Some simplifications

Add typo exception
Implement V2 key rotation support
2026-10-27 00:46:47 +02:00 · 2026-09-23 23:53:12 +02:00 · 2026-09-23 23:30:19 +02:00 · 2026-09-23 23:30:19 +02:00 · 2026-09-23 23:30:18 +02:00 · 2026-09-23 19:44:05 +02:00
62 changed files with 3979 additions and 3186 deletions
@@ -1,7 +1,7 @@
-// Ignore everything
+# Ignore everything
 *

-// Allow what is needed
+# Allow what is needed
 !.git
 !docker/healthcheck.sh
 !docker/start.sh
@@ -402,10 +402,13 @@
 ## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
 ## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
 ## - "pm-30529-webauthn-related-origins":
+## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
+## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
 ## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=

 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -58,13 +58,13 @@ jobs:

    steps:
      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
        with:
          platforms: "arm64,arm"

      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -185,7 +185,7 @@ jobs:

      - name: Bake ${{ matrix.base_image }} containers
        id: bake_vw
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
        env:
          BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          sarif_file: 'trivy-results.sarif'
@@ -23,4 +23,4 @@ jobs:

      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3 # v1.50.0
+        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
@@ -24,7 +24,7 @@ jobs:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
@@ -18,7 +18,7 @@ repos:

  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
  - repo: https://github.com/crate-ci/typos
-    rev: 4d9c206a77c041268485162b8e2579ad7a5cb9a3 # v1.50.0
+    rev: 512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
    hooks:
      - id: typos
        always_run: true
@@ -18,6 +18,7 @@ extend-ignore-re = [
    "COSE",
    "COSEKey",
    "COSEAlgorithm",
+    "CoseEncrypt0",
    # Ignore this specific string as it's valid
    "Ensure they are valid OTPs",
    # This word is misspelled upstream
@@ -12,7 +12,6 @@ members = ["macros"]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
-readme = "README.md"
 build = "build.rs"
 repository.workspace = true
 edition.workspace = true
@@ -41,6 +40,7 @@ vendored_openssl = ["openssl/vendored"]
 enable_mimalloc = ["dep:mimalloc"]
 s3 = [
    "opendal/services-s3",
+    "dep:opendal-http-transport-reqwest",
    "dep:aws-config",
    "dep:aws-credential-types",
    "dep:aws-smithy-runtime-api",
@@ -107,7 +107,7 @@ serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"

 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.12", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
+diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
 diesel_migrations = "2.3.2"

 derive_more = { version = "2.1.1", features = [
@@ -125,11 +125,11 @@ libsqlite3-sys = { version = "0.38.2", optional = true }
 # Crypto-related libraries
 rand = "0.10.2"
 ring = "0.17.14"
-rustls = { version = "0.23.43", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.45", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"

 # UUID generation
-uuid = { version = "1.26.0", features = ["v4"] }
+uuid = { version = "1.26.1", features = ["v4"] }

 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
@@ -143,7 +143,7 @@ job_scheduler_ng = "2.5.0"
 data-encoding = "2.11.1"

 # JWT library
-jsonwebtoken = { version = "11.0.0", default-features = false, features = ["rust_crypto", "use_pem"] }
+jsonwebtoken = { version = "11.1.0", default-features = false, features = ["rust_crypto", "use_pem"] }

 # TOTP library
 totp-lite = "2.0.1"
@@ -183,7 +183,7 @@ email_address = "0.2.9"
 handlebars = { version = "6.4.4", features = ["dir_source"] }

 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.13.4", default-features = false, features = [
+reqwest = { version = "0.13.5", default-features = false, features = [
    # Misc
    "charset",
    "cookies",
@@ -201,7 +201,7 @@ reqwest = { version = "0.13.4", default-features = false, features = [
    "socks",
    "system-proxy",
 ] }
-hickory-resolver = "0.26.1"
+hickory-resolver = "0.26.3"

 # Favicon extraction libraries
 html5gum = "0.8.4"
@@ -215,7 +215,7 @@ bytes = "1.12.1"
 svg-hush = "0.9.7"

 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "3.1.1", features = ["async"] }
+cached = { version = "4.0.0", features = ["async"] }

 # Used for custom short lived cookie jar during favicon extraction
 cookie = "0.18.2"
@@ -232,7 +232,7 @@ pastey = "0.2.3"
 governor = "0.10.4"

 # CIDR parsing for the trusted proxies of the client IP header
-ipnet = "2.12.1"
+ipnet = "2.12.2"

 # OIDC for SSO
 openidconnect = { version = "4.0.1", default-features = false }
@@ -257,17 +257,18 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }

 # File are accessed through Apache OpenDAL
-opendal = { version = "0.58.2", default-features = false, features = ["services-fs"] }
+opendal = { version = "0.59.2", default-features = false, features = ["services-fs"] }
+opendal-http-transport-reqwest = { version = "0.59.2", default-features = false, features = ["rustls-no-provider"], optional = true }

 # For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.11.0", optional = true, default-features = false, features = [
+aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
    "behavior-version-latest",
    "credentials-process",
    "rt-tokio",
    "sso",
 ] }
 aws-credential-types = { version = "1.3.0", optional = true }
-aws-smithy-runtime-api = { version = "1.15.0", optional = true }
+aws-smithy-runtime-api = { version = "1.16.2", optional = true }
 http = { version = "1.5.0", optional = true }
 reqsign-aws-v4 = { version = "3.3.0", optional = true }
 reqsign-core = { version = "3.3.1", optional = true }
@@ -5,7 +5,8 @@ vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
 xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
-rust_version: 1.98.0 # Rust version to be used
+# The `rust_version` variable is extracted from `rust-toolchain.toml`
+# rust_version: x.yy.z # Rust version to be used
 debian_version: trixie # Debian release name to be used
 alpine_version: "3.24" # Alpine version to be used
 # For which platforms/architectures will we try to build images
@@ -32,10 +32,10 @@ FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.98.0 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.98.0 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.98.0 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.98.0 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.98.1 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.98.1 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.98.1 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.98.1 AS build_armv6

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -36,7 +36,7 @@ FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.0-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.1-slim-trixie AS build
 # hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH
@@ -3,17 +3,23 @@
 import os
 import argparse
 import json
+import tomllib
 import yaml
 import jinja2

 # Load settings file
-with open("DockerSettings.yaml", 'r') as yaml_file:
+with open('DockerSettings.yaml', 'r', encoding='utf-8') as yaml_file:
 	yaml_data = yaml.safe_load(yaml_file)

+# Extract the rust_version from the rust-toolchain.toml file
+script_dir = os.path.dirname(os.path.abspath(__file__))
+with open(os.path.join(script_dir, '..', 'rust-toolchain.toml'), 'rb') as toolchain_file:
+    yaml_data["rust_version"] = tomllib.load(toolchain_file)["toolchain"]["channel"]
+
 settings_env = jinja2.Environment(
 	loader=jinja2.FileSystemLoader(os.getcwd()),
 )
-settings_yaml = yaml.safe_load(settings_env.get_template("DockerSettings.yaml").render(yaml_data))
+settings_yaml = yaml.safe_load(settings_env.get_template('DockerSettings.yaml').render(yaml_data))

 args_parser = argparse.ArgumentParser()
 args_parser.add_argument('template_file', help='Jinja2 template file to render.')
@@ -14,7 +14,7 @@ proc-macro = true

 [dependencies]
 quote = "1.0.47"
-syn = "3.0.4"
+syn = "3.0.6"

 [lints]
 workspace = true
@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -4,3 +4,4 @@ ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -2,8 +2,7 @@ ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-
-DROP TABLE IF EXISTS user_signature_key_pairs;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

 CREATE TABLE user_signature_key_pairs (
    uuid                CHAR(36) NOT NULL PRIMARY KEY,
@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -4,3 +4,4 @@ ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -2,8 +2,7 @@ ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-
-DROP TABLE IF EXISTS user_signature_key_pairs;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

 CREATE TABLE user_signature_key_pairs (
    uuid                CHAR(36) NOT NULL PRIMARY KEY,
@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -4,3 +4,4 @@ ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -2,8 +2,7 @@ ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-
-DROP TABLE IF EXISTS user_signature_key_pairs;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

 CREATE TABLE user_signature_key_pairs (
    uuid                TEXT     NOT NULL PRIMARY KEY,
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.98.0"
+channel = "1.98.1"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
@@ -1,6 +1,7 @@
 use std::collections::HashSet;

 use chrono::Utc;
+use num_traits::FromPrimitive;
 use rocket::{
    http::Status,
    request::{FromRequest, Outcome, Request},
@@ -11,7 +12,7 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::{
-        AnonymousNotify, ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
+        AnonymousNotify, ApiResult, EmptyResult, JsonResult, LogOutReason, Notify, PasswordOrOtpData, UpdateType,
        core::{accept_org_invite, log_user_event, two_factor::email},
        master_password_policy, register_push_device, unregister_push_device,
    },
@@ -21,9 +22,9 @@ use crate::{
        DbConn, DbPool,
        models::{
            AuthRequest, AuthRequestId, Cipher, CipherId, Device, DeviceId, DeviceType, DeviceWithAuthRequest,
-            EmergencyAccess, EmergencyAccessId, EventType, Folder, FolderId, Invitation, Membership, MembershipId,
-            OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, SignatureAlgorithm, User, UserId,
-            UserKdfType, UserSignatureKeyPair,
+            EmergencyAccess, EmergencyAccessId, EventType, Folder, FolderId, Invitation, KeyId, Membership,
+            MembershipId, OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, SignatureAlgorithm,
+            User, UserId, UserKdfType, UserSignatureKeyPair,
        },
    },
    mail,
@@ -48,7 +49,10 @@ pub fn routes() -> Vec<rocket::Route> {
        post_password,
        post_set_password,
        post_kdf,
+        get_key_rotation_data,
        post_rotatekey,
+        post_user_key,
+        post_rotate_user_keys,
        post_sstamp,
        post_email_token,
        post_email,
@@ -172,6 +176,14 @@ impl RegisterDataCompat {
        self.fold(|rdc| &rdc.key, |rdcu| &rdcu.master_password_unlock.key).to_owned()
    }

+    /// The id of the user key, which only the current format carries.
+    fn key_id(&self) -> Option<KeyId> {
+        match self {
+            RegisterDataCompat::RegisterDataOld(_) => None,
+            RegisterDataCompat::RegisterDataCur(rdcu) => rdcu.master_password_unlock.contained_key_id.clone(),
+        }
+    }
+
    // When comparing with salt, email need to be normalized:
    //  - https://github.com/bitwarden/clients/blob/web-v2026.5.0/libs/common/src/key-management/master-password/services/master-password.service.ts#L171
    fn unprocessable(&self, email: &str) -> bool {
@@ -273,7 +285,7 @@ impl AccountKeysData {

        let v2 = match (signed_public_key, self.signature_key_pair, self.security_state) {
            (Some(signed_public_key), Some(signature_key_pair), Some(security_state)) => {
-                let Some(signature_algorithm) = SignatureAlgorithm::from_str(&signature_key_pair.signature_algorithm)
+                let Some(signature_algorithm) = SignatureAlgorithm::parse(&signature_key_pair.signature_algorithm)
                else {
                    err!(format!("Unsupported signature algorithm: {}", signature_key_pair.signature_algorithm))
                };
@@ -301,6 +313,23 @@ impl AccountKeysData {
    }
 }

+impl WrappedAccountCryptographicState {
+    /// This shape is v2-only: the key pairs and security state were already required by the
+    /// deserializer, so a missing signed public key fails the all-or-nothing check in
+    /// [`AccountKeysData::validate`] rather than falling back to v1, which would silently turn a
+    /// rotation into a downgrade.
+    fn validate(self) -> ApiResult<ValidatedAccountKeys> {
+        AccountKeysData {
+            user_key_encrypted_account_private_key: None,
+            account_public_key: None,
+            public_key_encryption_key_pair: Some(self.public_key_encryption_key_pair),
+            signature_key_pair: Some(self.signature_key_pair),
+            security_state: Some(self.security_state),
+        }
+        .validate()
+    }
+}
+
 impl From<KeysData> for ValidatedAccountKeys {
    fn from(keys: KeysData) -> Self {
        Self {
@@ -312,6 +341,19 @@ impl From<KeysData> for ValidatedAccountKeys {
 }

 impl ValidatedAccountKeys {
+    /// The keys of a request that may carry either shape. `accountKeys` supersedes the flat `keys`
+    /// object when both are sent.
+    fn from_request(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Option<Self>> {
+        match (account_keys, keys) {
+            (Some(account_keys), _) => account_keys.validate().map(Some),
+            (None, keys) => Ok(keys.map(Self::from)),
+        }
+    }
+
+    fn is_v2(&self) -> bool {
+        self.v2.is_some()
+    }
+
    /// Writes the parts of the state that live on the user itself. The user still needs saving, and
    /// [`Self::save_signature_key_pair`] still needs calling once it has been.
    ///
@@ -339,7 +381,7 @@ impl ValidatedAccountKeys {
            return Ok(());
        };

-        let mut key_pair = match UserSignatureKeyPair::find_active_by_user(user_id, conn).await {
+        let mut key_pair = match UserSignatureKeyPair::find_by_user(user_id, conn).await {
            Some(mut key_pair) => {
                key_pair.signature_algorithm = v2.signature_algorithm as i32;
                key_pair.signing_key.clone_from(&v2.signing_key);
@@ -375,6 +417,7 @@ pub struct MasterPasswordUnlock {

    #[serde(alias = "masterKeyWrappedUserKey")]
    key: String,
+    contained_key_id: Option<KeyId>,
 }

 #[derive(Debug, Deserialize)]
@@ -502,10 +545,11 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
        err!("The field Name must be a string with a maximum length of 50.");
    }

-    // Check against the password hint setting here so if it fails, the user
-    // can retry without losing their invitation below.
+    // Check against the password hint setting and the keys here so if they fail,
+    // the user can retry without losing their invitation below.
    let password_hint = clean_password_hint(data.master_password_hint.as_ref());
    enforce_password_hint_setting(password_hint.as_ref())?;
+    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;

    let mut user = match User::find_by_mail(&email, &conn).await {
        Some(user) => {
@@ -562,13 +606,13 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
        user.name = name;
    }

-    let account_keys = match (data.account_keys, data.keys) {
-        (Some(account_keys), _) => Some(account_keys.validate()?),
-        (None, Some(keys)) => Some(keys.into()),
-        (None, None) => None,
-    };
    if let Some(ref account_keys) = account_keys {
        account_keys.apply(&mut user)?;
+        // Like upstream, only a v2 registration records the user key id. A v1 account reports it
+        // later, through `user-key-id`.
+        if account_keys.is_v2() {
+            user.key_id = data.compat.key_id();
+        }
    }

    if email_verified {
@@ -627,11 +671,7 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
    let password_hint = clean_password_hint(data.master_password_hint.as_ref());
    enforce_password_hint_setting(password_hint.as_ref())?;

-    let account_keys = match (data.account_keys, data.keys) {
-        (Some(account_keys), _) => Some(account_keys.validate()?),
-        (None, Some(keys)) => Some(keys.into()),
-        (None, None) => None,
-    };
+    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;

    set_kdf_data(&mut user, data.compat.kdf())?;

