Implement V2 registration support

* Add revision_date to org policies

Org policy JSON responses never included a revisionDate field, unlike
every other synced entity. The official Bitwarden server always sets
it, and current official clients (recently migrated to the WASM SDK's
typed PolicyView) now assume it is always a valid date string. Its
absence deserializes to undefined client-side, which then throws
(RangeError: Invalid time value) when the client formats it, breaking
the whole policy sync pipeline and silently emptying the vault view in
the browser and desktop apps.

Adds a revision_date column (mirroring the existing pattern used by
Send), stamped on creation and bumped on every save.

* Fix migration correctness for org policy revision_date

Caught by review: SQLite rejects non-constant defaults in ALTER TABLE
ADD COLUMN, so the sqlite migration would fail outright on every
existing installation (vaultwarden's default backend) rather than the
postgresql setup this was developed against.

- sqlite/mysql: add the column with a constant placeholder default,
  then backfill via UPDATE, since neither allows a volatile default
  in ALTER TABLE ADD COLUMN (mysql does allow it, but a constant
  keeps the three backends' migrations symmetric).
- mysql: use DATETIME instead of TIMESTAMP, matching this repo's
  existing revision_date columns, and backfill with UTC_TIMESTAMP()
  instead of a session-timezone-dependent CURRENT_TIMESTAMP.
- postgresql: backfill with `now() AT TIME ZONE 'utc'` instead of a
  DEFAULT now(), since assigning timestamptz now() into this naive
  TIMESTAMP column would otherwise cast through the server's TimeZone
  GUC and store local wall-clock instead of UTC on non-UTC servers.
- mysql/postgresql: add a real down.sql (DROP COLUMN) instead of
  leaving it empty.

* Move org policy revision_date migration after the latest one

---------

Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>

.env.template

@@ -394,11 +394,15 @@
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
 ## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
+## - "windows-desktop-autotype": Enable the autotype feature preview on Windows. (Desktop >= 2025.8.0)
+## - "windows-desktop-autotype-ga": Enable the new, still in development, autotype implementation on Windows. (Desktop >= 2026.9.1)
+##   Only enable one of the two autotype flags, the clients disable autotype completely when both are enabled.
 ## - "pm-30529-webauthn-related-origins":
 ## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
 ## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
 ## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
 ## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
+## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 
 ## Require new device emails. When a user logs in an email is required to be sent.

.typos.toml

@@ -14,10 +14,8 @@ extend-ignore-re = [
     # In SMTP it's called HELO, so ignore it
     "(?i)helo_name",
     "Server name sent during.+HELO",
-    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
+    # COSE Is short for CBOR Object Signing and Encryption
-    "COSE",
+    "(?i)cose",
-    "COSEKey",
-    "COSEAlgorithm",
     # Ignore this specific string as it's valid
     "Ensure they are valid OTPs",
     # This word is misspelled upstream

docker/DockerSettings.yaml

@@ -1,6 +1,6 @@
 ---
-vault_version: "v2026.7.0"
+vault_version: "v2026.8.0"
-vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c"
+vault_image_digest: "sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a"
 # Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags

docker/Dockerfile.alpine

@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
-#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
+#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
-#     [docker.io/vaultwarden/web-vault:v2026.7.0]
+#     [docker.io/vaultwarden/web-vault:v2026.8.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
 
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64

docker/Dockerfile.debian

@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
-#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
+#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
-#     [docker.io/vaultwarden/web-vault:v2026.7.0]
+#     [docker.io/vaultwarden/web-vault:v2026.8.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
 
 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts

migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/down.sql

@@ -0,0 +1 @@
+ALTER TABLE org_policies DROP COLUMN revision_date;

migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/up.sql

@@ -0,0 +1,7 @@
+-- DATETIME (not TIMESTAMP) to match this repo's convention for revision_date
+-- columns elsewhere, and to avoid MySQL's implicit session-timezone
+-- conversion and 2038 range limit on TIMESTAMP.
+ALTER TABLE org_policies
+ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
+
+UPDATE org_policies SET revision_date = UTC_TIMESTAMP();

migrations/mysql/2026-10-08-120000_cipher_data_longtext/up.sql

@@ -0,0 +1,3 @@
+-- A blob-encrypted cipher keeps all of its content in `data`, up to 500,000 characters, so the
+-- 64 KiB of TEXT is too small. Like upstream, which uses LONGTEXT.
+ALTER TABLE ciphers MODIFY data LONGTEXT NOT NULL;

migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/down.sql

@@ -0,0 +1 @@
+ALTER TABLE org_policies DROP COLUMN revision_date;

migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/up.sql

@@ -0,0 +1,9 @@
+-- Backfill via `now() AT TIME ZONE 'utc'` rather than a DEFAULT of now():
+-- assigning timestamptz now() into a naive TIMESTAMP column casts through
+-- the server's TimeZone GUC, so a DEFAULT now() would store local wall-clock
+-- instead of UTC on non-UTC servers, unlike every other naive-UTC timestamp
+-- column in this schema.
+ALTER TABLE org_policies
+ADD COLUMN revision_date TIMESTAMP NOT NULL DEFAULT '1970-01-01 00:00:00';
+
+UPDATE org_policies SET revision_date = (now() AT TIME ZONE 'utc');

migrations/postgresql/2026-10-08-120000_cipher_data_longtext/up.sql

@@ -0,0 +1 @@
+-- TEXT has no size limit here, only MySQL needed the change

migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/up.sql

@@ -0,0 +1,6 @@
+-- SQLite forbids non-constant defaults in ALTER TABLE ... ADD COLUMN, so add
+-- the column with a constant placeholder and backfill separately.
+ALTER TABLE org_policies
+ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
+
+UPDATE org_policies SET revision_date = CURRENT_TIMESTAMP;

migrations/sqlite/2026-10-08-120000_cipher_data_longtext/up.sql

@@ -0,0 +1 @@
+-- TEXT has no size limit here, only MySQL needed the change

playwright/README.md

@@ -2,7 +2,7 @@
 
 This allows running integration tests using [Playwright](https://playwright.dev/).
 \
-It usse its own [test.env](/test/scenarios/test.env) with different ports to not collide with a running dev instance.
+It uses its own [test.env](./test.env) with different ports to not collide with a running dev instance.
 
 ## Install
 
@@ -62,7 +62,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 
 ### Keep services running
 
