Fix org import

Fmt
Fix get_groups_data when not using full_access
2026-10-26 01:06:47 +02:00 · 2026-07-24 16:36:11 +02:00 · 2026-07-24 16:32:50 +02:00 · 2026-07-24 16:20:34 +02:00 · 2026-07-24 15:47:51 +02:00 · 2026-07-20 01:24:46 +02:00
78 changed files with 1520 additions and 1943 deletions
@@ -316,14 +316,6 @@
 ## unauthenticated access to potentially sensitive data.
 # SHOW_PASSWORD_HINT=false
 #########################
 ### Client settings  ###
 #########################
 ## Control whether clients onboarding interstitials are suppressed
 ## (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals)
 # CLIENT_SUPPRESS_ONBOARDING=false
 #########################
 ### Advanced settings ###
 #########################
@@ -62,7 +62,7 @@ jobs:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      # End Checkout the repo
@@ -32,7 +32,7 @@ jobs:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      # End Checkout the repo
@@ -41,12 +41,12 @@ jobs:
      # Uses the Docker-based action (hadolint pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian)
      # so no binary is downloaded at runtime. Pinned by commit SHA for supply-chain safety.
      - name: Run hadolint on Dockerfile.debian
-        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: docker/Dockerfile.debian
      - name: Run hadolint on Dockerfile.alpine
-        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: docker/Dockerfile.alpine
      # End Test Dockerfiles with hadolint
@@ -77,7 +77,7 @@ jobs:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        # We need fetch-depth of 0 so we also get all the tag metadata
        with:
          persist-credentials: false
@@ -106,7 +106,7 @@ jobs:
      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -121,7 +121,7 @@ jobs:
      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -137,7 +137,7 @@ jobs:
      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -237,7 +237,7 @@ jobs:
      # Upload artifacts to Github Actions and Attest the binaries
      - name: Attest binaries
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-path: vaultwarden-${{ env.NORMALIZED_ARCH }}
@@ -272,7 +272,7 @@ jobs:
      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -287,7 +287,7 @@ jobs:
      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -303,7 +303,7 @@ jobs:
      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -365,7 +365,7 @@ jobs:
      # Attest container images
      - name: Attest - docker.io - ${{ matrix.base_image }}
        if: ${{ vars.DOCKERHUB_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-name: ${{ vars.DOCKERHUB_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -373,7 +373,7 @@ jobs:
      - name: Attest - ghcr.io - ${{ matrix.base_image }}
        if: ${{ vars.GHCR_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-name: ${{ vars.GHCR_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -381,7 +381,7 @@ jobs:
      - name: Attest - quay.io - ${{ matrix.base_image }}
        if: ${{ vars.QUAY_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-name: ${{ vars.QUAY_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -33,7 +33,7 @@ jobs:
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
@@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH
      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          sarif_file: 'trivy-results.sarif'
@@ -16,11 +16,11 @@ jobs:
    steps:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      # End Checkout the repo
      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
+        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
@@ -19,12 +19,12 @@ jobs:
      security-events: write # To write the security report
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
@@ -18,10 +18,9 @@ repos:
  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
  - repo: https://github.com/crate-ci/typos
-    rev: 8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
+    rev: bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
    hooks:
      - id: typos
        always_run: true
  - repo: local
    hooks:
@@ -39,7 +38,8 @@ repos:
        entry: cargo test
        language: system
        args: [ "--features", "sqlite,mysql,postgresql", "--" ]
-        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
+        types_or: [ rust, file ]
        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
        pass_filenames: false
      - id: cargo-clippy
        name: cargo clippy
@@ -47,7 +47,8 @@ repos:
        entry: cargo clippy
        language: system
        args: [ "--features", "sqlite,mysql,postgresql", "--", "-D", "warnings" ]
-        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
+        types_or: [ rust, file ]
        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
        pass_filenames: false
      - id: check-docker-templates
        name: check docker templates
@@ -1,6 +1,6 @@
 [workspace.package]
 edition = "2024"
-rust-version = "1.95.0"
+rust-version = "1.94.1"
 license = "AGPL-3.0-only"
 repository = "https://github.com/dani-garcia/vaultwarden"
 publish = false
@@ -58,7 +58,6 @@ oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]
 unstable = []
 [target."cfg(unix)".dependencies]
 nix = { version = "0.31.3", features = ["fs"] }
 # Logging
 syslog = "7.0.0"
@@ -76,7 +75,7 @@ dotenvy = { version = "0.15.7", default-features = false }
 # Numerical libraries
 num-traits = "0.2.19"
-num-derive = "0.5.1"
+num-derive = "0.4.2"
 bigdecimal = "0.4.10"
 # Web framework
@@ -90,8 +89,8 @@ rmpv = "1.3.1" # MessagePack library
 dashmap = "6.2.1"
 # Async futures
-futures = "0.3.33"
+futures = "0.3.32"
-tokio = { version = "1.53.1", features = [
+tokio = { version = "1.52.3", features = [
    "fs",
    "io-util",
    "net",
@@ -100,14 +99,14 @@ tokio = { version = "1.53.1", features = [
    "signal",
    "time",
 ] }
-tokio-util = { version = "0.7.19", features = ["compat"] }
+tokio-util = { version = "0.7.18", features = ["compat"] }
 # A generic serialization/deserialization framework
-serde = { version = "1.0.229", features = ["derive"] }
+serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.151"
+serde_json = "1.0.150"
 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.11", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.3.10", features = ["chrono", "r2d2", "numeric"] }
 diesel_migrations = "2.3.2"
 derive_more = { version = "2.1.1", features = [
@@ -125,31 +124,31 @@ libsqlite3-sys = { version = "0.37.0", optional = true }
 # Crypto-related libraries
 rand = "0.10.2"
 ring = "0.17.14"
-rustls = { version = "0.23.43", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.41", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"
 # UUID generation
-uuid = { version = "1.24.0", features = ["v4"] }
+uuid = { version = "1.23.4", features = ["v4"] }
 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
 chrono-tz = "0.10.4"
-time = "0.3.55"
+time = "0.3.53"
 # Job scheduler
-job_scheduler_ng = "2.5.0"
+job_scheduler_ng = "2.4.0"
 # Data encoding library Hex/Base32/Base64
-data-encoding = "2.11.1"
+data-encoding = "2.11.0"
 # JWT library
-jsonwebtoken = { version = "11.0.0", default-features = false, features = ["rust_crypto", "use_pem"] }
+jsonwebtoken = { version = "10.4.0", default-features = false, features = ["rust_crypto", "use_pem"] }
 # TOTP library
 totp-lite = "2.0.1"
 # Yubico Library
-yubico_ng = { version = "1.0.0", default-features = false }
+yubico = { package = "yubico_ng", version = "0.15.0", default-features = false, features = ["online-tokio"] }
 # WebAuthn libraries
 # danger-allow-state-serialisation is needed to save the state in the db
@@ -162,7 +161,7 @@ webauthn-rs-core = "0.5.5"
 url = "2.5.8"
 # Email libraries
-lettre = { version = "0.11.23", default-features = false, features = [
+lettre = { version = "0.11.22", default-features = false, features = [
    # Misc
    "tracing",
    "serde",
@@ -180,7 +179,7 @@ percent-encoding = "2.3.2" # URL encoding library used for URL's in the emails
 email_address = "0.2.9"
 # HTML Template library
-handlebars = { version = "6.4.3", features = ["dir_source"] }
+handlebars = { version = "6.4.2", features = ["dir_source"] }
 # HTTP client (Used for favicons, version check, DUO and HIBP API)
 reqwest = { version = "0.13.4", default-features = false, features = [
@@ -205,7 +204,7 @@ hickory-resolver = "0.26.1"
 # Favicon extraction libraries
 html5gum = "0.8.4"
-regex = { version = "1.13.1", default-features = false, features = [
+regex = { version = "1.12.4", default-features = false, features = [
    "perf",
    "std",
    "unicode-perl",
@@ -232,7 +231,7 @@ pastey = "0.2.3"
 governor = "0.10.4"
 # CIDR parsing for the trusted proxies of the client IP header
-ipnet = "2.12.1"
+ipnet = "2.12.0"
 # OIDC for SSO
 openidconnect = { version = "4.0.1", default-features = false }
@@ -245,7 +244,7 @@ semver = "1.0.28"
 # Mainly used for the musl builds, since the default musl malloc is very slow
 mimalloc = { version = "0.1.52", optional = true, default-features = false, features = ["secure"] }
-which = "8.0.5"
+which = "8.0.4"
 # Argon2 library with support for the PHC format
 argon2 = "0.5.3"
@@ -257,20 +256,20 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }
 # File are accessed through Apache OpenDAL
-opendal = { version = "0.58.1", default-features = false, features = ["services-fs"] }
+opendal = { version = "0.57.0", default-features = false, features = ["services-fs"] }
 # For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.10.1", optional = true, default-features = false, features = [
+aws-config = { version = "1.8.18", optional = true, default-features = false, features = [
    "behavior-version-latest",
    "credentials-process",
    "rt-tokio",
    "sso",
 ] }
-aws-credential-types = { version = "1.3.0", optional = true }
+aws-credential-types = { version = "1.2.14", optional = true }
-aws-smithy-runtime-api = { version = "1.14.0", optional = true }
+aws-smithy-runtime-api = { version = "1.13.0", optional = true }
-http = { version = "1.5.0", optional = true }
+http = { version = "1.4.2", optional = true }
-reqsign-aws-v4 = { version = "3.1.0", optional = true }
+reqsign-aws-v4 = { version = "3.0.1", optional = true }
-reqsign-core = { version = "3.2.1", optional = true }
+reqsign-core = { version = "3.0.1", optional = true }
 # Strip debuginfo from the release builds
 # The debug symbols are to provide better panic traces
@@ -1,11 +1,11 @@
 ---
-vault_version: "v2026.7.0"
+vault_version: "v2026.6.2"
-vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c"
+vault_image_digest: "sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a"
 # Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
 xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
-rust_version: 1.97.1 # Rust version to be used
+rust_version: 1.96.1 # Rust version to be used
 debian_version: trixie # Debian release name to be used
 alpine_version: "3.24" # Alpine version to be used
 # For which platforms/architectures will we try to build images
@@ -19,23 +19,23 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.6.2
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.6.2
-#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
+#     [docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a
-#     [docker.io/vaultwarden/web-vault:v2026.7.0]
+#     [docker.io/vaultwarden/web-vault:v2026.6.2]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a AS vault