@@ -647,6 +687,10 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:

    if let Some(ref account_keys) = account_keys {
        account_keys.apply(&mut user)?;
+        // As in `register`, only a v2 account records the user key id here
+        if account_keys.is_v2() {
+            user.key_id = data.compat.key_id();
+        }
    }

    if let Some(identifier) = data.org_identifier
@@ -790,6 +834,8 @@ struct PostKeysData {
    #[serde(flatten)]
    keys: Option<KeysData>,
    account_keys: Option<AccountKeysData>,
+    // The id of the user key these account keys belong to, only honored for v2 `accountKeys`
+    user_key_id: Option<KeyId>,
 }

 #[post("/accounts/keys", data = "<data>")]
@@ -798,9 +844,25 @@ async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) ->

    let mut user = headers.user;

+    // This only sets the keys of an account that has none yet. Replacing existing ones is what a key
+    // rotation does, with the checks that go with it.
+    if user.private_key.is_some() || user.public_key.is_some() {
+        err!("User has existing keypair")
+    }
+
    // `accountKeys` supersedes the flat `keys` object when both are sent.
    let account_keys = match (data.account_keys, data.keys) {
-        (Some(account_keys), _) => account_keys.validate()?,
+        (Some(account_keys), _) => {
+            let account_keys = account_keys.validate()?;
+            if !account_keys.is_v2() {
+                err!("AccountKeys are only supported for V2 encryption.")
+            }
+            // A client that predates key ids sends none, and reports it later through `user-key-id`
+            if data.user_key_id.is_some() {
+                user.key_id = data.user_key_id;
+            }
+            account_keys
+        }
        (None, Some(keys)) => keys.into(),
        (None, None) => err!("No account keys provided"),
    };
@@ -853,6 +915,8 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbCon
                err!("Invalid master password salt")
            }

+            validate_key_id_unchanged(&user, &unlock_data)?;
+
            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
            (new_master_password_hash, new_key)
@@ -938,6 +1002,21 @@ struct UnlockData {
    salt: String,
    kdf: KDFData,
    master_key_wrapped_user_key: String,
+    contained_key_id: Option<KeyId>,
+}
+
+/// A password or KDF change re-wraps the same user key, so a key id sent with it has to be the
+/// current one. Either may be missing: from a client that predates key ids, or a user whose key id
+/// isn't known yet. There is nothing to compare in those cases.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
+fn validate_key_id_unchanged(user: &User, unlock_data: &UnlockData) -> EmptyResult {
+    if let (Some(current), Some(contained)) = (&user.key_id, &unlock_data.contained_key_id)
+        && current != contained
+    {
+        err!("Invalid user key sent in master-password unlock data.")
+    }
+    Ok(())
 }

 #[derive(Deserialize)]
@@ -964,6 +1043,8 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, conn: DbConn, nt:
        err!("Invalid master password salt")
    }

+    validate_key_id_unchanged(&headers.user, &data.unlock_data)?;
+
    let mut user = headers.user;

    set_kdf_data(&mut user, &data.unlock_data.kdf)?;
@@ -1005,43 +1086,62 @@ struct UpdateEmergencyAccessData {
 #[serde(rename_all = "camelCase")]
 struct UpdateResetPasswordData {
    organization_id: OrganizationId,
-    reset_password_key: String,
+    // Absent in a v1 -> v2 upgrade, which keeps the key the organization already holds
+    reset_password_key: Option<String>,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct KeyData {
    account_unlock_data: RotateAccountUnlockData,
-    account_keys: RotateAccountKeys,
+    account_keys: AccountKeysData,
    account_data: RotateAccountData,
    old_master_key_authentication_hash: String,
+    new_user_key_id: Option<KeyId>,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RotateAccountUnlockData {
-    emergency_access_unlock_data: Vec<UpdateEmergencyAccessData>,
    master_password_unlock_data: MasterPasswordUnlockData,
-    organization_account_recovery_unlock_data: Vec<UpdateResetPasswordData>,
+    #[serde(flatten)]
+    common: CommonUnlockData,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct MasterPasswordUnlockData {
-    kdf_type: i32,
-    kdf_iterations: i32,
-    kdf_parallelism: Option<i32>,
-    kdf_memory: Option<i32>,
+    #[serde(flatten)]
+    kdf: KDFData,
    email: String,
    master_key_authentication_hash: String,
    master_key_encrypted_user_key: String,
+    contained_key_id: Option<KeyId>,
 }

+/// The unlock data both rotation endpoints share. Vaultwarden has neither trusted device encryption
+/// nor passkey login, so `key-rotation-data` reports none of either and these must arrive empty.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Models/Requests/CommonUnlockDataRequestModel.cs>
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct RotateAccountKeys {
-    user_key_encrypted_account_private_key: String,
-    account_public_key: String,
+struct CommonUnlockData {
+    emergency_access_unlock_data: Vec<UpdateEmergencyAccessData>,
+    organization_account_recovery_unlock_data: Vec<UpdateResetPasswordData>,
+    #[serde(default)]
+    passkey_unlock_data: Vec<Value>,
+    #[serde(default)]
+    device_key_unlock_data: Vec<Value>,
+    v2_upgrade_token: Option<V2UpgradeTokenData>,
+}
+
+/// Lets clients that still hold the v1 user key derive the v2 one after another client upgraded the
+/// account, so a v1 -> v2 upgrade doesn't have to log every other session out. Opaque to us.
+#[derive(Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct V2UpgradeTokenData {
+    wrapped_user_key1: String,
+    wrapped_user_key2: String,
 }

 #[derive(Deserialize)]
@@ -1052,31 +1152,148 @@ struct RotateAccountData {
    sends: Vec<SendData>,
 }

-fn validate_keydata(
-    data: &KeyData,
+/// Body of `rotate-user-keys`, which rotates the keys without touching the master password.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RotateUserKeysData {
+    wrapped_account_cryptographic_state: WrappedAccountCryptographicState,
+    unlock_data: CommonUnlockData,
+    account_data: RotateAccountData,
+    unlock_method_data: UnlockMethodData,
+    new_user_key_id: Option<KeyId>,
+}
+
+/// The v2-only account cryptographic state, where all three parts are mandatory.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct WrappedAccountCryptographicState {
+    public_key_encryption_key_pair: PublicKeyEncryptionKeyPairData,
+    signature_key_pair: SignatureKeyPairData,
+    security_state: SecurityStateData,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct UnlockMethodData {
+    unlock_method: i32,
+    master_password_unlock_data: Option<RotateMasterPasswordUnlockData>,
+    // `keyConnectorKeyWrappedUserKey` is deliberately not read: that unlock method is rejected.
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RotateMasterPasswordUnlockData {
+    kdf: KDFData,
+    salt: String,
+    master_key_wrapped_user_key: String,
+    contained_key_id: Option<KeyId>,
+}
+
+/// The user key wrapped in the master password unlock data has to be the new one.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
+fn validate_contained_key_id(contained_key_id: Option<&KeyId>, new_user_key_id: Option<&KeyId>) -> EmptyResult {
+    match (contained_key_id, new_user_key_id) {
+        // Neither is sent by clients that predate key ids
+        (None, None) => Ok(()),
+        (Some(contained), Some(new)) if contained == new => Ok(()),
+        _ => err!("Invalid user key sent in master-password unlock data."),
+    }
+}
+
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Enums/UnlockMethod.cs>
+#[derive(num_derive::FromPrimitive)]
+enum UnlockMethod {
+    Tde = 0,
+    MasterPassword = 1,
+    KeyConnector = 2,
+}
+
+/// The rotation-specific checks on the new account keys.
+///
+/// A rotation re-wraps the existing keys under a new user key; it must not swap the identity the
+/// account presents to others. So the public key never changes, and for an account that is already
+/// v2 the verifying key doesn't either — only the *wrapped* signing key does. A v1 account may gain
+/// a signature key pair, which is the v1 -> v2 upgrade.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs>
+async fn validate_rotation_account_keys(keys: &ValidatedAccountKeys, user: &User, conn: &DbConn) -> EmptyResult {
+    if user.public_key.as_ref() != Some(&keys.public_key) {
+        err!("Changing the asymmetric keypair is not possible during key rotation")
+    }
+
+    let Some(v2) = &keys.v2 else {
+        if user.is_v2() {
+            err!("Cannot downgrade an account from v2 to v1 encryption during key rotation")
+        }
+        // A v1 rotation: the private key stays wrapped by an AES-CBC-HMAC user key
+        if enc_string_type(&keys.private_key) != Some(ENC_TYPE_AES_CBC_256_HMAC_SHA256) {
+            err!("The provided account private key was not wrapped with AES-256-CBC-HMAC")
+        }
+        return Ok(());
+    };
+
+    // Both a v2 rotation and the v1 -> v2 upgrade end up with a COSE user key wrapping the private keys
+    if enc_string_type(&v2.signing_key) != Some(ENC_TYPE_COSE_ENCRYPT0) {
+        err!("The provided signing key data is not wrapped with XChaCha20-Poly1305.")
+    }
+    if enc_string_type(&keys.private_key) != Some(ENC_TYPE_COSE_ENCRYPT0) {
+        err!("The provided private key encryption key is not wrapped with XChaCha20-Poly1305.")
+    }
+    if v2.verifying_key.is_empty() || v2.signed_public_key.is_empty() || v2.security_state.is_empty() {
+        err!("The v2 account keys are missing the verifying key, signed public key or security state")
+    }
+
+    if !user.is_v2() {
+        // The v1 -> v2 upgrade, which is where the signature key pair comes from
+        return Ok(());
+    }
+
+    let Some(key_pair) = UserSignatureKeyPair::find_by_user(&user.uuid, conn).await else {
+        err!("The account is missing its signature key pair")
+    };
+    if key_pair.verifying_key != v2.verifying_key {
+        err!("Changing the verifying key is not possible during key rotation")
+    }
+
+    Ok(())
+}
+
+/// `AesCbc256_HmacSha256_B64`, the v1 user key
+const ENC_TYPE_AES_CBC_256_HMAC_SHA256: &str = "2";
+/// `CoseEncrypt0B64`, the v2 user key
+const ENC_TYPE_COSE_ENCRYPT0: &str = "7";
+
+/// The encryption type of an EncString, the number before the first `.`.
+fn enc_string_type(enc_string: &str) -> Option<&str> {
+    enc_string.split_once('.').map(|(enc_type, _)| enc_type)
+}
+
+impl KDFData {
+    /// Whether these are the settings the user already has, which a key rotation can't change.
+    fn is_unchanged_for(&self, user: &User) -> bool {
+        user.client_kdf_type == self.kdf
+            && user.client_kdf_iter == self.kdf_iterations
+            && user.client_kdf_memory == self.kdf_memory
+            && user.client_kdf_parallelism == self.kdf_parallelism
+    }
+}
+
+/// A rotation re-encrypts everything under the new user key, so anything left out would be
+/// unreadable afterwards. Both rotation endpoints require the client to send the complete set.
+fn validate_rotation_data(
+    data: &RotateData,
    existing_ciphers: &[Cipher],
    existing_folders: &[Folder],
    existing_emergency_access: &[EmergencyAccess],
    existing_memberships: &[Membership],
    existing_sends: &[Send],
-    user: &User,
 ) -> EmptyResult {
-    if user.client_kdf_type != data.account_unlock_data.master_password_unlock_data.kdf_type
-        || user.client_kdf_iter != data.account_unlock_data.master_password_unlock_data.kdf_iterations
-        || user.client_kdf_memory != data.account_unlock_data.master_password_unlock_data.kdf_memory
-        || user.client_kdf_parallelism != data.account_unlock_data.master_password_unlock_data.kdf_parallelism
-        || user.email != data.account_unlock_data.master_password_unlock_data.email
-    {
-        err!("Changing the kdf variant or email is not supported during key rotation");
-    }
-    if user.public_key.as_ref() != Some(&data.account_keys.account_public_key) {
-        err!("Changing the asymmetric keypair is not possible during key rotation")
-    }
+    let account_data = &data.account_data;

    // Check that we're correctly rotating all the user's ciphers
    let existing_cipher_ids = existing_ciphers.iter().map(|c| &c.uuid).collect::<HashSet<&CipherId>>();
-    let provided_cipher_ids = data
-        .account_data
+    let provided_cipher_ids = account_data
        .ciphers
        .iter()
        .filter(|c| c.organization_id.is_none())
@@ -1088,8 +1305,7 @@ fn validate_keydata(

    // Check that we're correctly rotating all the user's folders
    let existing_folder_ids = existing_folders.iter().map(|f| &f.uuid).collect::<HashSet<&FolderId>>();
-    let provided_folder_ids =
-        data.account_data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
+    let provided_folder_ids = account_data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
    if !provided_folder_ids.is_superset(&existing_folder_ids) {
        err!("All existing folders must be included in the rotation")
    }
@@ -1097,12 +1313,8 @@ fn validate_keydata(
    // Check that we're correctly rotating all the user's emergency access keys
    let existing_emergency_access_ids =
        existing_emergency_access.iter().map(|ea| &ea.uuid).collect::<HashSet<&EmergencyAccessId>>();
-    let provided_emergency_access_ids = data
-        .account_unlock_data
-        .emergency_access_unlock_data
-        .iter()
-        .map(|ea| &ea.id)
-        .collect::<HashSet<&EmergencyAccessId>>();
+    let provided_emergency_access_ids =
+        data.unlock_data.emergency_access_unlock_data.iter().map(|ea| &ea.id).collect::<HashSet<&EmergencyAccessId>>();
    if !provided_emergency_access_ids.is_superset(&existing_emergency_access_ids) {
        err!("All existing emergency access keys must be included in the rotation")
    }
@@ -1111,7 +1323,7 @@ fn validate_keydata(
    let existing_reset_password_ids =
        existing_memberships.iter().map(|m| &m.org_uuid).collect::<HashSet<&OrganizationId>>();
    let provided_reset_password_ids = data
-        .account_unlock_data
+        .unlock_data
        .organization_account_recovery_unlock_data
        .iter()
        .map(|rp| &rp.organization_id)
@@ -1122,7 +1334,7 @@ fn validate_keydata(

    // Check that we're correctly rotating all the user's sends
    let existing_send_ids = existing_sends.iter().map(|s| &s.uuid).collect::<HashSet<&SendId>>();
-    let provided_send_ids = data.account_data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
+    let provided_send_ids = account_data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
    if !provided_send_ids.is_superset(&existing_send_ids) {
        err!("All existing sends must be included in the rotation")
    }
@@ -1130,25 +1342,142 @@ fn validate_keydata(
    Ok(())
 }

