Add a manual workflow that runs the SDK live integration tests

.github/workflows/sdk-live-tests.yml

@@ -52,7 +52,7 @@ jobs:
           node-version: 20
 
       - name: "Install binaryen"
-        run: npm i -g binaryen
+        run: npm i -g binaryen@132.0.0
 
       - name: "Run the SDK live tests"
         run: tools/sdk-live-tests/run.sh --sdk-dir sdk-internal

.typos.toml

@@ -14,11 +14,8 @@ extend-ignore-re = [
     # In SMTP it's called HELO, so ignore it
     "(?i)helo_name",
     "Server name sent during.+HELO",
-    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
-    "COSE",
-    "COSEKey",
-    "COSEAlgorithm",
-    "CoseEncrypt0",
+    # COSE Is short for CBOR Object Signing and Encryption
+    "(?i)cose",
     # Ignore this specific string as it's valid
     "Ensure they are valid OTPs",
     # This word is misspelled upstream

migrations/mysql/2026-09-19-120000_cipher_data_longtext/up.sql

@@ -0,0 +1,3 @@
+-- A blob-encrypted cipher keeps all of its content in `data`, up to 500,000 characters, so the
+-- 64 KiB of TEXT is too small. Like upstream, which uses LONGTEXT.
+ALTER TABLE ciphers MODIFY data LONGTEXT NOT NULL;

migrations/postgresql/2026-09-19-120000_cipher_data_longtext/up.sql

@@ -0,0 +1 @@
+-- TEXT has no size limit here, only MySQL needed the change

migrations/sqlite/2026-09-19-120000_cipher_data_longtext/up.sql

@@ -0,0 +1 @@
+-- TEXT has no size limit here, only MySQL needed the change

src/api/core/accounts.rs

@@ -12,7 +12,7 @@ use serde_json::Value;
 use crate::{
     CONFIG,
     api::{
-        AnonymousNotify, ApiResult, EmptyResult, JsonResult, LogOutReason, Notify, PasswordOrOtpData, UpdateType,
+        AnonymousNotify, ApiResult, EmptyResult, JsonResult, LogOutReason, Notify, PasswordOrOtpData,
         core::{accept_org_invite, log_user_event, two_factor::email},
         master_password_policy, register_push_device, unregister_push_device,
     },
@@ -32,7 +32,7 @@ use crate::{
 };
 
 use super::{
-    ciphers::{CipherData, update_cipher_from_data},
+    ciphers::{CipherData, rotate_cipher_data, validate_rotated_cipher},
     sends::SendData,
 };
 
@@ -206,17 +206,21 @@ struct KeysData {
     public_key: String,
 }
 
-/// The `accountKeys` payload, which replaces the flat `keys`/`userAsymmetricKeys` object.
+/// Upstream's implicit `[Required]` on a non-nullable string: present and not blank.
+fn required(value: Option<String>, field: &str) -> ApiResult<String> {
+    match value {
+        Some(value) if !value.trim().is_empty() => Ok(value),
+        _ => err!(format!("The {field} field is required.")),
+    }
+}
+
+/// The `accountKeys` payload: a v1 key pair, or v2 with a signature key pair and security state.
 ///
-/// It carries either a "v1" state (just the encryption key pair) or a "v2" one, which adds a
-/// signature key pair, a signed public key, and a signed security state. The two deprecated
-/// top-level fields are still sent by the SDK alongside the nested ones and are only used as a
-/// fallback for clients that don't send `publicKeyEncryptionKeyPair` yet.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Api/Request/AccountKeysRequestModel.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Api/Request/AccountKeysRequestModel.cs#L6-L50>
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct AccountKeysData {
+struct AccountKeysData {
+    // Required like upstream, but only used without `public_key_encryption_key_pair`
     user_key_encrypted_account_private_key: Option<String>,
     account_public_key: Option<String>,
 
@@ -248,7 +252,7 @@ struct SecurityStateData {
     security_version: i32,
 }
 
-pub struct ValidatedAccountKeys {
+struct ValidatedAccountKeys {
     private_key: String,
     public_key: String,
     v2: Option<ValidatedV2AccountKeys>,
@@ -264,25 +268,37 @@ struct ValidatedV2AccountKeys {
 }
 
 impl AccountKeysData {
-    /// Checks that the payload describes a complete account cryptographic state.
-    ///
-    /// The v2 fields have to be all present or all absent: a client that receives a COSE-wrapped
-    /// private key without the matching signature key pair and security state refuses to unlock the
-    /// vault, so storing half a state would produce an account nobody can log into.
-    pub fn validate(self) -> ApiResult<ValidatedAccountKeys> {
-        let (private_key, public_key, signed_public_key) = if let Some(key_pair) = self.public_key_encryption_key_pair {
-            (key_pair.wrapped_private_key, key_pair.public_key, key_pair.signed_public_key)
-        // Older clients only send the deprecated top-level fields, which are always v1.
-        } else if let (Some(private_key), Some(public_key)) =
-            (self.user_key_encrypted_account_private_key, self.account_public_key)
-        {
-            (private_key, public_key, None)
-        } else {
-            err!("The account keys are missing an encryption key pair")
+    /// Upstream's model checks, plus the v2 fields all or none: no client can unlock a partial v2 state.
+    fn validate(self) -> ApiResult<ValidatedAccountKeys> {
+        let top_private_key =
+            required(self.user_key_encrypted_account_private_key, "UserKeyEncryptedAccountPrivateKey")?;
+        let top_public_key = required(self.account_public_key, "AccountPublicKey")?;
+        let (private_key, public_key, signed_public_key) = match self.public_key_encryption_key_pair {
+            Some(key_pair) => (
+                required(Some(key_pair.wrapped_private_key), "WrappedPrivateKey")?,
+                required(Some(key_pair.public_key), "PublicKey")?,
+                key_pair.signed_public_key,
+            ),
+            // Older clients only send the top-level fields, which are always v1
+            None => (top_private_key, top_public_key, None),
         };
 
+        if let Some(signature_key_pair) = &self.signature_key_pair {
+            required(Some(signature_key_pair.signature_algorithm.clone()), "SignatureAlgorithm")?;
+            required(Some(signature_key_pair.wrapped_signing_key.clone()), "WrappedSigningKey")?;
+            required(Some(signature_key_pair.verifying_key.clone()), "VerifyingKey")?;
+        }
+        if let Some(security_state) = &self.security_state {
+            required(Some(security_state.security_state.clone()), "SecurityState")?;
+            if security_state.security_state.encode_utf16().count() > 10_000 {
+                err!("The field SecurityState must be a string with a maximum length of 10000.")
+            }
+        }
+
         let v2 = match (signed_public_key, self.signature_key_pair, self.security_state) {
             (Some(signed_public_key), Some(signature_key_pair), Some(security_state)) => {
+                // Upstream fails on a null one, but takes an empty one that no client can unlock with
+                let signed_public_key = required(Some(signed_public_key), "SignedPublicKey")?;
                 let Some(signature_algorithm) = SignatureAlgorithm::parse(&signature_key_pair.signature_algorithm)
                 else {
                     err!(format!(
@@ -315,15 +331,13 @@ impl AccountKeysData {
 }
 
 impl WrappedAccountCryptographicState {
-    /// This shape is v2-only: the key pairs and security state were already required by the
-    /// deserializer, so a missing signed public key fails the all-or-nothing check in
-    /// [`AccountKeysData::validate`] rather than falling back to v1, which would silently turn a
-    /// rotation into a downgrade.
+    /// v2-only: the nested pair stands in for the top-level keys, so a partial state can't pass as v1.
     fn validate(self) -> ApiResult<ValidatedAccountKeys> {
+        let key_pair = self.public_key_encryption_key_pair;
         AccountKeysData {
-            user_key_encrypted_account_private_key: None,
-            account_public_key: None,
-            public_key_encryption_key_pair: Some(self.public_key_encryption_key_pair),
+            user_key_encrypted_account_private_key: Some(key_pair.wrapped_private_key.clone()),
+            account_public_key: Some(key_pair.public_key.clone()),
+            public_key_encryption_key_pair: Some(key_pair),
             signature_key_pair: Some(self.signature_key_pair),
             security_state: Some(self.security_state),
         }
@@ -342,28 +356,28 @@ impl From<KeysData> for ValidatedAccountKeys {
 }
 
 impl ValidatedAccountKeys {
-    /// The keys of a request that may carry either shape. `accountKeys` supersedes the flat `keys`
-    /// object when both are sent.
-    fn from_request(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Option<Self>> {
-        match (account_keys, keys) {
-            (Some(account_keys), _) => account_keys.validate().map(Some),
-            (None, keys) => Ok(keys.map(Self::from)),
+    /// The keys of a registration: `accountKeys` only for a v2 account, like upstream.
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Auth/Models/Api/Request/Accounts/RegisterFinishRequestModel.cs#L77-L100>
+    fn for_registration(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Self> {
+        if let Some(account_keys) = account_keys {
+            let account_keys = account_keys.validate()?;
+            if account_keys.is_v2() {
+                return Ok(account_keys);
+            }
         }
+        let Some(keys) = keys else {
+            err!("PublicKey and WrappedPrivateKey not found in RequestModel")
+        };
+        Ok(keys.into())
     }
 
     fn is_v2(&self) -> bool {
         self.v2.is_some()
     }
 
-    /// Writes the parts of the state that live on the user itself. The user still needs saving, and
-    /// [`Self::save_signature_key_pair`] still needs calling once it has been.
-    ///
-    /// Rejects downgrading an account from v2 back to v1.
-    pub fn apply(&self, user: &mut User) -> EmptyResult {
-        if user.is_v2() && self.v2.is_none() {
-            err!("Cannot downgrade an account from v2 to v1 encryption")
-        }
-
+    /// Sets the keys on the user, which then needs saving before [`Self::save_signature_key_pair`].
+    fn apply(&self, user: &mut User) -> EmptyResult {
         user.private_key = Some(self.private_key.clone());
         user.public_key = Some(self.public_key.clone());
 
