Test dylint

2025-11-30 00:22:34 +02:00 · 2024-11-09 17:31:22 +01:00
114 changed files with 7774 additions and 11335 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -5,7 +5,6 @@
 !.git
 !docker/healthcheck.sh
 !docker/start.sh
-!macros
 !migrations
 !src

--- a/.env.template
+++ b/.env.template
@@ -15,14 +15,6 @@
 ####################

 ## Main data folder
-## This can be a path to local folder or a path to an external location
-## depending on features enabled at build time. Possible external locations:
-##
-## - AWS S3 Bucket (via `s3` feature): s3://bucket-name/path/to/folder
-##
-## When using an external location, make sure to set TMP_FOLDER,
-## TEMPLATES_FOLDER, and DATABASE_URL to local paths and/or a remote database
-## location.
 # DATA_FOLDER=data

 ## Individual folders, these override %DATA_FOLDER%
@@ -30,13 +22,10 @@
 # ICON_CACHE_FOLDER=data/icon_cache
 # ATTACHMENTS_FOLDER=data/attachments
 # SENDS_FOLDER=data/sends
-
-## Temporary folder used for storing temporary file uploads
-## Must be a local path.
 # TMP_FOLDER=data/tmp

-## HTML template overrides data folder
-## Must be a local path.
+## Templates data folder, by default uses embedded templates
+## Check source code to see the format
 # TEMPLATES_FOLDER=data/templates
 ## Automatically reload the templates for every request, slow, use only for development
 # RELOAD_TEMPLATES=false
@@ -50,9 +39,7 @@
 #########################

 ## Database URL
-## When using SQLite, this is the path to the DB file, and it defaults to
-## %DATA_FOLDER%/db.sqlite3. If DATA_FOLDER is set to an external location, this
-## must be set to a local sqlite3 file path.
+## When using SQLite, this is the path to the DB file, default to %DATA_FOLDER%/db.sqlite3
 # DATABASE_URL=data/db.sqlite3
 ## When using MySQL, specify an appropriate connection URI.
 ## Details: https://docs.diesel.rs/2.1.x/diesel/mysql/struct.MysqlConnection.html
@@ -130,7 +117,7 @@
 ## and are always in terms of UTC time (regardless of your local time zone settings).
 ##
 ## The schedule format is a bit different from crontab as crontab does not contains seconds.
-## You can test the format here: https://crontab.guru, but remove the first digit!
+## You can test the the format here: https://crontab.guru, but remove the first digit!
 ## SEC  MIN   HOUR   DAY OF MONTH    MONTH   DAY OF WEEK
 ## "0   30   9,12,15     1,15       May-Aug  Mon,Wed,Fri"
 ## "0   30     *          *            *          *     "
@@ -242,8 +229,7 @@
 # SIGNUPS_ALLOWED=true

 ## Controls if new users need to verify their email address upon registration
-## On new client versions, this will require the user to verify their email at signup time.
-## On older clients, it will require the user to verify their email before they can log in.
+## Note that setting this option to true prevents logins until the email address has been verified!
 ## The welcome email will include a verification link, and login attempts will periodically
 ## trigger another verification email to be sent.
 # SIGNUPS_VERIFY=false
@@ -273,7 +259,7 @@
 ## A comma-separated list means only those users can create orgs:
 # ORG_CREATION_USERS=admin1@example.com,admin2@example.com

-## Allows org admins to invite users, even when signups are disabled
+## Invitations org admins to invite users, even when signups are disabled
 # INVITATIONS_ALLOWED=true
 ## Name shown in the invitation emails that don't come from a specific organization
 # INVITATION_ORG_NAME=Vaultwarden
@@ -294,13 +280,12 @@
 ## The default for new users. If changed, it will be updated during login for existing users.
 # PASSWORD_ITERATIONS=600000

-## Controls whether users can set or show password hints. This setting applies globally to all users.
+## Controls whether users can set password hints. This setting applies globally to all users.
 # PASSWORD_HINTS_ALLOWED=true

 ## Controls whether a password hint should be shown directly in the web page if
-## SMTP service is not configured and password hints are allowed.
-## Not recommended for publicly-accessible instances because this provides
-## unauthenticated access to potentially sensitive data.
+## SMTP service is not configured. Not recommended for publicly-accessible instances
+## as this provides unauthenticated access to potentially sensitive data.
 # SHOW_PASSWORD_HINT=false

 #########################
@@ -341,33 +326,29 @@

 ## Icon download timeout
 ## Configure the timeout value when downloading the favicons.
-## The default is 10 seconds, but this could be too low on slower network connections
+## The default is 10 seconds, but this could be to low on slower network connections
 # ICON_DOWNLOAD_TIMEOUT=10

 ## Block HTTP domains/IPs by Regex
 ## Any domains or IPs that match this regex won't be fetched by the internal HTTP client.
 ## Useful to hide other servers in the local network. Check the WIKI for more details
-## NOTE: Always enclose this regex within single quotes!
+## NOTE: Always enclose this regex withing single quotes!
 # HTTP_REQUEST_BLOCK_REGEX='^(192\.168\.0\.[0-9]+|192\.168\.1\.[0-9]+)$'

-## Enabling this will cause the internal HTTP client to refuse to connect to any non-global IP address.
+## Enabling this will cause the internal HTTP client to refuse to connect to any non global IP address.
 ## Useful to secure your internal environment: See https://en.wikipedia.org/wiki/Reserved_IP_addresses for a list of IPs which it will block
 # HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS=true

 ## Client Settings
 ## Enable experimental feature flags for clients.
 ## This is a comma-separated list of flags, e.g. "flag1,flag2,flag3".
-## Note that clients cache the /api/config endpoint for about 1 hour and it could take some time before they are enabled or disabled!
 ##
 ## The following flags are available:
-## - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
-## - "inline-menu-totp": Enable the use of inline menu TOTP codes in the browser extension.
-## - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
-## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
-## - "export-attachments": Enable support for exporting attachments (Clients >=2025.4.0)
-## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Needs Android >=2025.3.0, iOS >=2025.4.0)
-## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Needs Android >=2025.3.0, iOS >=2025.4.0)
-## - "mutual-tls": Enable the use of mutual TLS on Android (Client >= 2025.2.0)
+## - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
+## - "autofill-v2": Use the new autofill implementation.
+## - "browser-fileless-import": Directly import credentials from other providers without a file.
+## - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
+## - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=fido2-vault-credentials

 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -426,14 +407,6 @@
 ## Multiple values must be separated with a whitespace.
 # ALLOWED_IFRAME_ANCESTORS=

-## Allowed connect-src (Know the risks!)
-## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
-## Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
-## This adds the configured value to the 'Content-Security-Policy' headers 'connect-src' value.
-## Multiple values must be separated with a whitespace. And only HTTPS values are allowed.
-## Example: "https://my-addy-io.domain.tld https://my-simplelogin.domain.tld"
-# ALLOWED_CONNECT_SRC=""
-
 ## Number of seconds, on average, between login requests from the same IP address before rate limiting kicks in.
 # LOGIN_RATELIMIT_SECONDS=60
 ## Allow a burst of requests of up to this size, while maintaining the average indicated by `LOGIN_RATELIMIT_SECONDS`.
@@ -501,7 +474,7 @@
 ## Maximum attempts before an email token is reset and a new email will need to be sent.
 # EMAIL_ATTEMPTS_LIMIT=3
 ##
-## Setup email 2FA on registration regardless of any organization policy
+## Setup email 2FA regardless of any organization policy
 # EMAIL_2FA_ENFORCE_ON_VERIFIED_INVITE=false
 ## Automatically setup email 2FA as fallback provider when needed
 # EMAIL_2FA_AUTO_FALLBACK=false
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,6 +1,3 @@
 /.github @dani-garcia @BlackDex
-/.github/** @dani-garcia @BlackDex
 /.github/CODEOWNERS @dani-garcia @BlackDex
-/.github/ISSUE_TEMPLATE/** @dani-garcia @BlackDex
 /.github/workflows/** @dani-garcia @BlackDex
-/SECURITY.md @dani-garcia @BlackDex
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -8,30 +8,15 @@ body:
      value: |
        Thanks for taking the time to fill out this bug report!

-        Please **do not** submit feature requests or ask for help on how to configure Vaultwarden here!
+        Please *do not* submit feature requests or ask for help on how to configure Vaultwarden here.

        The [GitHub Discussions](https://github.com/dani-garcia/vaultwarden/discussions/) has sections for Questions and Ideas.

-        Our [Wiki](https://github.com/dani-garcia/vaultwarden/wiki/) has topics on how to configure Vaultwarden.
-
        Also, make sure you are running [![GitHub Release](https://img.shields.io/github/release/dani-garcia/vaultwarden.svg)](https://github.com/dani-garcia/vaultwarden/releases/latest) of Vaultwarden!
+        And search for existing open or closed issues or discussions regarding your topic before posting.

        Be sure to check and validate the Vaultwarden Admin Diagnostics (`/admin/diagnostics`) page for any errors!
        See here [how to enable the admin page](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page).
-
-        > [!IMPORTANT]
-        > ## :bangbang: Search for existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) regarding your topic before posting! :bangbang:
-  #
-  - type: checkboxes
-    id: checklist
-    attributes:
-      label: Prerequisites
-      description: Please confirm you have completed the following before submitting an issue!
-      options:
-        - label: I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=)
-          required: true
-        - label: I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/)
-          required: true
  #
  - id: support-string
    type: textarea
@@ -51,7 +36,7 @@ body:
    attributes:
      label: Vaultwarden Build Version
      description: What version of Vaultwarden are you running?
-      placeholder: ex. v1.34.0 or v1.34.1-53f58b14
+      placeholder: ex. v1.31.0 or v1.32.0-3466a804
    validations:
      required: true
  #
@@ -82,7 +67,7 @@ body:
    attributes:
      label: Reverse Proxy
      description: Are you using a reverse proxy, if so which and what version?
-      placeholder: ex. nginx 1.29.0, caddy 2.10.0, traefik 3.4.4, haproxy 3.2
+      placeholder: ex. nginx 1.26.2, caddy 2.8.4, traefik 3.1.2, haproxy 3.0
    validations:
      required: true
  #
@@ -130,7 +115,7 @@ body:
    attributes:
      label: Client Version
      description: What version(s) of the client(s) are you seeing the problem on?
-      placeholder: ex. CLI v2025.7.0, Firefox 140 - v2025.6.1
+      placeholder: ex. CLI v2024.7.2, Firefox 130 - v2024.7.0
  #
  - id: reproduce
    type: textarea
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,4 @@
 name: Build
-permissions: {}

 on:
  push:
@@ -14,7 +13,6 @@ on:
      - "diesel.toml"
      - "docker/Dockerfile.j2"
      - "docker/DockerSettings.yaml"
-
  pull_request:
    paths:
      - ".github/workflows/build.yml"
@@ -30,17 +28,13 @@ on:

 jobs:
  build:
-    name: Build and Test ${{ matrix.channel }}
-    permissions:
-      actions: write
-      contents: read
    # We use Ubuntu 22.04 here because this matches the library versions used within the Debian docker containers
    runs-on: ubuntu-22.04
    timeout-minutes: 120
    # Make warnings errors, this is to prevent warnings slipping through.
    # This is done globally to prevent rebuilds when the RUSTFLAGS env variable changes.
    env:
-      RUSTFLAGS: "-Dwarnings"
+      RUSTFLAGS: "-D warnings"
    strategy:
      fail-fast: false
      matrix:
@@ -48,33 +42,32 @@ jobs:
          - "rust-toolchain" # The version defined in rust-toolchain
          - "msrv" # The supported MSRV

+    name: Build and Test ${{ matrix.channel }}
+
    steps:
+      # Checkout the repo
+      - name: "Checkout"
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
+      # End Checkout the repo
+
+
      # Install dependencies
      - name: "Install dependencies Ubuntu"
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends openssl build-essential libmariadb-dev-compat libpq-dev libssl-dev pkg-config
      # End Install dependencies

-      # Checkout the repo
-      - name: "Checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-      # End Checkout the repo

      # Determine rust-toolchain version
      - name: Init Variables
        id: toolchain
        shell: bash
-        env:
-          CHANNEL: ${{ matrix.channel }}
        run: |
-          if [[ "${CHANNEL}" == 'rust-toolchain' ]]; then
+          if [[ "${{ matrix.channel }}" == 'rust-toolchain' ]]; then
            RUST_TOOLCHAIN="$(grep -oP 'channel.*"(\K.*?)(?=")' rust-toolchain.toml)"
-          elif [[ "${CHANNEL}" == 'msrv' ]]; then
+          elif [[ "${{ matrix.channel }}" == 'msrv' ]]; then
            RUST_TOOLCHAIN="$(grep -oP 'rust-version.*"(\K.*?)(?=")' Cargo.toml)"
          else
-            RUST_TOOLCHAIN="${CHANNEL}"
+            RUST_TOOLCHAIN="${{ matrix.channel }}"
          fi
          echo "RUST_TOOLCHAIN=${RUST_TOOLCHAIN}" | tee -a "${GITHUB_OUTPUT}"
      # End Determine rust-toolchain version
@@ -82,7 +75,7 @@ jobs:

      # Only install the clippy and rustfmt components on the default rust-toolchain
      - name: "Install rust-toolchain version"
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # master @ Apr 29, 2025, 9:22 PM GMT+2
+        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a # master @ Aug 8, 2024, 7:36 PM GMT+2
        if: ${{ matrix.channel == 'rust-toolchain' }}
        with:
          toolchain: "${{steps.toolchain.outputs.RUST_TOOLCHAIN}}"
@@ -92,7 +85,7 @@ jobs:

      # Install the any other channel to be used for which we do not execute clippy and rustfmt
      - name: "Install MSRV version"
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # master @ Apr 29, 2025, 9:22 PM GMT+2
+        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a # master @ Aug 8, 2024, 7:36 PM GMT+2
        if: ${{ matrix.channel != 'rust-toolchain' }}
        with:
          toolchain: "${{steps.toolchain.outputs.RUST_TOOLCHAIN}}"
@@ -100,13 +93,11 @@ jobs:

      # Set the current matrix toolchain version as default
      - name: "Set toolchain ${{steps.toolchain.outputs.RUST_TOOLCHAIN}} as default"
-        env:
-          RUST_TOOLCHAIN: ${{steps.toolchain.outputs.RUST_TOOLCHAIN}}
        run: |
          # Remove the rust-toolchain.toml
          rm rust-toolchain.toml
          # Set the default
-          rustup default "${RUST_TOOLCHAIN}"
+          rustup default ${{steps.toolchain.outputs.RUST_TOOLCHAIN}}

      # Show environment
      - name: "Show environment"
@@ -116,8 +107,7 @@ jobs:
      # End Show environment

      # Enable Rust Caching
-      - name: Rust Caching
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
        with:
          # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
          # Like changing the build host from Ubuntu 20.04 to 22.04 for example.
@@ -127,39 +117,33 @@ jobs:

      # Run cargo tests
      # First test all features together, afterwards test them separately.
-      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc,query_logger"
-        id: test_sqlite_mysql_postgresql_mimalloc_logger
-        if: ${{ !cancelled() }}
-        run: |
-          cargo test --features sqlite,mysql,postgresql,enable_mimalloc,query_logger
-
      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc"
        id: test_sqlite_mysql_postgresql_mimalloc
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features sqlite,mysql,postgresql,enable_mimalloc

      - name: "test features: sqlite,mysql,postgresql"
        id: test_sqlite_mysql_postgresql
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features sqlite,mysql,postgresql

      - name: "test features: sqlite"
        id: test_sqlite
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features sqlite

      - name: "test features: mysql"
        id: test_mysql
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features mysql

      - name: "test features: postgresql"
        id: test_postgresql
-        if: ${{ !cancelled() }}
+        if: $${{ always() }}
        run: |
          cargo test --features postgresql
      # End Run cargo tests
@@ -168,16 +152,16 @@ jobs:
      # Run cargo clippy, and fail on warnings
      - name: "clippy features: sqlite,mysql,postgresql,enable_mimalloc"
        id: clippy
-        if: ${{ !cancelled() && matrix.channel == 'rust-toolchain' }}
+        if: ${{ always() && matrix.channel == 'rust-toolchain' }}
        run: |
-          cargo clippy --features sqlite,mysql,postgresql,enable_mimalloc
+          cargo clippy --features sqlite,mysql,postgresql,enable_mimalloc -- -D warnings
      # End Run cargo clippy


      # Run cargo fmt (Only run on rust-toolchain defined version)
      - name: "check formatting"
        id: formatting
-        if: ${{ !cancelled() && matrix.channel == 'rust-toolchain' }}
+        if: ${{ always() && matrix.channel == 'rust-toolchain' }}
        run: |
          cargo fmt --all -- --check
      # End Run cargo fmt
@@ -187,31 +171,21 @@ jobs:
      # This is useful so all test/clippy/fmt actions are done, and they can all be addressed
      - name: "Some checks failed"
        if: ${{ failure() }}
-        env:
-          TEST_DB_M_L: ${{ steps.test_sqlite_mysql_postgresql_mimalloc_logger.outcome }}
-          TEST_DB_M: ${{ steps.test_sqlite_mysql_postgresql_mimalloc.outcome }}
-          TEST_DB: ${{ steps.test_sqlite_mysql_postgresql.outcome }}
-          TEST_SQLITE: ${{ steps.test_sqlite.outcome }}
-          TEST_MYSQL: ${{ steps.test_mysql.outcome }}
-          TEST_POSTGRESQL: ${{ steps.test_postgresql.outcome }}
-          CLIPPY: ${{ steps.clippy.outcome }}
-          FMT: ${{ steps.formatting.outcome }}
        run: |
-          echo "### :x: Checks Failed!" >> "${GITHUB_STEP_SUMMARY}"
-          echo "" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|Job|Status|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|---|------|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (sqlite,mysql,postgresql,enable_mimalloc,query_logger)|${TEST_DB_M_L}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (sqlite,mysql,postgresql,enable_mimalloc)|${TEST_DB_M}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (sqlite,mysql,postgresql)|${TEST_DB}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (sqlite)|${TEST_SQLITE}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (mysql)|${TEST_MYSQL}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (postgresql)|${TEST_POSTGRESQL}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|clippy (sqlite,mysql,postgresql,enable_mimalloc)|${CLIPPY}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|fmt|${FMT}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "" >> "${GITHUB_STEP_SUMMARY}"
-          echo "Please check the failed jobs and fix where needed." >> "${GITHUB_STEP_SUMMARY}"
-          echo "" >> "${GITHUB_STEP_SUMMARY}"
+          echo "### :x: Checks Failed!" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "|Job|Status|" >> $GITHUB_STEP_SUMMARY
+          echo "|---|------|" >> $GITHUB_STEP_SUMMARY
+          echo "|test (sqlite,mysql,postgresql,enable_mimalloc)|${{ steps.test_sqlite_mysql_postgresql_mimalloc.outcome }}|" >> $GITHUB_STEP_SUMMARY
+          echo "|test (sqlite,mysql,postgresql)|${{ steps.test_sqlite_mysql_postgresql.outcome }}|" >> $GITHUB_STEP_SUMMARY
+          echo "|test (sqlite)|${{ steps.test_sqlite.outcome }}|" >> $GITHUB_STEP_SUMMARY
+          echo "|test (mysql)|${{ steps.test_mysql.outcome }}|" >> $GITHUB_STEP_SUMMARY
+          echo "|test (postgresql)|${{ steps.test_postgresql.outcome }}|" >> $GITHUB_STEP_SUMMARY
+          echo "|clippy (sqlite,mysql,postgresql,enable_mimalloc)|${{ steps.clippy.outcome }}|" >> $GITHUB_STEP_SUMMARY
+          echo "|fmt|${{ steps.formatting.outcome }}|" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Please check the failed jobs and fix where needed." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
          exit 1


@@ -220,5 +194,5 @@ jobs:
      - name: "All checks passed"
        if: ${{ success() }}
        run: |
-          echo "### :tada: Checks Passed!" >> "${GITHUB_STEP_SUMMARY}"
-          echo "" >> "${GITHUB_STEP_SUMMARY}"
+          echo "### :tada: Checks Passed!" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/check-templates.yml
+++ b/.github/workflows/check-templates.yml
@@ -1,29 +0,0 @@
-name: Check templates
-permissions: {}
-
-on: [ push, pull_request ]
-
-jobs:
-  docker-templates:
-    name: Validate docker templates
-    permissions:
-      contents: read
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-
-    steps:
-      # Checkout the repo
-      - name: "Checkout"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-        with:
-          persist-credentials: false
-      # End Checkout the repo
-
-      - name: Run make to rebuild templates
-        working-directory: docker
-        run: make
-
-      - name: Check for unstaged changes
-        working-directory: docker
-        run: git diff --exit-code
-        continue-on-error: false
--- a/.github/workflows/hadolint.yml
+++ b/.github/workflows/hadolint.yml
@@ -1,20 +1,24 @@
 name: Hadolint
-permissions: {}

-on: [ push, pull_request ]
+on: [
+      push,
+      pull_request
+    ]

 jobs:
  hadolint:
    name: Validate Dockerfile syntax
-    permissions:
-      contents: read
    runs-on: ubuntu-24.04
    timeout-minutes: 30
-
    steps:
+      # Checkout the repo
+      - name: Checkout
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
+      # End Checkout the repo
+
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -33,12 +37,6 @@ jobs:
        env:
          HADOLINT_VERSION: 2.12.0
      # End Download hadolint
-      # Checkout the repo
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-        with:
-          persist-credentials: false
-      # End Checkout the repo

      # Test Dockerfiles with hadolint
      - name: Run hadolint
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,4 @@
 name: Release
-permissions: {}

 on:
  push:
@@ -7,23 +6,17 @@ on:
      - main

    tags:
-      # https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
-      - '[1-2].[0-9]+.[0-9]+'
+      - '*'

 jobs:
  # https://github.com/marketplace/actions/skip-duplicate-actions
  # Some checks to determine if we need to continue with building a new docker.
  # We will skip this check if we are creating a tag, because that has the same hash as a previous run already.
  skip_check:
-    # Only run this in the upstream repo and not on forks
-    if: ${{ github.repository == 'dani-garcia/vaultwarden' }}
-    name: Cancel older jobs when running
-    permissions:
-      actions: write
    runs-on: ubuntu-24.04
+    if: ${{ github.repository == 'dani-garcia/vaultwarden' }}
    outputs:
      should_skip: ${{ steps.skip_check.outputs.should_skip }}
-
    steps:
      - name: Skip Duplicates Actions
        id: skip_check
@@ -34,20 +27,14 @@ jobs:
        if: ${{ github.ref_type == 'branch' }}

  docker-build:
-    needs: skip_check
-    if: ${{ needs.skip_check.outputs.should_skip != 'true' && github.repository == 'dani-garcia/vaultwarden' }}
-    name: Build Vaultwarden containers
-    permissions:
-      packages: write
-      contents: read
-      attestations: write
-      id-token: write
    runs-on: ubuntu-24.04
    timeout-minutes: 120
-    # Start a local docker registry to extract the compiled binaries to upload as artifacts and attest them
+    needs: skip_check
+    if: ${{ needs.skip_check.outputs.should_skip != 'true' && github.repository == 'dani-garcia/vaultwarden' }}
+    # Start a local docker registry to extract the final Alpine static build binaries
    services:
      registry:
-        image: registry@sha256:1fc7de654f2ac1247f0b67e8a459e273b0993be7d2beda1f3f56fbf1001ed3e7 # v3.0.0
+        image: registry:2
        ports:
          - 5000:5000
    env:
@@ -69,42 +56,37 @@ jobs:
        base_image: ["debian","alpine"]

    steps:
+      # Checkout the repo
+      - name: Checkout
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
+        with:
+          fetch-depth: 0
+
      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
        with:
          platforms: "arm64,arm"

      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
-          cache-binary: false
          buildkitd-config-inline: |
            [worker.oci]
              max-parallelism = 2
          driver-opts: |
            network=host

-      # Checkout the repo
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-        # We need fetch-depth of 0 so we also get all the tag metadata
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-
      # Determine Base Tags and Source Version
      - name: Determine Base Tags and Source Version
        shell: bash
-        env:
-          REF_TYPE: ${{ github.ref_type }}
        run: |
-          # Check which main tag we are going to build determined by ref_type
-          if [[ "${REF_TYPE}" == "tag" ]]; then
+          # Check which main tag we are going to build determined by github.ref_type
+          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            echo "BASE_TAGS=latest,${GITHUB_REF#refs/*/}" | tee -a "${GITHUB_ENV}"
-          elif [[ "${REF_TYPE}" == "branch" ]]; then
+          elif [[ "${{ github.ref_type }}" == "branch" ]]; then
            echo "BASE_TAGS=testing" | tee -a "${GITHUB_ENV}"
          fi

@@ -120,7 +102,7 @@ jobs:

      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -129,14 +111,12 @@ jobs:
      - name: Add registry for DockerHub
        if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' }}
        shell: bash
-        env:
-          DOCKERHUB_REPO: ${{ vars.DOCKERHUB_REPO }}
        run: |
-          echo "CONTAINER_REGISTRIES=${DOCKERHUB_REPO}" | tee -a "${GITHUB_ENV}"
+          echo "CONTAINER_REGISTRIES=${{ vars.DOCKERHUB_REPO }}" | tee -a "${GITHUB_ENV}"