+/// The public keys and encrypted keysets that participate in a key rotation, so the client can
+/// re-share the new user key without having to piece this together from several endpoints.
+///
+/// The four collections must always be present, even when empty: the SDK errors out if any of them
+/// is missing. `trustedDeviceKeyData` and `passkeyKeyData` are always empty here, since vaultwarden
+/// supports neither trusted device encryption nor passkey (PRF) login.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/UserKey/Queries/KeyRotationDataQuery.cs>
+#[get("/accounts/key-management/key-rotation-data")]
+async fn get_key_rotation_data(headers: Headers, conn: DbConn) -> JsonResult {
+    let user_id = &headers.user.uuid;
+
+    let mut organization_data = Vec::new();
+    for membership in Membership::find_by_user(user_id, &conn).await {
+        // Only memberships actually enrolled in account recovery take part in the rotation.
+        if membership.reset_password_key.is_none() {
+            continue;
+        }
+        let Some(org) = Organization::find_by_uuid(&membership.org_uuid, &conn).await else {
+            continue;
+        };
+        let Some(public_key) = org.public_key else {
+            continue;
+        };
+        organization_data.push(json!({
+            "organizationId": org.uuid,
+            "organizationName": org.name,
+            "organizationPublicKey": public_key,
+            "object": "organizationPasswordResetKeyData",
+        }));
+    }
+
+    let mut emergency_access_data = Vec::new();
+    for emergency_access in EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await {
+        // Without a stored key there is nothing to re-share.
+        if emergency_access.key_encrypted.is_none() {
+            continue;
+        }
+        let Some(grantee_id) = emergency_access.grantee_uuid.clone() else {
+            continue;
+        };
+        let Some(grantee) = User::find_by_uuid(&grantee_id, &conn).await else {
+            continue;
+        };
+        let Some(public_key) = grantee.public_key.clone() else {
+            continue;
+        };
+        emergency_access_data.push(json!({
+            "id": emergency_access.uuid,
+            "granteeId": grantee_id,
+            "granteeName": grantee.name,
+            "granteeEmail": grantee.email,
+            "publicKey": public_key,
+            "object": "emergencyAccessKeyData",
+        }));
+    }
+
+    Ok(Json(json!({
+        "organizationPasswordResetKeyData": organization_data,
+        "emergencyAccessKeyData": emergency_access_data,
+        "trustedDeviceKeyData": [],
+        "passkeyKeyData": [],
+        "object": "keyRotationData",
+    })))
+}
+
+/// Everything a rotation replaces, once each endpoint's wrapper has been peeled off.
+struct RotateData {
+    account_keys: ValidatedAccountKeys,
+    account_data: RotateAccountData,
+    unlock_data: CommonUnlockData,
+    /// Only v2 (COSE) user keys have an id, so this is `None` for a v1 -> v1 rotation.
+    new_user_key_id: Option<KeyId>,
+    /// The new user key, wrapped by the master key.
+    wrapped_user_key: String,
+    /// Only for `rotate-user-account-keys`, where the master password changes along with the keys.
+    new_password_hash: Option<String>,
+}
+
+impl CommonUnlockData {
+    /// We advertise no trusted devices or passkeys in `key-rotation-data`, so a client sending
+    /// either has produced keys for something that doesn't exist here. Silently dropping them would
+    /// leave the client believing an unlock method was rotated when it wasn't.
+    fn validate(&self) -> EmptyResult {
+        if !self.passkey_unlock_data.is_empty() {
+            err!("Passkey unlock is not supported")
+        }
+        if !self.device_key_unlock_data.is_empty() {
+            err!("Trusted device unlock is not supported")
+        }
+        Ok(())
+    }
+}
+
 #[post("/accounts/key-management/rotate-user-account-keys", data = "<data>")]
 async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    // TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
    let data: KeyData = data.into_inner();

    if !headers.user.check_valid_password(&data.old_master_key_authentication_hash) {
        err!("Invalid password")
    }

-    // Validate the import before continuing
-    // Bitwarden does not process the import if there is one item invalid.
-    // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
-    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
-    Cipher::validate_cipher_data(&data.account_data.ciphers)?;
+    let unlock_data = data.account_unlock_data.master_password_unlock_data;
+    if !unlock_data.kdf.is_unchanged_for(&headers.user) || unlock_data.email != headers.user.email {
+        err!("Changing the kdf variant or email is not supported during key rotation");
+    }
+    validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
+
+    let mut common = data.account_unlock_data.common;
+    // This endpoint always logs every session out, so an upgrade token is never kept here. That
+    // also clears one left over from an earlier upgrade. Ref: upstream's AccountsKeyManagementController
+    common.v2_upgrade_token = None;
+
+    rotate_account(
+        RotateData {
+            account_keys: data.account_keys.validate()?,
+            account_data: data.account_data,
+            unlock_data: common,
+            new_user_key_id: data.new_user_key_id,
+            wrapped_user_key: unlock_data.master_key_encrypted_user_key,
+            new_password_hash: Some(unlock_data.master_key_authentication_hash),
+        },
+        headers,
+        conn,
+        nt,
+    )
+    .await
+}
+
+/// The body shared by both rotation endpoints: check that the client re-encrypted everything, re-save
+/// it, then swap the account keys and the wrapped user key.
+async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    // TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
+    data.unlock_data.validate()?;

    let user_id = &headers.user.uuid;
-
-    // TODO: Ideally we'd do everything after this point in a single transaction.
-
    let mut existing_ciphers = Cipher::find_owned_by_user(user_id, &conn).await;
    let mut existing_folders = Folder::find_by_user(user_id, &conn).await;
    let mut existing_emergency_access = EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await;
@@ -1157,16 +1486,50 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
    existing_memberships.retain(|m| m.reset_password_key.is_some());
    let mut existing_sends = Send::find_by_user(user_id, &conn).await;

-    validate_keydata(
+    validate_rotation_data(
        &data,
        &existing_ciphers,
        &existing_folders,
        &existing_emergency_access,
        &existing_memberships,
        &existing_sends,
-        &headers.user,
    )?;

+    validate_rotation_account_keys(&data.account_keys, &headers.user, &conn).await?;
+
+    // The upgrade token only means anything for a v1 account moving to v2: it lets sessions still
+    // holding the v1 user key pick up the v2 one instead of being forced to re-authenticate. For an
+    // account that is already v2 it is meaningless, so it gets discarded and the security stamp is
+    // reset, as a rotation otherwise would. That ends the refresh tokens, while the access tokens in
+    // use run out on their own, as upstream.
+    let is_upgrade = data.unlock_data.v2_upgrade_token.is_some() && !headers.user.is_v2();
+    let upgrade_token = match &data.unlock_data.v2_upgrade_token {
+        Some(token) if is_upgrade => Some(serde_json::to_string(token)?),
+        _ => None,
+    };
+
+    // An upgrade can't re-wrap the account recovery keys: that needs the organization's public key
+    // to be trusted, and an upgrade shows the user no prompt. So the stored keys are kept, and each
+    // organization gets the upgrade token instead, to unwrap the v2 user key with.
+    // Ref: upstream's OrganizationUserRotationValidator
+    for reset_password_data in &data.unlock_data.organization_account_recovery_unlock_data {
+        let has_key = reset_password_data.reset_password_key.as_deref().is_some_and(|k| !k.is_empty());
+        if is_upgrade && has_key {
+            err!("Account recovery keys cannot be rotated during a V1 to V2 upgrade rotation.")
+        }
+        if !is_upgrade && !has_key {
+            err!("Account recovery keys cannot be null or empty during rotation.")
+        }
+    }
+
+    // Validate the import before continuing
+    // Bitwarden does not process the import if there is one item invalid.
+    // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
+    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
+    Cipher::validate_cipher_data(&data.account_data.ciphers)?;
+
+    // TODO: Ideally we'd do everything after this point in a single transaction.
+
    // Update folder data
    for folder_data in data.account_data.folders {
        // Skip `null` folder id entries.
@@ -1182,7 +1545,7 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
    }

    // Update emergency access data
-    for emergency_access_data in data.account_unlock_data.emergency_access_unlock_data {
+    for emergency_access_data in data.unlock_data.emergency_access_unlock_data {
        let Some(saved_emergency_access) =
            existing_emergency_access.iter_mut().find(|ea| ea.uuid == emergency_access_data.id)
        else {
@@ -1194,14 +1557,17 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
    }

    // Update reset password data
-    for reset_password_data in data.account_unlock_data.organization_account_recovery_unlock_data {
+    for reset_password_data in data.unlock_data.organization_account_recovery_unlock_data {
        let Some(membership) =
            existing_memberships.iter_mut().find(|m| m.org_uuid == reset_password_data.organization_id)
        else {
            err!("Reset password doesn't exist")
        };

-        membership.reset_password_key = Some(reset_password_data.reset_password_key);
+        if !is_upgrade {
+            membership.reset_password_key = reset_password_data.reset_password_key;
+        }
+        membership.v2_upgrade_token.clone_from(&upgrade_token);
        membership.save(&conn).await?;
    }

@@ -1223,33 +1589,113 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
            };

            // Prevent triggering cipher updates via WebSockets by settings UpdateType::None
-            // The user sessions are invalidated because all the ciphers were re-encrypted and thus triggering an update could cause issues.
-            // We force the users to logout after the user has been saved to try and prevent these issues.
+            // Other sessions still hold the old user key, so an update to a re-encrypted cipher could cause issues.
+            // After the user is saved they are logged out, or on an upgrade, told to sync the new key.
            update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
        }
    }

    // Update user data
    let mut user = headers.user;
+    user.v2_upgrade_token = upgrade_token;

-    user.private_key = Some(data.account_keys.user_key_encrypted_account_private_key);
-    user.set_password(
-        &data.account_unlock_data.master_password_unlock_data.master_key_authentication_hash,
-        Some(data.account_unlock_data.master_password_unlock_data.master_key_encrypted_user_key),
-        true,
-        None,
-        &conn,
-    )
-    .await?;
+    data.account_keys.apply(&mut user)?;
+    // The old id names a key that no longer exists, so it is replaced even when the new key has none.
+    user.key_id = data.new_user_key_id;

-    let save_result = user.save(&conn).await;
+    user.akey = data.wrapped_user_key;
+    if let Some(new_password_hash) = data.new_password_hash {
+        user.set_password(&new_password_hash, None, false, None, &conn).await?;
+    }
+    // An upgrade keeps the sessions alive, see `is_upgrade` above
+    if !is_upgrade {
+        user.reset_security_stamp_after_key_rotation(&conn).await?;
+    }
+
+    // The key pair goes first: if saving the user then fails during an upgrade, the account is still
+    // v1 and the key pair unused, instead of a v2 account without one, which no client could unlock.
+    // A failure between the two writes of a v2 rotation still needs a transaction to undo.
+    data.account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
+    user.save(&conn).await?;

    // Prevent logging out the client where the user requested this endpoint from.
    // If you do logout the user it will causes issues at the client side.
    // Adding the device uuid will prevent this.
-    nt.send_logout(&user, Some(&headers.device), &conn).await;
+    // When the sessions were kept alive, the reason lets the other clients sync the new keys (through
+    // the upgrade token) instead of logging out, if they have `pm-31050-no-logout-key-upgrade-rotation`.
+    let reason = is_upgrade.then_some(LogOutReason::KeyRotation);
+    nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await;

-    save_result
+    Ok(())
+}
+
+/// Rotates the account keys without changing the master password.
+///
+/// Unlike `rotate-user-account-keys` this carries no proof of the master password: the request is
+/// authorized by the session alone, which is how upstream defines it, and the client has to be
+/// unlocked to produce the payload in the first place.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs>
+#[post("/accounts/key-management/rotate-user-keys", data = "<data>")]
+async fn post_rotate_user_keys(
+    data: Json<RotateUserKeysData>,
+    headers: Headers,
+    conn: DbConn,
+    nt: Notify<'_>,
+) -> EmptyResult {
+    let data: RotateUserKeysData = data.into_inner();
+
+    let wrapped_user_key = match UnlockMethod::from_i32(data.unlock_method_data.unlock_method) {
+        Some(UnlockMethod::MasterPassword) => {
+            let Some(unlock_data) = data.unlock_method_data.master_password_unlock_data else {
+                err!("Missing master password unlock data")
+            };
+            if !unlock_data.kdf.is_unchanged_for(&headers.user) {
+                err!("Changing the kdf variant is not supported during key rotation")
+            }
+            if unlock_data.salt != headers.user.email {
+                err!("Invalid master password salt")
+            }
+            validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
+            unlock_data.master_key_wrapped_user_key
+        }
+        Some(UnlockMethod::Tde) => err!("Trusted device encryption is not supported"),
+        Some(UnlockMethod::KeyConnector) => err!("Key connector is not supported"),
+        None => err!("Unrecognized unlock method"),
+    };
+
+    rotate_account(
+        RotateData {
+            account_keys: data.wrapped_account_cryptographic_state.validate()?,
+            account_data: data.account_data,
+            unlock_data: data.unlock_data,
+            new_user_key_id: data.new_user_key_id,
+            wrapped_user_key,
+            new_password_hash: None,
+        },
+        headers,
+        conn,
+        nt,
+    )
+    .await
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct KeyIdData {
+    user_key_id: KeyId,
+}
+
+#[post("/accounts/key-management/user-key-id", data = "<data>")]
+async fn post_user_key(data: Json<KeyIdData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    let mut user = headers.user;
+    // Only a backfill for accounts that have none. Afterwards the id changes with the key, in a rotation.
+    if user.key_id.is_some() {
+        err!("User key id is already set.")
+    }
+
+    user.key_id = Some(data.into_inner().user_key_id);
+    user.save(&conn).await
 }

 #[post("/accounts/security-stamp", data = "<data>")]
@@ -1838,7 +2284,7 @@ async fn post_auth_request(
        _ => err!("AuthRequest doesn't exist", "Device verification failed"),
    };

-    let mut auth_request = AuthRequest::new(
+    let auth_request = AuthRequest::new(
        user.uuid.clone(),
        data.device_identifier.clone(),
        client_headers.device_type,
@@ -6,6 +6,7 @@ use rocket::{
    Route,
    form::{Form, FromForm},
    fs::TempFile,
+    http::Status,
    serde::json::Json,
 };
 use serde_json::Value;
@@ -21,8 +22,9 @@ use crate::{
        DbConn, DbPool,
        models::{
            Archive, Attachment, AttachmentId, Cipher, CipherId, Collection, CollectionCipher, CollectionGroup,
-            CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, Membership,
-            MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, UserId,
+            CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, KeyId,
+            Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, User, UserId,
+            is_data_blob_encrypted,
        },
    },
    util::{NumberOrString, deser_opt_nonempty_str, save_temp_file},
@@ -161,6 +163,12 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
    let policies_json: Vec<Value> =
        OrgPolicy::find_confirmed_by_user(&headers.user.uuid, &conn).await.iter().map(OrgPolicy::to_json).collect();

+    let policies_new_json: Vec<Value> = OrgPolicy::find_accepted_and_confirmed_by_user(&headers.user.uuid, &conn)
+        .await
+        .iter()
+        .map(OrgPolicy::to_json)
+        .collect();
+
    let domains_json = if data.exclude_domains {
        Value::Null
    } else {
@@ -182,24 +190,32 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
            // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
            "masterKeyEncryptedUserKey": headers.user.akey,
            "masterKeyWrappedUserKey": headers.user.akey,
-            "salt": headers.user.email
+            "salt": headers.user.email,
+            "containedKeyId": headers.user.key_id,
        })
    } else {
        Value::Null
    };