@@ -374,9 +388,8 @@ impl ValidatedAccountKeys {
         Ok(())
     }
 
-    /// Persists the signature key pair. Separate from [`Self::apply`] because the row has a foreign
-    /// key to the user, so it can only be written once the user exists.
-    pub async fn save_signature_key_pair(&self, user_id: &UserId, conn: &DbConn) -> EmptyResult {
+    /// Saves the signature key pair, which needs the user to exist for its foreign key.
+    async fn save_signature_key_pair(&self, user_id: &UserId, conn: &DbConn) -> EmptyResult {
         // Skip if the account is v1, since v1 accounts don't have a signature key pair.
         let Some(v2) = &self.v2 else {
             return Ok(());
@@ -547,7 +560,7 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     // the user can retry without losing their invitation below.
     let password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(password_hint.as_ref())?;
-    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
+    let account_keys = ValidatedAccountKeys::for_registration(data.account_keys, data.keys)?;
 
     let mut user = match User::find_by_mail(&email, &conn).await {
         Some(user) => {
@@ -604,13 +617,10 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
         user.name = name;
     }
 
-    if let Some(ref account_keys) = account_keys {
-        account_keys.apply(&mut user)?;
-        // Like upstream, only a v2 registration records the user key id. A v1 account reports it
-        // later, through `user-key-id`.
-        if account_keys.is_v2() {
-            user.key_id = data.compat.key_id();
-        }
+    account_keys.apply(&mut user)?;
+    // Like upstream, only a v2 registration records the key id; v1 accounts report it through `user-key-id`
+    if account_keys.is_v2() {
+        user.key_id = data.compat.key_id();
     }
 
     if email_verified {
@@ -633,10 +643,7 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     }
 
     user.save(&conn).await?;
-
-    if let Some(account_keys) = account_keys {
-        account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
-    }
+    account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
 
     // accept any open emergency access invitations
     if !CONFIG.mail_enabled() && CONFIG.emergency_access_allowed() {
@@ -650,9 +657,41 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
     })))
 }
 
+/// Upstream's shape checks of the set-password body, on the raw JSON that the untagged compat would hide.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs#L75-L106>
+fn validate_set_password_shape(body: &Value) -> EmptyResult {
+    let has = |name: &str| {
+        body.as_object().is_some_and(|o| o.iter().any(|(k, v)| k.eq_ignore_ascii_case(name) && !v.is_null()))
+    };
+
+    if has("accountKeys") && has("keys") {
+        err!("Cannot specify both AccountKeys and Keys. Provide exactly one keypair.")
+    }
+    let (authentication, unlock) = (has("masterPasswordAuthentication"), has("masterPasswordUnlock"));
+    if authentication != unlock {
+        err!(
+            "Must provide both MasterPasswordAuthentication and MasterPasswordUnlock together. Cannot provide one without the other."
+        )
+    }
+    if authentication && (has("masterPasswordHash") || has("key") || has("kdf")) {
+        err!(
+            "Cannot mix modern (MasterPasswordAuthentication/MasterPasswordUnlock) and legacy (MasterPasswordHash/Key/Kdf) fields. Provide one shape or the other."
+        )
+    }
+    Ok(())
+}
+
 #[post("/accounts/set-password", data = "<data>")]
-async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: SetPasswordData = data.into_inner();
+async fn post_set_password(data: Json<Value>, headers: Headers, conn: DbConn) -> JsonResult {
+    let data = data.into_inner();
+    validate_set_password_shape(&data)?;
+    let Ok(data) = serde_json::from_value::<SetPasswordData>(data) else {
+        err_code!("Unexpected SetPasswordData format", Status::UnprocessableEntity.code)
+    };
+    if data.master_password_hint.as_ref().is_some_and(|h| h.encode_utf16().count() > 50) {
+        err!("The field MasterPasswordHint must be a string with a maximum length of 50.")
+    }
     let mut user = headers.user;
 
     if user.private_key.is_some() || !user.password_hash.is_empty() {
@@ -668,7 +707,25 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
     let password_hint = clean_password_hint(data.master_password_hint.as_ref());
     enforce_password_hint_setting(password_hint.as_ref())?;
 
-    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
+    // Like upstream, `accountKeys` only through the v2 JIT flow
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Controllers/AccountsController.cs#L314-L359>
+    let account_keys = match data.account_keys {
+        Some(account_keys) => {
+            if !matches!(data.compat, RegisterDataCompat::RegisterDataCur(_))
+                || !crate::util::is_client_feature_flag_enabled(
+                    "enable-account-encryption-v2-jit-password-registration",
+                )
+            {
+                err!("Request includes V2 AccountKeys but V2 encryption is not enabled.")
+            }
+            let account_keys = account_keys.validate()?;
+            if !account_keys.is_v2() {
+                err!("AccountKeys are only supported for V2 encryption.")
+            }
+            Some(account_keys)
+        }
+        None => data.keys.map(ValidatedAccountKeys::from),
+    };
 
     set_kdf_data(&mut user, data.compat.kdf())?;
 
@@ -832,8 +889,9 @@ async fn get_keys(headers: Headers, conn: DbConn) -> JsonResult {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct PostKeysData {
-    #[serde(flatten)]
-    keys: Option<KeysData>,
+    // Required like upstream, even next to `accountKeys`
+    public_key: Option<String>,
+    encrypted_private_key: Option<String>,
     account_keys: Option<AccountKeysData>,
     // The id of the user key these account keys belong to, only honored for v2 `accountKeys`
     user_key_id: Option<KeyId>,
@@ -845,15 +903,18 @@ async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) ->
 
     let mut user = headers.user;
 
-    // This only sets the keys of an account that has none yet. Replacing existing ones is what a key
-    // rotation does, with the checks that go with it.
+    // Only for an account without keys, replacing them is what a key rotation does
     if user.private_key.is_some() || user.public_key.is_some() {
         err!("User has existing keypair")
     }
 
-    // `accountKeys` supersedes the flat `keys` object when both are sent.
-    let account_keys = match (data.account_keys, data.keys) {
-        (Some(account_keys), _) => {
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Auth/Models/Api/Request/Accounts/KeysRequestModel.cs#L11-L19>
+    let public_key = required(data.public_key, "PublicKey")?;
+    let encrypted_private_key = required(data.encrypted_private_key, "EncryptedPrivateKey")?;
+
+    // `accountKeys` supersedes the flat keys when both are sent
+    let account_keys = match data.account_keys {
+        Some(account_keys) => {
             let account_keys = account_keys.validate()?;
             if !account_keys.is_v2() {
                 err!("AccountKeys are only supported for V2 encryption.")
@@ -864,8 +925,11 @@ async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) ->
             }
             account_keys
         }
-        (None, Some(keys)) => keys.into(),
-        (None, None) => err!("No account keys provided"),
+        None => KeysData {
+            encrypted_private_key,
+            public_key,
+        }
+        .into(),
     };
 
     account_keys.apply(&mut user)?;
@@ -912,7 +976,8 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbCon
                 err!("KDF settings must be equal for authentication and unlock")
             }
 
-            if user.email != authentication_data.salt || user.email != unlock_data.salt {
+            let salt = user.master_password_salt();
+            if salt != authentication_data.salt || salt != unlock_data.salt {
                 err!("Invalid master password salt")
             }
 
@@ -1009,11 +1074,9 @@ struct UnlockData {
     contained_key_id: Option<KeyId>,
 }
 
-/// A password or KDF change re-wraps the same user key, so a key id sent with it has to be the
-/// current one. Either may be missing: from a client that predates key ids, or a user whose key id
-/// isn't known yet. There is nothing to compare in those cases.
+/// A password or KDF change keeps the user key, so its key id must be the current one, when both are known.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs#L27-L47>
 fn validate_key_id_unchanged(user: &User, unlock_data: &UnlockData) -> EmptyResult {
     if let (Some(current), Some(contained)) = (&user.key_id, &unlock_data.contained_key_id)
         && current != contained
@@ -1023,6 +1086,17 @@ fn validate_key_id_unchanged(user: &User, unlock_data: &UnlockData) -> EmptyResu
     Ok(())
 }
 
+/// A rotation's unlock data has to wrap the new user key. Neither id is sent by clients that predate them.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs#L49-L61>
+fn validate_contained_key_id(contained_key_id: Option<&KeyId>, new_user_key_id: Option<&KeyId>) -> EmptyResult {
+    match (contained_key_id, new_user_key_id) {
+        (None, None) => Ok(()),
+        (Some(contained), Some(new)) if contained == new => Ok(()),
+        _ => err!("Invalid user key sent in master-password unlock data."),
+    }
+}
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct ChangeKdfData {
@@ -1043,7 +1117,8 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, conn: DbConn, nt:
         err!("KDF settings must be equal for authentication and unlock")
     }
 
-    if headers.user.email != data.authentication_data.salt || headers.user.email != data.unlock_data.salt {
+    let salt = headers.user.master_password_salt();
+    if salt != data.authentication_data.salt || salt != data.unlock_data.salt {
         err!("Invalid master password salt")
     }
 
@@ -1083,7 +1158,9 @@ struct UpdateFolderData {
 #[serde(rename_all = "camelCase")]
 struct UpdateEmergencyAccessData {
     id: EmergencyAccessId,
-    key_encrypted: String,
+    key_encrypted: Option<String>,
+    // Only validated, upstream doesn't store it either
+    wait_time_days: Option<i32>,
 }
 
 #[derive(Deserialize)]
@@ -1120,27 +1197,27 @@ struct MasterPasswordUnlockData {
     email: String,
     master_key_authentication_hash: String,
     master_key_encrypted_user_key: String,
+    master_password_hint: Option<String>,
+    master_password_salt: Option<String>,
     contained_key_id: Option<KeyId>,
 }
 
-/// The unlock data both rotation endpoints share. Vaultwarden has neither trusted device encryption
-/// nor passkey login, so `key-rotation-data` reports none of either and these must arrive empty.
+/// The unlock data of both rotation endpoints; passkey and device keys are ignored, as we support neither.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Models/Requests/CommonUnlockDataRequestModel.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/CommonUnlockDataRequestModel.cs#L7-L14>
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct CommonUnlockData {
     emergency_access_unlock_data: Vec<UpdateEmergencyAccessData>,
     organization_account_recovery_unlock_data: Vec<UpdateResetPasswordData>,
-    #[serde(default)]
+    #[expect(dead_code, reason = "Required like upstream, but unused")]
     passkey_unlock_data: Vec<Value>,
-    #[serde(default)]
+    #[expect(dead_code, reason = "Required like upstream, but unused")]
     device_key_unlock_data: Vec<Value>,
     v2_upgrade_token: Option<V2UpgradeTokenData>,
 }
 