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -146,14 +126,12 @@ jobs:
      - name: Add registry for ghcr.io
        if: ${{ env.HAVE_GHCR_LOGIN == 'true' }}
        shell: bash
-        env:
-          GHCR_REPO: ${{ vars.GHCR_REPO }}
        run: |
-          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${GHCR_REPO}" | tee -a "${GITHUB_ENV}"
+          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${{ vars.GHCR_REPO }}" | tee -a "${GITHUB_ENV}"

      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -163,22 +141,17 @@ jobs:
      - name: Add registry for Quay.io
        if: ${{ env.HAVE_QUAY_LOGIN == 'true' }}
        shell: bash
-        env:
-          QUAY_REPO: ${{ vars.QUAY_REPO }}
        run: |
-          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${QUAY_REPO}" | tee -a "${GITHUB_ENV}"
+          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${{ vars.QUAY_REPO }}" | tee -a "${GITHUB_ENV}"

      - name: Configure build cache from/to
        shell: bash
-        env:
-          GHCR_REPO: ${{ vars.GHCR_REPO }}
-          BASE_IMAGE: ${{ matrix.base_image }}
        run: |
          #
          # Check if there is a GitHub Container Registry Login and use it for caching
          if [[ -n "${HAVE_GHCR_LOGIN}" ]]; then
-            echo "BAKE_CACHE_FROM=type=registry,ref=${GHCR_REPO}-buildcache:${BASE_IMAGE}" | tee -a "${GITHUB_ENV}"
-            echo "BAKE_CACHE_TO=type=registry,ref=${GHCR_REPO}-buildcache:${BASE_IMAGE},compression=zstd,mode=max" | tee -a "${GITHUB_ENV}"
+            echo "BAKE_CACHE_FROM=type=registry,ref=${{ vars.GHCR_REPO }}-buildcache:${{ matrix.base_image }}" | tee -a "${GITHUB_ENV}"
+            echo "BAKE_CACHE_TO=type=registry,ref=${{ vars.GHCR_REPO }}-buildcache:${{ matrix.base_image }},compression=zstd,mode=max" | tee -a "${GITHUB_ENV}"
          else
            echo "BAKE_CACHE_FROM="
            echo "BAKE_CACHE_TO="
@@ -186,13 +159,13 @@ jobs:
          #

      - name: Add localhost registry
+        if: ${{ matrix.base_image == 'alpine' }}
        shell: bash
        run: |
          echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}localhost:5000/vaultwarden/server" | tee -a "${GITHUB_ENV}"

      - name: Bake ${{ matrix.base_image }} containers
-        id: bake_vw
-        uses: docker/bake-action@37816e747588cb137173af99ab33873600c46ea8 # v6.8.0
+        uses: docker/bake-action@2e3d19baedb14545e5d41222653874f25d5b4dfb # v5.10.0
        env:
          BASE_TAGS: "${{ env.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -202,121 +175,78 @@ jobs:
        with:
          pull: true
          push: true
-          source: .
          files: docker/docker-bake.hcl
          targets: "${{ matrix.base_image }}-multi"
          set: |
            *.cache-from=${{ env.BAKE_CACHE_FROM }}
            *.cache-to=${{ env.BAKE_CACHE_TO }}

-      - name: Extract digest SHA
-        shell: bash
-        env:
-          BAKE_METADATA: ${{ steps.bake_vw.outputs.metadata }}
-          BASE_IMAGE: ${{ matrix.base_image }}
-        run: |
-          GET_DIGEST_SHA="$(jq -r --arg base "$BASE_IMAGE" '.[$base + "-multi"]."containerimage.digest"' <<< "${BAKE_METADATA}")"
-          echo "DIGEST_SHA=${GET_DIGEST_SHA}" | tee -a "${GITHUB_ENV}"
-
-      # Attest container images
-      - name: Attest - docker.io - ${{ matrix.base_image }}
-        if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
-        with:
-          subject-name: ${{ vars.DOCKERHUB_REPO }}
-          subject-digest: ${{ env.DIGEST_SHA }}
-          push-to-registry: true
-
-      - name: Attest - ghcr.io - ${{ matrix.base_image }}
-        if: ${{ env.HAVE_GHCR_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
-        with:
-          subject-name: ${{ vars.GHCR_REPO }}
-          subject-digest: ${{ env.DIGEST_SHA }}
-          push-to-registry: true
-
-      - name: Attest - quay.io - ${{ matrix.base_image }}
-        if: ${{ env.HAVE_QUAY_LOGIN == 'true' && steps.bake_vw.outputs.metadata != ''}}
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
-        with:
-          subject-name: ${{ vars.QUAY_REPO }}
-          subject-digest: ${{ env.DIGEST_SHA }}
-          push-to-registry: true
-

      # Extract the Alpine binaries from the containers
      - name: Extract binaries
+        if: ${{ matrix.base_image == 'alpine' }}
        shell: bash
-        env:
-          REF_TYPE: ${{ github.ref_type }}
-          BASE_IMAGE: ${{ matrix.base_image }}
        run: |
-          # Check which main tag we are going to build determined by ref_type
-          if [[ "${REF_TYPE}" == "tag" ]]; then
+          # Check which main tag we are going to build determined by github.ref_type
+          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            EXTRACT_TAG="latest"
-          elif [[ "${REF_TYPE}" == "branch" ]]; then
+          elif [[ "${{ github.ref_type }}" == "branch" ]]; then
            EXTRACT_TAG="testing"
          fi

-          # Check which base_image was used and append -alpine if needed
-          if [[ "${BASE_IMAGE}" == "alpine" ]]; then
-            EXTRACT_TAG="${EXTRACT_TAG}-alpine"
-          fi
-
          # After each extraction the image is removed.
          # This is needed because using different platforms doesn't trigger a new pull/download

          # Extract amd64 binary
-          docker create --name amd64 --platform=linux/amd64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
-          docker cp amd64:/vaultwarden vaultwarden-amd64-${BASE_IMAGE}
+          docker create --name amd64 --platform=linux/amd64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"
+          docker cp amd64:/vaultwarden vaultwarden-amd64
          docker rm --force amd64
-          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"

          # Extract arm64 binary
-          docker create --name arm64 --platform=linux/arm64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
-          docker cp arm64:/vaultwarden vaultwarden-arm64-${BASE_IMAGE}
+          docker create --name arm64 --platform=linux/arm64 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"
+          docker cp arm64:/vaultwarden vaultwarden-arm64
          docker rm --force arm64
-          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"

          # Extract armv7 binary
-          docker create --name armv7 --platform=linux/arm/v7 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
-          docker cp armv7:/vaultwarden vaultwarden-armv7-${BASE_IMAGE}
+          docker create --name armv7 --platform=linux/arm/v7 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"
+          docker cp armv7:/vaultwarden vaultwarden-armv7
          docker rm --force armv7
-          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"

          # Extract armv6 binary
-          docker create --name armv6 --platform=linux/arm/v6 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
-          docker cp armv6:/vaultwarden vaultwarden-armv6-${BASE_IMAGE}
+          docker create --name armv6 --platform=linux/arm/v6 "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"
+          docker cp armv6:/vaultwarden vaultwarden-armv6
          docker rm --force armv6
-          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}"
+          docker rmi --force "localhost:5000/vaultwarden/server:${EXTRACT_TAG}-alpine"

-      # Upload artifacts to Github Actions and Attest the binaries
-      - name: "Upload amd64 artifact ${{ matrix.base_image }}"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      # Upload artifacts to Github Actions
+      - name: "Upload amd64 artifact"
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ matrix.base_image == 'alpine' }}
        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-amd64-${{ matrix.base_image }}
-          path: vaultwarden-amd64-${{ matrix.base_image }}
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-amd64
+          path: vaultwarden-amd64

-      - name: "Upload arm64 artifact ${{ matrix.base_image }}"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - name: "Upload arm64 artifact"
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ matrix.base_image == 'alpine' }}
        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-arm64-${{ matrix.base_image }}
-          path: vaultwarden-arm64-${{ matrix.base_image }}
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-arm64
+          path: vaultwarden-arm64

-      - name: "Upload armv7 artifact ${{ matrix.base_image }}"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - name: "Upload armv7 artifact"
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ matrix.base_image == 'alpine' }}
        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv7-${{ matrix.base_image }}
-          path: vaultwarden-armv7-${{ matrix.base_image }}
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv7
+          path: vaultwarden-armv7

-      - name: "Upload armv6 artifact ${{ matrix.base_image }}"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - name: "Upload armv6 artifact"
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ matrix.base_image == 'alpine' }}
        with:
-          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv6-${{ matrix.base_image }}
-          path: vaultwarden-armv6-${{ matrix.base_image }}
-
-      - name: "Attest artifacts ${{ matrix.base_image }}"
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
-        with:
-          subject-path: vaultwarden-*
+          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv6
+          path: vaultwarden-armv6
      # End Upload artifacts to Github Actions
--- a/.github/workflows/releasecache-cleanup.yml
+++ b/.github/workflows/releasecache-cleanup.yml
@@ -1,6 +1,3 @@
-name: Cleanup
-permissions: {}
-
 on:
  workflow_dispatch:
    inputs:
@@ -12,11 +9,10 @@ on:
  schedule:
    - cron: '0 1 * * FRI'

+name: Cleanup
 jobs:
  releasecache-cleanup:
    name: Releasecache Cleanup
-    permissions:
-      packages: write
    runs-on: ubuntu-24.04
    continue-on-error: true
    timeout-minutes: 30
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -1,45 +1,37 @@
-name: Trivy
-permissions: {}
+name: trivy

 on:
  push:
    branches:
      - main
-
    tags:
      - '*'
-
  pull_request:
-    branches:
-      - main
-
+    branches: [ "main" ]
  schedule:
    - cron: '08 11 * * *'

+permissions:
+  contents: read
+
 jobs:
  trivy-scan:
-    # Only run this in the upstream repo and not on forks
+    # Only run this in the master repo and not on forks
    # When all forks run this at the same time, it is causing `Too Many Requests` issues
    if: ${{ github.repository == 'dani-garcia/vaultwarden' }}
-    name: Trivy Scan
-    permissions:
-      contents: read
-      actions: read
-      security-events: write
+    name: Check
    runs-on: ubuntu-24.04
    timeout-minutes: 30
-
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
    steps:
      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1

      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
-        env:
-          TRIVY_DB_REPOSITORY: docker.io/aquasec/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2
-          TRIVY_JAVA_DB_REPOSITORY: docker.io/aquasec/trivy-java-db:1,public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1
+        uses: aquasecurity/trivy-action@5681af892cd0f4997658e2bacc62bd0a894cf564 # v0.27.0
        with:
          scan-type: repo
          ignore-unfixed: true
@@ -48,6 +40,6 @@ jobs:
          severity: CRITICAL,HIGH

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
+        uses: github/codeql-action/upload-sarif@2bbafcdd7fbf96243689e764c2f15d9735164f33 # v3.26.6
        with:
          sarif_file: 'trivy-results.sarif'
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -1,28 +0,0 @@
-name: Security Analysis with zizmor
-
-on:
-  push:
-    branches: ["main"]
-  pull_request:
-    branches: ["**"]
-
-permissions: {}
-
-jobs:
-  zizmor:
-    name: Run zizmor
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1
-        with:
-          # intentionally not scanning the entire repository,
-          # since it contains integration tests.
-          inputs: ./.github/
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,7 @@
 ---
 repos:
 -   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v4.6.0
    hooks:
    - id: check-yaml
    - id: check-json
@@ -31,7 +31,7 @@ repos:
      language: system
      args: ["--features", "sqlite,mysql,postgresql,enable_mimalloc", "--"]
      types_or: [rust, file]
-      files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
+      files: (Cargo.toml|Cargo.lock|rust-toolchain|.*\.rs$)
      pass_filenames: false
    - id: cargo-clippy
      name: cargo clippy
@@ -40,13 +40,5 @@ repos:
      language: system
      args: ["--features", "sqlite,mysql,postgresql,enable_mimalloc", "--", "-D", "warnings"]
      types_or: [rust, file]
-      files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
+      files: (Cargo.toml|Cargo.lock|rust-toolchain|clippy.toml|.*\.rs$)
      pass_filenames: false
-    - id: check-docker-templates
-      name: check docker templates
-      description: Check if the Docker templates are updated
-      language: system
-      entry: sh
-      args:
-        - "-c"
-        - "cd docker && make"
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,12 +1,9 @@
-[workspace]
-members = ["macros"]
-
 [package]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.86.0"
+rust-version = "1.80.0"
 resolver = "2"

 repository = "https://github.com/dani-garcia/vaultwarden"
@@ -32,7 +29,6 @@ enable_mimalloc = ["dep:mimalloc"]
 # You also need to set an env variable `QUERY_LOGGER=1` to fully activate this so you do not have to re-compile
 # if you want to turn off the logging for a specific run.
 query_logger = ["dep:diesel_logger"]
-s3 = ["opendal/services-s3", "dep:aws-config", "dep:aws-credential-types", "dep:aws-smithy-runtime-api", "dep:anyhow", "dep:http", "dep:reqsign"]

 # Enable unstable features, requires nightly
 # Currently only used to enable rusts official ip support
@@ -40,26 +36,24 @@ unstable = []

 [target."cfg(unix)".dependencies]
 # Logging
-syslog = "7.0.0"
+syslog = "6.1.1"

 [dependencies]
-macros = { path = "./macros" }
-
 # Logging
-log = "0.4.27"
-fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
-tracing = { version = "0.1.41", features = ["log"] } # Needed to have lettre and webauthn-rs trace logging to work
+log = "0.4.22"
+fern = { version = "0.7.0", features = ["syslog-6", "reopen-1"] }
+tracing = { version = "0.1.40", features = ["log"] } # Needed to have lettre and webauthn-rs trace logging to work

 # A `dotenv` implementation for Rust
 dotenvy = { version = "0.15.7", default-features = false }

 # Lazy initialization
-once_cell = "1.21.3"
+once_cell = "1.20.2"

 # Numerical libraries
 num-traits = "0.2.19"
 num-derive = "0.4.2"
-bigdecimal = "0.4.8"
+bigdecimal = "0.4.5"

 # Web framework
 rocket = { version = "0.5.1", features = ["tls", "json"], default-features = false }
@@ -73,125 +67,104 @@ dashmap = "6.1.0"

 # Async futures
 futures = "0.3.31"
-tokio = { version = "1.47.0", features = ["rt-multi-thread", "fs", "io-util", "parking_lot", "time", "signal", "net"] }
-tokio-util = { version = "0.7.15", features = ["compat"]}
+tokio = { version = "1.41.0", features = ["rt-multi-thread", "fs", "io-util", "parking_lot", "time", "signal", "net"] }

 # A generic serialization/deserialization framework
-serde = { version = "1.0.219", features = ["derive"] }
-serde_json = "1.0.141"
+serde = { version = "1.0.213", features = ["derive"] }
+serde_json = "1.0.132"

 # A safe, extensible ORM and Query builder
-diesel = { version = "2.2.12", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.2.4", features = ["chrono", "r2d2", "numeric"] }
 diesel_migrations = "2.2.0"
-diesel_logger = { version = "0.4.0", optional = true }
-
-derive_more = { version = "2.0.1", features = ["from", "into", "as_ref", "deref", "display"] }
-diesel-derive-newtype = "2.1.2"
+diesel_logger = { version = "0.3.0", optional = true }

 # Bundled/Static SQLite
-libsqlite3-sys = { version = "0.35.0", features = ["bundled"], optional = true }
+libsqlite3-sys = { version = "0.30.1", features = ["bundled"], optional = true }

 # Crypto-related libraries
-rand = "0.9.2"
-ring = "0.17.14"
-subtle = "2.6.1"
+rand = { version = "0.8.5", features = ["small_rng"] }
+ring = "0.17.8"

 # UUID generation
-uuid = { version = "1.17.0", features = ["v4"] }
+uuid = { version = "1.11.0", features = ["v4"] }

 # Date and time libraries
-chrono = { version = "0.4.41", features = ["clock", "serde"], default-features = false }
-chrono-tz = "0.10.4"
-time = "0.3.41"
+chrono = { version = "0.4.38", features = ["clock", "serde"], default-features = false }
+chrono-tz = "0.10.0"
+time = "0.3.36"

 # Job scheduler
-job_scheduler_ng = "2.2.0"
+job_scheduler_ng = "2.0.5"

 # Data encoding library Hex/Base32/Base64
-data-encoding = "2.9.0"
+data-encoding = "2.6.0"

 # JWT library
-jsonwebtoken = "9.3.1"
+jsonwebtoken = "9.3.0"

 # TOTP library
 totp-lite = "2.0.1"

 # Yubico Library
-yubico = { package = "yubico_ng", version = "0.13.0", features = ["online-tokio"], default-features = false }
+yubico = { version = "0.11.0", features = ["online-tokio"], default-features = false }

 # WebAuthn libraries
 webauthn-rs = "0.3.2"

 # Handling of URL's for WebAuthn and favicons
-url = "2.5.4"
+url = "2.5.2"

 # Email libraries
-lettre = { version = "0.11.18", features = ["smtp-transport", "sendmail-transport", "builder", "serde", "hostname", "tracing", "tokio1-rustls", "ring", "rustls-native-certs"], default-features = false }
+lettre = { version = "0.11.10", features = ["smtp-transport", "sendmail-transport", "builder", "serde", "tokio1-native-tls", "hostname", "tracing", "tokio1"], default-features = false }
 percent-encoding = "2.3.1" # URL encoding library used for URL's in the emails
 email_address = "0.2.9"

 # HTML Template library
-handlebars = { version = "6.3.2", features = ["dir_source"] }
+handlebars = { version = "6.1.0", features = ["dir_source"] }

 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.12.22", features = ["rustls-tls", "rustls-tls-native-roots", "stream", "json", "deflate", "gzip", "brotli", "zstd", "socks", "cookies", "charset", "http2", "system-proxy"], default-features = false}
-hickory-resolver = "0.25.2"
+reqwest = { version = "0.12.8", features = ["native-tls-alpn", "stream", "json", "gzip", "brotli", "socks", "cookies"] }
+hickory-resolver = "0.24.1"

 # Favicon extraction libraries
-html5gum = "0.7.0"
-regex = { version = "1.11.1", features = ["std", "perf", "unicode-perl"], default-features = false }
+html5gum = "0.5.7"
+regex = { version = "1.11.0", features = ["std", "perf", "unicode-perl"], default-features = false }
 data-url = "0.3.1"
-bytes = "1.10.1"
-svg-hush = "0.9.5"
+bytes = "1.8.0"

 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "0.56.0", features = ["async"] }
+cached = { version = "0.53.1", features = ["async"] }

 # Used for custom short lived cookie jar during favicon extraction
 cookie = "0.18.1"
-cookie_store = "0.21.1"
+cookie_store = "0.21.0"

 # Used by U2F, JWT and PostgreSQL
-openssl = "0.10.73"
+openssl = "0.10.68"

 # CLI argument parsing
 pico-args = "0.5.0"

 # Macro ident concatenation
-pastey = "0.1.0"
-governor = "0.10.0"
+paste = "1.0.15"
+governor = "0.7.0"

 # Check client versions for specific features.
-semver = "1.0.26"
+semver = "1.0.23"

 # Allow overriding the default memory allocator
 # Mainly used for the musl builds, since the default musl malloc is very slow
-mimalloc = { version = "0.1.47", features = ["secure"], default-features = false, optional = true }
-
-which = "8.0.0"
+mimalloc = { version = "0.1.43", features = ["secure"], default-features = false, optional = true }
+which = "6.0.3"

 # Argon2 library with support for the PHC format
 argon2 = "0.5.3"

 # Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
-rpassword = "7.4.0"
-
-# Loading a dynamic CSS Stylesheet
-grass_compiler = { version = "0.13.4", default-features = false }
-
-# File are accessed through Apache OpenDAL
-opendal = { version = "0.54.0", features = ["services-fs"], default-features = false }
-
-# For retrieving AWS credentials, including temporary SSO credentials
-anyhow = { version = "1.0.98", optional = true }
-aws-config = { version = "1.8.3", features = ["behavior-version-latest", "rt-tokio", "credentials-process", "sso"], default-features = false, optional = true }
-aws-credential-types = { version = "1.2.4", optional = true }
-aws-smithy-runtime-api = { version = "1.8.5", optional = true }
-http = { version = "1.3.1", optional = true }
-reqsign = { version = "0.16.5", optional = true }
+rpassword = "7.3.1"

 # Strip debuginfo from the release builds
-# The debug symbols are to provide better panic traces
+# The symbols are the provide better panic traces
 # Also enable fat LTO and use 1 codegen unit for optimizations
 [profile.release]
 strip = "debuginfo"
@@ -226,7 +199,7 @@ codegen-units = 16

 # Linting config
 # https://doc.rust-lang.org/rustc/lints/groups.html
-[workspace.lints.rust]
+[lints.rust]
 # Forbid
 unsafe_code = "forbid"
 non_ascii_idents = "forbid"
@@ -240,8 +213,7 @@ noop_method_call = "deny"
 refining_impl_trait = { level = "deny", priority = -1 }
 rust_2018_idioms = { level = "deny", priority = -1 }
 rust_2021_compatibility = { level = "deny", priority = -1 }
-rust_2024_compatibility = { level = "deny", priority = -1 }
-edition_2024_expr_fragment_specifier = "allow" # Once changed to Rust 2024 this should be removed and macro's should be validated again
+# rust_2024_compatibility = { level = "deny", priority = -1 } # Enable once we are at MSRV 1.81.0
 single_use_lifetimes = "deny"
 trivial_casts = "deny"
 trivial_numeric_casts = "deny"
@@ -250,20 +222,16 @@ unused_import_braces = "deny"
 unused_lifetimes = "deny"
 unused_qualifications = "deny"
 variant_size_differences = "deny"
-# Allow the following lints since these cause issues with Rust v1.84.0 or newer
-# Building Vaultwarden with Rust v1.85.0 and edition 2024 also works without issues
-if_let_rescope = "allow"
-tail_expr_drop_order = "allow"
+# The lints below are part of the rust_2024_compatibility group
+static-mut-refs = "deny"
+unsafe-op-in-unsafe-fn = "deny"

 # https://rust-lang.github.io/rust-clippy/stable/index.html
-[workspace.lints.clippy]
+[lints.clippy]
 # Warn
 dbg_macro = "warn"
 todo = "warn"

-# Ignore/Allow
-result_large_err = "allow"
-
 # Deny
 case_sensitive_file_extension_comparisons = "deny"
 cast_lossless = "deny"
@@ -279,6 +247,7 @@ macro_use_imports = "deny"
 manual_assert = "deny"
 manual_instant_elapsed = "deny"
 manual_string_new = "deny"
+match_on_vec_items = "deny"
 match_wildcard_for_single_variants = "deny"
 mem_forget = "deny"
 needless_continue = "deny"
@@ -293,6 +262,3 @@ unused_async = "deny"
 unused_self = "deny"
 verbose_file_reads = "deny"
 zero_sized_map_values = "deny"
-
-[lints]
-workspace = true
--- a/README.md
+++ b/README.md
@@ -59,21 +59,19 @@ A nearly complete implementation of the Bitwarden Client API is provided, includ
 ## Usage

 > [!IMPORTANT]
-> The web-vault requires the use a secure context for the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API).
-> That means it will only work via `http://localhost:8000` (using the port from the example below) or if you [enable HTTPS](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS).
-
-The recommended way to install and use Vaultwarden is via our container images which are published to [ghcr.io](https://github.com/dani-garcia/vaultwarden/pkgs/container/vaultwarden), [docker.io](https://hub.docker.com/r/vaultwarden/server) and [quay.io](https://quay.io/repository/vaultwarden/server).
-See [which container image to use](https://github.com/dani-garcia/vaultwarden/wiki/Which-container-image-to-use) for an explanation of the provided tags.
-
-There are also [community driven packages](https://github.com/dani-garcia/vaultwarden/wiki/Third-party-packages) which can be used, but those might be lagging behind the latest version or might deviate in the way Vaultwarden is configured, as described in our [Wiki](https://github.com/dani-garcia/vaultwarden/wiki).
-
-Alternatively, you can also [build Vaultwarden](https://github.com/dani-garcia/vaultwarden/wiki/Building-binary) yourself.
-
-While Vaultwarden is based upon the [Rocket web framework](https://rocket.rs) which has built-in support for TLS our recommendation would be that you setup a reverse proxy (see [proxy examples](https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples)).
+> Most modern web browsers disallow the use of Web Crypto APIs in insecure contexts. In this case, you might get an error like `Cannot read property 'importKey'`. To solve this problem, you need to access the web vault via HTTPS or localhost.
+>
+>This can be configured in [Vaultwarden directly](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS) or using a third-party reverse proxy ([some examples](https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples)).
+>
+>If you have an available domain name, you can get HTTPS certificates with [Let's Encrypt](https://letsencrypt.org/), or you can generate self-signed certificates with utilities like [mkcert](https://github.com/FiloSottile/mkcert). Some proxies automatically do this step, like Caddy or Traefik (see examples linked above).