+    // Upstream omits these two when unset rather than sending null.
+    let mut user_decryption = json!({ "masterPasswordUnlock": master_password_unlock });
+    if let Some(key_id) = &headers.user.key_id {
+        user_decryption["userKeyId"] = json!(key_id);
+    }
+    if let Some(v2_upgrade_token) = headers.user.v2_upgrade_token_json() {
+        user_decryption["v2UpgradeToken"] = v2_upgrade_token;
+    }
+
    Ok(Json(json!({
        "profile": user_json,
        "folders": folders_json,
        "collections": collections_json,
        "policies": policies_json,
+        "policiesNew": policies_new_json,
        "ciphers": ciphers_json,
        "domains": domains_json,
        "sends": sends_json,
-        "userDecryption": {
-            "masterPasswordUnlock": master_password_unlock,
-            "v2UpgradeToken": headers.user.v2_upgrade_token_json(),
-        },
+        "userDecryption": user_decryption,
        "object": "sync"
    })))
 }
@@ -261,15 +277,23 @@ pub struct CipherData {

    key: Option<String>,

+    pub encrypted_for: UserId, // Added in web-v2025.6.0
+    // Added in web-v2025.8.1, Optional for compat
+    pub encrypted_by_key_id: Option<KeyId>,
+
    /*
    Login = 1,
    SecureNote = 2,
    Card = 3,
    Identity = 4,
    SshKey = 5
+    BankAccount = 6
+    DriversLicense = 7
+    Passport = 8
    */
    pub r#type: i32,
-    pub name: String,
+    // Absent on a blob-encrypted cipher, whose name is sealed inside `data`
+    pub name: Option<String>,
    pub notes: Option<String>,
    fields: Option<Value>,

@@ -279,6 +303,12 @@ pub struct CipherData {
    card: Option<Value>,
    identity: Option<Value>,
    ssh_key: Option<Value>,
+    bank_account: Option<Value>,
+    drivers_license: Option<Value>,
+    passport: Option<Value>,
+
+    // The sealed blob of a v2 account's cipher, which replaces all of the fields above
+    data: Option<String>,

    favorite: Option<bool>,
    reprompt: Option<i32>,
@@ -301,6 +331,70 @@ pub struct CipherData {
    archived_date: Option<String>,
 }

+/// A field of a [`CipherData`] that fails upstream's model validation.
+#[derive(Debug)]
+pub struct CipherValidationError {
+    pub field: &'static str,
+    pub message: String,
+}
+
+impl From<CipherValidationError> for crate::Error {
+    fn from(e: CipherValidationError) -> Self {
+        Self::new_msg(e.message)
+    }
+}
+
+/// A user-owned cipher must be encrypted with the user's current key. Organization ciphers use the
+/// organization key, which has no id yet, and either id may be missing: from a client that predates
+/// the field, or a user whose key id isn't known yet. There is nothing to compare in those cases.
+///
+/// Ref: upstream's `CiphersController.ValidateCipherEncryptedByUser`
+fn validate_encrypted_by_user_key(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
+    if !is_org_cipher
+        && let (Some(cipher_key_id), Some(user_key_id)) = (&data.encrypted_by_key_id, &user.key_id)
+        && cipher_key_id != user_key_id
+    {
+        err!("Cipher was not encrypted with the current user key. Please try again.")
+    }
+    Ok(())
+}
+
+/// Upstream's `[StringLength(500000)]` on `CipherRequestModel.Data`
+const MAX_CIPHER_DATA_LENGTH: usize = 500_000;
+
+impl CipherData {
+    /// Whether the content is a single blob rather than the per-type fields. This parses `data`, so
+    /// callers that need the answer more than once should keep it.
+    pub fn is_blob(&self) -> bool {
+        self.data.as_deref().is_some_and(is_data_blob_encrypted)
+    }
+
+    /// Checks the content the way upstream's model validation does, before anything is saved.
+    /// `is_blob` is [`Self::is_blob`].
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/Vault/Models/Request/CipherRequestModel.cs>
+    pub fn validate_content(&self, is_blob: bool) -> Result<(), CipherValidationError> {
+        if let Some(data) = &self.data
+            && data.len() > MAX_CIPHER_DATA_LENGTH
+        {
+            return Err(CipherValidationError {
+                field: "Data",
+                message: format!("The field Data must be a string with a maximum length of {MAX_CIPHER_DATA_LENGTH}."),
+            });
+        }
+
+        // A blob carries the name inside it, so only the other formats need one
+        if !is_blob && self.name.as_deref().is_none_or(|n| n.trim().is_empty()) {
+            return Err(CipherValidationError {
+                field: "Name",
+                message: String::from("The Name field is required."),
+            });
+        }
+
+        Ok(())
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PartialCipherData {
@@ -334,12 +428,17 @@ async fn post_ciphers_create(
 ) -> JsonResult {
    let mut data: ShareCipherData = data.into_inner();

+    if data.cipher.encrypted_for != headers.user.uuid {
+        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
+    }
+    validate_encrypted_by_user_key(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
+
    // This check is usually only needed in update_cipher_from_data(), but we
    // need it here as well to avoid creating an empty cipher in the call to
    // cipher.save() below.
    enforce_personal_ownership_policy(Some(&data.cipher), &headers, &conn).await?;

-    let mut cipher = Cipher::new(data.cipher.r#type, data.cipher.name.clone());
+    let mut cipher = Cipher::new(data.cipher.r#type, String::new());
    cipher.user_uuid = Some(headers.user.uuid.clone());
    cipher.save(&conn).await?;

@@ -363,13 +462,19 @@ async fn post_ciphers_create(
 async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    let mut data: CipherData = data.into_inner();

+    if data.encrypted_for != headers.user.uuid {
+        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
+    }
+
+    validate_encrypted_by_user_key(&data, &headers.user, data.organization_id.is_some())?;
+
    // The web/browser clients set this field to null as expected, but the
    // mobile clients seem to set the invalid value `0001-01-01T00:00:00`,
    // which results in a warning message being logged. This field isn't
    // needed when creating a new cipher, so just ignore it unconditionally.
    data.last_known_revision_date = None;

-    let mut cipher = Cipher::new(data.r#type, data.name.clone());
+    let mut cipher = Cipher::new(data.r#type, String::new());
    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherCreate).await?;

    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -418,6 +523,9 @@ pub async fn update_cipher_from_data(

    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;

+    let is_blob = data.is_blob();
+    data.validate_content(is_blob)?;
+
    // Check that the client isn't updating an existing cipher with stale data.
    // And only perform this check when not importing ciphers, else the date/time check will fail.
    if ut != UpdateType::None
@@ -511,38 +619,53 @@ pub async fn update_cipher_from_data(
        3 => data.card,
        4 => data.identity,
        5 => data.ssh_key,
+        6 => data.bank_account,
+        7 => data.drivers_license,
+        8 => data.passport,
        _ => err!("Invalid type"),
    };

-    let type_data = if let Some(mut data) = type_data_opt {
-        // Remove the 'Response' key from the base object.
-        data.as_object_mut().unwrap().remove("response");
-        // Remove the 'Response' key from every Uri.
-        if data["uris"].is_array() {
-            data["uris"] = clean_cipher_data(data["uris"].clone());
-        }
-        data
+    if let Some(blob) = data.data.filter(|_| is_blob) {
+        // A blob holds all of the content, the name included, so nothing is kept outside it. The name
+        // column can't be null, so it's left empty; `to_json` reports it as null, as upstream does.
+        // TODO: Make `ciphers.name` nullable and store `None` here instead.
+        cipher.name = String::new();
+        cipher.notes = None;
+        cipher.fields = None;
+        cipher.password_history = None;
+        cipher.data = blob;
    } else {
-        err!("Data missing")
-    };
+        let Some(mut type_data) = type_data_opt else {
+            err!("Data missing")
+        };
+        // Remove the 'Response' key from the base object.
+        type_data.as_object_mut().unwrap().remove("response");
+        // Remove the 'Response' key from every Uri.
+        if type_data["uris"].is_array() {
+            type_data["uris"] = clean_cipher_data(type_data["uris"].clone());
+        }
+
+        // `validate_content` made sure there is a name
+        cipher.name = data.name.unwrap_or_default();
+        cipher.notes = data.notes;
+        cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
+        cipher.password_history = data.password_history.map(|f| f.to_string());
+        cipher.data = type_data.to_string();
+    }

    cipher.key = data.key;
-    cipher.name = data.name;
-    cipher.notes = data.notes;
-    cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
-    cipher.data = type_data.to_string();
-    cipher.password_history = data.password_history.map(|f| f.to_string());
    cipher.reprompt = data.reprompt.filter(|r| *r == RepromptType::None as i32 || *r == RepromptType::Password as i32);

    cipher.save(conn).await?;
    cipher.move_to_folder(data.folder_id, &headers.user.uuid, conn).await?;
    cipher.set_favorite(data.favorite, &headers.user.uuid, conn).await?;

-    if let Some(dt_str) = data.archived_date {
-        match NaiveDateTime::parse_from_str(&dt_str, "%+") {
+    match data.archived_date {
+        Some(dt_str) => match NaiveDateTime::parse_from_str(&dt_str, "%+") {
            Ok(dt) => cipher.set_archived_at(dt, &headers.user.uuid, conn).await?,
            Err(err) => warn!("Error parsing ArchivedDate '{dt_str}': {err}"),
-        }
+        },
+        None => cipher.unarchive(&headers.user.uuid, conn).await?,
    }

    if ut != UpdateType::None {
@@ -627,7 +750,7 @@ async fn post_ciphers_import(data: Json<ImportData>, headers: Headers, conn: DbC
        let folder_id = relations_map.get(&index).and_then(|i| folders.get(*i).cloned());
        cipher_data.folder_id = folder_id;

-        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
+        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
        update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
    }

@@ -695,6 +818,8 @@ async fn put_cipher(
        err!("Cipher is not write accessible")
    }

+    validate_encrypted_by_user_key(&data, &headers.user, cipher.organization_uuid.is_some())?;
+
    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherUpdate).await?;

    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -199,6 +199,26 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
+            // Only the vault notification banner click is accepted from clients. The rest of
+            // the 1500..=1599 range is written server-side and must not be forgeable by a client.
+            t if t == EventType::OrganizationUserNotificationBannerActionClicked as i32 => {
+                if let Some(org_id) = &event.organization_id
+                    && let Some(membership) =
+                        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await
+                {
+                    log_event_impl(
+                        event.r#type,
+                        &membership.uuid,
+                        org_id,
+                        &headers.user.uuid,
+                        headers.device.atype,
+                        Some(event_date),
+                        &headers.ip.ip,
+                        &conn,
+                    )
+                    .await;
+                }
+            }
            _ => {
                // The cipher determines the organization the event is logged to, so make sure the
                // user can actually access it instead of trusting the provided cipher uuid.
@@ -1075,7 +1075,7 @@ async fn send_invite(
            && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
            && data.permissions.get("createNewCollections") == Some(&json!(true)));

-    let mut user_created: bool = false;
+    let mut user_created: bool;
    for email in &data.emails {
        let mut member_status = MembershipStatus::Invited as i32;
        let user = match User::find_by_mail(email, &conn).await {
@@ -1110,6 +1110,7 @@ async fn send_invite(
                        member_status = MembershipStatus::Accepted as i32;
                    }
                }
+                user_created = false;
                user
            }
        };
@@ -1884,7 +1885,7 @@ async fn post_org_import(
        cipher_data.folder_id = None;
        // Replace the client-provided, unvalidated organizationId with the real target org
        cipher_data.organization_id = Some(org_id.clone());
-        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
+        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
        update_cipher_from_data(
            &mut cipher,
            cipher_data,
@@ -3,7 +3,7 @@ use num_traits::FromPrimitive;
 use rocket::{
    Route,
    form::{Form, FromForm},
-    http::{Cookie, CookieJar, SameSite},
+    http::{Accept, Cookie, CookieJar, MediaType, SameSite},
    response::Redirect,
    serde::json::Json,
 };
@@ -1061,11 +1061,18 @@ enum RegisterVerificationResponse {
    #[response(status = 204)]
    NoContent(()),
    Token(Json<String>),
+    PlainToken(String),
+}
+
+// Return JSON only when the client explicitly requests it, otherwise return plain text.
+fn accepts_json(accept: Option<&Accept>) -> bool {
+    accept.is_some_and(|accept| accept.preferred().media_type() == &MediaType::JSON)
 }

 #[post("/accounts/register/send-verification-email", data = "<data>")]
 async fn register_verification_email(
    data: Json<RegisterVerificationData>,
+    accept: Option<&Accept>,
    ip: ClientIp,
    conn: DbConn,
 ) -> ApiResult<RegisterVerificationResponse> {
@@ -1103,7 +1110,11 @@ async fn register_verification_email(
    } else {
        // If email verification is not required, return the token directly
        // the clients will use this token to finish the registration
-        Ok(RegisterVerificationResponse::Token(Json(token)))
+        Ok(if accepts_json(accept) {
+            RegisterVerificationResponse::Token(Json(token))
+        } else {
+            RegisterVerificationResponse::PlainToken(token)
+        })
    }
 }

@@ -23,7 +23,7 @@ pub use crate::api::{
    icons::routes as icons_routes,
    identity::routes as identity_routes,
    notifications::routes as notifications_routes,
-    notifications::{AnonymousNotify, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
+    notifications::{AnonymousNotify, LogOutReason, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
    push::{
        push_cipher_update, push_folder_update, push_logout, push_send_update, push_user_update, register_push_device,
        unregister_push_device,
@@ -383,23 +383,36 @@ impl WebSocketUsers {
    }

    pub async fn send_logout(&self, user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+        self.send_logout_with_reason(user, acting_device, None, conn).await;
+    }
+
+    /// A logout that clients may handle differently depending on `reason`, e.g. syncing instead of
+    /// logging out after a key rotation that kept the sessions alive.
+    pub async fn send_logout_with_reason(
+        &self,
+        user: &User,
+        acting_device: Option<&Device>,
+        reason: Option<LogOutReason>,
+        conn: &DbConn,
+    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
        let acting_device_id = acting_device.map(|d| d.uuid.clone());
-        let data = create_update(
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
-            UpdateType::LogOut,
-            acting_device_id,
-        );
+        let mut payload =
+            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))];
+        if let Some(reason) = reason {
+            payload.push(("Reason".into(), (reason as i32).into()));
+        }
+        let data = create_update(payload, UpdateType::LogOut, acting_device_id);

        if CONFIG.enable_websocket() {
            self.send_update(&user.uuid, &data).await;
        }

        if CONFIG.push_enabled() {
-            push_logout(user, acting_device, conn).await;
+            push_logout(user, acting_device, reason, conn).await;
        }
    }

@@ -667,6 +680,15 @@ fn create_ping() -> Vec<u8> {
    serialize(&Value::Array(vec![6.into()]))
 }

