validate_token(token: &str) -> bool {
    match CONFIG.admin_token().as_ref() {
        None => false,
        Some(t) if t.starts_with("$argon2") => {
            use argon2::password_hash::PasswordVerifier;
-            match argon2::password_hash::PasswordHash::new(t) {
+            match argon2::password_hash::phc::PasswordHash::new(t) {
                Ok(h) => {
                    // NOTE: hash params from `ADMIN_TOKEN` are used instead of what is configured in the `Argon2` instance.
                    argon2::Argon2::default().verify_password(token.trim().as_ref(), &h).is_ok()
@@ -307,21 +306,14 @@ async fn get_user_or_404(user_id: &UserId, conn: &DbConn) -> ApiResult<User> {
 #[post("/invite", format = "application/json", data = "<data>")]
 async fn invite_user(data: Json<InviteData>, _token: AdminToken, conn: DbConn) -> JsonResult {
-    let data: InviteData = data.into_inner();
+    async fn generate_invite(user: &User, conn: &DbConn) -> EmptyResult {
    if User::find_by_mail(&data.email, &conn).await.is_some() {
        err_code!("User already exists", Status::Conflict.code)
    }
    let mut user = User::new(&data.email, None);
    async fn _generate_invite(user: &User, conn: &DbConn) -> EmptyResult {
        if CONFIG.mail_enabled() {
            let org_id: OrganizationId = if CONFIG.sso_enabled() {
                FAKE_SSO_IDENTIFIER.into()
            } else {
                FAKE_ADMIN_UUID.into()
            };
-            let member_id: MembershipId = FAKE_ADMIN_UUID.to_string().into();
+            let member_id: MembershipId = FAKE_ADMIN_UUID.to_owned().into();
            mail::send_invite(user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
        } else {
            let invitation = Invitation::new(&user.email);
@@ -329,7 +321,14 @@ async fn invite_user(data: Json<InviteData>, _token: AdminToken, conn: DbConn) -
        }
    }
-    _generate_invite(&user, &conn).await.map_err(|e| e.with_code(Status::InternalServerError.code))?;
+    let data: InviteData = data.into_inner();
    if User::find_by_mail(&data.email, &conn).await.is_some() {
        err_code!("User already exists", Status::Conflict.code)
    }
    let mut user = User::new(&data.email, None);
    generate_invite(&user, &conn).await.map_err(|e| e.with_code(Status::InternalServerError.code))?;
    user.save(&conn).await.map_err(|e| e.with_code(Status::InternalServerError.code))?;
    Ok(Json(user.to_json(&conn).await))
@@ -386,7 +385,7 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri
            None => json!("Never"),
        };
-        usr["sso_identifier"] = json!(sso_u.map(|u| u.identifier.to_string()).unwrap_or(String::new()));
+        usr["sso_identifier"] = json!(sso_u.map_or(String::new(), |u| u.identifier.to_string()));
        users_json.push(usr);
    }
@@ -426,7 +425,7 @@ async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyR
    for membership in memberships {
        log_event(
-            EventType::OrganizationUserDeleted as i32,
+            EventType::OrganizationUserDeleted,
            &membership.uuid,
            &membership.org_uuid,
            &ACTING_ADMIN_USER.into(),
@@ -447,7 +446,7 @@ async fn delete_sso_user(user_id: UserId, token: AdminToken, conn: DbConn) -> Em
    for membership in memberships {
        log_event(
-            EventType::OrganizationUserUnlinkedSso as i32,
+            EventType::OrganizationUserUnlinkedSso,
            &membership.uuid,
            &membership.org_uuid,
            &ACTING_ADMIN_USER.into(),
@@ -469,10 +468,10 @@ async fn deauth_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Noti
    if CONFIG.push_enabled() {
        for device in Device::find_push_devices_by_user(&user.uuid, &conn).await {
-            match unregister_push_device(&device.push_uuid).await {
+            match unregister_push_device(device.push_uuid.as_ref()).await {
                Ok(r) => r,
                Err(e) => error!("Unable to unregister devices from Bitwarden server: {e}"),
-            };
+            }
        }
    }
@@ -509,6 +508,7 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty
 async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
    let mut user = get_user_or_404(&user_id, &conn).await?;
    TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
    Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
    two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?;
    user.totp_recover = None;
    user.save(&conn).await
@@ -528,7 +528,7 @@ async fn resend_user_invite(user_id: UserId, _token: AdminToken, conn: DbConn) -
            } else {
                FAKE_ADMIN_UUID.into()
            };
-            let member_id: MembershipId = FAKE_ADMIN_UUID.to_string().into();
+            let member_id: MembershipId = FAKE_ADMIN_UUID.to_owned().into();
            mail::send_invite(&user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
        } else {
            Ok(())
@@ -554,9 +554,10 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
        err!("The specified user isn't member of the organization")
    };
-    let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
+    let new_type = if let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) {
-        Some(new_type) => new_type as i32,
+        new_type as i32
-        None => err!("Invalid type"),
+    } else {
        err!("Invalid type")
    };
    if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
@@ -571,7 +572,7 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
    OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
    log_event(
-        EventType::OrganizationUserUpdated as i32,
+        EventType::OrganizationUserUpdated,
        &member_to_edit.uuid,
        &data.org_uuid,
        &ACTING_ADMIN_USER.into(),
@@ -643,11 +644,11 @@ async fn has_http_access() -> bool {
    }
 }
-use cached::proc_macro::cached;
+use cached::macros::cached;
 /// Cache this function to prevent API call rate limit. Github only allows 60 requests per hour, and we use 3 here already
 /// It will cache this function for 600 seconds (10 minutes) which should prevent the exhaustion of the rate limit
 /// Any cache will be lost if Vaultwarden is restarted
-#[cached(time = 600, sync_writes = "default")]
+#[cached(ttl_secs = 600, sync_writes = "default")]
 async fn get_release_info(has_http_access: bool) -> (String, String, String) {
    // If the HTTP Check failed, do not even attempt to check for new versions since we were not able to connect with github.com anyway.
    if has_http_access {
@@ -656,42 +657,40 @@ async fn get_release_info(has_http_access: bool) -> (String, String, String) {
                .await
            {
                Ok(r) => r.tag_name,
-                _ => "-".to_string(),
+                _ => "-".to_owned(),
            },
            match get_json_api::<GitCommit>("https://api.github.com/repos/dani-garcia/vaultwarden/commits/main").await {
                Ok(mut c) => {
                    c.sha.truncate(8);
                    c.sha
                }
-                _ => "-".to_string(),
+                _ => "-".to_owned(),
            },
            // Do not fetch the web-vault version when running within a container
            // The web-vault version is embedded within the container it self, and should not be updated manually
            match get_json_api::<GitRelease>("https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest")
                .await
            {
-                Ok(r) => r.tag_name.trim_start_matches('v').to_string(),
+                Ok(r) => r.tag_name.trim_start_matches('v').to_owned(),
-                _ => "-".to_string(),
+                _ => "-".to_owned(),
            },
        )
    } else {
-        ("-".to_string(), "-".to_string(), "-".to_string())
+        ("-".to_owned(), "-".to_owned(), "-".to_owned())
    }
 }
 async fn get_ntp_time(has_http_access: bool) -> String {
-    if has_http_access {
+    if has_http_access && let Ok(cf_trace) = get_text_api("https://cloudflare.com/cdn-cgi/trace").await {
-        if let Ok(cf_trace) = get_text_api("https://cloudflare.com/cdn-cgi/trace").await {
+        for line in cf_trace.lines() {
-            for line in cf_trace.lines() {
+            if let Some((key, value)) = line.split_once('=')
-                if let Some((key, value)) = line.split_once('=') {
+                && key == "ts"
-                    if key == "ts" {
+            {
-                        let ts = value.split_once('.').map_or(value, |(s, _)| s);
+                let ts = value.split_once('.').map_or(value, |(s, _)| s);
-                        if let Ok(dt) = chrono::DateTime::parse_from_str(ts, "%s") {
+                if let Ok(dt) = chrono::DateTime::parse_from_str(ts, "%s") {
-                            return dt.format("%Y-%m-%d %H:%M:%S UTC").to_string();
+                    return dt.format("%Y-%m-%d %H:%M:%S UTC").to_string();
                        }
                        break;
                    }
                }
                break;
            }
        }
    }
@@ -718,6 +717,36 @@ fn web_vault_compare(active: &str, latest: &str) -> i8 {
    }
 }
 fn check_template_overrides() -> Vec<&'static str> {
    let template_folder = std::path::PathBuf::from(CONFIG.templates_folder());
    let mut overrides = Vec::new();
    for folder in ["admin", "email", "scss"] {
        if folder_has_hbs_files(&template_folder.join(folder)) {
            overrides.push(folder);
        }
    }
    if folder_has_hbs_files(&template_folder) {
        overrides.push("other");
    }
    overrides
 }
 fn folder_has_hbs_files(dir: &std::path::Path) -> bool {
    let Ok(files) = std::fs::read_dir(dir) else {
        // No files in this directory at all, so we can return false
        return false;
    };
    files.flatten().any(|f| {
        // Validate if it is a file and if it has the `.hbs` extension and starts with a-z or 0-9
        f.file_type().is_ok_and(|t| t.is_file())
            && f.path().extension().is_some_and(|e| e.eq_ignore_ascii_case("hbs"))
            && f.file_name().to_str().is_some_and(|n| n.starts_with(|c: char| c.is_ascii_alphanumeric()))
    })
 }
 #[get("/diagnostics")]
 async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> ApiResult<Html<String>> {
    use chrono::prelude::*;
@@ -734,7 +763,7 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
    // Check if we are able to resolve DNS entries
    let dns_resolved = match ("github.com", 0).to_socket_addrs().map(|mut i| i.next()) {
        Ok(Some(a)) => a.ip().to_string(),
-        _ => "Unable to resolve domain name.".to_string(),
+        _ => "Unable to resolve domain name.".to_owned(),
    };
    let (latest_vw_release, latest_vw_commit, latest_web_release) = get_release_info(has_http_access).await;
@@ -745,7 +774,7 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
    let invalid_feature_flags: Vec<String> = parse_experimental_client_feature_flags(
        &CONFIG.experimental_client_feature_flags(),
-        FeatureFlagFilter::InvalidOnly,
+        &FeatureFlagFilter::InvalidOnly,
    )
    .into_keys()
    .collect();
@@ -772,6 +801,7 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
        "db_version": get_sql_server_version(&conn).await,
        "admin_url": format!("{}/diagnostics", admin_url()),
        "overrides": &CONFIG.get_overrides().join(", "),
        "template_overrides": check_template_overrides().join(", "),
        "invalid_feature_flags": invalid_feature_flags,
        "host_arch": env::consts::ARCH,
        "host_os":  env::consts::OS,
@@ -834,33 +864,30 @@ impl<'r> FromRequest<'r> for AdminToken {
    type Error = &'static str;
    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let ip = match ClientIp::from_request(request).await {
+        let Outcome::Success(ip) = ClientIp::from_request(request).await else {
-            Outcome::Success(ip) => ip,
+            err_handler!("Error getting Client IP")
            _ => err_handler!("Error getting Client IP"),
        };
        if !CONFIG.disable_admin_token() {
            let cookies = request.cookies();
-            let access_token = match cookies.get(COOKIE_NAME) {
+            let access_token = if let Some(cookie) = cookies.get(COOKIE_NAME) {
-                Some(cookie) => cookie.value(),
+                cookie.value()
-                None => {
+            } else {
-                    let requested_page =
+                let requested_page =
-                        request.segments::<std::path::PathBuf>(0..).unwrap_or_default().display().to_string();
+                    request.segments::<std::path::PathBuf>(0..).unwrap_or_default().display().to_string();
-                    // When the requested page is empty, it is `/admin`, in that case, Forward, so it will render the login page
+                // When the requested page is empty, it is `/admin`, in that case, Forward, so it will render the login page
-                    // Else, return a 401 failure, which will be caught
+                // Else, return a 401 failure, which will be caught
-                    if requested_page.is_empty() {
+                if requested_page.is_empty() {
-                        return Outcome::Forward(Status::Unauthorized);
+                    return Outcome::Forward(Status::Unauthorized);
                    } else {
                        return Outcome::Error((Status::Unauthorized, "Unauthorized"));
                    }
                }
                return Outcome::Error((Status::Unauthorized, "Unauthorized"));
            };
            if decode_admin(access_token).is_err() {
                // Remove admin cookie
                cookies.remove(Cookie::build(COOKIE_NAME).path(admin_path()));
-                error!("Invalid or expired admin JWT. IP: {}.", &ip.ip);
+                error!("Invalid or expired admin JWT. IP: {}.", ip.ip);
                return Outcome::Error((Status::Unauthorized, "Session expired"));
            }
        }
@@ -879,23 +906,23 @@ mod tests {
    fn validate_web_vault_compare() {
        // web_vault_compare(active, latest)
        // Test normal versions
-        assert!(web_vault_compare("2025.12.0", "2025.12.1") == -1);
+        assert_eq!(web_vault_compare("2025.12.0", "2025.12.1"), -1);
-        assert!(web_vault_compare("2025.12.1", "2025.12.1") == 0);
+        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1"), 0);
-        assert!(web_vault_compare("2025.12.2", "2025.12.1") == 1);
+        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1"), 1);
        // Test patched/+build.n versions
        // Newer latest version
-        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1") == -1);
+        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1"), -1);
-        assert!(web_vault_compare("2025.12.1", "2025.12.1+build.1") == -1);
+        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1+build.1"), -1);
-        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1") == -1);
+        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1"), -1);
-        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2") == -1);
+        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2"), -1);
        // Equal versions
-        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1") == 0);
+        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1"), 0);
-        assert!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2") == 0);
+        assert_eq!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2"), 0);
        // Newer active version
-        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1") == 1);
+        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1"), 1);
-        assert!(web_vault_compare("2025.12.2", "2025.12.1+build.1") == 1);
+        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1+build.1"), 1);
-        assert!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1") == 1);
+        assert_eq!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1"), 1);
-        assert!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2") == 1);
+        assert_eq!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2"), 1);
    }
 }
@@ -1,23 +1,23 @@
 use chrono::{TimeDelta, Utc};
-use rocket::{serde::json::Json, Route};
+use rocket::{Route, serde::json::Json};
 use serde_json::Value;
 use crate::{
    CONFIG,
    api::{
        core::{CipherSyncData, CipherSyncType},
        EmptyResult, JsonResult,
        core::{CipherSyncData, CipherSyncType},
    },
-    auth::{decode_emergency_access_invite, Headers},
+    auth::{Headers, decode_emergency_access_invite},
    db::{
        DbConn, DbPool,
        models::{
            Cipher, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType, Invitation,
            Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
        },
        DbConn, DbPool,
    },
    mail,
    util::NumberOrString,
    CONFIG,
 };
 pub fn routes() -> Vec<Route> {
@@ -55,7 +55,7 @@ async fn get_contacts(headers: Headers, conn: DbConn) -> Json<Value> {
    let mut emergency_access_list_json = Vec::with_capacity(emergency_access_list.len());
    for ea in emergency_access_list {
        if let Some(grantee) = ea.to_json_grantee_details(&conn).await {
-            emergency_access_list_json.push(grantee)
+            emergency_access_list_json.push(grantee);
        }
    }
@@ -89,11 +89,14 @@ async fn get_grantees(headers: Headers, conn: DbConn) -> Json<Value> {
 async fn get_emergency_access(emer_id: EmergencyAccessId, headers: Headers, conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;
-    match EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await {
+    if let Some(emergency_access) =
-        Some(emergency_access) => Ok(Json(
+        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
    {
        Ok(Json(
            emergency_access.to_json_grantee_details(&conn).await.expect("Grantee user should exist but does not!"),
-        )),
+        ))
-        None => err!("Emergency access not valid."),
+    } else {
        err!("Emergency access not valid.")