 > [!TIP]
 >**For more detailed examples on how to install, use and configure Vaultwarden you can check our [Wiki](https://github.com/dani-garcia/vaultwarden/wiki).**

+The main way to use Vaultwarden is via our container images which are published to [ghcr.io](https://github.com/dani-garcia/vaultwarden/pkgs/container/vaultwarden), [docker.io](https://hub.docker.com/r/vaultwarden/server) and [quay.io](https://quay.io/repository/vaultwarden/server).
+
+There are also [community driven packages](https://github.com/dani-garcia/vaultwarden/wiki/Third-party-packages) which can be used, but those might be lagging behind the latest version or might deviate in the way Vaultwarden is configured, as described in our [Wiki](https://github.com/dani-garcia/vaultwarden/wiki).
+
 ### Docker/Podman CLI

 Pull the container image and mount a volume from the host for persistent storage.<br>
@@ -85,7 +83,7 @@ docker run --detach --name vaultwarden \
  --env DOMAIN="https://vw.domain.tld" \
  --volume /vw-data/:/data/ \
  --restart unless-stopped \
-  --publish 127.0.0.1:8000:80 \
+  --publish 80:80 \
  vaultwarden/server:latest
 ```

@@ -106,7 +104,7 @@ services:
    volumes:
      - ./vw-data/:/data/
    ports:
-      - 127.0.0.1:8000:80
+      - 80:80
 ```

 <br>
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -21,7 +21,7 @@ notify us. We welcome working with you to resolve the issue promptly. Thanks in
 The following bug classes are out-of scope:

 - Bugs that are already reported on Vaultwarden's issue tracker (https://github.com/dani-garcia/vaultwarden/issues)
- Bugs that are not part of Vaultwarden, like on the web-vault or mobile and desktop clients. These issues need to be reported in the respective project issue tracker at https://github.com/bitwarden to which we are not associated
+- Bugs that are not part of Vaultwarden, like on the the web-vault or mobile and desktop clients. These issues need to be reported in the respective project issue tracker at https://github.com/bitwarden to which we are not associated
 - Issues in an upstream software dependency (ex: Rust, or External Libraries) which are already reported to the upstream maintainer
 - Attacks requiring physical access to a user's device
 - Issues related to software or protocols not under Vaultwarden's control
--- a/build.rs
+++ b/build.rs
@@ -11,8 +11,6 @@ fn main() {
    println!("cargo:rustc-cfg=postgresql");
    #[cfg(feature = "query_logger")]
    println!("cargo:rustc-cfg=query_logger");
-    #[cfg(feature = "s3")]
-    println!("cargo:rustc-cfg=s3");

    #[cfg(not(any(feature = "sqlite", feature = "mysql", feature = "postgresql")))]
    compile_error!(
@@ -25,7 +23,6 @@ fn main() {
    println!("cargo::rustc-check-cfg=cfg(mysql)");
    println!("cargo::rustc-check-cfg=cfg(postgresql)");
    println!("cargo::rustc-check-cfg=cfg(query_logger)");
-    println!("cargo::rustc-check-cfg=cfg(s3)");

    // Rerun when these paths are changed.
    // Someone could have checked-out a tag or specific commit, but no other files changed.
@@ -51,8 +48,8 @@ fn main() {
 fn run(args: &[&str]) -> Result<String, std::io::Error> {
    let out = Command::new(args[0]).args(&args[1..]).output()?;
    if !out.status.success() {
-        use std::io::Error;
-        return Err(Error::other("Command not successful"));
+        use std::io::{Error, ErrorKind};
+        return Err(Error::new(ErrorKind::Other, "Command not successful"));
    }
    Ok(String::from_utf8(out.stdout).unwrap().trim().to_string())
 }
--- a/docker/DockerSettings.yaml
+++ b/docker/DockerSettings.yaml
@@ -1,13 +1,13 @@
 ---
-vault_version: "v2025.7.0"
-vault_image_digest: "sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e"
-# Cross Compile Docker Helper Scripts v1.6.1
+vault_version: "v2024.6.2c"
+vault_image_digest: "sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b"
+# Cross Compile Docker Helper Scripts v1.5.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
-xx_image_digest: "sha256:9c207bead753dda9430bdd15425c6518fc7a03d866103c516a2c6889188f5894"
-rust_version: 1.88.0 # Rust version to be used
+xx_image_digest: "sha256:1978e7a58a1777cb0ef0dde76bad60b7914b21da57cfa88047875e4f364297aa"
+rust_version: 1.82.0 # Rust version to be used
 debian_version: bookworm # Debian release name to be used
-alpine_version: "3.22" # Alpine version to be used
+alpine_version: "3.20" # Alpine version to be used
 # For which platforms/architectures will we try to build images
 platforms: ["linux/amd64", "linux/arm64", "linux/arm/v7", "linux/arm/v6"]
 # Determine the build images per OS/Arch
--- a/docker/Dockerfile.alpine
+++ b/docker/Dockerfile.alpine
@@ -19,23 +19,23 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2025.7.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2025.7.0
-#     [docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2024.6.2c
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2024.6.2c
+#     [docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e
-#     [docker.io/vaultwarden/web-vault:v2025.7.0]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b
+#     [docker.io/vaultwarden/web-vault:v2024.6.2c]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b AS vault

 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.88.0 AS build_amd64
-FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.88.0 AS build_arm64
-FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.88.0 AS build_armv7
-FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.88.0 AS build_armv6
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.82.0 AS build_amd64
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.82.0 AS build_arm64
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.82.0 AS build_armv7
+FROM --platform=linux/amd64 ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.82.0 AS build_armv6

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -76,7 +76,6 @@ RUN source /env-cargo && \

 # Copies over *only* your manifests and build files
 COPY ./Cargo.* ./rust-toolchain.toml ./build.rs ./
-COPY ./macros ./macros

 ARG CARGO_PROFILE=release

@@ -127,7 +126,7 @@ RUN source /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
-FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.22
+FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.20

 ENV ROCKET_PROFILE="release" \
    ROCKET_ADDRESS=0.0.0.0 \
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@@ -19,24 +19,24 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2025.7.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2025.7.0
-#     [docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2024.6.2c
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2024.6.2c
+#     [docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e
-#     [docker.io/vaultwarden/web-vault:v2025.7.0]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b
+#     [docker.io/vaultwarden/web-vault:v2024.6.2c]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:f6ac819a2cd9e226f2cd2ec26196ede94a41e672e9672a11b5f307a19278b15e AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:409ab328ca931439cb916b388a4bb784bd44220717aaf74cf71620c23e34fc2b AS vault

 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
 ## And these bash scripts do not have any significant difference if at all
-FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:9c207bead753dda9430bdd15425c6518fc7a03d866103c516a2c6889188f5894 AS xx
+FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:1978e7a58a1777cb0ef0dde76bad60b7914b21da57cfa88047875e4f364297aa AS xx

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.88.0-slim-bookworm AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.82.0-slim-bookworm AS build
 COPY --from=xx / /
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -89,24 +89,24 @@ RUN USER=root cargo new --bin /app
 WORKDIR /app

 # Environment variables for Cargo on Debian based builds
-ARG TARGET_PKG_CONFIG_PATH
+ARG ARCH_OPENSSL_LIB_DIR \
+    ARCH_OPENSSL_INCLUDE_DIR

 RUN source /env-cargo && \
    if xx-info is-cross ; then \
+        # Some special variables if needed to override some build paths
+        if [[ -n "${ARCH_OPENSSL_LIB_DIR}" && -n "${ARCH_OPENSSL_INCLUDE_DIR}" ]]; then \
+            echo "export $(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_OPENSSL_LIB_DIR=${ARCH_OPENSSL_LIB_DIR}" >> /env-cargo && \
+            echo "export $(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_OPENSSL_INCLUDE_DIR=${ARCH_OPENSSL_INCLUDE_DIR}" >> /env-cargo ; \
+        fi && \
        # We can't use xx-cargo since that uses clang, which doesn't work for our libraries.
        # Because of this we generate the needed environment variables here which we can load in the needed steps.
        echo "export CC_$(echo "${CARGO_TARGET}" | tr '[:upper:]' '[:lower:]' | tr - _)=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
        echo "export CARGO_TARGET_$(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_LINKER=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
+        echo "export PKG_CONFIG=/usr/bin/$(xx-info)-pkg-config" >> /env-cargo && \
        echo "export CROSS_COMPILE=1" >> /env-cargo && \
-        echo "export PKG_CONFIG_ALLOW_CROSS=1" >> /env-cargo && \
-        # For some architectures `xx-info` returns a triple which doesn't matches the path on disk
-        # In those cases you can override this by setting the `TARGET_PKG_CONFIG_PATH` build-arg
-        if [[ -n "${TARGET_PKG_CONFIG_PATH}" ]]; then \
-            echo "export TARGET_PKG_CONFIG_PATH=${TARGET_PKG_CONFIG_PATH}" >> /env-cargo ; \
-        else \
-            echo "export PKG_CONFIG_PATH=/usr/lib/$(xx-info)/pkgconfig" >> /env-cargo ; \
-        fi && \
-        echo "# End of env-cargo" >> /env-cargo ; \
+        echo "export OPENSSL_INCLUDE_DIR=/usr/include/$(xx-info)" >> /env-cargo && \
+        echo "export OPENSSL_LIB_DIR=/usr/lib/$(xx-info)" >> /env-cargo ; \
    fi && \
    # Output the current contents of the file
    cat /env-cargo
@@ -116,7 +116,6 @@ RUN source /env-cargo && \

 # Copies over *only* your manifests and build files
 COPY ./Cargo.* ./rust-toolchain.toml ./build.rs ./
-COPY ./macros ./macros

 ARG CARGO_PROFILE=release

--- a/docker/Dockerfile.j2
+++ b/docker/Dockerfile.j2
@@ -109,24 +109,24 @@ WORKDIR /app

 {% if base == "debian" %}
 # Environment variables for Cargo on Debian based builds
-ARG TARGET_PKG_CONFIG_PATH
+ARG ARCH_OPENSSL_LIB_DIR \
+    ARCH_OPENSSL_INCLUDE_DIR

 RUN source /env-cargo && \
    if xx-info is-cross ; then \
+        # Some special variables if needed to override some build paths
+        if [[ -n "${ARCH_OPENSSL_LIB_DIR}" && -n "${ARCH_OPENSSL_INCLUDE_DIR}" ]]; then \
+            echo "export $(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_OPENSSL_LIB_DIR=${ARCH_OPENSSL_LIB_DIR}" >> /env-cargo && \
+            echo "export $(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_OPENSSL_INCLUDE_DIR=${ARCH_OPENSSL_INCLUDE_DIR}" >> /env-cargo ; \
+        fi && \
        # We can't use xx-cargo since that uses clang, which doesn't work for our libraries.
        # Because of this we generate the needed environment variables here which we can load in the needed steps.
        echo "export CC_$(echo "${CARGO_TARGET}" | tr '[:upper:]' '[:lower:]' | tr - _)=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
        echo "export CARGO_TARGET_$(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_LINKER=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
+        echo "export PKG_CONFIG=/usr/bin/$(xx-info)-pkg-config" >> /env-cargo && \
        echo "export CROSS_COMPILE=1" >> /env-cargo && \
-        echo "export PKG_CONFIG_ALLOW_CROSS=1" >> /env-cargo && \
-        # For some architectures `xx-info` returns a triple which doesn't matches the path on disk
-        # In those cases you can override this by setting the `TARGET_PKG_CONFIG_PATH` build-arg
-        if [[ -n "${TARGET_PKG_CONFIG_PATH}" ]]; then \
-            echo "export TARGET_PKG_CONFIG_PATH=${TARGET_PKG_CONFIG_PATH}" >> /env-cargo ; \
-        else \
-            echo "export PKG_CONFIG_PATH=/usr/lib/$(xx-info)/pkgconfig" >> /env-cargo ; \
-        fi && \
-        echo "# End of env-cargo" >> /env-cargo ; \
+        echo "export OPENSSL_INCLUDE_DIR=/usr/include/$(xx-info)" >> /env-cargo && \
+        echo "export OPENSSL_LIB_DIR=/usr/lib/$(xx-info)" >> /env-cargo ; \
    fi && \
    # Output the current contents of the file
    cat /env-cargo
@@ -143,7 +143,6 @@ RUN source /env-cargo && \

 # Copies over *only* your manifests and build files
 COPY ./Cargo.* ./rust-toolchain.toml ./build.rs ./
-COPY ./macros ./macros