+/// Why a logout was pushed. Absent for a plain logout.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Enums/PushNotificationLogOutReason.cs>
+/// (`KdfChange = 0` is not sent by vaultwarden yet.)
+#[derive(Copy, Clone, Eq, PartialEq)]
+pub enum LogOutReason {
+    KeyRotation = 1,
+}
+
 // https://github.com/bitwarden/server/blob/375af7c43b10d9da03525d41452f95de3f921541/src/Core/Enums/PushType.cs
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum UpdateType {
@@ -12,7 +12,7 @@ use tokio::sync::RwLock;

 use crate::{
    CONFIG,
-    api::{ApiResult, EmptyResult, UpdateType},
+    api::{ApiResult, EmptyResult, LogOutReason, UpdateType},
    db::{
        DbConn,
        models::{AuthRequestId, Cipher, Device, Folder, PushId, Send, User, UserId},
@@ -188,7 +188,7 @@ pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device
    }
 }

-pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+pub async fn push_logout(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>, conn: &DbConn) {
    if Device::check_user_has_push_device(&user.uuid, conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
            "userId": user.uuid,
@@ -198,7 +198,8 @@ pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbC
            "type": UpdateType::LogOut as i32,
            "payload": {
                "userId": user.uuid,
-                "date": format_date(&user.updated_at)
+                "date": format_date(&user.updated_at),
+                "reason": reason.map(|r| r as i32),
            },
            "clientType": null,
            "installationId": null
@@ -30,7 +30,7 @@ use crate::{
        models::{
            AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
            EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
-            SendFileId, SendId, User, UserId, UserStampException,
+            SendFileId, SendId, User, UserId,
        },
    },
    error::Error,
@@ -667,31 +667,13 @@ impl<'r> FromRequest<'r> for Headers {
        };

        if user.security_stamp != claims.sstamp {
-            if let Some(stamp_exception) =
-                user.stamp_exception.as_deref().and_then(|s| serde_json::from_str::<UserStampException>(s).ok())
-            {
-                let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                    err_handler!("Error getting current route for stamp exception")
-                };
+            let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
+                err_handler!("Error getting current route for stamp exception")
+            };

-                // Check if the stamp exception has expired first.
-                // Then, check if the current route matches any of the allowed routes.
-                // After that check the stamp in exception matches the one in the claims.
-                if Utc::now().timestamp() > stamp_exception.expire {
-                    // If the stamp exception has been expired remove it from the database.
-                    // This prevents checking this stamp exception for new requests.
-                    let mut user = user;
-                    user.reset_stamp_exception();
-                    if let Err(e) = user.save(&conn).await {
-                        error!("Error updating user: {e:#?}");
-                    }
-                    err_handler!("Stamp exception is expired")
-                } else if !stamp_exception.routes.contains(&current_route.to_owned()) {
-                    err_handler!("Invalid security stamp: Current route and exception route do not match")
-                } else if stamp_exception.security_stamp != claims.sstamp {
-                    err_handler!("Invalid security stamp for matched stamp exception")
-                }
-            } else {
+            // Expired exceptions are dropped the next time the stamp is reset, not here: writing them
+            // back from this request could undo a reset made since the user was read.
+            if !user.stamp_exceptions().iter().any(|e| e.allows(&claims.sstamp, current_route)) {
                err_handler!("Invalid security stamp")
            }
        }
@@ -1427,20 +1427,29 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
    "pm-5594-safari-account-switching",
    "pm-32413-multi-client-password-management",
    // Autofill Team
+    "enable-basic-auth-response",
    "ssh-agent",
    "ssh-agent-v2",
    // Key Management Team
    "ssh-key-vault-item",
    "pm-25373-windows-biometrics-v2",
    "pm-26340-linux-biometrics-v2",
+    "pm-31050-no-logout-key-upgrade-rotation",
+    "pm-27278-v2-password-registration",
+    "enable-account-encryption-v2-jit-password-registration",
+    "pm-30144-sdk-key-rotation",
+    "force-upgrade-v2-encryption",
    // Mobile Team
    "anon-addy-self-host-alias",
    "simple-login-self-host-alias",
    "mutual-tls",
    "cxp-import-mobile",
    "cxp-export-mobile",
+    "pm-34171-card-scanner",
    // Platform Team
    "pm-30529-webauthn-related-origins",
+    // Vault Team
+    "pm-32009-new-item-types",
 ];

 impl Config {
@@ -41,17 +41,20 @@ impl Archive {
    ) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;
        db_run! { conn:
-            sqlite, mysql {
-                diesel::replace_into(archives::table)
+            mysql {
+                diesel::insert_into(archives::table)
                    .values((
                        archives::user_uuid.eq(user_uuid),
                        archives::cipher_uuid.eq(cipher_uuid),
                        archives::archived_at.eq(archived_at),
                    ))
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(archives::archived_at.eq(archived_at))
                    .execute(conn)
                    .map_res("Error saving archive")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(archives::table)
                    .values((
                        archives::user_uuid.eq(user_uuid),
@@ -82,24 +82,16 @@ impl Attachment {
 impl Attachment {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(attachments::table)
+            mysql {
+                diesel::insert_into(attachments::table)
                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(attachments::table)
-                            .filter(attachments::id.eq(&self.id))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error saving attachment")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving attachment")
+                    .map_res("Error saving attachment")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(attachments::table)
                    .values(self)
                    .on_conflict(attachments::id)
@@ -82,31 +82,23 @@ impl AuthRequest {
 }

 impl AuthRequest {
-    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
+    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(auth_requests::table)
-                    .values(&*self)
-                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(auth_requests::table)
-                            .filter(auth_requests::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error auth_request")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error auth_request")
-            }
-            postgresql {
+            mysql {
                diesel::insert_into(auth_requests::table)
-                    .values(&*self)
+                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
+                    .execute(conn)
+                    .map_res("Error saving auth_request")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(auth_requests::table)
+                    .values(self)
                    .on_conflict(auth_requests::uuid)
                    .do_update()
-                    .set(&*self)
+                    .set(self)
                    .execute(conn)
                    .map_res("Error saving auth_request")
            }
@@ -63,6 +63,22 @@ pub struct Cipher {
    pub reprompt: Option<i32>,
 }

+/// Whether `data` is a sealed cipher blob rather than the legacy per-type JSON.
+///
+/// Ciphers of v2 accounts are encrypted as a single blob that carries everything, name included,
+/// and is opaque to us. It is recognized the same way upstream does, by a top-level
+/// `format_version` key that the legacy JSON never has.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Vault/Entities/Cipher.cs>
+pub fn is_data_blob_encrypted(data: &str) -> bool {
+    serde_json::from_str::<Value>(data).is_ok_and(|d| is_blob_value(&d))
+}
+
+/// [`is_data_blob_encrypted`] for `data` that was already parsed.
+fn is_blob_value(data: &Value) -> bool {
+    data.get("format_version").is_some()
+}
+
 pub enum RepromptType {
    None = 0,
    Password = 1,
@@ -110,6 +126,11 @@ impl Cipher {
                    .insert(format!("Ciphers[{index}].Notes"), serde_json::to_value([&max_note_size_msg]).unwrap());
            }

+            if let Err(e) = cipher.validate_content(cipher.is_blob()) {
+                validation_errors
+                    .insert(format!("Ciphers[{index}].{}", e.field), serde_json::to_value([e.message]).unwrap());
+            }
+
            // Validate the password history if it contains `null` values and if so, return a warning
            if let Some(Value::Array(password_history)) = &cipher.password_history {
                for pwh in password_history {
@@ -154,6 +175,11 @@ impl Cipher {
    ) -> Result<Value, crate::Error> {
        use crate::util::{format_date, validate_and_format_date};

+        // Parsed once here, since `data` can be large and this runs for every cipher in a sync.
+        // `LowerCase` only lowercases the first letter of each key, so it keeps `format_version`.
+        let type_data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data);
+        let is_blob_encrypted = type_data.as_ref().is_ok_and(is_blob_value);
+
        let mut attachments_json: Value = Value::Null;
        if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(attachments) = cipher_sync_data.cipher_attachments.get(&self.uuid)
@@ -189,124 +215,62 @@ impl Cipher {
            (false, false, false)
        };

-        let fields_json: Vec<_> = self
-            .fields
-            .as_ref()
-            .and_then(|s| {
-                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                    .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
-                    .ok()
-            })
-            .map(|d| {
-                d.into_iter()
-                    .map(|mut f| {
-                        // Check if the `type` key is a number, strings break some clients
-                        // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
-                        // If not try to convert the string value to a number and fallback to `1`
-                        // If it is both not a number and not a string, fallback to `1`
-                        match f.data.get("type") {
-                            Some(t) if t.is_number() => {}
-                            Some(t) if t.is_string() => {
-                                let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
-                                f.data["type"] = json!(type_num);
+        // Like upstream, a cipher that was stored without fields or password history reports them as
+        // null rather than as an empty list; clients keep the two apart.
+        let fields_json: Option<Vec<_>> = self.fields.as_ref().map(|s| {
+            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
+                .ok()
+                .map(|d| {
+                    d.into_iter()
+                        .map(|mut f| {
+                            // Check if the `type` key is a number, strings break some clients
+                            // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
+                            // If not try to convert the string value to a number and fallback to `1`
+                            // If it is both not a number and not a string, fallback to `1`
+                            match f.data.get("type") {
+                                Some(t) if t.is_number() => {}
+                                Some(t) if t.is_string() => {
+                                    let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
+                                    f.data["type"] = json!(type_num);
+                                }
+                                _ => {
+                                    f.data["type"] = json!(1);
+                                }
                            }
-                            _ => {
-                                f.data["type"] = json!(1);
-                            }
-                        }
-                        f.data
-                    })
-                    .collect()
-            })
-            .unwrap_or_default();
+                            f.data
+                        })
+                        .collect()
+                })
+                .unwrap_or_default()
+        });

-        let password_history_json: Vec<_> = self
-            .password_history
-            .as_ref()
-            .and_then(|s| {
-                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                    .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
-                    .ok()
-            })
-            .map(|d| {
-                // Check every password history item if they are valid and return it.
-                // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
-                // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
-                d.into_iter()
-                    .filter_map(|d| match d.data.get("password") {
-                        Some(p) if p.is_string() => Some(d.data),
-                        _ => None,
-                    })
-                    .map(|mut d| {
-                        let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
-                            validate_and_format_date(l)
-                        } else {
-                            "1970-01-01T00:00:00.000000Z".to_owned()
-                        };
-                        d["lastUsedDate"] = json!(lud);
-                        d
-                    })
-                    .collect()
-            })
-            .unwrap_or_default();
-
-        // Get the type_data or a default to an empty json object '{}'.
-        // If not passing an empty object, mobile clients will crash.
-        let mut type_data_json = serde_json::from_str::<LowerCase<Value>>(&self.data)
-            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
-            .map_or_else(|_| Value::Object(serde_json::Map::new()), |d| d.data);
-
-        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
-        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
-        if self.atype == 1 {
-            // Upstream always has an `uri` key/value
-            type_data_json["uri"] = Value::Null;
-            if let Some(uris) = type_data_json["uris"].as_array_mut()
-                && !uris.is_empty()
-            {
-                // Fix uri match values first, they are only allowed to be a number or null
-                // If it is a string, convert it to an int or null if that fails
-                for uri in &mut *uris {
-                    if uri["match"].is_string() {
-                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
-                            Ok(n) => json!(n),
-                            _ => Value::Null,
-                        };
-                        uri["match"] = match_value;
-                    }
-                }
-                type_data_json["uri"] = uris[0]["uri"].clone();
-            }
-
-            // Check if `passwordRevisionDate` is a valid date, else convert it
-            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
-                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
-            }
-        }
-
-        // Fix secure note issues when data is invalid
-        // This breaks at least the native mobile clients
-        if self.atype == 2 {
-            match type_data_json {
-                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
-                _ => {
-                    type_data_json = json!({"type": 0});
-                }
-            }
-        }
-
-        // Fix invalid SSH Entries
-        // This breaks at least the native mobile client if invalid
-        // The only way to fix this is by setting type_data_json to `null`
-        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
-        if self.atype == 5
-            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
-                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
-                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
-        {
-            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
-            type_data_json = Value::Null;
-        }
+        let password_history_json: Option<Vec<_>> = self.password_history.as_ref().map(|s| {
+            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
+                .ok()
+                .map(|d| {
+                    // Check every password history item if they are valid and return it.
+                    // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
+                    // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
+                    d.into_iter()
+                        .filter_map(|d| match d.data.get("password") {
+                            Some(p) if p.is_string() => Some(d.data),
+                            _ => None,
+                        })
+                        .map(|mut d| {
+                            let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
+                                validate_and_format_date(l)
+                            } else {
+                                "1970-01-01T00:00:00.000000Z".to_owned()
+                            };
+                            d["lastUsedDate"] = json!(lud);
+                            d
+                        })
+                        .collect()
+                })
+                .unwrap_or_default()
+        });

        let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
@@ -403,10 +367,83 @@ impl Cipher {
            _ => err!(format!("Cipher {} has an invalid type {}", self.uuid, self.atype)),
        };

-        json_object[key] = type_data_json;
+        if is_blob_encrypted {
+            // The blob holds all of the content, so it is sent back as-is and the structured fields
+            // stay null, as upstream does. Only the name needs clearing, the others are never stored.
+            json_object["data"] = json!(self.data);
+            json_object["name"] = Value::Null;
+        } else {
+            json_object[key] = self.legacy_type_data_json(type_data);
+        }
        Ok(json_object)
    }

+    /// The per-type data (`login`, `card`, …) of a legacy cipher, from `type_data` as parsed from
+    /// `self.data`, with fixups for values that are known to break clients.
+    fn legacy_type_data_json(&self, type_data: Result<Value, serde_json::Error>) -> Value {
+        use crate::util::validate_and_format_date;
+
+        // Get the type_data or a default to an empty json object '{}'.
+        // If not passing an empty object, mobile clients will crash.
+        let mut type_data_json = type_data
+            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
+            .unwrap_or_else(|_| Value::Object(serde_json::Map::new()));
+
+        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
+        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
+        if self.atype == 1 {
+            // Upstream always has an `uri` key/value
+            type_data_json["uri"] = Value::Null;
+            if let Some(uris) = type_data_json["uris"].as_array_mut()
+                && !uris.is_empty()
+            {
+                // Fix uri match values first, they are only allowed to be a number or null
+                // If it is a string, convert it to an int or null if that fails
+                for uri in &mut *uris {
+                    if uri["match"].is_string() {
+                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
+                            Ok(n) => json!(n),
+                            _ => Value::Null,
+                        };
+                        uri["match"] = match_value;
+                    }
+                }
+                type_data_json["uri"] = uris[0]["uri"].clone();
+            }
+
+            // Check if `passwordRevisionDate` is a valid date, else convert it
+            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
+                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
+            }
+        }
+
+        // Fix secure note issues when data is invalid
+        // This breaks at least the native mobile clients
+        if self.atype == 2 {
+            match type_data_json {
+                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
+                _ => {
+                    type_data_json = json!({"type": 0});
+                }
+            }
+        }
+
+        // Fix invalid SSH Entries
+        // This breaks at least the native mobile client if invalid
+        // The only way to fix this is by setting type_data_json to `null`
+        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
+        if self.atype == 5
+            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
+                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
+                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
+        {
+            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
+            type_data_json = Value::Null;
+        }
+
+        type_data_json
+    }
+
    pub async fn update_users_revision(&self, conn: &DbConn) -> Vec<UserId> {
        let mut user_uuids = Vec::new();
        match self.user_uuid {
@@ -440,24 +477,16 @@ impl Cipher {
        self.updated_at = Utc::now().naive_utc();