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.97.1 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.96.1 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.97.1 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.96.1 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.97.1 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.96.1 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.97.1 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.96.1 AS build_armv6
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -66,11 +66,11 @@ RUN USER=root cargo new --bin /app
 WORKDIR /app
 # Environment variables for Cargo on Alpine based builds
-RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
+RUN echo "export CARGO_TARGET=${RUST_MUSL_CROSS_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -86,7 +86,7 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
    find . -not -path "./target*" -delete
@@ -97,13 +97,13 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -126,7 +126,6 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.24
 ENV ROCKET_PROFILE="release" \
@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.6.2
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.6.2
-#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
+#     [docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a
-#     [docker.io/vaultwarden/web-vault:v2026.7.0]
+#     [docker.io/vaultwarden/web-vault:v2026.6.2]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a AS vault
 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
@@ -36,8 +36,7 @@ FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.97.1-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.96.1-slim-trixie AS build
 # hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -81,7 +80,7 @@ RUN mkdir -pv "${CARGO_HOME}" && \
 RUN USER=root cargo new --bin /app
 WORKDIR /app
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -96,14 +95,9 @@ ARG DB=sqlite,mysql,postgresql
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
+RUN source /env-cargo && \
-    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
+    # Workaround for xx related build issues
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
        export XX_RUSTFLAGS; \
    fi && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
    find . -not -path "./target*" -delete
@@ -114,20 +108,15 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
-    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
+    # Workaround for xx related build issues
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
        export XX_RUSTFLAGS; \
    fi && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -150,7 +139,6 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim
 ENV ROCKET_PROFILE="release" \
@@ -28,13 +28,8 @@
 #     [docker.io/vaultwarden/web-vault:{{ vault_version | replace('+', '_') }}]
 #
 {% macro xx_cargo_config() -%}
-# Configure xx-cargo for target pkg-config and Debian transitive library lookup
+# Workaround for xx related build issues
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
        export XX_RUSTFLAGS; \
    fi && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}"
 {%- endmacro %}
 FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault
@@ -57,7 +52,6 @@ FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].arch_image[arch] }} AS
 # hadolint ignore=DL3006
 FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].image }} AS build
 {% if base == "debian" %}
 # hadolint ignore=DL3067
 COPY --from=xx / /
 {% endif %}
 ARG TARGETARCH
@@ -112,12 +106,12 @@ WORKDIR /app
 {% if base == "alpine" %}
 # Environment variables for Cargo on Alpine based builds
-RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
+RUN echo "export CARGO_TARGET=${RUST_MUSL_CROSS_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo
 {% endif %}
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -137,7 +131,7 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
+RUN source /env-cargo && \
 {% if base == "debian" %}
    {{ xx_cargo_config() }} && \
 {% elif base == "alpine" %}
@@ -152,7 +146,7 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
@@ -162,7 +156,7 @@ RUN . /env-cargo && \
 {% elif base == "alpine" %}
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
 {% endif %}
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -185,7 +179,6 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM {{ runtime_stage_image[base] }}
 ENV ROCKET_PROFILE="release" \
@@ -13,8 +13,8 @@ path = "src/lib.rs"
 proc-macro = true
 [dependencies]
-quote = "1.0.47"
+quote = "1.0.46"
-syn = "3.0.3"
+syn = "2.0.118"
 [lints]
 workspace = true
@@ -21,19 +21,11 @@ TEST_USER3=test3
 TEST_USER3_PASSWORD=${TEST_USER3}
 TEST_USER3_MAIL=${TEST_USER3}@yopmail.com
 TEST_USER4=test4
 TEST_USER4_PASSWORD=${TEST_USER4}
 TEST_USER4_MAIL=${TEST_USER4}@yopmail.com
 TEST_USER5=test5
 TEST_USER5_PASSWORD=${TEST_USER5}
 TEST_USER5_MAIL=${TEST_USER5}@yopmail.com
 ###################
 # Keycloak Config #
 ###################
-KC_BOOTSTRAP_ADMIN_USERNAME=admin
+KEYCLOAK_ADMIN=admin
-KC_BOOTSTRAP_ADMIN_PASSWORD=${KC_BOOTSTRAP_ADMIN_USERNAME}
+KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
 KC_HTTP_HOST=127.0.0.1
 KC_HTTP_PORT=8080
@@ -47,10 +39,8 @@ DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
 ######################
 ROCKET_ADDRESS=0.0.0.0
 ROCKET_PORT=8000
-ROCKET_TLS={certs="/data/ssl/localhost.crt",key="/data/ssl/localhost.key"}
+DOMAIN=http://localhost:${ROCKET_PORT}
 DOMAIN=https://127.0.0.1:${ROCKET_PORT}
 LOG_LEVEL=info,oidcwarden::sso=debug
 SSO_DEBUG_TOKENS=true
 I_REALLY_WANT_VOLATILE_STORAGE=true
 SSO_ENABLED=true
@@ -1,8 +1,8 @@
 # Integration tests
 This allows running integration tests using [Playwright](https://playwright.dev/).
-\
+
-It usse its own [test.env](/test/scenarios/test.env) with different ports to not collide with a running dev instance.
+It uses its own `test.env` with different ports to not collide with a running dev instance.
 ## Install
@@ -11,11 +11,11 @@ Databases (`Mariadb`, `Mysql` and `Postgres`) and `Playwright` will run in conta
 ### Running Playwright outside docker
-It's possible to run `Playwright` outside of the container, this remove the need to rebuild the image for each change.
+It is possible to run `Playwright` outside of the container, this removes the need to rebuild the image for each change.
-You'll additionally need `nodejs` then run:
+You will additionally need `nodejs` then run:
 ```bash
-npm ci --ignore-scripts --allow-git=none --allow-remote=none
+npm ci --ignore-scripts
 npx playwright install-deps
 npx playwright install firefox
 ```
@@ -65,7 +65,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
 ```bash
-PW_KEEP_SERVICE_RUNNING=true npx playwright test
+PW_KEEP_SERVICE_RUNNNING=true npx playwright test
 ```
 ### Running specific tests
@@ -77,7 +77,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite login
 ```
-To run only a specific test (It might fail if it has dependency):
+To run only a specifc test (It might fail if it has dependency):
 ```bash
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite -g "Account creation"
@@ -92,7 +92,7 @@ This does not start the server, you will need to start it manually.
 ```bash
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
-npx playwright codegen "https://127.0.0.1:8000" --ignore-https-errors
+npx playwright codegen "http://127.0.0.1:8003"
 ```
 ## Override web-vault
@@ -112,11 +112,12 @@ You can check the result running:
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
 ```
-Then check `https://127.0.0.1:8003/admin/diagnostics` with `admin`.
+Then check `http://127.0.0.1:8003/admin/diagnostics` with `admin`.
 # OpenID Connect test setup
-Additionally this `docker-compose` template allow to run locally `Vaultwarden`, [Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.
+Additionally this `docker-compose` template allows to run locally Vaultwarden,
 [Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.
 ## Setup
@@ -130,17 +131,18 @@ Then start the stack (the `profile` is required to run `Vaultwarden`) :
 ```bash
 > docker compose --profile vaultwarden --env-file .env up
 ....
-keycloakSetup_1  | Logging into https://127.0.0.1:8080 as user admin of realm master
+keycloakSetup_1  | Logging into http://127.0.0.1:8080 as user admin of realm master
 keycloakSetup_1  | Created new realm with id 'test'
 keycloakSetup_1  | 74af4933-e386-4e64-ba15-a7b61212c45e
 oidc_keycloakSetup_1 exited with code 0
 ```
-Wait until `oidc_keycloakSetup_1 exited with code 0` which indicate the correct setup of the Keycloak realm, client and user (It's normal for this container to stop once the configuration is done).
+Wait until `oidc_keycloakSetup_1 exited with code 0` which indicates the correct setup of the Keycloak realm, client and user
 (It is normal for this container to stop once the configuration is done).
 Then you can access :
- `Vaultwarden` on https://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
+- `Vaultwarden` on http://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
 - `Keycloak` on http://0.0.0.0:8080/admin/master/console/ with the default user `admin/admin`
 - `Maildev` on http://0.0.0.0:1080
@@ -169,7 +171,7 @@ docker compose --profile vaultwarden --env-file .env build VaultwardenPrebuild V
 All configuration for `keycloak` / `Vaultwarden` / `keycloak_setup.sh` can be found in [.env](.env.template).
 The content of the file will be loaded as environment variables in all containers.
- `keycloak` [configuration](https://www.keycloak.org/server/all-config) include `KC_BOOTSTRAP_ADMIN_USERNAME` / `KC_BOOTSTRAP_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
+- `keycloak` [configuration](https://www.keycloak.org/server/all-config) includes `KEYCLOAK_ADMIN` / `KEYCLOAK_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
 - All `Vaultwarden` configuration can be set (EX: `SMTP_*`)
 ## Cleanup
@@ -17,7 +17,7 @@ done
 set -e
-kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KC_BOOTSTRAP_ADMIN_USERNAME" --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" --client admin-cli
+kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
 kcadm.sh create realms -s realm="$TEST_REALM" -s enabled=true -s "accessTokenLifespan=600"
 kcadm.sh create clients -r test -s "clientId=$SSO_CLIENT_ID" -s "secret=$SSO_CLIENT_SECRET" -s "redirectUris=[\"$DOMAIN/*\"]" -i
@@ -39,6 +39,6 @@ kcadm.sh create realms -s realm="$DUMMY_REALM" -s enabled=true -s "accessTokenLi
 # THEN in another terminal:
 # docker exec -it keycloakSetup-dev /bin/bash
 # export PATH=$PATH:/opt/keycloak/bin
-# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KC_BOOTSTRAP_ADMIN_USERNAME" --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" --client admin-cli
+# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
 # ENJOY
 # Doc: https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/admin-cli.html
@@ -28,7 +28,7 @@ RUN mkdir /playwright
 WORKDIR /playwright
 COPY package.json package-lock.json .
-RUN npm ci --ignore-scripts --allow-git=none --allow-remote=none && npx playwright install-deps && npx playwright install firefox
+RUN npm ci --ignore-scripts && npx playwright install-deps && npx playwright install firefox
 COPY docker-compose.yml test.env ./
 COPY compose ./compose
@@ -35,7 +35,6 @@ WORKDIR /
 COPY --from=prebuilt /start.sh .
 COPY --from=prebuilt /vaultwarden .
 COPY --from=build /data ./data
 COPY --from=build /web-vault ./web-vault
 ENTRYPOINT ["/start.sh"]