-/// Lets clients that still hold the v1 user key derive the v2 one after another client upgraded the
-/// account, so a v1 -> v2 upgrade doesn't have to log every other session out. Opaque to us.
+/// Lets other sessions with the v1 user key unwrap the v2 one after an upgrade. Opaque to us.
 #[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct V2UpgradeTokenData {
@@ -1180,32 +1257,11 @@ struct WrappedAccountCryptographicState {
 #[serde(rename_all = "camelCase")]
 struct UnlockMethodData {
     unlock_method: i32,
-    master_password_unlock_data: Option<RotateMasterPasswordUnlockData>,
-    // `keyConnectorKeyWrappedUserKey` is deliberately not read: that unlock method is rejected.
+    master_password_unlock_data: Option<UnlockData>,
+    key_connector_key_wrapped_user_key: Option<String>,
 }
 
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct RotateMasterPasswordUnlockData {
-    kdf: KDFData,
-    salt: String,
-    master_key_wrapped_user_key: String,
-    contained_key_id: Option<KeyId>,
-}
-
-/// The user key wrapped in the master password unlock data has to be the new one.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
-fn validate_contained_key_id(contained_key_id: Option<&KeyId>, new_user_key_id: Option<&KeyId>) -> EmptyResult {
-    match (contained_key_id, new_user_key_id) {
-        // Neither is sent by clients that predate key ids
-        (None, None) => Ok(()),
-        (Some(contained), Some(new)) if contained == new => Ok(()),
-        _ => err!("Invalid user key sent in master-password unlock data."),
-    }
-}
-
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Enums/UnlockMethod.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Enums/UnlockMethod.cs#L3-L8>
 #[derive(num_derive::FromPrimitive)]
 enum UnlockMethod {
     Tde = 0,
@@ -1213,14 +1269,9 @@ enum UnlockMethod {
     KeyConnector = 2,
 }
 
-/// The rotation-specific checks on the new account keys.
+/// The rotation checks on the new keys: the public key never changes, nor the verifying key of a v2 account.
 ///
-/// A rotation re-wraps the existing keys under a new user key; it must not swap the identity the
-/// account presents to others. So the public key never changes, and for an account that is already
-/// v2 the verifying key doesn't either — only the *wrapped* signing key does. A v1 account may gain
-/// a signature key pair, which is the v1 -> v2 upgrade.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs#L192-L287>
 async fn validate_rotation_account_keys(keys: &ValidatedAccountKeys, user: &User, conn: &DbConn) -> EmptyResult {
     if user.public_key.as_ref() != Some(&keys.public_key) {
         err!("Changing the asymmetric keypair is not possible during key rotation")
@@ -1283,8 +1334,7 @@ impl KDFData {
     }
 }
 
-/// A rotation re-encrypts everything under the new user key, so anything left out would be
-/// unreadable afterwards. Both rotation endpoints require the client to send the complete set.
+/// Every existing item must be in the rotation, or it would be unreadable afterwards.
 fn validate_rotation_data(
     data: &RotateData,
     existing_ciphers: &[Cipher],
@@ -1293,11 +1343,10 @@ fn validate_rotation_data(
     existing_memberships: &[Membership],
     existing_sends: &[Send],
 ) -> EmptyResult {
-    let account_data = &data.account_data;
-
     // Check that we're correctly rotating all the user's ciphers
     let existing_cipher_ids = existing_ciphers.iter().map(|c| &c.uuid).collect::<HashSet<&CipherId>>();
-    let provided_cipher_ids = account_data
+    let provided_cipher_ids = data
+        .account_data
         .ciphers
         .iter()
         .filter(|c| c.organization_id.is_none())
@@ -1309,7 +1358,8 @@ fn validate_rotation_data(
 
     // Check that we're correctly rotating all the user's folders
     let existing_folder_ids = existing_folders.iter().map(|f| &f.uuid).collect::<HashSet<&FolderId>>();
-    let provided_folder_ids = account_data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
+    let provided_folder_ids =
+        data.account_data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
     if !provided_folder_ids.is_superset(&existing_folder_ids) {
         err!("All existing folders must be included in the rotation")
     }
@@ -1338,7 +1388,7 @@ fn validate_rotation_data(
 
     // Check that we're correctly rotating all the user's sends
     let existing_send_ids = existing_sends.iter().map(|s| &s.uuid).collect::<HashSet<&SendId>>();
-    let provided_send_ids = account_data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
+    let provided_send_ids = data.account_data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
     if !provided_send_ids.is_superset(&existing_send_ids) {
         err!("All existing sends must be included in the rotation")
     }
@@ -1346,14 +1396,9 @@ fn validate_rotation_data(
     Ok(())
 }
 
-/// The public keys and encrypted keysets that participate in a key rotation, so the client can
-/// re-share the new user key without having to piece this together from several endpoints.
+/// The keys a rotation re-shares the new user key with. The SDK needs all four lists, even when empty.
 ///
-/// The four collections must always be present, even when empty: the SDK errors out if any of them
-/// is missing. `trustedDeviceKeyData` and `passkeyKeyData` are always empty here, since vaultwarden
-/// supports neither trusted device encryption nor passkey (PRF) login.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/UserKey/Queries/KeyRotationDataQuery.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Queries/KeyRotationDataQuery.cs#L14-L122>
 #[get("/accounts/key-management/key-rotation-data")]
 async fn get_key_rotation_data(headers: Headers, conn: DbConn) -> JsonResult {
     let user_id = &headers.user.uuid;
@@ -1417,46 +1462,128 @@ struct RotateData {
     account_keys: ValidatedAccountKeys,
     account_data: RotateAccountData,
     unlock_data: CommonUnlockData,
-    /// Only v2 (COSE) user keys have an id, so this is `None` for a v1 -> v1 rotation.
+    /// `None` from clients that predate key ids.
     new_user_key_id: Option<KeyId>,
     /// The new user key, wrapped by the master key.
     wrapped_user_key: String,
-    /// Only for `rotate-user-account-keys`, where the master password changes along with the keys.
-    new_password_hash: Option<String>,
+    /// Only for `rotate-user-account-keys`: the new password hash and hint.
+    new_password: Option<(String, Option<String>)>,
 }
 
-impl CommonUnlockData {
-    /// We advertise no trusted devices or passkeys in `key-rotation-data`, so a client sending
-    /// either has produced keys for something that doesn't exist here. Silently dropping them would
-    /// leave the client believing an unlock method was rotated when it wasn't.
-    fn validate(&self) -> EmptyResult {
-        if !self.passkey_unlock_data.is_empty() {
-            err!("Passkey unlock is not supported")
-        }
-        if !self.device_key_unlock_data.is_empty() {
-            err!("Trusted device unlock is not supported")
+/// Upstream's `[StringLength(max)]`, which counts UTF-16 code units.
+fn validate_max_length(value: &str, max: usize, field: &str) -> EmptyResult {
+    if value.encode_utf16().count() > max {
+        err!(format!("The field {field} must be a string with a maximum length of {max}."))
+    }
+    Ok(())
+}
+
+impl KDFData {
+    /// Upstream's check that the parameters fit the KDF type.
+    fn validate_parameters(&self) -> EmptyResult {
+        let has_argon2_parameters = (self.kdf_memory.is_some(), self.kdf_parallelism.is_some());
+        if self.kdf == UserKdfType::Pbkdf2 as i32 {
+            if has_argon2_parameters != (false, false) {
+                err!("KdfMemory and KdfParallelism must be null for PBKDF2_SHA256")
+            }
+        } else if self.kdf == UserKdfType::Argon2id as i32 {
+            if has_argon2_parameters != (true, true) {
+                err!("KdfMemory and KdfParallelism must have values for Argon2id")
+            }
+        } else {
+            err!("Invalid KdfType")
         }
         Ok(())
     }
 }
 
+impl MasterPasswordUnlockData {
+    /// Upstream's model validation.
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/MasterPasswordUnlockDataAndAuthenticationModel.cs#L8-L48>
+    fn validate(&self) -> EmptyResult {
+        self.kdf.validate_parameters()?;
+        if !crate::util::is_valid_email(&self.email) {
+            err!("The Email field is not a supported e-mail address format.")
+        }
+        validate_max_length(&self.email, 256, "Email")?;
+        required(Some(self.master_key_authentication_hash.clone()), "MasterKeyAuthenticationHash")?;
+        validate_max_length(&self.master_key_authentication_hash, 300, "MasterKeyAuthenticationHash")?;
+        required(Some(self.master_key_encrypted_user_key.clone()), "MasterKeyEncryptedUserKey")?;
+        if let Some(hint) = &self.master_password_hint {
+            validate_max_length(hint, 50, "MasterPasswordHint")?;
+        }
+        if self.master_password_salt.as_ref().is_some_and(|salt| salt.encode_utf16().count() > 256) {
+            err!("The field MasterPasswordSalt must be a string or array type with a maximum length of '256'.")
+        }
+        Ok(())
+    }
+}
+
+impl CommonUnlockData {
+    /// Upstream's model validation.
+    fn validate(&self) -> EmptyResult {
+        // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Models/Request/EmergencyAccessRequestModels.cs#L32-L39>
+        for emergency_access in &self.emergency_access_unlock_data {
+            if !emergency_access.wait_time_days.is_some_and(|days| (1..=i32::from(i16::MAX)).contains(&days)) {
+                err!("The field WaitTimeDays must be between 1 and 32767.")
+            }
+        }
+        if let Some(token) = &self.v2_upgrade_token {
+            required(Some(token.wrapped_user_key1.clone()), "WrappedUserKey1")?;
+            required(Some(token.wrapped_user_key2.clone()), "WrappedUserKey2")?;
+        }
+        Ok(())
+    }
+}
+
+/// The model validation of the parts both rotation endpoints share, which upstream runs before anything else.
+fn validate_rotation_request(account_data: &RotateAccountData, unlock_data: &CommonUnlockData) -> EmptyResult {
+    unlock_data.validate()?;
+
+    // Validate the import before continuing
+    // Bitwarden does not process the import if there is one item invalid.
+    // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
+    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
+    Cipher::validate_cipher_data(&account_data.ciphers)?;
+
+    for cipher in &account_data.ciphers {
+        if cipher.id.is_none() {
+            err!("The Id field is required.")
+        }
+        cipher.validate_type_data(cipher.is_blob())?;
+    }
+    if account_data.sends.iter().any(|send| send.id.is_none()) {
+        err!("The Id field is required.")
+    }
+    Ok(())
+}
+
 #[post("/accounts/key-management/rotate-user-account-keys", data = "<data>")]
 async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
     let data: KeyData = data.into_inner();
 
+    let unlock_data = data.account_unlock_data.master_password_unlock_data;
+    validate_max_length(&data.old_master_key_authentication_hash, 300, "OldMasterKeyAuthenticationHash")?;
+    unlock_data.validate()?;
+    validate_rotation_request(&data.account_data, &data.account_unlock_data.common)?;
+
     if !headers.user.check_valid_password(&data.old_master_key_authentication_hash) {
         err!("Invalid password")
     }
 