-If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
+If you want you can keep the DB and Keycloak running (states are not impacted by the tests):
 
 ```bash
 PW_KEEP_SERVICE_RUNNING=true npx playwright test

playwright/tests/emergency.spec.ts

@@ -0,0 +1,131 @@
+import { test, expect, type Page, type TestInfo, Test } from '@playwright/test';
+import { MailDev } from 'maildev';
+
+import * as utils from "../global-utils";
+import { createAccount, logUser } from './setups/user';
+import { activateTOTP } from './setups/2fa';
+
+let users = utils.loadEnv();
+let mailserver;
+
+test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
+    mailserver = new MailDev({
+        port: process.env.MAILDEV_SMTP_PORT,
+        web: { port: process.env.MAILDEV_HTTP_PORT },
+    })
+
+    await mailserver.listen();
+
+    await utils.startVault(browser, testInfo, {
+        SMTP_HOST: process.env.MAILDEV_HOST,
+        SMTP_FROM: process.env.PW_SMTP_FROM,
+    });
+});
+
+test.afterAll('Teardown', async ({}) => {
+    utils.stopVault();
+    if( mailserver ){
+        await mailserver.close();
+    }
+});
+
+async function emergencyAccess(test: Test, page: Page, user: { name: string }) {
+    await test.step('Navigate', async () => {
+        await page.getByRole('button', { name: user.name }).click();
+        await page.getByRole('menuitem', { name: 'Account settings' }).click();
+        await page.getByRole('link', { name: 'Emergency access' }).click();
+        await expect(page.locator('#main-content').getByText('Emergency access', { exact: true })).toBeVisible();
+    });
+}
+
+test('Emergency access', async ({ browser, page }) => {
+    const context2 = await browser.newContext();
+    const page2 = await context2.newPage();
+
+    const mailBuffer = mailserver.buffer(users.user1.email);
+    const mailBuffer2 = mailserver.buffer(users.user2.email);
+
+    await createAccount(test, page, users.user1);
+    await createAccount(test, page2, users.user2);
+
+    await test.step('Add test2', async () => {
+        await emergencyAccess(test, page, users.user1);
+        await page.getByRole('button', { name: 'Add emergency contact' }).click();
+        await page.getByRole('textbox', { name: 'Email * (required)' }).fill(users.user2.email);
+        await page.getByRole('radio', { name: 'Takeover Can reset your' }).check();
+        await page.getByRole('button', { name: 'Save' }).click();
+        await utils.checkNotification(page, 'User(s) invited');
+    });
+
+    await test.step('Accept', async () => {
+        const email = await mailBuffer2.expect((m) => m.subject === "Emergency access for " + users.user1.name);
+        const pageE = await context2.newPage();
+        await pageE.setContent(email.html);
+        const link = await pageE.getByTestId("emergency").getAttribute("href");
+        await pageE.close();
+
+        await page2.goto(link);
+        await utils.checkNotification(page2, 'Invitation accepted');
+    });
+
+    await test.step('Confirm', async () => {
+        await emergencyAccess(test, page, users.user1);
+        await expect(page.locator('#main-content').getByText('Needs confirmation')).toBeVisible();
+        await page.getByRole('button', { name: 'Options' }).click();
+        await page.getByRole('menuitem', { name: 'Confirm' }).click();
+        await page.getByRole('button', { name: 'Confirm' }).click();
+        await utils.checkNotification(page, users.user2.name + ' confirmed');
+        await mailBuffer2.expect((m) => m.subject === "Emergency access contact for " + users.user1.name + " confirmed");
+    });
+
+    await test.step('Request', async () => {
+        await emergencyAccess(test, page2, users.user2);
+        await page2.getByRole('button', { name: 'Options' }).click();
+        await page2.getByRole('menuitem', { name: 'Request Access' }).click();
+        await page2.getByRole('button', { name: 'Request Access' }).click();
+        await utils.checkNotification(page2, 'Emergency access requested');
+        await mailBuffer.expect((m) => m.subject === "Emergency access request by " + users.user2.name + " initiated");
+    });
+
+    await test.step('Approved', async () => {
+        await emergencyAccess(test, page, users.user1);
+        await page.getByRole('button', { name: 'Options' }).click();
+        await page.getByRole('menuitem', { name: 'Approve' }).click();
+        await page.getByRole('button', { name: 'Approve' }).click();
+        await utils.checkNotification(page, 'Emergency access approved');
+        await mailBuffer2.expect((m) => m.subject === "Emergency access request for " + users.user1.name + " approved");
+    });
+    await activateTOTP(test, page, users.user1);
+
+    let newPassword = "TotoNewPassword";
+    await test.step('Access', async () => {
+        await emergencyAccess(test, page2, users.user2);
+        await page2.getByRole('button', { name: 'Options' }).click();
+        await page2.getByRole('menuitem', { name: 'Takeover' }).click();
+        await page2.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
+        await page2.getByRole('textbox', { name: 'Confirm new master password' }).fill(newPassword);
+        await page2.getByRole('button', { name: 'Save' }).click();
+        await utils.checkNotification(page2, 'Password reset for ' + users.user1.name);
+    });
+
+    await test.step('Changed no 2fa', async () => {
+        users.user1.password = newPassword;
+        await logUser(test, page, users.user1);
+    });
+
+    await test.step('Reject', async () => {
+        await emergencyAccess(test, page, users.user1);
+        await page.getByRole('button', { name: 'Options' }).click();
+        await page.getByRole('menuitem', { name: 'Reject' }).click();
+        await utils.checkNotification(page, 'Emergency access rejected');
+        await mailBuffer2.expect((m) => m.subject === "Emergency access request to " + users.user1.name + " rejected");
+    });
+
+    await test.step('Remove', async () => {
+        await page.getByRole('button', { name: 'Options' }).click();
+        await page.getByRole('menuitem', { name: 'Remove' }).click();
+        await page.getByRole('button', { name: 'Yes' }).click();
+        await utils.checkNotification(page, 'Removed user ' + users.user2.name);
+        await expect(page.getByText('You have not added any emergency contacts')).toBeVisible();
+    });
+});

playwright/tests/login.spec.ts

@@ -3,7 +3,7 @@ import * as OTPAuth from "otpauth";
 
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP } from './setups/2fa';
+import { activateTOTP, disableTOTP, recoveryCodes } from './setups/2fa';
 
 let users = utils.loadEnv();
 let totp;
@@ -31,21 +31,42 @@ test('Authenticator 2fa', async ({ page }) => {
 
     await utils.logout(test, page, users.user1);
 
-    await test.step('login', async () => {
+    await logUser(test, page, users.user1, { totp });
-        let timestamp = Date.now(); // Needed to use the next token
-        timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
 
+    await disableTOTP(test, page, users.user1);
+});
+
+test('Recovery codes', async ({ context, page }) => {
+    await logUser(test, page, users.user1);
+
+    await activateTOTP(test, page, users.user1);
+    let recovery = await recoveryCodes(test, page, users.user1);
+
+    await utils.logout(test, page, users.user1);
+
+    await test.step('login', async () => {
         await page.getByLabel(/Email address/).fill(users.user1.email);
         await page.getByRole('button', { name: 'Continue' }).click();
         await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
         await page.getByRole('button', { name: 'Log in', exact: true }).click();
 
         await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
-        await page.getByRole('button', { name: 'Continue' }).click();
 
         await expect(page).toHaveTitle(/Vaultwarden Web/);
-    });
 
-    await disableTOTP(test, page, users.user1);
+        const newPagePromise = context.waitForEvent('page');
+        await page.getByRole('button', { name: 'Use your recovery code' }).click();
+        const newPage = await newPagePromise;
+
+        const tabs = context.pages();
+        await tabs[1].bringToFront();
+        await expect(tabs[1].getByRole('heading', { name: 'Recover account two-step login' })).toBeVisible();
+        await tabs[1].getByRole('textbox', { name: 'Email address * (required)' }).fill(users.user1.email);
+        await tabs[1].getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
+        await tabs[1].getByRole('textbox', { name: 'Recovery code * (required)' }).fill(recovery);
+        await tabs[1].getByRole('button', { name: 'Submit' }).click();
+
+        await expect(tabs[1]).toHaveTitle(/Two-step login/);
+    });
 });
+

playwright/tests/setups/2fa.ts

@@ -4,6 +4,24 @@ import * as OTPAuth from "otpauth";
 
 import * as utils from '../../global-utils';
 
+export async function recoveryCodes(test: Test, page: Page, user: { name: string, password: string }): string {
+    return await test.step('Recovery code', async () => {
+        await page.getByRole('button', { name: user.name }).click();
+        await page.getByRole('menuitem', { name: 'Account settings' }).click();
+        await page.getByRole('link', { name: 'Security' }).click();
+        await page.getByRole('link', { name: 'Two-step login' }).click();
+
+        await page.getByRole('button', { name: 'View recovery code' }).click();
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByRole('button', { name: 'Continue' }).click();
+
+        const recovery = await page.getByRole('code').innerText();
+        await page.getByLabel('Close').click();
+
+        return recovery;
+    })
+}
+
 export async function activateTOTP(test: Test, page: Page, user: { name: string, password: string }): OTPAuth.TOTP {
     return await test.step('Activate TOTP 2FA', async () => {
         await page.getByRole('button', { name: user.name }).click();
@@ -21,7 +39,6 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
         await page.getByLabel(/Verification code/).fill(totp.generate());
         await page.getByRole('button', { name: 'Turn on' }).click();
         await page.getByRole('heading', { name: 'Turned on', exact: true });
-        await page.getByLabel('Close').click();
 
         return totp;
     })

playwright/tests/setups/user.ts

@@ -2,6 +2,7 @@ import { expect, type Browser, Page } from '@playwright/test';
 
 import { type MailBuffer } from 'maildev';
 
+import * as OTPAuth from "otpauth";
 import * as utils from '../../global-utils';
 import { retrieveEmailCode } from './2fa';
 
@@ -43,6 +44,7 @@ export async function logUser(
         mailBuffer ?: MailBuffer,
         mail2fa?: boolean,
         notNewDevice?: boolean,
+        totp?: OTPAuth.TOTP,
     } = {}
 ) {
     await test.step(`Log user ${user.email}`, async () => {
@@ -55,11 +57,23 @@ export async function logUser(
         await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
         await page.getByRole('button', { name: 'Log in', exact: true }).click();
 
-        if( options.mail2fa ){
+        if( options.mail2fa || options.totp ){
+            let code;
+
             await test.step('2FA check', async () => {
                 await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-                let code = await retrieveEmailCode(test, page, options.mailBuffer);
+
+                if( options.totp ) {
+                    const totp = options.totp;
+                    let timestamp = Date.now(); // Needed to use the next token
+                    timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
+                    code = totp.generate({timestamp});
+                } else if( options.mail2fa ){
+                    code = await retrieveEmailCode(test, page, options.mailBuffer);
+                }
+
                 await page.getByLabel(/Verification code/).fill(code);
+
                 await page.getByRole('button', { name: 'Continue' }).click();
             });
         }

src/api/core/accounts.rs

@@ -94,6 +94,15 @@ pub struct KDFData {
     kdf_parallelism: Option<i32>,
 }
 
+impl KDFData {
+    pub(super) fn matches_user(&self, user: &User) -> bool {
+        self.kdf == user.client_kdf_type
+            && self.kdf_iterations == user.client_kdf_iter
+            && self.kdf_memory == user.client_kdf_memory
+            && self.kdf_parallelism == user.client_kdf_parallelism
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RegisterData {
@@ -203,17 +212,21 @@ struct KeysData {
     public_key: String,
 }
 
-/// The `accountKeys` payload, which replaces the flat `keys`/`userAsymmetricKeys` object.
+/// Upstream's implicit `[Required]` on a non-nullable string: present and not blank.
+fn required(value: Option<String>, field: &str) -> ApiResult<String> {
+    match value {
+        Some(value) if !value.trim().is_empty() => Ok(value),
+        _ => err!(format!("The {field} field is required.")),
+    }
+}
+
+/// The `accountKeys` payload: a v1 key pair, or v2 with a signature key pair and security state.
 ///
-/// It carries either a "v1" state (just the encryption key pair) or a "v2" one, which adds a
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Api/Request/AccountKeysRequestModel.cs#L6-L50>
-/// signature key pair, a signed public key, and a signed security state. The two deprecated
-/// top-level fields are still sent by the SDK alongside the nested ones and are only used as a
-/// fallback for clients that don't send `publicKeyEncryptionKeyPair` yet.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Api/Request/AccountKeysRequestModel.cs>
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct AccountKeysData {
+struct AccountKeysData {
+    // Required like upstream, but only used without `public_key_encryption_key_pair`
     user_key_encrypted_account_private_key: Option<String>,
     account_public_key: Option<String>,
 
@@ -245,7 +258,7 @@ struct SecurityStateData {
     security_version: i32,
 }
 
-pub struct ValidatedAccountKeys {
+struct ValidatedAccountKeys {
     private_key: String,
     public_key: String,
     v2: Option<ValidatedV2AccountKeys>,
@@ -261,25 +274,37 @@ struct ValidatedV2AccountKeys {
 }
 
 impl AccountKeysData {
-    /// Checks that the payload describes a complete account cryptographic state.
+    /// Upstream's model checks, plus the v2 fields all or none: no client can unlock a partial v2 state.
-    ///
+    fn validate(self) -> ApiResult<ValidatedAccountKeys> {
-    /// The v2 fields have to be all present or all absent: a client that receives a COSE-wrapped
+        let top_private_key =
-    /// private key without the matching signature key pair and security state refuses to unlock the
+            required(self.user_key_encrypted_account_private_key, "UserKeyEncryptedAccountPrivateKey")?;
-    /// vault, so storing half a state would produce an account nobody can log into.
+        let top_public_key = required(self.account_public_key, "AccountPublicKey")?;
-    pub fn validate(self) -> ApiResult<ValidatedAccountKeys> {
+        let (private_key, public_key, signed_public_key) = match self.public_key_encryption_key_pair {
-        let (private_key, public_key, signed_public_key) = if let Some(key_pair) = self.public_key_encryption_key_pair {
+            Some(key_pair) => (
-            (key_pair.wrapped_private_key, key_pair.public_key, key_pair.signed_public_key)
+                required(Some(key_pair.wrapped_private_key), "WrappedPrivateKey")?,
-        // Older clients only send the deprecated top-level fields, which are always v1.
+                required(Some(key_pair.public_key), "PublicKey")?,
-        } else if let (Some(private_key), Some(public_key)) =
+                key_pair.signed_public_key,
-            (self.user_key_encrypted_account_private_key, self.account_public_key)
+            ),
-        {
+            // Older clients only send the top-level fields, which are always v1
-            (private_key, public_key, None)
+            None => (top_private_key, top_public_key, None),
-        } else {
-            err!("The account keys are missing an encryption key pair")
         };
 
+        if let Some(signature_key_pair) = &self.signature_key_pair {
+            required(Some(signature_key_pair.signature_algorithm.clone()), "SignatureAlgorithm")?;
+            required(Some(signature_key_pair.wrapped_signing_key.clone()), "WrappedSigningKey")?;
+            required(Some(signature_key_pair.verifying_key.clone()), "VerifyingKey")?;
+        }
+        if let Some(security_state) = &self.security_state {
+            required(Some(security_state.security_state.clone()), "SecurityState")?;
+            if security_state.security_state.encode_utf16().count() > 10_000 {
+                err!("The field SecurityState must be a string with a maximum length of 10000.")
+            }
+        }
+
         let v2 = match (signed_public_key, self.signature_key_pair, self.security_state) {
             (Some(signed_public_key), Some(signature_key_pair), Some(security_state)) => {
+                // Upstream fails on a null one, but takes an empty one that no client can unlock with
+                let signed_public_key = required(Some(signed_public_key), "SignedPublicKey")?;
                 let Some(signature_algorithm) = SignatureAlgorithm::parse(&signature_key_pair.signature_algorithm)
                 else {
                     err!(format!(
@@ -322,28 +347,28 @@ impl From<KeysData> for ValidatedAccountKeys {
 }
 
 impl ValidatedAccountKeys {
-    /// The keys of a request that may carry either shape. `accountKeys` supersedes the flat `keys`
+    /// The keys of a registration: `accountKeys` only for a v2 account, like upstream.
-    /// object when both are sent.
+    ///
-    fn from_request(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Option<Self>> {
+    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Auth/Models/Api/Request/Accounts/RegisterFinishRequestModel.cs#L77-L100>
-        match (account_keys, keys) {
+    fn for_registration(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Self> {
-            (Some(account_keys), _) => account_keys.validate().map(Some),
+        if let Some(account_keys) = account_keys {
-            (None, keys) => Ok(keys.map(Self::from)),
+            let account_keys = account_keys.validate()?;
+            if account_keys.is_v2() {
+                return Ok(account_keys);
+            }
         }
+        let Some(keys) = keys else {
+            err!("PublicKey and WrappedPrivateKey not found in RequestModel")
+        };
+        Ok(keys.into())
     }
 
     fn is_v2(&self) -> bool {
         self.v2.is_some()
     }
 
-    /// Writes the parts of the state that live on the user itself. The user still needs saving, and
+    /// Sets the keys on the user, which then needs saving before [`Self::save_signature_key_pair`].
-    /// [`Self::save_signature_key_pair`] still needs calling once it has been.
+    fn apply(&self, user: &mut User) -> EmptyResult {