@@ -22,14 +22,3 @@ if [[ ! -z "$REPO_URL" ]] && [[ ! -z "$COMMIT_HASH" ]] ; then
    mv build /web-vault
 fi
 # Lower the KDF iterations default for faster tests.
 sed -i 's/(6e5,2e6,6e5)/(1e5,2e6,1e5)/' /web-vault/app/main.*.js
 # Generate a self signed cert
 mkdir -p /data/ssl; cd /data/ssl
 openssl req -x509 -out localhost.crt -keyout localhost.key \
  -newkey rsa:2048 -nodes -sha256 \
  -subj '/CN=localhost' -extensions EXT -config <( \
   printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
@@ -24,15 +24,12 @@ services:
    environment:
      - ADMIN_TOKEN
      - DATABASE_URL
      - CLIENT_SUPPRESS_ONBOARDING
      - EMAIL_2FA_AUTO_FALLBACK
      - I_REALLY_WANT_VOLATILE_STORAGE
      - LOG_LEVEL
      - LOGIN_RATELIMIT_MAX_BURST
      - SMTP_HOST
      - SMTP_FROM
      - SMTP_DEBUG
      - SSO_AUTH_ONLY_NOT_SESSION
      - SSO_DEBUG_TOKENS
      - SSO_ENABLED
      - SSO_FRONTEND
@@ -73,7 +70,7 @@ services:
  Mysql:
    profiles: ["playwright"]
    container_name: playwright_mysql
-    image: mysql:9.7.0
+    image: mysql:8.4.1
    env_file: test.env
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
@@ -85,7 +82,7 @@ services:
  Postgres:
    profiles: ["playwright"]
    container_name: playwright_postgres
-    image: postgres:18.4
+    image: postgres:16.3
    env_file: test.env
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
@@ -97,7 +94,7 @@ services:
  Maildev:
    profiles: ["vaultwarden", "maildev"]
    container_name: maildev
-    image: timshel/maildev:3.2.19
+    image: timshel/maildev:3.0.4
    ports:
      - ${SMTP_PORT}:1025
      - 1080:1080
@@ -105,7 +102,7 @@ services:
  Keycloak:
    profiles: ["keycloak", "vaultwarden"]
    container_name: keycloak-${ENV:-dev}
-    image: quay.io/keycloak/keycloak:26.6.2
+    image: quay.io/keycloak/keycloak:26.3.4
    network_mode: "host"
    command:
      - start-dev
@@ -115,12 +112,12 @@ services:
    profiles: ["keycloak", "vaultwarden"]
    container_name: keycloakSetup-${ENV:-dev}
    image: keycloak_setup-${ENV:-dev}
    network_mode: "host"
    build:
      context: compose/keycloak
      dockerfile: Dockerfile
      args:
-        KEYCLOAK_VERSION: 26.6.2
+        KEYCLOAK_VERSION: 26.3.4
    network_mode: "host"
    depends_on:
      - Keycloak
    restart: "no"
@@ -1,4 +1,4 @@
-import { type FullConfig } from '@playwright/test';
+import { firefox, type FullConfig } from '@playwright/test';
 import { execSync } from 'node:child_process';
 import fs from 'fs';
@@ -207,7 +207,7 @@ export async function startVault(browser: Browser, testInfo: TestInfo, env = {},
 }
 export async function stopVault(force: boolean = false) {
-    if( force === false && process.env.PW_KEEP_SERVICE_RUNNING === "true" ) {
+    if( force === false && process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
        console.log(`Keep vaultwarden running on: ${process.env.DOMAIN}`);
    } else {
        console.log(`Vaultwarden stopping`);
@@ -231,7 +231,6 @@ export async function checkNotification(page: Page, hasText: string) {
 }
 export async function cleanLanding(page: Page) {
    await page.context().clearCookies();
    await page.goto('/', { waitUntil: 'domcontentloaded' });
    await expect(page.getByRole('button').nth(0)).toBeVisible();
@@ -249,3 +248,15 @@ export async function logout(test: Test, page: Page, user: { name: string }) {
        await expect(page.getByRole('heading', { name: 'Log in' })).toBeVisible();
    });
 }
 export async function ignoreExtension(page: Page) {
    await page.waitForLoadState('domcontentloaded');
    try {
        await page.getByRole('button', { name: 'Add it later' }).click({timeout: 5_000});
        await page.getByRole('link', { name: 'Skip to web app' }).click();
    } catch (error) {
        console.log('Extension setup not visible. Continuing');
    }
 }
@@ -8,14 +8,14 @@
    "author": "",
    "license": "ISC",
    "devDependencies": {
-        "@playwright/test": "1.60.0",
+        "@playwright/test": "1.56.1",
-        "dotenv": "17.4.2",
+        "dotenv": "17.2.3",
-        "dotenv-expand": "13.0.0",
+        "dotenv-expand": "12.0.3",
-        "maildev": "npm:@timshel_npm/maildev@3.2.19"
+        "maildev": "npm:@timshel_npm/maildev@3.2.5"
    },
    "dependencies": {
-        "mysql2": "3.22.3",
+        "mysql2": "3.15.3",
-        "otpauth": "9.5.1",
+        "otpauth": "9.4.1",
-        "pg": "8.21.0"
+        "pg": "8.16.3"
    }
 }
@@ -25,12 +25,10 @@ export default defineConfig({
    /* Long global timeout for complex tests
     * But short action/nav/expect timeouts to fail on specific step (raise locally if not enough).
     */
-    timeout: 240 * 1000,
+    timeout: 120 * 1000,
-    actionTimeout: 40 * 1000,
+    actionTimeout: 20 * 1000,
-    navigationTimeout: 40 * 1000,
+    navigationTimeout: 20 * 1000,
-    expect: { timeout: 40 * 1000 },
+    expect: { timeout: 20 * 1000 },
    "permissions": ["clipboard-read"],
    /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
    use: {
@@ -39,10 +37,6 @@ export default defineConfig({
        browserName: 'firefox',
        locale: 'en-GB',
        timezoneId: 'Europe/London',
        ignoreHTTPSErrors: true,
        launchOptions: {
            args: ['--ignore-certificate-errors']
        },
        /* Always collect trace (other values add random test failures) See https://playwright.dev/docs/trace-viewer */
        trace: 'on',
@@ -10,7 +10,7 @@ DOCKER_BUILDKIT=1
 #####################
 # Playwright Config #
 #####################
-PW_KEEP_SERVICE_RUNNING=${PW_KEEP_SERVICE_RUNNING:-false}
+PW_KEEP_SERVICE_RUNNNING=${PW_KEEP_SERVICE_RUNNNING:-false}
 PW_SMTP_FROM=vaultwarden@playwright.test
 #####################
@@ -38,8 +38,8 @@ TEST_USER3_MAIL=${TEST_USER3}@example.com
 ###################
 # Keycloak Config #
 ###################
-KC_BOOTSTRAP_ADMIN_USERNAME=admin
+KEYCLOAK_ADMIN=admin
-KC_BOOTSTRAP_ADMIN_PASSWORD=${KC_BOOTSTRAP_ADMIN_USERNAME}
+KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
 KC_HTTP_HOST=127.0.0.1
 KC_HTTP_PORT=8081
@@ -52,12 +52,10 @@ DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
 # Vaultwarden Config #
 ######################
 ROCKET_PORT=8003
-ROCKET_TLS={certs="/data/ssl/localhost.crt",key="/data/ssl/localhost.key"}
+DOMAIN=http://localhost:${ROCKET_PORT}
 DOMAIN=https://127.0.0.1:${ROCKET_PORT}
 LOG_LEVEL=info,oidcwarden::sso=debug
 LOGIN_RATELIMIT_MAX_BURST=100
 ADMIN_TOKEN=admin
 CLIENT_SUPPRESS_ONBOARDING=true
 SMTP_SECURITY=off
 SMTP_PORT=${MAILDEV_SMTP_PORT}
@@ -1,8 +1,6 @@
 import { test, expect, type TestInfo } from '@playwright/test';
 import * as utils from "../global-utils";
 import * as orgs from './setups/orgs';
 import { createAccount } from './setups/user';
 let users = utils.loadEnv();
@@ -18,12 +16,20 @@ test.afterAll('Teardown', async ({}) => {
 test('Create', async ({ page }) => {
    await createAccount(test, page, users.user1);
-    await orgs.create(test, page, 'New organisation');
+    await test.step('Create Org', async () => {
        await page.getByRole('link', { name: 'New organisation' }).click();
        await page.getByLabel('Organisation name (required)').fill('Test');
        await page.getByRole('button', { name: 'Submit' }).click();
        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
        await utils.checkNotification(page, 'Organisation created');
    });
    await test.step('Create Collection', async () => {
-        await page.getByRole('button', { name: 'New', exact: true }).click();
+        await page.getByRole('link', { name: 'Collections' }).click();
        await page.getByRole('button', { name: 'New' }).click();
        await page.getByRole('menuitem', { name: 'Collection' }).click();
-        await page.getByRole('textbox', { name: 'Name * (required)', exact: true }).fill('RandomCollec');
+        await page.getByLabel('Name (required)').fill('RandomCollec');
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Created collection RandomCollec');
        await expect(page.getByRole('button', { name: 'RandomCollec' })).toBeVisible();
@@ -1,56 +0,0 @@
 import { test, expect, type Page, type TestInfo } from '@playwright/test';
 import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
 import { activateTOTP, disableTOTP } from './setups/2fa';
 let users = utils.loadEnv();
 let totp;
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {});
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
 });
 test('Change Key settings', async ({ page }) => {
    await createAccount(test, page, users.user1);
    await test.step('Change SHA-256 Iterations', async () => {
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Keys' }).click();
        await page.getByRole('spinbutton', { name: 'KDF iterations * (required)'}).fill('700000');
        await page.getByRole('button', { name: 'Update encryption settings' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Update settings' }).click();
        await page.getByRole('heading', { name: 'Log in' }).click();
    });
    await logUser(test, page, users.user1);
    await test.step('Switch to Argon2', async () => {
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Keys' }).click();
        await page.locator('.ng-arrow-wrapper').click();
        await page.getByText('Argon2id').click();
        await page.getByRole('spinbutton', { name: 'KDF memory (MB) * (required)'}).fill('16');
        await page.getByRole('spinbutton', { name: 'KDF iterations * (required)'}).fill('2');
        await page.getByRole('spinbutton', { name: 'KDF parallelism * (required)'}).fill('1');
        await page.getByRole('button', { name: 'Update encryption settings' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Update settings' }).click();
        await page.getByRole('heading', { name: 'Log in' }).click();
    });
    await logUser(test, page, users.user1);
 });
@@ -41,10 +41,13 @@ test('Account creation', async ({ page }) => {
 test('Login', async ({ context, page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
-    await logUser(test, page, users.user1, { mailBuffer });
+    await logUser(test, page, users.user1, mailBuffer);
    await test.step('verify email', async () => {
-        await page.getByRole('button', { name: "Send email" }).click();
+        await page.getByText('Verify your account\'s email').click();
        await expect(page.getByText('Verify your account\'s email')).toBeVisible();
        await page.getByRole('button', { name: 'Send email' }).click();
        await utils.checkNotification(page, 'Check your email inbox for a verification link');
        const verify = await mailBuffer.expect((m) => m.subject === "Verify Your Email");
@@ -75,10 +78,26 @@ test('Activate 2fa', async ({ page }) => {
 test('2fa', async ({ page }) => {
    const emails = mailserver.buffer(users.user1.email);
-    await logUser(test, page, users.user1, {
+    await test.step('login', async () => {
-        mailBuffer: emails,
+        await page.goto('/');
-        mail2fa: true,
+
-    });
+        await page.getByLabel(/Email address/).fill(users.user1.email);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByLabel('Master password').fill(users.user1.password);
        await page.getByRole('button', { name: 'Log in with master password' }).click();
        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
        const code = await retrieveEmailCode(test, page, emails);
        await page.getByLabel(/Verification code/).fill(code);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Add it later' }).click();
        await page.getByRole('link', { name: 'Skip to web app' }).click();
        await expect(page).toHaveTitle(/Vaults/);
    })
    await disableEmail(test, page, users.user1);
    emails.close();
 });
@@ -37,8 +37,8 @@ test('Authenticator 2fa', async ({ page }) => {
        await page.getByLabel(/Email address/).fill(users.user1.email);
        await page.getByRole('button', { name: 'Continue' }).click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
+        await page.getByLabel('Master password').fill(users.user1.password);
-        await page.getByRole('button', { name: 'Log in', exact: true }).click();
+        await page.getByRole('button', { name: 'Log in with master password' }).click();
        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
@@ -4,7 +4,6 @@ import { MailDev } from 'maildev';
 import * as utils from '../global-utils';
 import * as orgs from './setups/orgs';
 import { createAccount, logUser } from './setups/user';
 import { activateTOTP } from './setups/2fa';
 let users = utils.loadEnv();
@@ -21,7 +20,6 @@ test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
        EMAIL_2FA_AUTO_FALLBACK: "true",
    });
    mail1Buffer = mailServer.buffer(users.user1.email);
@@ -47,7 +45,7 @@ test('Invite users', async ({ page }) => {
        await orgs.policies(test, page, 'Test');
        await page.getByRole('button', { name: 'Account recovery' }).click();
        await page.getByRole('checkbox', { name: 'Turn on' }).check();
-        await page.getByRole('checkbox', { name: 'Automatically enroll new' }).check();
+        await page.getByRole('checkbox', { name: 'Require new members' }).check();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Edited policy Account recovery');
    });
@@ -68,16 +66,18 @@ test('invited with new account', async ({ page }) => {
        await page.goto(link);
        await expect(page).toHaveTitle(/Create account | Vaultwarden Web/);