 ARG CARGO_PROFILE=release

--- a/docker/README.md
+++ b/docker/README.md
@@ -46,7 +46,7 @@ There also is an option to use an other docker container to provide support for
 ```bash
 # To install and activate
 docker run --privileged --rm tonistiigi/binfmt --install arm64,arm
-# To uninstall
+# To unistall
 docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 ```

--- a/docker/docker-bake.hcl
+++ b/docker/docker-bake.hcl
@@ -17,7 +17,7 @@ variable "SOURCE_REPOSITORY_URL" {
  default = null
 }

-// The commit hash of the current commit this build was triggered on
+// The commit hash of of the current commit this build was triggered on
 variable "SOURCE_COMMIT" {
  default = null
 }
@@ -133,7 +133,8 @@ target "debian-386" {
  platforms = ["linux/386"]
  tags = generate_tags("", "-386")
  args = {
-    TARGET_PKG_CONFIG_PATH = "/usr/lib/i386-linux-gnu/pkgconfig"
+    ARCH_OPENSSL_LIB_DIR = "/usr/lib/i386-linux-gnu"
+    ARCH_OPENSSL_INCLUDE_DIR = "/usr/include/i386-linux-gnu"
  }
 }

@@ -141,12 +142,20 @@ target "debian-ppc64le" {
  inherits = ["debian"]
  platforms = ["linux/ppc64le"]
  tags = generate_tags("", "-ppc64le")
+  args = {
+    ARCH_OPENSSL_LIB_DIR = "/usr/lib/powerpc64le-linux-gnu"
+    ARCH_OPENSSL_INCLUDE_DIR = "/usr/include/powerpc64le-linux-gnu"
+  }
 }

 target "debian-s390x" {
  inherits = ["debian"]
  platforms = ["linux/s390x"]
  tags = generate_tags("", "-s390x")
+  args = {
+    ARCH_OPENSSL_LIB_DIR = "/usr/lib/s390x-linux-gnu"
+    ARCH_OPENSSL_INCLUDE_DIR = "/usr/include/s390x-linux-gnu"
+  }
 }
 // ==== End of unsupported Debian architecture targets ===

--- a/dylint.toml
+++ b/dylint.toml
@@ -0,0 +1,2 @@
+[workspace.metadata.dylint]
+libraries = [{ path = "dylints/*" }]
--- a/dylints/README.md
+++ b/dylints/README.md
@@ -0,0 +1,7 @@
+# How to run Lints
+
+```sh
+cargo install cargo-dylint dylint-link
+
+RUSTFLAGS="-Aunreachable_patterns" cargo dylint --all -- --features sqlite
+```
--- a/dylints/non_authenticated_routes/.cargo/config.toml
+++ b/dylints/non_authenticated_routes/.cargo/config.toml
@@ -0,0 +1,2 @@
+[target.'cfg(all())']
+linker = "dylint-link"
--- a/dylints/non_authenticated_routes/.gitignore
+++ b/dylints/non_authenticated_routes/.gitignore
@@ -0,0 +1 @@
+/target
--- a/dylints/non_authenticated_routes/Cargo.lock
+++ b/dylints/non_authenticated_routes/Cargo.lock
--- a/dylints/non_authenticated_routes/Cargo.toml
+++ b/dylints/non_authenticated_routes/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "non_authenticated_routes"
+version = "0.1.0"
+authors = ["authors go here"]
+description = "description goes here"
+edition = "2021"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+clippy_utils = { git = "https://github.com/rust-lang/rust-clippy", rev = "4f0e46b74dbc8441daf084b6f141a7fe414672a2" }
+dylint_linting = "3.2.1"
+
+[dev-dependencies]
+dylint_testing = "3.2.1"
+
+[package.metadata.rust-analyzer]
+rustc_private = true
--- a/dylints/non_authenticated_routes/rust-toolchain
+++ b/dylints/non_authenticated_routes/rust-toolchain
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "nightly-2024-11-09"
+components = ["llvm-tools-preview", "rustc-dev"]
--- a/dylints/non_authenticated_routes/src/lib.rs
+++ b/dylints/non_authenticated_routes/src/lib.rs
@@ -0,0 +1,167 @@
+#![feature(rustc_private)]
+#![feature(let_chains)]
+
+extern crate rustc_arena;
+extern crate rustc_ast;
+extern crate rustc_ast_pretty;
+extern crate rustc_attr;
+extern crate rustc_data_structures;
+extern crate rustc_errors;
+extern crate rustc_hir;
+extern crate rustc_hir_pretty;
+extern crate rustc_index;
+extern crate rustc_infer;
+extern crate rustc_lexer;
+extern crate rustc_middle;
+extern crate rustc_mir_dataflow;
+extern crate rustc_parse;
+extern crate rustc_span;
+extern crate rustc_target;
+extern crate rustc_trait_selection;
+
+use clippy_utils::diagnostics::span_lint;
+use rustc_hir::{def_id::DefId, Item, ItemKind, QPath, TyKind};
+use rustc_lint::{LateContext, LateLintPass};
+use rustc_span::{symbol::Ident, Span, Symbol};
+
+dylint_linting::impl_late_lint! {
+    /// ### What it does
+    ///
+    /// ### Why is this bad?
+    ///
+    /// ### Known problems
+    /// Remove if none.
+    ///
+    /// ### Example
+    /// ```rust
+    /// // example code where a warning is issued
+    /// ```
+    /// Use instead:
+    /// ```rust
+    /// // example code that does not raise a warning
+    /// ```
+    pub NON_AUTHENTICATED_ROUTES,
+    Warn,
+    "description goes here",
+    NonAuthenticatedRoutes::default()
+}
+
+#[derive(Default)]
+pub struct NonAuthenticatedRoutes {
+    last_function_item: Option<(Ident, Span, bool)>,
+}
+
+// Collect all the attribute macros that are applied to the given span
+fn attr_def_ids(mut span: rustc_span::Span) -> Vec<(DefId, Symbol, Option<DefId>)> {
+    use rustc_span::hygiene::{walk_chain, ExpnKind, MacroKind};
+    use rustc_span::{ExpnData, SyntaxContext};
+
+    let mut def_ids = Vec::new();
+    while span.ctxt() != SyntaxContext::root() {
+        if let ExpnData {
+            kind: ExpnKind::Macro(MacroKind::Attr, macro_symbol),
+            macro_def_id: Some(def_id),
+            parent_module,
+            ..
+        } = span.ctxt().outer_expn_data()
+        {
+            def_ids.push((def_id, macro_symbol, parent_module));
+        }
+        span = walk_chain(span, SyntaxContext::root());
+    }
+    def_ids
+}
+
+const ROCKET_MACRO_EXCEPTIONS: [(&str, &str); 1] = [("rocket::catch", "catch")];
+
+const VALID_AUTH_HEADERS: [&str; 6] = [
+    "auth::Headers",
+    "auth::OrgHeaders",
+    "auth::AdminHeaders",
+    "auth::ManagerHeaders",
+    "auth::ManagerHeadersLoose",
+    "auth::OwnerHeaders",
+];
+
+impl<'tcx> LateLintPass<'tcx> for NonAuthenticatedRoutes {
+    fn check_item(&mut self, cx: &LateContext<'tcx>, item: &'tcx Item) {
+        if let ItemKind::Fn(sig, ..) = item.kind {
+            let mut has_auth_headers = false;
+
+            for input in sig.decl.inputs {
+                let TyKind::Path(QPath::Resolved(_, path)) = input.kind else {
+                    continue;
+                };
+
+                for seg in path.segments {
+                    if let Some(def_id) = seg.res.opt_def_id() {
+                        let def = cx.tcx.def_path_str(def_id);
+                        if VALID_AUTH_HEADERS.contains(&def.as_str()) {
+                            has_auth_headers = true;
+                        }
+                    }
+                }
+            }
+
+            self.last_function_item = Some((item.ident, sig.span, has_auth_headers));
+            return;
+        }
+
+        let ItemKind::Struct(_data, _generics) = item.kind else {
+            return;
+        };
+
+        let def_ids = attr_def_ids(item.span);
+
+        let mut is_rocket_route = false;
+
+        for (def_id, sym, parent) in &def_ids {
+            let def_id = cx.tcx.def_path_str(*def_id);
+            let sym = sym.as_str();
+            let parent = parent.map(|parent| cx.tcx.def_path_str(parent));
+
+            if ROCKET_MACRO_EXCEPTIONS.contains(&(&def_id, sym)) {
+                is_rocket_route = false;
+                break;
+            }
+
+            if def_id.starts_with("rocket::") || parent.as_deref() == Some("rocket_codegen") {
+                is_rocket_route = true;
+                break;
+            }
+        }
+
+        if !is_rocket_route {
+            return;
+        }
+
+        let Some((func_ident, func_span, has_auth_headers)) = self.last_function_item.take() else {
+            span_lint(cx, NON_AUTHENTICATED_ROUTES, item.span, "No function found before the expanded route");
+            return;
+        };
+
+        if func_ident != item.ident {
+            span_lint(
+                cx,
+                NON_AUTHENTICATED_ROUTES,
+                item.span,
+                "The function before the expanded route does not match the route",
+            );
+            return;
+        }
+
+        if !has_auth_headers {
+            span_lint(
+                cx,
+                NON_AUTHENTICATED_ROUTES,
+                func_span,
+                "This Rocket route does not have any authentication headers",
+            );
+        }
+    }
+}
+
+#[test]
+fn ui() {
+    dylint_testing::ui_test(env!("CARGO_PKG_NAME"), "ui");
+}
--- a/dylints/non_authenticated_routes/ui/main.rs
+++ b/dylints/non_authenticated_routes/ui/main.rs
@@ -0,0 +1 @@
+fn main() {}
--- a/migrations/mysql/2025-01-09-172300_add_manage/down.sql
+++ b/migrations/mysql/2025-01-09-172300_add_manage/down.sql
--- a/macros/Cargo.toml
+++ b/macros/Cargo.toml
@@ -1,16 +0,0 @@
-[package]
-name = "macros"
-version = "0.1.0"
-edition = "2021"
-
-[lib]
-name = "macros"
-path = "src/lib.rs"
-proc-macro = true
-
-[dependencies]
-quote = "1.0.40"
-syn = "2.0.104"
-
-[lints]
-workspace = true
--- a/macros/src/lib.rs
+++ b/macros/src/lib.rs
@@ -1,56 +0,0 @@
-use proc_macro::TokenStream;
-use quote::quote;
-
-#[proc_macro_derive(UuidFromParam)]
-pub fn derive_uuid_from_param(input: TokenStream) -> TokenStream {
-    let ast = syn::parse(input).unwrap();
-
-    impl_derive_uuid_macro(&ast)
-}
-
-fn impl_derive_uuid_macro(ast: &syn::DeriveInput) -> TokenStream {
-    let name = &ast.ident;
-    let gen_derive = quote! {
-        #[automatically_derived]
-        impl<'r> rocket::request::FromParam<'r> for #name {
-            type Error = ();
-
-            #[inline(always)]
-            fn from_param(param: &'r str) -> Result<Self, Self::Error> {
-                if uuid::Uuid::parse_str(param).is_ok() {
-                    Ok(Self(param.to_string()))
-                } else {
-                    Err(())
-                }
-            }
-        }
-    };
-    gen_derive.into()
-}
-
-#[proc_macro_derive(IdFromParam)]
-pub fn derive_id_from_param(input: TokenStream) -> TokenStream {
-    let ast = syn::parse(input).unwrap();
-
-    impl_derive_safestring_macro(&ast)
-}
-
-fn impl_derive_safestring_macro(ast: &syn::DeriveInput) -> TokenStream {
-    let name = &ast.ident;
-    let gen_derive = quote! {
-        #[automatically_derived]
-        impl<'r> rocket::request::FromParam<'r> for #name {
-            type Error = ();
-
-            #[inline(always)]
-            fn from_param(param: &'r str) -> Result<Self, Self::Error> {
-                if param.chars().all(|c| matches!(c, 'a'..='z' | 'A'..='Z' |'0'..='9' | '-')) {
-                    Ok(Self(param.to_string()))
-                } else {
-                    Err(())
-                }
-            }
-        }
-    };
-    gen_derive.into()
-}
--- a/migrations/mysql/2025-01-09-172300_add_manage/up.sql
+++ b/migrations/mysql/2025-01-09-172300_add_manage/up.sql
@@ -1,5 +0,0 @@
-ALTER TABLE users_collections
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT FALSE;
-
-ALTER TABLE collections_groups
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT FALSE;
--- a/migrations/postgresql/2025-01-09-172300_add_manage/down.sql
+++ b/migrations/postgresql/2025-01-09-172300_add_manage/down.sql
--- a/migrations/postgresql/2025-01-09-172300_add_manage/up.sql
+++ b/migrations/postgresql/2025-01-09-172300_add_manage/up.sql
@@ -1,5 +0,0 @@
-ALTER TABLE users_collections
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT FALSE;
-
-ALTER TABLE collections_groups
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT FALSE;
--- a/migrations/sqlite/2025-01-09-172300_add_manage/down.sql
+++ b/migrations/sqlite/2025-01-09-172300_add_manage/down.sql
--- a/migrations/sqlite/2025-01-09-172300_add_manage/up.sql
+++ b/migrations/sqlite/2025-01-09-172300_add_manage/up.sql
@@ -1,5 +0,0 @@
-ALTER TABLE users_collections
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT 0; -- FALSE
-
-ALTER TABLE collections_groups
-ADD COLUMN manage BOOLEAN NOT NULL DEFAULT 0; -- FALSE
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.88.0"
+channel = "1.82.0"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -50,7 +50,7 @@ pub fn routes() -> Vec<Route> {
        disable_user,
        enable_user,
        remove_2fa,
-        update_membership_type,
+        update_user_org_type,
        update_revision_users,
        post_config,
        delete_config,
@@ -62,7 +62,6 @@ pub fn routes() -> Vec<Route> {
        diagnostics,
        get_diagnostics_config,
        resend_user_invite,
-        get_diagnostics_http,
    ]
 }

@@ -99,10 +98,9 @@ const DT_FMT: &str = "%Y-%m-%d %H:%M:%S %Z";
 const BASE_TEMPLATE: &str = "admin/base";

 const ACTING_ADMIN_USER: &str = "vaultwarden-admin-00000-000000000000";
-pub const FAKE_ADMIN_UUID: &str = "00000000-0000-0000-0000-000000000000";

 fn admin_path() -> String {
-    format!("{}{ADMIN_PATH}", CONFIG.domain_path())
+    format!("{}{}", CONFIG.domain_path(), ADMIN_PATH)
 }

 #[derive(Debug)]
@@ -171,7 +169,7 @@ struct LoginForm {
    redirect: Option<String>,
 }

-#[post("/", format = "application/x-www-form-urlencoded", data = "<data>")]
+#[post("/", data = "<data>")]
 fn post_admin_login(
    data: Form<LoginForm>,
    cookies: &CookieJar<'_>,
@@ -206,7 +204,7 @@ fn post_admin_login(

        cookies.add(cookie);
        if let Some(redirect) = redirect {
-            Ok(Redirect::to(format!("{}{redirect}", admin_path())))
+            Ok(Redirect::to(format!("{}{}", admin_path(), redirect)))
        } else {
            Err(AdminResponse::Ok(render_admin_page()))
        }
@@ -281,15 +279,15 @@ struct InviteData {
    email: String,
 }

-async fn get_user_or_404(user_id: &UserId, conn: &mut DbConn) -> ApiResult<User> {
-    if let Some(user) = User::find_by_uuid(user_id, conn).await {
+async fn get_user_or_404(uuid: &str, conn: &mut DbConn) -> ApiResult<User> {
+    if let Some(user) = User::find_by_uuid(uuid, conn).await {
        Ok(user)
    } else {
        err_code!("User doesn't exist", Status::NotFound.code);
    }
 }

-#[post("/invite", format = "application/json", data = "<data>")]
+#[post("/invite", data = "<data>")]
 async fn invite_user(data: Json<InviteData>, _token: AdminToken, mut conn: DbConn) -> JsonResult {
    let data: InviteData = data.into_inner();
    if User::find_by_mail(&data.email, &mut conn).await.is_some() {
@@ -300,9 +298,7 @@ async fn invite_user(data: Json<InviteData>, _token: AdminToken, mut conn: DbCon

    async fn _generate_invite(user: &User, conn: &mut DbConn) -> EmptyResult {
        if CONFIG.mail_enabled() {
-            let org_id: OrganizationId = FAKE_ADMIN_UUID.to_string().into();
-            let member_id: MembershipId = FAKE_ADMIN_UUID.to_string().into();
-            mail::send_invite(user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
+            mail::send_invite(user, None, None, &CONFIG.invitation_org_name(), None).await
        } else {
            let invitation = Invitation::new(&user.email);
            invitation.save(conn).await
@@ -315,7 +311,7 @@ async fn invite_user(data: Json<InviteData>, _token: AdminToken, mut conn: DbCon
    Ok(Json(user.to_json(&mut conn).await))
 }

-#[post("/test/smtp", format = "application/json", data = "<data>")]
+#[post("/test/smtp", data = "<data>")]
 async fn test_smtp(data: Json<InviteData>, _token: AdminToken) -> EmptyResult {
    let data: InviteData = data.into_inner();

@@ -384,29 +380,29 @@ async fn get_user_by_mail_json(mail: &str, _token: AdminToken, mut conn: DbConn)
    }
 }

-#[get("/users/<user_id>")]
-async fn get_user_json(user_id: UserId, _token: AdminToken, mut conn: DbConn) -> JsonResult {
-    let u = get_user_or_404(&user_id, &mut conn).await?;
+#[get("/users/<uuid>")]
+async fn get_user_json(uuid: &str, _token: AdminToken, mut conn: DbConn) -> JsonResult {
+    let u = get_user_or_404(uuid, &mut conn).await?;
    let mut usr = u.to_json(&mut conn).await;
    usr["userEnabled"] = json!(u.enabled);
    usr["createdAt"] = json!(format_naive_datetime_local(&u.created_at, DT_FMT));
    Ok(Json(usr))
 }

-#[post("/users/<user_id>/delete", format = "application/json")]
-async fn delete_user(user_id: UserId, token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/delete")]
+async fn delete_user(uuid: &str, token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let user = get_user_or_404(uuid, &mut conn).await?;

-    // Get the membership records before deleting the actual user
-    let memberships = Membership::find_any_state_by_user(&user_id, &mut conn).await;
+    // Get the user_org records before deleting the actual user
+    let user_orgs = UserOrganization::find_any_state_by_user(uuid, &mut conn).await;
    let res = user.delete(&mut conn).await;

-    for membership in memberships {
+    for user_org in user_orgs {
        log_event(
-            EventType::OrganizationUserDeleted as i32,
-            &membership.uuid,
-            &membership.org_uuid,
-            &ACTING_ADMIN_USER.into(),
+            EventType::OrganizationUserRemoved as i32,
+            &user_org.uuid,
+            &user_org.org_uuid,
+            ACTING_ADMIN_USER,
            14, // Use UnknownBrowser type
            &token.ip.ip,
            &mut conn,
@@ -417,17 +413,17 @@ async fn delete_user(user_id: UserId, token: AdminToken, mut conn: DbConn) -> Em
    res
 }

-#[post("/users/<user_id>/deauth", format = "application/json")]
-async fn deauth_user(user_id: UserId, _token: AdminToken, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/deauth")]
+async fn deauth_user(uuid: &str, _token: AdminToken, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let mut user = get_user_or_404(uuid, &mut conn).await?;

-    nt.send_logout(&user, None, &mut conn).await;
+    nt.send_logout(&user, None).await;

    if CONFIG.push_enabled() {
        for device in Device::find_push_devices_by_user(&user.uuid, &mut conn).await {
-            match unregister_push_device(&device.push_uuid).await {
+            match unregister_push_device(device.push_uuid).await {
                Ok(r) => r,
-                Err(e) => error!("Unable to unregister devices from Bitwarden server: {e}"),
+                Err(e) => error!("Unable to unregister devices from Bitwarden server: {}", e),
            };
        }
    }
@@ -438,49 +434,47 @@ async fn deauth_user(user_id: UserId, _token: AdminToken, mut conn: DbConn, nt:
    user.save(&mut conn).await
 }

-#[post("/users/<user_id>/disable", format = "application/json")]
-async fn disable_user(user_id: UserId, _token: AdminToken, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/disable")]
+async fn disable_user(uuid: &str, _token: AdminToken, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let mut user = get_user_or_404(uuid, &mut conn).await?;
    Device::delete_all_by_user(&user.uuid, &mut conn).await?;
    user.reset_security_stamp();
    user.enabled = false;

    let save_result = user.save(&mut conn).await;

-    nt.send_logout(&user, None, &mut conn).await;
+    nt.send_logout(&user, None).await;

    save_result
 }

-#[post("/users/<user_id>/enable", format = "application/json")]
-async fn enable_user(user_id: UserId, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/enable")]
+async fn enable_user(uuid: &str, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let mut user = get_user_or_404(uuid, &mut conn).await?;
    user.enabled = true;

    user.save(&mut conn).await
 }

-#[post("/users/<user_id>/remove-2fa", format = "application/json")]
-async fn remove_2fa(user_id: UserId, token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let mut user = get_user_or_404(&user_id, &mut conn).await?;
+#[post("/users/<uuid>/remove-2fa")]
+async fn remove_2fa(uuid: &str, token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let mut user = get_user_or_404(uuid, &mut conn).await?;
    TwoFactor::delete_all_by_user(&user.uuid, &mut conn).await?;
-    two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &mut conn).await?;
+    two_factor::enforce_2fa_policy(&user, ACTING_ADMIN_USER, 14, &token.ip.ip, &mut conn).await?;
    user.totp_recover = None;
    user.save(&mut conn).await
 }

-#[post("/users/<user_id>/invite/resend", format = "application/json")]
-async fn resend_user_invite(user_id: UserId, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    if let Some(user) = User::find_by_uuid(&user_id, &mut conn).await {
+#[post("/users/<uuid>/invite/resend")]
+async fn resend_user_invite(uuid: &str, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    if let Some(user) = User::find_by_uuid(uuid, &mut conn).await {
        //TODO: replace this with user.status check when it will be available (PR#3397)
        if !user.password_hash.is_empty() {
            err_code!("User already accepted invitation", Status::BadRequest.code);
        }

        if CONFIG.mail_enabled() {
-            let org_id: OrganizationId = FAKE_ADMIN_UUID.to_string().into();
-            let member_id: MembershipId = FAKE_ADMIN_UUID.to_string().into();
-            mail::send_invite(&user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
+            mail::send_invite(&user, None, None, &CONFIG.invitation_org_name(), None).await
        } else {
            Ok(())
        }
@@ -490,41 +484,42 @@ async fn resend_user_invite(user_id: UserId, _token: AdminToken, mut conn: DbCon
 }

 #[derive(Debug, Deserialize)]
-struct MembershipTypeData {
+struct UserOrgTypeData {
    user_type: NumberOrString,
-    user_uuid: UserId,
-    org_uuid: OrganizationId,
+    user_uuid: String,
+    org_uuid: String,
 }

-#[post("/users/org_type", format = "application/json", data = "<data>")]
-async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let data: MembershipTypeData = data.into_inner();
+#[post("/users/org_type", data = "<data>")]
+async fn update_user_org_type(data: Json<UserOrgTypeData>, token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let data: UserOrgTypeData = data.into_inner();

-    let Some(mut member_to_edit) = Membership::find_by_user_and_org(&data.user_uuid, &data.org_uuid, &mut conn).await
-    else {
-        err!("The specified user isn't member of the organization")
-    };
+    let mut user_to_edit =
+        match UserOrganization::find_by_user_and_org(&data.user_uuid, &data.org_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err!("The specified user isn't member of the organization"),
+        };

-    let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
+    let new_type = match UserOrgType::from_str(&data.user_type.into_string()) {
        Some(new_type) => new_type as i32,
        None => err!("Invalid type"),
    };

-    if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
+    if user_to_edit.atype == UserOrgType::Owner && new_type != UserOrgType::Owner {
        // Removing owner permission, check that there is at least one other confirmed owner
-        if Membership::count_confirmed_by_org_and_type(&data.org_uuid, MembershipType::Owner, &mut conn).await <= 1 {
+        if UserOrganization::count_confirmed_by_org_and_type(&data.org_uuid, UserOrgType::Owner, &mut conn).await <= 1 {
            err!("Can't change the type of the last owner")
        }
    }

-    // This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type
+    // This check is also done at api::organizations::{accept_invite(), _confirm_invite, _activate_user(), edit_user()}, update_user_org_type
    // It returns different error messages per function.
-    if new_type < MembershipType::Admin {
-        match OrgPolicy::is_user_allowed(&member_to_edit.user_uuid, &member_to_edit.org_uuid, true, &mut conn).await {
+    if new_type < UserOrgType::Admin {
+        match OrgPolicy::is_user_allowed(&user_to_edit.user_uuid, &user_to_edit.org_uuid, true, &mut conn).await {
            Ok(_) => {}
            Err(OrgPolicyErr::TwoFactorMissing) => {
                if CONFIG.email_2fa_auto_fallback() {
-                    two_factor::email::find_and_activate_email_2fa(&member_to_edit.user_uuid, &mut conn).await?;
+                    two_factor::email::find_and_activate_email_2fa(&user_to_edit.user_uuid, &mut conn).await?;
                } else {
                    err!("You cannot modify this user to this type because they have not setup 2FA");
                }
@@ -537,20 +532,20 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke

    log_event(
        EventType::OrganizationUserUpdated as i32,
-        &member_to_edit.uuid,
+        &user_to_edit.uuid,
        &data.org_uuid,
-        &ACTING_ADMIN_USER.into(),
+        ACTING_ADMIN_USER,
        14, // Use UnknownBrowser type
        &token.ip.ip,
        &mut conn,
    )
    .await;

-    member_to_edit.atype = new_type;
-    member_to_edit.save(&mut conn).await
+    user_to_edit.atype = new_type;
+    user_to_edit.save(&mut conn).await
 }

-#[post("/users/update_revision", format = "application/json")]
+#[post("/users/update_revision")]
 async fn update_revision_users(_token: AdminToken, mut conn: DbConn) -> EmptyResult {
    User::update_all_revisions(&mut conn).await
 }
@@ -561,7 +556,7 @@ async fn organizations_overview(_token: AdminToken, mut conn: DbConn) -> ApiResu
    let mut organizations_json = Vec::with_capacity(organizations.len());
    for o in organizations {
        let mut org = o.to_json();
-        org["user_count"] = json!(Membership::count_by_org(&o.uuid, &mut conn).await);
+        org["user_count"] = json!(UserOrganization::count_by_org(&o.uuid, &mut conn).await);
        org["cipher_count"] = json!(Cipher::count_by_org(&o.uuid, &mut conn).await);
        org["collection_count"] = json!(Collection::count_by_org(&o.uuid, &mut conn).await);
        org["group_count"] = json!(Group::count_by_org(&o.uuid, &mut conn).await);
@@ -575,9 +570,9 @@ async fn organizations_overview(_token: AdminToken, mut conn: DbConn) -> ApiResu
    Ok(Html(text))
 }

-#[post("/organizations/<org_id>/delete", format = "application/json")]
-async fn delete_organization(org_id: OrganizationId, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
-    let org = Organization::find_by_uuid(&org_id, &mut conn).await.map_res("Organization doesn't exist")?;
+#[post("/organizations/<uuid>/delete")]
+async fn delete_organization(uuid: &str, _token: AdminToken, mut conn: DbConn) -> EmptyResult {
+    let org = Organization::find_by_uuid(uuid, &mut conn).await.map_res("Organization doesn't exist")?;
    org.delete(&mut conn).await
 }

@@ -591,17 +586,24 @@ struct GitCommit {
    sha: String,
 }

+#[derive(Deserialize)]
+struct TimeApi {
+    year: u16,
+    month: u8,
+    day: u8,
+    hour: u8,
+    minute: u8,
+    seconds: u8,
+}
+
 async fn get_json_api<T: DeserializeOwned>(url: &str) -> Result<T, Error> {
    Ok(make_http_request(Method::GET, url)?.send().await?.error_for_status()?.json::<T>().await?)
 }

-async fn get_text_api(url: &str) -> Result<String, Error> {
-    Ok(make_http_request(Method::GET, url)?.send().await?.error_for_status()?.text().await?)
-}
-
 async fn has_http_access() -> bool {
-    let Ok(req) = make_http_request(Method::HEAD, "https://github.com/dani-garcia/vaultwarden") else {
-        return false;
+    let req = match make_http_request(Method::HEAD, "https://github.com/dani-garcia/vaultwarden") {
+        Ok(r) => r,
+        Err(_) => return false,
    };
    match req.send().await {
        Ok(r) => r.status().is_success(),
@@ -610,12 +612,10 @@ async fn has_http_access() -> bool {
 }

 use cached::proc_macro::cached;
-/// Cache this function to prevent API call rate limit. Github only allows 60 requests per hour, and we use 3 here already
-/// It will cache this function for 600 seconds (10 minutes) which should prevent the exhaustion of the rate limit
-/// Any cache will be lost if Vaultwarden is restarted
-use std::time::Duration; // Needed for cached
-#[cached(time = 600, sync_writes = "default")]
-async fn get_release_info(has_http_access: bool) -> (String, String, String) {
+/// Cache this function to prevent API call rate limit. Github only allows 60 requests per hour, and we use 3 here already.
+/// It will cache this function for 300 seconds (5 minutes) which should prevent the exhaustion of the rate limit.
+#[cached(time = 300, sync_writes = true)]
+async fn get_release_info(has_http_access: bool, running_within_container: bool) -> (String, String, String) {
    // If the HTTP Check failed, do not even attempt to check for new versions since we were not able to connect with github.com anyway.
    if has_http_access {
        (
@@ -632,13 +632,19 @@ async fn get_release_info(has_http_access: bool) -> (String, String, String) {