-    ///
-    /// Rejects downgrading an account from v2 back to v1.
-    pub fn apply(&self, user: &mut User) -> EmptyResult {
-        if user.is_v2() && self.v2.is_none() {
-            err!("Cannot downgrade an account from v2 to v1 encryption")
-        }
-
         user.private_key = Some(self.private_key.clone());
         user.public_key = Some(self.public_key.clone());
 
@@ -354,9 +379,8 @@ impl ValidatedAccountKeys {
         Ok(())
     }
 
-    /// Persists the signature key pair. Separate from [`Self::apply`] because the row has a foreign
+    /// Saves the signature key pair, which needs the user to exist for its foreign key.
-    /// key to the user, so it can only be written once the user exists.
+    async fn save_signature_key_pair(&self, user_id: &UserId, conn: &DbConn) -> EmptyResult {
-    pub async fn save_signature_key_pair(&self, user_id: &UserId, conn: &DbConn) -> EmptyResult {
         // Skip if the account is v1, since v1 accounts don't have a signature key pair.
         let Some(v2) = &self.v2 else {
             return Ok(());
@@ -527,7 +551,7 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     // the user can retry without losing their invitation below.
     let password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(password_hint.as_ref())?;
-    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
+    let account_keys = ValidatedAccountKeys::for_registration(data.account_keys, data.keys)?;
 
     let mut user = match User::find_by_mail(&email, &conn).await {
         Some(user) => {
@@ -584,13 +608,10 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
         user.name = name;
     }
 
-    if let Some(ref account_keys) = account_keys {
+    account_keys.apply(&mut user)?;
-        account_keys.apply(&mut user)?;
+    // Like upstream, only a v2 registration records the key id; v1 accounts report it through `user-key-id`
-        // Like upstream, only a v2 registration records the user key id. A v1 account reports it
+    if account_keys.is_v2() {
-        // later, through `user-key-id`.
+        user.key_id = data.compat.key_id();
-        if account_keys.is_v2() {
-            user.key_id = data.compat.key_id();
-        }
     }
 
     if email_verified {
@@ -613,10 +634,7 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     }
 
     user.save(&conn).await?;
-
+    account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
-    if let Some(account_keys) = account_keys {
-        account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
-    }
 
     // accept any open emergency access invitations
     if !CONFIG.mail_enabled() && CONFIG.emergency_access_allowed() {
@@ -630,9 +648,41 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     })))
 }
 
+/// Upstream's shape checks of the set-password body, on the raw JSON that the untagged compat would hide.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs#L75-L106>
+fn validate_set_password_shape(body: &Value) -> EmptyResult {
+    let has = |name: &str| {
+        body.as_object().is_some_and(|o| o.iter().any(|(k, v)| k.eq_ignore_ascii_case(name) && !v.is_null()))
+    };
+
+    if has("accountKeys") && has("keys") {
+        err!("Cannot specify both AccountKeys and Keys. Provide exactly one keypair.")
+    }
+    let (authentication, unlock) = (has("masterPasswordAuthentication"), has("masterPasswordUnlock"));
+    if authentication != unlock {
+        err!(
+            "Must provide both MasterPasswordAuthentication and MasterPasswordUnlock together. Cannot provide one without the other."
+        )
+    }
+    if authentication && (has("masterPasswordHash") || has("key") || has("kdf")) {
+        err!(
+            "Cannot mix modern (MasterPasswordAuthentication/MasterPasswordUnlock) and legacy (MasterPasswordHash/Key/Kdf) fields. Provide one shape or the other."
+        )
+    }
+    Ok(())
+}
+
 #[post("/accounts/set-password", data = "<data>")]
-async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn post_set_password(data: Json<Value>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: SetPasswordData = data.into_inner();
+    let data = data.into_inner();
+    validate_set_password_shape(&data)?;
+    let Ok(data) = serde_json::from_value::<SetPasswordData>(data) else {
+        err_code!("Unexpected SetPasswordData format", Status::UnprocessableEntity.code)
+    };
+    if data.master_password_hint.as_ref().is_some_and(|h| h.encode_utf16().count() > 50) {
+        err!("The field MasterPasswordHint must be a string with a maximum length of 50.")
+    }
     let mut user = headers.user;
 
     if user.private_key.is_some() || !user.password_hash.is_empty() {
@@ -648,7 +698,25 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
     let password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(password_hint.as_ref())?;
 
-    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
+    // Like upstream, `accountKeys` only through the v2 JIT flow
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Controllers/AccountsController.cs#L314-L359>
+    let account_keys = match data.account_keys {
+        Some(account_keys) => {
+            if !matches!(data.compat, RegisterDataCompat::RegisterDataCur(_))
+                || !crate::util::is_client_feature_flag_enabled(
+                    "enable-account-encryption-v2-jit-password-registration",
+                )
+            {
+                err!("Request includes V2 AccountKeys but V2 encryption is not enabled.")
+            }
+            let account_keys = account_keys.validate()?;
+            if !account_keys.is_v2() {
+                err!("AccountKeys are only supported for V2 encryption.")
+            }
+            Some(account_keys)
+        }
+        None => data.keys.map(ValidatedAccountKeys::from),
+    };
 
     set_kdf_data(&mut user, data.compat.kdf())?;
 
@@ -691,8 +759,7 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
         Membership::accept_user_invitations(&user.uuid, &conn).await?;
     }
 
-    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+    log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
-        .await;
 
     user.save(&conn).await?;
 
@@ -812,8 +879,9 @@ async fn get_keys(headers: Headers, conn: DbConn) -> JsonResult {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct PostKeysData {
-    #[serde(flatten)]
+    // Required like upstream, even next to `accountKeys`
-    keys: Option<KeysData>,
+    public_key: Option<String>,
+    encrypted_private_key: Option<String>,
     account_keys: Option<AccountKeysData>,
     // The id of the user key these account keys belong to, only honored for v2 `accountKeys`
     user_key_id: Option<KeyId>,
@@ -825,15 +893,18 @@ async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) ->
 
     let mut user = headers.user;
 
-    // This only sets the keys of an account that has none yet. Replacing existing ones is what a key
+    // Only for an account without keys, replacing them is what a key rotation does
-    // rotation does, with the checks that go with it.
     if user.private_key.is_some() || user.public_key.is_some() {
         err!("User has existing keypair")
     }
 
-    // `accountKeys` supersedes the flat `keys` object when both are sent.
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Auth/Models/Api/Request/Accounts/KeysRequestModel.cs#L11-L19>
-    let account_keys = match (data.account_keys, data.keys) {
+    let public_key = required(data.public_key, "PublicKey")?;
-        (Some(account_keys), _) => {
+    let encrypted_private_key = required(data.encrypted_private_key, "EncryptedPrivateKey")?;
+
+    // `accountKeys` supersedes the flat keys when both are sent
+    let account_keys = match data.account_keys {
+        Some(account_keys) => {
             let account_keys = account_keys.validate()?;
             if !account_keys.is_v2() {
                 err!("AccountKeys are only supported for V2 encryption.")
@@ -844,8 +915,11 @@ async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) ->
             }
             account_keys
         }
-        (None, Some(keys)) => keys.into(),
+        None => KeysData {
-        (None, None) => err!("No account keys provided"),
+            encrypted_private_key,
+            public_key,
+        }
+        .into(),
     };
 
     account_keys.apply(&mut user)?;
@@ -883,8 +957,7 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbCon
         err!("Invalid password")
     }
 
-    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+    log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
-        .await;
 
     let (new_master_password_hash, new_key) =
         if let (Some(unlock_data), Some(authentication_data)) = (data.unlock_data, data.authentication_data) {
@@ -971,29 +1044,41 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult {
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct AuthenticationData {
+pub(super) struct AuthenticationData {
     #[serde(alias = "Salt")]
     salt: String,
     #[serde(alias = "Kdf")]
-    kdf: KDFData,
+    pub(super) kdf: KDFData,
     #[serde(alias = "MasterPasswordAuthenticationHash")]
-    master_password_authentication_hash: String,
+    pub(super) master_password_authentication_hash: String,
+}
+
+impl AuthenticationData {
+    pub(super) fn check(&self, user: &User, unlock: &UnlockData) -> EmptyResult {
+        if self.kdf != unlock.kdf {
+            err!("KDF settings must be equal for authentication and unlock")
+        }
+
+        if self.salt != user.master_password_salt() || self.salt != unlock.salt {
+            err!("Invalid master password salt")
+        }
+
+        Ok(())
+    }
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct UnlockData {
+pub(super) struct UnlockData {
     salt: String,
     kdf: KDFData,
-    master_key_wrapped_user_key: String,
+    pub(super) master_key_wrapped_user_key: String,
     contained_key_id: Option<KeyId>,
 }
 
-/// A password or KDF change re-wraps the same user key, so a key id sent with it has to be the
+/// A password or KDF change keeps the user key, so its key id must be the current one, when both are known.
-/// current one. Either may be missing: from a client that predates key ids, or a user whose key id
-/// isn't known yet. There is nothing to compare in those cases.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs#L27-L47>
 fn validate_key_id_unchanged(user: &User, unlock_data: &UnlockData) -> EmptyResult {
     if let (Some(current), Some(contained)) = (&user.key_id, &unlock_data.contained_key_id)
         && current != contained
@@ -1019,13 +1104,7 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, conn: DbConn, nt:
         err!("Invalid password")
     }
 
-    if data.authentication_data.kdf != data.unlock_data.kdf {
+    data.authentication_data.check(&headers.user, &data.unlock_data)?;
-        err!("KDF settings must be equal for authentication and unlock")
-    }
-
-    if headers.user.email != data.authentication_data.salt || headers.user.email != data.unlock_data.salt {
-        err!("Invalid master password salt")
-    }
 
     validate_key_id_unchanged(&headers.user, &data.unlock_data)?;
 
@@ -1204,9 +1283,7 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
         err!("Invalid password")
     }
 
-    // This only rotates the keys of a v1 account. A v2 account's signing key would stay wrapped by the
+    // Rotating v2 keys, or upgrading to them, would leave an account that can't be unlocked here
-    // old user key, and a v1 account can't be upgraded here, since the signature key pair isn't read.
-    // Either would leave an account that can't be unlocked.
     if headers.user.is_v2() {
         err!("Key rotation is not supported for v2 accounts")
     }
@@ -1961,7 +2038,7 @@ async fn post_auth_request(
     nt.send_auth_request(&user.uuid, &auth_request.uuid, &device, &conn).await;
 
     log_user_event(
-        EventType::UserRequestedDeviceApproval as i32,
+        EventType::UserRequestedDeviceApproval,
         &user.uuid,
         client_headers.device_type,
         &client_headers.ip.ip,
@@ -2055,7 +2132,7 @@ async fn put_auth_request(
         nt.send_auth_response(&auth_request.user_uuid, &auth_request.uuid, &headers.device, &conn).await;
 
         log_user_event(
-            EventType::OrganizationUserApprovedAuthRequest as i32,
+            EventType::OrganizationUserApprovedAuthRequest,
             &headers.user.uuid,
             headers.device.atype,
             &headers.ip.ip,
@@ -2066,7 +2143,7 @@ async fn put_auth_request(
         // If denied, there's no reason to keep the request
         auth_request.delete(&conn).await?;
         log_user_event(
-            EventType::OrganizationUserRejectedAuthRequest as i32,
+            EventType::OrganizationUserRejectedAuthRequest,
             &headers.user.uuid,
             headers.device.atype,
             &headers.ip.ip,

src/api/core/ciphers.rs

@@ -197,7 +197,7 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
         Value::Null
     };
 
-    // Upstream omits this when unset rather than sending null.
+    // Upstream omits these when unset rather than sending null
     let mut user_decryption = json!({ "masterPasswordUnlock": master_password_unlock });
     if let Some(key_id) = &headers.user.key_id {
         user_decryption["userKeyId"] = json!(key_id);
@@ -274,7 +274,8 @@ pub struct CipherData {
 
     key: Option<String>,
 
-    pub encrypted_for: UserId, // Added in web-v2025.6.0
+    // Added in web-v2025.6.0. Deprecated upstream for `encrypted_by_key_id`, but still checked when sent
+    pub encrypted_for: Option<UserId>,
     // Added in web-v2025.8.1, Optional for compat
     pub encrypted_by_key_id: Option<KeyId>,
 
@@ -341,12 +342,22 @@ impl From<CipherValidationError> for crate::Error {
     }
 }
 
-/// A user-owned cipher must be encrypted with the user's current key. Organization ciphers use the
+/// The cipher must have been encrypted for the acting user. Only checked when the client sends the field.
-/// organization key, which has no id yet, and either id may be missing: from a client that predates
-/// the field, or a user whose key id isn't known yet. There is nothing to compare in those cases.
 ///
-/// Ref: upstream's `CiphersController.ValidateCipherEncryptedByUser`
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1857-L1870>
-fn validate_encrypted_by_user_key(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
+fn validate_encrypted_for_user(data: &CipherData, user_id: &UserId) -> EmptyResult {
+    if data.encrypted_for.as_ref().is_some_and(|encrypted_for| encrypted_for != user_id) {
+        err!("Cipher was not encrypted for the current user. Please try again.")
+    }
+    Ok(())
+}
+
+/// [`validate_encrypted_for_user`], plus the key id of a user-owned cipher, when both ids are known.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1886-L1911>
+fn validate_encrypted_by_user(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
+    validate_encrypted_for_user(data, &user.uuid)?;
+
     if !is_org_cipher
         && let (Some(cipher_key_id), Some(user_key_id)) = (&data.encrypted_by_key_id, &user.key_id)
         && cipher_key_id != user_key_id
@@ -360,16 +371,15 @@ fn validate_encrypted_by_user_key(data: &CipherData, user: &User, is_org_cipher:
 const MAX_CIPHER_DATA_LENGTH: usize = 500_000;
 
 impl CipherData {
-    /// Whether the content is a single blob rather than the per-type fields. This parses `data`, so
+    /// Whether `data` is a blob rather than the per-type fields. Parses `data`, so keep the result.
-    /// callers that need the answer more than once should keep it.
     pub fn is_blob(&self) -> bool {
         self.data.as_deref().is_some_and(is_data_blob_encrypted)
     }
 
-    /// Checks the content the way upstream's model validation does, before anything is saved.
+    /// Upstream's model checks that depend on the format: the size of `data`, and a name unless it's a blob.
-    /// `is_blob` is [`Self::is_blob`].
     ///
-    /// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/Vault/Models/Request/CipherRequestModel.cs>
+    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L76-L77>
+    /// and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L91-L99>
     pub fn validate_content(&self, is_blob: bool) -> Result<(), CipherValidationError> {
         if let Some(data) = &self.data
             && data.len() > MAX_CIPHER_DATA_LENGTH
@@ -425,17 +435,14 @@ async fn post_ciphers_create(
 ) -> JsonResult {
     let mut data: ShareCipherData = data.into_inner();
 
-    if data.cipher.encrypted_for != headers.user.uuid {
+    validate_encrypted_by_user(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
-        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
-    }
-    validate_encrypted_by_user_key(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
 
     // This check is usually only needed in update_cipher_from_data(), but we
     // need it here as well to avoid creating an empty cipher in the call to
     // cipher.save() below.
     enforce_personal_ownership_policy(Some(&data.cipher), &headers, &conn).await?;
 
-    let mut cipher = Cipher::new(data.cipher.r#type, String::new());
+    let mut cipher = Cipher::new(data.cipher.r#type);
     cipher.user_uuid = Some(headers.user.uuid.clone());
     cipher.save(&conn).await?;
 
@@ -459,11 +466,7 @@ async fn post_ciphers_create(
 async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
     let mut data: CipherData = data.into_inner();
 
-    if data.encrypted_for != headers.user.uuid {
+    validate_encrypted_by_user(&data, &headers.user, data.organization_id.is_some())?;
-        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
-    }
-
-    validate_encrypted_by_user_key(&data, &headers.user, data.organization_id.is_some())?;
 
     // The web/browser clients set this field to null as expected, but the
     // mobile clients seem to set the invalid value `0001-01-01T00:00:00`,
@@ -471,7 +474,7 @@ async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt
     // needed when creating a new cipher, so just ignore it unconditionally.
     data.last_known_revision_date = None;
 
-    let mut cipher = Cipher::new(data.r#type, String::new());
+    let mut cipher = Cipher::new(data.r#type);
     update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherCreate).await?;
 
     Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -495,6 +498,44 @@ async fn enforce_personal_ownership_policy(data: Option<&CipherData>, headers: &
     Ok(())
 }
 
+/// The checks of saving a cipher, for callers that run them before writing anything else
+async fn validate_cipher_update(
+    cipher: &Cipher,
+    data: &CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+    ut: UpdateType,
+) -> EmptyResult {
+    // Check that the client isn't updating an existing cipher with stale data.
+    // And only perform this check when not importing ciphers, else the date/time check will fail.
+    if ut != UpdateType::None
+        && let Some(dt) = &data.last_known_revision_date