    }
 }
@@ -136,9 +139,10 @@ async fn post_emergency_access(
        err!("Emergency access not valid.")
    };
-    let new_type = match EmergencyAccessType::from_str(&data.r#type.into_string()) {
+    let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
-        Some(new_type) => new_type as i32,
+        new_type as i32
-        None => err!("Invalid emergency access type."),
+    } else {
        err!("Invalid emergency access type.")
    };
    emergency_access.atype = new_type;
@@ -205,9 +209,10 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
    let emergency_access_status = EmergencyAccessStatus::Invited as i32;
-    let new_type = match EmergencyAccessType::from_str(&data.r#type.into_string()) {
+    let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
-        Some(new_type) => new_type as i32,
+        new_type as i32
-        None => err!("Invalid emergency access type."),
+    } else {
        err!("Invalid emergency access type.")
    };
    let grantor_user = headers.user;
@@ -220,7 +225,7 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
    let (grantee_user, new_user) = match User::find_by_mail(&email, &conn).await {
        None => {
            if !CONFIG.invitations_allowed() {
-                err!(format!("Grantee user does not exist: {email}"))
+                err!(format!("Grantee user does not exist: {}", email.escape_debug()))
            }
            if !CONFIG.is_email_domain_allowed(&email) {
@@ -342,12 +347,11 @@ async fn accept_invite(
        err!("Claim email does not match current users email")
    }
-    let grantee_user = match User::find_by_mail(&claims.email, &conn).await {
+    let grantee_user = if let Some(user) = User::find_by_mail(&claims.email, &conn).await {
-        Some(user) => {
+        Invitation::take(&claims.email, &conn).await;
-            Invitation::take(&claims.email, &conn).await;
+        user
-            user
+    } else {
-        }
+        err!("Invited user not found")
        None => err!("Invited user not found"),
    };
    // We need to search for the uuid in combination with the email, since we do not yet store the uuid of the grantee in the database.
@@ -766,7 +770,7 @@ pub async fn emergency_request_timeout_job(pool: DbPool) {
            }
        }
    } else {
-        error!("Failed to get DB connection while searching emergency request timed out")
+        error!("Failed to get DB connection while searching emergency request timed out");
    }
 }
@@ -825,6 +829,6 @@ pub async fn emergency_notification_reminder_job(pool: DbPool) {
            }
        }
    } else {
-        error!("Failed to get DB connection while searching emergency notification reminder")
+        error!("Failed to get DB connection while searching emergency notification reminder");
    }
 }
@@ -1,18 +1,19 @@
 use std::net::IpAddr;
 use chrono::NaiveDateTime;
-use rocket::{form::FromForm, serde::json::Json, Route};
+use rocket::{Route, form::FromForm, serde::json::Json};
 use serde_json::Value;
 use crate::{
-    api::{EmptyResult, JsonResult},
+    CONFIG,
    api::{ApiResult, EmptyResult, JsonResult},
    auth::{AdminHeaders, Headers},
    db::{
        models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId},
        DbConn, DbPool,
        models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
    },
    error::MapResult,
    util::parse_date,
    CONFIG,
 };
 /// ###############################################################################################################
@@ -29,6 +30,14 @@ struct EventRange {
    continuation_token: Option<String>,
 }
 impl EventRange {
    fn date_range(&self) -> ApiResult<(NaiveDateTime, NaiveDateTime)> {
        let start_date = parse_date(&self.start).map_res("Invalid start date")?;
        let end_date = parse_date(self.continuation_token.as_ref().unwrap_or(&self.end)).map_res("Invalid end date")?;
        Ok((start_date, end_date))
    }
 }
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/EventsController.cs#L87
 #[get("/organizations/<org_id>/events?<data..>")]
 async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: AdminHeaders, conn: DbConn) -> JsonResult {
@@ -38,21 +47,16 @@ async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: Admin
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
-    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
+    let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        Vec::with_capacity(0)
+        let (start_date, end_date) = data.date_range()?;
    } else {
        let start_date = parse_date(&data.start);
        let end_date = if let Some(before_date) = &data.continuation_token {
            parse_date(before_date)
        } else {
            parse_date(&data.end)
        };
        Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &conn)
            .await
            .iter()
-            .map(|e| e.to_json())
+            .map(Event::to_json)
            .collect()
    } else {
        Vec::new()
    };
    Ok(Json(json!({
@@ -64,27 +68,16 @@ async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: Admin
 #[get("/ciphers/<cipher_id>/events?<data..>")]
 async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Headers, conn: DbConn) -> JsonResult {
-    // Return an empty vec when we org events are disabled.
+    // Return an empty vec when org events are disabled.
    // This prevents client errors
-    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
+    let events_json: Vec<Value> = if CONFIG.org_events_enabled()
-        Vec::with_capacity(0)
+        && Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await
-    } else {
+    {
-        let mut events_json = Vec::with_capacity(0);
+        let (start_date, end_date) = data.date_range()?;
        if Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await {
            let start_date = parse_date(&data.start);
            let end_date = if let Some(before_date) = &data.continuation_token {
                parse_date(before_date)
            } else {
                parse_date(&data.end)
            };
-            events_json = Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn)
+        Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn).await.iter().map(Event::to_json).collect()
-                .await
+    } else {
-                .iter()
+        Vec::new()
                .map(|e| e.to_json())
                .collect()
        }
        events_json
    };
    Ok(Json(json!({
@@ -107,21 +100,16 @@ async fn get_user_events(
    }
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
-    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
+    let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        Vec::with_capacity(0)
+        let (start_date, end_date) = data.date_range()?;
    } else {
        let start_date = parse_date(&data.start);
        let end_date = if let Some(before_date) = &data.continuation_token {
            parse_date(before_date)
        } else {
            parse_date(&data.end)
        };
        Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &conn)
            .await
            .iter()
-            .map(|e| e.to_json())
+            .map(Event::to_json)
            .collect()
    } else {
        Vec::new()
    };
    Ok(Json(json!({
@@ -134,7 +122,8 @@ async fn get_user_events(
 fn get_continuation_token(events_json: &[Value]) -> Option<&str> {
    // When the length of the vec equals the max page_size there probably is more data
    // When it is less, then all events are loaded.
-    if events_json.len() as i64 == Event::PAGE_SIZE {
+    #[expect(clippy::cast_possible_truncation, reason = "PAGE_SIZE fits within usize")]
    if events_json.len() == Event::PAGE_SIZE as usize {
        if let Some(last_event) = events_json.last() {
            last_event["date"].as_str()
        } else {
@@ -173,10 +162,11 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
    }
    for event in data.iter() {
-        let event_date = parse_date(&event.date);
+        let event_date = parse_date(&event.date).map_res("Invalid event date")?;
        // Only the event types upstream accepts from clients, the rest are written server-side.
        match event.r#type {
-            1000..=1099 => {
+            t if t == EventType::UserClientExportedVault as i32 => {
-                _log_user_event(
+                log_user_event_impl(
                    event.r#type,
                    &headers.user.uuid,
                    headers.device.atype,
@@ -186,9 +176,12 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                )
                .await;
            }
-            1600..=1699 => {
+            t if t == EventType::OrganizationClientExportedVault as i32 => {
-                if let Some(org_id) = &event.organization_id {
+                // Only allow logging events for an organization the user is actually a member of.
-                    _log_event(
+                if let Some(org_id) = &event.organization_id
                    && Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await.is_some()
                {
                    log_event_impl(
                        event.r#type,
                        org_id,
                        org_id,
@@ -201,25 +194,49 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
-            _ => {
+            // Only the vault notification banner click is accepted from clients. The rest of
-                if let Some(cipher_uuid) = &event.cipher_id {
+            // the 1500..=1599 range is written server-side and must not be forgeable by a client.
-                    if let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &conn).await {
+            t if t == EventType::OrganizationUserNotificationBannerActionClicked as i32 => {
-                        if let Some(org_id) = cipher.organization_uuid {
+                if let Some(org_id) = &event.organization_id
-                            _log_event(
+                    && let Some(membership) =
-                                event.r#type,
+                        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await
-                                cipher_uuid,
+                {
-                                &org_id,
+                    log_event_impl(
-                                &headers.user.uuid,
+                        event.r#type,
-                                headers.device.atype,
+                        &membership.uuid,
-                                Some(event_date),
+                        org_id,
-                                &headers.ip.ip,
+                        &headers.user.uuid,
-                                &conn,
+                        headers.device.atype,
-                            )
+                        Some(event_date),
-                            .await;
+                        &headers.ip.ip,
-                        }
+                        &conn,
-                    }
+                    )
                    .await;
                }
            }
            // Client-side cipher events (viewed, copied, toggled, autofilled).