                }
                _ => "-".to_string(),
            },
-            // Do not fetch the web-vault version when running within a container
+            // Do not fetch the web-vault version when running within a container.
            // The web-vault version is embedded within the container it self, and should not be updated manually
-            match get_json_api::<GitRelease>("https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest")
+            if running_within_container {
+                "-".to_string()
+            } else {
+                match get_json_api::<GitRelease>(
+                    "https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest",
+                )
                .await
-            {
-                Ok(r) => r.tag_name.trim_start_matches('v').to_string(),
-                _ => "-".to_string(),
+                {
+                    Ok(r) => r.tag_name.trim_start_matches('v').to_string(),
+                    _ => "-".to_string(),
+                }
            },
        )
    } else {
@@ -648,18 +654,17 @@ async fn get_release_info(has_http_access: bool) -> (String, String, String) {

 async fn get_ntp_time(has_http_access: bool) -> String {
    if has_http_access {
-        if let Ok(cf_trace) = get_text_api("https://cloudflare.com/cdn-cgi/trace").await {
-            for line in cf_trace.lines() {
-                if let Some((key, value)) = line.split_once('=') {
-                    if key == "ts" {
-                        let ts = value.split_once('.').map_or(value, |(s, _)| s);
-                        if let Ok(dt) = chrono::DateTime::parse_from_str(ts, "%s") {
-                            return dt.format("%Y-%m-%d %H:%M:%S UTC").to_string();
-                        }
-                        break;
-                    }
-                }
-            }
+        if let Ok(ntp_time) = get_json_api::<TimeApi>("https://www.timeapi.io/api/Time/current/zone?timeZone=UTC").await
+        {
+            return format!(
+                "{year}-{month:02}-{day:02} {hour:02}:{minute:02}:{seconds:02} UTC",
+                year = ntp_time.year,
+                month = ntp_time.month,
+                day = ntp_time.day,
+                hour = ntp_time.hour,
+                minute = ntp_time.minute,
+                seconds = ntp_time.seconds
+            );
        }
    }
    String::from("Unable to fetch NTP time.")
@@ -684,23 +689,14 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, mut conn: DbConn)
        _ => "Unable to resolve domain name.".to_string(),
    };

-    let (latest_release, latest_commit, latest_web_build) = get_release_info(has_http_access).await;
+    let (latest_release, latest_commit, latest_web_build) =
+        get_release_info(has_http_access, running_within_container).await;

    let ip_header_name = &ip_header.0.unwrap_or_default();

    // Get current running versions
    let web_vault_version = get_web_vault_version();

-    // Check if the running version is newer than the latest stable released version
-    let web_vault_pre_release = if let Ok(web_ver_match) = semver::VersionReq::parse(&format!(">{latest_web_build}")) {
-        web_ver_match.matches(
-            &semver::Version::parse(&web_vault_version).unwrap_or_else(|_| semver::Version::parse("2025.1.1").unwrap()),
-        )
-    } else {
-        error!("Unable to parse latest_web_build: '{latest_web_build}'");
-        false
-    };
-
    let diagnostics_json = json!({
        "dns_resolved": dns_resolved,
        "current_release": VERSION,
@@ -709,7 +705,6 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, mut conn: DbConn)
        "web_vault_enabled": &CONFIG.web_vault_enabled(),
        "web_vault_version": web_vault_version,
        "latest_web_build": latest_web_build,
-        "web_vault_pre_release": web_vault_pre_release,
        "running_within_container": running_within_container,
        "container_base_image": if running_within_container { container_base_image() } else { "Not applicable" },
        "has_http_access": has_http_access,
@@ -718,14 +713,12 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, mut conn: DbConn)
        "ip_header_name": ip_header_name,
        "ip_header_config": &CONFIG.ip_header(),
        "uses_proxy": uses_proxy,
-        "enable_websocket": &CONFIG.enable_websocket(),
        "db_type": *DB_TYPE,
        "db_version": get_sql_server_version(&mut conn).await,
        "admin_url": format!("{}/diagnostics", admin_url()),
        "overrides": &CONFIG.get_overrides().join(", "),
        "host_arch": env::consts::ARCH,
        "host_os":  env::consts::OS,
-        "tz_env": env::var("TZ").unwrap_or_default(),
        "server_time_local": Local::now().format("%Y-%m-%d %H:%M:%S %Z").to_string(),
        "server_time": Utc::now().format("%Y-%m-%d %H:%M:%S UTC").to_string(), // Run the server date/time check as late as possible to minimize the time difference
        "ntp_time": get_ntp_time(has_http_access).await, // Run the ntp check as late as possible to minimize the time difference
@@ -735,35 +728,30 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, mut conn: DbConn)
    Ok(Html(text))
 }

-#[get("/diagnostics/config", format = "application/json")]
+#[get("/diagnostics/config")]
 fn get_diagnostics_config(_token: AdminToken) -> Json<Value> {
    let support_json = CONFIG.get_support_json();
    Json(support_json)
 }

-#[get("/diagnostics/http?<code>")]
-fn get_diagnostics_http(code: u16, _token: AdminToken) -> EmptyResult {
-    err_code!(format!("Testing error {code} response"), code);
-}
-
-#[post("/config", format = "application/json", data = "<data>")]
-async fn post_config(data: Json<ConfigBuilder>, _token: AdminToken) -> EmptyResult {
+#[post("/config", data = "<data>")]
+fn post_config(data: Json<ConfigBuilder>, _token: AdminToken) -> EmptyResult {
    let data: ConfigBuilder = data.into_inner();
-    if let Err(e) = CONFIG.update_config(data, true).await {
+    if let Err(e) = CONFIG.update_config(data) {
        err!(format!("Unable to save config: {e:?}"))
    }
    Ok(())
 }

-#[post("/config/delete", format = "application/json")]
-async fn delete_config(_token: AdminToken) -> EmptyResult {
-    if let Err(e) = CONFIG.delete_user_config().await {
+#[post("/config/delete")]
+fn delete_config(_token: AdminToken) -> EmptyResult {
+    if let Err(e) = CONFIG.delete_user_config() {
        err!(format!("Unable to delete config: {e:?}"))
    }
    Ok(())
 }

-#[post("/config/backup_db", format = "application/json")]
+#[post("/config/backup_db")]
 async fn backup_db(_token: AdminToken, mut conn: DbConn) -> ApiResult<String> {
    if *CAN_BACKUP {
        match backup_database(&mut conn).await {
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
--- a/src/api/core/ciphers.rs
+++ b/src/api/core/ciphers.rs
--- a/src/api/core/emergency_access.rs
+++ b/src/api/core/emergency_access.rs
@@ -93,10 +93,10 @@ async fn get_grantees(headers: Headers, mut conn: DbConn) -> Json<Value> {
 }

 #[get("/emergency-access/<emer_id>")]
-async fn get_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn get_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    match EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await {
+    match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
        Some(emergency_access) => Ok(Json(
            emergency_access.to_json_grantee_details(&mut conn).await.expect("Grantee user should exist but does not!"),
        )),
@@ -118,7 +118,7 @@ struct EmergencyAccessUpdateData {

 #[put("/emergency-access/<emer_id>", data = "<data>")]
 async fn put_emergency_access(
-    emer_id: EmergencyAccessId,
+    emer_id: &str,
    data: Json<EmergencyAccessUpdateData>,
    headers: Headers,
    conn: DbConn,
@@ -128,7 +128,7 @@ async fn put_emergency_access(

 #[post("/emergency-access/<emer_id>", data = "<data>")]
 async fn post_emergency_access(
-    emer_id: EmergencyAccessId,
+    emer_id: &str,
    data: Json<EmergencyAccessUpdateData>,
    headers: Headers,
    mut conn: DbConn,
@@ -137,11 +137,11 @@ async fn post_emergency_access(

    let data: EmergencyAccessUpdateData = data.into_inner();

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emergency_access) => emergency_access,
+            None => err!("Emergency access not valid."),
+        };

    let new_type = match EmergencyAccessType::from_str(&data.r#type.into_string()) {
        Some(new_type) => new_type as i32,
@@ -163,12 +163,12 @@ async fn post_emergency_access(
 // region delete

 #[delete("/emergency-access/<emer_id>")]
-async fn delete_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> EmptyResult {
+async fn delete_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> EmptyResult {
    check_emergency_access_enabled()?;

    let emergency_access = match (
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await,
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &headers.user.uuid, &mut conn).await,
+        EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await,
+        EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &headers.user.uuid, &mut conn).await,
    ) {
        (Some(grantor_emer), None) => {
            info!("Grantor deleted emergency access {emer_id}");
@@ -186,7 +186,7 @@ async fn delete_emergency_access(emer_id: EmergencyAccessId, headers: Headers, m
 }

 #[post("/emergency-access/<emer_id>/delete")]
-async fn post_delete_emergency_access(emer_id: EmergencyAccessId, headers: Headers, conn: DbConn) -> EmptyResult {
+async fn post_delete_emergency_access(emer_id: &str, headers: Headers, conn: DbConn) -> EmptyResult {
    delete_emergency_access(emer_id, headers, conn).await
 }

@@ -227,7 +227,7 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, mu
    let (grantee_user, new_user) = match User::find_by_mail(&email, &mut conn).await {
        None => {
            if !CONFIG.invitations_allowed() {
-                err!(format!("Grantee user does not exist: {email}"))
+                err!(format!("Grantee user does not exist: {}", &email))
            }

            if !CONFIG.is_email_domain_allowed(&email) {
@@ -266,8 +266,8 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, mu
    if CONFIG.mail_enabled() {
        mail::send_emergency_access_invite(
            &new_emergency_access.email.expect("Grantee email does not exists"),
-            grantee_user.uuid,
-            new_emergency_access.uuid,
+            &grantee_user.uuid,
+            &new_emergency_access.uuid,
            &grantor_user.name,
            &grantor_user.email,
        )
@@ -281,25 +281,27 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, mu
 }

 #[post("/emergency-access/<emer_id>/reinvite")]
-async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> EmptyResult {
+async fn resend_invite(emer_id: &str, headers: Headers, mut conn: DbConn) -> EmptyResult {
    check_emergency_access_enabled()?;

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::Invited as i32 {
        err!("The grantee user is already accepted or confirmed to the organization");
    }

-    let Some(email) = emergency_access.email.clone() else {
-        err!("Email not valid.")
+    let email = match emergency_access.email.clone() {
+        Some(email) => email,
+        None => err!("Email not valid."),
    };

-    let Some(grantee_user) = User::find_by_mail(&email, &mut conn).await else {
-        err!("Grantee user not found.")
+    let grantee_user = match User::find_by_mail(&email, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantee user not found."),
    };

    let grantor_user = headers.user;
@@ -307,8 +309,8 @@ async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, mut conn: D
    if CONFIG.mail_enabled() {
        mail::send_emergency_access_invite(
            &email,
-            grantor_user.uuid,
-            emergency_access.uuid,
+            &grantor_user.uuid,
+            &emergency_access.uuid,
            &grantor_user.name,
            &grantor_user.email,
        )
@@ -331,12 +333,7 @@ struct AcceptData {
 }

 #[post("/emergency-access/<emer_id>/accept", data = "<data>")]
-async fn accept_invite(
-    emer_id: EmergencyAccessId,
-    data: Json<AcceptData>,
-    headers: Headers,
-    mut conn: DbConn,
-) -> EmptyResult {
+async fn accept_invite(emer_id: &str, data: Json<AcceptData>, headers: Headers, mut conn: DbConn) -> EmptyResult {
    check_emergency_access_enabled()?;

    let data: AcceptData = data.into_inner();
@@ -359,15 +356,16 @@ async fn accept_invite(

    // We need to search for the uuid in combination with the email, since we do not yet store the uuid of the grantee in the database.
    // The uuid of the grantee gets stored once accepted.
-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_email(&emer_id, &headers.user.email, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_email(emer_id, &headers.user.email, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    // get grantor user to send Accepted email
-    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    if emer_id == claims.emer_id
@@ -394,7 +392,7 @@ struct ConfirmData {

 #[post("/emergency-access/<emer_id>/confirm", data = "<data>")]
 async fn confirm_emergency_access(
-    emer_id: EmergencyAccessId,
+    emer_id: &str,
    data: Json<ConfirmData>,
    headers: Headers,
    mut conn: DbConn,
@@ -405,11 +403,11 @@ async fn confirm_emergency_access(
    let data: ConfirmData = data.into_inner();
    let key = data.key;

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &confirming_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &confirming_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::Accepted as i32
        || emergency_access.grantor_uuid != confirming_user.uuid
@@ -417,13 +415,15 @@ async fn confirm_emergency_access(
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&confirming_user.uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&confirming_user.uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    if let Some(grantee_uuid) = emergency_access.grantee_uuid.as_ref() {
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &mut conn).await else {
-            err!("Grantee user not found.")
+        let grantee_user = match User::find_by_uuid(grantee_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err!("Grantee user not found."),
        };

        emergency_access.status = EmergencyAccessStatus::Confirmed as i32;
@@ -446,22 +446,23 @@ async fn confirm_emergency_access(
 // region access emergency access

 #[post("/emergency-access/<emer_id>/initiate")]
-async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn initiate_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

    let initiating_user = headers.user;
-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &initiating_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &initiating_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::Confirmed as i32 {
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    let now = Utc::now().naive_utc();
@@ -484,26 +485,28 @@ async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 }

 #[post("/emergency-access/<emer_id>/approve")]
-async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn approve_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32 {
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&headers.user.uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&headers.user.uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    if let Some(grantee_uuid) = emergency_access.grantee_uuid.as_ref() {
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &mut conn).await else {
-            err!("Grantee user not found.")
+        let grantee_user = match User::find_by_uuid(grantee_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err!("Grantee user not found."),
        };

        emergency_access.status = EmergencyAccessStatus::RecoveryApproved as i32;
@@ -519,14 +522,14 @@ async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 }

 #[post("/emergency-access/<emer_id>/reject")]
-async fn reject_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn reject_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    let Some(mut emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let mut emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantor_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32
        && emergency_access.status != EmergencyAccessStatus::RecoveryApproved as i32
@@ -535,8 +538,9 @@ async fn reject_emergency_access(emer_id: EmergencyAccessId, headers: Headers, m
    }

    if let Some(grantee_uuid) = emergency_access.grantee_uuid.as_ref() {
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &mut conn).await else {
-            err!("Grantee user not found.")
+        let grantee_user = match User::find_by_uuid(grantee_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err!("Grantee user not found."),
        };

        emergency_access.status = EmergencyAccessStatus::Confirmed as i32;
@@ -556,14 +560,14 @@ async fn reject_emergency_access(emer_id: EmergencyAccessId, headers: Headers, m
 // region action

 #[post("/emergency-access/<emer_id>/view")]
-async fn view_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn view_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &headers.user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &headers.user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if !is_valid_request(&emergency_access, &headers.user.uuid, EmergencyAccessType::View) {
        err!("Emergency access not valid.")
@@ -582,7 +586,7 @@ async fn view_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut
                CipherSyncType::User,
                &mut conn,
            )
-            .await?,
+            .await,
        );
    }

@@ -594,22 +598,23 @@ async fn view_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut
 }

 #[post("/emergency-access/<emer_id>/takeover")]
-async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn takeover_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

    let requesting_user = headers.user;
-    let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &requesting_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &requesting_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if !is_valid_request(&emergency_access, &requesting_user.uuid, EmergencyAccessType::Takeover) {
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    let result = json!({
@@ -633,7 +638,7 @@ struct EmergencyAccessPasswordData {

 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
 async fn password_emergency_access(
-    emer_id: EmergencyAccessId,
+    emer_id: &str,
    data: Json<EmergencyAccessPasswordData>,
    headers: Headers,
    mut conn: DbConn,
@@ -645,18 +650,19 @@ async fn password_emergency_access(
    //let key = &data.Key;

    let requesting_user = headers.user;
-    let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &requesting_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &requesting_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if !is_valid_request(&emergency_access, &requesting_user.uuid, EmergencyAccessType::Takeover) {
        err!("Emergency access not valid.")
    }

-    let Some(mut grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let mut grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    // change grantor_user password
@@ -667,9 +673,9 @@ async fn password_emergency_access(
    TwoFactor::delete_all_by_user(&grantor_user.uuid, &mut conn).await?;

    // Remove grantor from all organisations unless Owner
-    for member in Membership::find_any_state_by_user(&grantor_user.uuid, &mut conn).await {
-        if member.atype != MembershipType::Owner as i32 {
-            member.delete(&mut conn).await?;
+    for user_org in UserOrganization::find_any_state_by_user(&grantor_user.uuid, &mut conn).await {
+        if user_org.atype != UserOrgType::Owner as i32 {
+            user_org.delete(&mut conn).await?;
        }
    }
    Ok(())
@@ -678,20 +684,21 @@ async fn password_emergency_access(
 // endregion

 #[get("/emergency-access/<emer_id>/policies")]
-async fn policies_emergency_access(emer_id: EmergencyAccessId, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn policies_emergency_access(emer_id: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
    let requesting_user = headers.user;
-    let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &requesting_user.uuid, &mut conn).await
-    else {
-        err!("Emergency access not valid.")
-    };
+    let emergency_access =
+        match EmergencyAccess::find_by_uuid_and_grantee_uuid(emer_id, &requesting_user.uuid, &mut conn).await {
+            Some(emer) => emer,
+            None => err!("Emergency access not valid."),
+        };

    if !is_valid_request(&emergency_access, &requesting_user.uuid, EmergencyAccessType::Takeover) {
        err!("Emergency access not valid.")
    }

-    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await else {
-        err!("Grantor user not found.")
+    let grantor_user = match User::find_by_uuid(&emergency_access.grantor_uuid, &mut conn).await {
+        Some(user) => user,
+        None => err!("Grantor user not found."),
    };

    let policies = OrgPolicy::find_confirmed_by_user(&grantor_user.uuid, &mut conn);
@@ -706,11 +713,11 @@ async fn policies_emergency_access(emer_id: EmergencyAccessId, headers: Headers,

 fn is_valid_request(
    emergency_access: &EmergencyAccess,
-    requesting_user_id: &UserId,
+    requesting_user_uuid: &str,
    requested_access_type: EmergencyAccessType,
 ) -> bool {
    emergency_access.grantee_uuid.is_some()
-        && emergency_access.grantee_uuid.as_ref().unwrap() == requesting_user_id
+        && emergency_access.grantee_uuid.as_ref().unwrap() == requesting_user_uuid
        && emergency_access.status == EmergencyAccessStatus::RecoveryApproved as i32
        && emergency_access.atype == requested_access_type as i32
 }
--- a/src/api/core/events.rs
+++ b/src/api/core/events.rs
@@ -8,7 +8,7 @@ use crate::{
    api::{EmptyResult, JsonResult},
    auth::{AdminHeaders, Headers},
    db::{
-        models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId},
+        models::{Cipher, Event, UserOrganization},
        DbConn, DbPool,
    },
    util::parse_date,
@@ -29,18 +29,9 @@ struct EventRange {
    continuation_token: Option<String>,
 }

-// Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/EventsController.cs#L87
+// Upstream: https://github.com/bitwarden/server/blob/9ecf69d9cabce732cf2c57976dd9afa5728578fb/src/Api/Controllers/EventsController.cs#LL84C35-L84C41
 #[get("/organizations/<org_id>/events?<data..>")]
-async fn get_org_events(
-    org_id: OrganizationId,
-    data: EventRange,
-    headers: AdminHeaders,
-    mut conn: DbConn,
-) -> JsonResult {
-    if org_id != headers.org_id {
-        err!("Organization not found", "Organization id's do not match");
-    }
-
+async fn get_org_events(org_id: &str, data: EventRange, _headers: AdminHeaders, mut conn: DbConn) -> JsonResult {
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
@@ -53,7 +44,7 @@ async fn get_org_events(
            parse_date(&data.end)
        };

-        Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &mut conn)
+        Event::find_by_organization_uuid(org_id, &start_date, &end_date, &mut conn)
            .await
            .iter()
            .map(|e| e.to_json())
@@ -68,14 +59,14 @@ async fn get_org_events(
 }

 #[get("/ciphers/<cipher_id>/events?<data..>")]
-async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Headers, mut conn: DbConn) -> JsonResult {
+async fn get_cipher_events(cipher_id: &str, data: EventRange, headers: Headers, mut conn: DbConn) -> JsonResult {
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
        Vec::with_capacity(0)
    } else {
        let mut events_json = Vec::with_capacity(0);
-        if Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &mut conn).await {
+        if UserOrganization::user_has_ge_admin_access_to_cipher(&headers.user.uuid, cipher_id, &mut conn).await {
            let start_date = parse_date(&data.start);
            let end_date = if let Some(before_date) = &data.continuation_token {
                parse_date(before_date)
@@ -83,7 +74,7 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade
                parse_date(&data.end)
            };

-            events_json = Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &mut conn)
+            events_json = Event::find_by_cipher_uuid(cipher_id, &start_date, &end_date, &mut conn)
                .await
                .iter()
                .map(|e| e.to_json())
@@ -99,17 +90,14 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade
    })))
 }

-#[get("/organizations/<org_id>/users/<member_id>/events?<data..>")]
+#[get("/organizations/<org_id>/users/<user_org_id>/events?<data..>")]
 async fn get_user_events(
-    org_id: OrganizationId,
-    member_id: MembershipId,
+    org_id: &str,
+    user_org_id: &str,
    data: EventRange,
-    headers: AdminHeaders,
+    _headers: AdminHeaders,
    mut conn: DbConn,
 ) -> JsonResult {
-    if org_id != headers.org_id {
-        err!("Organization not found", "Organization id's do not match");
-    }
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
@@ -122,7 +110,7 @@ async fn get_user_events(
            parse_date(&data.end)
        };

-        Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &mut conn)
+        Event::find_by_org_and_user_org(org_id, user_org_id, &start_date, &end_date, &mut conn)
            .await
            .iter()
            .map(|e| e.to_json())
@@ -164,13 +152,13 @@ struct EventCollection {
    date: String,

    // Optional
-    cipher_id: Option<CipherId>,
-    organization_id: Option<OrganizationId>,
+    cipher_id: Option<String>,
+    organization_id: Option<String>,
 }

 // Upstream:
-// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Events/Controllers/CollectController.cs
-// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Services/Implementations/EventService.cs
+// https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Events/Controllers/CollectController.cs
+// https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Core/Services/Implementations/EventService.cs
 #[post("/collect", format = "application/json", data = "<data>")]
 async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers, mut conn: DbConn) -> EmptyResult {
    if !CONFIG.org_events_enabled() {
@@ -192,11 +180,11 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                .await;
            }
            1600..=1699 => {
-                if let Some(org_id) = &event.organization_id {
+                if let Some(org_uuid) = &event.organization_id {
                    _log_event(
                        event.r#type,
-                        org_id,
-                        org_id,
+                        org_uuid,
+                        org_uuid,
                        &headers.user.uuid,
                        headers.device.atype,
                        Some(event_date),
@@ -209,11 +197,11 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
            _ => {
                if let Some(cipher_uuid) = &event.cipher_id {
                    if let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &mut conn).await {
-                        if let Some(org_id) = cipher.organization_uuid {
+                        if let Some(org_uuid) = cipher.organization_uuid {
                            _log_event(
                                event.r#type,
                                cipher_uuid,
-                                &org_id,
+                                &org_uuid,
                                &headers.user.uuid,
                                headers.device.atype,
                                Some(event_date),
@@ -230,39 +218,38 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
    Ok(())
 }

-pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &mut DbConn) {
+pub async fn log_user_event(event_type: i32, user_uuid: &str, device_type: i32, ip: &IpAddr, conn: &mut DbConn) {
    if !CONFIG.org_events_enabled() {
        return;
    }
-    _log_user_event(event_type, user_id, device_type, None, ip, conn).await;
+    _log_user_event(event_type, user_uuid, device_type, None, ip, conn).await;