+    {
+        match NaiveDateTime::parse_from_str(dt, "%+") {
+            // ISO 8601 format
+            Err(err) => warn!("Error parsing LastKnownRevisionDate '{dt}': {err}"),
+            Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => {
+                err!("The client copy of this cipher is out of date. Resync the client and try again.")
+            }
+            Ok(_) => (),
+        }
+    }
+
+    if let Some(note) = &data.notes {
+        let max_note_size = CONFIG._max_note_size();
+        if note.len() > max_note_size {
+            err!(format!("The field Notes exceeds the maximum encrypted value length of {max_note_size} characters."))
+        }
+    }
+
+    if let Some(folder_id) = &data.folder_id
+        && Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, conn).await.is_none()
+    {
+        err!("Invalid folder", "Folder does not exist or belongs to another user");
+    }
+    Ok(())
+}
+
 pub async fn update_cipher_from_data(
     cipher: &mut Cipher,
     data: CipherData,
@@ -522,33 +563,12 @@ pub async fn update_cipher_from_data(
 
     let is_blob = data.is_blob();
     data.validate_content(is_blob)?;
-
+    validate_cipher_update(cipher, &data, headers, conn, ut).await?;
-    // Check that the client isn't updating an existing cipher with stale data.
-    // And only perform this check when not importing ciphers, else the date/time check will fail.
-    if ut != UpdateType::None
-        && let Some(dt) = data.last_known_revision_date
-    {
-        match NaiveDateTime::parse_from_str(&dt, "%+") {
-            // ISO 8601 format
-            Err(err) => warn!("Error parsing LastKnownRevisionDate '{dt}': {err}"),
-            Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => {
-                err!("The client copy of this cipher is out of date. Resync the client and try again.")
-            }
-            Ok(_) => (),
-        }
-    }
 
     if cipher.organization_uuid.is_some() && cipher.organization_uuid != data.organization_id {
         err!("Organization mismatch. Please resync the client before updating the cipher")
     }
 
-    if let Some(note) = &data.notes {
-        let max_note_size = CONFIG._max_note_size();
-        if note.len() > max_note_size {
-            err!(format!("The field Notes exceeds the maximum encrypted value length of {max_note_size} characters."))
-        }
-    }
-
     // Check if this cipher is being transferred from a personal to an organization vault
     let transfer_cipher = cipher.organization_uuid.is_none() && data.organization_id.is_some();
 
@@ -579,12 +599,6 @@ pub async fn update_cipher_from_data(
         cipher.user_uuid = Some(headers.user.uuid.clone());
     }
 
-    if let Some(ref folder_id) = data.folder_id
-        && Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, conn).await.is_none()
-    {
-        err!("Invalid folder", "Folder does not exist or belongs to another user");
-    }
-
     // Modify attachments name and keys when rotating
     if let Some(attachments) = data.attachments2 {
         for (id, attachment) in attachments {
@@ -624,8 +638,7 @@ pub async fn update_cipher_from_data(
     };
 
     if let Some(blob) = data.data.filter(|_| is_blob) {
-        // A blob holds all of the content, the name included, so nothing is kept outside it. The name
+        // A blob holds everything, the name included; the column can't be null, so it's left empty
-        // column can't be null, so it's left empty; `to_json` reports it as null, as upstream does.
         // TODO: Make `ciphers.name` nullable and store `None` here instead.
         cipher.name = String::new();
         cipher.notes = None;
@@ -750,7 +763,7 @@ async fn post_ciphers_import(data: Json<ImportData>, headers: Headers, conn: DbC
         let folder_id = relations_map.get(&index).and_then(|i| folders.get(*i).cloned());
         cipher_data.folder_id = folder_id;
 
-        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
+        let mut cipher = Cipher::new(cipher_data.r#type);
         update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
     }
 
@@ -818,7 +831,8 @@ async fn put_cipher(
         err!("Cipher is not write accessible")
     }
 
-    validate_encrypted_by_user_key(&data, &headers.user, cipher.organization_uuid.is_some())?;
+    // Against the cipher we hold rather than the organization the client claims, like upstream
+    validate_encrypted_by_user(&data, &headers.user, cipher.organization_uuid.is_some())?;
 
     update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherUpdate).await?;
 
@@ -1078,9 +1092,7 @@ async fn post_cipher_share(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    let data: ShareCipherData = data.into_inner();
+    put_cipher_share(cipher_id, data, headers, conn, nt).await
-
-    share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
 }
 
 #[put("/ciphers/<cipher_id>/share", data = "<data>")]
@@ -1093,6 +1105,21 @@ async fn put_cipher_share(
 ) -> JsonResult {
     let data: ShareCipherData = data.into_inner();
 
+    // Upstream's `PutShare` checks, before anything is written.
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L899-L912>
+    // and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L498-L519>
+    if data.cipher.organization_id.is_none() {
+        err!("Cipher OrganizationId is required.")
+    }
+    if data.collection_ids.is_empty() {
+        err!("You must select at least one collection.")
+    }
+    if !Cipher::find_by_uuid(&cipher_id, &conn).await.is_some_and(|c| c.user_uuid.as_ref() == Some(&headers.user.uuid))
+    {
+        err_code!("Cipher doesn't exist", Status::NotFound.code)
+    }
+    validate_encrypted_for_user(&data.cipher, &headers.user.uuid)?;
+
     share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
 }
 
@@ -1112,18 +1139,33 @@ async fn put_cipher_share_selected(
 ) -> EmptyResult {
     let mut data: ShareSelectedCipherData = data.into_inner();
 
+    // Upstream's `PutShareMany` checks, before anything is written.
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1395-L1421>
+    // and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L560-L604>
     if data.ciphers.is_empty() {
         err!("You must select at least one cipher.")
     }
-
+    if data.ciphers.iter().any(|c| c.id.is_none() || c.organization_id.is_none()) {
+        err!("All Ciphers must have an Id and OrganizationId.")
+    }
+    if data.ciphers.iter().map(|c| &c.organization_id).collect::<HashSet<_>>().len() != 1 {
+        err!("All ciphers must be for the same organization.")
+    }
     if data.collection_ids.is_empty() {
         err!("You must select at least one collection.")
     }
-
     for cipher in &data.ciphers {
-        if cipher.id.is_none() {
+        cipher.validate_content(cipher.is_blob())?;
-            err!("Request missing ids field")
+    }
-        }
+    for cipher in &data.ciphers {
+        validate_encrypted_for_user(cipher, &headers.user.uuid)?;
+    }
+    let owned_ciphers = Cipher::find_owned_by_user(&headers.user.uuid, &conn).await;
+    for cipher_data in &data.ciphers {
+        let Some(cipher) = owned_ciphers.iter().find(|c| cipher_data.id.as_ref() == Some(&c.uuid)) else {
+            err!("Trying to share ciphers that you do not own.")
+        };
+        validate_cipher_update(cipher, cipher_data, &headers, &conn, UpdateType::None).await?;
     }
 
     while let Some(cipher) = data.ciphers.pop() {
@@ -1170,6 +1212,20 @@ async fn share_cipher_by_uuid(
         err!("Organization mismatch. Please resync the client before updating the cipher")
     }
 
+    // When LastKnownRevisionDate is None, it is a new cipher, so send CipherCreate.
+    // If there is an override, like when handling multiple items, we want to prevent a push notification for every single item
+    let ut = if let Some(ut) = override_ut {
+        ut
+    } else if data.cipher.last_known_revision_date.is_some() {
+        UpdateType::SyncCipherUpdate
+    } else {
+        UpdateType::SyncCipherCreate
+    };
+
+    // For the same reason, the other checks of saving
+    data.cipher.validate_content(data.cipher.is_blob())?;
+    validate_cipher_update(&cipher, &data.cipher, headers, conn, ut).await?;
+
     let mut shared_to_collections = vec![];
 
     if let Some(organization_id) = &data.cipher.organization_id {
@@ -1188,16 +1244,6 @@ async fn share_cipher_by_uuid(
         }
     }
 
-    // When LastKnownRevisionDate is None, it is a new cipher, so send CipherCreate.
-    // If there is an override, like when handling multiple items, we want to prevent a push notification for every single item
-    let ut = if let Some(ut) = override_ut {
-        ut
-    } else if data.cipher.last_known_revision_date.is_some() {
-        UpdateType::SyncCipherUpdate
-    } else {
-        UpdateType::SyncCipherCreate
-    };
-
     update_cipher_from_data(&mut cipher, data.cipher, headers, Some(shared_to_collections), conn, nt, ut).await?;
 
     Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, conn).await?))

src/api/core/emergency_access.rs

@@ -6,7 +6,10 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult,
-        core::{CipherSyncData, CipherSyncType},
+        core::{
+            CipherSyncData, CipherSyncType,
+            accounts::{AuthenticationData, UnlockData},
+        },
     },
     auth::{Headers, decode_emergency_access_invite},
     db::{
@@ -615,6 +618,7 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
         "kdfMemory": grantor_user.client_kdf_memory,
         "kdfParallelism": grantor_user.client_kdf_parallelism,
         "keyEncrypted": &emergency_access.key_encrypted,
+        "salt": grantor_user.master_password_salt(),
         "object": "emergencyAccessTakeover",
     });
 
@@ -624,8 +628,13 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EmergencyAccessPasswordData {
-    new_master_password_hash: String,
+    // Legacy payload
-    key: String,
+    new_master_password_hash: Option<String>,
+    key: Option<String>,
+
+    // Current payload
+    authentication_data: Option<AuthenticationData>,
+    unlock_data: Option<UnlockData>,
 }
 
 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
@@ -638,8 +647,6 @@ async fn password_emergency_access(
     check_emergency_access_enabled()?;
 
     let data: EmergencyAccessPasswordData = data.into_inner();
-    let new_master_password_hash = &data.new_master_password_hash;
-    //let key = &data.Key;
 
     let requesting_user = headers.user;
     let Some(emergency_access) =
@@ -656,8 +663,23 @@ async fn password_emergency_access(
         err!("Grantor user not found.")
     };
 
+    let (new_master_password_hash, new_key) =
+        if let (Some(authentication_data), Some(unlock_data)) = (data.authentication_data, data.unlock_data) {
+            authentication_data.check(&grantor_user, &unlock_data)?;
+
+            if !authentication_data.kdf.matches_user(&grantor_user) {
+                err!("KDF settings do not match the grantor account")
+            }
+
+            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
+        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
+            (new_master_password_hash, new_key)
+        } else {
+            err!("Invalid request!")
+        };
+
     // change grantor_user password
-    grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
+    grantor_user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
     grantor_user.save(&conn).await?;
 
     // Disable TwoFactor providers since they will otherwise block logins

src/api/core/events.rs

@@ -242,11 +242,11 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
     Ok(())
 }
 
-pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
+pub async fn log_user_event(event_type: EventType, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
     if !CONFIG.org_events_enabled() {
         return;
     }
-    log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await;
+    log_user_event_impl(event_type as i32, user_id, device_type, None, ip, conn).await;
 }
 
 async fn log_user_event_impl(

src/api/core/organizations.rs

@@ -8,7 +8,7 @@ use crate::{
     CONFIG,
     api::admin::FAKE_ADMIN_UUID,
     api::{
-        EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
+        ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
         core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor},
     },
     auth::{AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite},
@@ -26,6 +26,8 @@ use crate::{
     util::{NumberOrString, convert_json_key_lcase_first},
 };
 
+use super::accounts::{AuthenticationData, UnlockData};
+
 pub fn routes() -> Vec<Route> {
     routes![
         get_organization,
@@ -1829,7 +1831,7 @@ async fn post_org_import(
         cipher_data.folder_id = None;
         // Replace the client-provided, unvalidated organizationId with the real target org
         cipher_data.organization_id = Some(org_id.clone());
-        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
+        let mut cipher = Cipher::new(cipher_data.r#type);
         update_cipher_from_data(
             &mut cipher,
             cipher_data,
@@ -2751,9 +2753,14 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserRecoverAccountRequest {
+    // Legacy payload
     new_master_password_hash: Option<String>,
     key: Option<String>,
 
+    // Current payload
+    authentication_data: Option<AuthenticationData>,
+    unlock_data: Option<UnlockData>,
+
     #[serde(default)]
     reset_master_password: bool,
     #[serde(default)]
@@ -2764,8 +2771,26 @@ struct OrganizationUserRecoverAccountRequest {
 // But the clients do not seem to use this at all
 // Just add it here in case they will
 #[get("/organizations/<org_id>/public-key")]
-async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
+async fn get_organization_public_key(
-    if org_id != headers.membership.org_uuid {
+    org_id: OrganizationId,
+    headers: Headers,
+    member: Result<OrgMemberHeaders, &'static str>,
+    conn: DbConn,
+) -> JsonResult {
+    // SSO users without an org get the fake one, whose key the v2 JIT password flow fetches anyway
+    if org_id.eq_ignore_ascii_case(FAKE_SSO_IDENTIFIER) && headers.user.private_key.is_none() {
+        return Ok(Json(json!({
+            "object": "organizationPublicKey",
+            "publicKey": fake_sso_org_public_key().await?,
+        })));
+    }
+    let member = match member {
+        Ok(member) => member,
+        // The guard already logged it
+        Err(e) => return Err(crate::error::Error::new_msg(e).with_code(Status::Unauthorized.code)),
+    };
+
+    if org_id != member.membership.org_uuid {
         err!("Organization not found", "Organization id's do not match");
     }
     let Some(org) = Organization::find_by_uuid(&org_id, &conn).await else {
@@ -2778,11 +2803,30 @@ async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberH
     })))
 }
 
+/// The SDK only uses this key to wrap an account recovery key that it never sends for the fake org,
+/// so it is made once and its private half dropped.
+async fn fake_sso_org_public_key() -> ApiResult<String> {
+    static PUBLIC_KEY: std::sync::LazyLock<Option<String>> = std::sync::LazyLock::new(|| {
+        let der = openssl::rsa::Rsa::generate(2048).and_then(|rsa| rsa.public_key_to_der()).ok()?;
+        Some(data_encoding::BASE64.encode(&der))
+    });
+
+    let Ok(Some(public_key)) = tokio::task::spawn_blocking(|| PUBLIC_KEY.clone()).await else {
+        err!("Failed to generate the organization key")
+    };
+    Ok(public_key)
+}
+
 // Obsolete - Renamed to public-key (2023.8), left for backwards compatibility with older clients
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/OrganizationsController.cs#L487-L492
 #[get("/organizations/<org_id>/keys")]
-async fn get_organization_keys(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
+async fn get_organization_keys(
-    get_organization_public_key(org_id, headers, conn).await
+    org_id: OrganizationId,
+    headers: Headers,
+    member: Result<OrgMemberHeaders, &'static str>,
+    conn: DbConn,
+) -> JsonResult {
+    get_organization_public_key(org_id, headers, member, conn).await
 }
 
 // Will allow to reset 2FA too
@@ -2833,11 +2877,34 @@ async fn recover_account(
 
     let fallback_2fa_email =
         if req.reset_two_factor && CONFIG.mail_enabled() && CONFIG.email_2fa_auto_fallback() && user.verified() {
-            TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
+            TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await.is_none()
         } else {
             false
         };
 
+    // Check the new password before the email below, so that a rejected request doesn't tell the user
+    // their password was reset
+    let new_password = if req.reset_master_password {
+        let (new_master_password_hash, new_key) = if let (Some(authentication_data), Some(unlock_data)) =
+            (req.authentication_data, req.unlock_data)
+        {
+            authentication_data.check(&user, &unlock_data)?;
+
+            if !authentication_data.kdf.matches_user(&user) {
+                err!("KDF settings do not match the user account")
+            }
+
+            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
+        } else if let (Some(new_master_password_hash), Some(new_key)) = (req.new_master_password_hash, req.key) {
+            (new_master_password_hash, new_key)
+        } else {
+            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
+        };
+        Some((new_master_password_hash, new_key))
+    } else {
+        None
+    };
+
     // Sending email first ensure working email configuration and the resulting user notification.
     // Also this might add some protection against security flaws and misuse
     if let Err(e) = mail::send_admin_account_recovery(
@@ -2853,14 +2920,8 @@ async fn recover_account(
         err!(format!("Error sending user reset password email: {e:#?}"));
     }
 
-    if req.reset_master_password {
+    if let Some((new_master_password_hash, new_key)) = new_password {
-        if let Some(key) = req.key
+        user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
-            && let Some(hash) = req.new_master_password_hash
-        {
-            user.set_password(hash.as_str(), Some(key), true, None, &conn).await?;
-        } else {
-            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
-        }
     }
 
     if req.reset_two_factor {
@@ -2919,6 +2980,7 @@ async fn get_reset_password_details(
         "kdfIterations": user.client_kdf_iter,
         "kdfMemory": user.client_kdf_memory,
         "kdfParallelism": user.client_kdf_parallelism,
+        "masterPasswordSalt": user.master_password_salt(),
         "resetPasswordKey": member.reset_password_key,
         "encryptedPrivateKey": org.private_key,
     })))

src/api/core/public.rs

@@ -137,9 +137,13 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
 
     if CONFIG.org_groups_enabled() {
         for group_data in &data.groups {