            1107..=1114 | 1117 | 1119..=1132 => {
                // The cipher determines the organization the event is logged to, so make sure the
                // user can actually access it instead of trusting the provided cipher uuid.
                if let Some(cipher_uuid) = &event.cipher_id
                    && let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &conn).await
                    && cipher.is_accessible_to_user(&headers.user.uuid, &conn).await
                    && let Some(org_id) = cipher.organization_uuid
                {
                    log_event_impl(
                        event.r#type,
                        cipher_uuid,
                        &org_id,
                        &headers.user.uuid,
                        headers.device.atype,
                        Some(event_date),
                        &headers.ip.ip,
                        &conn,
                    )
                    .await;
                }
            }
            _ => {}
        }
    }
    Ok(())
@@ -229,10 +246,10 @@ pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32,
    if !CONFIG.org_events_enabled() {
        return;
    }
-    _log_user_event(event_type, user_id, device_type, None, ip, conn).await;
+    log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await;
 }
-async fn _log_user_event(
+async fn log_user_event_impl(
    event_type: i32,
    user_id: &UserId,
    device_type: i32,
@@ -267,7 +284,7 @@ async fn _log_user_event(
 }
 pub async fn log_event(
-    event_type: i32,
+    event_type: EventType,
    source_uuid: &str,
    org_id: &OrganizationId,
    act_user_id: &UserId,
@@ -278,11 +295,11 @@ pub async fn log_event(
    if !CONFIG.org_events_enabled() {
        return;
    }
-    _log_event(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
+    log_event_impl(event_type as i32, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
 }
-#[allow(clippy::too_many_arguments)]
+#[expect(clippy::too_many_arguments)]
-async fn _log_event(
+async fn log_event_impl(
    event_type: i32,
    source_uuid: &str,
    org_id: &OrganizationId,
@@ -298,24 +315,24 @@ async fn _log_event(
        // 1000..=1099 Are user events, they need to be logged via log_user_event()
        // Cipher Events
        1100..=1199 => {
-            event.cipher_uuid = Some(source_uuid.to_string().into());
+            event.cipher_uuid = Some(source_uuid.to_owned().into());
        }
        // Collection Events
        1300..=1399 => {
-            event.collection_uuid = Some(source_uuid.to_string().into());
+            event.collection_uuid = Some(source_uuid.to_owned().into());
        }
        // Group Events
        1400..=1499 => {
-            event.group_uuid = Some(source_uuid.to_string().into());
+            event.group_uuid = Some(source_uuid.to_owned().into());
        }
        // Org User Events
        1500..=1599 => {
-            event.org_user_uuid = Some(source_uuid.to_string().into());
+            event.org_user_uuid = Some(source_uuid.to_owned().into());
        }
        // 1600..=1699 Are organizational events, and they do not need the source_uuid
        // Policy Events
        1700..=1799 => {
-            event.policy_uuid = Some(source_uuid.to_string().into());
+            event.policy_uuid = Some(source_uuid.to_owned().into());
        }
        // Ignore others
        _ => {}
@@ -338,6 +355,6 @@ pub async fn event_cleanup_job(pool: DbPool) {
    if let Ok(conn) = pool.get().await {
        Event::clean_events(&conn).await.ok();
    } else {
-        error!("Failed to get DB connection while trying to cleanup the events table")
+        error!("Failed to get DB connection while trying to cleanup the events table");
    }
 }
@@ -5,8 +5,8 @@ use crate::{
    api::{EmptyResult, JsonResult, Notify, UpdateType},
    auth::Headers,
    db::{
        models::{Folder, FolderId},
        DbConn,
        models::{Folder, FolderId},
    },
    util::deser_opt_nonempty_str,
 };
@@ -29,9 +29,10 @@ async fn get_folders(headers: Headers, conn: DbConn) -> Json<Value> {
 #[get("/folders/<folder_id>")]
 async fn get_folder(folder_id: FolderId, headers: Headers, conn: DbConn) -> JsonResult {
-    match Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &conn).await {
+    if let Some(folder) = Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &conn).await {
-        Some(folder) => Ok(Json(folder.to_json())),
+        Ok(Json(folder.to_json()))
-        _ => err!("Invalid folder", "Folder does not exist or belongs to another user"),
+    } else {
        err!("Invalid folder", "Folder does not exist or belongs to another user")
    }
 }
@@ -1,4 +1,6 @@
 pub mod accounts;
 pub mod two_factor;
 mod ciphers;
 mod emergency_access;
 mod events;
@@ -6,17 +8,32 @@ mod folders;
 mod organizations;
 mod public;
 mod sends;
 pub mod two_factor;
 pub use accounts::purge_auth_requests;
-pub use ciphers::{purge_trashed_ciphers, CipherData, CipherSyncData, CipherSyncType};
+pub use ciphers::{CipherData, CipherSyncData, CipherSyncType, purge_trashed_ciphers};
 pub use emergency_access::{emergency_notification_reminder_job, emergency_request_timeout_job};
 pub use events::{event_cleanup_job, log_event, log_user_event};
 use reqwest::Method;
 pub use sends::purge_sends;
 use reqwest::Method;
 use rocket::{Catcher, Route, serde::json::Json, serde::json::Value};
 use crate::{
    CONFIG,
    api::{EmptyResult, JsonResult, Notify, UpdateType},
    auth::Headers,
    db::{
        DbConn,
        models::{Membership, MembershipStatus, OrgPolicy, Organization, User},
    },
    error::Error,
    http_client::make_http_request,
    mail,
    util::{FeatureFlagFilter, parse_experimental_client_feature_flags},
 };
 pub fn routes() -> Vec<Route> {
-    let mut eq_domains_routes = routes![get_eq_domains, post_eq_domains, put_eq_domains];
+    let mut eq_domains_routes = routes![get_settings_domains, post_settings_domains, put_settings_domains];
    let mut hibp_routes = routes![hibp_breach];
    let mut meta_routes = routes![alive, now, version, config, get_api_webauthn];
@@ -44,25 +61,6 @@ pub fn events_routes() -> Vec<Route> {
    routes
 }
 //
 // Move this somewhere else
 //
 use rocket::{serde::json::Json, serde::json::Value, Catcher, Route};
 use crate::{
    api::{EmptyResult, JsonResult, Notify, UpdateType},
    auth::Headers,
    db::{
        models::{Membership, MembershipStatus, OrgPolicy, Organization, User},
        DbConn,
    },
    error::Error,
    http_client::make_http_request,
    mail,
    util::{parse_experimental_client_feature_flags, FeatureFlagFilter},
    CONFIG,
 };
 #[derive(Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct GlobalDomain {
@@ -73,15 +71,17 @@ struct GlobalDomain {
 const GLOBAL_DOMAINS: &str = include_str!("../../static/global_domains.json");
 #[expect(clippy::needless_pass_by_value, reason = "Not beneficial for Headers")]
 #[get("/settings/domains")]
-fn get_eq_domains(headers: Headers) -> Json<Value> {
+fn get_settings_domains(headers: Headers) -> Json<Value> {
-    _get_eq_domains(&headers, false)
+    get_eq_domains(&headers, false)
 }
-fn _get_eq_domains(headers: &Headers, no_excluded: bool) -> Json<Value> {
+fn get_eq_domains(headers: &Headers, no_excluded: bool) -> Json<Value> {
    let user = &headers.user;
    use serde_json::from_str;
    let user = &headers.user;
    let equivalent_domains: Vec<Vec<String>> = from_str(&user.equivalent_domains).unwrap();
    let excluded_globals: Vec<i32> = from_str(&user.excluded_globals).unwrap();
@@ -110,28 +110,39 @@ struct EquivDomainData {
 }
 #[post("/settings/domains", data = "<data>")]
-async fn post_eq_domains(data: Json<EquivDomainData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
+async fn post_settings_domains(
    data: Json<EquivDomainData>,
    headers: Headers,
    conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
    use serde_json::to_string;
    let data: EquivDomainData = data.into_inner();
    let excluded_globals = data.excluded_global_equivalent_domains.unwrap_or_default();
    let equivalent_domains = data.equivalent_domains.unwrap_or_default();
    let mut user = headers.user;
    use serde_json::to_string;
-    user.excluded_globals = to_string(&excluded_globals).unwrap_or_else(|_| "[]".to_string());
+    user.excluded_globals = to_string(&excluded_globals).unwrap_or_else(|_| "[]".to_owned());
-    user.equivalent_domains = to_string(&equivalent_domains).unwrap_or_else(|_| "[]".to_string());
+    user.equivalent_domains = to_string(&equivalent_domains).unwrap_or_else(|_| "[]".to_owned());
    user.save(&conn).await?;
-    nt.send_user_update(UpdateType::SyncSettings, &user, &headers.device.push_uuid, &conn).await;
+    nt.send_user_update(UpdateType::SyncSettings, &user, headers.device.push_uuid.as_ref(), &conn).await;
    Ok(Json(json!({})))
 }
 #[put("/settings/domains", data = "<data>")]
-async fn put_eq_domains(data: Json<EquivDomainData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
+async fn put_settings_domains(
-    post_eq_domains(data, headers, conn, nt).await
+    data: Json<EquivDomainData>,
    headers: Headers,
    conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
    post_settings_domains(data, headers, conn, nt).await
 }
 #[get("/hibp/breach?<username>")]
@@ -204,11 +215,11 @@ fn config() -> Json<Value> {
    // Client (v2026.2.1): https://github.com/bitwarden/clients/blob/f96380c3138291a028bdd2c7a5fee540d5c98ba5/libs/common/src/enums/feature-flag.enum.ts#L12
    // Android (v2026.2.1): https://github.com/bitwarden/android/blob/6902c19c0093fa476bbf74ccaa70c9f14afbb82f/core/src/main/kotlin/com/bitwarden/core/data/manager/model/FlagKey.kt#L31
    // iOS (v2026.2.1): https://github.com/bitwarden/ios/blob/cdd9ba1770ca2ffc098d02d12cc3208e3a830454/BitwardenShared/Core/Platform/Models/Enum/FeatureFlag.swift#L7
-    let feature_states = parse_experimental_client_feature_flags(
+    let mut feature_states = parse_experimental_client_feature_flags(
        &CONFIG.experimental_client_feature_flags(),
-        FeatureFlagFilter::ValidOnly,
+        &FeatureFlagFilter::ValidOnly,
    );
-    // Add default feature_states here if needed, currently no features are needed by default.
+    feature_states.insert("pm-19148-innovation-archive".to_owned(), true);
    Json(json!({
        // Note: The clients use this version to handle backwards compatibility concerns
@@ -217,14 +228,17 @@ fn config() -> Json<Value> {
        // Version history:
        // - Individual cipher key encryption: 2024.2.0
        // - Mobile app support for MasterPasswordUnlockData: 2025.8.0
-        "version": "2025.12.0",
+        "version": "2026.6.0",
        "gitHash": option_env!("GIT_REV"),
        "server": {
          "name": "Vaultwarden",
          "url": "https://github.com/dani-garcia/vaultwarden"
        },
        "settings": {
-            "disableUserRegistration": CONFIG.is_signup_disabled()
+            "disableUserRegistration": CONFIG.is_signup_disabled(),
            // When enabled, this setting signals to clients that onboarding interstitials
            // (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals) should be suppressed
            "suppressOnboardingInterstitials": CONFIG.client_suppress_onboarding(),
        },
        "environment": {
          "vault": domain,
@@ -240,6 +254,10 @@ fn config() -> Json<Value> {
          "vapidPublicKey": null
        },
        "featureStates": feature_states,
        // Not supported right now
        // Used for by clients to learn if the server requires extra work to establish a connection.
        // See: https://github.com/bitwarden/server/pull/6892 | https://github.com/bitwarden/server/commit/52955d1860b4dfb905f67bbe39d9b10bbd61ded0
        "communication": null,
        "object": "config",
    }))
 }
@@ -278,9 +296,8 @@ async fn accept_org_invite(
    member.save(conn).await?;
    if CONFIG.mail_enabled() {
-        let org = match Organization::find_by_uuid(&member.org_uuid, conn).await {
+        let Some(org) = Organization::find_by_uuid(&member.org_uuid, conn).await else {
-            Some(org) => org,
+            err!("Organization not found.")
            None => err!("Organization not found."),
        };
        // User was invited to an organization, so they must be confirmed manually after acceptance
        mail::send_invite_accepted(&user.email, &member.invited_by_email.unwrap_or(org.billing_email), &org.name)
@@ -1,23 +1,24 @@
 use chrono::Utc;
 use rocket::{
    request::{FromRequest, Outcome},
    serde::json::Json,
    Request, Route,
 };
 use std::collections::HashSet;
 use chrono::Utc;
 use rocket::{
    Request, Route,
    request::{FromRequest, Outcome},
    serde::json::Json,
 };
 use crate::{
    CONFIG,
    api::EmptyResult,
    auth,
    db::{
        DbConn,
        models::{
-            Group, GroupUser, Invitation, Membership, MembershipStatus, MembershipType, Organization,
+            Group, GroupUser, Invitation, Membership, MembershipStatus, MembershipType, OrgPolicy, Organization,
            OrganizationApiKey, OrganizationId, User,
        },
        DbConn,
    },
-    mail, CONFIG,
+    mail,
 };
 pub fn routes() -> Vec<Route> {
@@ -57,25 +58,13 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
    let org_id = token.0;
    let data = data.into_inner();
    // Like upstream, the import never removes Owners, so it doesn't revoke or restore them either.
    for user_data in &data.members {
        let mut user_created: bool = false;
        if user_data.deleted {
            // If user is marked for deletion and it exists, revoke it
            if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &conn).await {
-                // Only revoke a user if it is not the last confirmed owner
+                let revoked = member.atype != MembershipType::Owner && member.revoke();
                let revoked = if member.atype == MembershipType::Owner
                    && member.status == MembershipStatus::Confirmed as i32
                {
                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &conn).await <= 1 {
                        warn!("Can't revoke the last owner");
                        false
                    } else {
                        member.revoke()
                    }
                } else {
                    member.revoke()
                };
                let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
                if revoked || ext_modified {
                    member.save(&conn).await?;
@@ -83,26 +72,32 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
            }
        // If user is part of the organization, restore it
        } else if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &conn).await {
-            let restored = member.restore();
+            let mut restored = member.atype != MembershipType::Owner && member.restore();
            let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
            // Enforce org policies as every other restore path does.