-        // await page.getByLabel('Name').fill(users.user2.name);
+        //await page.getByLabel('Name').fill(users.user2.name);
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
+        await page.getByLabel('Confirm master password (').fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Your new account has been created');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
        // Redirected to the vault
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
        // await utils.checkNotification(page, 'You have been logged in!');
        await utils.checkNotification(page, 'Successfully accepted your invitation');
    });
    await test.step('Check mails', async () => {
@@ -100,19 +100,21 @@ test('invited with existing account', async ({ page }) => {
    await page.getByRole('button', { name: 'Continue' }).click();
    // Unlock page
-    await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user3.password);
+    await page.getByLabel('Master password').fill(users.user3.password);
-    await page.getByRole('button', { name: 'Log in', exact: true }).click();
+    await page.getByRole('button', { name: 'Log in with master password' }).click();
    await utils.checkNotification(page, 'Invitation accepted');
    await utils.ignoreExtension(page);
    // We are now in the default vault page
    await expect(page).toHaveTitle(/Vaultwarden Web/);
    await utils.checkNotification(page, 'Successfully accepted your invitation');
    await mail3Buffer.expect((m) => m.subject === 'New Device Logged In From Firefox');
    await mail1Buffer.expect((m) => m.subject.includes('Invitation to Test accepted'));
 });
 test('Confirm invited user', async ({ page }) => {
-    await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
+    await logUser(test, page, users.user1, mail1Buffer);
    await orgs.members(test, page, 'Test');
    await orgs.confirm(test, page, 'Test', users.user2.email);
@@ -121,26 +123,25 @@ test('Confirm invited user', async ({ page }) => {
 });
 test('Organization is visible', async ({ page }) => {
-    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
+    await logUser(test, page, users.user2, mail2Buffer);
    await page.getByRole('button', { name: 'vault: Test', exact: true }).click();
    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
 });
 test('Recover user password', async ({ page }) => {
-    await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
+    await logUser(test, page, users.user1, mail1Buffer);
    let newPassword = "TotoNewPassword";
    await orgs.members(test, page, 'Test');
-    await test.step(`Recover ${users.user2.email}`, async () => {
+    await test.step(`Rrcover ${users.user2.email}`, async () => {
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
        await page.getByRole('row').filter({hasText: users.user2.email}).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Recover account' }).click();
-        await page.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
+        await page.getByRole('textbox', { name: 'New master password (required)', exact: true }).fill(newPassword);
-        await page.getByRole('textbox', { name: 'Confirm new master password * (' }).fill(newPassword);
+        await page.getByRole('textbox', { name: 'Confirm new master password (' }).fill(newPassword);
-        await page.getByRole('button', { name: 'Save' }).click();
+         await page.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page, 'Account recovery success');
+        await utils.checkNotification(page, 'Password reset success');
        await mail2Buffer.expect((m) => m.subject.includes('Master Password Has Been Changed'));
    });
    let user2 = {
@@ -148,8 +149,5 @@ test('Recover user password', async ({ page }) => {
        name: users.user2.name,
        password: newPassword,
    };
-    await logUser(test, page, user2, {
+    await logUser(test, page, user2, mail2Buffer);
        mailBuffer: mail2Buffer,
        notNewDevice: true,
    });
 });
@@ -1,110 +0,0 @@
 import { test, expect, type Page, type TestInfo } from '@playwright/test';
 import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
 let users = utils.loadEnv();
 let totp;
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {});
    const context = await browser.newContext();
    const page = await context.newPage();
    await createAccount(test, page, users.user1);
    await context.close();
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
 });
 test('Password', async ({ context, page }, testInfo: TestInfo) => {
    const label = 'Test Password';
    await logUser(test, page, users.user1);
    await test.step('Create password entry', async () => {
        await page.getByRole('button', { name: 'New item' }).click();
        await page.getByRole('textbox', { name: 'Item name * (required)' }).fill(label);
        await page.getByRole('textbox', { name: 'Username' }).fill(users.user1.name);
        await page.getByRole('textbox', { name: 'Password' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Item added');
        await page.getByRole('button', { name: 'Close' }).click();
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Check', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByRole('button', { name: label }).click();
        await page.getByTestId('copy-username').click();
        await utils.checkNotification(page, 'Username copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(users.user1.name)
        await page.getByTestId('copy-password').click();
        await utils.checkNotification(page, 'Password copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(users.user1.password)
        await page.getByRole('button', { name: 'Close' }).click();
    });
    await test.step('Delete', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Delete' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
        await utils.checkNotification(page, 'Item sent to bin');
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Deleted', async () => {
        await expect(page.getByRole('row').filter({ hasText: label })).toHaveCount(0)
    });
 });
 test('SSH Key', async ({ context, page }, testInfo: TestInfo) => {
    const label = 'Test SSH key';
    await logUser(test, page, users.user1);
    const privateKey = await test.step('Create key entry', async () => {
        await page.getByRole('button', { name: 'New', exact: true }).click();
        await page.getByRole('menuitem', { name: 'SSH key' }).click();
        await page.getByRole('textbox', { name: 'Item name * (required)' }).fill('Test SSH key');
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Item added');
        await page.getByRole('button', { name: 'Copy private key' }).click();
        await utils.checkNotification(page, 'Private key copied');
        return await page.evaluate(() => navigator.clipboard.readText());
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Check', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByRole('button', { name: label }).click();
        await page.getByRole('button', { name: 'Copy private key' }).click();
        await utils.checkNotification(page, 'Private key copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(privateKey)
        await page.getByRole('button', { name: 'Close' }).click();
    });
    await test.step('Delete', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Delete' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
        await utils.checkNotification(page, 'Item sent to bin');
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Deleted', async () => {
        await expect(page.getByRole('row').filter({ hasText: label })).toHaveCount(0)
    })
 });
@@ -21,11 +21,11 @@ test('Send', async ({ browser, page }) => {
        await page.getByRole('link', { name: 'Send' }).click();
        await expect(page.locator('#main-content').getByText('Send', { exact: true })).toBeVisible();
-        await page.getByRole('button', { name: 'New Send', exact: true }).click();
+        await page.getByRole('button', { name: 'New', exact: true }).click();
        await page.getByRole('menuitem', { name: 'Text' }).click();
-        await page.getByRole('textbox', { name: 'Send name * (required)' }).fill('Test');
+        await page.getByRole('textbox', { name: 'Send name (required)' }).fill('Test');
-        await page.getByRole('textbox', { name: 'Text to share * (required)' }).fill('test');
+        await page.getByRole('textbox', { name: 'Text to share (required)' }).fill('test');
        await page.getByRole('button', { name: 'Save' }).click();
        await page.locator('footer').getByRole('button', { name: 'Copy link' }).click();
@@ -46,14 +46,14 @@ test('Send', async ({ browser, page }) => {
        await page.getByRole('link', { name: 'Send' }).click();
        await expect(page.locator('#main-content').getByText('Send', { exact: true })).toBeVisible();
-        await page.getByRole('button', { name: 'New' }).click();
+        await page.getByRole('button', { name: 'New', exact: true }).click();
        await page.getByRole('menuitem', { name: 'Text' }).click();
-        await page.getByRole('textbox', { name: 'Send name * (required)' }).fill('Password');
+        await page.getByRole('textbox', { name: 'Send name (required)' }).fill('Password');
-        await page.getByRole('textbox', { name: 'Text to share * (required)' }).fill('password');
+        await page.getByRole('textbox', { name: 'Text to share (required)' }).fill('password');
        await page.getByRole('combobox', { name: 'Who can view' }).click();
        await page.getByText('Anyone with a password set by you').click();
-        await page.getByRole('textbox', { name: 'Password * (required)', exact: true }).fill('password');
+        await page.getByRole('textbox', { name: 'Password (required)' }).fill('password');
        await page.getByRole('button', { name: 'Save' }).click();
        await page.locator('footer').getByRole('button', { name: 'Copy link' }).click();
@@ -64,7 +64,7 @@ test('Send', async ({ browser, page }) => {
    await test.step('View with password', async () => {
        await page2.goto(pwd_url, { waitUntil: 'domcontentloaded' });
        await expect(page2.getByRole('heading', { name: 'Enter the password to view' })).toBeVisible();
-        await page2.getByRole('textbox', { name: 'Password * (required)' }).fill('password');
+        await page2.getByRole('textbox', { name: 'Password (required)' }).fill('password');
        await page2.getByRole('button', { name: 'Continue' }).click();
        await expect(page2.getByRole('heading', { name: 'View Send' })).toBeVisible();
        await expect(await page2.getByRole('paragraph').filter({ hasText: 'Password' })).toBeVisible();
@@ -11,11 +11,10 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
-        const secret = await page.getByLabel('Key', { exact: true }).innerText();
+        const secret = await page.getByLabel('Key').innerText();
        let totp = new OTPAuth.TOTP({ secret, period: 30 });
        await page.getByLabel(/Verification code/).fill(totp.generate());
@@ -34,8 +33,8 @@ export async function disableTOTP(test: Test, page: Page, user: { password: stri
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).click()
+        await page.getByLabel('Master password (required)').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Turn off' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
@@ -50,7 +49,7 @@ export async function activateEmail(test: Test, page: Page, user: { name: string
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: 'Enter a code sent to your email' }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Send email' }).click();
    });
@@ -82,8 +81,8 @@ export async function disableEmail(test: Test, page: Page, user: { password: str
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: 'Email' }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).click()
+        await page.getByLabel('Master password (required)').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Turn off' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
@@ -1,21 +0,0 @@
 import { expect, type Browser, Page } from '@playwright/test';
 import * as utils from '../../global-utils';
 utils.loadEnv();
 export async function login(test, page: Page) {
    await test.step(`Admin login`, async () => {
        await page.goto('/admin');
        await page.getByRole('textbox', { name: 'Enter admin token' }).fill(process.env.ADMIN_TOKEN);
        await page.getByRole('button', { name: 'Enter' }).click();
    });
 }
 export async function invite(test, page: Page, email: string) {
    await test.step(`Invite user with ${email}`, async () => {
        await page.getByRole('link', { name: 'Users' }).click();
        await page.getByRole('textbox', { name: 'Enter email' }).fill(email);
        await page.getByRole('button', { name: 'Invite' }).click();
        await expect(page.getByRole('row', { name: email })).toHaveText(/Invited/);
    });
 }
@@ -5,7 +5,7 @@ const utils = require('../../global-utils');
 utils.loadEnv();
 test('DB teardown ?', async ({ serviceName }) => {
-    if( process.env.PW_KEEP_SERVICE_RUNNING !== "true" ) {
+    if( process.env.PW_KEEP_SERVICE_RUNNNING !== "true" ) {
        utils.stopComposeService(serviceName);
    }
 });
@@ -3,14 +3,11 @@ import { expect, type Browser,Page } from '@playwright/test';
 import * as utils from '../../global-utils';