-            let group_uuid = if let Some(group) =
+            let group_uuid = if let Some(mut group) =
                 Group::find_by_external_id_and_org(&group_data.external_id, &org_id, &conn).await
             {
+                if group.name != group_data.name {
+                    group.name = group_data.name.clone();
+                    group.save(&conn).await?;
+                }
                 group.uuid
             } else {
                 let mut group =

src/api/core/two_factor/authenticator.rs

@@ -3,11 +3,11 @@ use rocket::{Route, serde::json::Json};
 
 use crate::{
     api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code},
-    auth::{ClientIp, Headers},
+    auth::{ClientIp, Headers, two_factor},
     crypto,
     db::{
         DbConn,
-        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
+        models::{EventType, TwoFactor, TwoFactorType, UserId},
     },
     util::NumberOrString,
 };
@@ -20,27 +20,23 @@ pub fn routes() -> Vec<Route> {
 
 #[post("/two-factor/get-authenticator", data = "<data>")]
 async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
 
     data.validate(&user, false, &conn).await?;
 
-    let type_ = TwoFactorType::Authenticator as i32;
+    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await;
-    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await;
 
     let (enabled, key) = match twofactor {
         Some(tf) => (true, tf.data),
         _ => (false, crypto::encode_random_bytes::<20>(&BASE32)),
     };
 
-    // Upstream seems to also return `userVerificationToken`, but doesn't seem to be used at all.
-    // It should help prevent TOTP disclosure if someone keeps their vault unlocked.
-    // Since it doesn't seem to be used, and also does not cause any issues, lets leave it out of the response.
-    // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Controllers/TwoFactorController.cs#L94
     Ok(Json(json!({
-        "enabled": enabled,
+        "authenticator": json!({
-        "key": key,
+            "enabled": enabled,
-        "object": "twoFactorAuthenticator"
+            "key": key,
+        }),
+        "userVerificationToken": two_factor::authenticator_token(user.uuid, key, enabled),
     })))
 }
 
@@ -49,8 +45,7 @@ async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers,
 struct EnableAuthenticatorData {
     key: String,
     token: NumberOrString,
-    master_password_hash: Option<String>,
+    user_verification_token: String,
-    otp: Option<String>,
 }
 
 #[post("/two-factor/authenticator", data = "<data>")]
@@ -61,12 +56,7 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
 
     let mut user = headers.user;
 
-    PasswordOrOtpData {
+    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &key, false)?;
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
-    }
-    .validate(&user, true, &conn)
-    .await?;
 
     // Validate key as base32 and 20 bytes length
     let decoded_key: Vec<u8> = if let Ok(decoded) = BASE32.decode(key.as_bytes()) {
@@ -84,12 +74,13 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     Ok(Json(json!({
-        "enabled": true,
+        "authenticator": json!({
-        "key": key,
+            "enabled": true,
-        "object": "twoFactorAuthenticator"
+            "key": key,
+        }),
     })))
 }
 
@@ -125,8 +116,7 @@ pub async fn validate_totp_code(
         err!("Invalid TOTP secret")
     };
 
-    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
+    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator, conn).await {
-    {
         Some(tf) => tf,
         _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_owned()),
     };
@@ -184,37 +174,25 @@ pub async fn validate_totp_code(
 #[serde(rename_all = "camelCase")]
 struct DisableAuthenticatorData {
     key: String,
-    master_password_hash: String,
+    user_verification_token: String,
-    r#type: NumberOrString,
 }
 
 #[delete("/two-factor/authenticator", data = "<data>")]
-async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> EmptyResult {
     let user = headers.user;
-    let type_ = data.r#type.into_i32()?;
 
-    if !user.check_valid_password(&data.master_password_hash) {
+    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &data.key, true)?;
-        err!("Invalid password");
-    }
 
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await {
         if twofactor.data == data.key {
             twofactor.delete(&conn).await?;
-            Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
+            log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
-            log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
-                .await;
         } else {
             err!(format!("TOTP key for user {} does not match recorded value, cannot deactivate", &user.email));
         }
     }
 
-    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
-        super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
-    }
 
-    Ok(Json(json!({
+    Ok(())
-        "enabled": false,
-        "keys": type_,
-        "object": "twoFactorProvider"
-    })))
 }

src/api/core/two_factor/duo.rs

@@ -2,12 +2,12 @@ use chrono::Utc;
 use rocket::{Route, serde::json::Json};
 
 use crate::{
-    CONFIG,
     api::{
-        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event,
+        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData,
-        core::two_factor::generate_recover_code,
+        core::log_user_event,
+        core::two_factor::{VerificationTokenData, generate_recover_code},
     },
-    auth::Headers,
+    auth::{Headers, two_factor, two_factor::DuoData},
     crypto,
     db::{
         DbConn,
@@ -18,55 +18,7 @@ use crate::{
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![get_duo, activate_duo, activate_duo_put,]
+    routes![get_duo, activate_duo, activate_duo_put, disable_duo,]
-}
-
-#[derive(Serialize, Deserialize)]
-struct DuoData {
-    host: String, // Duo API hostname
-    ik: String,   // client id
-    sk: String,   // client secret
-}
-
-impl DuoData {
-    fn global() -> Option<Self> {
-        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
-            (true, Some(host)) => Some(Self {
-                host,
-                ik: CONFIG.duo_ikey().unwrap(),
-                sk: CONFIG.duo_skey().unwrap(),
-            }),
-            _ => None,
-        }
-    }
-    fn msg(s: &str) -> Self {
-        Self {
-            host: s.into(),
-            ik: s.into(),
-            sk: s.into(),
-        }
-    }
-    fn secret() -> Self {
-        Self::msg("<global_secret>")
-    }
-    fn obscure(self) -> Self {
-        let mut host = self.host;
-        let mut ik = self.ik;
-        let mut sk = self.sk;
-
-        let digits = 4;
-        let replaced = "************";
-
-        host.replace_range(digits.., replaced);
-        ik.replace_range(digits.., replaced);
-        sk.replace_range(digits.., replaced);
-
-        Self {
-            host,
-            ik,
-            sk,
-        }
-    }
 }
 
 enum DuoStatus {
@@ -95,22 +47,19 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
 
     data.validate(&user, false, &conn).await?;
 
-    let data = get_user_duo_data(&user.uuid, &conn).await;
+    let (enabled, duo) = match get_user_duo_data(&user.uuid, &conn).await {
-
-    let (enabled, data) = match data {
         DuoStatus::Global(_) => (true, Some(DuoData::secret())),
         DuoStatus::User(data) => (true, Some(data.obscure())),
         DuoStatus::Disabled(true) => (false, Some(DuoData::msg(DISABLED_MESSAGE_DEFAULT))),
         DuoStatus::Disabled(false) => (false, None),
     };
 
-    let json = if let Some(data) = data {
+    let duo_json = if let Some(data) = duo.as_ref() {
         json!({
             "enabled": enabled,
             "host": data.host,
             "clientSecret": data.sk,
             "clientId": data.ik,
-            "object": "twoFactorDuo"
         })
     } else {
         json!({
@@ -118,11 +67,13 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
             "host": null,
             "clientSecret": null,
             "clientId": null,
-            "object": "twoFactorDuo"
         })
     };
 
-    Ok(Json(json))
+    Ok(Json(rocket::serde::json::json!({
+        "duo": duo_json,
+        "userVerificationToken": two_factor::duo_token(user.uuid, duo, enabled),
+    })))
 }
 
 #[derive(Deserialize)]
@@ -131,8 +82,7 @@ struct EnableDuoData {
     host: String,
     client_secret: String,
     client_id: String,
-    master_password_hash: Option<String>,
+    user_verification_token: String,
-    otp: Option<String>,
 }
 
 impl From<EnableDuoData> for DuoData {
@@ -159,12 +109,7 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
     let data: EnableDuoData = data.into_inner();
     let mut user = headers.user;
 
-    PasswordOrOtpData {
+    two_factor::validate_duo(&data.user_verification_token, &user.uuid, None, false)?;
-        master_password_hash: data.master_password_hash.clone(),
-        otp: data.otp.clone(),
-    }
-    .validate(&user, true, &conn)
-    .await?;
 
     let (data, data_str) = if check_duo_fields_custom(&data) {
         let data_req: DuoData = data.into();
@@ -181,14 +126,15 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     Ok(Json(json!({
-        "enabled": true,
+        "duo": json!({
-        "host": data.host,
+            "enabled": true,
-        "clientSecret": data.sk,
+            "host": data.host,
-        "clientId": data.ik,
+            "clientSecret": data.sk,
-        "object": "twoFactorDuo"
+            "clientId": data.ik,
+        }),
     })))
 }
 
@@ -197,6 +143,29 @@ async fn activate_duo_put(data: Json<EnableDuoData>, headers: Headers, conn: DbC
     activate_duo(data, headers, conn).await
 }
 
+#[delete("/two-factor/duo", data = "<data>")]
+async fn disable_duo(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    let user = headers.user;
+
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Duo, &conn).await {
+        // Apply the same transformation than in `get_duo` to check we are disabling the correct one
+        let duo = match to_user_duo_data(&twofactor) {
+            DuoStatus::Global(_) => Some(DuoData::secret()),
+            DuoStatus::User(data) => Some(data.obscure()),
+            DuoStatus::Disabled(_) => None,
+        };
+
+        two_factor::validate_duo(&data.user_verification_token, &user.uuid, duo.as_ref(), true)?;
+
+        twofactor.delete(&conn).await?;
+        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    }
+
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+
+    Ok(())
+}
+
 async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) -> EmptyResult {
     use reqwest::{Method, header};
     use std::str::FromStr;
@@ -222,13 +191,15 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
 }
 
 async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
-    let type_ = TwoFactorType::Duo as i32;
-
     // If the user doesn't have an entry, disabled
-    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await else {
+    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Duo, conn).await else {
         return DuoStatus::Disabled(DuoData::global().is_some());
     };
 
+    to_user_duo_data(&twofactor)
+}
+
+fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
     // If the user has the required values, we use those
     if let Ok(data) = serde_json::from_str(&twofactor.data) {
         return DuoStatus::User(data);

src/api/core/two_factor/email.rs

@@ -5,20 +5,26 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{log_user_event, two_factor::generate_recover_code},
+        core::{
+            log_user_event,
+            two_factor::{VerificationTokenData, generate_recover_code},
+        },
     },
-    auth::{ClientHeaders, Headers},
+    auth::{ClientHeaders, Headers, two_factor},
     crypto,
     db::{
         DbConn,
-        models::{AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorType, User, UserId},
+        models::{
+            AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorIncomplete, TwoFactorType, User,
+            UserId,
+        },
     },
     error::{Error, MapResult},
     mail,
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![get_email, send_email_login, send_email, email,]
+    routes![get_email, send_email_login, send_email, email, disable_email]
 }
 
 #[derive(Deserialize)]
@@ -91,6 +97,20 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
             {
                 err!("AuthRequest doesn't exist", "Invalid device, IP or code")
             }
+        } else if let Some(device_identifier) = &data.device_identifier {
+            // iOS/Android SSO logins send the email and device id but no password hash,
+            // so accept a device that has a pending 2FA login for this user
+            if TwoFactorIncomplete::find_by_user_and_device(&user.uuid, device_identifier, &conn).await.is_none() {
+                err!(
+                    "Username or password is incorrect. Try again",
+                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
+                )
+            }
+            debug!(
+                "Email 2FA fallback: pending login. Username: {}. Device: {}.",
+                user.email,
+                device_identifier.to_string().escape_debug()
+            );
         } else {
             err!("No password hash has been submitted.")
         }
@@ -104,7 +124,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
         let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
             err!(
                 "Username or password is incorrect. Try again",
-                format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
+                format!("IP: {}. Device: {}.", client_headers.ip.ip, device_identifier.to_string().escape_debug())
             )
         };
 
@@ -116,8 +136,8 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
 
 /// Generate the token, save the data for later verification and send email to user
 pub async fn send_token(user_id: &UserId, conn: &DbConn) -> EmptyResult {
-    let type_ = TwoFactorType::Email as i32;
+    let mut twofactor =
-    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, type_, conn).await.map_res("Two factor not found")?;
+        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
 
     let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
 
@@ -140,18 +160,19 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
     data.validate(&user, false, &conn).await?;
 
     let (enabled, mfa_email) =
-        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await {
+        if let Some(x) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
-            Some(x) => {
+            let twofactor_data = EmailTokenData::from_json(&x.data)?;
-                let twofactor_data = EmailTokenData::from_json(&x.data)?;
+            (true, Some(twofactor_data.email))
-                (true, json!(twofactor_data.email))
+        } else {
-            }
+            (false, None)
-            _ => (false, serde_json::value::Value::Null),
         };
 
-    Ok(Json(json!({
+    Ok(Json(rocket::serde::json::json!({
-        "email": mfa_email,
+        "email": rocket::serde::json::json!({
-        "enabled": enabled,
+            "enabled": enabled,
-        "object": "twoFactorEmail"
+            "email": mfa_email,
+        }),
+        "userVerificationToken": two_factor::email_token(user.uuid, mfa_email, enabled),
     })))
 }
 
@@ -160,30 +181,22 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
 struct SendEmailData {
     /// Email where 2FA codes will be sent to, can be different than user email account.
     email: String,
-    master_password_hash: Option<String>,
+    user_verification_token: String,
-    otp: Option<String>,
 }
 
 /// Send a verification email to the specified email address to check whether it exists/belongs to user.
 #[post("/two-factor/send-email", data = "<data>")]
-async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> EmptyResult {
+async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> JsonResult {
     let data: SendEmailData = data.into_inner();
     let user = headers.user;
 
-    PasswordOrOtpData {
+    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email.clone(), false)?;
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
-    }
-    .validate(&user, false, &conn)
-    .await?;
 
     if !CONFIG._enable_email_2fa() {
         err!("Email 2FA is disabled")
     }
 
-    let type_ = TwoFactorType::Email as i32;
+    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
-
-    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
         tf.delete(&conn).await?;
     }
 
@@ -191,12 +204,13 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
     let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));
 
     // Uses EmailVerificationChallenge as type to show that it's not verified yet.
-    let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
+    let twofactor =
+        TwoFactor::new(user.uuid.clone(), TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
     twofactor.save(&conn).await?;
 
     mail::send_token(&twofactor_data.email, &twofactor_data.last_token.map_res("Token is empty")?).await?;
 
-    Ok(())
+    Ok(Json(json!({})))
 }
 
 #[derive(Deserialize, Serialize)]
@@ -204,8 +218,7 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
 struct EmailData {
     email: String,
     token: String,
-    master_password_hash: Option<String>,
+    user_verification_token: String,
-    otp: Option<String>,
 }
 
 /// Verify email belongs to user and can be used for 2FA email codes.
@@ -214,17 +227,11 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
     let data: EmailData = data.into_inner();
     let mut user = headers.user;
 
-    // This is the last step in the verification process, delete the otp directly afterwards
+    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email, false)?;
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
-    }
-    .validate(&user, true, &conn)
-    .await?;
 
-    let type_ = TwoFactorType::EmailVerificationChallenge as i32;
+    let mut twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::EmailVerificationChallenge, &conn)
-    let mut twofactor =
+        .await
-        TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await.map_res("Two factor not found")?;
+        .map_res("Two factor not found")?;
 
     let mut email_data = EmailTokenData::from_json(&twofactor.data)?;
 
@@ -243,13 +250,26 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
-    Ok(Json(json!({
+    Ok(Json(json!({})))
-        "email": email_data.email,
+}
-        "enabled": "true",
+
-        "object": "twoFactorEmail"
+#[delete("/two-factor/email", data = "<data>")]
-    })))
+async fn disable_email(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    let user = headers.user;
+
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+        let twofactor_data = EmailTokenData::from_json(&twofactor.data)?;