            // If the user is not allowed, we revoke again and continue so the external_id is still updated.
            if restored && let Err(e) = OrgPolicy::check_user_allowed(&member, "restore", &conn).await {
                warn!("Not restoring {}: {e:?}", user_data.email);
                member.revoke();
                restored = false;
            }
            if restored || ext_modified {
                member.save(&conn).await?;
            }
        } else {
            // If user is not part of the organization
-            let user = match User::find_by_mail(&user_data.email, &conn).await {
+            let user = if let Some(user) = User::find_by_mail(&user_data.email, &conn).await {
-                Some(user) => user, // exists in vaultwarden
+                user
-                None => {
+            } else {
-                    // User does not exist yet
+                // User does not exist yet
-                    let mut new_user = User::new(&user_data.email, None);
+                let mut new_user = User::new(&user_data.email, None);
-                    new_user.save(&conn).await?;
+                new_user.save(&conn).await?;
-                    if !CONFIG.mail_enabled() {
+                if !CONFIG.mail_enabled() {
-                        Invitation::new(&new_user.email).save(&conn).await?;
+                    Invitation::new(&new_user.email).save(&conn).await?;
                    }
                    user_created = true;
                    new_user
                }
                user_created = true;
                new_user
            };
            let member_status = if CONFIG.mail_enabled() || user.password_hash.is_empty() {
                MembershipStatus::Invited as i32
@@ -110,9 +105,10 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
                MembershipStatus::Accepted as i32 // Automatically mark user as accepted if no email invites
            };
-            let (org_name, org_email) = match Organization::find_by_uuid(&org_id, &conn).await {
+            let (org_name, org_email) = if let Some(org) = Organization::find_by_uuid(&org_id, &conn).await {
-                Some(org) => (org.name, org.billing_email),
+                (org.name, org.billing_email)
-                None => err!("Error looking up organization"),
+            } else {
                err!("Error looking up organization")
            };
            let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(org_email.clone()));
@@ -123,37 +119,33 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
            new_member.save(&conn).await?;
-            if CONFIG.mail_enabled() {
+            if CONFIG.mail_enabled()
-                if let Err(e) =
+                && let Err(e) =
                    mail::send_invite(&user, org_id.clone(), new_member.uuid.clone(), &org_name, Some(org_email)).await
-                {
+            {
-                    // Upon error delete the user, invite and org member records when needed
+                // Upon error delete the user, invite and org member records when needed
-                    if user_created {
+                if user_created {
-                        user.delete(&conn).await?;
+                    user.delete(&conn).await?;
-                    } else {
+                } else {
-                        new_member.delete(&conn).await?;
+                    new_member.delete(&conn).await?;
                    }
                    err!(format!("Error sending invite: {e:?} "));
                }
                err!(format!("Error sending invite: {e:?} "));
            }
        }
    }
    if CONFIG.org_groups_enabled() {
        for group_data in &data.groups {
-            let group_uuid = match Group::find_by_external_id_and_org(&group_data.external_id, &org_id, &conn).await {
+            let group_uuid = if let Some(group) =
-                Some(group) => group.uuid,
+                Group::find_by_external_id_and_org(&group_data.external_id, &org_id, &conn).await
-                None => {
+            {
-                    let mut group = Group::new(
+                group.uuid
-                        org_id.clone(),
+            } else {
-                        group_data.name.clone(),
+                let mut group =
-                        false,
+                    Group::new(org_id.clone(), group_data.name.clone(), false, Some(group_data.external_id.clone()));
-                        Some(group_data.external_id.clone()),
+                group.save(&conn).await?;
-                    );
+                group.uuid
                    group.save(&conn).await?;
                    group.uuid
                }
            };
            GroupUser::delete_all_by_group(&group_uuid, &org_id, &conn).await?;
@@ -174,18 +166,11 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
        // Generate a HashSet to quickly verify if a member is listed or not.
        let sync_members: HashSet<String> = data.members.into_iter().map(|m| m.external_id).collect();
        for member in Membership::find_by_org(&org_id, &conn).await {
-            if let Some(ref user_external_id) = member.external_id {
+            if let Some(ref user_external_id) = member.external_id
-                if !sync_members.contains(user_external_id) {
+                && !sync_members.contains(user_external_id)
-                    if member.atype == MembershipType::Owner && member.status == MembershipStatus::Confirmed as i32 {
+                && member.atype != MembershipType::Owner
-                        // Removing owner, check that there is at least one other confirmed owner
+            {
-                        if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &conn).await <= 1
+                member.delete(&conn).await?;
                        {
                            warn!("Can't delete the last owner");
                            continue;
                        }
                    }
                    member.delete(&conn).await?;
                }
            }
        }
    }
@@ -202,12 +187,14 @@ impl<'r> FromRequest<'r> for PublicToken {
    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = request.headers();
        // Get access_token
-        let access_token: &str = match headers.get_one("Authorization") {
+        let access_token: &str = if let Some(a) = headers.get_one("Authorization") {
-            Some(a) => match a.rsplit("Bearer ").next() {
+            if let Some(split) = a.rsplit("Bearer ").next() {
-                Some(split) => split,
+                split
-                None => err_handler!("No access token provided"),
+            } else {
-            },
+                err_handler!("No access token provided")
-            None => err_handler!("No access token provided"),
+            }
        } else {
            err_handler!("No access token provided")
        };
        // Check JWT token is valid and get device and user from it
        let Ok(claims) = auth::decode_api_org(access_token) else {
@@ -229,14 +216,13 @@ impl<'r> FromRequest<'r> for PublicToken {
        // Check if claims.sub is org_api_key.uuid
        // Check if claims.client_sub is org_api_key.org_uuid
-        let conn = match DbConn::from_request(request).await {
+        let Outcome::Success(conn) = DbConn::from_request(request).await else {
-            Outcome::Success(conn) => conn,
+            err_handler!("Error getting DB")
            _ => err_handler!("Error getting DB"),
        };
        let Some(org_id) = claims.client_id.strip_prefix("organization.") else {
            err_handler!("Malformed client_id")
        };
-        let org_id: OrganizationId = org_id.to_string().into();
+        let org_id: OrganizationId = org_id.to_owned().into();
        let Some(org_api_key) = OrganizationApiKey::find_by_org_uuid(&org_id, &conn).await else {
            err_handler!("Invalid client_id")
        };
@@ -10,20 +10,20 @@ use rocket::{
 use serde_json::Value;
 use crate::{
    CONFIG,
    api::{ApiResult, EmptyResult, JsonResult, Notify, UpdateType},
-    auth::{ClientIp, Headers, Host},
+    auth::{Headers, Host, SendHeaders},
    config::PathType,
    db::{
        models::{Device, OrgPolicy, OrgPolicyType, Send, SendFileId, SendId, SendType, UserId},
        DbConn, DbPool,
        models::{Device, OrgPolicy, OrgPolicyType, Send, SendFileId, SendId, SendType, UserId},
    },
-    util::{save_temp_file, NumberOrString},
+    util::{NumberOrString, save_temp_file},
    CONFIG,
 };
 const SEND_INACCESSIBLE_MSG: &str = "Send does not exist or is no longer available";
 static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
-    let dt = crate::util::parse_date("1970-01-01T00:00:00.000000Z");
+    let dt = DateTime::UNIX_EPOCH.naive_utc();
    Device {
        uuid: String::from("00000000-0000-0000-0000-000000000000").into(),
        created_at: dt,
@@ -39,14 +39,13 @@ static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
 });
 // The max file size allowed by Bitwarden clients and add an extra 5% to avoid issues
-const SIZE_525_MB: i64 = 550_502_400;
+pub(crate) const SIZE_525_MB: i64 = 550_502_400;
 pub fn routes() -> Vec<rocket::Route> {
    routes![
        get_sends,
        get_send,
        post_send,
        post_send_file,
        post_access,
        post_access_file,
        put_send,
@@ -63,7 +62,7 @@ pub async fn purge_sends(pool: DbPool) {
    if let Ok(conn) = pool.get().await {
        Send::purge(&conn).await;
    } else {
-        error!("Failed to get DB connection while purging sends")
+        error!("Failed to get DB connection while purging sends");
    }
 }
@@ -71,13 +70,14 @@ pub async fn purge_sends(pool: DbPool) {
 #[serde(rename_all = "camelCase")]
 pub struct SendData {
    r#type: i32,
-    key: String,
+    pub key: String,
    password: Option<String>,
    max_access_count: Option<NumberOrString>,
    expiration_date: Option<DateTime<Utc>>,
    deletion_date: DateTime<Utc>,
    disabled: bool,
    hide_email: Option<bool>,
    emails: Option<String>,
    // Data field
    name: String,
@@ -148,6 +148,10 @@ fn create_send(data: SendData, user_id: UserId) -> ApiResult<Send> {
        );
    }
    if data.emails.is_some() {
        err!("Sends with email verification is not supported");
    }
    let mut send = Send::new(data.r#type, data.name, data_str, data.key, data.deletion_date.naive_utc());
    send.user_uuid = Some(user_id);
    send.notes = data.notes;
@@ -168,7 +172,7 @@ fn create_send(data: SendData, user_id: UserId) -> ApiResult<Send> {
 #[get("/sends")]
 async fn get_sends(headers: Headers, conn: DbConn) -> Json<Value> {
    let sends = Send::find_by_user(&headers.user.uuid, &conn);
-    let sends_json: Vec<Value> = sends.await.iter().map(|s| s.to_json()).collect();
+    let sends_json: Vec<Value> = sends.await.iter().map(Send::to_json).collect();
    Json(json!({
      "data": sends_json,
@@ -179,9 +183,10 @@ async fn get_sends(headers: Headers, conn: DbConn) -> Json<Value> {
 #[get("/sends/<send_id>")]
 async fn get_send(send_id: SendId, headers: Headers, conn: DbConn) -> JsonResult {
-    match Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &conn).await {
+    if let Some(send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &conn).await {
-        Some(send) => Ok(Json(send.to_json())),
+        Ok(Json(send.to_json()))
-        None => err!("Send not found", "Invalid send uuid or does not belong to user"),
+    } else {
        err!("Send not found", "Invalid send uuid or does not belong to user")
    }
 }
@@ -193,7 +198,7 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
    enforce_disable_hide_email_policy(&data, &headers, &conn).await?;
    if data.r#type == SendType::File as i32 {
-        err!("File sends should use /api/sends/file")
+        err!("File sends should use /api/sends/file/v2")
    }
    let mut send = create_send(data, headers.user.uuid)?;
@@ -210,93 +215,11 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
    Ok(Json(send.to_json()))
 }
 #[derive(FromForm)]
 struct UploadData<'f> {
    model: Json<SendData>,
    data: TempFile<'f>,
 }
 #[derive(FromForm)]
 struct UploadDataV2<'f> {
    data: TempFile<'f>,
 }
 // @deprecated Mar 25 2021: This method has been deprecated in favor of direct uploads (v2).
 // This method still exists to support older clients, probably need to remove it sometime.