-    let unlock_data = data.account_unlock_data.master_password_unlock_data;
-    if !unlock_data.kdf.is_unchanged_for(&headers.user) || unlock_data.email != headers.user.email {
-        err!("Changing the kdf variant or email is not supported during key rotation");
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Models/Data/PasswordChangeAndRotateUserAccountKeysData.cs#L17-L32>
+    let salt = unlock_data.master_password_salt.as_ref().unwrap_or(&unlock_data.email);
+    if !unlock_data.kdf.is_unchanged_for(&headers.user) || *salt != headers.user.master_password_salt() {
+        err!("The provided master password unlock data is not valid for this user.")
     }
     validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
+    let password_hint = clean_password_hint(unlock_data.master_password_hint.as_ref());
+    enforce_password_hint_setting(password_hint.as_ref())?;
 
     let mut common = data.account_unlock_data.common;
-    // This endpoint always logs every session out, so an upgrade token is never kept here. That
-    // also clears one left over from an earlier upgrade. Ref: upstream's AccountsKeyManagementController
+    // Like upstream, this endpoint logs every session out, so an upgrade token is never kept
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs#L94-L96>
     common.v2_upgrade_token = None;
 
     rotate_account(
@@ -1466,7 +1593,7 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
             unlock_data: common,
             new_user_key_id: data.new_user_key_id,
             wrapped_user_key: unlock_data.master_key_encrypted_user_key,
-            new_password_hash: Some(unlock_data.master_key_authentication_hash),
+            new_password: Some((unlock_data.master_key_authentication_hash, password_hint)),
         },
         headers,
         conn,
@@ -1475,16 +1602,14 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
     .await
 }
 
-/// The body shared by both rotation endpoints: check that the client re-encrypted everything, re-save
-/// it, then swap the account keys and the wrapped user key.
+/// Both rotation endpoints: every check first, then the re-encrypted data and the new keys are saved.
 async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    // TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
-    data.unlock_data.validate()?;
-
     let user_id = &headers.user.uuid;
     let mut existing_ciphers = Cipher::find_owned_by_user(user_id, &conn).await;
     let mut existing_folders = Folder::find_by_user(user_id, &conn).await;
     let mut existing_emergency_access = EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await;
+    // Like upstream, only the ones with a key take part
+    existing_emergency_access.retain(|ea| ea.key_encrypted.is_some());
     let mut existing_memberships = Membership::find_by_user(user_id, &conn).await;
     // We only rotate the reset password key if it is set.
     existing_memberships.retain(|m| m.reset_password_key.is_some());
@@ -1501,23 +1626,23 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
 
     validate_rotation_account_keys(&data.account_keys, &headers.user, &conn).await?;
 
-    // The upgrade token only means anything for a v1 account moving to v2: it lets sessions still
-    // holding the v1 user key pick up the v2 one instead of being forced to re-authenticate. For an
-    // account that is already v2 it is meaningless, so it gets discarded and the security stamp is
-    // reset, as a rotation otherwise would. That ends the refresh tokens, while the access tokens in
-    // use run out on their own, as upstream.
+    // An upgrade keeps the sessions; for an account already on v2 the token means nothing and is dropped
     let is_upgrade = data.unlock_data.v2_upgrade_token.is_some() && !headers.user.is_v2();
     let upgrade_token = match &data.unlock_data.v2_upgrade_token {
         Some(token) if is_upgrade => Some(serde_json::to_string(token)?),
         _ => None,
     };
 
-    // An upgrade can't re-wrap the account recovery keys: that needs the organization's public key
-    // to be trusted, and an upgrade shows the user no prompt. So the stored keys are kept, and each
-    // organization gets the upgrade token instead, to unwrap the v2 user key with.
-    // Ref: upstream's OrganizationUserRotationValidator
-    for reset_password_data in &data.unlock_data.organization_account_recovery_unlock_data {
-        let has_key = reset_password_data.reset_password_key.as_deref().is_some_and(|k| !k.is_empty());
+    // An upgrade can't re-wrap the recovery keys without a trust prompt, so they're kept and get the token
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Validators/OrganizationUserRotationValidator.cs#L39-L64>
+    for membership in &existing_memberships {
+        let has_key = data
+            .unlock_data
+            .organization_account_recovery_unlock_data
+            .iter()
+            .find(|rp| rp.organization_id == membership.org_uuid)
+            .and_then(|rp| rp.reset_password_key.as_deref())
+            .is_some_and(|key| !key.trim().is_empty());
         if is_upgrade && has_key {
             err!("Account recovery keys cannot be rotated during a V1 to V2 upgrade rotation.")
         }
@@ -1526,79 +1651,80 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
         }
     }
 
-    // Validate the import before continuing
-    // Bitwarden does not process the import if there is one item invalid.
-    // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
-    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
-    Cipher::validate_cipher_data(&data.account_data.ciphers)?;
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Validators/EmergencyAccessRotationValidator.cs#L23-L53>
+    for emergency_access in &existing_emergency_access {
+        if data
+            .unlock_data
+            .emergency_access_unlock_data
+            .iter()
+            .find(|ea| ea.id == emergency_access.uuid)
+            .is_some_and(|ea| ea.key_encrypted.is_none())
+        {
+            err!("Emergency access keys cannot be set to null during rotation.")
+        }
+    }
+
+    // Saving's own checks, so that they can't fail halfway
+    for cipher_data in data.account_data.ciphers.iter().filter(|c| c.organization_id.is_none()) {
+        if let Some(cipher) = existing_ciphers.iter().find(|c| cipher_data.id.as_ref() == Some(&c.uuid)) {
+            validate_rotated_cipher(cipher, cipher_data, &headers, &conn).await?;
+        }
+    }
 
     // TODO: Ideally we'd do everything after this point in a single transaction.
 
-    // Update folder data
+    // Update folder data, ignoring ids that aren't the user's, like upstream
     for folder_data in data.account_data.folders {
         // Skip `null` folder id entries.
         // See: https://github.com/bitwarden/clients/issues/8453
-        if let Some(folder_id) = folder_data.id {
-            let Some(saved_folder) = existing_folders.iter_mut().find(|f| f.uuid == folder_id) else {
-                err!("Folder doesn't exist")
-            };
-
+        if let Some(saved_folder) = folder_data.id.and_then(|id| existing_folders.iter_mut().find(|f| f.uuid == id)) {
             saved_folder.name = folder_data.name;
             saved_folder.save(&conn).await?;
         }
     }
 
-    // Update emergency access data
-    for emergency_access_data in data.unlock_data.emergency_access_unlock_data {
-        let Some(saved_emergency_access) =
-            existing_emergency_access.iter_mut().find(|ea| ea.uuid == emergency_access_data.id)
-        else {
-            err!("Emergency access doesn't exist or is not owned by the user")
-        };
-
-        saved_emergency_access.key_encrypted = Some(emergency_access_data.key_encrypted);
-        saved_emergency_access.save(&conn).await?;
+    // Like upstream, the unlock data below comes from the first entry for each, as checked above
+    for saved_emergency_access in &mut existing_emergency_access {
+        if let Some(emergency_access_data) =
+            data.unlock_data.emergency_access_unlock_data.iter().find(|ea| ea.id == saved_emergency_access.uuid)
+        {
+            saved_emergency_access.key_encrypted.clone_from(&emergency_access_data.key_encrypted);
+            saved_emergency_access.save(&conn).await?;
+        }
     }
 
-    // Update reset password data
-    for reset_password_data in data.unlock_data.organization_account_recovery_unlock_data {
-        let Some(membership) =
-            existing_memberships.iter_mut().find(|m| m.org_uuid == reset_password_data.organization_id)
-        else {
-            err!("Reset password doesn't exist")
-        };
-
-        if !is_upgrade {
-            membership.reset_password_key = reset_password_data.reset_password_key;
+    for membership in &mut existing_memberships {
+        if let Some(reset_password_data) = data
+            .unlock_data
+            .organization_account_recovery_unlock_data
+            .iter()
+            .find(|rp| rp.organization_id == membership.org_uuid)
+        {
+            if !is_upgrade {
+                membership.reset_password_key.clone_from(&reset_password_data.reset_password_key);
+            }
+            membership.v2_upgrade_token.clone_from(&upgrade_token);
+            membership.save(&conn).await?;
         }
-        membership.v2_upgrade_token.clone_from(&upgrade_token);
-        membership.save(&conn).await?;
     }
 
     // Update send data
     for send_data in data.account_data.sends {
-        let Some(send) = send_data.id.as_ref().and_then(|id| existing_sends.iter_mut().find(|s| &s.uuid == id)) else {
-            err!("Send doesn't exist")
-        };
-
-        // Like upstream, only the key changes on rotation
-        send.akey = send_data.key;
-        send.save(&conn).await?;
+        if let Some(send) = send_data.id.as_ref().and_then(|id| existing_sends.iter_mut().find(|s| &s.uuid == id)) {
+            // Like upstream, only the key changes on rotation
+            send.akey = send_data.key;
+            send.save(&conn).await?;
+        }
     }
 
     // Update cipher data
     for cipher_data in data.account_data.ciphers {
-        if cipher_data.organization_id.is_none() {
-            let Some(saved_cipher) =
+        if cipher_data.organization_id.is_none()
+            && let Some(saved_cipher) =
                 cipher_data.id.as_ref().and_then(|id| existing_ciphers.iter_mut().find(|c| &c.uuid == id))
-            else {
-                err!("Cipher doesn't exist")
-            };
-
-            // Prevent triggering cipher updates via WebSockets by settings UpdateType::None
-            // Other sessions still hold the old user key, so an update to a re-encrypted cipher could cause issues.
-            // After the user is saved they are logged out, or on an upgrade, told to sync the new key.
-            update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
+        {
+            // No cipher pushes: the other sessions still hold the old user key
+            rotate_cipher_data(saved_cipher, cipher_data, &headers, &conn, &nt).await?;
         }
     }
 
@@ -1611,38 +1737,32 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
     user.key_id = data.new_user_key_id;
 
     user.akey = data.wrapped_user_key;
-    if let Some(new_password_hash) = data.new_password_hash {
-        user.set_password(&new_password_hash, None, false, None, &conn).await?;
-    }
-    // An upgrade keeps the sessions alive, see `is_upgrade` above
-    if !is_upgrade {
+    if let Some((new_password_hash, new_password_hint)) = data.new_password {
+        // A password change ends every session, as `/accounts/password` does
+        user.password_hint = new_password_hint;
+        user.set_password(&new_password_hash, None, true, None, &conn).await?;
+    } else if !is_upgrade {
+        // An upgrade keeps the sessions alive, see `is_upgrade` above
         user.reset_security_stamp_after_key_rotation(&conn).await?;
     }
 