        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(ciphers::table)
+            mysql {
+                diesel::insert_into(ciphers::table)
                    .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(ciphers::table)
-                            .filter(ciphers::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error saving cipher")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving cipher")
+                    .map_res("Error saving cipher")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(ciphers::table)
                    .values(&*self)
                    .on_conflict(ciphers::uuid)
@@ -665,16 +694,27 @@ impl Cipher {
    }

    async fn get_user_collections_access_flags(&self, user_uuid: &UserId, conn: &DbConn) -> Vec<(bool, bool, bool)> {
+        let user_uuid = user_uuid.to_string();
        conn.run(move |conn| {
            // Check whether this cipher is in any collections accessible to the
            // user. If so, retrieve the access flags for each collection.
+            // The user must have a confirmed membership in the cipher's
+            // organization, since users_collections rows are kept when a
+            // membership is revoked or not confirmed yet.
            ciphers::table
                .filter(ciphers::uuid.eq(&self.uuid))
                .inner_join(ciphers_collections::table.on(ciphers::uuid.eq(ciphers_collections::cipher_uuid)))
+                .inner_join(
+                    users_organizations::table.on(ciphers::organization_uuid
+                        .eq(users_organizations::org_uuid.nullable())
+                        .and(users_organizations::user_uuid.eq(user_uuid))
+                        .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
+                )
                .inner_join(
                    users_collections::table.on(ciphers_collections::collection_uuid
                        .eq(users_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid))),
+                        // Only allow collection access via the confirmed membership.
+                        .and(users_organizations::user_uuid.eq(users_collections::user_uuid))),
                )
                .select((users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
                .load::<(bool, bool, bool)>(conn)
@@ -705,6 +745,9 @@ impl Cipher {
                        .and(groups::organizations_uuid.eq(users_organizations::org_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
+                // Only allow group access via a confirmed membership, since
+                // groups_users rows are kept when a membership is revoked.
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage))
                .load::<(bool, bool, bool)>(conn)
                .expect("Error getting group access restrictions")
@@ -168,24 +168,16 @@ impl Collection {
        self.update_users_revision(conn).await;

        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(collections::table)
+            mysql {
+                diesel::insert_into(collections::table)
                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(collections::table)
-                            .filter(collections::uuid.eq(&self.uuid))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error saving collection")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving collection")
+                    .map_res("Error saving collection")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(collections::table)
                    .values(self)
                    .on_conflict(collections::uuid)
@@ -728,53 +720,30 @@ impl CollectionUser {
    ) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;

+        let values = (
+            users_collections::user_uuid.eq(user_uuid),
+            users_collections::collection_uuid.eq(collection_uuid),
+            users_collections::read_only.eq(read_only),
+            users_collections::hide_passwords.eq(hide_passwords),
+            users_collections::manage.eq(manage),
+        );
+
        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(users_collections::table)
-                    .values((
-                        users_collections::user_uuid.eq(user_uuid),
-                        users_collections::collection_uuid.eq(collection_uuid),
-                        users_collections::read_only.eq(read_only),
-                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
-                    ))
-                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(users_collections::table)
-                            .filter(users_collections::user_uuid.eq(user_uuid))
-                            .filter(users_collections::collection_uuid.eq(collection_uuid))
-                            .set((
-                                users_collections::user_uuid.eq(user_uuid),
-                                users_collections::collection_uuid.eq(collection_uuid),
-                                users_collections::read_only.eq(read_only),
-                                users_collections::hide_passwords.eq(hide_passwords),
-                                users_collections::manage.eq(manage),
-                            ))
-                            .execute(conn)
-                            .map_res("Error adding user to collection")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error adding user to collection")
-            }
-            postgresql {
+            mysql {
                diesel::insert_into(users_collections::table)
-                    .values((
-                        users_collections::user_uuid.eq(user_uuid),
-                        users_collections::collection_uuid.eq(collection_uuid),
-                        users_collections::read_only.eq(read_only),
-                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
-                    ))
+                    .values(values)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(values)
+                    .execute(conn)
+                    .map_res("Error adding user to collection")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(users_collections::table)
+                    .values(values)
                    .on_conflict((users_collections::user_uuid, users_collections::collection_uuid))
                    .do_update()
-                    .set((
-                        users_collections::read_only.eq(read_only),
-                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
-                    ))
+                    .set(values)
                    .execute(conn)
                    .map_res("Error adding user to collection")
            }
@@ -909,19 +878,18 @@ impl CollectionCipher {
        Self::update_users_revision(collection_uuid, conn).await;

        db_run! { conn:
-            sqlite, mysql {
-                // Not checking for ForeignKey Constraints here.
-                // Table ciphers_collections does not have ForeignKey Constraints which would cause conflicts.
-                // This table has no constraints pointing to itself, but only to others.
-                diesel::replace_into(ciphers_collections::table)
+            mysql {
+                diesel::insert_into(ciphers_collections::table)
                    .values((
                        ciphers_collections::cipher_uuid.eq(cipher_uuid),
                        ciphers_collections::collection_uuid.eq(collection_uuid),
                    ))
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_nothing()
                    .execute(conn)
                    .map_res("Error adding cipher to collection")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(ciphers_collections::table)
                    .values((
                        ciphers_collections::cipher_uuid.eq(cipher_uuid),
@@ -146,15 +146,18 @@ impl Device {
        }

        db_run! { conn:
-            sqlite, mysql {
+            mysql {
                crate::util::retry(||
-                    diesel::replace_into(devices::table)
+                    diesel::insert_into(devices::table)
                        .values(&*self)
+                        .on_conflict(diesel::dsl::DuplicatedKeys)
+                        .do_update()
+                        .set(&*self)
                        .execute(conn),
                    10,
                ).map_res("Error saving device")
            }
-            postgresql {
+            postgresql, sqlite {
                crate::util::retry(||
                    diesel::insert_into(devices::table)
                        .values(&*self)
@@ -146,24 +146,16 @@ impl EmergencyAccess {
        self.updated_at = Utc::now().naive_utc();

        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(emergency_access::table)
+            mysql {
+                diesel::insert_into(emergency_access::table)
                    .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(emergency_access::table)
-                            .filter(emergency_access::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error updating emergency access")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving emergency access")
+                    .map_res("Error saving emergency access")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(emergency_access::table)
                    .values(&*self)
                    .on_conflict(emergency_access::uuid)
@@ -113,7 +113,7 @@ pub enum EventType {
    OrganizationUserAdminResetTwoFactor = 1519,
    // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
    // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
-    // OrganizationUserNotificationBannerActionClicked = 1522,
+    OrganizationUserNotificationBannerActionClicked = 1522,

    // Organization
    OrganizationUpdated = 1600,
@@ -208,20 +208,23 @@ impl Event {
    /// Basic Queries
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            sqlite, mysql {
-                diesel::replace_into(event::table)
-                .values(self)
-                .execute(conn)
-                .map_res("Error saving event")
-            }
-            postgresql {
+            mysql {
                diesel::insert_into(event::table)
-                .values(self)
-                .on_conflict(event::uuid)
-                .do_update()
-                .set(self)
-                .execute(conn)
-                .map_res("Error saving event")
+                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
+                    .execute(conn)
+                    .map_res("Error saving event")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(event::table)
+                    .values(self)
+                    .on_conflict(event::uuid)
+                    .do_update()
+                    .set(self)
+                    .execute(conn)
+                    .map_res("Error saving event")
            }
        }
    }
@@ -77,24 +77,16 @@ impl Folder {
        self.updated_at = Utc::now().naive_utc();

        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(folders::table)
+            mysql {
+                diesel::insert_into(folders::table)
                    .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(folders::table)
-                            .filter(folders::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error saving folder")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving folder")
+                    .map_res("Error saving folder")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(folders::table)
                    .values(&*self)
                    .on_conflict(folders::uuid)
@@ -147,16 +139,15 @@ impl Folder {
 impl FolderCipher {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            sqlite, mysql {
-                // Not checking for ForeignKey Constraints here.
-                // Table folders_ciphers does not have ForeignKey Constraints which would cause conflicts.
-                // This table has no constraints pointing to itself, but only to others.
-                diesel::replace_into(folders_ciphers::table)
+            mysql {
+                diesel::insert_into(folders_ciphers::table)
                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_nothing()
                    .execute(conn)
                    .map_res("Error adding cipher to folder")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(folders_ciphers::table)
                    .values(self)
                    .on_conflict((folders_ciphers::cipher_uuid, folders_ciphers::folder_uuid))
@@ -13,7 +13,7 @@ use crate::{
 };
 use macros::UuidFromParam;

-use super::{CollectionId, Membership, MembershipId, OrganizationId, User, UserId};
+use super::{CollectionId, Membership, MembershipId, MembershipStatus, OrganizationId, User, UserId};

 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
 #[diesel(table_name = groups)]
@@ -166,24 +166,16 @@ impl Group {
        self.revision_date = Utc::now().naive_utc();

        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(groups::table)
+            mysql {
+                diesel::insert_into(groups::table)
                    .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(groups::table)
-                            .filter(groups::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error saving group")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving group")
+                    .map_res("Error saving group")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(groups::table)
                    .values(&*self)
                    .on_conflict(groups::uuid)
@@ -276,6 +268,9 @@ impl Group {
                        .and(users_organizations::org_uuid.eq(groups::organizations_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
+                // Only allow full access via a confirmed membership, since
+                // groups_users rows are kept when a membership is revoked.
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(groups::organizations_uuid.eq(org_uuid))
                .filter(groups::access_all.eq(true))
                .select(groups::access_all)
@@ -326,53 +321,30 @@ impl CollectionGroup {
            group_user.update_user_revision(conn).await;
        }

+        let values = (
+            collections_groups::collections_uuid.eq(&self.collections_uuid),
+            collections_groups::groups_uuid.eq(&self.groups_uuid),
+            collections_groups::read_only.eq(&self.read_only),
+            collections_groups::hide_passwords.eq(&self.hide_passwords),
+            collections_groups::manage.eq(&self.manage),
+        );
+
        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(collections_groups::table)
-                    .values((
-                        collections_groups::collections_uuid.eq(&self.collections_uuid),
-                        collections_groups::groups_uuid.eq(&self.groups_uuid),
-                        collections_groups::read_only.eq(&self.read_only),
-                        collections_groups::hide_passwords.eq(&self.hide_passwords),
-                        collections_groups::manage.eq(&self.manage),
-                    ))
-                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(collections_groups::table)
-                            .filter(collections_groups::collections_uuid.eq(&self.collections_uuid))
-                            .filter(collections_groups::groups_uuid.eq(&self.groups_uuid))
-                            .set((
-                                collections_groups::collections_uuid.eq(&self.collections_uuid),
-                                collections_groups::groups_uuid.eq(&self.groups_uuid),
-                                collections_groups::read_only.eq(&self.read_only),
-                                collections_groups::hide_passwords.eq(&self.hide_passwords),
-                                collections_groups::manage.eq(&self.manage),
-                            ))
-                            .execute(conn)
-                            .map_res("Error adding group to collection")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error adding group to collection")
-            }
-            postgresql {
+            mysql {
                diesel::insert_into(collections_groups::table)
-                    .values((
-                        collections_groups::collections_uuid.eq(&self.collections_uuid),
-                        collections_groups::groups_uuid.eq(&self.groups_uuid),
-                        collections_groups::read_only.eq(self.read_only),
-                        collections_groups::hide_passwords.eq(self.hide_passwords),
-                        collections_groups::manage.eq(self.manage),
-                    ))
+                    .values(values)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(values)
+                    .execute(conn)
+                    .map_res("Error adding group to collection")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(collections_groups::table)
+                    .values(values)
                    .on_conflict((collections_groups::collections_uuid, collections_groups::groups_uuid))
                    .do_update()
-                    .set((
-                        collections_groups::read_only.eq(self.read_only),
-                        collections_groups::hide_passwords.eq(self.hide_passwords),
-                        collections_groups::manage.eq(self.manage),
-                    ))
+                    .set(values)
                    .execute(conn)
                    .map_res("Error adding group to collection")
            }
@@ -497,43 +469,25 @@ impl GroupUser {
    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
        self.update_user_revision(conn).await;

+        let values = (
+            groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+            groups_users::groups_uuid.eq(&self.groups_uuid),
+        );
+
        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(groups_users::table)
-                    .values((
-                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                        groups_users::groups_uuid.eq(&self.groups_uuid),
-                    ))
-                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(groups_users::table)
-                            .filter(groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid))
-                            .filter(groups_users::groups_uuid.eq(&self.groups_uuid))
-                            .set((
-                                groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                                groups_users::groups_uuid.eq(&self.groups_uuid),
-                            ))
-                            .execute(conn)
-                            .map_res("Error adding user to group")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error adding user to group")
-            }
-            postgresql {
+            mysql {
                diesel::insert_into(groups_users::table)
-                    .values((
-                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                        groups_users::groups_uuid.eq(&self.groups_uuid),
-                    ))
+                    .values(values)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_nothing()
+                    .execute(conn)
+                    .map_res("Error adding user to group")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(groups_users::table)
+                    .values(values)
                    .on_conflict((groups_users::users_organizations_uuid, groups_users::groups_uuid))
-                    .do_update()
-                    .set((
-                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                        groups_users::groups_uuid.eq(&self.groups_uuid),
-                    ))
+                    .do_nothing()
                    .execute(conn)
                    .map_res("Error adding user to group")
            }
@@ -22,7 +22,7 @@ mod user_signature_key_pair;
 pub use self::archive::Archive;
 pub use self::attachment::{Attachment, AttachmentId};
 pub use self::auth_request::{AuthRequest, AuthRequestId};
-pub use self::cipher::{Cipher, CipherId, RepromptType};
+pub use self::cipher::{Cipher, CipherId, RepromptType, is_data_blob_encrypted};
 pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
 pub use self::device::{Device, DeviceId, DeviceType, DeviceWithAuthRequest, PushId};
 pub use self::emergency_access::{EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType};
@@ -40,5 +40,5 @@ pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, SsoUser, User, UserId, UserKdfType, UserStampException};
+pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType};
 pub use self::user_signature_key_pair::{SignatureAlgorithm, UserSignatureKeyPair};
@@ -49,6 +49,7 @@ pub enum OrgPolicyType {
    // AutotypeDefaultSetting = 17, // Not supported yet
    // AutoConfirm = 18, // Not supported (not implemented yet)
    // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
+    OrganizationUserNotification = 20,
 }

 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs#L5
@@ -186,6 +187,26 @@ impl OrgPolicy {
        .await
    }