 // Upstream: https://github.com/bitwarden/server/blob/d0c793c95181dfb1b447eb450f85ba0bfd7ef643/src/Api/Controllers/SendsController.cs#L164-L167
 // 2025: This endpoint doesn't seem to exists anymore in the latest version
 // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs
 #[post("/sends/file", format = "multipart/form-data", data = "<data>")]
 async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    enforce_disable_send_policy(&headers, &conn).await?;
    let UploadData {
        model,
        data,
    } = data.into_inner();
    let model = model.into_inner();
    let Some(size) = data.len().to_i64() else {
        err!("Invalid send size");
    };
    if size < 0 {
        err!("Send size can't be negative")
    }
    enforce_disable_hide_email_policy(&model, &headers, &conn).await?;
    let size_limit = match CONFIG.user_send_limit() {
        Some(0) => err!("File uploads are disabled"),
        Some(limit_kb) => {
            let Some(already_used) = Send::size_by_user(&headers.user.uuid, &conn).await else {
                err!("Existing sends overflow")
            };
            let Some(left) = limit_kb.checked_mul(1024).and_then(|l| l.checked_sub(already_used)) else {
                err!("Send size overflow");
            };
            if left <= 0 {
                err!("Send storage limit reached! Delete some sends to free up space")
            }
            i64::clamp(left, 0, SIZE_525_MB)
        }
        None => SIZE_525_MB,
    };
    if size > size_limit {
        err!("Send storage limit exceeded with this file");
    }
    let mut send = create_send(model, headers.user.uuid)?;
    if send.atype != SendType::File as i32 {
        err!("Send content is not a file");
    }
    let file_id = crate::crypto::generate_send_file_id();
    save_temp_file(&PathType::Sends, &format!("{}/{file_id}", send.uuid), data, true).await?;
    let mut data_value: Value = serde_json::from_str(&send.data)?;
    if let Some(o) = data_value.as_object_mut() {
        o.insert(String::from("id"), Value::String(file_id));
        o.insert(String::from("size"), Value::Number(size.into()));
        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(size)));
    }
    send.data = serde_json::to_string(&data_value)?;
    // Save the changes in the database
    send.save(&conn).await?;
    nt.send_send_update(
        UpdateType::SyncSendCreate,
        &send,
        &send.update_users_revision(&conn).await,
        &headers.device,
        &conn,
    )
    .await;
    Ok(Json(send.to_json()))
 }
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L165
 #[post("/sends/file/v2", data = "<data>")]
 async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn) -> JsonResult {
@@ -310,9 +233,10 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn)
    enforce_disable_hide_email_policy(&data, &headers, &conn).await?;
-    let file_length = match &data.file_length {
+    let file_length = if let Some(m) = &data.file_length {
-        Some(m) => m.into_i64()?,
+        m.into_i64()?
-        _ => err!("Invalid send length"),
+    } else {
        err!("Invalid send length")
    };
    if file_length < 0 {
        err!("Send size can't be negative")
@@ -369,7 +293,7 @@ pub struct SendFileData {
 }
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L195
-#[post("/sends/<send_id>/file/<file_id>", format = "multipart/form-data", data = "<data>")]
+#[post("/sends/<send_id>/file/<file_id>", format = "multipart/form-data", data = "<data>", rank = 2)]
 async fn post_send_file_v2_data(
    send_id: SendId,
    file_id: SendFileId,
@@ -404,8 +328,8 @@ async fn post_send_file_v2_data(
            "Send file name does not match.",
            format!(
                "Expected file name '{}' got '{}'",
-                send_data.fileName,
+                send_data.fileName.escape_debug(),
-                raw_file_name.dangerous_unsafe_unsanitized_raw()
+                raw_file_name.dangerous_unsafe_unsanitized_raw().as_str().escape_debug()
            )
        ),
        _ => err!("Send file name does not match or is not provided."),
@@ -439,59 +363,22 @@ async fn post_send_file_v2_data(
    Ok(())
 }
-#[derive(Deserialize)]
+#[post("/sends/access")]
-#[serde(rename_all = "camelCase")]
+async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-pub struct SendAccessData {
+    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
    pub password: Option<String>,
 }
 #[post("/sends/access/<access_id>", data = "<data>")]
 async fn post_access(
    access_id: &str,
    data: Json<SendAccessData>,
    conn: DbConn,
    ip: ClientIp,
    nt: Notify<'_>,
 ) -> JsonResult {
    let Some(mut send) = Send::find_by_access_id(access_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
-
+    if !send.is_accessible() {
    if let Some(max_access_count) = send.max_access_count {
        if send.access_count >= max_access_count {
            err_code!(SEND_INACCESSIBLE_MSG, 404);
        }
    }
    if let Some(expiration) = send.expiration_date {
        if Utc::now().naive_utc() >= expiration {
            err_code!(SEND_INACCESSIBLE_MSG, 404)
        }
    }
    if Utc::now().naive_utc() >= send.deletion_date {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.disabled {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.password_hash.is_some() {
        match data.into_inner().password {
            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
            Some(_) => err!("Invalid password", format!("IP: {}.", ip.ip)),
            None => err_code!("Password not provided", format!("IP: {}.", ip.ip), 401),
        }
    }
    // Files are incremented during the download
-    if send.atype == SendType::Text as i32 {
+    if send.atype == SendType::Text as i32 && !send.register_access(&conn).await? {
-        send.access_count += 1;
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    process_access(send, conn, nt).await
 }
-    send.save(&conn).await?;
+async fn process_access(send: Send, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    nt.send_send_update(
        UpdateType::SyncSendUpdate,
        &send,
@@ -504,51 +391,38 @@ async fn post_access(
    Ok(Json(send.to_json_access(&conn).await))
 }
-#[post("/sends/<send_id>/access/file/<file_id>", data = "<data>")]
+#[post("/sends/access/file/<file_id>", rank = 1)]
 async fn post_access_file(
    send_id: SendId,
    file_id: SendFileId,
-    data: Json<SendAccessData>,
+    headers: SendHeaders,
    host: Host,
    conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&send_id, &conn).await else {
+    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
-
+    if !send.is_accessible() {
    if let Some(max_access_count) = send.max_access_count {
        if send.access_count >= max_access_count {
            err_code!(SEND_INACCESSIBLE_MSG, 404)
        }
    }
    if let Some(expiration) = send.expiration_date {
        if Utc::now().naive_utc() >= expiration {
            err_code!(SEND_INACCESSIBLE_MSG, 404)
        }
    }
    if Utc::now().naive_utc() >= send.deletion_date {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
-
+    check_send_file_id(&send, &file_id)?;
-    if send.disabled {
+    if !send.register_access(&conn).await? {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    process_access_file(send, file_id, host, conn, nt).await
 }
-    if send.password_hash.is_some() {
+fn check_send_file_id(send: &Send, file_id: &SendFileId) -> EmptyResult {
-        match data.into_inner().password {
+    if send.atype != SendType::File as i32 {
-            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
+        err!("Send is not a file type send.");
            Some(_) => err!("Invalid password."),
            None => err_code!("Password not provided", 401),
        }
    }
    match serde_json::from_str::<SendFileData>(&send.data) {
        Ok(data) if &data.id == file_id => Ok(()),
        _ => err_code!(SEND_INACCESSIBLE_MSG, 404),
    }
 }
-    send.access_count += 1;
+async fn process_access_file(send: Send, file_id: SendFileId, host: Host, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    send.save(&conn).await?;
    nt.send_send_update(
        UpdateType::SyncSendUpdate,
        &send,
@@ -561,29 +435,29 @@ async fn post_access_file(
    Ok(Json(json!({
        "object": "send-fileDownload",
        "id": file_id,
-        "url": download_url(&host, &send_id, &file_id).await?,
+        "url": download_url(&host, &send.uuid, &file_id).await?,
    })))
 }
 async fn download_url(host: &Host, send_id: &SendId, file_id: &SendFileId) -> Result<String, crate::Error> {
    let operator = CONFIG.opendal_operator_for_path_type(&PathType::Sends)?;
-    if operator.info().scheme() == <&'static str>::from(opendal::Scheme::Fs) {
+    if crate::storage::is_fs_operator(&operator) {
        let token_claims = crate::auth::generate_send_claims(send_id, file_id);
        let token = crate::auth::encode_jwt(&token_claims);
-        Ok(format!("{}/api/sends/{send_id}/{file_id}?t={token}", &host.host))
+        Ok(format!("{}/api/sends/{send_id}/{file_id}?t={token}", host.host))
    } else {
-        Ok(operator.presign_read(&format!("{send_id}/{file_id}"), Duration::from_secs(5 * 60)).await?.uri().to_string())
+        Ok(operator.presign_read(&format!("{send_id}/{file_id}"), Duration::from_mins(5)).await?.uri().to_string())
    }
 }
 #[get("/sends/<send_id>/<file_id>?<t>")]
 async fn download_send(send_id: SendId, file_id: SendFileId, t: &str) -> Option<NamedFile> {
-    if let Ok(claims) = crate::auth::decode_send(t) {
+    if let Ok(claims) = crate::auth::decode_send(t)
-        if claims.sub == format!("{send_id}/{file_id}") {
+        && claims.sub == format!("{send_id}/{file_id}")
-            return NamedFile::open(Path::new(&CONFIG.sends_folder()).join(send_id).join(file_id)).await.ok();
+    {
-        }
+        return NamedFile::open(Path::new(&CONFIG.sends_folder()).join(send_id).join(file_id)).await.ok();
    }
    None
 }
@@ -599,12 +473,16 @@ async fn put_send(send_id: SendId, data: Json<SendData>, headers: Headers, conn:
        err!("Send not found", "Send send_id is invalid or does not belong to user")
    };
    if data.emails.is_some() {
        err!("Sends with email verification is not supported");
    }
    update_send_from_data(&mut send, data, &headers, &conn, &nt, UpdateType::SyncSendUpdate).await?;
    Ok(Json(send.to_json()))
 }
-pub async fn update_send_from_data(
+async fn update_send_from_data(
    send: &mut Send,
    data: SendData,
    headers: &Headers,
@@ -1,14 +1,13 @@
 use data_encoding::BASE32;
-use rocket::serde::json::Json;
+use rocket::{Route, serde::json::Json};
 use rocket::Route;
 use crate::{
-    api::{core::log_user_event, core::two_factor::_generate_recover_code, EmptyResult, JsonResult, PasswordOrOtpData},
+    api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code},
    auth::{ClientIp, Headers},
    crypto,
    db::{
        models::{EventType, TwoFactor, TwoFactorType, UserId},
        DbConn,
        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
    },
    util::NumberOrString,
 };
@@ -70,9 +69,10 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
    .await?;
    // Validate key as base32 and 20 bytes length
-    let decoded_key: Vec<u8> = match BASE32.decode(key.as_bytes()) {
+    let decoded_key: Vec<u8> = if let Ok(decoded) = BASE32.decode(key.as_bytes()) {
-        Ok(decoded) => decoded,
+        decoded
-        _ => err!("Invalid totp secret"),
+    } else {
        err!("Invalid totp secret")
    };
    if decoded_key.len() != 20 {
@@ -82,7 +82,7 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
    // Validate the token provided with the key, and save new twofactor
    validate_totp_code(&user.uuid, &token, &key.to_uppercase(), &headers.ip, &conn).await?;
-    _generate_recover_code(&mut user, &conn).await;
+    generate_recover_code(&mut user, &conn).await;
    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
@@ -119,7 +119,7 @@ pub async fn validate_totp_code(
    ip: &ClientIp,
    conn: &DbConn,
 ) -> EmptyResult {
-    use totp_lite::{totp_custom, Sha1};
+    use totp_lite::{Sha1, totp_custom};
    let Ok(decoded_secret) = BASE32.decode(secret.as_bytes()) else {
        err!("Invalid TOTP secret")
@@ -128,7 +128,7 @@ pub async fn validate_totp_code(
    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
    {
        Some(tf) => tf,
-        _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_string()),
+        _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_owned()),
    };
    // The amount of steps back and forward in time
@@ -145,7 +145,7 @@ pub async fn validate_totp_code(
        // We need to calculate the time offsite and cast it as an u64.
        // Since we only have times into the future and the totp generator needs an u64 instead of the default i64.
-        let time = (current_timestamp + step * 30i64) as u64;
+        let time: u64 = (current_timestamp + step * 30i64).cast_unsigned();
        let generated = totp_custom::<Sha1>(30, 6, &decoded_secret, time);
        // Check the given code equals the generated and if the time_step is larger then the one last used.