 }

 async fn _log_user_event(
    event_type: i32,
-    user_id: &UserId,
+    user_uuid: &str,
    device_type: i32,
    event_date: Option<NaiveDateTime>,
    ip: &IpAddr,
    conn: &mut DbConn,
 ) {
-    let memberships = Membership::find_by_user(user_id, conn).await;
-    let mut events: Vec<Event> = Vec::with_capacity(memberships.len() + 1); // We need an event per org and one without an org
+    let orgs = UserOrganization::get_org_uuid_by_user(user_uuid, conn).await;
+    let mut events: Vec<Event> = Vec::with_capacity(orgs.len() + 1); // We need an event per org and one without an org

-    // Upstream saves the event also without any org_id.
+    // Upstream saves the event also without any org_uuid.
    let mut event = Event::new(event_type, event_date);
-    event.user_uuid = Some(user_id.clone());
-    event.act_user_uuid = Some(user_id.clone());
+    event.user_uuid = Some(String::from(user_uuid));
+    event.act_user_uuid = Some(String::from(user_uuid));
    event.device_type = Some(device_type);
    event.ip_address = Some(ip.to_string());
    events.push(event);

    // For each org a user is a member of store these events per org
-    for membership in memberships {
+    for org_uuid in orgs {
        let mut event = Event::new(event_type, event_date);
-        event.user_uuid = Some(user_id.clone());
-        event.org_uuid = Some(membership.org_uuid);
-        event.org_user_uuid = Some(membership.uuid);
-        event.act_user_uuid = Some(user_id.clone());
+        event.user_uuid = Some(String::from(user_uuid));
+        event.org_uuid = Some(org_uuid);
+        event.act_user_uuid = Some(String::from(user_uuid));
        event.device_type = Some(device_type);
        event.ip_address = Some(ip.to_string());
        events.push(event);
@@ -274,8 +261,8 @@ async fn _log_user_event(
 pub async fn log_event(
    event_type: i32,
    source_uuid: &str,
-    org_id: &OrganizationId,
-    act_user_id: &UserId,
+    org_uuid: &str,
+    act_user_uuid: &str,
    device_type: i32,
    ip: &IpAddr,
    conn: &mut DbConn,
@@ -283,15 +270,15 @@ pub async fn log_event(
    if !CONFIG.org_events_enabled() {
        return;
    }
-    _log_event(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
+    _log_event(event_type, source_uuid, org_uuid, act_user_uuid, device_type, None, ip, conn).await;
 }

 #[allow(clippy::too_many_arguments)]
 async fn _log_event(
    event_type: i32,
    source_uuid: &str,
-    org_id: &OrganizationId,
-    act_user_id: &UserId,
+    org_uuid: &str,
+    act_user_uuid: &str,
    device_type: i32,
    event_date: Option<NaiveDateTime>,
    ip: &IpAddr,
@@ -303,31 +290,31 @@ async fn _log_event(
        // 1000..=1099 Are user events, they need to be logged via log_user_event()
        // Cipher Events
        1100..=1199 => {
-            event.cipher_uuid = Some(source_uuid.to_string().into());
+            event.cipher_uuid = Some(String::from(source_uuid));
        }
        // Collection Events
        1300..=1399 => {
-            event.collection_uuid = Some(source_uuid.to_string().into());
+            event.collection_uuid = Some(String::from(source_uuid));
        }
        // Group Events
        1400..=1499 => {
-            event.group_uuid = Some(source_uuid.to_string().into());
+            event.group_uuid = Some(String::from(source_uuid));
        }
        // Org User Events
        1500..=1599 => {
-            event.org_user_uuid = Some(source_uuid.to_string().into());
+            event.org_user_uuid = Some(String::from(source_uuid));
        }
        // 1600..=1699 Are organizational events, and they do not need the source_uuid
        // Policy Events
        1700..=1799 => {
-            event.policy_uuid = Some(source_uuid.to_string().into());
+            event.policy_uuid = Some(String::from(source_uuid));
        }
        // Ignore others
        _ => {}
    }

-    event.org_uuid = Some(org_id.clone());
-    event.act_user_uuid = Some(act_user_id.clone());
+    event.org_uuid = Some(String::from(org_uuid));
+    event.act_user_uuid = Some(String::from(act_user_uuid));
    event.device_type = Some(device_type);
    event.ip_address = Some(ip.to_string());
    event.save(conn).await.unwrap_or(());
--- a/src/api/core/folders.rs
+++ b/src/api/core/folders.rs
@@ -23,19 +23,25 @@ async fn get_folders(headers: Headers, mut conn: DbConn) -> Json<Value> {
    }))
 }

-#[get("/folders/<folder_id>")]
-async fn get_folder(folder_id: FolderId, headers: Headers, mut conn: DbConn) -> JsonResult {
-    match Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &mut conn).await {
-        Some(folder) => Ok(Json(folder.to_json())),
-        _ => err!("Invalid folder", "Folder does not exist or belongs to another user"),
+#[get("/folders/<uuid>")]
+async fn get_folder(uuid: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
+    let folder = match Folder::find_by_uuid(uuid, &mut conn).await {
+        Some(folder) => folder,
+        _ => err!("Invalid folder"),
+    };
+
+    if folder.user_uuid != headers.user.uuid {
+        err!("Folder belongs to another user")
    }
+
+    Ok(Json(folder.to_json()))
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct FolderData {
    pub name: String,
-    pub id: Option<FolderId>,
+    pub id: Option<String>,
 }

 #[post("/folders", data = "<data>")]
@@ -45,25 +51,19 @@ async fn post_folders(data: Json<FolderData>, headers: Headers, mut conn: DbConn
    let mut folder = Folder::new(headers.user.uuid, data.name);

    folder.save(&mut conn).await?;
-    nt.send_folder_update(UpdateType::SyncFolderCreate, &folder, &headers.device, &mut conn).await;
+    nt.send_folder_update(UpdateType::SyncFolderCreate, &folder, &headers.device.uuid, &mut conn).await;

    Ok(Json(folder.to_json()))
 }

-#[post("/folders/<folder_id>", data = "<data>")]
-async fn post_folder(
-    folder_id: FolderId,
-    data: Json<FolderData>,
-    headers: Headers,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> JsonResult {
-    put_folder(folder_id, data, headers, conn, nt).await
+#[post("/folders/<uuid>", data = "<data>")]
+async fn post_folder(uuid: &str, data: Json<FolderData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
+    put_folder(uuid, data, headers, conn, nt).await
 }

-#[put("/folders/<folder_id>", data = "<data>")]
+#[put("/folders/<uuid>", data = "<data>")]
 async fn put_folder(
-    folder_id: FolderId,
+    uuid: &str,
    data: Json<FolderData>,
    headers: Headers,
    mut conn: DbConn,
@@ -71,32 +71,42 @@ async fn put_folder(
 ) -> JsonResult {
    let data: FolderData = data.into_inner();

-    let Some(mut folder) = Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &mut conn).await else {
-        err!("Invalid folder", "Folder does not exist or belongs to another user")
+    let mut folder = match Folder::find_by_uuid(uuid, &mut conn).await {
+        Some(folder) => folder,
+        _ => err!("Invalid folder"),
    };

+    if folder.user_uuid != headers.user.uuid {
+        err!("Folder belongs to another user")
+    }
+
    folder.name = data.name;

    folder.save(&mut conn).await?;
-    nt.send_folder_update(UpdateType::SyncFolderUpdate, &folder, &headers.device, &mut conn).await;
+    nt.send_folder_update(UpdateType::SyncFolderUpdate, &folder, &headers.device.uuid, &mut conn).await;

    Ok(Json(folder.to_json()))
 }

-#[post("/folders/<folder_id>/delete")]
-async fn delete_folder_post(folder_id: FolderId, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    delete_folder(folder_id, headers, conn, nt).await
+#[post("/folders/<uuid>/delete")]
+async fn delete_folder_post(uuid: &str, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    delete_folder(uuid, headers, conn, nt).await
 }

-#[delete("/folders/<folder_id>")]
-async fn delete_folder(folder_id: FolderId, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let Some(folder) = Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &mut conn).await else {
-        err!("Invalid folder", "Folder does not exist or belongs to another user")
+#[delete("/folders/<uuid>")]
+async fn delete_folder(uuid: &str, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let folder = match Folder::find_by_uuid(uuid, &mut conn).await {
+        Some(folder) => folder,
+        _ => err!("Invalid folder"),
    };

+    if folder.user_uuid != headers.user.uuid {
+        err!("Folder belongs to another user")
+    }
+
    // Delete the actual folder entry
    folder.delete(&mut conn).await?;

-    nt.send_folder_update(UpdateType::SyncFolderDelete, &folder, &headers.device, &mut conn).await;
+    nt.send_folder_update(UpdateType::SyncFolderDelete, &folder, &headers.device.uuid, &mut conn).await;
    Ok(())
 }
--- a/src/api/core/mod.rs
+++ b/src/api/core/mod.rs
@@ -18,7 +18,7 @@ pub use sends::purge_sends;
 pub fn routes() -> Vec<Route> {
    let mut eq_domains_routes = routes![get_eq_domains, post_eq_domains, put_eq_domains];
    let mut hibp_routes = routes![hibp_breach];
-    let mut meta_routes = routes![alive, now, version, config, get_api_webauthn];
+    let mut meta_routes = routes![alive, now, version, config];

    let mut routes = Vec::new();
    routes.append(&mut accounts::routes());
@@ -124,7 +124,7 @@ async fn post_eq_domains(

    user.save(&mut conn).await?;

-    nt.send_user_update(UpdateType::SyncSettings, &user, &headers.device.push_uuid, &mut conn).await;
+    nt.send_user_update(UpdateType::SyncSettings, &user).await;

    Ok(Json(json!({})))
 }
@@ -135,13 +135,12 @@ async fn put_eq_domains(data: Json<EquivDomainData>, headers: Headers, conn: DbC
 }

 #[get("/hibp/breach?<username>")]
-async fn hibp_breach(username: &str, _headers: Headers) -> JsonResult {
-    let username: String = url::form_urlencoded::byte_serialize(username.as_bytes()).collect();
-    if let Some(api_key) = crate::CONFIG.hibp_api_key() {
-        let url = format!(
-            "https://haveibeenpwned.com/api/v3/breachedaccount/{username}?truncateResponse=false&includeUnverified=false"
-        );
+async fn hibp_breach(username: &str) -> JsonResult {
+    let url = format!(
+        "https://haveibeenpwned.com/api/v3/breachedaccount/{username}?truncateResponse=false&includeUnverified=false"
+    );

+    if let Some(api_key) = crate::CONFIG.hibp_api_key() {
        let res = make_http_request(Method::GET, &url)?.header("hibp-api-key", api_key).send().await?;

        // If we get a 404, return a 404, it means no breached accounts
@@ -184,48 +183,29 @@ fn version() -> Json<&'static str> {
    Json(crate::VERSION.unwrap_or_default())
 }

-#[get("/webauthn")]
-fn get_api_webauthn(_headers: Headers) -> Json<Value> {
-    // Prevent a 404 error, which also causes key-rotation issues
-    // It looks like this is used when login with passkeys is enabled, which Vaultwarden does not (yet) support
-    // An empty list/data also works fine
-    Json(json!({
-        "object": "list",
-        "data": [],
-        "continuationToken": null
-    }))
-}
-
 #[get("/config")]
 fn config() -> Json<Value> {
    let domain = crate::CONFIG.domain();
-    // Official available feature flags can be found here:
-    // Server (v2025.6.2): https://github.com/bitwarden/server/blob/d094be3267f2030bd0dc62106bc6871cf82682f5/src/Core/Constants.cs#L103
-    // Client (web-v2025.6.1): https://github.com/bitwarden/clients/blob/747c2fd6a1c348a57a76e4a7de8128466ffd3c01/libs/common/src/enums/feature-flag.enum.ts#L12
-    // Android (v2025.6.0): https://github.com/bitwarden/android/blob/b5b022caaad33390c31b3021b2c1205925b0e1a2/app/src/main/kotlin/com/x8bit/bitwarden/data/platform/manager/model/FlagKey.kt#L22
-    // iOS (v2025.6.0): https://github.com/bitwarden/ios/blob/ff06d9c6cc8da89f78f37f376495800201d7261a/BitwardenShared/Core/Platform/Models/Enum/FeatureFlag.swift#L7
    let mut feature_states =
        parse_experimental_client_feature_flags(&crate::CONFIG.experimental_client_feature_flags());
-    feature_states.insert("duo-redirect".to_string(), true);
-    feature_states.insert("email-verification".to_string(), true);
-    feature_states.insert("unauth-ui-refresh".to_string(), true);
-    feature_states.insert("enable-pm-flight-recorder".to_string(), true);
-    feature_states.insert("mobile-error-reporting".to_string(), true);
+    // Force the new key rotation feature
+    feature_states.insert("key-rotation-improvements".to_string(), true);
+    feature_states.insert("flexible-collections-v-1".to_string(), false);

    Json(json!({
        // Note: The clients use this version to handle backwards compatibility concerns
        // This means they expect a version that closely matches the Bitwarden server version
        // We should make sure that we keep this updated when we support the new server features
        // Version history:
-        // - Individual cipher key encryption: 2024.2.0
-        "version": "2025.6.0",
+        // - Individual cipher key encryption: 2023.9.1
+        "version": "2024.2.0",
        "gitHash": option_env!("GIT_REV"),
        "server": {
          "name": "Vaultwarden",
          "url": "https://github.com/dani-garcia/vaultwarden"
        },
        "settings": {
-            "disableUserRegistration": crate::CONFIG.is_signup_disabled()
+            "disableUserRegistration": !crate::CONFIG.signups_allowed() && crate::CONFIG.signups_domains_whitelist().is_empty(),
        },
        "environment": {
          "vault": domain,
@@ -233,12 +213,6 @@ fn config() -> Json<Value> {
          "identity": format!("{domain}/identity"),
          "notifications": format!("{domain}/notifications"),
          "sso": "",
-          "cloudRegion": null,
-        },
-        // Bitwarden uses this for the self-hosted servers to indicate the default push technology
-        "push": {
-          "pushTechnology": 0,
-          "vapidPublicKey": null
        },
        "featureStates": feature_states,
        "object": "config",
--- a/src/api/core/organizations.rs
+++ b/src/api/core/organizations.rs
--- a/src/api/core/public.rs
+++ b/src/api/core/public.rs
@@ -46,42 +46,46 @@ struct OrgImportData {
 #[post("/public/organization/import", data = "<data>")]
 async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: DbConn) -> EmptyResult {
    // Most of the logic for this function can be found here
-    // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Services/Implementations/OrganizationService.cs#L1203
+    // https://github.com/bitwarden/server/blob/fd892b2ff4547648a276734fb2b14a8abae2c6f5/src/Core/Services/Implementations/OrganizationService.cs#L1797

    let org_id = token.0;
    let data = data.into_inner();

    for user_data in &data.members {
-        let mut user_created: bool = false;
        if user_data.deleted {
            // If user is marked for deletion and it exists, revoke it
-            if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &mut conn).await {
+            if let Some(mut user_org) =
+                UserOrganization::find_by_email_and_org(&user_data.email, &org_id, &mut conn).await
+            {
                // Only revoke a user if it is not the last confirmed owner
-                let revoked = if member.atype == MembershipType::Owner
-                    && member.status == MembershipStatus::Confirmed as i32
+                let revoked = if user_org.atype == UserOrgType::Owner
+                    && user_org.status == UserOrgStatus::Confirmed as i32
                {
-                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &mut conn).await <= 1
+                    if UserOrganization::count_confirmed_by_org_and_type(&org_id, UserOrgType::Owner, &mut conn).await
+                        <= 1
                    {
                        warn!("Can't revoke the last owner");
                        false
                    } else {
-                        member.revoke()
+                        user_org.revoke()
                    }
                } else {
-                    member.revoke()
+                    user_org.revoke()
                };

-                let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
+                let ext_modified = user_org.set_external_id(Some(user_data.external_id.clone()));
                if revoked || ext_modified {
-                    member.save(&mut conn).await?;
+                    user_org.save(&mut conn).await?;
                }
            }
        // If user is part of the organization, restore it
-        } else if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &mut conn).await {
-            let restored = member.restore();
-            let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
+        } else if let Some(mut user_org) =
+            UserOrganization::find_by_email_and_org(&user_data.email, &org_id, &mut conn).await
+        {
+            let restored = user_org.restore();
+            let ext_modified = user_org.set_external_id(Some(user_data.external_id.clone()));
            if restored || ext_modified {
-                member.save(&mut conn).await?;
+                user_org.save(&mut conn).await?;
            }
        } else {
            // If user is not part of the organization
@@ -93,25 +97,25 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
                    new_user.save(&mut conn).await?;

                    if !CONFIG.mail_enabled() {
-                        Invitation::new(&new_user.email).save(&mut conn).await?;
+                        let invitation = Invitation::new(&new_user.email);
+                        invitation.save(&mut conn).await?;
                    }
-                    user_created = true;
                    new_user
                }
            };
-            let member_status = if CONFIG.mail_enabled() || user.password_hash.is_empty() {
-                MembershipStatus::Invited as i32
+            let user_org_status = if CONFIG.mail_enabled() || user.password_hash.is_empty() {
+                UserOrgStatus::Invited as i32
            } else {
-                MembershipStatus::Accepted as i32 // Automatically mark user as accepted if no email invites
+                UserOrgStatus::Accepted as i32 // Automatically mark user as accepted if no email invites
            };

-            let mut new_member = Membership::new(user.uuid.clone(), org_id.clone());
-            new_member.set_external_id(Some(user_data.external_id.clone()));
-            new_member.access_all = false;
-            new_member.atype = MembershipType::User as i32;
-            new_member.status = member_status;
+            let mut new_org_user = UserOrganization::new(user.uuid.clone(), org_id.clone());
+            new_org_user.set_external_id(Some(user_data.external_id.clone()));
+            new_org_user.access_all = false;
+            new_org_user.atype = UserOrgType::User as i32;
+            new_org_user.status = user_org_status;

-            new_member.save(&mut conn).await?;
+            new_org_user.save(&mut conn).await?;

            if CONFIG.mail_enabled() {
                let (org_name, org_email) = match Organization::find_by_uuid(&org_id, &mut conn).await {
@@ -119,18 +123,8 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
                    None => err!("Error looking up organization"),
                };

-                if let Err(e) =
-                    mail::send_invite(&user, org_id.clone(), new_member.uuid.clone(), &org_name, Some(org_email)).await
-                {
-                    // Upon error delete the user, invite and org member records when needed
-                    if user_created {
-                        user.delete(&mut conn).await?;
-                    } else {
-                        new_member.delete(&mut conn).await?;
-                    }
-
-                    err!(format!("Error sending invite: {e:?} "));
-                }
+                mail::send_invite(&user, Some(org_id.clone()), Some(new_org_user.uuid), &org_name, Some(org_email))
+                    .await?;
            }
        }
    }
@@ -155,8 +149,9 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
            GroupUser::delete_all_by_group(&group_uuid, &mut conn).await?;

            for ext_id in &group_data.member_external_ids {
-                if let Some(member) = Membership::find_by_external_id_and_org(ext_id, &org_id, &mut conn).await {
-                    let mut group_user = GroupUser::new(group_uuid.clone(), member.uuid.clone());
+                if let Some(user_org) = UserOrganization::find_by_external_id_and_org(ext_id, &org_id, &mut conn).await
+                {
+                    let mut group_user = GroupUser::new(group_uuid.clone(), user_org.uuid.clone());
                    group_user.save(&mut conn).await?;
                }
            }
@@ -169,19 +164,20 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
    if data.overwrite_existing {
        // Generate a HashSet to quickly verify if a member is listed or not.
        let sync_members: HashSet<String> = data.members.into_iter().map(|m| m.external_id).collect();
-        for member in Membership::find_by_org(&org_id, &mut conn).await {
-            if let Some(ref user_external_id) = member.external_id {
+        for user_org in UserOrganization::find_by_org(&org_id, &mut conn).await {
+            if let Some(ref user_external_id) = user_org.external_id {
                if !sync_members.contains(user_external_id) {
-                    if member.atype == MembershipType::Owner && member.status == MembershipStatus::Confirmed as i32 {
+                    if user_org.atype == UserOrgType::Owner && user_org.status == UserOrgStatus::Confirmed as i32 {
                        // Removing owner, check that there is at least one other confirmed owner
-                        if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &mut conn).await
+                        if UserOrganization::count_confirmed_by_org_and_type(&org_id, UserOrgType::Owner, &mut conn)
+                            .await
                            <= 1
                        {
                            warn!("Can't delete the last owner");
                            continue;
                        }
                    }
-                    member.delete(&mut conn).await?;
+                    user_org.delete(&mut conn).await?;
                }
            }
        }
@@ -190,7 +186,7 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, mut conn: Db
    Ok(())
 }

-pub struct PublicToken(OrganizationId);
+pub struct PublicToken(String);

 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for PublicToken {
@@ -207,8 +203,9 @@ impl<'r> FromRequest<'r> for PublicToken {
            None => err_handler!("No access token provided"),
        };
        // Check JWT token is valid and get device and user from it
-        let Ok(claims) = auth::decode_api_org(access_token) else {
-            err_handler!("Invalid claim")
+        let claims = match auth::decode_api_org(access_token) {
+            Ok(claims) => claims,
+            Err(_) => err_handler!("Invalid claim"),
        };
        // Check if time is between claims.nbf and claims.exp
        let time_now = Utc::now().timestamp();
@@ -230,12 +227,13 @@ impl<'r> FromRequest<'r> for PublicToken {
            Outcome::Success(conn) => conn,
            _ => err_handler!("Error getting DB"),
        };
-        let Some(org_id) = claims.client_id.strip_prefix("organization.") else {
-            err_handler!("Malformed client_id")
+        let org_uuid = match claims.client_id.strip_prefix("organization.") {
+            Some(uuid) => uuid,
+            None => err_handler!("Malformed client_id"),
        };
-        let org_id: OrganizationId = org_id.to_string().into();
-        let Some(org_api_key) = OrganizationApiKey::find_by_org_uuid(&org_id, &conn).await else {
-            err_handler!("Invalid client_id")
+        let org_api_key = match OrganizationApiKey::find_by_org_uuid(org_uuid, &conn).await {
+            Some(org_api_key) => org_api_key,
+            None => err_handler!("Invalid client_id"),
        };
        if org_api_key.org_uuid != claims.client_sub {
            err_handler!("Token not issued for this org");
--- a/src/api/core/sends.rs
+++ b/src/api/core/sends.rs
@@ -1,9 +1,7 @@
 use std::path::Path;
-use std::time::Duration;

 use chrono::{DateTime, TimeDelta, Utc};
 use num_traits::ToPrimitive;
-use once_cell::sync::Lazy;
 use rocket::form::Form;
 use rocket::fs::NamedFile;
 use rocket::fs::TempFile;
@@ -13,28 +11,12 @@ use serde_json::Value;
 use crate::{
    api::{ApiResult, EmptyResult, JsonResult, Notify, UpdateType},
    auth::{ClientIp, Headers, Host},
-    config::PathType,
    db::{models::*, DbConn, DbPool},
-    util::{save_temp_file, NumberOrString},
+    util::{NumberOrString, SafeString},
    CONFIG,
 };

 const SEND_INACCESSIBLE_MSG: &str = "Send does not exist or is no longer available";
-static ANON_PUSH_DEVICE: Lazy<Device> = Lazy::new(|| {
-    let dt = crate::util::parse_date("1970-01-01T00:00:00.000000Z");
-    Device {
-        uuid: String::from("00000000-0000-0000-0000-000000000000").into(),
-        created_at: dt,
-        updated_at: dt,
-        user_uuid: String::from("00000000-0000-0000-0000-000000000000").into(),
-        name: String::new(),
-        atype: 14, // 14 == Unknown Browser
-        push_uuid: Some(String::from("00000000-0000-0000-0000-000000000000").into()),
-        push_token: None,
-        refresh_token: String::new(),
-        twofactor_remember: None,
-    }
-});

 // The max file size allowed by Bitwarden clients and add an extra 5% to avoid issues
 const SIZE_525_MB: i64 = 550_502_400;
@@ -85,7 +67,7 @@ pub struct SendData {
    file_length: Option<NumberOrString>,

    // Used for key rotations
-    pub id: Option<SendId>,
+    pub id: Option<String>,
 }

 /// Enforces the `Disable Send` policy. A non-owner/admin user belonging to
@@ -97,9 +79,9 @@ pub struct SendData {
 /// There is also a Vaultwarden-specific `sends_allowed` config setting that
 /// controls this policy globally.
 async fn enforce_disable_send_policy(headers: &Headers, conn: &mut DbConn) -> EmptyResult {
-    let user_id = &headers.user.uuid;
+    let user_uuid = &headers.user.uuid;
    if !CONFIG.sends_allowed()
-        || OrgPolicy::is_applicable_to_user(user_id, OrgPolicyType::DisableSend, None, conn).await
+        || OrgPolicy::is_applicable_to_user(user_uuid, OrgPolicyType::DisableSend, None, conn).await
    {
        err!("Due to an Enterprise Policy, you are only able to delete an existing Send.")
    }
@@ -113,9 +95,9 @@ async fn enforce_disable_send_policy(headers: &Headers, conn: &mut DbConn) -> Em
 ///
 /// Ref: https://bitwarden.com/help/article/policies/#send-options
 async fn enforce_disable_hide_email_policy(data: &SendData, headers: &Headers, conn: &mut DbConn) -> EmptyResult {
-    let user_id = &headers.user.uuid;
+    let user_uuid = &headers.user.uuid;
    let hide_email = data.hide_email.unwrap_or(false);
-    if hide_email && OrgPolicy::is_hide_email_disabled(user_id, conn).await {
+    if hide_email && OrgPolicy::is_hide_email_disabled(user_uuid, conn).await {
        err!(
            "Due to an Enterprise Policy, you are not allowed to hide your email address \
              from recipients when creating or editing a Send."
@@ -124,7 +106,7 @@ async fn enforce_disable_hide_email_policy(data: &SendData, headers: &Headers, c
    Ok(())
 }

-fn create_send(data: SendData, user_id: UserId) -> ApiResult<Send> {
+fn create_send(data: SendData, user_uuid: String) -> ApiResult<Send> {
    let data_val = if data.r#type == SendType::Text as i32 {
        data.text
    } else if data.r#type == SendType::File as i32 {
@@ -147,7 +129,7 @@ fn create_send(data: SendData, user_id: UserId) -> ApiResult<Send> {
    }

    let mut send = Send::new(data.r#type, data.name, data_str, data.key, data.deletion_date.naive_utc());
-    send.user_uuid = Some(user_id);
+    send.user_uuid = Some(user_uuid);
    send.notes = data.notes;
    send.max_access_count = match data.max_access_count {
        Some(m) => Some(m.into_i32()?),
@@ -175,12 +157,18 @@ async fn get_sends(headers: Headers, mut conn: DbConn) -> Json<Value> {
    }))
 }

-#[get("/sends/<send_id>")]
-async fn get_send(send_id: SendId, headers: Headers, mut conn: DbConn) -> JsonResult {