+    pub async fn find_accepted_and_confirmed_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
+        conn.run(move |conn| {
+            org_policies::table
+                .inner_join(
+                    users_organizations::table.on(users_organizations::org_uuid
+                        .eq(org_policies::org_uuid)
+                        .and(users_organizations::user_uuid.eq(user_uuid))),
+                )
+                .filter(
+                    users_organizations::status
+                        .eq(MembershipStatus::Accepted as i32)
+                        .or(users_organizations::status.eq(MembershipStatus::Confirmed as i32)),
+                )
+                .select(org_policies::all_columns)
+                .load::<Self>(conn)
+                .expect("Error loading org_policy")
+        })
+        .await
+    }
+
    pub async fn find_by_org_and_type(
        org_uuid: &OrganizationId,
        policy_type: OrgPolicyType,
@@ -57,6 +57,10 @@ pub struct Membership {
    pub atype: i32,
    pub reset_password_key: Option<String>,
    pub external_id: Option<String>,
+    /// A copy of the user's v2 upgrade token, kept when a v1 -> v2 upgrade leaves the account
+    /// recovery key (`reset_password_key`) wrapped by the v1 user key. It lets the organization
+    /// unwrap the v2 user key from it. Opaque to us, like `User::v2_upgrade_token`.
+    pub v2_upgrade_token: Option<String>,
 }

 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -274,6 +278,7 @@ impl Membership {
            atype: MembershipType::User as i32,
            reset_password_key: None,
            external_id: None,
+            v2_upgrade_token: None,
        }
    }

@@ -353,25 +358,16 @@ impl Organization {
        }

        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(organizations::table)
+            mysql {
+                diesel::insert_into(organizations::table)
                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(organizations::table)
-                            .filter(organizations::uuid.eq(&self.uuid))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error saving organization")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving organization")
-
+                    .map_res("Error saving organization")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(organizations::table)
                    .values(self)
                    .on_conflict(organizations::uuid)
@@ -753,24 +749,16 @@ impl Membership {
        User::update_uuid_revision(&self.user_uuid, conn).await;

        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(users_organizations::table)
+            mysql {
+                diesel::insert_into(users_organizations::table)
                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(users_organizations::table)
-                            .filter(users_organizations::uuid.eq(&self.uuid))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error adding user to organization")
-                    },
-                    Err(e) => Err(e.into()),
-                }.map_res("Error adding user to organization")
+                    .map_res("Error adding user to organization")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(users_organizations::table)
                    .values(self)
                    .on_conflict(users_organizations::uuid)
@@ -861,6 +849,21 @@ impl Membership {
        .await
    }

+    pub async fn find_accepted_and_confirmed_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
+        conn.run(move |conn| {
+            users_organizations::table
+                .filter(users_organizations::user_uuid.eq(user_uuid))
+                .filter(
+                    users_organizations::status
+                        .eq(MembershipStatus::Accepted as i32)
+                        .or(users_organizations::status.eq(MembershipStatus::Confirmed as i32)),
+                )
+                .load::<Self>(conn)
+                .unwrap_or_default()
+        })
+        .await
+    }
+
    pub async fn find_invited_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            users_organizations::table
@@ -1186,25 +1189,16 @@ impl Membership {
 impl OrganizationApiKey {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(organization_api_key::table)
+            mysql {
+                diesel::insert_into(organization_api_key::table)
                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(organization_api_key::table)
-                            .filter(organization_api_key::uuid.eq(&self.uuid))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error saving organization")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving organization")
-
+                    .map_res("Error saving organization")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(organization_api_key::table)
                    .values(self)
                    .on_conflict((organization_api_key::uuid, organization_api_key::org_uuid))
@@ -202,24 +202,16 @@ impl Send {
        self.revision_date = Utc::now().naive_utc();

        db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(sends::table)
+            mysql {
+                diesel::insert_into(sends::table)
                    .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(sends::table)
-                            .filter(sends::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error saving send")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving send")
+                    .map_res("Error saving send")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(sends::table)
                    .values(&*self)
                    .on_conflict(sends::uuid)
@@ -6,6 +6,7 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::EmptyResult,
+    auth::DEFAULT_ACCESS_VALIDITY,
    crypto,
    db::{
        DbConn,
@@ -71,6 +72,8 @@ pub struct User {

    pub external_id: Option<String>, // Todo: Needs to be removed in the future, this is not used anymore.

+    pub key_id: Option<KeyId>,
+
    // "v2" account cryptographic state. Either all of these are set (together with a row in
    // `user_signature_key_pairs`) or none of them are; see `User::is_v2`.
    pub signed_public_key: Option<String>,
@@ -107,13 +110,28 @@ enum UserStatus {
    _Disabled = 2,
 }

+/// A previous security stamp that is still accepted, until `expire`.
 #[derive(Serialize, Deserialize)]
 pub struct UserStampException {
-    pub routes: Vec<String>,
+    /// The routes the stamp is still accepted on, or `None` for any route.
+    pub routes: Option<Vec<String>>,
    pub security_stamp: String,
    pub expire: i64,
 }

+impl UserStampException {
+    pub fn is_expired(&self) -> bool {
+        Utc::now().timestamp() > self.expire
+    }
+
+    /// Whether this exception lets a token carrying `security_stamp` through on `route`.
+    pub fn allows(&self, security_stamp: &str, route: &str) -> bool {
+        !self.is_expired()
+            && self.security_stamp == security_stamp
+            && self.routes.as_ref().is_none_or(|routes| routes.iter().any(|r| r == route))
+    }
+}
+
 /// Local methods
 impl User {
    pub const CLIENT_KDF_TYPE_DEFAULT: i32 = UserKdfType::Pbkdf2 as i32;
@@ -165,6 +183,8 @@ impl User {

            external_id: None, // Todo: Needs to be removed in the future, this is not used anymore.

+            key_id: None,
+
            signed_public_key: None,
            security_state: None,
            security_version: None,
@@ -235,10 +255,41 @@ impl User {

    pub async fn reset_security_stamp(&mut self, conn: &DbConn) -> EmptyResult {
        self.security_stamp = get_uuid();
+        // A reset is meant to end the other sessions, which a key rotation's grace would undo. The
+        // route exceptions stay, since they are set right before a reset, for the stamp it replaces.
+        // This is also where expired exceptions get dropped.
+        let mut exceptions = self.stamp_exceptions();
+        exceptions.retain(|e| e.routes.is_some() && !e.is_expired());
+        self.set_stamp_exceptions(&exceptions);
        Device::rotate_refresh_tokens_by_user(&self.uuid, conn).await?;
        Ok(())
    }

+    /// Resets the security stamp after a key rotation, while letting the access tokens already
+    /// issued keep working until they expire.
+    ///
+    /// This is what upstream does: there the stamp is only checked when a token is refreshed, so a
+    /// rotation invalidates refresh tokens but not the access tokens in use. Clients rely on it to
+    /// keep a session going across a rotation. Chained rotations keep every earlier stamp that is
+    /// still within its window.
+    pub async fn reset_security_stamp_after_key_rotation(&mut self, conn: &DbConn) -> EmptyResult {
+        let previous_stamp = self.security_stamp.clone();
+        let mut grace: Vec<UserStampException> =
+            self.stamp_exceptions().into_iter().filter(|e| e.routes.is_none() && !e.is_expired()).collect();
+
+        self.reset_security_stamp(conn).await?;
+
+        grace.push(UserStampException {
+            routes: None,
+            security_stamp: previous_stamp,
+            expire: (Utc::now() + *DEFAULT_ACCESS_VALIDITY).timestamp(),
+        });
+        let mut exceptions = self.stamp_exceptions();
+        exceptions.extend(grace);
+        self.set_stamp_exceptions(&exceptions);
+        Ok(())
+    }
+
    /// Set the stamp_exception to only allow a subsequent request matching a specific route using the current security-stamp.
    ///
    /// # Arguments
@@ -247,17 +298,30 @@ impl User {
    ///   After these 2 minutes this stamp will expire.
    ///
    pub fn set_stamp_exception(&mut self, route_exception: Vec<String>) {
-        let stamp_exception = UserStampException {
-            routes: route_exception,
+        self.set_stamp_exceptions(&[UserStampException {
+            routes: Some(route_exception),
            security_stamp: self.security_stamp.clone(),
            expire: (Utc::now() + TimeDelta::try_minutes(2).unwrap()).timestamp(),
-        };
-        self.stamp_exception = Some(serde_json::to_string(&stamp_exception).unwrap_or_default());
+        }]);
    }

-    /// Resets the stamp_exception to prevent re-use of the previous security-stamp
-    pub fn reset_stamp_exception(&mut self) {
-        self.stamp_exception = None;
+    /// The previous security stamps that are still accepted, expired ones included.
+    pub fn stamp_exceptions(&self) -> Vec<UserStampException> {
+        let Some(stored) = self.stamp_exception.as_deref() else {
+            return Vec::new();
+        };
+        // Before key rotations kept sessions alive, only a single route exception was stored.
+        serde_json::from_str::<Vec<UserStampException>>(stored)
+            .or_else(|_| serde_json::from_str::<UserStampException>(stored).map(|e| vec![e]))
+            .unwrap_or_default()
+    }
+
+    fn set_stamp_exceptions(&mut self, exceptions: &[UserStampException]) {
+        self.stamp_exception = if exceptions.is_empty() {
+            None
+        } else {
+            Some(serde_json::to_string(&exceptions).unwrap_or_default())
+        };
    }

    pub fn display_name(&self) -> &str {
@@ -276,7 +340,7 @@ impl User {
        if !self.is_v2() {
            return None;
        }
-        UserSignatureKeyPair::find_active_by_user(&self.uuid, conn).await
+        UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
    }

    pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
@@ -323,8 +387,8 @@ impl User {
        })
    }

-    pub fn v2_upgrade_token_json(&self) -> Value {
-        self.v2_upgrade_token.as_ref().and_then(|token| serde_json::from_str(token).ok()).unwrap_or(Value::Null)
+    pub fn v2_upgrade_token_json(&self) -> Option<Value> {
+        self.v2_upgrade_token.as_ref().and_then(|token| serde_json::from_str(token).ok())
    }

    pub async fn to_json(&self, conn: &DbConn) -> Value {
@@ -333,6 +397,11 @@ impl User {
            orgs_json.push(c.to_json(conn).await);
        }

+        let mut orgs_new_json = Vec::new();
+        for c in Membership::find_accepted_and_confirmed_by_user(&self.uuid, conn).await {
+            orgs_new_json.push(c.to_json(conn).await);
+        }
+
        let twofactor_enabled = !TwoFactor::find_by_user(&self.uuid, conn).await.is_empty();

        // TODO: Might want to save the status field in the DB
@@ -359,6 +428,7 @@ impl User {
            "privateKey": self.private_key,
            "securityStamp": self.security_stamp,
            "organizations": orgs_json,
+            "organizationsNew": orgs_new_json,
            "providers": [],
            "providerOrganizations": [],
            "forcePasswordReset": false,
@@ -524,15 +594,17 @@ impl Invitation {
        }

        db_run! { conn:
-            sqlite, mysql {
-                // Not checking for ForeignKey Constraints here
-                // Table invitations does not have any ForeignKey Constraints.
-                diesel::replace_into(invitations::table)
+            // Not checking for ForeignKey Constraints here
+            // Table invitations does not have any ForeignKey Constraints.
+            mysql {
+                diesel::insert_into(invitations::table)
                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_nothing()
                    .execute(conn)
                    .map_res("Error saving invitation")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(invitations::table)
                    .values(self)
                    .on_conflict(invitations::email)
@@ -586,16 +658,47 @@ impl Invitation {
 #[from(forward)]
 pub struct UserId(String);

+#[derive(
+    Clone,
+    Debug,
+    DieselNewType,
+    FromForm,
+    PartialEq,
+    Eq,
+    Hash,
+    Serialize,
+    Deserialize,
+    AsRef,
+    Deref,
+    Display,
+    From,
+    UuidFromParam,
+)]
+#[deref(forward)]
+#[from(forward)]
+pub struct KeyId(#[serde(deserialize_with = "deserialize_key_id")] String);
+
+/// Rejects a key id from a request that isn't 16 bytes as lowercase hex, as upstream's `[KeyId]` does.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/KeyId.cs>
+fn deserialize_key_id<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
+    let key_id = <String as serde::Deserialize>::deserialize(deserializer)?;
+    if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
+        return Err(serde::de::Error::custom("Key id must be a 32 character lowercase hex-encoded string."));
+    }
+    Ok(key_id)
+}
+
 impl SsoUser {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            sqlite, mysql {
-                diesel::replace_into(sso_users::table)
+            mysql {
+                diesel::insert_into(sso_users::table)
                    .values(self)
                    .execute(conn)
                    .map_res("Error saving SSO user")
            }
-            postgresql {
+            postgresql, sqlite {
                diesel::insert_into(sso_users::table)
                    .values(self)
                    .execute(conn)
@@ -9,7 +9,6 @@ use crate::{
    error::MapResult,
    util::get_uuid,
 };
-use macros::UuidFromParam;

 use super::UserId;

@@ -47,28 +46,13 @@ pub enum SignatureAlgorithm {
 }

 impl SignatureAlgorithm {
-    pub fn from_str(algorithm: &str) -> Option<Self> {
+    pub fn parse(algorithm: &str) -> Option<Self> {
        match algorithm {
            "ed25519" => Some(Self::Ed25519),
            "mldsa44" => Some(Self::MlDsa44),
            _ => None,
        }
    }
-
-    pub fn from_i32(algorithm: i32) -> Option<Self> {
-        match algorithm {
-            0 => Some(Self::Ed25519),
-            1 => Some(Self::MlDsa44),
-            _ => None,
-        }
-    }
-
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::Ed25519 => "ed25519",
-            Self::MlDsa44 => "mldsa44",
-        }
-    }
 }

 /// Local methods
@@ -128,9 +112,8 @@ impl UserSignatureKeyPair {
        }
    }

-    /// The key pair currently in use by the user. There is at most one today, enforced by a unique
-    /// index on `user_uuid`.
-    pub async fn find_active_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<Self> {
+    /// The user's key pair. There is at most one, enforced by a unique index on `user_uuid`.
+    pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<Self> {
        conn.run(move |conn| {
            user_signature_key_pairs::table
                .filter(user_signature_key_pairs::user_uuid.eq(user_uuid))
@@ -150,20 +133,5 @@ impl UserSignatureKeyPair {
    }
 }

-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
+#[derive(Clone, Debug, AsRef, Deref, DieselNewType, Display, From, Hash, PartialEq, Eq, Serialize, Deserialize)]
 pub struct UserSignatureKeyPairId(String);
@@ -217,6 +217,7 @@ table! {
        api_key -> Nullable<Text>,
        avatar_color -> Nullable<Text>,
        external_id -> Nullable<Text>,
+        key_id -> Nullable<Text>,
        signed_public_key -> Nullable<Text>,
        security_state -> Nullable<Text>,
        security_version -> Nullable<Integer>,
@@ -258,6 +259,7 @@ table! {
        atype -> Integer,
        reset_password_key -> Nullable<Text>,
        external_id -> Nullable<Text>,
+        v2_upgrade_token -> Nullable<Text>,
    }
 }

@@ -14,7 +14,10 @@ use reqwest::{
 };
 use url::Host;

-use crate::{CONFIG, util::is_global};
+use crate::{
+    CONFIG,
+    util::{get_env_bool, is_global},
+};

 pub fn make_http_request(method: reqwest::Method, url: &str) -> Result<reqwest::RequestBuilder, crate::Error> {
    static INSTANCE: LazyLock<Client> =
@@ -36,7 +39,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
    let mut headers = header::HeaderMap::new();
    headers.insert(header::USER_AGENT, header::HeaderValue::from_static("Vaultwarden"));