+        two_factor::validate_email(&data.user_verification_token, &user.uuid, twofactor_data.email, true)?;
+
+        twofactor.delete(&conn).await?;
+        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    }
+
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+
+    Ok(())
 }
 
 /// Validate the email code when used as TwoFactor token mechanism
@@ -261,9 +281,8 @@ pub async fn validate_email_code_str(
     conn: &DbConn,
 ) -> EmptyResult {
     let mut email_data = EmailTokenData::from_json(data)?;
-    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email as i32, conn)
+    let mut twofactor =
-        .await
+        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
-        .map_res("Two factor not found")?;
     let Some(issued_token) = &email_data.last_token else {
         err!(
             format!("No token available! IP: {ip}"),

src/api/core/two_factor/mod.rs

@@ -7,10 +7,7 @@ use serde_json::Value;
 
 use crate::{
     CONFIG,
-    api::{
+    api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_event},
-        EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{log_event, log_user_event},
-    },
     auth::Headers,
     crypto,
     db::{
@@ -21,7 +18,6 @@ use crate::{
         },
     },
     mail,
-    util::NumberOrString,
 };
 
 pub mod authenticator;
@@ -69,7 +65,7 @@ pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data
 }
 
 pub fn routes() -> Vec<Route> {
-    let mut routes = routes![get_twofactor, get_recover, disable_twofactor, get_device_verification_settings];
+    let mut routes = routes![get_twofactor, get_recover, get_device_verification_settings];
 
     routes.append(&mut authenticator::routes());
     routes.append(&mut duo::routes());
@@ -81,6 +77,12 @@ pub fn routes() -> Vec<Route> {
     routes
 }
 
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct VerificationTokenData {
+    user_verification_token: String,
+}
+
 #[get("/two-factor")]
 async fn get_twofactor(headers: Headers, conn: DbConn) -> Json<Value> {
     let twofactors = TwoFactor::find_by_user(&headers.user.uuid, &conn).await;
@@ -120,45 +122,14 @@ async fn generate_recover_code(user: &mut User, conn: &DbConn) {
     }
 }
 
-#[derive(Deserialize)]
+/// Call after a 2FA provider, or one of its keys, was removed. No remembered device may keep skipping
-#[serde(rename_all = "camelCase")]
+/// the providers that are left, and once every provider is gone the 2FA policy applies.
-struct DisableTwoFactorData {
+pub async fn check_2fa_state(user: &User, device_type: i32, ip: &std::net::IpAddr, conn: &DbConn) -> EmptyResult {
-    master_password_hash: Option<String>,
+    Device::clear_twofactor_remember_by_user(&user.uuid, conn).await?;
-    otp: Option<String>,
+    if TwoFactor::find_by_user(&user.uuid, conn).await.is_empty() {
-    r#type: NumberOrString,
+        enforce_2fa_policy(user, &user.uuid, device_type, ip, conn).await?;
-}
-
-#[put("/two-factor/disable", data = "<data>")]
-async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: DisableTwoFactorData = data.into_inner();
-    let user = headers.user;
-
-    // Delete directly after a valid token has been provided
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
     }
-    .validate(&user, true, &conn)
+    Ok(())
-    .await?;
-
-    let type_ = data.r#type.into_i32()?;
-
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
-        twofactor.delete(&conn).await?;
-        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
-        log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
-            .await;
-    }
-
-    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
-        enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
-    }
-
-    Ok(Json(json!({
-        "enabled": false,
-        "type": type_,
-        "object": "twoFactorProvider"
-    })))
 }
 
 pub async fn enforce_2fa_policy(

src/api/core/two_factor/protected_actions.rs

@@ -72,8 +72,7 @@ async fn request_otp(headers: Headers, conn: DbConn) -> EmptyResult {
     let user = headers.user;
 
     // Only one Protected Action per user is allowed to take place, delete the previous one
-    if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions as i32, &conn).await
+    if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions, &conn).await {
-    {
         let pa_data = ProtectedActionData::from_json(&pa.data)?;
         let elapsed = pa_data.time_since_sent().num_seconds();
         let delay = 30;
@@ -125,7 +124,7 @@ pub async fn validate_protected_action_otp(
     delete_if_valid: bool,
     conn: &DbConn,
 ) -> EmptyResult {
-    let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions as i32, conn)
+    let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions, conn)
         .await
         .map_res("Protected action token not found, try sending the code again or restart the process")?;
     let mut pa_data = ProtectedActionData::from_json(&pa.data)?;

src/api/core/two_factor/webauthn.rs

@@ -1,4 +1,4 @@
-use std::{str::FromStr, sync::LazyLock, time::Duration};
+use std::{collections::HashSet, str::FromStr, sync::LazyLock, time::Duration};
 
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
@@ -18,16 +18,18 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{log_user_event, two_factor::generate_recover_code},
+        core::{
+            log_user_event,
+            two_factor::{VerificationTokenData, generate_recover_code},
+        },
     },
-    auth::Headers,
+    auth::{Headers, two_factor},
     crypto::ct_eq,
     db::{
         DbConn,
-        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
+        models::{EventType, TwoFactor, TwoFactorType, UserId},
     },
     error::Error,
-    util::NumberOrString,
 };
 
 static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
@@ -45,7 +47,14 @@ static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
 });
 
 pub fn routes() -> Vec<Route> {
-    routes![get_webauthn, generate_webauthn_challenge, activate_webauthn, activate_webauthn_put, delete_webauthn,]
+    routes![
+        get_webauthn,
+        generate_webauthn_challenge,
+        activate_webauthn,
+        activate_webauthn_put,
+        delete_webauthn,
+        delete_webauthns
+    ]
 }
 
 // Some old u2f structs still needed for migrating from u2f to WebAuthn
@@ -119,34 +128,36 @@ async fn get_webauthn(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbC
     data.validate(&user, false, &conn).await?;
 
     let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
+    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
     let registrations_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect();
 
     Ok(Json(json!({
-        "enabled": enabled,
+        "webAuthn": json!({
-        "keys": registrations_json,
+            "enabled": enabled,
-        "object": "twoFactorWebAuthn"
+            "keys": registrations_json,
+        }),
+        "userVerificationToken": two_factor::webauthn_token(user.uuid, keys, enabled),
     })))
 }
 
 #[post("/two-factor/get-webauthn-challenge", data = "<data>")]
-async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn generate_webauthn_challenge(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
 
-    data.validate(&user, false, &conn).await?;
+    let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
-
+    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
-    let registrations = get_webauthn_registrations(&user.uuid, &conn)
+    let creds = registrations
-        .await?
-        .1
         .into_iter()
         .map(|r| r.credential.cred_id().to_owned()) // We return the credentialIds to the clients to avoid double registering
         .collect();
 
+    two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, enabled)?;
+
     let (mut challenge, state) = WEBAUTHN.start_passkey_registration(
         Uuid::from_str(&user.uuid).expect("Failed to parse UUID"), // Should never fail
         &user.email,
         user.display_name(),
-        Some(registrations),
+        Some(creds),
     )?;
 
     let mut state = serde_json::to_value(&state)?;
@@ -166,17 +177,19 @@ async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Hea
     let mut challenge_value = serde_json::to_value(challenge.public_key)?;
     challenge_value["status"] = "ok".into();
     challenge_value["errorMessage"] = "".into();
-    Ok(Json(challenge_value))
+
+    Ok(Json(json!({
+        "options": challenge_value
+    })))
 }
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EnableWebauthnData {
-    id: NumberOrString, // 1..5
+    id: i32,
     name: String,
     device_response: RegisterPublicKeyCredentialCopy,
-    master_password_hash: Option<String>,
+    user_verification_token: String,
-    otp: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -257,16 +270,14 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
     let data: EnableWebauthnData = data.into_inner();
     let mut user = headers.user;
 
-    PasswordOrOtpData {
+    let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
-        master_password_hash: data.master_password_hash,
+    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
-        otp: data.otp,
+    two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, !keys.is_empty())?;
-    }
-    .validate(&user, true, &conn)
-    .await?;
 
     // Retrieve and delete the saved challenge state
-    let type_ = TwoFactorType::WebauthnRegisterChallenge as i32;
+    let state = if let Some(tf) =
-    let state = if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
+        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::WebauthnRegisterChallenge, &conn).await
+    {
         let state: PasskeyRegistration = serde_json::from_str(&tf.data)?;
         tf.delete(&conn).await?;
         state
@@ -277,10 +288,9 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
     // Verify the credentials with the saved state
     let credential = WEBAUTHN.finish_passkey_registration(&data.device_response.into(), &state)?;
 
-    let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
     // TODO: Check for repeated ID's
     registrations.push(WebauthnRegistration {
-        id: data.id.into_i32()?,
+        id: data.id,
         name: data.name,
         migrated: false,
 
@@ -293,13 +303,13 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
         .await?;
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
-    let keys_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect();
     Ok(Json(json!({
-        "enabled": true,
+        "webAuthn": json!({
-        "keys": keys_json,
+            "enabled": true,
-        "object": "twoFactorU2f"
+            "keys": registrations.iter().map(WebauthnRegistration::to_json).collect::<Vec<Value>>(),
+        }),
     })))
 }
 
@@ -310,58 +320,87 @@ async fn activate_webauthn_put(data: Json<EnableWebauthnData>, headers: Headers,
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct DeleteU2FData {
+struct DeleteWebauthnData {
-    id: NumberOrString,
+    id: i32,
-    master_password_hash: String,
+    user_verification_token: String,
 }
 
 #[delete("/two-factor/webauthn", data = "<data>")]
-async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn delete_webauthn(data: Json<DeleteWebauthnData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let id = data.id.into_i32()?;
+    inner_delete_webauthns(&data.user_verification_token, |key| key.id != data.id, headers, &conn).await
-    if !headers.user.check_valid_password(&data.master_password_hash) {
+}
-        err!("Invalid password");
-    }
 
-    let Some(mut tf) =
+#[delete("/two-factor/webauthn/all", data = "<data>")]
-        TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &conn).await
+async fn delete_webauthns(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> JsonResult {
-    else {
+    inner_delete_webauthns(&data.user_verification_token, |_| false, headers, &conn).await
+}
+
+async fn inner_delete_webauthns(
+    token: &str,
+    retain: impl Fn(&WebauthnRegistration) -> bool,
+    headers: Headers,
+    conn: &DbConn,
+) -> JsonResult {
+    let user = headers.user;
+
+    let Some(mut tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Webauthn, conn).await else {
         err!("Webauthn data not found!")
     };
 
-    let mut data: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;
+    let mut keys: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;
+    let keys_id: Vec<i32> = keys.iter().map(|r| r.id).collect();
 
-    let Some(item_pos) = data.iter().position(|r| r.id == id) else {
+    two_factor::validate_webauthn(token, &user.uuid, &keys_id, true)?;
+
+    let mut removed: HashSet<Vec<u8>> = HashSet::new();
+    let mut migrated = false;
+
+    keys.retain(|key| {
+        let retained = retain(key);
+        if !retained {
+            removed.insert(key.credential.cred_id().to_vec());
+            migrated = migrated || key.migrated;
+        }
+        retained
+    });
+
+    if removed.is_empty() {
         err!("Webauthn entry not found")
-    };
+    }
 
-    let removed_item = data.remove(item_pos);
+    if keys.is_empty() {
-    tf.data = serde_json::to_string(&data)?;
+        tf.delete(conn).await?;
-    tf.save(&conn).await?;
+        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, conn).await;
-    drop(tf);
+    } else {
-    Device::clear_twofactor_remember_by_user(&headers.user.uuid, &conn).await?;
+        tf.data = serde_json::to_string(&keys)?;
+        tf.save(conn).await?;
+        drop(tf);
+    }
 
     // If entry is migrated from u2f, delete the u2f entry as well
-    if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await
+    if migrated && let Some(mut u2f) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::U2f, conn).await {
-    {
+        let Ok(mut data) = serde_json::from_str::<Vec<U2FRegistration>>(&u2f.data) else {
-        let mut data: Vec<U2FRegistration> = if let Ok(d) = serde_json::from_str(&u2f.data) {
-            d
-        } else {
             err!("Error parsing U2F data")
         };
 
-        data.retain(|r| r.reg.key_handle != removed_item.credential.cred_id().as_slice());
+        data.retain(|old| !removed.contains(&old.reg.key_handle));
-        let new_data_str = serde_json::to_string(&data)?;
 
-        u2f.data = new_data_str;
+        if data.is_empty() {
-        u2f.save(&conn).await?;
+            u2f.delete(conn).await?;
+        } else {
+            let new_data_str = serde_json::to_string(&data)?;
+            u2f.data = new_data_str;
+            u2f.save(conn).await?;
+        }
     }
 
-    let keys_json: Vec<Value> = data.iter().map(WebauthnRegistration::to_json).collect();
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, conn).await?;
 
     Ok(Json(json!({
-        "enabled": true,
+        "webAuthn": json!({
-        "keys": keys_json,
+            "enabled": !keys.is_empty(),
-        "object": "twoFactorU2f"
+            "keys": keys.iter().map(WebauthnRegistration::to_json).collect::<Vec<Value>>(),
+        }),
     })))
 }
 
@@ -369,8 +408,7 @@ pub async fn get_webauthn_registrations(
     user_id: &UserId,
     conn: &DbConn,
 ) -> Result<(bool, Vec<WebauthnRegistration>), Error> {
-    let type_ = TwoFactorType::Webauthn as i32;
+    match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Webauthn, conn).await {
-    match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
         Some(tf) => Ok((tf.enabled, serde_json::from_str(&tf.data)?)),
         None => Ok((false, Vec::new())), // If no data, return empty list
     }
@@ -417,8 +455,9 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &DbConn) -> JsonRes
 }
 
 pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &DbConn) -> EmptyResult {
-    let type_ = TwoFactorType::WebauthnLoginChallenge as i32;
+    let mut state = if let Some(tf) =
-    let mut state = if let Some(tf) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
+        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::WebauthnLoginChallenge, conn).await
+    {
         let state: PasskeyAuthentication = serde_json::from_str(&tf.data)?;
         tf.delete(conn).await?;
         state

src/api/core/two_factor/yubikey.rs

@@ -10,9 +10,12 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{log_user_event, two_factor::generate_recover_code},
+        core::{
+            log_user_event,
+            two_factor::{VerificationTokenData, generate_recover_code},
+        },
     },
-    auth::Headers,
+    auth::{Headers, two_factor},
     db::{
         DbConn,
         models::{EventType, TwoFactor, TwoFactorType},
@@ -22,7 +25,7 @@ use crate::{
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
+    routes![generate_yubikey, activate_yubikey, activate_yubikey_put, delete_yubikeys,]
 }
 
 struct HttpClientTransport {
@@ -60,8 +63,7 @@ struct EnableYubikeyData {
     key4: Option<String>,
     key5: Option<String>,
     nfc: bool,
-    master_password_hash: Option<String>,
+    user_verification_token: String,
-    otp: Option<String>,
 }
 
 #[derive(Deserialize, Serialize, Debug)]
@@ -125,48 +127,29 @@ async fn generate_yubikey(data: Json<PasswordOrOtpData>, headers: Headers, conn:
     data.validate(&user, false, &conn).await?;
 
     let user_id = &user.uuid;
-    let yubikey_type = TwoFactorType::YubiKey as i32;
 
-    let r = TwoFactor::find_by_user_and_type(user_id, yubikey_type, &conn).await;
+    let (enabled, keys, yubikey_json) =
-
+        if let Some(r) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::YubiKey, &conn).await {
-    if let Some(r) = r {
+            let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
-        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
+            let enabled = !yubikey_metadata.keys.is_empty();
-
+            let mut result = jsonify_yubikeys(yubikey_metadata.keys.clone());
-        let mut result = jsonify_yubikeys(yubikey_metadata.keys);
+            result["enabled"] = Value::Bool(enabled);
-
+            result["nfc"] = Value::Bool(yubikey_metadata.nfc);
-        result["enabled"] = Value::Bool(true);
+            (enabled, yubikey_metadata.keys, result)
-        result["nfc"] = Value::Bool(yubikey_metadata.nfc);
+        } else {
-        result["object"] = Value::String("twoFactorU2f".to_owned());
+            (false, Vec::new(), json!({"enabled": false}))
-
+        };
-        Ok(Json(result))
+    Ok(Json(json!({
-    } else {
+        "yubiKey": yubikey_json,
-        Ok(Json(json!({
+        "userVerificationToken": two_factor::yubikey_token(user.uuid, keys, enabled),
-            "enabled": false,
+    })))
-            "object": "twoFactorU2f",
-        })))
-    }
 }
 
 #[post("/two-factor/yubikey", data = "<data>")]
 async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn: DbConn) -> JsonResult {
     let data: EnableYubikeyData = data.into_inner();
-    let mut user = headers.user;
-
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash.clone(),
-        otp: data.otp.clone(),
-    }
-    .validate(&user, true, &conn)
-    .await?;
-
-    // Check if we already have some data
-    let mut yubikey_data =