-    match Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await {
-        Some(send) => Ok(Json(send.to_json())),
-        None => err!("Send not found", "Invalid send uuid or does not belong to user"),
+#[get("/sends/<uuid>")]
+async fn get_send(uuid: &str, headers: Headers, mut conn: DbConn) -> JsonResult {
+    let send = match Send::find_by_uuid(uuid, &mut conn).await {
+        Some(send) => send,
+        None => err!("Send not found"),
+    };
+
+    if send.user_uuid.as_ref() != Some(&headers.user.uuid) {
+        err!("Send is not owned by user")
    }
+
+    Ok(Json(send.to_json()))
 }

 #[post("/sends", data = "<data>")]
@@ -200,7 +188,7 @@ async fn post_send(data: Json<SendData>, headers: Headers, mut conn: DbConn, nt:
        UpdateType::SyncSendCreate,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &headers.device,
+        &headers.device.uuid,
        &mut conn,
    )
    .await;
@@ -222,15 +210,13 @@ struct UploadDataV2<'f> {
 // @deprecated Mar 25 2021: This method has been deprecated in favor of direct uploads (v2).
 // This method still exists to support older clients, probably need to remove it sometime.
 // Upstream: https://github.com/bitwarden/server/blob/d0c793c95181dfb1b447eb450f85ba0bfd7ef643/src/Api/Controllers/SendsController.cs#L164-L167
-// 2025: This endpoint doesn't seem to exists anymore in the latest version
-// See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs
 #[post("/sends/file", format = "multipart/form-data", data = "<data>")]
 async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> JsonResult {
    enforce_disable_send_policy(&headers, &mut conn).await?;

    let UploadData {
        model,
-        data,
+        mut data,
    } = data.into_inner();
    let model = model.into_inner();

@@ -269,9 +255,14 @@ async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, mut conn:
        err!("Send content is not a file");
    }

-    let file_id = crate::crypto::generate_send_file_id();
+    let file_id = crate::crypto::generate_send_id();
+    let folder_path = tokio::fs::canonicalize(&CONFIG.sends_folder()).await?.join(&send.uuid);
+    let file_path = folder_path.join(&file_id);
+    tokio::fs::create_dir_all(&folder_path).await?;

-    save_temp_file(PathType::Sends, &format!("{}/{file_id}", send.uuid), data, true).await?;
+    if let Err(_err) = data.persist_to(&file_path).await {
+        data.move_copy_to(file_path).await?
+    }

    let mut data_value: Value = serde_json::from_str(&send.data)?;
    if let Some(o) = data_value.as_object_mut() {
@@ -287,7 +278,7 @@ async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, mut conn:
        UpdateType::SyncSendCreate,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &headers.device,
+        &headers.device.uuid,
        &mut conn,
    )
    .await;
@@ -295,7 +286,7 @@ async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, mut conn:
    Ok(Json(send.to_json()))
 }

-// Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L165
+// Upstream: https://github.com/bitwarden/server/blob/d0c793c95181dfb1b447eb450f85ba0bfd7ef643/src/Api/Controllers/SendsController.cs#L190
 #[post("/sends/file/v2", data = "<data>")]
 async fn post_send_file_v2(data: Json<SendData>, headers: Headers, mut conn: DbConn) -> JsonResult {
    enforce_disable_send_policy(&headers, &mut conn).await?;
@@ -339,7 +330,7 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, mut conn: DbC

    let mut send = create_send(data, headers.user.uuid)?;

-    let file_id = crate::crypto::generate_send_file_id();
+    let file_id = crate::crypto::generate_send_id();

    let mut data_value: Value = serde_json::from_str(&send.data)?;
    if let Some(o) = data_value.as_object_mut() {
@@ -353,7 +344,7 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, mut conn: DbC
    Ok(Json(json!({
        "fileUploadType": 0, // 0 == Direct | 1 == Azure
        "object": "send-fileUpload",
-        "url": format!("/sends/{}/file/{file_id}", send.uuid),
+        "url": format!("/sends/{}/file/{}", send.uuid, file_id),
        "sendResponse": send.to_json()
    })))
 }
@@ -361,16 +352,16 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, mut conn: DbC
 #[derive(Deserialize)]
 #[allow(non_snake_case)]
 pub struct SendFileData {
-    id: SendFileId,
+    id: String,
    size: u64,
    fileName: String,
 }

-// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L195
-#[post("/sends/<send_id>/file/<file_id>", format = "multipart/form-data", data = "<data>")]
+// https://github.com/bitwarden/server/blob/66f95d1c443490b653e5a15d32977e2f5a3f9e32/src/Api/Tools/Controllers/SendsController.cs#L250
+#[post("/sends/<send_uuid>/file/<file_id>", format = "multipart/form-data", data = "<data>")]
 async fn post_send_file_v2_data(
-    send_id: SendId,
-    file_id: SendFileId,
+    send_uuid: &str,
+    file_id: &str,
    data: Form<UploadDataV2<'_>>,
    headers: Headers,
    mut conn: DbConn,
@@ -378,26 +369,30 @@ async fn post_send_file_v2_data(
 ) -> EmptyResult {
    enforce_disable_send_policy(&headers, &mut conn).await?;

-    let data = data.into_inner();
+    let mut data = data.into_inner();

-    let Some(send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await else {
-        err!("Send not found. Unable to save the file.", "Invalid send uuid or does not belong to user.")
+    let Some(send) = Send::find_by_uuid(send_uuid, &mut conn).await else {
+        err!("Send not found. Unable to save the file.")
    };

    if send.atype != SendType::File as i32 {
        err!("Send is not a file type send.");
    }

+    let Some(send_user_id) = &send.user_uuid else {
+        err!("Sends are only supported for users at the moment.")
+    };
+
+    if send_user_id != &headers.user.uuid {
+        err!("Send doesn't belong to user.");
+    }
+
    let Ok(send_data) = serde_json::from_str::<SendFileData>(&send.data) else {
        err!("Unable to decode send data as json.")
    };

    match data.data.raw_name() {
-        Some(raw_file_name)
-            if raw_file_name.dangerous_unsafe_unsanitized_raw() == send_data.fileName
-            // be less strict only if using CLI, cf. https://github.com/dani-garcia/vaultwarden/issues/5614
-            || (headers.device.is_cli() && send_data.fileName.ends_with(raw_file_name.dangerous_unsafe_unsanitized_raw().as_str())
-            ) => {}
+        Some(raw_file_name) if raw_file_name.dangerous_unsafe_unsanitized_raw() == send_data.fileName => (),
        Some(raw_file_name) => err!(
            "Send file name does not match.",
            format!(
@@ -421,15 +416,25 @@ async fn post_send_file_v2_data(
        err!("Send file size does not match.", format!("Expected a file size of {} got {size}", send_data.size));
    }

-    let file_path = format!("{send_id}/{file_id}");
+    let folder_path = tokio::fs::canonicalize(&CONFIG.sends_folder()).await?.join(send_uuid);
+    let file_path = folder_path.join(file_id);

-    save_temp_file(PathType::Sends, &file_path, data.data, false).await?;
+    // Check if the file already exists, if that is the case do not overwrite it
+    if tokio::fs::metadata(&file_path).await.is_ok() {
+        err!("Send file has already been uploaded.", format!("File {file_path:?} already exists"))
+    }
+
+    tokio::fs::create_dir_all(&folder_path).await?;
+
+    if let Err(_err) = data.data.persist_to(&file_path).await {
+        data.data.move_copy_to(file_path).await?
+    }

    nt.send_send_update(
        UpdateType::SyncSendCreate,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &headers.device,
+        &headers.device.uuid,
        &mut conn,
    )
    .await;
@@ -451,8 +456,9 @@ async fn post_access(
    ip: ClientIp,
    nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(mut send) = Send::find_by_access_id(access_id, &mut conn).await else {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    let mut send = match Send::find_by_access_id(access_id, &mut conn).await {
+        Some(s) => s,
+        None => err_code!(SEND_INACCESSIBLE_MSG, 404),
    };

    if let Some(max_access_count) = send.max_access_count {
@@ -494,7 +500,7 @@ async fn post_access(
        UpdateType::SyncSendUpdate,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &ANON_PUSH_DEVICE,
+        &String::from("00000000-0000-0000-0000-000000000000"),
        &mut conn,
    )
    .await;
@@ -504,15 +510,16 @@ async fn post_access(

 #[post("/sends/<send_id>/access/file/<file_id>", data = "<data>")]
 async fn post_access_file(
-    send_id: SendId,
-    file_id: SendFileId,
+    send_id: &str,
+    file_id: &str,
    data: Json<SendAccessData>,
    host: Host,
    mut conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&send_id, &mut conn).await else {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    let mut send = match Send::find_by_uuid(send_id, &mut conn).await {
+        Some(s) => s,
+        None => err_code!(SEND_INACCESSIBLE_MSG, 404),
    };

    if let Some(max_access_count) = send.max_access_count {
@@ -551,33 +558,22 @@ async fn post_access_file(
        UpdateType::SyncSendUpdate,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &ANON_PUSH_DEVICE,
+        &String::from("00000000-0000-0000-0000-000000000000"),
        &mut conn,
    )
    .await;

+    let token_claims = crate::auth::generate_send_claims(send_id, file_id);
+    let token = crate::auth::encode_jwt(&token_claims);
    Ok(Json(json!({
        "object": "send-fileDownload",
        "id": file_id,
-        "url": download_url(&host, &send_id, &file_id).await?,
+        "url": format!("{}/api/sends/{}/{}?t={}", &host.host, send_id, file_id, token)
    })))
 }

-async fn download_url(host: &Host, send_id: &SendId, file_id: &SendFileId) -> Result<String, crate::Error> {
-    let operator = CONFIG.opendal_operator_for_path_type(PathType::Sends)?;
-
-    if operator.info().scheme() == opendal::Scheme::Fs {
-        let token_claims = crate::auth::generate_send_claims(send_id, file_id);
-        let token = crate::auth::encode_jwt(&token_claims);
-
-        Ok(format!("{}/api/sends/{send_id}/{file_id}?t={token}", &host.host))
-    } else {
-        Ok(operator.presign_read(&format!("{send_id}/{file_id}"), Duration::from_secs(5 * 60)).await?.uri().to_string())
-    }
-}
-
 #[get("/sends/<send_id>/<file_id>?<t>")]
-async fn download_send(send_id: SendId, file_id: SendFileId, t: &str) -> Option<NamedFile> {
+async fn download_send(send_id: SafeString, file_id: SafeString, t: &str) -> Option<NamedFile> {
    if let Ok(claims) = crate::auth::decode_send(t) {
        if claims.sub == format!("{send_id}/{file_id}") {
            return NamedFile::open(Path::new(&CONFIG.sends_folder()).join(send_id).join(file_id)).await.ok();
@@ -586,21 +582,16 @@ async fn download_send(send_id: SendId, file_id: SendFileId, t: &str) -> Option<
    None
 }

-#[put("/sends/<send_id>", data = "<data>")]
-async fn put_send(
-    send_id: SendId,
-    data: Json<SendData>,
-    headers: Headers,
-    mut conn: DbConn,
-    nt: Notify<'_>,
-) -> JsonResult {
+#[put("/sends/<id>", data = "<data>")]
+async fn put_send(id: &str, data: Json<SendData>, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> JsonResult {
    enforce_disable_send_policy(&headers, &mut conn).await?;

    let data: SendData = data.into_inner();
    enforce_disable_hide_email_policy(&data, &headers, &mut conn).await?;

-    let Some(mut send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await else {
-        err!("Send not found", "Send send_id is invalid or does not belong to user")
+    let mut send = match Send::find_by_uuid(id, &mut conn).await {
+        Some(s) => s,
+        None => err!("Send not found"),
    };

    update_send_from_data(&mut send, data, &headers, &mut conn, &nt, UpdateType::SyncSendUpdate).await?;
@@ -661,23 +652,28 @@ pub async fn update_send_from_data(

    send.save(conn).await?;
    if ut != UpdateType::None {
-        nt.send_send_update(ut, send, &send.update_users_revision(conn).await, &headers.device, conn).await;
+        nt.send_send_update(ut, send, &send.update_users_revision(conn).await, &headers.device.uuid, conn).await;
    }
    Ok(())
 }

-#[delete("/sends/<send_id>")]
-async fn delete_send(send_id: SendId, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    let Some(send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await else {
-        err!("Send not found", "Invalid send uuid, or does not belong to user")
+#[delete("/sends/<id>")]
+async fn delete_send(id: &str, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let send = match Send::find_by_uuid(id, &mut conn).await {
+        Some(s) => s,
+        None => err!("Send not found"),
    };

+    if send.user_uuid.as_ref() != Some(&headers.user.uuid) {
+        err!("Send is not owned by user")
+    }
+
    send.delete(&mut conn).await?;
    nt.send_send_update(
        UpdateType::SyncSendDelete,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &headers.device,
+        &headers.device.uuid,
        &mut conn,
    )
    .await;
@@ -685,21 +681,26 @@ async fn delete_send(send_id: SendId, headers: Headers, mut conn: DbConn, nt: No
    Ok(())
 }

-#[put("/sends/<send_id>/remove-password")]
-async fn put_remove_password(send_id: SendId, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> JsonResult {
+#[put("/sends/<id>/remove-password")]
+async fn put_remove_password(id: &str, headers: Headers, mut conn: DbConn, nt: Notify<'_>) -> JsonResult {
    enforce_disable_send_policy(&headers, &mut conn).await?;

-    let Some(mut send) = Send::find_by_uuid_and_user(&send_id, &headers.user.uuid, &mut conn).await else {
-        err!("Send not found", "Invalid send uuid, or does not belong to user")
+    let mut send = match Send::find_by_uuid(id, &mut conn).await {
+        Some(s) => s,
+        None => err!("Send not found"),
    };

+    if send.user_uuid.as_ref() != Some(&headers.user.uuid) {
+        err!("Send is not owned by user")
+    }
+
    send.set_password(None);
    send.save(&mut conn).await?;
    nt.send_send_update(
        UpdateType::SyncSendUpdate,
        &send,
        &send.update_users_revision(&mut conn).await,
-        &headers.device,
+        &headers.device.uuid,
        &mut conn,
    )
    .await;
--- a/src/api/core/two_factor/authenticator.rs
+++ b/src/api/core/two_factor/authenticator.rs
@@ -7,7 +7,7 @@ use crate::{
    auth::{ClientIp, Headers},
    crypto,
    db::{
-        models::{EventType, TwoFactor, TwoFactorType, UserId},
+        models::{EventType, TwoFactor, TwoFactorType},
        DbConn,
    },
    util::NumberOrString,
@@ -16,7 +16,7 @@ use crate::{
 pub use crate::config::CONFIG;

 pub fn routes() -> Vec<Route> {
-    routes![generate_authenticator, activate_authenticator, activate_authenticator_put, disable_authenticator]
+    routes![generate_authenticator, activate_authenticator, activate_authenticator_put,]
 }

 #[post("/two-factor/get-authenticator", data = "<data>")]
@@ -34,10 +34,6 @@ async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers,
        _ => (false, crypto::encode_random_bytes::<20>(BASE32)),
    };

-    // Upstream seems to also return `userVerificationToken`, but doesn't seem to be used at all.
-    // It should help prevent TOTP disclosure if someone keeps their vault unlocked.
-    // Since it doesn't seem to be used, and also does not cause any issues, lets leave it out of the response.
-    // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Controllers/TwoFactorController.cs#L94
    Ok(Json(json!({
        "enabled": enabled,
        "key": key,
@@ -99,7 +95,7 @@ async fn activate_authenticator_put(data: Json<EnableAuthenticatorData>, headers
 }

 pub async fn validate_totp_code_str(
-    user_id: &UserId,
+    user_uuid: &str,
    totp_code: &str,
    secret: &str,
    ip: &ClientIp,
@@ -109,11 +105,11 @@ pub async fn validate_totp_code_str(
        err!("TOTP code is not a number");
    }

-    validate_totp_code(user_id, totp_code, secret, ip, conn).await
+    validate_totp_code(user_uuid, totp_code, secret, ip, conn).await
 }

 pub async fn validate_totp_code(
-    user_id: &UserId,
+    user_uuid: &str,
    totp_code: &str,
    secret: &str,
    ip: &ClientIp,
@@ -121,15 +117,16 @@ pub async fn validate_totp_code(
 ) -> EmptyResult {
    use totp_lite::{totp_custom, Sha1};

-    let Ok(decoded_secret) = BASE32.decode(secret.as_bytes()) else {
-        err!("Invalid TOTP secret")
+    let decoded_secret = match BASE32.decode(secret.as_bytes()) {
+        Ok(s) => s,
+        Err(_) => err!("Invalid TOTP secret"),
    };

-    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
-    {
-        Some(tf) => tf,
-        _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_string()),
-    };
+    let mut twofactor =
+        match TwoFactor::find_by_user_and_type(user_uuid, TwoFactorType::Authenticator as i32, conn).await {
+            Some(tf) => tf,
+            _ => TwoFactor::new(user_uuid.to_string(), TwoFactorType::Authenticator, secret.to_string()),
+        };

    // The amount of steps back and forward in time
    // Also check if we need to disable time drifted TOTP codes.
@@ -152,7 +149,7 @@ pub async fn validate_totp_code(
        if generated == totp_code && time_step > twofactor.last_used {
            // If the step does not equals 0 the time is drifted either server or client side.
            if step != 0 {
-                warn!("TOTP Time drift detected. The step offset is {step}");
+                warn!("TOTP Time drift detected. The step offset is {}", step);
            }

            // Save the last used time step so only totp time steps higher then this one are allowed.
@@ -161,7 +158,7 @@ pub async fn validate_totp_code(
            twofactor.save(conn).await?;
            return Ok(());
        } else if generated == totp_code && time_step <= twofactor.last_used {
-            warn!("This TOTP or a TOTP code within {steps} steps back or forward has already been used!");
+            warn!("This TOTP or a TOTP code within {} steps back or forward has already been used!", steps);
            err!(
                format!("Invalid TOTP code! Server time: {} IP: {}", current_time.format("%F %T UTC"), ip.ip),
                ErrorEvent {
@@ -179,47 +176,3 @@ pub async fn validate_totp_code(
        }
    );
 }
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct DisableAuthenticatorData {
-    key: String,
-    master_password_hash: String,
-    r#type: NumberOrString,
-}
-
-#[delete("/two-factor/authenticator", data = "<data>")]
-async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, mut conn: DbConn) -> JsonResult {
-    let user = headers.user;
-    let type_ = data.r#type.into_i32()?;
-
-    if !user.check_valid_password(&data.master_password_hash) {
-        err!("Invalid password");
-    }
-
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &mut conn).await {
-        if twofactor.data == data.key {
-            twofactor.delete(&mut conn).await?;
-            log_user_event(
-                EventType::UserDisabled2fa as i32,
-                &user.uuid,
-                headers.device.atype,
-                &headers.ip.ip,
-                &mut conn,
-            )
-            .await;
-        } else {
-            err!(format!("TOTP key for user {} does not match recorded value, cannot deactivate", &user.email));
-        }
-    }
-
-    if TwoFactor::find_by_user(&user.uuid, &mut conn).await.is_empty() {
-        super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &mut conn).await?;
-    }
-
-    Ok(Json(json!({
-        "enabled": false,
-        "keys": type_,
-        "object": "twoFactorProvider"
-    })))
-}
--- a/src/api/core/two_factor/duo.rs
+++ b/src/api/core/two_factor/duo.rs
@@ -11,7 +11,7 @@ use crate::{
    auth::Headers,
    crypto,
    db::{
-        models::{EventType, TwoFactor, TwoFactorType, User, UserId},
+        models::{EventType, TwoFactor, TwoFactorType, User},
        DbConn,
    },
    error::MapResult,
@@ -26,8 +26,8 @@ pub fn routes() -> Vec<Route> {
 #[derive(Serialize, Deserialize)]
 struct DuoData {
    host: String, // Duo API hostname
-    ik: String,   // client id
-    sk: String,   // client secret
+    ik: String,   // integration key
+    sk: String,   // secret key
 }

 impl DuoData {
@@ -111,16 +111,13 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, mut conn: DbCo
        json!({
            "enabled": enabled,
            "host": data.host,
-            "clientSecret": data.sk,
-            "clientId": data.ik,
+            "secretKey": data.sk,
+            "integrationKey": data.ik,
            "object": "twoFactorDuo"
        })
    } else {
        json!({
            "enabled": enabled,
-            "host": null,
-            "clientSecret": null,
-            "clientId": null,
            "object": "twoFactorDuo"
        })
    };
@@ -132,8 +129,8 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, mut conn: DbCo
 #[serde(rename_all = "camelCase")]
 struct EnableDuoData {
    host: String,
-    client_secret: String,
-    client_id: String,
+    secret_key: String,
+    integration_key: String,
    master_password_hash: Option<String>,
    otp: Option<String>,
 }
@@ -142,8 +139,8 @@ impl From<EnableDuoData> for DuoData {
    fn from(d: EnableDuoData) -> Self {
        Self {
            host: d.host,
-            ik: d.client_id,
-            sk: d.client_secret,
+            ik: d.integration_key,
+            sk: d.secret_key,
        }
    }
 }
@@ -154,7 +151,7 @@ fn check_duo_fields_custom(data: &EnableDuoData) -> bool {
        st.is_empty() || s == DISABLED_MESSAGE_DEFAULT
    }

-    !empty_or_default(&data.host) && !empty_or_default(&data.client_secret) && !empty_or_default(&data.client_id)
+    !empty_or_default(&data.host) && !empty_or_default(&data.secret_key) && !empty_or_default(&data.integration_key)
 }

 #[post("/two-factor/duo", data = "<data>")]
@@ -189,8 +186,8 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, mut conn: DbC
    Ok(Json(json!({
        "enabled": true,
        "host": data.host,
-        "clientSecret": data.sk,
-        "clientId": data.ik,
+        "secretKey": data.sk,
+        "integrationKey": data.ik,
        "object": "twoFactorDuo"
    })))
 }
@@ -205,7 +202,7 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
    use std::str::FromStr;

    // https://duo.com/docs/authapi#api-details
-    let url = format!("https://{}{path}", &data.host);
+    let url = format!("https://{}{}", &data.host, path);
    let date = Utc::now().to_rfc2822();
    let username = &data.ik;
    let fields = [&date, method, &data.host, path, params];
@@ -231,12 +228,13 @@ const AUTH_PREFIX: &str = "AUTH";
 const DUO_PREFIX: &str = "TX";
 const APP_PREFIX: &str = "APP";

-async fn get_user_duo_data(user_id: &UserId, conn: &mut DbConn) -> DuoStatus {
+async fn get_user_duo_data(uuid: &str, conn: &mut DbConn) -> DuoStatus {
    let type_ = TwoFactorType::Duo as i32;

    // If the user doesn't have an entry, disabled
-    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await else {
-        return DuoStatus::Disabled(DuoData::global().is_some());
+    let twofactor = match TwoFactor::find_by_user_and_type(uuid, type_, conn).await {
+        Some(t) => t,
+        None => return DuoStatus::Disabled(DuoData::global().is_some()),
    };

    // If the user has the required values, we use those
@@ -261,7 +259,7 @@ pub(crate) async fn get_duo_keys_email(email: &str, conn: &mut DbConn) -> ApiRes
    }
    .map_res("Can't fetch Duo Keys")?;

-    Ok((data.ik, data.sk, CONFIG.get_duo_akey().await, data.host))
+    Ok((data.ik, data.sk, CONFIG.get_duo_akey(), data.host))
 }

 pub async fn generate_duo_signature(email: &str, conn: &mut DbConn) -> ApiResult<(String, String)> {
@@ -277,9 +275,9 @@ pub async fn generate_duo_signature(email: &str, conn: &mut DbConn) -> ApiResult

 fn sign_duo_values(key: &str, email: &str, ikey: &str, prefix: &str, expire: i64) -> String {
    let val = format!("{email}|{ikey}|{expire}");
-    let cookie = format!("{prefix}|{}", BASE64.encode(val.as_bytes()));
+    let cookie = format!("{}|{}", prefix, BASE64.encode(val.as_bytes()));

-    format!("{cookie}|{}", crypto::hmac_sign(key, &cookie))
+    format!("{}|{}", cookie, crypto::hmac_sign(key, &cookie))
 }

 pub async fn validate_duo_login(email: &str, response: &str, conn: &mut DbConn) -> EmptyResult {
@@ -335,12 +333,14 @@ fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -
        err!("Prefixes don't match")
    }

-    let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else {
-        err!("Invalid Duo cookie encoding")
+    let cookie_vec = match BASE64.decode(u_b64.as_bytes()) {
+        Ok(c) => c,
+        Err(_) => err!("Invalid Duo cookie encoding"),
    };

-    let Ok(cookie) = String::from_utf8(cookie_vec) else {
-        err!("Invalid Duo cookie encoding")
+    let cookie = match String::from_utf8(cookie_vec) {
+        Ok(c) => c,
+        Err(_) => err!("Invalid Duo cookie encoding"),
    };

    let cookie_split: Vec<&str> = cookie.split('|').collect();
--- a/src/api/core/two_factor/duo_oidc.rs
+++ b/src/api/core/two_factor/duo_oidc.rs
@@ -10,7 +10,7 @@ use crate::{
    api::{core::two_factor::duo::get_duo_keys_email, EmptyResult},
    crypto,
    db::{
-        models::{DeviceId, EventType, TwoFactorDuoContext},
+        models::{EventType, TwoFactorDuoContext},
        DbConn, DbPool,
    },
    error::Error,
@@ -21,7 +21,7 @@ use url::Url;

 // The location on this service that Duo should redirect users to. For us, this is a bridge
 // built in to the Bitwarden clients.
-// See: https://github.com/bitwarden/clients/blob/5fb46df3415aefced0b52f2db86c873962255448/apps/web/src/connectors/duo-redirect.ts
+// See: https://github.com/bitwarden/clients/blob/main/apps/web/src/connectors/duo-redirect.ts
 const DUO_REDIRECT_LOCATION: &str = "duo-redirect-connector.html";

 // Number of seconds that a JWT we generate for Duo should be valid for.
@@ -182,7 +182,7 @@ impl DuoClient {
            HealthCheckResponse::HealthFail {
                message,
                message_detail,
-            } => err!(format!("Duo health check FAIL response, msg: {message}, detail: {message_detail}")),
+            } => err!(format!("Duo health check FAIL response, msg: {}, detail: {}", message, message_detail)),
        };

        if health_stat != "OK" {
@@ -211,7 +211,10 @@ impl DuoClient {
            nonce,
        };

-        let token = self.encode_duo_jwt(jwt_payload)?;
+        let token = match self.encode_duo_jwt(jwt_payload) {
+            Ok(token) => token,
+            Err(e) => return Err(e),
+        };

        let authz_endpoint = format!("https://{}/oauth/v1/authorize", self.api_host);
        let mut auth_url = match Url::parse(authz_endpoint.as_str()) {
@@ -275,7 +278,7 @@ impl DuoClient {

        let status_code = res.status();
        if status_code != StatusCode::OK {
-            err!(format!("Failure response from Duo: {status_code}"))
+            err!(format!("Failure response from Duo: {}", status_code))
        }

        let response: IdTokenResponse = match res.json::<IdTokenResponse>().await {
@@ -379,7 +382,7 @@ fn make_callback_url(client_name: &str) -> Result<String, Error> {
 pub async fn get_duo_auth_url(
    email: &str,
    client_id: &str,
-    device_identifier: &DeviceId,
+    device_identifier: &String,
    conn: &mut DbConn,
 ) -> Result<String, Error> {
    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
@@ -417,7 +420,7 @@ pub async fn validate_duo_login(
    email: &str,
    two_factor_token: &str,
    client_id: &str,
-    device_identifier: &DeviceId,
+    device_identifier: &str,
    conn: &mut DbConn,
 ) -> EmptyResult {
    // Result supplied to us by clients in the form "<authz code>|<state>"
@@ -478,7 +481,7 @@ pub async fn validate_duo_login(
        Err(e) => return Err(e),
    };

-    let d: Digest = digest(&SHA512_256, format!("{}{device_identifier}", ctx.nonce).as_bytes());
+    let d: Digest = digest(&SHA512_256, format!("{}{}", ctx.nonce, device_identifier).as_bytes());
    let hash: String = HEXLOWER.encode(d.as_ref());

    match client.exchange_authz_code_for_result(code, email, hash.as_str()).await {
--- a/src/api/core/two_factor/email.rs
+++ b/src/api/core/two_factor/email.rs
@@ -10,7 +10,7 @@ use crate::{
    auth::Headers,
    crypto,
    db::{