-    // The key pair goes first: if saving the user then fails during an upgrade, the account is still
-    // v1 and the key pair unused, instead of a v2 account without one, which no client could unlock.
-    // A failure between the two writes of a v2 rotation still needs a transaction to undo.
+    // The key pair first: if saving the user then fails, an upgraded account stays v1 instead of broken
     data.account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
     user.save(&conn).await?;
 
     // Prevent logging out the client where the user requested this endpoint from.
     // If you do logout the user it will causes issues at the client side.
     // Adding the device uuid will prevent this.
-    // When the sessions were kept alive, the reason lets the other clients sync the new keys (through
-    // the upgrade token) instead of logging out, if they have `pm-31050-no-logout-key-upgrade-rotation`.
+    // On an upgrade, the reason lets clients with `pm-31050-no-logout-key-upgrade-rotation` sync instead
     let reason = is_upgrade.then_some(LogOutReason::KeyRotation);
     nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await;
 
     Ok(())
 }
 
-/// Rotates the account keys without changing the master password.
+/// Rotates the keys without changing the master password; like upstream, the session is the only proof.
 ///
-/// Unlike `rotate-user-account-keys` this carries no proof of the master password: the request is
-/// authorized by the session alone, which is how upstream defines it, and the client has to be
-/// unlocked to produce the payload in the first place.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs#L174-L208>
 #[post("/accounts/key-management/rotate-user-keys", data = "<data>")]
 async fn post_rotate_user_keys(
     data: Json<RotateUserKeysData>,
@@ -1651,17 +1771,32 @@ async fn post_rotate_user_keys(
     nt: Notify<'_>,
 ) -> EmptyResult {
     let data: RotateUserKeysData = data.into_inner();
+    validate_rotation_request(&data.account_data, &data.unlock_data)?;
 
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/UnlockMethodRequestModel.cs#L20-L46>
     let wrapped_user_key = match UnlockMethod::from_i32(data.unlock_method_data.unlock_method) {
         Some(UnlockMethod::MasterPassword) => {
-            let Some(unlock_data) = data.unlock_method_data.master_password_unlock_data else {
-                err!("Missing master password unlock data")
+            let (Some(unlock_data), None) = (
+                data.unlock_method_data.master_password_unlock_data,
+                data.unlock_method_data.key_connector_key_wrapped_user_key,
+            ) else {
+                err!(
+                    "Invalid MasterPassword unlock method request, MasterPasswordUnlockData must be provided and KeyConnectorKeyWrappedUserKey must be null"
+                )
             };
-            if !unlock_data.kdf.is_unchanged_for(&headers.user) {
-                err!("Changing the kdf variant is not supported during key rotation")
+            required(Some(unlock_data.master_key_wrapped_user_key.clone()), "MasterKeyWrappedUserKey")?;
+            required(Some(unlock_data.salt.clone()), "Salt")?;
+            validate_max_length(&unlock_data.salt, 256, "Salt")?;
+
+            // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Models/Data/MasterPasswordRotateUserAccountKeysData.cs#L12-L23>
+            if headers.user.password_hash.is_empty() || headers.user.akey.is_empty() {
+                err!("User is in an invalid state for master password key rotation.")
             }
-            if unlock_data.salt != headers.user.email {
-                err!("Invalid master password salt")
+            if unlock_data.salt != headers.user.master_password_salt() {
+                err!("Invalid master password salt.")
+            }
+            if !unlock_data.kdf.is_unchanged_for(&headers.user) {
+                err!("Invalid KDF settings.")
             }
             validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
             unlock_data.master_key_wrapped_user_key
@@ -1678,7 +1813,7 @@ async fn post_rotate_user_keys(
             unlock_data: data.unlock_data,
             new_user_key_id: data.new_user_key_id,
             wrapped_user_key,
-            new_password_hash: None,
+            new_password: None,
         },
         headers,
         conn,

src/api/core/ciphers.rs

@@ -190,14 +190,14 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "masterKeyEncryptedUserKey": headers.user.akey,
             "masterKeyWrappedUserKey": headers.user.akey,
-            "salt": headers.user.email,
+            "salt": headers.user.master_password_salt(),
             "containedKeyId": headers.user.key_id,
         })
     } else {
         Value::Null
     };
 
-    // Upstream omits these two when unset rather than sending null.
+    // Upstream omits these when unset rather than sending null
     let mut user_decryption = json!({ "masterPasswordUnlock": master_password_unlock });
     if let Some(key_id) = &headers.user.key_id {
         user_decryption["userKeyId"] = json!(key_id);
@@ -277,7 +277,8 @@ pub struct CipherData {
 
     key: Option<String>,
 
-    pub encrypted_for: UserId, // Added in web-v2025.6.0
+    // Added in web-v2025.6.0. Deprecated upstream for `encrypted_by_key_id`, but still checked when sent
+    pub encrypted_for: Option<UserId>,
     // Added in web-v2025.8.1, Optional for compat
     pub encrypted_by_key_id: Option<KeyId>,
 
@@ -344,12 +345,22 @@ impl From<CipherValidationError> for crate::Error {
     }
 }
 
-/// A user-owned cipher must be encrypted with the user's current key. Organization ciphers use the
-/// organization key, which has no id yet, and either id may be missing: from a client that predates
-/// the field, or a user whose key id isn't known yet. There is nothing to compare in those cases.
+/// The cipher must have been encrypted for the acting user. Only checked when the client sends the field.
 ///
-/// Ref: upstream's `CiphersController.ValidateCipherEncryptedByUser`
-fn validate_encrypted_by_user_key(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1857-L1870>
+fn validate_encrypted_for_user(data: &CipherData, user_id: &UserId) -> EmptyResult {
+    if data.encrypted_for.as_ref().is_some_and(|encrypted_for| encrypted_for != user_id) {
+        err!("Cipher was not encrypted for the current user. Please try again.")
+    }
+    Ok(())
+}
+
+/// [`validate_encrypted_for_user`], plus the key id of a user-owned cipher, when both ids are known.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1886-L1911>
+fn validate_encrypted_by_user(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
+    validate_encrypted_for_user(data, &user.uuid)?;
+
     if !is_org_cipher
         && let (Some(cipher_key_id), Some(user_key_id)) = (&data.encrypted_by_key_id, &user.key_id)
         && cipher_key_id != user_key_id
@@ -363,16 +374,34 @@ fn validate_encrypted_by_user_key(data: &CipherData, user: &User, is_org_cipher:
 const MAX_CIPHER_DATA_LENGTH: usize = 500_000;
 
 impl CipherData {
-    /// Whether the content is a single blob rather than the per-type fields. This parses `data`, so
-    /// callers that need the answer more than once should keep it.
+    /// Whether `data` is a blob rather than the per-type fields. Parses `data`, so keep the result.
     pub fn is_blob(&self) -> bool {
         self.data.as_deref().is_some_and(is_data_blob_encrypted)
     }
 
-    /// Checks the content the way upstream's model validation does, before anything is saved.
-    /// `is_blob` is [`Self::is_blob`].
+    /// Saving's last checks: a known type, and its data unless it's a blob.
+    pub fn validate_type_data(&self, is_blob: bool) -> EmptyResult {
+        let type_data = match self.r#type {
+            1 => &self.login,
+            2 => &self.secure_note,
+            3 => &self.card,
+            4 => &self.identity,
+            5 => &self.ssh_key,
+            6 => &self.bank_account,
+            7 => &self.drivers_license,
+            8 => &self.passport,
+            _ => err!("Invalid type"),
+        };
+        if !is_blob && type_data.is_none() {
+            err!("Data missing")
+        }
+        Ok(())
+    }
+
+    /// Upstream's model checks that depend on the format: the size of `data`, and a name unless it's a blob.
     ///
-    /// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/Vault/Models/Request/CipherRequestModel.cs>
+    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L76-L77>
+    /// and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L91-L99>
     pub fn validate_content(&self, is_blob: bool) -> Result<(), CipherValidationError> {
         if let Some(data) = &self.data
             && data.len() > MAX_CIPHER_DATA_LENGTH
@@ -428,17 +457,14 @@ async fn post_ciphers_create(
 ) -> JsonResult {
     let mut data: ShareCipherData = data.into_inner();
 
-    if data.cipher.encrypted_for != headers.user.uuid {
-        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
-    }
-    validate_encrypted_by_user_key(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
+    validate_encrypted_by_user(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
 
     // This check is usually only needed in update_cipher_from_data(), but we
     // need it here as well to avoid creating an empty cipher in the call to
     // cipher.save() below.
     enforce_personal_ownership_policy(Some(&data.cipher), &headers, &conn).await?;
 
-    let mut cipher = Cipher::new(data.cipher.r#type, String::new());
+    let mut cipher = Cipher::new(data.cipher.r#type);
     cipher.user_uuid = Some(headers.user.uuid.clone());
     cipher.save(&conn).await?;
 
@@ -462,11 +488,7 @@ async fn post_ciphers_create(
 async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
     let mut data: CipherData = data.into_inner();
 
-    if data.encrypted_for != headers.user.uuid {
-        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
-    }
-
-    validate_encrypted_by_user_key(&data, &headers.user, data.organization_id.is_some())?;
+    validate_encrypted_by_user(&data, &headers.user, data.organization_id.is_some())?;
 
     // The web/browser clients set this field to null as expected, but the
     // mobile clients seem to set the invalid value `0001-01-01T00:00:00`,
@@ -474,7 +496,7 @@ async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt
     // needed when creating a new cipher, so just ignore it unconditionally.
     data.last_known_revision_date = None;
 
-    let mut cipher = Cipher::new(data.r#type, String::new());
+    let mut cipher = Cipher::new(data.r#type);
     update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherCreate).await?;
 
     Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -498,6 +520,44 @@ async fn enforce_personal_ownership_policy(data: Option<&CipherData>, headers: &
     Ok(())
 }
 