-        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey as i32, &conn).await {
-            Some(data) => data,
-            None => TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new()),
-        };
-
     let yubikeys = parse_yubikeys(&data);
+    let mut user = headers.user;
 
     if yubikeys.is_empty() {
         // Return an error to prevent saving empty keys which would cause users not being able to login anymore.
@@ -174,6 +157,17 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
         err!("A key is required.");
     }
 
+    // Check if we already have some data
+    let mut yubikey_data =
+        if let Some(yd) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
+            let ym: YubikeyMetadata = serde_json::from_str(&yd.data)?;
+            two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &ym.keys, !ym.keys.is_empty())?;
+            yd
+        } else {
+            two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &Vec::new(), false)?;
+            TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new())
+        };
+
     // Ensure they are valid OTPs
     for yubikey in &yubikeys {
         if yubikey.is_empty() || yubikey.len() == 12 {
@@ -195,15 +189,12 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     let mut result = jsonify_yubikeys(yubikey_metadata.keys);
-
     result["enabled"] = Value::Bool(true);
     result["nfc"] = Value::Bool(yubikey_metadata.nfc);
-    result["object"] = Value::String("twoFactorU2f".to_owned());
+    Ok(Json(json!({"yubiKey": result})))
-
-    Ok(Json(result))
 }
 
 #[put("/two-factor/yubikey", data = "<data>")]
@@ -211,6 +202,23 @@ async fn activate_yubikey_put(data: Json<EnableYubikeyData>, headers: Headers, c
     activate_yubikey(data, headers, conn).await
 }
 
+#[delete("/two-factor/yubikey", data = "<data>")]
+async fn delete_yubikeys(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    let user = headers.user;
+
+    if let Some(r) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
+        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
+        two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &yubikey_metadata.keys, true)?;
+
+        r.delete(&conn).await?;
+        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    }
+
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+
+    Ok(())
+}
+
 pub async fn validate_yubikey_login(response: &str, twofactor_data: &str) -> EmptyResult {
     if response.len() != 44 {
         err!("Invalid Yubikey OTP length");

src/api/identity.rs

@@ -118,7 +118,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
         match &login_result {
             Ok(_) => {
                 log_user_event(
-                    EventType::UserLoggedIn as i32,
+                    EventType::UserLoggedIn,
                     &user_id,
                     client_header.device_type,
                     &client_header.ip.ip,
@@ -128,8 +128,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
             }
             Err(e) => {
                 if let Some(ev) = e.get_event() {
-                    log_user_event(ev.event as i32, &user_id, client_header.device_type, &client_header.ip.ip, &conn)
+                    log_user_event(ev.event, &user_id, client_header.device_type, &client_header.ip.ip, &conn).await;
-                        .await;
                 }
             }
         }
@@ -882,7 +881,7 @@ async fn twofactor_auth(
 
             enforce_2fa_policy(user, &user.uuid, device.atype, &ip.ip, conn).await?;
 
-            log_user_event(EventType::UserRecovered2fa as i32, &user.uuid, device.atype, &ip.ip, conn).await;
+            log_user_event(EventType::UserRecovered2fa, &user.uuid, device.atype, &ip.ip, conn).await;
 
             if CONFIG.mail_enabled()
                 && let Err(e) =
@@ -952,7 +951,7 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
             }
 
             Some(tf_type @ TwoFactorType::YubiKey) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
+                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
                     err!("No YubiKey devices registered")
                 };
 
@@ -964,7 +963,7 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
             }
 
             Some(tf_type @ TwoFactorType::Email) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
+                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
                     err!("No twofactor email registered")
                 };
 

src/api/mod.rs

@@ -46,7 +46,7 @@ pub type JsonResult = ApiResult<Json<Value>>;
 pub type EmptyResult = ApiResult<()>;
 
 // Common structs representing JSON data received
-#[derive(Deserialize)]
+#[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct PasswordOrOtpData {
     #[serde(alias = "MasterPasswordHash")]

src/api/notifications.rs

@@ -1,7 +1,7 @@
 use std::{
     net::IpAddr,
     sync::{Arc, LazyLock},
-    time::Duration,
+    time::{Duration, Instant},
 };
 
 use chrono::{NaiveDateTime, Utc};
@@ -41,6 +41,14 @@ pub static WS_ANONYMOUS_SUBSCRIPTIONS: LazyLock<Arc<AnonymousWebSocketSubscripti
 /// One connection is needed per pending login request, several at once are only expected behind NAT.
 const MAX_ANONYMOUS_CONNECTIONS_PER_IP: u32 = 25;
 
+/// How often a Ping is sent to the client.
+const WS_PING_INTERVAL: Duration = Duration::from_secs(15);
+
+/// Close the connection if nothing, not even a Pong, was received from the client for this long.
+/// Otherwise half-open connections (client gone without a FIN, e.g. behind a proxy or NAT) are kept forever.
+/// Same as the default `ClientTimeoutInterval` of ASP.NET Core SignalR, which the official server uses.
+const WS_CLIENT_TIMEOUT: Duration = Duration::from_secs(30);
+
 static NOTIFICATIONS_DISABLED: LazyLock<bool> = LazyLock::new(|| !CONFIG.enable_websocket() && !CONFIG.push_enabled());
 
 pub fn routes() -> Vec<Route> {
@@ -156,12 +164,16 @@ fn websockets_hub<'r>(
         rocket_ws::Stream! { ws => {
             let mut ws = ws;
             let _guard = guard;
-            let mut interval = tokio::time::interval(Duration::from_secs(15));
+            let mut interval = tokio::time::interval(WS_PING_INTERVAL);
+            let mut last_received = Instant::now();
             loop {
                 tokio::select! {
                     res = ws.next() =>  {
                         match res {
                             Some(Ok(message)) => {
+                                // Any message, including a Pong, means the client is still there
+                                last_received = Instant::now();
+
                                 match message {
                                     // Respond to any pings
                                     Message::Ping(ping) => yield Message::Pong(ping),
@@ -195,7 +207,13 @@ fn websockets_hub<'r>(
                         }
                     }
 
-                    _ = interval.tick() => yield Message::Ping(create_ping())
+                    _ = interval.tick() => {
+                        // The client stopped responding without closing the connection, drop it
+                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
+                            break;
+                        }
+                        yield Message::Ping(create_ping());
+                    }
                 }
             }
         }}
@@ -229,12 +247,16 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
         rocket_ws::Stream! { ws => {
             let mut ws = ws;
             let _guard = guard;
-            let mut interval = tokio::time::interval(Duration::from_secs(15));
+            let mut interval = tokio::time::interval(WS_PING_INTERVAL);
+            let mut last_received = Instant::now();
             loop {
                 tokio::select! {
                     res = ws.next() =>  {
                         match res {
                             Some(Ok(message)) => {
+                                // Any message, including a Pong, means the client is still there
+                                last_received = Instant::now();
+
                                 match message {
                                     // Respond to any pings
                                     Message::Ping(ping) => yield Message::Pong(ping),
@@ -268,7 +290,13 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
                         }
                     }
 
-                    _ = interval.tick() => yield Message::Ping(create_ping())
+                    _ = interval.tick() => {
+                        // The client stopped responding without closing the connection, drop it
+                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
+                            break;
+                        }
+                        yield Message::Ping(create_ping());
+                    }
                 }
             }
         }}

src/auth.rs

@@ -1,3 +1,6 @@
+#[path = "auth/two_factor.rs"]
+pub mod two_factor;
+
 #[path = "auth/send.rs"]
 pub mod send;
 pub type SendTokens = send::SendTokens;

src/auth/two_factor.rs

@@ -0,0 +1,281 @@
+use chrono::{TimeDelta, Utc};
+use serde::{de::DeserializeOwned, ser::Serialize};
+use std::sync::LazyLock;
+
+use crate::{
+    CONFIG,
+    api::{ApiResult, EmptyResult},
+    auth::{decode_jwt, encode_jwt},
+    db::models::UserId,
+};
+
+static JWT_2FA_AUTH_ISSUER: LazyLock<String> = LazyLock::new(|| format!("{}|api.2fa", CONFIG.domain_origin()));
+
+#[derive(Serialize, Deserialize)]
+pub struct TwoFactorClaims<T> {
+    // Not before
+    pub nbf: i64,
+    // Expiration time
+    pub exp: i64,
+    // Issuer
+    pub iss: String,
+    // Subject
+    pub sub: UserId,
+
+    pub enabled: bool,
+
+    pub claims: T,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AuthenticatorClaims {
+    #[serde(rename = "authenticator_key")]
+    pub key: String,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct DuoClaims {
+    #[serde(rename = "duo_data")]
+    pub data: Option<DuoData>,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WebauthnClaims {
+    #[serde(rename = "webauthn_keys")]
+    pub keys: Vec<i32>,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct YubikeyClaims {
+    #[serde(rename = "yubi_keys")]
+    pub keys: Vec<String>,
+}
+
+#[derive(Serialize, Deserialize, PartialEq)]
+pub struct DuoData {
+    pub host: String, // Duo API hostname
+    pub ik: String,   // client id
+    pub sk: String,   // client secret
+}
+
+impl DuoData {
+    pub fn global() -> Option<Self> {
+        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
+            (true, Some(host)) => Some(Self {
+                host,
+                ik: CONFIG.duo_ikey().unwrap(),
+                sk: CONFIG.duo_skey().unwrap(),
+            }),
+            _ => None,
+        }
+    }
+    pub fn msg(s: &str) -> Self {
+        Self {
+            host: s.into(),
+            ik: s.into(),
+            sk: s.into(),
+        }
+    }
+    pub fn secret() -> Self {
+        Self::msg("<global_secret>")
+    }
+    pub fn obscure(self) -> Self {
+        let mut host = self.host;
+        let mut ik = self.ik;
+        let mut sk = self.sk;
+
+        let digits = 4;
+        let replaced = "************";
+
+        host.replace_range(digits.., replaced);
+        ik.replace_range(digits.., replaced);
+        sk.replace_range(digits.., replaced);
+
+        Self {
+            host,
+            ik,
+            sk,
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EmailClaims {
+    pub email: Option<String>,
+}
+
+fn token<T: Serialize>(user_id: UserId, enabled: bool, claims: T) -> String {
+    let time_now = Utc::now();
+    let claims = TwoFactorClaims {
+        nbf: time_now.timestamp(),
+        exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
+        iss: JWT_2FA_AUTH_ISSUER.to_string(),
+        sub: user_id,
+        enabled,
+        claims,
+    };
+    encode_jwt(&claims)
+}
+
+fn validate<T: DeserializeOwned>(token: &str, user_id: &UserId, enabled: bool) -> ApiResult<T> {
+    match decode_jwt::<TwoFactorClaims<T>>(token, JWT_2FA_AUTH_ISSUER.to_string()) {
+        Ok(claims) => {
+            if claims.sub != *user_id {
+                err!("Invalid verification token: Invalid user");
+            }
+            if claims.enabled != enabled {
+                err!("Invalid verification token: Invalid state");
+            }
+            Ok(claims.claims)
+        }
+        Err(err) => err!(format!("Failed to decode verification token: {err}")),
+    }
+}
+
+pub fn authenticator_token(user_id: UserId, key: String, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        AuthenticatorClaims {
+            key,
+        },
+    )
+}
+
+pub fn validate_authenticator(token: &str, user_id: &UserId, key: &str, enabled: bool) -> EmptyResult {
+    let claims = validate::<AuthenticatorClaims>(token, user_id, enabled)?;
+    if claims.key != key {
+        err!("Invalid verification token: Invalid key");
+    }
+    Ok(())
+}
+
+pub fn duo_token(user_id: UserId, data: Option<DuoData>, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        DuoClaims {
+            data,
+        },
+    )
+}
+
+// When disabling we check that it's the correct data
+pub fn validate_duo(token: &str, user_id: &UserId, data: Option<&DuoData>, enabled: bool) -> EmptyResult {
+    let claims = validate::<DuoClaims>(token, user_id, enabled)?;
+    if enabled && claims.data.as_ref() != data {
+        err!("Invalid verification token: Invalid duo data");
+    }
+    Ok(())
+}
+
+pub fn email_token(user_id: UserId, email: Option<String>, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        EmailClaims {
+            email,
+        },
+    )
+}
+
+// When disabling we check that it's the correct `email`
+pub fn validate_email(token: &str, user_id: &UserId, email: String, enabled: bool) -> EmptyResult {
+    let claims = validate::<EmailClaims>(token, user_id, enabled)?;
+    if enabled && claims.email != Some(email) {
+        err!("Invalid verification token: Invalid email");
+    }
+    Ok(())
+}
+
+pub fn webauthn_token(user_id: UserId, keys: Vec<i32>, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        WebauthnClaims {
+            keys,
+        },
+    )
+}
+
+pub fn validate_webauthn(token: &str, user_id: &UserId, keys: &[i32], enabled: bool) -> EmptyResult {
+    let claims = validate::<WebauthnClaims>(token, user_id, enabled)?;
+    if keys != claims.keys {
+        err!("Invalid verification token: Invalid keys");
+    }
+    Ok(())
+}
+
+pub fn yubikey_token(user_id: UserId, keys: Vec<String>, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        YubikeyClaims {
+            keys,
+        },
+    )
+}
+
+pub fn validate_yubikey(token: &str, user_id: &UserId, keys: &Vec<String>, enabled: bool) -> EmptyResult {
+    let claims = validate::<YubikeyClaims>(token, user_id, enabled)?;
+    if *keys != claims.keys {
+        err!("Invalid verification token: Invalid keys");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{Value, from_value, to_value};
+
+    fn token<T: Serialize>(claims: T) -> Value {
+        to_value(TwoFactorClaims {
+            nbf: 0,
+            exp: 0,
+            iss: String::new(),
+            sub: UserId::from(String::from("4ff0f0a4-0aa4-4c1d-9d43-1f2bd4d5e8b1")),
+            enabled: false,
+            claims,
+        })
+        .unwrap()
+    }
+
+    #[test]
+    fn claims_only_parse_as_their_own_provider() {
+        let tokens = [
+            token(AuthenticatorClaims {
+                key: String::from("JBSWY3DPEHPK3PXP"),
+            }),
+            token(DuoClaims {
+                data: None,
+            }),
+            token(WebauthnClaims {
+                keys: vec![1],
+            }),
+            token(YubikeyClaims {
+                keys: Vec::new(),
+            }),
+            token(EmailClaims {
+                email: None,
+            }),
+        ];
+        for (issued, token) in tokens.iter().enumerate() {
+            let parsed = [
+                from_value::<TwoFactorClaims<AuthenticatorClaims>>(token.clone()).is_ok(),
+                from_value::<TwoFactorClaims<DuoClaims>>(token.clone()).is_ok(),
+                from_value::<TwoFactorClaims<WebauthnClaims>>(token.clone()).is_ok(),
+                from_value::<TwoFactorClaims<YubikeyClaims>>(token.clone()).is_ok(),
+                from_value::<TwoFactorClaims<EmailClaims>>(token.clone()).is_ok(),
+            ];
+            for (checked, ok) in parsed.into_iter().enumerate() {
+                assert_eq!(ok, issued == checked, "token {issued} parsed as {checked}");
+            }
+        }
+    }
+}

src/config.rs

@@ -1266,6 +1266,14 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         err!("`AUTH_REQUEST_PURGE_SCHEDULE` is not a valid cron expression")
     }
 
+    if !cfg.duo_context_purge_schedule.is_empty() && cfg.duo_context_purge_schedule.parse::<Schedule>().is_err() {
+        err!("`DUO_CONTEXT_PURGE_SCHEDULE` is not a valid cron expression")
+    }
+
+    if !cfg.purge_incomplete_sso_auth.is_empty() && cfg.purge_incomplete_sso_auth.parse::<Schedule>().is_err() {
+        err!("`PURGE_INCOMPLETE_SSO_AUTH` is not a valid cron expression")
+    }
+
     if !cfg.disable_admin_token {
         match cfg.admin_token.as_ref() {
             Some(t) if t.starts_with("$argon2") => {
@@ -1422,10 +1430,13 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     "undetermined-cipher-scenario-logic",
     "enable-basic-auth-response",
     "ssh-agent-v2",
+    "windows-desktop-autotype",
+    "windows-desktop-autotype-ga",
     // Key Management Team
+    "biometrics-sdk-ipc",
     "windows-native-credential-sync",
-    "pm-27278-v2-password-registration",
     "enable-account-encryption-v2-jit-password-registration",
+    "pm-27278-v2-password-registration",
     // Mobile Team
     "pm-34171-card-scanner",
     // Platform Team

src/db/models/cipher.rs

@@ -19,7 +19,7 @@ use crate::{
         },
     },
     error::MapResult,
-    util::LowerCase,
+    util::{LowerCase, convert_json_key_lcase_first},
 };
 use macros::UuidFromParam;
 
@@ -63,13 +63,9 @@ pub struct Cipher {
     pub reprompt: Option<i32>,
 }
 
-/// Whether `data` is a sealed cipher blob rather than the legacy per-type JSON.
+/// Whether `data` is a v2 cipher blob, recognized like upstream by a top-level `format_version` key.
 ///
-/// Ciphers of v2 accounts are encrypted as a single blob that carries everything, name included,
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Vault/Entities/Cipher.cs#L36-L41>
-/// and is opaque to us. It is recognized the same way upstream does, by a top-level
-/// `format_version` key that the legacy JSON never has.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Vault/Entities/Cipher.cs>
 pub fn is_data_blob_encrypted(data: &str) -> bool {
     serde_json::from_str::<Value>(data).is_ok_and(|d| is_blob_value(&d))
 }
@@ -86,7 +82,8 @@ pub enum RepromptType {
 
 /// Local methods
 impl Cipher {
-    pub fn new(atype: i32, name: String) -> Self {