 export async function create(test, page: Page, name: string) {
-    await test.step(`Create Org ${name}`, async () => {
+    await test.step('Create Org', async () => {
-        let pm_locator = page.locator('a').filter({ hasText: 'Password Manager' });
+        await page.locator('a').filter({ hasText: 'Password Manager' }).first().click();
        if( await pm_locator.count() > 0 ){
            pm_locator.first().click();
        }
        await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        await page.getByRole('link', { name: 'New organisation' }).click();
-        await page.getByRole('textbox', { name: 'Organisation name * (required)', exact: true }).fill(name);
+        await page.getByLabel('Organisation name (required)').fill(name);
        await page.getByRole('button', { name: 'Submit' }).click();
        await utils.checkNotification(page, 'Organisation created');
@@ -21,7 +18,7 @@ export async function policies(test, page: Page, name: string) {
    await test.step(`Navigate to ${name} policies`, async () => {
        await page.locator('a').filter({ hasText: 'Admin Console' }).first().click();
        await page.locator('org-switcher').getByLabel(/Toggle collapse/).click();
-        await page.locator('org-switcher > bit-nav-group > div > bit-nav-item').filter({ hasText: `${name}` }).first().click();
+        await page.locator('org-switcher').getByRole('link', { name: `${name}` }).first().click();
        await expect(page.getByRole('heading', { name: `${name} collections` })).toBeVisible();
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Policies' }).click();
@@ -33,11 +30,11 @@ export async function members(test, page: Page, name: string) {
    await test.step(`Navigate to ${name} members`, async () => {
        await page.locator('a').filter({ hasText: 'Admin Console' }).first().click();
        await page.locator('org-switcher').getByLabel(/Toggle collapse/).click();
-        await page.locator('org-switcher > bit-nav-group > div > bit-nav-item').filter({ hasText: `${name}` }).first().click();
+        await page.locator('org-switcher').getByRole('link', { name: `${name}` }).first().click();
        await expect(page.getByRole('heading', { name: `${name} collections` })).toBeVisible();
-        await page.getByRole('link', { name: 'Members' }).click();
+        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
-        await expect(page.getByRole('columnheader', { name: 'Select all' })).toBeVisible();
+        await expect(page.getByRole('cell', { name: 'All' })).toBeVisible();
    });
 }
@@ -45,13 +42,13 @@ export async function invite(test, page: Page, name: string, email: string) {
    await test.step(`Invite ${email}`, async () => {
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
        await page.getByRole('button', { name: 'Invite member' }).click();
-        await page.getByRole('textbox', { name: 'Email * (required)', exact: true }).fill(email);
+        await page.getByLabel('Email (required)').fill(email);
        await page.getByRole('tab', { name: 'Collections' }).click();
        await page.getByRole('combobox', { name: 'Permission' }).click();
        await page.getByText('Edit items', { exact: true }).click();
-        await page.getByRole('combobox', { name: 'Select collections' }).click();
+        await page.getByLabel('Select collections').click();
-        await page.getByLabel('Options List').getByText('Default collection').click();
+        await page.getByText('Default collection').click();
-        await page.getByRole('columnheader', { name: 'Collection', exact: true }).click();
+        await page.getByRole('cell', { name: 'Collection', exact: true }).click();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'User(s) invited');
    });
@@ -6,7 +6,7 @@ const utils = require('../../global-utils');
 utils.loadEnv();
 test('Keycloak teardown', async () => {
-    if( process.env.PW_KEEP_SERVICE_RUNNING === "true" ) {
+    if( process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
        console.log("Keep Keycloak running");
    } else {
        console.log("Keycloak stopping");
@@ -15,8 +15,11 @@ export async function logNewUser(
    options: { mailBuffer?: MailBuffer } = {}
 ) {
    await test.step(`Create user ${user.name}`, async () => {
        await page.context().clearCookies();
        await test.step('Landing page', async () => {
            await utils.cleanLanding(page);
            await page.locator("input[type=email].vw-email-sso").fill(user.email);
            await page.getByRole('button', { name: /Use single sign-on/ }).click();
        });
@@ -30,24 +33,26 @@ export async function logNewUser(
        await test.step('Create Vault account', async () => {
            await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-            await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+            await page.getByLabel('Master password (required)', { exact: true }).fill(user.password);
-            await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(user.password);
+            await page.getByLabel('Confirm master password (').fill(user.password);
            await page.getByRole('button', { name: 'Create account' }).click();
        });
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
        await test.step('Default vault page', async () => {
            await expect(page).toHaveTitle(/Vaultwarden Web/);
            await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        });
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        if( options.mailBuffer ){
            let mailBuffer = options.mailBuffer;
            await test.step('Check emails', async () => {
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
                await mailBuffer.expect((m) => m.subject === "Welcome");
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
            });
        }
    });
@@ -64,14 +69,16 @@ export async function logUser(
        mailBuffer ?: MailBuffer,
        totp?: OTPAuth.TOTP,
        mail2fa?: boolean,
        notNewDevice?: boolean,
    } = {}
 ) {
    let mailBuffer = options.mailBuffer;
    await test.step(`Log user ${user.email}`, async () => {
        await page.context().clearCookies();
        await test.step('Landing page', async () => {
            await utils.cleanLanding(page);
            await page.locator("input[type=email].vw-email-sso").fill(user.email);
            await page.getByRole('button', { name: /Use single sign-on/ }).click();
        });
@@ -110,12 +117,14 @@ export async function logUser(
            await page.getByRole('button', { name: 'Unlock' }).click();
        });
        await utils.ignoreExtension(page);
        await test.step('Default vault page', async () => {
            await expect(page).toHaveTitle(/Vaultwarden Web/);
            await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        });
-        if( mailBuffer && !options.notNewDevice ){
+        if( mailBuffer ){
            await test.step('Check email', async () => {
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
            });
@@ -3,7 +3,6 @@ import { expect, type Browser, Page } from '@playwright/test';
 import { type MailBuffer } from 'maildev';
 import * as utils from '../../global-utils';
 import { retrieveEmailCode } from './2fa';
 export async function createAccount(test, page: Page, user: { email: string, name: string, password: string }, mailBuffer?: MailBuffer) {
    await test.step(`Create user ${user.name}`, async () => {
@@ -18,11 +17,12 @@ export async function createAccount(test, page: Page, user: { email: string, nam
        await page.getByRole('button', { name: 'Continue' }).click();
        // Vault finish Creation
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(user.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(user.password);
+        await page.getByLabel('Confirm master password (').fill(user.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Your new account has been created')
        await utils.ignoreExtension(page);
        // We are now in the default vault page
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
@@ -35,16 +35,7 @@ export async function createAccount(test, page: Page, user: { email: string, nam
    });
 }
-export async function logUser(
+export async function logUser(test, page: Page, user: { email: string, password: string }, mailBuffer?: MailBuffer) {
    test,
    page: Page,
    user: { email: string, password: string },
    options: {
        mailBuffer ?: MailBuffer,
        mail2fa?: boolean,
        notNewDevice?: boolean,
    } = {}
 ) {
    await test.step(`Log user ${user.email}`, async () => {
        await utils.cleanLanding(page);
@@ -52,23 +43,16 @@ export async function logUser(
        await page.getByRole('button', { name: 'Continue' }).click();
        // Unlock page
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password').fill(user.password);
-        await page.getByRole('button', { name: 'Log in', exact: true }).click();
+        await page.getByRole('button', { name: 'Log in with master password' }).click();
-        if( options.mail2fa ){
+        await utils.ignoreExtension(page);
            await test.step('2FA check', async () => {
                await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
                let code = await retrieveEmailCode(test, page, options.mailBuffer);
                await page.getByLabel(/Verification code/).fill(code);
                await page.getByRole('button', { name: 'Continue' }).click();
            });
        }
        // We are now in the default vault page
        await expect(page).toHaveTitle(/Vaultwarden Web/);
-        if( options.mailBuffer && !options.notNewDevice ){
+        if( mailBuffer ){
-            await options.mailBuffer.expect((m) => m.subject === "New Device Logged In From Firefox");
+            await mailBuffer.expect((m) => m.subject === "New Device Logged In From Firefox");
        }
    });
 }
@@ -1,7 +1,6 @@
 import { test, expect, type TestInfo } from '@playwright/test';
 import { MailDev } from 'maildev';
 import * as admin from "./setups/admin";
 import { logNewUser, logUser } from './setups/sso';
 import { activateEmail, disableEmail } from './setups/2fa';
 import * as utils from "../global-utils";
@@ -20,7 +19,7 @@ test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {
        SSO_ENABLED: true,
-        SSO_ONLY: true,
+        SSO_ONLY: false,
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
    });
@@ -33,64 +32,22 @@ test.afterAll('Teardown', async ({}) => {
    }
 });
-test('2FA email', async ({ page }) => {
+test('Create and activate 2FA', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
    await logNewUser(test, page, users.user1, {mailBuffer: mailBuffer});
    await activateEmail(test, page, users.user1, mailBuffer);
-    await logUser(test, page, users.user1, {mailBuffer: mailBuffer, mail2fa: true, notNewDevice: true});
+    mailBuffer.close();
 });
 test('Log and disable', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
    await logUser(test, page, users.user1, {mailBuffer: mailBuffer, mail2fa: true});
    await disableEmail(test, page, users.user1);
    mailBuffer.close();
 });
 test('Admin invite', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user2.email);
    await admin.login(test, page);
    await admin.invite(test, page, users.user2.email);
    const link = await test.step('Extract email link', async () => {
        const invited = await mailBuffer.expect((m) => m.subject === "Join Vaultwarden");
        await page.setContent(invited.html);
        return await page.getByTestId("invite").getAttribute("href");
    });
    await test.step('Redirect to Keycloak', async () => {
        await page.goto(link);
    });
    await test.step('Keycloak login', async () => {
        await expect(page.getByRole('heading', { name: 'Sign in to your account' })).toBeVisible();
        await page.getByLabel(/Username/).fill(users.user2.name);
        await page.getByLabel('Password', { exact: true }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Sign In' }).click();
    });
    await test.step('Create Vault account', async () => {
        await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
    });
    await test.step('Check mails', async () => {
        await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
        await mailBuffer.expect((m) => m.subject === "Welcome");
    });
    mailBuffer.close();
 });
@@ -33,8 +33,8 @@ test('Non SSO login', async ({ page }) => {
    await page.getByRole('button', { name: 'Other' }).click();
    // Unlock page
-    await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
+    await page.getByLabel('Master password').fill(users.user1.password);
-    await page.getByRole('button', { name: 'Log in', exact: true }).click();
+    await page.getByRole('button', { name: 'Log in with master password' }).click();
    // We are now in the default vault page
    await expect(page).toHaveTitle(/Vaultwarden Web/);
@@ -58,7 +58,6 @@ test('Non SSO login impossible', async ({ page, browser }, testInfo: TestInfo) =
    // Landing page
    await page.goto('/');
    await page.locator("input[type=email].vw-email-sso").fill(users.user1.email);
    // Check that SSO login is available
    await expect(page.getByRole('button', { name: /Use single sign-on/ })).toHaveCount(1);