+/// The checks of saving a cipher, for callers that run them before writing anything else
+async fn validate_cipher_update(
+    cipher: &Cipher,
+    data: &CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+    ut: UpdateType,
+) -> EmptyResult {
+    // Check that the client isn't updating an existing cipher with stale data.
+    // And only perform this check when not importing ciphers, else the date/time check will fail.
+    if ut != UpdateType::None
+        && let Some(dt) = &data.last_known_revision_date
+    {
+        match NaiveDateTime::parse_from_str(dt, "%+") {
+            // ISO 8601 format
+            Err(err) => warn!("Error parsing LastKnownRevisionDate '{dt}': {err}"),
+            Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => {
+                err!("The client copy of this cipher is out of date. Resync the client and try again.")
+            }
+            Ok(_) => (),
+        }
+    }
+
+    if let Some(note) = &data.notes {
+        let max_note_size = CONFIG._max_note_size();
+        if note.len() > max_note_size {
+            err!(format!("The field Notes exceeds the maximum encrypted value length of {max_note_size} characters."))
+        }
+    }
+
+    if let Some(folder_id) = &data.folder_id
+        && Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, conn).await.is_none()
+    {
+        err!("Invalid folder", "Folder does not exist or belongs to another user");
+    }
+    Ok(())
+}
+
 pub async fn update_cipher_from_data(
     cipher: &mut Cipher,
     data: CipherData,
@@ -506,6 +566,40 @@ pub async fn update_cipher_from_data(
     conn: &DbConn,
     nt: &Notify<'_>,
     ut: UpdateType,
+) -> EmptyResult {
+    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
+    save_cipher_data(cipher, data, headers, shared_to_collections, conn, nt, ut).await
+}
+
+/// [`update_cipher_from_data`] for a rotation: like upstream, the personal ownership policy doesn't apply.
+pub async fn rotate_cipher_data(
+    cipher: &mut Cipher,
+    data: CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+    nt: &Notify<'_>,
+) -> EmptyResult {
+    save_cipher_data(cipher, data, headers, None, conn, nt, UpdateType::None).await
+}
+
+/// The checks of [`rotate_cipher_data`] that need the database, to run on every cipher before the first is saved
+pub async fn validate_rotated_cipher(
+    cipher: &Cipher,
+    data: &CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+) -> EmptyResult {
+    validate_cipher_update(cipher, data, headers, conn, UpdateType::None).await
+}
+
+async fn save_cipher_data(
+    cipher: &mut Cipher,
+    data: CipherData,
+    headers: &Headers,
+    shared_to_collections: Option<Vec<CollectionId>>,
+    conn: &DbConn,
+    nt: &Notify<'_>,
+    ut: UpdateType,
 ) -> EmptyResult {
     // Cleanup cipher data, like removing the 'Response' key.
     // This key is somewhere generated during Javascript so no way for us this fix this.
@@ -521,37 +615,14 @@ pub async fn update_cipher_from_data(
         json_data
     }
 
-    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
-
     let is_blob = data.is_blob();
     data.validate_content(is_blob)?;
-
-    // Check that the client isn't updating an existing cipher with stale data.
-    // And only perform this check when not importing ciphers, else the date/time check will fail.
-    if ut != UpdateType::None
-        && let Some(dt) = data.last_known_revision_date
-    {
-        match NaiveDateTime::parse_from_str(&dt, "%+") {
-            // ISO 8601 format
-            Err(err) => warn!("Error parsing LastKnownRevisionDate '{dt}': {err}"),
-            Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => {
-                err!("The client copy of this cipher is out of date. Resync the client and try again.")
-            }
-            Ok(_) => (),
-        }
-    }
+    validate_cipher_update(cipher, &data, headers, conn, ut).await?;
 
     if cipher.organization_uuid.is_some() && cipher.organization_uuid != data.organization_id {
         err!("Organization mismatch. Please resync the client before updating the cipher")
     }
 
-    if let Some(note) = &data.notes {
-        let max_note_size = CONFIG._max_note_size();
-        if note.len() > max_note_size {
-            err!(format!("The field Notes exceeds the maximum encrypted value length of {max_note_size} characters."))
-        }
-    }
-
     // Check if this cipher is being transferred from a personal to an organization vault
     let transfer_cipher = cipher.organization_uuid.is_none() && data.organization_id.is_some();
 
@@ -582,12 +653,6 @@ pub async fn update_cipher_from_data(
         cipher.user_uuid = Some(headers.user.uuid.clone());
     }
 
-    if let Some(ref folder_id) = data.folder_id
-        && Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, conn).await.is_none()
-    {
-        err!("Invalid folder", "Folder does not exist or belongs to another user");
-    }
-
     // Modify attachments name and keys when rotating
     if let Some(attachments) = data.attachments2 {
         for (id, attachment) in attachments {
@@ -627,8 +692,7 @@ pub async fn update_cipher_from_data(
     };
 
     if let Some(blob) = data.data.filter(|_| is_blob) {
-        // A blob holds all of the content, the name included, so nothing is kept outside it. The name
-        // column can't be null, so it's left empty; `to_json` reports it as null, as upstream does.
+        // A blob holds everything, the name included; the column can't be null, so it's left empty
         // TODO: Make `ciphers.name` nullable and store `None` here instead.
         cipher.name = String::new();
         cipher.notes = None;
@@ -753,7 +817,7 @@ async fn post_ciphers_import(data: Json<ImportData>, headers: Headers, conn: DbC
         let folder_id = relations_map.get(&index).and_then(|i| folders.get(*i).cloned());
         cipher_data.folder_id = folder_id;
 
-        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
+        let mut cipher = Cipher::new(cipher_data.r#type);
         update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
     }
 
@@ -821,7 +885,8 @@ async fn put_cipher(
         err!("Cipher is not write accessible")
     }
 
-    validate_encrypted_by_user_key(&data, &headers.user, cipher.organization_uuid.is_some())?;
+    // Against the cipher we hold rather than the organization the client claims, like upstream
+    validate_encrypted_by_user(&data, &headers.user, cipher.organization_uuid.is_some())?;
 
     update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherUpdate).await?;
 
@@ -1081,9 +1146,7 @@ async fn post_cipher_share(
     conn: DbConn,
     nt: Notify<'_>,
 ) -> JsonResult {
-    let data: ShareCipherData = data.into_inner();
-
-    share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
+    put_cipher_share(cipher_id, data, headers, conn, nt).await
 }
 
 #[put("/ciphers/<cipher_id>/share", data = "<data>")]
@@ -1096,6 +1159,21 @@ async fn put_cipher_share(
 ) -> JsonResult {
     let data: ShareCipherData = data.into_inner();
 
+    // Upstream's `PutShare` checks, before anything is written.
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L899-L912>
+    // and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L498-L519>
+    if data.cipher.organization_id.is_none() {
+        err!("Cipher OrganizationId is required.")
+    }
+    if data.collection_ids.is_empty() {
+        err!("You must select at least one collection.")
+    }
+    if !Cipher::find_by_uuid(&cipher_id, &conn).await.is_some_and(|c| c.user_uuid.as_ref() == Some(&headers.user.uuid))
+    {
+        err_code!("Cipher doesn't exist", Status::NotFound.code)
+    }
+    validate_encrypted_for_user(&data.cipher, &headers.user.uuid)?;
+
     share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
 }
 
@@ -1115,18 +1193,35 @@ async fn put_cipher_share_selected(
 ) -> EmptyResult {
     let mut data: ShareSelectedCipherData = data.into_inner();
 
+    // Upstream's `PutShareMany` checks, before anything is written.
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1395-L1421>
+    // and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L560-L604>
     if data.ciphers.is_empty() {
         err!("You must select at least one cipher.")
     }
-
+    if data.ciphers.iter().any(|c| c.id.is_none() || c.organization_id.is_none()) {
+        err!("All Ciphers must have an Id and OrganizationId.")
+    }
+    if data.ciphers.iter().map(|c| &c.organization_id).collect::<HashSet<_>>().len() != 1 {
+        err!("All ciphers must be for the same organization.")
+    }
     if data.collection_ids.is_empty() {
         err!("You must select at least one collection.")
     }
-
     for cipher in &data.ciphers {
-        if cipher.id.is_none() {
-            err!("Request missing ids field")
-        }
+        let is_blob = cipher.is_blob();
+        cipher.validate_content(is_blob)?;
+        cipher.validate_type_data(is_blob)?;
+    }
+    for cipher in &data.ciphers {
+        validate_encrypted_for_user(cipher, &headers.user.uuid)?;
+    }
+    let owned_ciphers = Cipher::find_owned_by_user(&headers.user.uuid, &conn).await;
+    for cipher_data in &data.ciphers {
+        let Some(cipher) = owned_ciphers.iter().find(|c| cipher_data.id.as_ref() == Some(&c.uuid)) else {
+            err!("Trying to share ciphers that you do not own.")
+        };
+        validate_cipher_update(cipher, cipher_data, &headers, &conn, UpdateType::None).await?;
     }
 
     while let Some(cipher) = data.ciphers.pop() {
@@ -1173,6 +1268,22 @@ async fn share_cipher_by_uuid(
         err!("Organization mismatch. Please resync the client before updating the cipher")
     }
 
+    // When LastKnownRevisionDate is None, it is a new cipher, so send CipherCreate.
+    // If there is an override, like when handling multiple items, we want to prevent a push notification for every single item
+    let ut = if let Some(ut) = override_ut {
+        ut
+    } else if data.cipher.last_known_revision_date.is_some() {
+        UpdateType::SyncCipherUpdate
+    } else {
+        UpdateType::SyncCipherCreate
+    };
+
+    // For the same reason, the other checks of saving
+    let is_blob = data.cipher.is_blob();
+    data.cipher.validate_content(is_blob)?;
+    data.cipher.validate_type_data(is_blob)?;
+    validate_cipher_update(&cipher, &data.cipher, headers, conn, ut).await?;
+
     let mut shared_to_collections = vec![];
 
     if let Some(organization_id) = &data.cipher.organization_id {
@@ -1191,16 +1302,6 @@ async fn share_cipher_by_uuid(
         }
     }
 
-    // When LastKnownRevisionDate is None, it is a new cipher, so send CipherCreate.
-    // If there is an override, like when handling multiple items, we want to prevent a push notification for every single item
-    let ut = if let Some(ut) = override_ut {
-        ut
-    } else if data.cipher.last_known_revision_date.is_some() {
-        UpdateType::SyncCipherUpdate
-    } else {
-        UpdateType::SyncCipherCreate
-    };
-
     update_cipher_from_data(&mut cipher, data.cipher, headers, Some(shared_to_collections), conn, nt, ut).await?;
 
     Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, conn).await?))