@@ -200,6 +200,7 @@ async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: He
    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
        if twofactor.data == data.key {
            twofactor.delete(&conn).await?;
            Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
            log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                .await;
        } else {
@@ -1,22 +1,20 @@
 use chrono::Utc;
-use data_encoding::BASE64;
+use rocket::{Route, serde::json::Json};
 use rocket::serde::json::Json;
 use rocket::Route;
 use crate::{
    CONFIG,
    api::{
-        core::log_user_event, core::two_factor::_generate_recover_code, ApiResult, EmptyResult, JsonResult,
+        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event,
-        PasswordOrOtpData,
+        core::two_factor::generate_recover_code,
    },
    auth::Headers,
    crypto,
    db::{
        models::{EventType, TwoFactor, TwoFactorType, User, UserId},
        DbConn,
        models::{EventType, TwoFactor, TwoFactorType, User, UserId},
    },
    error::MapResult,
    http_client::make_http_request,
    CONFIG,
 };
 pub fn routes() -> Vec<Route> {
@@ -82,8 +80,7 @@ enum DuoStatus {
 impl DuoStatus {
    fn data(self) -> Option<DuoData> {
        match self {
-            DuoStatus::Global(data) => Some(data),
+            DuoStatus::Global(data) | DuoStatus::User(data) => Some(data),
            DuoStatus::User(data) => Some(data),
            DuoStatus::Disabled(_) => None,
        }
    }
@@ -182,7 +179,7 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
    let twofactor = TwoFactor::new(user.uuid.clone(), type_, data_str);
    twofactor.save(&conn).await?;
-    _generate_recover_code(&mut user, &conn).await;
+    generate_recover_code(&mut user, &conn).await;
    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
@@ -201,14 +198,14 @@ async fn activate_duo_put(data: Json<EnableDuoData>, headers: Headers, conn: DbC
 }
 async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) -> EmptyResult {
-    use reqwest::{header, Method};
+    use reqwest::{Method, header};
    use std::str::FromStr;
    // https://duo.com/docs/authapi#api-details
-    let url = format!("https://{}{path}", &data.host);
+    let url = format!("https://{}{path}", data.host);
-    let date = Utc::now().to_rfc2822();
+    let dt = Utc::now().to_rfc2822();
    let username = &data.ik;
-    let fields = [&date, method, &data.host, path, params];
+    let fields = [&dt, method, &data.host, path, params];
    let password = crypto::hmac_sign(&data.sk, &fields.join("\n"));
    let m = Method::from_str(method).unwrap_or_default();
@@ -216,7 +213,7 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
    make_http_request(m, &url)?
        .basic_auth(username, Some(password))
        .header(header::USER_AGENT, "vaultwarden:Duo/1.0 (Rust)")
-        .header(header::DATE, date)
+        .header(header::DATE, dt)
        .send()
        .await?
        .error_for_status()?;
@@ -224,13 +221,6 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
    Ok(())
 }
 const DUO_EXPIRE: i64 = 300;
 const APP_EXPIRE: i64 = 3600;
 const AUTH_PREFIX: &str = "AUTH";
 const DUO_PREFIX: &str = "TX";
 const APP_PREFIX: &str = "APP";
 async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
    let type_ = TwoFactorType::Duo as i32;
@@ -253,117 +243,13 @@ async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
    DuoStatus::Disabled(false)
 }
-// let (ik, sk, ak, host) = get_duo_keys();
+// let (ik, sk, host) = get_duo_keys_email();
-pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String, String)> {
+pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String)> {
    let data = match User::find_by_mail(email, conn).await {
        Some(u) => get_user_duo_data(&u.uuid, conn).await.data(),
        _ => DuoData::global(),
    }
    .map_res("Can't fetch Duo Keys")?;
-    Ok((data.ik, data.sk, CONFIG.get_duo_akey().await, data.host))
+    Ok((data.ik, data.sk, data.host))
 }
 pub async fn generate_duo_signature(email: &str, conn: &DbConn) -> ApiResult<(String, String)> {
    let now = Utc::now().timestamp();
    let (ik, sk, ak, host) = get_duo_keys_email(email, conn).await?;
    let duo_sign = sign_duo_values(&sk, email, &ik, DUO_PREFIX, now + DUO_EXPIRE);
    let app_sign = sign_duo_values(&ak, email, &ik, APP_PREFIX, now + APP_EXPIRE);
    Ok((format!("{duo_sign}:{app_sign}"), host))
 }
 fn sign_duo_values(key: &str, email: &str, ikey: &str, prefix: &str, expire: i64) -> String {
    let val = format!("{email}|{ikey}|{expire}");
    let cookie = format!("{prefix}|{}", BASE64.encode(val.as_bytes()));
    format!("{cookie}|{}", crypto::hmac_sign(key, &cookie))
 }
 pub async fn validate_duo_login(email: &str, response: &str, conn: &DbConn) -> EmptyResult {
    let split: Vec<&str> = response.split(':').collect();
    if split.len() != 2 {
        err!(
            "Invalid response length",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
        );
    }
    let auth_sig = split[0];
    let app_sig = split[1];
    let now = Utc::now().timestamp();
    let (ik, sk, ak, _host) = get_duo_keys_email(email, conn).await?;
    let auth_user = parse_duo_values(&sk, auth_sig, &ik, AUTH_PREFIX, now)?;
    let app_user = parse_duo_values(&ak, app_sig, &ik, APP_PREFIX, now)?;
    if !crypto::ct_eq(&auth_user, app_user) || !crypto::ct_eq(&auth_user, email) {
        err!(
            "Error validating duo authentication",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
        )
    }
    Ok(())
 }
 fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -> ApiResult<String> {
    let split: Vec<&str> = val.split('|').collect();
    if split.len() != 3 {
        err!("Invalid value length")
    }
    let u_prefix = split[0];
    let u_b64 = split[1];
    let u_sig = split[2];
    let sig = crypto::hmac_sign(key, &format!("{u_prefix}|{u_b64}"));
    if !crypto::ct_eq(crypto::hmac_sign(key, &sig), crypto::hmac_sign(key, u_sig)) {
        err!("Duo signatures don't match")
    }
    if u_prefix != prefix {
        err!("Prefixes don't match")
    }
    let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else {
        err!("Invalid Duo cookie encoding")
    };
    let Ok(cookie) = String::from_utf8(cookie_vec) else {
        err!("Invalid Duo cookie encoding")
    };
    let cookie_split: Vec<&str> = cookie.split('|').collect();
    if cookie_split.len() != 3 {
        err!("Invalid cookie length")
    }
    let username = cookie_split[0];
    let u_ikey = cookie_split[1];
    let expire = cookie_split[2];
    if !crypto::ct_eq(ikey, u_ikey) {
        err!("Invalid ikey")
    }
    let expire: i64 = match expire.parse() {
        Ok(e) => e,
        Err(_) => err!("Invalid expire time"),
    };
    if time >= expire {
        err!("Expired authorization")
    }
    Ok(username.into())
 }
@@ -1,23 +1,24 @@
 use std::collections::HashMap;
 use chrono::Utc;
 use data_encoding::HEXLOWER;
 use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header, Validation};
-use reqwest::{header, StatusCode};
+use reqwest::{StatusCode, header};
-use ring::digest::{digest, Digest, SHA512_256};
+use ring::digest::{Digest, SHA512_256, digest};
 use serde::Serialize;
-use std::collections::HashMap;
+use url::Url;
 use crate::{
-    api::{core::two_factor::duo::get_duo_keys_email, EmptyResult},
+    CONFIG,
    api::{EmptyResult, core::two_factor::duo::get_duo_keys_email},
    crypto,
    db::{
        models::{DeviceId, EventType, TwoFactorDuoContext},
        DbConn, DbPool,
        models::{DeviceId, EventType, TwoFactorDuoContext},
    },
    error::Error,
    http_client::make_http_request,
    CONFIG,
 };
 use url::Url;
 // The location on this service that Duo should redirect users to. For us, this is a bridge
 // built in to the Bitwarden clients.
@@ -124,7 +125,7 @@ impl DuoClient {
        ClientAssertion {
            iss: self.client_id.clone(),
            sub: self.client_id.clone(),
-            aud: url.to_string(),
+            aud: url.to_owned(),
            exp: now + JWT_VALIDITY_SECS,
            jti: jwt_id,
            iat: now,
@@ -302,7 +303,7 @@ impl DuoClient {
        if !(matching_nonces && matching_usernames) {
            err!("Error validating Duo authorization, nonce or username mismatch.")
-        };
+        }
        Ok(())
    }
@@ -347,7 +348,7 @@ pub async fn purge_duo_contexts(pool: DbPool) {
    if let Ok(conn) = pool.get().await {
        TwoFactorDuoContext::purge_expired_duo_contexts(&conn).await;
    } else {
-        error!("Failed to get DB connection while purging expired Duo authentications")
+        error!("Failed to get DB connection while purging expired Duo authentications");
    }
 }
@@ -382,7 +383,7 @@ pub async fn get_duo_auth_url(
    device_identifier: &DeviceId,
    conn: &DbConn,
 ) -> Result<String, Error> {
-    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
    let callback_url = match make_callback_url(client_id) {
        Ok(url) => url,
@@ -394,7 +395,7 @@ pub async fn get_duo_auth_url(
    match client.health_check().await {
        Ok(()) => {}
        Err(e) => return Err(e),
-    };
+    }
    // Generate random OAuth2 state and OIDC Nonce
    let state: String = crypto::get_random_string_alphanum(STATE_LENGTH);
@@ -434,20 +435,17 @@ pub async fn validate_duo_login(
    let code = split[0];
    let state = split[1];
-    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
    // Get the context by the state reported by the client. If we don't have one,
    // it means the context is either missing or expired.
-    let ctx = match extract_context(state, conn).await {
+    let Some(ctx) = extract_context(state, conn).await else {
-        Some(c) => c,
+        err!(
-        None => {
+            "Error validating duo authentication",
-            err!(
+            ErrorEvent {
-                "Error validating duo authentication",
+                event: EventType::UserFailedLogIn2fa
-                ErrorEvent {
+            }
-                    event: EventType::UserFailedLogIn2fa
+        )
                }
            )
        }
    };
    // Context validation steps
@@ -476,13 +474,13 @@ pub async fn validate_duo_login(
    match client.health_check().await {
        Ok(()) => {}
        Err(e) => return Err(e),
-    };
+    }
    let d: Digest = digest(&SHA512_256, format!("{}{device_identifier}", ctx.nonce).as_bytes());
    let hash: String = HEXLOWER.encode(d.as_ref());
    match client.exchange_authz_code_for_result(code, email, hash.as_str()).await {
-        Ok(_) => Ok(()),
+        Ok(()) => Ok(()),
        Err(_) => {
            err!(
                "Error validating duo authentication",
@@ -1,20 +1,20 @@
 use chrono::{DateTime, TimeDelta, Utc};
-use rocket::serde::json::Json;
+use rocket::{Route, serde::json::Json};
 use rocket::Route;
 use crate::{
    CONFIG,
    api::{
        core::{log_user_event, two_factor::_generate_recover_code},
        EmptyResult, JsonResult, PasswordOrOtpData,
        core::{log_user_event, two_factor::generate_recover_code},
    },
    auth::{ClientHeaders, Headers},
    crypto,
    db::{
        models::{AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorType, User, UserId},
        DbConn,
        models::{AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorType, User, UserId},
    },
    error::{Error, MapResult},
-    mail, CONFIG,
+    mail,
 };
 pub fn routes() -> Vec<Route> {
@@ -25,7 +25,7 @@ pub fn routes() -> Vec<Route> {
 #[serde(rename_all = "camelCase")]
 struct SendEmailLoginData {
    #[serde(alias = "DeviceIdentifier")]
-    device_identifier: DeviceId,
+    device_identifier: Option<DeviceId>,
    #[serde(alias = "Email")]
    email: Option<String>,
    #[serde(alias = "MasterPasswordHash")]
@@ -63,13 +63,19 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
    let user = if let Some(email) = email {
        let Some(user) = User::find_by_mail(email, &conn).await else {
-            err!("Username or password is incorrect. Try again.")
+            err!(
                "Username or password is incorrect. Try again",
                format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
            )
        };
        if let Some(master_password_hash) = master_password_hash {
            // Check password
            if !user.check_valid_password(master_password_hash) {
-                err!("Username or password is incorrect. Try again.")
+                err!(
                    "Username or password is incorrect. Try again",
                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
                )
            }
        } else if let Some(auth_request_id) = auth_request_id {
            let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
@@ -91,9 +97,15 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
        user
    } else {
        let Some(device_identifier) = &data.device_identifier else {
            err!("No device identifier has been submitted.")
        };
        // SSO login only sends device id, so we get the user by the most recently used device
-        let Some(user) = User::find_by_device_for_email2fa(&data.device_identifier, &conn).await else {
+        let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
-            err!("Username or password is incorrect. Try again.")