@@ -67,6 +66,7 @@ test('Non SSO login impossible', async ({ page, browser }, testInfo: TestInfo) =
    await expect(page.getByRole('button', { name: 'Other' })).toHaveCount(0);
 });
 test('No SSO login', async ({ page }, testInfo: TestInfo) => {
    await utils.restartVault(page, testInfo, {
        SSO_ENABLED: false
@@ -74,14 +74,12 @@ test('No SSO login', async ({ page }, testInfo: TestInfo) => {
    // Landing page
    await page.goto('/');
    await page.getByLabel(/Email address/).fill(users.user1.email);
    // No SSO button (rely on a correct selector checked in previous test)
    await page.getByLabel('Master password');
    await expect(page.getByRole('button', { name: /Use single sign-on/ })).toHaveCount(0);
    // Can continue to Master password
    await page.getByLabel(/Email address/).fill(users.user1.email);
    await page.getByRole('button', { name: 'Continue' }).click();
-    await expect(page.getByRole('button', { name: 'Log in' })).toHaveCount(1);
+    await expect(page.getByRole('button', { name: 'Log in with master password' })).toHaveCount(1);
 });
@@ -67,16 +67,17 @@ test('invited with new account', async ({ page }) => {
    await test.step('Create Vault account', async () => {
        await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
+        await page.getByLabel('Confirm master password (').fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle(/Vaultwarden Web/);
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
    });
    await test.step('Check mails', async () => {
@@ -94,7 +95,6 @@ test('invited with existing account', async ({ page }) => {
    await test.step('Redirect to Keycloak', async () => {
        await page.goto(link);
        await page.getByRole('button', { name: /Use single sign-on/ }).click();
    });
    await test.step('Keycloak login', async () => {
@@ -108,11 +108,13 @@ test('invited with existing account', async ({ page }) => {
        await expect(page).toHaveTitle('Vaultwarden Web');
        await page.getByLabel('Master password').fill(users.user3.password);
        await page.getByRole('button', { name: 'Unlock' }).click();
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle(/Vaultwarden Web/);
        await utils.checkNotification(page, 'Successfully accepted your invitation');
    });
    await test.step('Check mails', async () => {
@@ -49,7 +49,7 @@ test('Organization is visible', async ({ page }) => {
    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
 });
-test('Activate password policy', async ({ page }) => {
+test('Enforce password policy', async ({ page }) => {
    await logUser(test, page, users.user1);
    await orgs.policies(test, page, '/Test');
@@ -61,27 +61,16 @@ test('Activate password policy', async ({ page }) => {
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Edited policy Master password requirements.');
    });
 });
-test('Unlock trigger policyy', async ({ page }) => {
+    await utils.logout(test, page, users.user1);
    await page.goto('/', { waitUntil: 'domcontentloaded' });
-    await page.locator("input[type=email].vw-email-sso").fill(users.user2.email);
+    await test.step(`Unlock trigger policy`, async () => {
-    await page.getByRole('button', { name: /Use single sign-on/ }).click();
+        await page.locator("input[type=email].vw-email-sso").fill(users.user1.email);
        await page.getByRole('button', { name: 'Use single sign-on' }).click();
-    await test.step('Keycloak login', async () => {
+        await page.getByRole('textbox', { name: 'Master password (required)' }).fill(users.user1.password);
        await expect(page.getByRole('heading', { name: 'Sign in to your account' })).toBeVisible();
        await page.getByLabel(/Username/).fill(users.user2.name);
        await page.getByLabel('Password', { exact: true }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Sign In' }).click();
    });
    await test.step('Unlock vault', async () => {
        await expect(page).toHaveTitle('Vaultwarden Web');
        await expect(page.getByRole('heading', { name: 'Your vault is locked' })).toBeVisible();
        await page.getByLabel('Master password').fill(users.user2.password);
        await page.getByRole('button', { name: 'Unlock' }).click();
    });
-    await expect(page.getByRole('heading', { name: 'Update master password' })).toBeVisible();
+        await expect(page.getByRole('heading', { name: 'Update master password' })).toBeVisible();
    });
 });
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.97.1"
+channel = "1.96.1"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
@@ -716,36 +716,6 @@ fn web_vault_compare(active: &str, latest: &str) -> i8 {
    }
 }
 fn check_template_overrides() -> Vec<&'static str> {
    let template_folder = std::path::PathBuf::from(CONFIG.templates_folder());
    let mut overrides = Vec::new();
    for folder in ["admin", "email", "scss"] {
        if folder_has_hbs_files(&template_folder.join(folder)) {
            overrides.push(folder);
        }
    }
    if folder_has_hbs_files(&template_folder) {
        overrides.push("other");
    }
    overrides
 }
 fn folder_has_hbs_files(dir: &std::path::Path) -> bool {
    let Ok(files) = std::fs::read_dir(dir) else {
        // No files in this directory at all, so we can return false
        return false;
    };
    files.flatten().any(|f| {
        // Validate if it is a file and if it has the `.hbs` extension and starts with a-z or 0-9
        f.file_type().is_ok_and(|t| t.is_file())
            && f.path().extension().is_some_and(|e| e.eq_ignore_ascii_case("hbs"))
            && f.file_name().to_str().is_some_and(|n| n.starts_with(|c: char| c.is_ascii_alphanumeric()))
    })
 }
 #[get("/diagnostics")]
 async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> ApiResult<Html<String>> {
    use chrono::prelude::*;
@@ -800,7 +770,6 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
        "db_version": get_sql_server_version(&conn).await,
        "admin_url": format!("{}/diagnostics", admin_url()),
        "overrides": &CONFIG.get_overrides().join(", "),
        "template_overrides": check_template_overrides().join(", "),
        "invalid_feature_flags": invalid_feature_flags,
        "host_arch": env::consts::ARCH,
        "host_os":  env::consts::OS,
@@ -693,6 +693,10 @@ struct UnlockData {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct ChangeKdfData {
    #[allow(dead_code)]
    new_master_password_hash: String,
    #[allow(dead_code)]
    key: String,
    authentication_data: AuthenticationData,
    unlock_data: UnlockData,
    master_password_hash: String,
@@ -1334,13 +1338,6 @@ pub async fn prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
        "kdfIterations": kdf_iter,
        "kdfMemory": kdf_mem,
        "kdfParallelism": kdf_para,
        "kdfSettings": {
            "iterations": kdf_iter,
            "kdfType": kdf_type,
            "memory": kdf_mem,
            "parallelism": kdf_para
        },
        "salt": null,
    }))
 }
@@ -870,7 +870,7 @@ async fn put_collections_admin(
    headers: Headers,
    conn: DbConn,
    nt: Notify<'_>,
-) -> JsonResult {
+) -> EmptyResult {
    post_collections_admin(cipher_id, data, headers, conn, nt).await
 }
@@ -881,7 +881,7 @@ async fn post_collections_admin(
    headers: Headers,
    conn: DbConn,
    nt: Notify<'_>,
-) -> JsonResult {
+) -> EmptyResult {
    let data: CollectionsAdminData = data.into_inner();
    let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else {
@@ -940,7 +940,7 @@ async fn post_collections_admin(
    )
    .await;
-    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::Organization, &conn).await?))
+    Ok(())
 }
 #[derive(Deserialize)]
@@ -228,17 +228,14 @@ fn config() -> Json<Value> {
        // Version history:
        // - Individual cipher key encryption: 2024.2.0
        // - Mobile app support for MasterPasswordUnlockData: 2025.8.0
-        "version": "2026.6.0",
+        "version": "2025.12.0",
        "gitHash": option_env!("GIT_REV"),
        "server": {
          "name": "Vaultwarden",
          "url": "https://github.com/dani-garcia/vaultwarden"
        },
        "settings": {
-            "disableUserRegistration": CONFIG.is_signup_disabled(),
+            "disableUserRegistration": CONFIG.is_signup_disabled()
            // When enabled, this setting signals to clients that onboarding interstitials
            // (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals) should be suppressed
            "suppressOnboardingInterstitials": CONFIG.client_suppress_onboarding(),
        },
        "environment": {
          "vault": domain,
@@ -254,10 +251,6 @@ fn config() -> Json<Value> {
          "vapidPublicKey": null
        },
        "featureStates": feature_states,
        // Not supported right now
        // Used for by clients to learn if the server requires extra work to establish a connection.
        // See: https://github.com/bitwarden/server/pull/6892 | https://github.com/bitwarden/server/commit/52955d1860b4dfb905f67bbe39d9b10bbd61ded0
        "communication": null,
        "object": "config",
    }))
 }
@@ -453,9 +453,6 @@ async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> Json
    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if !send.is_accessible() {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    process_access(send, conn, nt).await
 }
@@ -486,7 +483,17 @@ async fn post_access_legacy(
        err_code!(SEND_INACCESSIBLE_MSG, 404);
    }
-    if !send.is_accessible() {
+    if let Some(expiration) = send.expiration_date
        && Utc::now().naive_utc() >= expiration
    {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if Utc::now().naive_utc() >= send.deletion_date {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.disabled {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
@@ -534,9 +541,6 @@ async fn post_access_file(
    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if !send.is_accessible() {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    process_access_file(send, file_id, host, conn, nt).await
 }
@@ -563,7 +567,17 @@ async fn post_access_file_legacy(
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
-    if !send.is_accessible() {
+    if let Some(expiration) = send.expiration_date
        && Utc::now().naive_utc() >= expiration
    {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if Utc::now().naive_utc() >= send.deletion_date {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.disabled {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
@@ -1,10 +1,6 @@
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
-use yubico_ng::{
+use yubico::{config::Config, verify_async};
    Verifier, YubicoError,
    config::Config,
    transport::{AsyncTransport, Response},
 };
 use crate::{
    CONFIG,
@@ -18,39 +14,12 @@ use crate::{
        models::{EventType, TwoFactor, TwoFactorType},
    },
    error::{Error, MapResult},
    http_client,
 };
 pub fn routes() -> Vec<Route> {
    routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
 }
 struct HttpClientTransport {
    client: reqwest::Client,
 }
 impl HttpClientTransport {
    fn new() -> Result<Self, reqwest::Error> {
        http_client::get_reqwest_client_builder(false).redirect(reqwest::redirect::Policy::none()).build().map(
            |client| Self {
                client,
            },
        )
    }
 }
 impl AsyncTransport for HttpClientTransport {
    type Error = YubicoError;
    async fn yubico_get(&self, url: &str) -> Result<Response, Self::Error> {
        let response = self.client.get(url).send().await.map_err(YubicoError::transport)?;
        Ok(Response {
            status: response.status().as_u16(),
            body: response.text().await.map_err(YubicoError::transport)?,
        })
    }
 }
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EnableYubikeyData {
@@ -75,7 +44,8 @@ pub struct YubikeyMetadata {
 fn parse_yubikeys(data: &EnableYubikeyData) -> Vec<String> {
    let data_keys = [&data.key1, &data.key2, &data.key3, &data.key4, &data.key5];
-    data_keys.into_iter().flatten().filter(|e| !e.is_empty()).cloned().collect()
+
    data_keys.into_iter().flatten().cloned().collect()
 }
 fn jsonify_yubikeys(yubikeys: Vec<String>) -> Value {
@@ -103,15 +73,13 @@ fn get_yubico_credentials() -> Result<(String, String), Error> {
 async fn verify_yubikey_otp(otp: String) -> EmptyResult {
    let (yubico_id, yubico_secret) = get_yubico_credentials()?;
-    let mut config = Config::default().set_client_id(yubico_id).set_key(yubico_secret)?;
+    let config = Config::default().set_client_id(yubico_id).set_key(yubico_secret);
-    if let Some(yubico_server) = CONFIG.yubico_server() {
+
-        config = config.set_api_host(yubico_server);
+    match CONFIG.yubico_server() {
        Some(server) => verify_async(otp, config.set_api_hosts(vec![server])).await,
        None => verify_async(otp, config).await,
    }
-
+    .map_res("Failed to verify OTP")
    let client = HttpClientTransport::new()?;
    let verifier = Verifier::with_client(config, client)?;
    verifier.verify(otp).await.map_res("Failed to verify OTP")
 }
 #[post("/two-factor/get-yubikey", data = "<data>")]
@@ -169,9 +137,10 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
    let yubikeys = parse_yubikeys(&data);
    if yubikeys.is_empty() {
-        // Return an error to prevent saving empty keys which would cause users not being able to login anymore.