src/api/core/organizations.rs

@@ -8,7 +8,7 @@ use crate::{
     CONFIG,
     api::admin::FAKE_ADMIN_UUID,
     api::{
-        EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
+        ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
         core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor},
     },
     auth::{AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite},
@@ -1829,7 +1829,7 @@ async fn post_org_import(
         cipher_data.folder_id = None;
         // Replace the client-provided, unvalidated organizationId with the real target org
         cipher_data.organization_id = Some(org_id.clone());
-        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
+        let mut cipher = Cipher::new(cipher_data.r#type);
         update_cipher_from_data(
             &mut cipher,
             cipher_data,
@@ -2764,8 +2764,26 @@ struct OrganizationUserRecoverAccountRequest {
 // But the clients do not seem to use this at all
 // Just add it here in case they will
 #[get("/organizations/<org_id>/public-key")]
-async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
-    if org_id != headers.membership.org_uuid {
+async fn get_organization_public_key(
+    org_id: OrganizationId,
+    headers: Headers,
+    member: Result<OrgMemberHeaders, &'static str>,
+    conn: DbConn,
+) -> JsonResult {
+    // SSO users without an org get the fake one, whose key the v2 JIT password flow fetches anyway
+    if org_id.eq_ignore_ascii_case(FAKE_SSO_IDENTIFIER) && headers.user.private_key.is_none() {
+        return Ok(Json(json!({
+            "object": "organizationPublicKey",
+            "publicKey": fake_sso_org_public_key().await?,
+        })));
+    }
+    let member = match member {
+        Ok(member) => member,
+        // The guard already logged it
+        Err(e) => return Err(crate::error::Error::new_msg(e).with_code(Status::Unauthorized.code)),
+    };
+
+    if org_id != member.membership.org_uuid {
         err!("Organization not found", "Organization id's do not match");
     }
     let Some(org) = Organization::find_by_uuid(&org_id, &conn).await else {
@@ -2778,11 +2796,30 @@ async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberH
     })))
 }
 
+/// The SDK only uses this key to wrap an account recovery key that it never sends for the fake org,
+/// so it is made once and its private half dropped.
+async fn fake_sso_org_public_key() -> ApiResult<String> {
+    static PUBLIC_KEY: std::sync::LazyLock<Option<String>> = std::sync::LazyLock::new(|| {
+        let der = openssl::rsa::Rsa::generate(2048).and_then(|rsa| rsa.public_key_to_der()).ok()?;
+        Some(data_encoding::BASE64.encode(&der))
+    });
+
+    let Ok(Some(public_key)) = tokio::task::spawn_blocking(|| PUBLIC_KEY.clone()).await else {
+        err!("Failed to generate the organization key")
+    };
+    Ok(public_key)
+}
+
 // Obsolete - Renamed to public-key (2023.8), left for backwards compatibility with older clients
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/OrganizationsController.cs#L487-L492
 #[get("/organizations/<org_id>/keys")]
-async fn get_organization_keys(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
-    get_organization_public_key(org_id, headers, conn).await
+async fn get_organization_keys(
+    org_id: OrganizationId,
+    headers: Headers,
+    member: Result<OrgMemberHeaders, &'static str>,
+    conn: DbConn,
+) -> JsonResult {
+    get_organization_public_key(org_id, headers, member, conn).await
 }
 
 // Will allow to reset 2FA too

src/api/identity.rs

@@ -546,7 +546,7 @@ async fn authenticated_response(
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "MasterKeyEncryptedUserKey": user.akey,
             "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.email
+            "Salt": user.master_password_salt()
         })
     } else {
         Value::Null
@@ -692,7 +692,7 @@ async fn user_api_key_login(
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "MasterKeyEncryptedUserKey": user.akey,
             "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.email
+            "Salt": user.master_password_salt()
         })
     } else {
         Value::Null

src/api/notifications.rs

@@ -386,8 +386,7 @@ impl WebSocketUsers {
         self.send_logout_with_reason(user, acting_device, None, conn).await;
     }
 
-    /// A logout that clients may handle differently depending on `reason`, e.g. syncing instead of
-    /// logging out after a key rotation that kept the sessions alive.
+    /// A logout that clients may handle differently depending on `reason`
     pub async fn send_logout_with_reason(
         &self,
         user: &User,
@@ -680,10 +679,9 @@ fn create_ping() -> Vec<u8> {
     serialize(&Value::Array(vec![6.into()]))
 }
 
-/// Why a logout was pushed. Absent for a plain logout.
+/// Why a logout was pushed, absent for a plain one. `KdfChange` isn't sent yet.
 ///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Enums/PushNotificationLogOutReason.cs>
-/// (`KdfChange = 0` is not sent by vaultwarden yet.)
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Enums/PushNotificationLogOutReason.cs#L3-L7>
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum LogOutReason {
     KeyRotation = 1,

src/auth.rs

@@ -686,8 +686,7 @@ impl<'r> FromRequest<'r> for Headers {
                 err_handler!("Error getting current route for stamp exception")
             };
 
-            // Expired exceptions are dropped the next time the stamp is reset, not here: writing them
-            // back from this request could undo a reset made since the user was read.
+            // Expired exceptions are only dropped on reset; writing them back here could undo a newer reset
             if !user.stamp_exceptions().iter().any(|e| e.allows(&claims.sstamp, current_route)) {
                 err_handler!("Invalid security stamp")
             }

src/config.rs

@@ -1424,10 +1424,10 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     "ssh-agent-v2",
     // Key Management Team
     "windows-native-credential-sync",
-    "pm-31050-no-logout-key-upgrade-rotation",
-    "pm-27278-v2-password-registration",
-    "enable-account-encryption-v2-jit-password-registration",
     "pm-30144-sdk-key-rotation",
+    "pm-31050-no-logout-key-upgrade-rotation",
+    "enable-account-encryption-v2-jit-password-registration",
+    "pm-27278-v2-password-registration",
     "force-upgrade-v2-encryption",
     // Mobile Team
     "pm-34171-card-scanner",

src/db/models/cipher.rs

@@ -19,7 +19,7 @@ use crate::{
         },
     },
     error::MapResult,
-    util::LowerCase,
+    util::{LowerCase, convert_json_key_lcase_first},
 };
 use macros::UuidFromParam;
 
@@ -63,13 +63,9 @@ pub struct Cipher {
     pub reprompt: Option<i32>,
 }
 
-/// Whether `data` is a sealed cipher blob rather than the legacy per-type JSON.
+/// Whether `data` is a v2 cipher blob, recognized like upstream by a top-level `format_version` key.
 ///
-/// Ciphers of v2 accounts are encrypted as a single blob that carries everything, name included,
-/// and is opaque to us. It is recognized the same way upstream does, by a top-level
-/// `format_version` key that the legacy JSON never has.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Vault/Entities/Cipher.cs>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Vault/Entities/Cipher.cs#L36-L41>
 pub fn is_data_blob_encrypted(data: &str) -> bool {
     serde_json::from_str::<Value>(data).is_ok_and(|d| is_blob_value(&d))
 }
@@ -86,7 +82,8 @@ pub enum RepromptType {
 
 /// Local methods
 impl Cipher {
-    pub fn new(atype: i32, name: String) -> Self {
+    /// The name is set when the data is saved, since a blob-encrypted cipher has it inside `data`
+    pub fn new(atype: i32) -> Self {
         let now = Utc::now().naive_utc();
 
         Self {
@@ -100,7 +97,7 @@ impl Cipher {
             key: None,
 
             atype,
-            name,
+            name: String::new(),
 
             notes: None,
             fields: None,
@@ -175,9 +172,8 @@ impl Cipher {
     ) -> Result<Value, crate::Error> {
         use crate::util::{format_date, validate_and_format_date};
 
-        // Parsed once here, since `data` can be large and this runs for every cipher in a sync.
-        // `LowerCase` only lowercases the first letter of each key, so it keeps `format_version`.
-        let type_data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data);
+        // Parsed once, since `data` can be large and this runs for every cipher in a sync
+        let type_data = serde_json::from_str::<Value>(&self.data);
         let is_blob_encrypted = type_data.as_ref().is_ok_and(is_blob_value);
 
         let mut attachments_json: Value = Value::Null;
@@ -215,62 +211,70 @@ impl Cipher {
             (false, false, false)
         };
 
-        // Like upstream, a cipher that was stored without fields or password history reports them as
-        // null rather than as an empty list; clients keep the two apart.
-        let fields_json: Option<Vec<_>> = self.fields.as_ref().map(|s| {
-            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
-                .ok()
-                .map(|d| {
-                    d.into_iter()
-                        .map(|mut f| {
-                            // Check if the `type` key is a number, strings break some clients
-                            // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
-                            // If not try to convert the string value to a number and fallback to `1`
-                            // If it is both not a number and not a string, fallback to `1`
-                            match f.data.get("type") {
-                                Some(t) if t.is_number() => {}
-                                Some(t) if t.is_string() => {
-                                    let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
-                                    f.data["type"] = json!(type_num);
-                                }
-                                _ => {
-                                    f.data["type"] = json!(1);
-                                }
+        let fields_json: Vec<_> = self
+            .fields
+            .as_ref()
+            .and_then(|s| {
+                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                    .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
+                    .ok()
+            })
+            .map(|d| {
+                d.into_iter()
+                    .map(|mut f| {
+                        // Check if the `type` key is a number, strings break some clients
+                        // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
+                        // If not try to convert the string value to a number and fallback to `1`
+                        // If it is both not a number and not a string, fallback to `1`
+                        match f.data.get("type") {
+                            Some(t) if t.is_number() => {}
+                            Some(t) if t.is_string() => {
+                                let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
+                                f.data["type"] = json!(type_num);
                             }
-                            f.data
-                        })
-                        .collect()
-                })
-                .unwrap_or_default()
-        });
+                            _ => {
+                                f.data["type"] = json!(1);
+                            }
+                        }
+                        f.data
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
 