+            err!(
                "Username or password is incorrect. Try again",
                format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
            )
        };
        user
@@ -176,7 +188,7 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
    }
    let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
-    let twofactor_data = EmailTokenData::new(data.email, generated_token);
+    let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));
    // Uses EmailVerificationChallenge as type to show that it's not verified yet.
    let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
@@ -229,7 +241,7 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
    twofactor.data = email_data.to_json();
    twofactor.save(&conn).await?;
-    _generate_recover_code(&mut user, &conn).await;
+    generate_recover_code(&mut user, &conn).await;
    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
@@ -281,9 +293,9 @@ pub async fn validate_email_code_str(
    twofactor.data = email_data.to_json();
    twofactor.save(conn).await?;
-    let date = DateTime::from_timestamp(email_data.token_sent, 0).expect("Email token timestamp invalid.").naive_utc();
+    let dt = DateTime::from_timestamp(email_data.token_sent, 0).expect("Email token timestamp invalid.").naive_utc();
-    let max_time = CONFIG.email_expiration_time() as i64;
+    let max_time = CONFIG.email_expiration_time().cast_signed();
-    if date + TimeDelta::try_seconds(max_time).unwrap() < Utc::now().naive_utc() {
+    if dt + TimeDelta::try_seconds(max_time).unwrap() < Utc::now().naive_utc() {
        err!(
            "Token has expired",
            ErrorEvent {
@@ -310,10 +322,10 @@ pub struct EmailTokenData {
 }
 impl EmailTokenData {
-    pub fn new(email: String, token: String) -> EmailTokenData {
+    pub fn new(email: String, token: Option<String>) -> EmailTokenData {
        EmailTokenData {
            email,
-            last_token: Some(token),
+            last_token: token,
            token_sent: Utc::now().timestamp(),
            attempts: 0,
        }
@@ -339,9 +351,10 @@ impl EmailTokenData {
    pub fn from_json(string: &str) -> Result<EmailTokenData, Error> {
        let res: Result<EmailTokenData, serde_json::Error> = serde_json::from_str(string);
-        match res {
+        if let Ok(x) = res {
-            Ok(x) => Ok(x),
+            Ok(x)
-            Err(_) => err!("Could not decode EmailTokenData from string"),
+        } else {
            err!("Could not decode EmailTokenData from string")
        }
    }
 }
@@ -350,7 +363,8 @@ pub async fn activate_email_2fa(user: &User, conn: &DbConn) -> EmptyResult {
    if user.verified_at.is_none() {
        err!("Auto-enabling of email 2FA failed because the users email address has not been verified!");
    }
-    let twofactor_data = EmailTokenData::new(user.email.clone(), String::new());
+    // The token is set when the first code is sent
    let twofactor_data = EmailTokenData::new(user.email.clone(), None);
    let twofactor = TwoFactor::new(user.uuid.clone(), TwoFactorType::Email, twofactor_data.to_json());
    twofactor.save(conn).await
 }
@@ -359,18 +373,17 @@ pub async fn activate_email_2fa(user: &User, conn: &DbConn) -> EmptyResult {
 pub fn obscure_email(email: &str) -> String {
    let split: Vec<&str> = email.rsplitn(2, '@').collect();
-    let mut name = split[1].to_string();
+    let mut name = split[1].to_owned();
    let domain = &split[0];
    let name_size = name.chars().count();
-    let new_name = match name_size {
+    let new_name = if let 1..=3 = name_size {
-        1..=3 => "*".repeat(name_size),
+        "*".repeat(name_size)
-        _ => {
+    } else {
-            let stars = "*".repeat(name_size - 2);
+        let stars = "*".repeat(name_size - 2);
-            name.truncate(2);
+        name.truncate(2);
-            format!("{name}{stars}")
+        format!("{name}{stars}")
        }
    };
    format!("{new_name}@{domain}")
@@ -1,28 +1,27 @@
 use chrono::{TimeDelta, Utc};
 use data_encoding::BASE32;
 use num_traits::FromPrimitive;
-use rocket::serde::json::Json;
+use rocket::{Route, serde::json::Json};
 use rocket::Route;
 use serde::Deserialize;
 use serde_json::Value;
 use crate::{
    CONFIG,
    api::{
        core::{log_event, log_user_event},
        EmptyResult, JsonResult, PasswordOrOtpData,
        core::{log_event, log_user_event},
    },
    auth::Headers,
    crypto,
    db::{
        models::{
            DeviceType, EventType, Membership, MembershipType, OrgPolicyType, Organization, OrganizationId, TwoFactor,
            TwoFactorIncomplete, TwoFactorType, User, UserId,
        },
        DbConn, DbPool,
        models::{
            Device, DeviceType, EventType, Membership, MembershipType, OrgPolicyType, Organization, OrganizationId,
            TwoFactor, TwoFactorIncomplete, TwoFactorType, User, UserId,
        },
    },
    mail,
    util::NumberOrString,
    CONFIG,
 };
 pub mod authenticator;
@@ -37,7 +36,7 @@ fn has_global_duo_credentials() -> bool {
    CONFIG._enable_duo() && CONFIG.duo_host().is_some() && CONFIG.duo_ikey().is_some() && CONFIG.duo_skey().is_some()
 }
-pub fn is_twofactor_provider_usable(provider_type: TwoFactorType, provider_data: Option<&str>) -> bool {
+pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data: Option<&str>) -> bool {
    #[derive(Deserialize)]
    struct DuoProviderData {
        host: String,
@@ -46,7 +45,7 @@ pub fn is_twofactor_provider_usable(provider_type: TwoFactorType, provider_data:
    }
    match provider_type {
-        TwoFactorType::Authenticator => true,
+        TwoFactorType::Authenticator | TwoFactorType::RecoveryCode => true,
        TwoFactorType::Email => CONFIG._enable_email_2fa(),
        TwoFactorType::Duo | TwoFactorType::OrganizationDuo => {
            provider_data
@@ -59,7 +58,6 @@ pub fn is_twofactor_provider_usable(provider_type: TwoFactorType, provider_data:
        }
        TwoFactorType::Webauthn => CONFIG.is_webauthn_2fa_supported(),
        TwoFactorType::Remember => !CONFIG.disable_2fa_remember(),
        TwoFactorType::RecoveryCode => true,
        TwoFactorType::U2f
        | TwoFactorType::U2fRegisterChallenge
        | TwoFactorType::U2fLoginChallenge
@@ -71,13 +69,7 @@ pub fn is_twofactor_provider_usable(provider_type: TwoFactorType, provider_data:
 }
 pub fn routes() -> Vec<Route> {
-    let mut routes = routes![
+    let mut routes = routes![get_twofactor, get_recover, disable_twofactor, get_device_verification_settings];
        get_twofactor,
        get_recover,
        disable_twofactor,
        disable_twofactor_put,
        get_device_verification_settings,
    ];
    routes.append(&mut authenticator::routes());
    routes.append(&mut duo::routes());
@@ -96,7 +88,7 @@ async fn get_twofactor(headers: Headers, conn: DbConn) -> Json<Value> {
        .iter()
        .filter_map(|tf| {
            let provider_type = TwoFactorType::from_i32(tf.atype)?;
-            is_twofactor_provider_usable(provider_type, Some(&tf.data)).then(|| TwoFactor::to_json_provider(tf))
+            is_twofactor_provider_usable(&provider_type, Some(&tf.data)).then(|| TwoFactor::to_json_provider(tf))
        })
        .collect();
@@ -120,7 +112,7 @@ async fn get_recover(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbCo
    })))
 }
-async fn _generate_recover_code(user: &mut User, conn: &DbConn) {
+async fn generate_recover_code(user: &mut User, conn: &DbConn) {
    if user.totp_recover.is_none() {
        let totp_recover = crypto::encode_random_bytes::<20>(&BASE32);
        user.totp_recover = Some(totp_recover);
@@ -136,7 +128,7 @@ struct DisableTwoFactorData {
    r#type: NumberOrString,
 }
-#[post("/two-factor/disable", data = "<data>")]
+#[put("/two-factor/disable", data = "<data>")]
 async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
    let data: DisableTwoFactorData = data.into_inner();
    let user = headers.user;
@@ -153,6 +145,7 @@ async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, c
    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
        twofactor.delete(&conn).await?;
        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
        log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
            .await;
    }
@@ -168,11 +161,6 @@ async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, c
    })))
 }
 #[put("/two-factor/disable", data = "<data>")]
 async fn disable_twofactor_put(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
    disable_twofactor(data, headers, conn).await
 }
 pub async fn enforce_2fa_policy(
    user: &User,
    act_user_id: &UserId,
@@ -180,9 +168,7 @@ pub async fn enforce_2fa_policy(
    ip: &std::net::IpAddr,
    conn: &DbConn,
 ) -> EmptyResult {
-    for member in
+    for member in Membership::find_by_user_and_policy(&user.uuid, OrgPolicyType::TwoFactorAuthentication, conn).await {
        Membership::find_by_user_and_policy(&user.uuid, OrgPolicyType::TwoFactorAuthentication, conn).await.into_iter()
    {
        // Policy only applies to non-Owner/non-Admin members who have accepted joining the org
        if member.atype < MembershipType::Admin {
            if CONFIG.mail_enabled() {
@@ -194,7 +180,7 @@ pub async fn enforce_2fa_policy(
            member.save(conn).await?;
            log_event(
-                EventType::OrganizationUserRevoked as i32,
+                EventType::OrganizationUserRevoked,
                &member.uuid,
                &member.org_uuid,
                act_user_id,
@@ -217,7 +203,7 @@ pub async fn enforce_2fa_policy_for_org(
    conn: &DbConn,
 ) -> EmptyResult {
    let org = Organization::find_by_uuid(org_id, conn).await.unwrap();
-    for member in Membership::find_confirmed_by_org(org_id, conn).await.into_iter() {
+    for member in Membership::find_confirmed_by_org(org_id, conn).await {
        // Don't enforce the policy for Admins and Owners.
        if member.atype < MembershipType::Admin && TwoFactor::find_by_user(&member.user_uuid, conn).await.is_empty() {
            if CONFIG.mail_enabled() {
@@ -228,16 +214,8 @@ pub async fn enforce_2fa_policy_for_org(
            member.revoke();
            member.save(conn).await?;
-            log_event(
+            log_event(EventType::OrganizationUserRevoked, &member.uuid, org_id, act_user_id, device_type, ip, conn)
-                EventType::OrganizationUserRevoked as i32,
+                .await;
                &member.uuid,
                org_id,
                act_user_id,
                device_type,
                ip,
                conn,
            )
            .await;
        }
    }
@@ -251,12 +229,9 @@ pub async fn send_incomplete_2fa_notifications(pool: DbPool) {
        return;
    }
-    let conn = match pool.get().await {
+    let Ok(conn) = pool.get().await else {
-        Ok(conn) => conn,
+        error!("Failed to get DB connection in send_incomplete_2fa_notifications()");
-        _ => {
+        return;
            error!("Failed to get DB connection in send_incomplete_2fa_notifications()");
            return;
        }
    };
    let now = Utc::now().naive_utc();
@@ -278,7 +253,7 @@ pub async fn send_incomplete_2fa_notifications(pool: DbPool) {
        )
        .await
        {
-            Ok(_) => {
+            Ok(()) => {
                if let Err(e) = login.delete(&conn).await {
                    error!("Error deleting incomplete 2FA record: {e:#?}");
                }
@@ -1,16 +1,17 @@
-use chrono::{naive::serde::ts_seconds, NaiveDateTime, TimeDelta, Utc};
+use chrono::{NaiveDateTime, TimeDelta, Utc, naive::serde::ts_seconds};
-use rocket::{serde::json::Json, Route};
+use rocket::{Route, serde::json::Json};
 use crate::{
    CONFIG,
    api::EmptyResult,
    auth::Headers,
    crypto,
    db::{
        models::{TwoFactor, TwoFactorType, UserId},
        DbConn,
        models::{TwoFactor, TwoFactorType, UserId},
    },
    error::{Error, MapResult},
-    mail, CONFIG,
+    mail,
 };
 pub fn routes() -> Vec<Route> {
@@ -44,9 +45,10 @@ impl ProtectedActionData {
    pub fn from_json(string: &str) -> Result<Self, Error> {
        let res: Result<Self, serde_json::Error> = serde_json::from_str(string);
-        match res {
+        if let Ok(x) = res {
-            Ok(x) => Ok(x),
+            Ok(x)
-            Err(_) => err!("Could not decode ProtectedActionData from string"),
+        } else {
            err!("Could not decode ProtectedActionData from string")
        }
    }
@@ -62,7 +64,9 @@ impl ProtectedActionData {
 #[post("/accounts/request-otp")]
 async fn request_otp(headers: Headers, conn: DbConn) -> EmptyResult {
    if !CONFIG.mail_enabled() {
-        err!("Email is disabled for this server. Either enable email or login using your master password instead of login via device.");
+        err!(
            "Email is disabled for this server. Either enable email or login using your master password instead of login via device."