+        return Ok(Json(json!({
-        // To remove all keys users should click the `Deactivate all keys` button
+            "enabled": false,
-        err!("A key is required.");
+            "object": "twoFactorU2f",
        })));
    }
    // Ensure they are valid OTPs
@@ -318,7 +318,7 @@ async fn sso_login(
        Some((user, _)) if !user.enabled => {
            err!(
                "This user has been disabled",
-                format!("IP: {}. Username: {}.", ip.ip, user.email),
+                format!("IP: {}. Username: {}.", ip.ip, user.display_name()),
                ErrorEvent {
                    event: EventType::UserFailedLogIn
                }
@@ -577,7 +577,7 @@ async fn authenticated_response(
        result["TwoFactorToken"] = Value::String(token);
    }
-    info!("User {} logged in successfully. IP: {}", user.email, ip.ip);
+    info!("User {} logged in successfully. IP: {}", user.display_name(), ip.ip);
    Ok(Json(result))
 }
@@ -30,7 +30,7 @@ pub use crate::api::{
    },
    web::catchers as web_catchers,
    web::routes as web_routes,
-    web::{invalidate_css_cache, static_files},
+    web::static_files,
 };
 use crate::{
    CONFIG,
@@ -1,7 +1,4 @@
-use std::{
+use std::path::{Path, PathBuf};
    path::{Path, PathBuf},
    sync::{Arc, RwLock},
 };
 use rocket::{
    Catcher, Route,
@@ -16,13 +13,12 @@ use crate::{
    CONFIG,
    api::{ApiResult, EmptyResult, core::now},
    auth::decode_file_download,
    crypto::sha256_hex,
    db::{
        DbConn,
        models::{AttachmentId, CipherId},
    },
    error::Error,
-    util::{Cached, EtagCached},
+    util::Cached,
 };
 pub fn routes() -> Vec<Route> {
@@ -67,27 +63,8 @@ fn not_found() -> ApiResult<Html<String>> {
    Ok(Html(text))
 }
 struct CssCache {
    css: String,
    etag: String,
 }
 static CSS_CACHE: RwLock<Option<Arc<CssCache>>> = RwLock::new(None);
 pub fn invalidate_css_cache() {
    *CSS_CACHE.write().unwrap() = None;
 }
 #[get("/css/vaultwarden.css")]
-fn vaultwarden_css() -> EtagCached<Css<String>> {
+fn vaultwarden_css() -> Cached<Css<String>> {
    // If reload_templates is false, and we already have the CSS Cached, return this
    if !CONFIG.reload_templates()
        && let Some(cached) = CSS_CACHE.read().unwrap().as_ref()
    {
        return EtagCached::new(Css(cached.css.clone()), &cached.etag);
    }
    // Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS
    let css_options = json!({
        "emergency_access_allowed": CONFIG.emergency_access_allowed(),
        "load_user_scss": true,
@@ -135,18 +112,8 @@ fn vaultwarden_css() -> EtagCached<Css<String>> {
        }
    };
-    let etag = sha256_hex(css.as_bytes());
+    // Cache for one day should be enough and not too much
-    let cached = Arc::new(CssCache {
+    Cached::ttl(Css(css), 86_400, false)
        css,
        etag,
    });
    if !CONFIG.reload_templates() {
        *CSS_CACHE.write().unwrap() = Some(Arc::clone(&cached));
    }
    // Etag Caching will let the browser send us an etag to verify and send new content if needed
    EtagCached::new(Css(cached.css.clone()), &cached.etag)
 }
 #[get("/")]
@@ -85,8 +85,18 @@ impl SendTokens {
            return Self::invalid_error(&format!("Send {send_id}, max access reached"), "send_id_invalid", true);
        }
-        if !send.is_accessible() {
+        if let Some(expiration) = send.expiration_date
-            return Self::invalid_error(&format!("Send {send_id}, not accessible"), "send_id_invalid", true);
+            && Utc::now().naive_utc() >= expiration
        {
            return Self::invalid_error(&format!("Send {send_id}, expired"), "send_id_invalid", true);
        }
        if Utc::now().naive_utc() >= send.deletion_date {
            return Self::invalid_error(&format!("Send {send_id}, past deletion"), "send_id_invalid", true);
        }
        if send.disabled {
            return Self::invalid_error(&format!("Send {send_id}, disabled"), "send_id_invalid", true);
        }
        if send.password_hash.is_some() {
@@ -659,11 +659,6 @@ make_config! {
        events_days_retain:     i64,    false,   option;
    },
    client {
        /// Control whether clients onboarding interstitials are suppressed |> post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals
        client_suppress_onboarding:         bool, true,   def,    false;
    },
    /// Advanced settings
    advanced {
        /// Client IP header |> If not present, the remote IP is used.
@@ -1162,8 +1157,11 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
                    }
                    #[cfg(unix)]
-                    if nix::unistd::access(&path, nix::unistd::AccessFlags::X_OK).is_err() {
+                    {
-                        err!(format!("sendmail command at `{path:?}` isn't executable"));
+                        use std::os::unix::fs::PermissionsExt;
                        if !metadata.permissions().mode() & 0o111 != 0 {
                            err!(format!("sendmail command at `{path:?}` isn't executable"));
                        }
                    }
                }
            }
@@ -1503,9 +1501,6 @@ impl Config {
        let operator = storage::operator_for_path(&CONFIG_FILE_PARENT_DIR)?;
        operator.write(&CONFIG_FILENAME, config_str).await?;
        // Invalidate CSS Cache because several config items might have impact on the rendered CSS
        crate::api::invalidate_css_cache();
        Ok(())
    }
@@ -1588,9 +1583,6 @@ impl Config {
            writer._overrides = Vec::new();
        }
        // Invalidate CSS Cache because several config items might have impact on the rendered CSS
        crate::api::invalidate_css_cache();
        Ok(())
    }
@@ -42,15 +42,13 @@ pub struct Cipher {
    pub key: Option<String>,
-    // See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/Vault/Enums/CipherType.cs
+    /*
-    // Login = 1,
+    Login = 1,
-    // SecureNote = 2,
+    SecureNote = 2,
-    // Card = 3,
+    Card = 3,
-    // Identity = 4,
+    Identity = 4,
-    // SSHKey = 5
+    SshKey = 5
-    // BankAccount = 6,
+    */
    // DriversLicense = 7,
    // Passport = 8,
    pub atype: i32,
    pub name: String,
    pub notes: Option<String>,
@@ -308,6 +306,16 @@ impl Cipher {
            type_data_json = Value::Null;
        }
        // Clone the type_data and add some default value.
        let mut data_json = type_data_json.clone();
        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
        // data_json should always contain the following keys with every atype
        data_json["fields"] = json!(fields_json);
        data_json["name"] = json!(self.name);
        data_json["notes"] = json!(self.notes);
        data_json["passwordHistory"] = Value::Array(password_history_json.clone());
        let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
                Cow::from(cipher_collections)
@@ -347,6 +355,8 @@ impl Cipher {
            "notes": self.notes,
            "fields": fields_json,
            "data": data_json,
            "passwordHistory": password_history_json,
            // All Cipher types are included by default as null, but only the matching one will be populated
@@ -355,9 +365,6 @@ impl Cipher {
            "card": null,
            "identity": null,
            "sshKey": null,
            "bankAccount": null,
            "driversLicense": null,
            "passport": null,
        });
        // These values are only needed for user/default syncs
@@ -397,9 +404,6 @@ impl Cipher {
            3 => "card",
            4 => "identity",
            5 => "sshKey",
            6 => "bankAccount",
            7 => "driversLicense",
            8 => "passport",
            _ => err!(format!("Cipher {} has an invalid type {}", self.uuid, self.atype)),
        };
@@ -21,7 +21,6 @@ use super::{
    User, UserId,
 };
 // See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/AdminConsole/Entities/Collection.cs
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
 #[diesel(table_name = collections)]
 #[diesel(treat_none_as_null = true)]
@@ -72,11 +71,6 @@ impl Collection {
            "id": self.uuid,
            "organizationId": self.org_uuid,
            "name": self.name,
            // Collection types are either 0: SharedCollection or 1: DefaultUserCollection, of which we do not yet support DefaultUserCollection.
            // See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/AdminConsole/Enums/CollectionType.cs
            "type": 0,
            // This is only used together with MyItems/DefaultUserCollection, which we do not yet support.
            "defaultUserCollectionEmail": null,
            "object": "collection",
        })
    }
@@ -298,16 +298,12 @@ impl Event {
    ) -> Vec<Self> {
        conn.run(move |conn| {
            event::table
-                .inner_join(
+                .inner_join(users_organizations::table.on(users_organizations::uuid.eq(member_uuid)))
                    users_organizations::table
                        .on(users_organizations::uuid.eq(member_uuid).and(users_organizations::org_uuid.eq(org_uuid))),
                )
                .filter(event::org_uuid.eq(org_uuid))
                .filter(event::event_date.between(start, end))
                .filter(
-                    event::org_user_uuid
+                    event::user_uuid
-                        .eq(member_uuid)
+                        .eq(users_organizations::user_uuid.nullable())
                        .or(event::user_uuid.eq(users_organizations::user_uuid.nullable()))
                        .or(event::act_user_uuid.eq(users_organizations::user_uuid.nullable())),
                )
                .select(event::all_columns)
@@ -91,7 +91,6 @@ impl OrgPolicy {
            "type": self.atype,
            "data": data_json,
            "enabled": self.enabled,
            "revisionDate": null,
            "object": "policy",
        });
@@ -217,18 +217,11 @@ impl Organization {
            "useSecretsManager": false, // Not supported (Not AGPLv3 Licensed)
            "selfHost": true,
            "useApi": true,
            "useDisableSMAdsForUsers": true, // Hide Secrets Manager ads
            "useInviteLinks": false, // Not (yet) supported
            "useMyItems": false, // Not (yet) supported
            "useOrganizationDomains": false, // Not supported (Linked to SSO)
            "usePam": false, // Not supported
            "usePhishingBlocker": false,
            "hasPublicAndPrivateKeys": self.private_key.is_some() && self.public_key.is_some(),
            "useResetPassword": CONFIG.mail_enabled(),
            "allowAdminAccessToAllCollectionItems": true,
            "limitCollectionCreation": true,
            "limitCollectionDeletion": true,
            "limitItemDeletion": false,
            "businessName": self.name,
            "businessAddress1": null,
@@ -502,12 +495,6 @@ impl Membership {
            "useActivateAutofillPolicy": false,
            "useAdminSponsoredFamilies": false,
            "useRiskInsights": false, // Not supported (Not AGPLv3 Licensed)
            "useDisableSMAdsForUsers": true, // Hide Secrets Manager ads
            "useInviteLinks": false, // Not (yet) supported
            "useMyItems": false, // Not (yet) supported
            "useOrganizationDomains": false, // Not supported (Linked to SSO)
            "usePam": false, // Not supported
            "usePhishingBlocker": false,
            "organizationUserId": self.uuid,
            "providerId": null,
@@ -262,22 +262,6 @@ impl Send {
        Ok(true)
    }
    /// Whether the Send is currently within its validity window: not disabled, not past its
    /// expiration date, and not past its deletion date. Does not consider `max_access_count`
    /// (consumed at token issuance) or the password.
    pub fn is_accessible(&self) -> bool {
        let now = Utc::now().naive_utc();
        if self.disabled {
            return false;
        }
        if let Some(expiration) = self.expiration_date
            && now >= expiration
        {
            return false;
        }
        now < self.deletion_date
    }
    pub async fn delete(&self, conn: &DbConn) -> EmptyResult {
        self.update_users_revision(conn).await;
@@ -268,25 +268,8 @@ impl User {
            UserStatus::Enabled
        };
        let account_keys = if self.private_key.is_some() {
            json!({
                "publicKeyEncryptionKeyPair": {
                    "wrappedPrivateKey": self.private_key,
                    "publicKey": self.public_key,
                    "signedPublicKey": null,
                    "object": "publicKeyEncryptionKeyPair",
                },
                "securityState": null,
                "signatureKeyPair": null,
                "object": "privateKeys"
            })
        } else {
            Value::Null
        };
        json!({
            "_status": status as i32,
            "accountKeys": account_keys,
            "id": self.uuid,
            "name": self.name,
            "email": self.email,
@@ -58,7 +58,7 @@ use serde_json::{Error as SerdeErr, Value};
 use std::io::Error as IoErr;
 use std::time::SystemTimeError as TimeErr;
 use webauthn_rs::prelude::WebauthnError as WebauthnErr;
-use yubico_ng::error::YubicoError as YubiErr;
+use yubico::yubicoerror::YubicoError as YubiErr;
 #[derive(Serialize)]
 pub struct Empty {}
@@ -307,18 +307,9 @@ pub async fn send_invite(
        if CONFIG.sso_enabled() && CONFIG.sso_only() {
            query_params.append_pair("orgSsoIdentifier", &org_id);
        }
-
+        if user.private_key.is_some() {
-        // The web vault requires both of these parameters to be present.