-        let password_history_json: Option<Vec<_>> = self.password_history.as_ref().map(|s| {
-            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
-                .ok()
-                .map(|d| {
-                    // Check every password history item if they are valid and return it.
-                    // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
-                    // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
-                    d.into_iter()
-                        .filter_map(|d| match d.data.get("password") {
-                            Some(p) if p.is_string() => Some(d.data),
-                            _ => None,
-                        })
-                        .map(|mut d| {
-                            let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
-                                validate_and_format_date(l)
-                            } else {
-                                "1970-01-01T00:00:00.000000Z".to_owned()
-                            };
-                            d["lastUsedDate"] = json!(lud);
-                            d
-                        })
-                        .collect()
-                })
-                .unwrap_or_default()
-        });
+        let password_history_json: Vec<_> = self
+            .password_history
+            .as_ref()
+            .and_then(|s| {
+                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                    .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
+                    .ok()
+            })
+            .map(|d| {
+                // Check every password history item if they are valid and return it.
+                // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
+                // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
+                d.into_iter()
+                    .filter_map(|d| match d.data.get("password") {
+                        Some(p) if p.is_string() => Some(d.data),
+                        _ => None,
+                    })
+                    .map(|mut d| {
+                        let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
+                            validate_and_format_date(l)
+                        } else {
+                            "1970-01-01T00:00:00.000000Z".to_owned()
+                        };
+                        d["lastUsedDate"] = json!(lud);
+                        d
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+
+        // Like upstream, fields and password history stored as NULL are sent as null, not `[]`
+        let fields_json = self.fields.is_some().then_some(fields_json);
+        let password_history_json = self.password_history.is_some().then_some(password_history_json);
 
         let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
             if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
@@ -368,8 +372,7 @@ impl Cipher {
         };
 
         if is_blob_encrypted {
-            // The blob holds all of the content, so it is sent back as-is and the structured fields
-            // stay null, as upstream does. Only the name needs clearing, the others are never stored.
+            // Like upstream, sent as-is with the structured fields null
             json_object["data"] = json!(self.data);
             json_object["name"] = Value::Null;
         } else {
@@ -378,16 +381,18 @@ impl Cipher {
         Ok(json_object)
     }
 
-    /// The per-type data (`login`, `card`, …) of a legacy cipher, from `type_data` as parsed from
-    /// `self.data`, with fixups for values that are known to break clients.
+    /// The per-type data of a legacy cipher, with fixups for values known to break clients.
     fn legacy_type_data_json(&self, type_data: Result<Value, serde_json::Error>) -> Value {
         use crate::util::validate_and_format_date;
 
         // Get the type_data or a default to an empty json object '{}'.
         // If not passing an empty object, mobile clients will crash.
-        let mut type_data_json = type_data
-            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
-            .unwrap_or_else(|_| Value::Object(serde_json::Map::new()));
+        let mut type_data_json = if let Ok(data @ Value::Object(_)) = type_data {
+            convert_json_key_lcase_first(data)
+        } else {
+            warn!("Error parsing data field for {}", self.uuid);
+            Value::Object(serde_json::Map::new())
+        };
 
         // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
         // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.

src/db/models/organization.rs

@@ -54,9 +54,7 @@ pub struct Membership {
     pub atype: i32,
     pub reset_password_key: Option<String>,
     pub external_id: Option<String>,
-    /// A copy of the user's v2 upgrade token, kept when a v1 -> v2 upgrade leaves the account
-    /// recovery key (`reset_password_key`) wrapped by the v1 user key. It lets the organization
-    /// unwrap the v2 user key from it. Opaque to us, like `User::v2_upgrade_token`.
+    /// The user's v2 upgrade token, for the org to unwrap the v2 user key after an upgrade. Opaque to us.
     pub v2_upgrade_token: Option<String>,
 }
 

src/db/models/user.rs

@@ -74,13 +74,11 @@ pub struct User {
 
     pub key_id: Option<KeyId>,
 
-    // "v2" account cryptographic state. Either all of these are set (together with a row in
-    // `user_signature_key_pairs`) or none of them are; see `User::is_v2`.
+    // The v2 state: all set, with a `user_signature_key_pairs` row, or none, see `User::is_v2`
     pub signed_public_key: Option<String>,
     pub security_state: Option<String>,
     pub security_version: Option<i32>,
-    /// JSON `{"wrappedUserKey1": ..., "wrappedUserKey2": ...}`, letting clients that still hold the
-    /// v1 user key obtain the v2 one after another client performed the upgrade. Opaque to us.
+    /// JSON `{"wrappedUserKey1", "wrappedUserKey2"}` for sessions that still hold the v1 user key. Opaque to us.
     pub v2_upgrade_token: Option<String>,
 }
 
@@ -255,9 +253,7 @@ impl User {
 
     pub async fn reset_security_stamp(&mut self, conn: &DbConn) -> EmptyResult {
         self.security_stamp = get_uuid();
-        // A reset is meant to end the other sessions, which a key rotation's grace would undo. The
-        // route exceptions stay, since they are set right before a reset, for the stamp it replaces.
-        // This is also where expired exceptions get dropped.
+        // Keeps the unexpired route exceptions, set for the stamp being replaced, and drops a rotation's grace
         let mut exceptions = self.stamp_exceptions();
         exceptions.retain(|e| e.routes.is_some() && !e.is_expired());
         self.set_stamp_exceptions(&exceptions);
@@ -265,13 +261,7 @@ impl User {
         Ok(())
     }
 
-    /// Resets the security stamp after a key rotation, while letting the access tokens already
-    /// issued keep working until they expire.
-    ///
-    /// This is what upstream does: there the stamp is only checked when a token is refreshed, so a
-    /// rotation invalidates refresh tokens but not the access tokens in use. Clients rely on it to
-    /// keep a session going across a rotation. Chained rotations keep every earlier stamp that is
-    /// still within its window.
+    /// Resets the stamp but lets issued access tokens run out, as upstream only checks it on refresh.
     pub async fn reset_security_stamp_after_key_rotation(&mut self, conn: &DbConn) -> EmptyResult {
         let previous_stamp = self.security_stamp.clone();
         let mut grace: Vec<UserStampException> =
@@ -324,6 +314,11 @@ impl User {
         };
     }
 
+    /// Upstream's `GetMasterPasswordSalt`: there is no separate salt, so the normalized email
+    pub fn master_password_salt(&self) -> String {
+        self.email.trim().to_lowercase()
+    }
+
     pub fn display_name(&self) -> &str {
         // default to email if name is empty
         if self.name.is_empty() {
@@ -347,34 +342,35 @@ impl User {
         UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
     }
 
+    /// The `accountKeys` object (upstream's `PrivateKeysResponseModel`), null without a key pair
     pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
-        if self.private_key.is_none() {
-            return Value::Null;
+        if self.private_key.is_some() {
+            let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
+                Some(key_pair) => (
+                    json!(self.signed_public_key),
+                    key_pair.to_json(),
+                    json!({
+                        "securityState": self.security_state,
+                        "securityVersion": self.security_version,
+                    }),
+                ),
+                None => (Value::Null, Value::Null, Value::Null),
+            };
+
+            json!({
+                "publicKeyEncryptionKeyPair": {
+                    "wrappedPrivateKey": self.private_key,
+                    "publicKey": self.public_key,
+                    "signedPublicKey": signed_public_key,
+                    "object": "publicKeyEncryptionKeyPair",
+                },
+                "securityState": security_state,
+                "signatureKeyPair": signature_key_pair,
+                "object": "privateKeys"
+            })
+        } else {
+            Value::Null
         }
-
-        let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
-            Some(key_pair) => (
-                json!(self.signed_public_key),
-                key_pair.to_json(),
-                json!({
-                    "securityState": self.security_state,
-                    "securityVersion": self.security_version,
-                }),
-            ),
-            None => (Value::Null, Value::Null, Value::Null),
-        };
-
-        json!({
-            "publicKeyEncryptionKeyPair": {
-                "wrappedPrivateKey": self.private_key,
-                "publicKey": self.public_key,
-                "signedPublicKey": signed_public_key,
-                "object": "publicKeyEncryptionKeyPair",
-            },
-            "signatureKeyPair": signature_key_pair,
-            "securityState": security_state,
-            "object": "privateKeys"
-        })
     }
 
     pub async fn public_keys_json(&self, conn: &DbConn) -> Value {
@@ -680,18 +676,7 @@ pub struct UserId(String);
 )]
 #[deref(forward)]
 #[from(forward)]
-pub struct KeyId(#[serde(deserialize_with = "deserialize_key_id")] String);
-
-/// Rejects a key id from a request that isn't 16 bytes as lowercase hex, as upstream's `[KeyId]` does.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/KeyId.cs>
-fn deserialize_key_id<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
-    let key_id = <String as serde::Deserialize>::deserialize(deserializer)?;
-    if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
-        return Err(serde::de::Error::custom("Key id must be a 32 character lowercase hex-encoded string."));
-    }
-    Ok(key_id)
-}
+pub struct KeyId(String);
 
 impl SsoUser {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {

src/db/models/user_signature_key_pair.rs

@@ -12,14 +12,9 @@ use crate::{
 
 use super::UserId;
 
-/// A user's signature key pair, part of the "v2" account cryptographic state.
+/// A user's signature key pair, part of the v2 state, in its own table like upstream.
 ///
-/// Upstream keeps this in its own table rather than as columns on the user, with a unique index on
-/// the user id. The stated intent is to eventually keep superseded key pairs around (an `active`
-/// flag was sketched but not shipped), which is why this is modelled as a row with its own identity
-/// instead of a set of user attributes.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql>
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql#L1-L15>
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
 #[diesel(table_name = user_signature_key_pairs)]
 #[diesel(treat_none_as_null = true)]
@@ -38,7 +33,7 @@ pub struct UserSignatureKeyPair {
     pub updated_at: NaiveDateTime,
 }
 
-/// https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs#L6-L10>
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum SignatureAlgorithm {
     Ed25519 = 0,

src/util.rs

@@ -839,6 +839,12 @@ pub fn parse_experimental_client_feature_flags(
         .collect()
 }
 
+/// Whether the admin enabled this supported client feature flag
+pub fn is_client_feature_flag_enabled(flag: &str) -> bool {
+    parse_experimental_client_feature_flags(&CONFIG.experimental_client_feature_flags(), &FeatureFlagFilter::ValidOnly)
+        .contains_key(flag)
+}
+
 /// TODO: This is extracted from IpAddr::is_global, which is unstable:
 /// https://doc.rust-lang.org/nightly/std/net/enum.IpAddr.html#method.is_global
 /// Remove once https://github.com/rust-lang/rust/issues/27709 is merged

tools/sdk-live-tests/run.sh

@@ -6,7 +6,7 @@
 # Every test vector of the SDK (test-vectors/users/) that the tests can log in with gets a fresh
 # server and database, since the tests rotate the account's keys. Stops at the first failure; the
 # server logs are in target/sdk-live-tests/. Building the SDK needs its Rust toolchain with the
-# wasm32-unknown-unknown target and rust-src, Node.js, and binaryen (`npm i -g binaryen`).
+# wasm32-unknown-unknown target and rust-src, Node.js, and binaryen (`npm i -g binaryen@132.0.0`).
 set -euo pipefail
 
 VW_DIR="$(cd "$(dirname "$0")/../.." && pwd)"