-    let redirect_policy = reqwest::redirect::Policy::custom(|attempt| {
+    let redirect_policy = reqwest::redirect::Policy::custom(move |attempt| {
        if attempt.previous().len() >= 5 {
            return attempt.error("Too many redirects");
        }
@@ -45,7 +48,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
            return attempt.error("Invalid host");
        };

-        if let Err(e) = should_block_host(&host) {
+        if enforce_block && let Err(e) = should_block_host(&host) {
            return attempt.error(e);
        }

@@ -59,6 +62,14 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
        .timeout(Duration::from_secs(10))
 }

+fn dns_prefer_ipv6() -> bool {
+    // CONFIG may require DNS to initialize, so avoid forcing it during bootstrap.
+    match LazyLock::get(&CONFIG) {
+        Some(config) => config.dns_prefer_ipv6(),
+        None => get_env_bool("DNS_PREFER_IPV6").unwrap_or(false),
+    }
+}
+
 fn should_block_ip(ip: IpAddr) -> bool {
    if !CONFIG.http_request_block_non_global_ips() {
        return false;
@@ -258,12 +269,8 @@ impl CustomDnsResolver {
    fn new() -> Arc<Self> {
        TokioResolver::builder(TokioRuntimeProvider::default())
            .and_then(|mut builder| {
-                // Hickory's default since v0.26 is `Ipv6AndIpv4`, which sorts IPv6 first
-                // This might cause issues on IPv4 only systems or containers
-                // Unless someone enabled DNS_PREFER_IPV6, use Ipv4AndIpv6, which returns IPv4 first which was our previous default
-                if !CONFIG.dns_prefer_ipv6() {
-                    builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
-                }
+                // Query both families; the preferred order is applied per lookup below.
+                builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
                builder.build()
            })
            .inspect_err(|e| warn!("Error creating Hickory resolver, falling back to default: {e:?}"))
@@ -289,6 +296,17 @@ impl CustomDnsResolver {
    }
 }

+fn sort_addresses(addresses: &mut [SocketAddr], prefer_ipv6: bool) {
+    // `sort_by_key` orders `false` before `true`.
+    // When IPv6 is preferred, IPv6 addresses return `false` for `is_ipv4()` and sort first.
+    // When IPv4 is preferred, IPv4 addresses return `false` for `is_ipv6()` and sort first.
+    if prefer_ipv6 {
+        addresses.sort_by_key(SocketAddr::is_ipv4);
+    } else {
+        addresses.sort_by_key(SocketAddr::is_ipv6);
+    }
+}
+
 fn pre_resolve(name: &str, enforce_block: bool) -> Result<(), CustomHttpClientError> {
    let Ok(host) = get_valid_host(name) else {
        return Err(CustomHttpClientError::Invalid {
@@ -320,7 +338,9 @@ impl Resolve for CustomDns {
        let this = Arc::clone(&self.resolver);
        Box::pin(async move {
            let name = name.as_str();
-            let results = this.resolve_domain(name, enforce_block).await?;
+            let mut results = this.resolve_domain(name, enforce_block).await?;
+            // Recheck after bootstrap so long-lived clients adopt the loaded config.
+            sort_addresses(&mut results, dns_prefer_ipv6());
            if results.is_empty() {
                warn!("Unable to resolve {name} to any valid IP address");
            }
@@ -339,10 +359,29 @@ pub(crate) mod aws {
    };
    use reqwest::Client;

+    use super::get_reqwest_client_builder;
+
    // Adapter that wraps reqwest to be compatible with the AWS SDK
    #[derive(Debug)]
    pub(crate) struct AwsReqwestConnector {
-        pub(crate) client: Client,
+        client: Client,
+    }
+
+    impl AwsReqwestConnector {
+        pub(crate) fn new() -> Self {
+            let client = get_reqwest_client_builder(false).build().expect("Failed to build AWS HTTP client");
+            Self {
+                client,
+            }
+        }
+    }
+
+    fn connector_error(error: reqwest::Error) -> ConnectorError {
+        if error.is_timeout() {
+            ConnectorError::timeout(Box::new(error))
+        } else {
+            ConnectorError::io(Box::new(error))
+        }
    }

    impl HttpConnector for AwsReqwestConnector {
@@ -362,10 +401,10 @@ pub(crate) mod aws {
                    req_builder = req_builder.body(body_bytes.to_vec());
                }

-                let response = req_builder.send().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
+                let response = req_builder.send().await.map_err(connector_error)?;

                let status = response.status().into();
-                let bytes = response.bytes().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
+                let bytes = response.bytes().await.map_err(connector_error)?;

                Ok(HttpResponse::new(status, bytes.into()))
            };
@@ -391,7 +430,7 @@ pub(crate) mod aws {
 mod tests {
    use super::*;
    use crate::util::is_global_hardcoded;
-    use std::net::Ipv4Addr;
+    use std::net::{Ipv4Addr, Ipv6Addr};
    use url::Host;

    // ===
@@ -404,6 +443,26 @@ mod tests {
        }
    }

+    #[test]
+    fn dns_setup_does_not_initialize_config() {
+        assert!(LazyLock::get(&CONFIG).is_none());
+        drop(CustomDns::instance(false));
+        assert!(LazyLock::get(&CONFIG).is_none());
+    }
+
+    #[test]
+    fn dns_preference_orders_addresses() {
+        let ipv4 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);
+        let ipv6 = SocketAddr::new(IpAddr::V6(Ipv6Addr::LOCALHOST), 0);
+        let mut addresses = [ipv6, ipv4];
+
+        sort_addresses(&mut addresses, false);
+        assert_eq!(addresses, [ipv4, ipv6]);
+
+        sort_addresses(&mut addresses, true);
+        assert_eq!(addresses, [ipv6, ipv4]);
+    }
+
    #[test]
    fn dotted_decimal_loopback_normalizes() {
        let ip = parse_to_ip("127.0.0.1").unwrap();
@@ -4,10 +4,10 @@
 *
 * To rebuild or modify this file with the latest versions of the included
 * software please visit:
- *   https://datatables.net/download/#bs5/dt-3.0.3
+ *   https://datatables.net/download/#bs5/dt-3.0.4
 *
 * Included libraries:
- *   DataTables 3.0.3
+ *   DataTables 3.0.4
 */

 /*! DataTables Bootstrap 5 integration
@@ -636,6 +636,18 @@ table.dataTable.table-sm > thead > tr td.dt-type-date .dt-column-order,
 table.dataTable.table-sm > thead > tr td.dt-type-numeric .dt-column-order {
  left: 0.25rem;
 }
+table.dataTable.table-sm > thead > tr th.dt-left .dt-column-order, table.dataTable.table-sm > thead > tr th.dt-head-left .dt-column-order,
+table.dataTable.table-sm > thead > tr td.dt-left .dt-column-order,
+table.dataTable.table-sm > thead > tr td.dt-head-left .dt-column-order {
+  left: auto;
+  right: 0.25rem;
+}
+table.dataTable.table-sm > thead > tr th.dt-right .dt-column-order, table.dataTable.table-sm > thead > tr th.dt-head-right .dt-column-order,
+table.dataTable.table-sm > thead > tr td.dt-right .dt-column-order,
+table.dataTable.table-sm > thead > tr td.dt-head-right .dt-column-order {
+  left: 0.25rem;
+  right: auto;
+}

 div.dt-scroll-head table.table-bordered {
  border-bottom-width: 0;
@@ -77,10 +77,18 @@ pub(crate) fn operator_for_path(path: &str) -> Result<opendal::Operator, crate::

 #[cfg(s3)]
 mod s3 {
+    use std::sync::LazyLock;
+
+    use opendal_http_transport_reqwest::ReqwestTransport;
    use reqwest::Url;

    use crate::error::Error;

+    static HTTP_CLIENT: LazyLock<reqwest::Client> = LazyLock::new(|| {
+        // Storage endpoints are administrator-configured and may be private.
+        crate::http_client::get_reqwest_client_builder(false).build().expect("Failed to build OpenDAL HTTP client")
+    });
+
    pub(super) fn is_uri(path: &str) -> bool {
        path.starts_with("s3://")
    }
@@ -177,12 +185,7 @@ mod s3 {

                let chain = DEFAULT_CREDENTIAL_CHAIN
                    .get_or_init(|| {
-                        let reqwest_client = reqwest::Client::builder().build().unwrap();
-                        let connector = AwsReqwestConnector {
-                            client: reqwest_client,
-                        };
-
-                        let conf = ProviderConfig::default().with_http_client(connector);
+                        let conf = ProviderConfig::default().with_http_client(AwsReqwestConnector::new());

                        DefaultCredentialsChain::builder().configure(conf).build()
                    })
@@ -236,7 +239,9 @@ mod s3 {
                builder.credential_provider_chain(ProvideCredentialChain::new().push(OpenDALS3CredentialProvider));
        }

-        Ok(opendal::Operator::new(builder)?)
+        let http_transport = opendal::HttpTransporter::new(ReqwestTransport::new(HTTP_CLIENT.clone()));
+        let context = opendal::OperationContext::new().with_http_transport(http_transport);
+        Ok(opendal::Operator::new(builder)?.with_context(context))
    }

    fn uri_has_option(uri: &opendal::OperatorUri, names: &[&str]) -> bool {
Author	SHA1	Message	Date
Daniel García	d01db37e75	Some simplifications	2026-09-23 23:53:12 +02:00
Daniel García	fe212a425f	Add typo exception	2026-09-23 23:30:19 +02:00
Daniel García	72a39ae90b	Implement V2 key rotation support	2026-09-23 23:30:19 +02:00
Daniel García	fd7e1be788	Implement V2 registration support Signed-off-by: BlackDex <black.dex@gmail.com>	2026-09-23 23:30:18 +02:00
Abhi ShandilyaandDaniel García	d2660324e6	Fix revoked org members retaining access to org ciphers (#7554 ) The cipher access restriction queries (direct collection access, group collection access, and full access via groups) never checked the organization membership status. Since users_collections and groups_users rows are kept when a membership is revoked, revoked (and not yet confirmed) members kept read, write, delete, attachment and collection-move access to org ciphers via the direct-by-UUID endpoints. Require a confirmed membership in the cipher's organization in all three queries, matching the behavior of the sync queries. Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>	2026-09-23 19:44:05 +02:00
Stefan Melmuk	cc67d644f6	set user_created bool for each separate invitation (#7753 )	2026-09-18 20:35:11 +02:00
Berk D. Demir	3347698712	Add `pm-34171-card-scanner` feature flag (#7477 ) Introduced in 2026.4.1 Mobile releases (Android and iOS), enables use of device camera to autofill a card type item. N.B. This feature relies on Google ML Kit. F-Droid policy disallows Google ML Kit. Because of this, F-Droid builds do not ship with card scanner feature. (See https://github.com/bitwarden/android/pull/6890)	2026-09-18 20:34:41 +02:00
Mathijs van Veluw	a24683636a	Update Crates, GHA and JS (#7751 ) Signed-off-by: BlackDex <black.dex@gmail.com>	2026-09-18 18:44:50 +02:00
Berk D. Demir	64c56411f6	Add `pm-32009-new-item-types` feature flag (#7478 ) Introduced in 2026.4.0 for all clients, enables new item types bank account, driver's license, and passport.	2026-09-18 16:53:27 +02:00
Tom	c3f5477525	Add accepted organization data to sync response (#7666 )	2026-09-18 16:53:17 +02:00
TimshelandTimshel	9c8aa2359f	User key id (#7693 ) Co-authored-by: Timshel <timshel@users.noreply.github.com>	2026-09-18 16:53:06 +02:00
Tom	8719f86fcf	Add basic auth response client feature flag (#7745 )	2026-09-18 16:52:57 +02:00
Tom	fddc8e71be	Support the vault banner policy (#7748 )	2026-09-18 16:52:49 +02:00
Mathijs van Veluw	eb212e23fa	Fix archiveDate update (#7722 ) When `archiveDate` is set to `null` it should unarchive it for that specific user, which is what Bitwarden does. This should fix this by checking and validating if it is `null` Fixes #7581 Signed-off-by: BlackDex <black.dex@gmail.com>	2026-09-09 18:24:33 +02:00
TimshelandTimshel	25dfedafd7	Use insert_into when possible (#6437 ) Co-authored-by: Timshel <timshel@users.noreply.github.com>	2026-09-09 16:43:47 +02:00
Tom	e992cbb4f5	Fix iOS registration token response (#7714 ) * Return registration token as text/plain for Accept: / * fix register verification response content negotiation	2026-09-09 14:31:03 +02:00
Chase DouglasandBlackDex	5b51b60f94	Route service clients through shared HTTP setup (#7639 ) * storage: route OpenDAL through HTTP client OpenDAL 0.58 requires applications to provide an HTTP transport. Its default installer creates a standalone client, bypassing Vaultwarden DNS, redirect, proxy, timeout, and request configuration. Build the client through the internal HTTP interface and inject it into OpenDAL's public reqwest transport. * http: honor block setting on redirects Clients can disable host blocking for administrator-configured private services. DNS resolution honors this setting, but the redirect policy still performs config-backed host checks. Capture the setting in the redirect policy and skip those checks when blocking is disabled. This also avoids re-entering CONFIG when a remote configuration request is redirected during startup. * http: make DNS setup bootstrap-safe Remote configuration can require an HTTP client while CONFIG is still initializing. Building the DNS resolver currently reads CONFIG.dns_prefer_ipv6(), so loading an S3-backed config can deadlock. Build one resolver without consulting CONFIG. Order addresses for each lookup using the merged setting when available, falling back to the environment and then IPv4-first during bootstrap. * aws: use internal HTTP client The AWS SDK connector builds a raw reqwest client, bypassing Vaultwarden TLS, DNS, redirect, proxy, timeout, and request setup. Construct it through the internal HTTP client interface and retain the standard ten-second request deadline. Permit private AWS metadata and service endpoints by disabling non-global IP blocking. Preserve timeout errors when adapting reqwest failures to the AWS SDK so the runtime receives the correct connector error category. * Added comment for the prefer IPv function Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com> Co-authored-by: BlackDex <black.dex@gmail.com>	2026-09-09 14:30:25 +02:00
Mathijs van Veluw	de7abaaafa	Update Rust and adjust DockerSettings (#7690 ) - Update Rust to v1.98.1 which resolves a build issues with strange outcomes - Adjusted the DockerSettings and render_template to extract the `rust_version` from the `rust-toolchain.toml` file. This should prevent mismatches and forgetting to update DockerSettings. - Updated typos in GHA and Pre-Commit - Updated all possible crates including hickory which has several CVE's fixed. Signed-off-by: BlackDex <black.dex@gmail.com>	2026-09-09 11:51:23 +02:00
niniconi	b7667e27bf	fix: Correct invalid comment syntax in .dockerignore (#7274 ) Docker only recognizes `#` as a valid comment indicator in .dockerignore files. Using `//` causes the lines to be incorrectly parsed as glob patterns rather than comments. While this may not cause fatal errors if no matching files exist, it is syntactically invalid and could lead to unexpected behavior. Corrected the syntax to use `#`.	2026-09-08 13:42:58 +02:00