+    /// The name is set when the data is saved, since a blob-encrypted cipher has it inside `data`
+    pub fn new(atype: i32) -> Self {
         let now = Utc::now().naive_utc();
 
         Self {
@@ -100,7 +97,7 @@ impl Cipher {
             key: None,
 
             atype,
-            name,
+            name: String::new(),
 
             notes: None,
             fields: None,
@@ -175,9 +172,8 @@ impl Cipher {
     ) -> Result<Value, crate::Error> {
         use crate::util::{format_date, validate_and_format_date};
 
-        // Parsed once here, since `data` can be large and this runs for every cipher in a sync.
+        // Parsed once, since `data` can be large and this runs for every cipher in a sync
-        // `LowerCase` only lowercases the first letter of each key, so it keeps `format_version`.
+        let type_data = serde_json::from_str::<Value>(&self.data);
-        let type_data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data);
         let is_blob_encrypted = type_data.as_ref().is_ok_and(is_blob_value);
 
         let mut attachments_json: Value = Value::Null;
@@ -215,62 +211,70 @@ impl Cipher {
             (false, false, false)
         };
 
-        // Like upstream, a cipher that was stored without fields or password history reports them as
+        let fields_json: Vec<_> = self
-        // null rather than as an empty list; clients keep the two apart.
+            .fields
-        let fields_json: Option<Vec<_>> = self.fields.as_ref().map(|s| {
+            .as_ref()
-            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+            .and_then(|s| {
-                .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
+                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                .ok()
+                    .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
-                .map(|d| {
+                    .ok()
-                    d.into_iter()
+            })
-                        .map(|mut f| {
+            .map(|d| {
-                            // Check if the `type` key is a number, strings break some clients
+                d.into_iter()
-                            // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
+                    .map(|mut f| {
-                            // If not try to convert the string value to a number and fallback to `1`
+                        // Check if the `type` key is a number, strings break some clients
-                            // If it is both not a number and not a string, fallback to `1`
+                        // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
-                            match f.data.get("type") {
+                        // If not try to convert the string value to a number and fallback to `1`
-                                Some(t) if t.is_number() => {}
+                        // If it is both not a number and not a string, fallback to `1`
-                                Some(t) if t.is_string() => {
+                        match f.data.get("type") {
-                                    let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
+                            Some(t) if t.is_number() => {}
-                                    f.data["type"] = json!(type_num);
+                            Some(t) if t.is_string() => {
-                                }
+                                let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
-                                _ => {
+                                f.data["type"] = json!(type_num);
-                                    f.data["type"] = json!(1);
-                                }
                             }
-                            f.data
+                            _ => {
-                        })
+                                f.data["type"] = json!(1);
-                        .collect()
+                            }
-                })
+                        }
-                .unwrap_or_default()
+                        f.data
-        });
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
 
-        let password_history_json: Option<Vec<_>> = self.password_history.as_ref().map(|s| {
+        let password_history_json: Vec<_> = self
-            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+            .password_history
-                .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
+            .as_ref()
-                .ok()
+            .and_then(|s| {
-                .map(|d| {
+                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                    // Check every password history item if they are valid and return it.
+                    .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
-                    // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
+                    .ok()
-                    // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
+            })
-                    d.into_iter()
+            .map(|d| {
-                        .filter_map(|d| match d.data.get("password") {
+                // Check every password history item if they are valid and return it.
-                            Some(p) if p.is_string() => Some(d.data),
+                // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
-                            _ => None,
+                // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
-                        })
+                d.into_iter()
-                        .map(|mut d| {
+                    .filter_map(|d| match d.data.get("password") {
-                            let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
+                        Some(p) if p.is_string() => Some(d.data),
-                                validate_and_format_date(l)
+                        _ => None,
-                            } else {
+                    })
-                                "1970-01-01T00:00:00.000000Z".to_owned()
+                    .map(|mut d| {
-                            };
+                        let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
-                            d["lastUsedDate"] = json!(lud);
+                            validate_and_format_date(l)
-                            d
+                        } else {
-                        })
+                            "1970-01-01T00:00:00.000000Z".to_owned()
-                        .collect()
+                        };
-                })
+                        d["lastUsedDate"] = json!(lud);
-                .unwrap_or_default()
+                        d
-        });
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+
+        // Like upstream, fields and password history stored as NULL are sent as null, not `[]`
+        let fields_json = self.fields.is_some().then_some(fields_json);
+        let password_history_json = self.password_history.is_some().then_some(password_history_json);
 
         let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
             if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
@@ -368,8 +372,7 @@ impl Cipher {
         };
 
         if is_blob_encrypted {
-            // The blob holds all of the content, so it is sent back as-is and the structured fields
+            // Like upstream, sent as-is with the structured fields null
-            // stay null, as upstream does. Only the name needs clearing, the others are never stored.
             json_object["data"] = json!(self.data);
             json_object["name"] = Value::Null;
         } else {
@@ -378,16 +381,18 @@ impl Cipher {
         Ok(json_object)
     }
 
-    /// The per-type data (`login`, `card`, …) of a legacy cipher, from `type_data` as parsed from
+    /// The per-type data of a legacy cipher, with fixups for values known to break clients.
-    /// `self.data`, with fixups for values that are known to break clients.
     fn legacy_type_data_json(&self, type_data: Result<Value, serde_json::Error>) -> Value {
         use crate::util::validate_and_format_date;
 
         // Get the type_data or a default to an empty json object '{}'.
         // If not passing an empty object, mobile clients will crash.
-        let mut type_data_json = type_data
+        let mut type_data_json = if let Ok(data @ Value::Object(_)) = type_data {
-            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
+            convert_json_key_lcase_first(data)
-            .unwrap_or_else(|_| Value::Object(serde_json::Map::new()));
+        } else {
+            warn!("Error parsing data field for {}", self.uuid);
+            Value::Object(serde_json::Map::new())
+        };
 
         // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
         // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.

src/db/models/org_policy.rs

@@ -1,3 +1,4 @@
+use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, From};
 use diesel::prelude::*;
 use serde::Deserialize;
@@ -11,6 +12,7 @@ use crate::{
         schema::{org_policies, users_organizations},
     },
     error::MapResult,
+    util::format_date,
 };
 
 use super::{Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, TwoFactor, UserId};
@@ -24,6 +26,7 @@ pub struct OrgPolicy {
     pub atype: i32,
     pub enabled: bool,
     pub data: String,
+    pub revision_date: NaiveDateTime,
 }
 
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/PolicyType.cs
@@ -46,7 +49,7 @@ pub enum OrgPolicyType {
     RemoveUnlockWithPin = 14,
     RestrictedItemTypes = 15,
     UriMatchDefaults = 16,
-    // AutotypeDefaultSetting = 17, // Not supported yet
+    AutotypeDefaultSetting = 17,
     // AutoConfirm = 18, // Not supported (not implemented yet)
     // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
     OrganizationUserNotification = 20,
@@ -77,6 +80,7 @@ impl OrgPolicy {
             atype: atype as i32,
             enabled,
             data,
+            revision_date: Utc::now().naive_utc(),
         }
     }
 
@@ -92,7 +96,7 @@ impl OrgPolicy {
             "type": self.atype,
             "data": data_json,
             "enabled": self.enabled,
-            "revisionDate": null,
+            "revisionDate": format_date(&self.revision_date),
             "object": "policy",
         });
 
@@ -110,11 +114,13 @@ impl OrgPolicy {
 
 /// Database methods
 impl OrgPolicy {
-    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
+    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
+        self.revision_date = Utc::now().naive_utc();
+
         db_run! { conn:
             sqlite, mysql {
                 match diesel::replace_into(org_policies::table)
-                    .values(self)
+                    .values(&*self)
                     .execute(conn)
                 {
                     Ok(_) => Ok(()),
@@ -122,7 +128,7 @@ impl OrgPolicy {
                     Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
                         diesel::update(org_policies::table)
                             .filter(org_policies::uuid.eq(&self.uuid))
-                            .set(self)
+                            .set(&*self)
                             .execute(conn)
                             .map_res("Error saving org_policy")
                     }
@@ -142,10 +148,10 @@ impl OrgPolicy {
                 .map_res("Error deleting org_policy for insert")?;
 
                 diesel::insert_into(org_policies::table)
-                    .values(self)
+                    .values(&*self)
                     .on_conflict(org_policies::uuid)
                     .do_update()
-                    .set(self)
+                    .set(&*self)
                     .execute(conn)
                     .map_res("Error saving org_policy")
             }

src/db/models/two_factor.rs

@@ -137,11 +137,11 @@ impl TwoFactor {
         .await
     }
 
-    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: i32, conn: &DbConn) -> Option<Self> {
+    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: TwoFactorType, conn: &DbConn) -> Option<Self> {
         conn.run(move |conn| {
             twofactor::table
                 .filter(twofactor::user_uuid.eq(user_uuid))
-                .filter(twofactor::atype.eq(atype))
+                .filter(twofactor::atype.eq(atype as i32))
                 .first::<Self>(conn)
                 .ok()
         })

src/db/models/user.rs

@@ -73,8 +73,7 @@ pub struct User {
 
     pub key_id: Option<KeyId>,
 
-    // "v2" account cryptographic state. Either all of these are set (together with a row in
+    // The v2 state: all set, with a `user_signature_key_pairs` row, or none, see `User::is_v2`
-    // `user_signature_key_pairs`) or none of them are; see `User::is_v2`.
     pub signed_public_key: Option<String>,
     pub security_state: Option<String>,
     pub security_version: Option<i32>,
@@ -185,6 +184,10 @@ impl User {
         )
     }
 
+    pub fn master_password_salt(&self) -> String {
+        self.email.trim().to_lowercase()
+    }
+
     pub fn check_valid_recovery_code(&self, recovery_code: &str) -> bool {
         if let Some(ref totp_recover) = self.totp_recover {
             crypto::ct_eq(recovery_code, totp_recover.to_lowercase())
@@ -283,34 +286,35 @@ impl User {
         UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
     }
 
+    /// The `accountKeys` object (upstream's `PrivateKeysResponseModel`), null without a key pair
     pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
-        if self.private_key.is_none() {
+        if self.private_key.is_some() {
-            return Value::Null;
+            let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
+                Some(key_pair) => (
+                    json!(self.signed_public_key),
+                    key_pair.to_json(),
+                    json!({
+                        "securityState": self.security_state,
+                        "securityVersion": self.security_version,
+                    }),
+                ),
+                None => (Value::Null, Value::Null, Value::Null),
+            };
+
+            json!({
+                "publicKeyEncryptionKeyPair": {
+                    "wrappedPrivateKey": self.private_key,
+                    "publicKey": self.public_key,
+                    "signedPublicKey": signed_public_key,
+                    "object": "publicKeyEncryptionKeyPair",
+                },
+                "securityState": security_state,
+                "signatureKeyPair": signature_key_pair,
+                "object": "privateKeys"
+            })
+        } else {
+            Value::Null
         }
-
-        let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
-            Some(key_pair) => (
-                json!(self.signed_public_key),
-                key_pair.to_json(),
-                json!({
-                    "securityState": self.security_state,
-                    "securityVersion": self.security_version,
-                }),
-            ),
-            None => (Value::Null, Value::Null, Value::Null),
-        };
-
-        json!({
-            "publicKeyEncryptionKeyPair": {
-                "wrappedPrivateKey": self.private_key,
-                "publicKey": self.public_key,
-                "signedPublicKey": signed_public_key,
-                "object": "publicKeyEncryptionKeyPair",
-            },
-            "signatureKeyPair": signature_key_pair,
-            "securityState": security_state,
-            "object": "privateKeys"
-        })
     }
 
     pub async fn public_keys_json(&self, conn: &DbConn) -> Value {
@@ -612,18 +616,7 @@ pub struct UserId(String);
 )]
 #[deref(forward)]
 #[from(forward)]
-pub struct KeyId(#[serde(deserialize_with = "deserialize_key_id")] String);
+pub struct KeyId(String);
-
-/// Rejects a key id from a request that isn't 16 bytes as lowercase hex, as upstream's `[KeyId]` does.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/KeyId.cs>
-fn deserialize_key_id<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
-    let key_id = <String as serde::Deserialize>::deserialize(deserializer)?;
-    if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
-        return Err(serde::de::Error::custom("Key id must be a 32 character lowercase hex-encoded string."));
-    }
-    Ok(key_id)
-}
 
 impl SsoUser {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {

src/db/models/user_signature_key_pair.rs

@@ -12,14 +12,9 @@ use crate::{
 
 use super::UserId;
 
-/// A user's signature key pair, part of the "v2" account cryptographic state.
+/// A user's signature key pair, part of the v2 state, in its own table like upstream.
 ///
-/// Upstream keeps this in its own table rather than as columns on the user, with a unique index on
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql#L1-L15>
-/// the user id. The stated intent is to eventually keep superseded key pairs around (an `active`
-/// flag was sketched but not shipped), which is why this is modelled as a row with its own identity
-/// instead of a set of user attributes.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql>
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
 #[diesel(table_name = user_signature_key_pairs)]
 #[diesel(treat_none_as_null = true)]
@@ -38,7 +33,7 @@ pub struct UserSignatureKeyPair {
     pub updated_at: NaiveDateTime,
 }
 
-/// https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs#L6-L10>
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum SignatureAlgorithm {
     Ed25519 = 0,

src/db/schema.rs

@@ -116,6 +116,7 @@ table! {
         atype -> Integer,
         enabled -> Bool,
         data -> Text,
+        revision_date -> Timestamp,
     }
 }
 

src/static/templates/email/send_emergency_access_invite.html.hbs

@@ -9,7 +9,7 @@ Emergency access for {{{grantor_name}}}
     </tr>
     <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
        <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none; text-align: center;" valign="top" align="center">
-          <a href="{{{url}}}"
+          <a data-testid="emergency" href="{{{url}}}"
              clicktracking=off target="_blank" style="color: #ffffff; text-decoration: none; text-align: center; cursor: pointer; display: inline-block; border-radius: 5px; background-color: #3c8dbc; border-color: #3c8dbc; border-style: solid; border-width: 10px 20px; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
           Become emergency contact
           </a>

src/util.rs

@@ -839,6 +839,12 @@ pub fn parse_experimental_client_feature_flags(
         .collect()
 }
 
+/// Whether the admin enabled this supported client feature flag
+pub fn is_client_feature_flag_enabled(flag: &str) -> bool {
+    parse_experimental_client_feature_flags(&CONFIG.experimental_client_feature_flags(), &FeatureFlagFilter::ValidOnly)
+        .contains_key(flag)
+}
+
 /// TODO: This is extracted from IpAddr::is_global, which is unstable:
 /// https://doc.rust-lang.org/nightly/std/net/enum.IpAddr.html#method.is_global
 /// Remove once https://github.com/rust-lang/rust/issues/27709 is merged