+            query_params.append_pair("orgUserHasExistingUser", "true");
-        // If either is missing it rejects the invite client-side, before any
+        }
        // request reaches the server, showing only "Unable to accept invitation".
        query_params.append_pair("initOrganization", "false");
        let org_user_has_existing_user = if user.private_key.is_some() {
            "true"
        } else {
            "false"
        };
        query_params.append_pair("orgUserHasExistingUser", org_user_has_existing_user);
    }
    let Some(query_string) = query.query() else {
@@ -2,7 +2,7 @@
 // The recursion_limit is mainly triggered by the json!() macro.
 // The more key/value pairs there are the more recursion occurs.
 // We want to keep this as low as possible!
-#![recursion_limit = "192"]
+#![recursion_limit = "165"]
 // When enabled use MiMalloc as malloc instead of the default malloc
 #[cfg(feature = "enable_mimalloc")]
@@ -1,5 +1,6 @@
 "use strict";
-/* exported BASE_URL, _post, _delete */
+/* eslint-env es2017, browser */
 /* exported BASE_URL, _post _delete */
 function getBaseUrl() {
    // If the base URL is `https://vaultwarden.example.com/base/path/admin/`,
@@ -1,4 +1,5 @@
 "use strict";
 /* eslint-env es2017, browser */
 /* global BASE_URL:readable, bootstrap:readable */
 var dnsCheck = false;
@@ -79,44 +80,37 @@ async function generateSupportString(event, dj) {
    event.preventDefault();
    event.stopPropagation();
    // Health check Markdown emoji, if something is a failure or not
    const chk = v => v ? "true :white_check_mark:" : "false :x:";
    // Yes/No Markdown emoji, if something is not a failure, but just yes or no
    const yn = v => v ? "yes :heavy_plus_sign:" : "no :heavy_minus_sign:";
    const template_overrides = dj.template_overrides !== "" ? ` (${dj.template_overrides})` : "";
    let supportString = "### Your environment (Generated via diagnostics page)\n\n";
    supportString += `* Vaultwarden version: v${dj.current_release}\n`;
    supportString += `* Web-vault version: v${dj.active_web_release}\n`;
    supportString += `* OS/Arch: ${dj.host_os}/${dj.host_arch}\n`;
-    supportString += `* Running within a container: ${yn(dj.running_within_container)} (Base: ${dj.container_base_image})\n`;
+    supportString += `* Running within a container: ${dj.running_within_container} (Base: ${dj.container_base_image})\n`;
    supportString += `* Database type: ${dj.db_type}\n`;
    supportString += `* Database version: ${dj.db_version}\n`;
-    supportString += `* Uses config.json: ${yn(dj.overrides !== "")}\n`;
+    supportString += `* Uses config.json: ${dj.overrides !== ""}\n`;
-    supportString += `* Uses custom templates: ${yn(dj.template_overrides !== "")}${template_overrides}\n`;
+    supportString += `* Uses a reverse proxy: ${dj.ip_header_exists}\n`;
    supportString += `* Uses a reverse proxy: ${yn(dj.ip_header_exists)}\n`;
    if (dj.ip_header_exists) {
-        supportString += `* IP Header check: ${chk(dj.ip_header_match)} (${dj.ip_header_name})\n`;
+        supportString += `* IP Header check: ${dj.ip_header_match} (${dj.ip_header_name})\n`;
    }
-    supportString += `* Internet access: ${chk(dj.has_http_access)}\n`;
+    supportString += `* Internet access: ${dj.has_http_access}\n`;
-    supportString += `* Internet access via a proxy: ${yn(dj.uses_proxy)}\n`;
+    supportString += `* Internet access via a proxy: ${dj.uses_proxy}\n`;
-    supportString += `* DNS Check: ${chk(dnsCheck)}\n`;
+    supportString += `* DNS Check: ${dnsCheck}\n`;
    if (dj.tz_env !== "") {
        supportString += `* TZ environment: ${dj.tz_env}\n`;
    }
-    supportString += `* Browser/Server Time Check: ${chk(timeCheck)}\n`;
+    supportString += `* Browser/Server Time Check: ${timeCheck}\n`;
-    supportString += `* Server/NTP Time Check: ${chk(ntpTimeCheck)}\n`;
+    supportString += `* Server/NTP Time Check: ${ntpTimeCheck}\n`;
-    supportString += `* Domain Configuration Check: ${chk(domainCheck)}\n`;
+    supportString += `* Domain Configuration Check: ${domainCheck}\n`;
-    supportString += `* HTTPS Check: ${chk(httpsCheck)}\n`;
+    supportString += `* HTTPS Check: ${httpsCheck}\n`;
    if (dj.enable_websocket) {
-        supportString += `* Websocket Check: ${chk(websocketCheck)}\n`;
+        supportString += `* Websocket Check: ${websocketCheck}\n`;
    } else {
        supportString += "* Websocket Check: disabled\n";
    }
-    supportString += `* HTTP Response Checks: ${chk(httpResponseCheck)}\n`;
+    supportString += `* HTTP Response Checks: ${httpResponseCheck}\n`;
    if (dj.invalid_feature_flags != "") {
-        supportString += "* Invalid feature flags: true\n";
+        supportString += `* Invalid feature flags: true\n`;
    }
    const jsonResponse = await fetch(`${BASE_URL}/admin/diagnostics/config`, {
@@ -1,5 +1,6 @@
 "use strict";
-/* global jQuery, _post:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
+/* eslint-env es2017, browser, jquery */
 /* global _post:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
 function deleteOrganization(event) {
    event.preventDefault();
@@ -1,4 +1,5 @@
 "use strict";
 /* eslint-env es2017, browser */
 /* global _post:readable, BASE_URL:readable */
 function smtpTest(event) {
@@ -1,5 +1,6 @@
 "use strict";
-/* global jQuery, _post:readable, _delete:readable, BASE_URL:readable, reload:readable, jdenticon:readable */
+/* eslint-env es2017, browser, jquery */
 /* global _post:readable, _delete:readable BASE_URL:readable, reload:readable, jdenticon:readable */
 function deleteUser(event) {
    event.preventDefault();
@@ -77,16 +77,6 @@
                        <span class="d-block"><b>No</b></span>
                    {{/unless}}
                    </dd>
                    <dt class="col-sm-5">Uses custom templates</dt>
                    <dd class="col-sm-7">
                    {{#if page_data.template_overrides}}
                        <span class="d-inline"><b>Yes</b></span>
                        <span class="badge bg-info text-dark abbr-badge" title="Custom template files are used.&#013;&#010;{{page_data.template_overrides}}">Details</span>
                    {{/if}}
                    {{#unless page_data.template_overrides}}
                        <span class="d-block"><b>No</b></span>
                    {{/unless}}
                    </dd>
                    <dt class="col-sm-5">Uses a reverse proxy</dt>
                    <dd class="col-sm-7">
                    {{#if page_data.ip_header_exists}}
@@ -116,8 +116,8 @@ app-security > app-two-factor-setup > form {
 }
 /* Hide unsupported Custom Role options */
-:is(bit-dialog, [bit-dialog]) div.tw-ml-4:has(bit-form-control input),
+bit-dialog div.tw-ml-4:has(bit-form-control input),
-:is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) {
+bit-dialog div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) {
  @extend %vw-hide;
 }
@@ -67,7 +67,7 @@ pub(crate) fn operator_for_path(path: &str) -> Result<opendal::Operator, crate::
        s3::operator_for_path(path)?
    } else {
        let builder = opendal::services::Fs::default().root(path);
-        opendal::Operator::new(builder)?
+        opendal::Operator::new(builder)?.finish()
    };
    OPERATORS_BY_PATH.insert(path.to_owned(), operator.clone());
@@ -236,7 +236,7 @@ mod s3 {
                builder.credential_provider_chain(ProvideCredentialChain::new().push(OpenDALS3CredentialProvider));
        }
-        Ok(opendal::Operator::new(builder)?)
+        Ok(opendal::Operator::new(builder)?.finish())
    }
    fn uri_has_option(uri: &opendal::OperatorUri, names: &[&str]) -> bool {
@@ -257,44 +257,6 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for Cache
    }
 }
 pub struct EtagCached<R> {
    response: R,
    etag: String,
 }
 impl<R> EtagCached<R> {
    /// An `etag` response should always be quoted
    pub fn new(response: R, etag: &str) -> Self {
        Self {
            response,
            etag: format!("\"{etag}\""),
        }
    }
 }
 impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for EtagCached<R> {
    fn respond_to(self, request: &'r Request<'_>) -> response::Result<'static> {
        // Check and validate a `If-None-Match` ETag header
        // Multiple tags could be returned for the same URI if the browser has multiple versions cached
        // Also, weak tags are prefixed with `W/`, but ETags are always weak, so just strip it too before comparing
        let etag_matches = request
            .headers()
            .get_one("If-None-Match")
            .is_some_and(|v| v.split(',').any(|t| t.trim().trim_start_matches("W/") == self.etag));
        let mut res = if etag_matches {
            Response::build().status(Status::NotModified).ok()?
        } else {
            self.response.respond_to(request)?
        };
        // Both 200 (OK) and 304 (Not Modified) need to return the etag and cache-control
        res.set_raw_header("Etag", self.etag);
        res.set_raw_header("Cache-Control", "public, no-cache");
        Ok(res)
    }
 }
 // Log all the routes from the main paths list, and the attachments endpoint
 // Effectively ignores, any static file route, and the alive endpoint
 const LOGGED_ROUTES: [&str; 7] = ["/api", "/admin", "/identity", "/icons", "/attachments", "/events", "/notifications"];
Author	SHA1	Message	Date
Daniel García	6a0c75320d	Fix org import	2026-07-24 16:36:11 +02:00
Daniel García	08dce4bcf9	Fmt	2026-07-24 16:32:50 +02:00
Daniel García	5f03e74feb	Fix get_groups_data when not using full_access	2026-07-24 16:20:34 +02:00
Daniel García	94a798e9dd	Fix get_groups_data	2026-07-24 15:47:51 +02:00
Daniel García	5a02e80a5a	Trusted proxies, unauthenticated rate limits and various fixes	2026-07-20 01:24:46 +02:00