        );
    }
    let user = headers.user;
@@ -102,7 +106,9 @@ struct ProtectedActionVerify {
 #[post("/accounts/verify-otp", data = "<data>")]
 async fn verify_otp(data: Json<ProtectedActionVerify>, headers: Headers, conn: DbConn) -> EmptyResult {
    if !CONFIG.mail_enabled() {
-        err!("Email is disabled for this server. Either enable email or login using your master password instead of login via device.");
+        err!(
            "Email is disabled for this server. Either enable email or login using your master password instead of login via device."
        );
    }
    let user = headers.user;
@@ -133,7 +139,7 @@ pub async fn validate_protected_action_otp(
    }
    // Check if the token has expired (Using the email 2fa expiration time)
-    let max_time = CONFIG.email_expiration_time() as i64;
+    let max_time = CONFIG.email_expiration_time().cast_signed();
    if pa_data.time_since_sent().num_seconds() > max_time {
        pa.delete(conn).await?;
        err!("Token has expired")
@@ -1,34 +1,35 @@
-use crate::{
+use std::{str::FromStr, sync::LazyLock, time::Duration};
-    api::{
+
-        core::{log_user_event, two_factor::_generate_recover_code},
+use rocket::{Route, serde::json::Json};
        EmptyResult, JsonResult, PasswordOrOtpData,
    },
    auth::Headers,
    crypto::ct_eq,
    db::{
        models::{EventType, TwoFactor, TwoFactorType, UserId},
        DbConn,
    },
    error::Error,
    util::NumberOrString,
    CONFIG,
 };
 use rocket::serde::json::Json;
 use rocket::Route;
 use serde_json::Value;
 use std::str::FromStr;
 use std::sync::LazyLock;
 use std::time::Duration;
 use url::Url;
 use uuid::Uuid;
-use webauthn_rs::prelude::{Base64UrlSafeData, Credential, Passkey, PasskeyAuthentication, PasskeyRegistration};
+use webauthn_rs::{
-use webauthn_rs::{Webauthn, WebauthnBuilder};
+    Webauthn, WebauthnBuilder,
    prelude::{Base64UrlSafeData, Credential, Passkey, PasskeyAuthentication, PasskeyRegistration},
 };
 use webauthn_rs_proto::{
    AuthenticationExtensionsClientOutputs, AuthenticatorAssertionResponseRaw, AuthenticatorAttestationResponseRaw,
    PublicKeyCredential, RegisterPublicKeyCredential, RegistrationExtensionsClientOutputs,
    RequestAuthenticationExtensions, UserVerificationPolicy,
 };
 use crate::{
    CONFIG,
    api::{
        EmptyResult, JsonResult, PasswordOrOtpData,
        core::{log_user_event, two_factor::generate_recover_code},
    },
    auth::Headers,
    crypto::ct_eq,
    db::{
        DbConn,
        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
    },
    error::Error,
    util::NumberOrString,
 };
 static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
    let domain = CONFIG.domain();
    let domain_origin = CONFIG.domain_origin();
@@ -38,7 +39,7 @@ static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
    let webauthn = WebauthnBuilder::new(&rp_id, &rp_origin)
        .expect("Creating WebauthnBuilder failed")
        .rp_name(&domain)
-        .timeout(Duration::from_millis(60000));
+        .timeout(Duration::from_mins(1));
    webauthn.build().expect("Building Webauthn failed")
 });
@@ -149,7 +150,7 @@ async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Hea
    )?;
    let mut state = serde_json::to_value(&state)?;
-    state["rs"]["policy"] = Value::String("discouraged".to_string());
+    state["rs"]["policy"] = Value::String("discouraged".to_owned());
    state["rs"]["extensions"].as_object_mut().unwrap().clear();
    let type_ = TwoFactorType::WebauthnRegisterChallenge;
@@ -265,13 +266,12 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
    // Retrieve and delete the saved challenge state
    let type_ = TwoFactorType::WebauthnRegisterChallenge as i32;
-    let state = match TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
+    let state = if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
-        Some(tf) => {
+        let state: PasskeyRegistration = serde_json::from_str(&tf.data)?;
-            let state: PasskeyRegistration = serde_json::from_str(&tf.data)?;
+        tf.delete(&conn).await?;
-            tf.delete(&conn).await?;
+        state
-            state
+    } else {
-        }
+        err!("Can't recover challenge")
        None => err!("Can't recover challenge"),
    };
    // Verify the credentials with the saved state
@@ -291,7 +291,7 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
    TwoFactor::new(user.uuid.clone(), TwoFactorType::Webauthn, serde_json::to_string(&registrations)?)
        .save(&conn)
        .await?;
-    _generate_recover_code(&mut user, &conn).await;
+    generate_recover_code(&mut user, &conn).await;
    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
@@ -338,13 +338,15 @@ async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, conn: DbCo
    tf.data = serde_json::to_string(&data)?;
    tf.save(&conn).await?;
    drop(tf);
    Device::clear_twofactor_remember_by_user(&headers.user.uuid, &conn).await?;
    // If entry is migrated from u2f, delete the u2f entry as well
    if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await
    {
-        let mut data: Vec<U2FRegistration> = match serde_json::from_str(&u2f.data) {
+        let mut data: Vec<U2FRegistration> = if let Ok(d) = serde_json::from_str(&u2f.data) {
-            Ok(d) => d,
+            d
-            Err(_) => err!("Error parsing U2F data"),
+        } else {
            err!("Error parsing U2F data")
        };
        data.retain(|r| r.reg.key_handle != removed_item.credential.cred_id().as_slice());
@@ -388,10 +390,10 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &DbConn) -> JsonRes
    // Modify to discourage user verification
    let mut state = serde_json::to_value(&state)?;
-    state["ast"]["policy"] = Value::String("discouraged".to_string());
+    state["ast"]["policy"] = Value::String("discouraged".to_owned());
    // Add appid, this is only needed for U2F compatibility, so maybe it can be removed as well
-    let app_id = format!("{}/app-id.json", &CONFIG.domain());
+    let app_id = format!("{}/app-id.json", CONFIG.domain());
    state["ast"]["appid"] = Value::String(app_id.clone());
    response.public_key.user_verification = UserVerificationPolicy::Discouraged_DO_NOT_USE;
@@ -416,18 +418,17 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &DbConn) -> JsonRes
 pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &DbConn) -> EmptyResult {
    let type_ = TwoFactorType::WebauthnLoginChallenge as i32;
-    let mut state = match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
+    let mut state = if let Some(tf) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
-        Some(tf) => {
+        let state: PasskeyAuthentication = serde_json::from_str(&tf.data)?;
-            let state: PasskeyAuthentication = serde_json::from_str(&tf.data)?;
+        tf.delete(conn).await?;
-            tf.delete(conn).await?;
+        state
-            state
+    } else {
-        }
+        err!(
        None => err!(
            "Can't recover login challenge",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
-        ),
+        )
    };
    let rsp: PublicKeyCredentialCopy = serde_json::from_str(response)?;
@@ -1,26 +1,56 @@
-use rocket::serde::json::Json;
+use rocket::{Route, serde::json::Json};
 use rocket::Route;
 use serde_json::Value;
-use yubico::{config::Config, verify_async};
+use yubico_ng::{
    Verifier, YubicoError,
    config::Config,
    transport::{AsyncTransport, Response},
 };
 use crate::{
    CONFIG,
    api::{
        core::{log_user_event, two_factor::_generate_recover_code},
        EmptyResult, JsonResult, PasswordOrOtpData,
        core::{log_user_event, two_factor::generate_recover_code},
    },
    auth::Headers,
    db::{
        models::{EventType, TwoFactor, TwoFactorType},
        DbConn,
        models::{EventType, TwoFactor, TwoFactorType},
    },
    error::{Error, MapResult},
-    CONFIG,
+    http_client,
 };
 pub fn routes() -> Vec<Route> {
    routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
 }
 struct HttpClientTransport {
    client: reqwest::Client,
 }
 impl HttpClientTransport {
    fn new() -> Result<Self, reqwest::Error> {
        http_client::get_reqwest_client_builder(false).redirect(reqwest::redirect::Policy::none()).build().map(
            |client| Self {
                client,
            },
        )
    }
 }
 impl AsyncTransport for HttpClientTransport {
    type Error = YubicoError;
    async fn yubico_get(&self, url: &str) -> Result<Response, Self::Error> {
        let response = self.client.get(url).send().await.map_err(YubicoError::transport)?;
        Ok(Response {
            status: response.status().as_u16(),
            body: response.text().await.map_err(YubicoError::transport)?,
        })
    }
 }
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EnableYubikeyData {
@@ -45,8 +75,7 @@ pub struct YubikeyMetadata {
 fn parse_yubikeys(data: &EnableYubikeyData) -> Vec<String> {
    let data_keys = [&data.key1, &data.key2, &data.key3, &data.key4, &data.key5];
-
+    data_keys.into_iter().flatten().filter(|e| !e.is_empty()).cloned().collect()
    data_keys.iter().filter_map(|e| e.as_ref().cloned()).collect()
 }
 fn jsonify_yubikeys(yubikeys: Vec<String>) -> Value {
@@ -64,22 +93,25 @@ fn get_yubico_credentials() -> Result<(String, String), Error> {
        err!("Yubico support is disabled");
    }
-    match (CONFIG.yubico_client_id(), CONFIG.yubico_secret_key()) {
+    if let (Some(id), Some(secret)) = (CONFIG.yubico_client_id(), CONFIG.yubico_secret_key()) {
-        (Some(id), Some(secret)) => Ok((id, secret)),
+        Ok((id, secret))
-        _ => err!("`YUBICO_CLIENT_ID` or `YUBICO_SECRET_KEY` environment variable is not set. Yubikey OTP Disabled"),
+    } else {
        err!("`YUBICO_CLIENT_ID` or `YUBICO_SECRET_KEY` environment variable is not set. Yubikey OTP Disabled")
    }
 }
 async fn verify_yubikey_otp(otp: String) -> EmptyResult {
    let (yubico_id, yubico_secret) = get_yubico_credentials()?;
-    let config = Config::default().set_client_id(yubico_id).set_key(yubico_secret);
+    let mut config = Config::default().set_client_id(yubico_id).set_key(yubico_secret)?;
-
+    if let Some(yubico_server) = CONFIG.yubico_server() {
-    match CONFIG.yubico_server() {
+        config = config.set_api_host(yubico_server);
        Some(server) => verify_async(otp, config.set_api_hosts(vec![server])).await,
        None => verify_async(otp, config).await,
    }
-    .map_res("Failed to verify OTP")
+
    let client = HttpClientTransport::new()?;
    let verifier = Verifier::with_client(config, client)?;
    verifier.verify(otp).await.map_res("Failed to verify OTP")
 }
 #[post("/two-factor/get-yubikey", data = "<data>")]
@@ -137,10 +169,9 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
    let yubikeys = parse_yubikeys(&data);
    if yubikeys.is_empty() {
-        return Ok(Json(json!({
+        // Return an error to prevent saving empty keys which would cause users not being able to login anymore.
-            "enabled": false,
+        // To remove all keys users should click the `Deactivate all keys` button
-            "object": "twoFactorU2f",
+        err!("A key is required.");
        })));
    }
    // Ensure they are valid OTPs
@@ -162,7 +193,7 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
    yubikey_data.data = serde_json::to_string(&yubikey_metadata).unwrap();
    yubikey_data.save(&conn).await?;
-    _generate_recover_code(&mut user, &conn).await;
+    generate_recover_code(&mut user, &conn).await;
    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
@@ -186,7 +217,9 @@ pub async fn validate_yubikey_login(response: &str, twofactor_data: &str) -> Emp
    }
    let yubikey_metadata: YubikeyMetadata = serde_json::from_str(twofactor_data).expect("Can't parse Yubikey Metadata");
-    let response_id = &response[..12];
+    let Some(response_id) = response.get(..12) else {
        err!("Invalid Yubikey OTP");
    };
    if !yubikey_metadata.keys.contains(&response_id.to_owned()) {
        err!("Given Yubikey is not registered");
		`@@ -0,0 +1 @@`
							`ALTER TABLE sso_auth DROP COLUMN binding_hash;`
		`@@ -0,0 +1 @@`
							`ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;`
		`@@ -0,0 +1 @@`
							`ALTER TABLE sso_auth DROP COLUMN code_response_error;`
		`@@ -0,0 +1 @@`
							`ALTER TABLE sso_auth ADD COLUMN code_response_error TEXT;`
		`@@ -0,0 +1 @@`
							`ALTER TABLE sso_auth DROP COLUMN IF EXISTS code_response_error;`
		`@@ -0,0 +1 @@`
							`ALTER TABLE sso_auth ADD COLUMN IF NOT EXISTS code_response_error TEXT;`