-        models::{EventType, TwoFactor, TwoFactorType, User, UserId},
+        models::{EventType, TwoFactor, TwoFactorType, User},
        DbConn,
    },
    error::{Error, MapResult},
@@ -40,8 +40,9 @@ async fn send_email_login(data: Json<SendEmailLoginData>, mut conn: DbConn) -> E
    use crate::db::models::User;

    // Get the user
-    let Some(user) = User::find_by_mail(&data.email, &mut conn).await else {
-        err!("Username or password is incorrect. Try again.")
+    let user = match User::find_by_mail(&data.email, &mut conn).await {
+        Some(user) => user,
+        None => err!("Username or password is incorrect. Try again."),
    };

    // Check password
@@ -59,9 +60,10 @@ async fn send_email_login(data: Json<SendEmailLoginData>, mut conn: DbConn) -> E
 }

 /// Generate the token, save the data for later verification and send email to user
-pub async fn send_token(user_id: &UserId, conn: &mut DbConn) -> EmptyResult {
+pub async fn send_token(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
    let type_ = TwoFactorType::Email as i32;
-    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, type_, conn).await.map_res("Two factor not found")?;
+    let mut twofactor =
+        TwoFactor::find_by_user_and_type(user_uuid, type_, conn).await.map_res("Two factor not found")?;

    let generated_token = crypto::generate_email_token(CONFIG.email_token_size());

@@ -172,8 +174,9 @@ async fn email(data: Json<EmailData>, headers: Headers, mut conn: DbConn) -> Jso

    let mut email_data = EmailTokenData::from_json(&twofactor.data)?;

-    let Some(issued_token) = &email_data.last_token else {
-        err!("No token available")
+    let issued_token = match &email_data.last_token {
+        Some(t) => t,
+        _ => err!("No token available"),
    };

    if !crypto::ct_eq(issued_token, data.token) {
@@ -197,24 +200,19 @@ async fn email(data: Json<EmailData>, headers: Headers, mut conn: DbConn) -> Jso
 }

 /// Validate the email code when used as TwoFactor token mechanism
-pub async fn validate_email_code_str(
-    user_id: &UserId,
-    token: &str,
-    data: &str,
-    ip: &std::net::IpAddr,
-    conn: &mut DbConn,
-) -> EmptyResult {
+pub async fn validate_email_code_str(user_uuid: &str, token: &str, data: &str, conn: &mut DbConn) -> EmptyResult {
    let mut email_data = EmailTokenData::from_json(data)?;
-    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email as i32, conn)
+    let mut twofactor = TwoFactor::find_by_user_and_type(user_uuid, TwoFactorType::Email as i32, conn)
        .await
        .map_res("Two factor not found")?;
-    let Some(issued_token) = &email_data.last_token else {
-        err!(
-            format!("No token available! IP: {ip}"),
+    let issued_token = match &email_data.last_token {
+        Some(t) => t,
+        _ => err!(
+            "No token available",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
-        )
+        ),
    };

    if !crypto::ct_eq(issued_token, token) {
@@ -226,7 +224,7 @@ pub async fn validate_email_code_str(
        twofactor.save(conn).await?;

        err!(
-            format!("Token is invalid! IP: {ip}"),
+            "Token is invalid",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
@@ -329,11 +327,11 @@ pub fn obscure_email(email: &str) -> String {
        }
    };

-    format!("{new_name}@{domain}")
+    format!("{}@{}", new_name, &domain)
 }

-pub async fn find_and_activate_email_2fa(user_id: &UserId, conn: &mut DbConn) -> EmptyResult {
-    if let Some(user) = User::find_by_uuid(user_id, conn).await {
+pub async fn find_and_activate_email_2fa(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
+    if let Some(user) = User::find_by_uuid(user_uuid, conn).await {
        activate_email_2fa(&user, conn).await
    } else {
        err!("User not found!");
--- a/src/api/core/two_factor/mod.rs
+++ b/src/api/core/two_factor/mod.rs
@@ -85,8 +85,9 @@ async fn recover(data: Json<RecoverTwoFactor>, client_headers: ClientHeaders, mu
    use crate::db::models::User;

    // Get the user
-    let Some(mut user) = User::find_by_mail(&data.email, &mut conn).await else {
-        err!("Username or password is incorrect. Try again.")
+    let mut user = match User::find_by_mail(&data.email, &mut conn).await {
+        Some(user) => user,
+        None => err!("Username or password is incorrect. Try again."),
    };

    // Check password
@@ -173,16 +174,17 @@ async fn disable_twofactor_put(data: Json<DisableTwoFactorData>, headers: Header

 pub async fn enforce_2fa_policy(
    user: &User,
-    act_user_id: &UserId,
+    act_uuid: &str,
    device_type: i32,
    ip: &std::net::IpAddr,
    conn: &mut DbConn,
 ) -> EmptyResult {
-    for member in
-        Membership::find_by_user_and_policy(&user.uuid, OrgPolicyType::TwoFactorAuthentication, conn).await.into_iter()
+    for member in UserOrganization::find_by_user_and_policy(&user.uuid, OrgPolicyType::TwoFactorAuthentication, conn)
+        .await
+        .into_iter()
    {
        // Policy only applies to non-Owner/non-Admin members who have accepted joining the org
-        if member.atype < MembershipType::Admin {
+        if member.atype < UserOrgType::Admin {
            if CONFIG.mail_enabled() {
                let org = Organization::find_by_uuid(&member.org_uuid, conn).await.unwrap();
                mail::send_2fa_removed_from_org(&user.email, &org.name).await?;
@@ -195,7 +197,7 @@ pub async fn enforce_2fa_policy(
                EventType::OrganizationUserRevoked as i32,
                &member.uuid,
                &member.org_uuid,
-                act_user_id,
+                act_uuid,
                device_type,
                ip,
                conn,
@@ -208,16 +210,16 @@ pub async fn enforce_2fa_policy(
 }

 pub async fn enforce_2fa_policy_for_org(
-    org_id: &OrganizationId,
-    act_user_id: &UserId,
+    org_uuid: &str,
+    act_uuid: &str,
    device_type: i32,
    ip: &std::net::IpAddr,
    conn: &mut DbConn,
 ) -> EmptyResult {
-    let org = Organization::find_by_uuid(org_id, conn).await.unwrap();
-    for member in Membership::find_confirmed_by_org(org_id, conn).await.into_iter() {
+    let org = Organization::find_by_uuid(org_uuid, conn).await.unwrap();
+    for member in UserOrganization::find_confirmed_by_org(org_uuid, conn).await.into_iter() {
        // Don't enforce the policy for Admins and Owners.
-        if member.atype < MembershipType::Admin && TwoFactor::find_by_user(&member.user_uuid, conn).await.is_empty() {
+        if member.atype < UserOrgType::Admin && TwoFactor::find_by_user(&member.user_uuid, conn).await.is_empty() {
            if CONFIG.mail_enabled() {
                let user = User::find_by_uuid(&member.user_uuid, conn).await.unwrap();
                mail::send_2fa_removed_from_org(&user.email, &org.name).await?;
@@ -229,8 +231,8 @@ pub async fn enforce_2fa_policy_for_org(
            log_event(
                EventType::OrganizationUserRevoked as i32,
                &member.uuid,
-                org_id,
-                act_user_id,
+                org_uuid,
+                act_uuid,
                device_type,
                ip,
                conn,
--- a/src/api/core/two_factor/protected_actions.rs
+++ b/src/api/core/two_factor/protected_actions.rs
@@ -6,7 +6,7 @@ use crate::{
    auth::Headers,
    crypto,
    db::{
-        models::{TwoFactor, TwoFactorType, UserId},
+        models::{TwoFactor, TwoFactorType},
        DbConn,
    },
    error::{Error, MapResult},
@@ -104,11 +104,11 @@ async fn verify_otp(data: Json<ProtectedActionVerify>, headers: Headers, mut con

 pub async fn validate_protected_action_otp(
    otp: &str,
-    user_id: &UserId,
+    user_uuid: &str,
    delete_if_valid: bool,
    conn: &mut DbConn,
 ) -> EmptyResult {
-    let pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions as i32, conn)
+    let pa = TwoFactor::find_by_user_and_type(user_uuid, TwoFactorType::ProtectedActions as i32, conn)
        .await
        .map_res("Protected action token not found, try sending the code again or restart the process")?;
    let mut pa_data = ProtectedActionData::from_json(&pa.data)?;
--- a/src/api/core/two_factor/webauthn.rs
+++ b/src/api/core/two_factor/webauthn.rs
@@ -11,7 +11,7 @@ use crate::{
    },
    auth::Headers,
    db::{
-        models::{EventType, TwoFactor, TwoFactorType, UserId},
+        models::{EventType, TwoFactor, TwoFactorType},
        DbConn,
    },
    error::Error,
@@ -148,7 +148,7 @@ async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Hea
    )?;

    let type_ = TwoFactorType::WebauthnRegisterChallenge;
-    TwoFactor::new(user.uuid.clone(), type_, serde_json::to_string(&state)?).save(&mut conn).await?;
+    TwoFactor::new(user.uuid, type_, serde_json::to_string(&state)?).save(&mut conn).await?;

    let mut challenge_value = serde_json::to_value(challenge.public_key)?;
    challenge_value["status"] = "ok".into();
@@ -309,16 +309,17 @@ async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, mut conn:
        err!("Invalid password");
    }

-    let Some(mut tf) =
-        TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &mut conn).await
-    else {
-        err!("Webauthn data not found!")
-    };
+    let mut tf =
+        match TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &mut conn).await {
+            Some(tf) => tf,
+            None => err!("Webauthn data not found!"),
+        };

    let mut data: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;

-    let Some(item_pos) = data.iter().position(|r| r.id == id) else {
-        err!("Webauthn entry not found")
+    let item_pos = match data.iter().position(|r| r.id == id) {
+        Some(p) => p,
+        None => err!("Webauthn entry not found"),
    };

    let removed_item = data.remove(item_pos);
@@ -352,20 +353,20 @@ async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, mut conn:
 }

 pub async fn get_webauthn_registrations(
-    user_id: &UserId,
+    user_uuid: &str,
    conn: &mut DbConn,
 ) -> Result<(bool, Vec<WebauthnRegistration>), Error> {
    let type_ = TwoFactorType::Webauthn as i32;
-    match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
+    match TwoFactor::find_by_user_and_type(user_uuid, type_, conn).await {
        Some(tf) => Ok((tf.enabled, serde_json::from_str(&tf.data)?)),
        None => Ok((false, Vec::new())), // If no data, return empty list
    }
 }

-pub async fn generate_webauthn_login(user_id: &UserId, conn: &mut DbConn) -> JsonResult {
+pub async fn generate_webauthn_login(user_uuid: &str, conn: &mut DbConn) -> JsonResult {
    // Load saved credentials
    let creds: Vec<Credential> =
-        get_webauthn_registrations(user_id, conn).await?.1.into_iter().map(|r| r.credential).collect();
+        get_webauthn_registrations(user_uuid, conn).await?.1.into_iter().map(|r| r.credential).collect();

    if creds.is_empty() {
        err!("No Webauthn devices registered")
@@ -376,7 +377,7 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &mut DbConn) -> Jso
    let (response, state) = WebauthnConfig::load().generate_challenge_authenticate_options(creds, Some(ext))?;

    // Save the challenge state for later validation
-    TwoFactor::new(user_id.clone(), TwoFactorType::WebauthnLoginChallenge, serde_json::to_string(&state)?)
+    TwoFactor::new(user_uuid.into(), TwoFactorType::WebauthnLoginChallenge, serde_json::to_string(&state)?)
        .save(conn)
        .await?;

@@ -384,9 +385,9 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &mut DbConn) -> Jso
    Ok(Json(serde_json::to_value(response.public_key)?))
 }

-pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &mut DbConn) -> EmptyResult {
+pub async fn validate_webauthn_login(user_uuid: &str, response: &str, conn: &mut DbConn) -> EmptyResult {
    let type_ = TwoFactorType::WebauthnLoginChallenge as i32;
-    let state = match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
+    let state = match TwoFactor::find_by_user_and_type(user_uuid, type_, conn).await {
        Some(tf) => {
            let state: AuthenticationState = serde_json::from_str(&tf.data)?;
            tf.delete(conn).await?;
@@ -403,7 +404,7 @@ pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &mu
    let rsp: PublicKeyCredentialCopy = serde_json::from_str(response)?;
    let rsp: PublicKeyCredential = rsp.into();

-    let mut registrations = get_webauthn_registrations(user_id, conn).await?.1;
+    let mut registrations = get_webauthn_registrations(user_uuid, conn).await?.1;

    // If the credential we received is migrated from U2F, enable the U2F compatibility
    //let use_u2f = registrations.iter().any(|r| r.migrated && r.credential.cred_id == rsp.raw_id.0);
@@ -413,7 +414,7 @@ pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &mu
        if &reg.credential.cred_id == cred_id {
            reg.credential.counter = auth_data.counter;

-            TwoFactor::new(user_id.clone(), TwoFactorType::Webauthn, serde_json::to_string(&registrations)?)
+            TwoFactor::new(user_uuid.to_string(), TwoFactorType::Webauthn, serde_json::to_string(&registrations)?)
                .save(conn)
                .await?;
            return Ok(());
--- a/src/api/core/two_factor/yubikey.rs
+++ b/src/api/core/two_factor/yubikey.rs
@@ -92,10 +92,10 @@ async fn generate_yubikey(data: Json<PasswordOrOtpData>, headers: Headers, mut c

    data.validate(&user, false, &mut conn).await?;

-    let user_id = &user.uuid;
+    let user_uuid = &user.uuid;
    let yubikey_type = TwoFactorType::YubiKey as i32;

-    let r = TwoFactor::find_by_user_and_type(user_id, yubikey_type, &mut conn).await;
+    let r = TwoFactor::find_by_user_and_type(user_uuid, yubikey_type, &mut conn).await;

    if let Some(r) = r {
        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
@@ -145,14 +145,15 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, mut c

    // Ensure they are valid OTPs
    for yubikey in &yubikeys {
-        if yubikey.is_empty() || yubikey.len() == 12 {
+        if yubikey.len() == 12 {
+            // YubiKey ID
            continue;
        }

        verify_yubikey_otp(yubikey.to_owned()).await.map_res("Invalid Yubikey OTP provided")?;
    }

-    let yubikey_ids: Vec<String> = yubikeys.into_iter().filter_map(|x| x.get(..12).map(str::to_owned)).collect();
+    let yubikey_ids: Vec<String> = yubikeys.into_iter().map(|x| (x[..12]).to_owned()).collect();

    let yubikey_metadata = YubikeyMetadata {
        keys: yubikey_ids,
--- a/src/api/icons.rs
+++ b/src/api/icons.rs
@@ -14,12 +14,14 @@ use reqwest::{
    Client, Response,
 };
 use rocket::{http::ContentType, response::Redirect, Route};
-use svg_hush::{data_url_filter, Filter};
+use tokio::{
+    fs::{create_dir_all, remove_file, symlink_metadata, File},
+    io::{AsyncReadExt, AsyncWriteExt},
+};

-use html5gum::{Emitter, HtmlString, Readable, StringReader, Tokenizer};
+use html5gum::{Emitter, HtmlString, InfallibleTokenizer, Readable, StringReader, Tokenizer};

 use crate::{
-    config::PathType,
    error::Error,
    http_client::{get_reqwest_client_builder, should_block_address, CustomHttpClientError},
    util::Cached,
@@ -36,29 +38,11 @@ pub fn routes() -> Vec<Route> {
 static CLIENT: Lazy<Client> = Lazy::new(|| {
    // Generate the default headers
    let mut default_headers = HeaderMap::new();
-    default_headers.insert(
-        header::USER_AGENT,
-        HeaderValue::from_static(
-            "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36",
-        ),
-    );
-    default_headers.insert(header::ACCEPT, HeaderValue::from_static("text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"));
-    default_headers.insert(header::ACCEPT_LANGUAGE, HeaderValue::from_static("en-US,en;q=0.9"));
+    default_headers.insert(header::USER_AGENT, HeaderValue::from_static("Links (2.22; Linux X86_64; GNU C; text)"));
+    default_headers.insert(header::ACCEPT, HeaderValue::from_static("text/html, text/*;q=0.5, image/*, */*;q=0.1"));
+    default_headers.insert(header::ACCEPT_LANGUAGE, HeaderValue::from_static("en,*;q=0.1"));
    default_headers.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-cache"));
    default_headers.insert(header::PRAGMA, HeaderValue::from_static("no-cache"));
-    default_headers.insert(header::UPGRADE_INSECURE_REQUESTS, HeaderValue::from_static("1"));
-
-    default_headers.insert("Sec-Ch-Ua-Mobile", HeaderValue::from_static("?0"));
-    default_headers.insert("Sec-Ch-Ua-Platform", HeaderValue::from_static("Linux"));
-    default_headers.insert(
-        "Sec-Ch-Ua",
-        HeaderValue::from_static("\"Not)A;Brand\";v=\"8\", \"Chromium\";v=\"138\", \"Google Chrome\";v=\"138\""),
-    );
-
-    default_headers.insert("Sec-Fetch-Site", HeaderValue::from_static("none"));
-    default_headers.insert("Sec-Fetch-Mode", HeaderValue::from_static("navigate"));
-    default_headers.insert("Sec-Fetch-User", HeaderValue::from_static("?1"));
-    default_headers.insert("Sec-Fetch-Dest", HeaderValue::from_static("document"));

    // Generate the cookie store
    let cookie_store = Arc::new(Jar::default());
@@ -72,7 +56,6 @@ static CLIENT: Lazy<Client> = Lazy::new(|| {
        .pool_max_idle_per_host(5) // Configure the Hyper Pool to only have max 5 idle connections
        .pool_idle_timeout(pool_idle_timeout) // Configure the Hyper Pool to timeout after 10 seconds
        .default_headers(default_headers.clone())
-        .http1_title_case_headers()
        .build()
        .expect("Failed to build client")
 });
@@ -80,18 +63,15 @@ static CLIENT: Lazy<Client> = Lazy::new(|| {
 // Build Regex only once since this takes a lot of time.
 static ICON_SIZE_REGEX: Lazy<Regex> = Lazy::new(|| Regex::new(r"(?x)(\d+)\D*(\d+)").unwrap());

-// The function name `icon_external` is checked in the `on_response` function in `AppHeaders`
-// It is used to prevent sending a specific header which breaks icon downloads.
-// If this function needs to be renamed, also adjust the code in `util.rs`
 #[get("/<domain>/icon.png")]
 fn icon_external(domain: &str) -> Option<Redirect> {
    if !is_valid_domain(domain) {
-        warn!("Invalid domain: {domain}");
+        warn!("Invalid domain: {}", domain);
        return None;
    }

    if should_block_address(domain) {
-        warn!("Blocked address: {domain}");
+        warn!("Blocked address: {}", domain);
        return None;
    }

@@ -113,7 +93,7 @@ async fn icon_internal(domain: &str) -> Cached<(ContentType, Vec<u8>)> {
    const FALLBACK_ICON: &[u8] = include_bytes!("../static/images/fallback-icon.png");

    if !is_valid_domain(domain) {
-        warn!("Invalid domain: {domain}");
+        warn!("Invalid domain: {}", domain);
        return Cached::ttl(
            (ContentType::new("image", "png"), FALLBACK_ICON.to_vec()),
            CONFIG.icon_cache_negttl(),
@@ -122,7 +102,7 @@ async fn icon_internal(domain: &str) -> Cached<(ContentType, Vec<u8>)> {
    }

    if should_block_address(domain) {
-        warn!("Blocked address: {domain}");
+        warn!("Blocked address: {}", domain);
        return Cached::ttl(
            (ContentType::new("image", "png"), FALLBACK_ICON.to_vec()),
            CONFIG.icon_cache_negttl(),
@@ -147,7 +127,7 @@ fn is_valid_domain(domain: &str) -> bool {

    // If parsing the domain fails using Url, it will not work with reqwest.
    if let Err(parse_error) = url::Url::parse(format!("https://{domain}").as_str()) {
-        debug!("Domain parse error: '{domain}' - {parse_error:?}");
+        debug!("Domain parse error: '{}' - {:?}", domain, parse_error);
        return false;
    } else if domain.is_empty()
        || domain.contains("..")
@@ -156,17 +136,18 @@ fn is_valid_domain(domain: &str) -> bool {
        || domain.ends_with('-')
    {
        debug!(
-            "Domain validation error: '{domain}' is either empty, contains '..', starts with an '.', starts or ends with a '-'"
+            "Domain validation error: '{}' is either empty, contains '..', starts with an '.', starts or ends with a '-'",
+            domain
        );
        return false;
    } else if domain.len() > 255 {
-        debug!("Domain validation error: '{domain}' exceeds 255 characters");
+        debug!("Domain validation error: '{}' exceeds 255 characters", domain);
        return false;
    }

    for c in domain.chars() {
        if !c.is_alphanumeric() && !ALLOWED_CHARS.contains(c) {
-            debug!("Domain validation error: '{domain}' contains an invalid character '{c}'");
+            debug!("Domain validation error: '{}' contains an invalid character '{}'", domain, c);
            return false;
        }
    }
@@ -175,7 +156,7 @@ fn is_valid_domain(domain: &str) -> bool {
 }

 async fn get_icon(domain: &str) -> Option<(Vec<u8>, String)> {
-    let path = format!("{domain}.png");
+    let path = format!("{}/{}.png", CONFIG.icon_cache_folder(), domain);

    // Check for expiration of negatively cached copy
    if icon_is_negcached(&path).await {
@@ -183,7 +164,10 @@ async fn get_icon(domain: &str) -> Option<(Vec<u8>, String)> {
    }

    if let Some(icon) = get_cached_icon(&path).await {
-        let icon_type = get_icon_type(&icon).unwrap_or("x-icon");
+        let icon_type = match get_icon_type(&icon) {
+            Some(x) => x,
+            _ => "x-icon",
+        };
        return Some((icon, icon_type.to_string()));
    }

@@ -194,7 +178,7 @@ async fn get_icon(domain: &str) -> Option<(Vec<u8>, String)> {
    // Get the icon, or None in case of error
    match download_icon(domain).await {
        Ok((icon, icon_type)) => {
-            save_icon(&path, icon.to_vec()).await;
+            save_icon(&path, &icon).await;
            Some((icon.to_vec(), icon_type.unwrap_or("x-icon").to_string()))
        }
        Err(e) => {
@@ -205,9 +189,9 @@ async fn get_icon(domain: &str) -> Option<(Vec<u8>, String)> {
                return None;
            }

-            warn!("Unable to download icon: {e:?}");
+            warn!("Unable to download icon: {:?}", e);
            let miss_indicator = path + ".miss";
-            save_icon(&miss_indicator, vec![]).await;
+            save_icon(&miss_indicator, &[]).await;
            None
        }
    }
@@ -220,9 +204,11 @@ async fn get_cached_icon(path: &str) -> Option<Vec<u8>> {
    }

    // Try to read the cached icon, and return it if it exists
-    if let Ok(operator) = CONFIG.opendal_operator_for_path_type(PathType::IconCache) {
-        if let Ok(buf) = operator.read(path).await {
-            return Some(buf.to_vec());
+    if let Ok(mut f) = File::open(path).await {
+        let mut buffer = Vec::new();
+
+        if f.read_to_end(&mut buffer).await.is_ok() {
+            return Some(buffer);
        }
    }

@@ -230,11 +216,9 @@ async fn get_cached_icon(path: &str) -> Option<Vec<u8>> {
 }

 async fn file_is_expired(path: &str, ttl: u64) -> Result<bool, Error> {
-    let operator = CONFIG.opendal_operator_for_path_type(PathType::IconCache)?;
-    let meta = operator.stat(path).await?;
-    let modified =
-        meta.last_modified().ok_or_else(|| std::io::Error::other(format!("No last modified time for `{path}`")))?;
-    let age = SystemTime::now().duration_since(modified.into())?;
+    let meta = symlink_metadata(path).await?;
+    let modified = meta.modified()?;
+    let age = SystemTime::now().duration_since(modified)?;

    Ok(ttl > 0 && ttl <= age.as_secs())
 }
@@ -246,13 +230,8 @@ async fn icon_is_negcached(path: &str) -> bool {
    match expired {
        // No longer negatively cached, drop the marker
        Ok(true) => {
-            match CONFIG.opendal_operator_for_path_type(PathType::IconCache) {
-                Ok(operator) => {
-                    if let Err(e) = operator.delete(&miss_indicator).await {
-                        error!("Could not remove negative cache indicator for icon {path:?}: {e:?}");
-                    }
-                }
-                Err(e) => error!("Could not remove negative cache indicator for icon {path:?}: {e:?}"),
+            if let Err(e) = remove_file(&miss_indicator).await {
+                error!("Could not remove negative cache indicator for icon {:?}: {:?}", path, e);
            }
            false
        }
@@ -282,7 +261,11 @@ impl Icon {
    }
 }

-fn get_favicons_node(dom: Tokenizer<StringReader<'_>, FaviconEmitter>, icons: &mut Vec<Icon>, url: &url::Url) {
+fn get_favicons_node(
+    dom: InfallibleTokenizer<StringReader<'_>, FaviconEmitter>,
+    icons: &mut Vec<Icon>,
+    url: &url::Url,
+) {
    const TAG_LINK: &[u8] = b"link";
    const TAG_BASE: &[u8] = b"base";
    const TAG_HEAD: &[u8] = b"head";
@@ -291,7 +274,7 @@ fn get_favicons_node(dom: Tokenizer<StringReader<'_>, FaviconEmitter>, icons: &m

    let mut base_url = url.clone();
    let mut icon_tags: Vec<Tag> = Vec::new();
-    for Ok(token) in dom {
+    for token in dom {
        let tag_name: &[u8] = &token.tag.name;
        match tag_name {
            TAG_LINK => {
@@ -312,7 +295,9 @@ fn get_favicons_node(dom: Tokenizer<StringReader<'_>, FaviconEmitter>, icons: &m
            TAG_HEAD if token.closing => {
                break;
            }
-            _ => {}
+            _ => {
+                continue;
+            }
        }
    }

@@ -338,7 +323,7 @@ struct IconUrlResult {

 /// Returns a IconUrlResult which holds a Vector IconList and a string which holds the referer.
 /// There will always two items within the iconlist which holds http(s)://domain.tld/favicon.ico.
-/// This does not mean that location exists, but (it) is the default location the browser uses.
+/// This does not mean that that location does exists, but it is the default location browser use.
 ///
 /// # Argument
 /// * `domain` - A string which holds the domain with extension.
@@ -416,7 +401,7 @@ async fn get_icon_url(domain: &str) -> Result<IconUrlResult, Error> {
        // 384KB should be more than enough for the HTML, though as we only really need the HTML header.
        let limited_reader = stream_to_bytes_limit(content, 384 * 1024).await?.to_vec();

-        let dom = Tokenizer::new_with_emitter(limited_reader.to_reader(), FaviconEmitter::default());
+        let dom = Tokenizer::new_with_emitter(limited_reader.to_reader(), FaviconEmitter::default()).infallible();
        get_favicons_node(dom, &mut iconlist, &url);
    } else {
        // Add the default favicon.ico to the list with just the given domain
@@ -552,10 +537,10 @@ async fn download_icon(domain: &str) -> Result<(Bytes, Option<&str>), Error> {
                        // Check if the icon type is allowed, else try an icon from the list.
                        icon_type = get_icon_type(&body);
                        if icon_type.is_none() {
-                            debug!("Icon from {domain} data:image uri, is not a valid image type");
+                            debug!("Icon from {} data:image uri, is not a valid image type", domain);
                            continue;
                        }
-                        info!("Extracted icon from data:image uri for {domain}");
+                        info!("Extracted icon from data:image uri for {}", domain);
                        buffer = body.freeze();
                        break;
                    }
@@ -581,46 +566,26 @@ async fn download_icon(domain: &str) -> Result<(Bytes, Option<&str>), Error> {

    if buffer.is_empty() {
        err_silent!("Empty response or unable find a valid icon", domain);
-    } else if icon_type == Some("svg+xml") {
-        let mut svg_filter = Filter::new();
-        svg_filter.set_data_url_filter(data_url_filter::allow_standard_images);
-        let mut sanitized_svg = Vec::new();
-        if svg_filter.filter(&*buffer, &mut sanitized_svg).is_err() {
-            icon_type = None;
-            buffer.clear();
-        } else {
-            buffer = sanitized_svg.into();
-        }
    }

    Ok((buffer, icon_type))
 }

-async fn save_icon(path: &str, icon: Vec<u8>) {
-    let operator = match CONFIG.opendal_operator_for_path_type(PathType::IconCache) {
-        Ok(operator) => operator,
-        Err(e) => {
-            warn!("Failed to get OpenDAL operator while saving icon: {e}");
-            return;
+async fn save_icon(path: &str, icon: &[u8]) {
+    match File::create(path).await {
+        Ok(mut f) => {
+            f.write_all(icon).await.expect("Error writing icon file");
+        }
+        Err(ref e) if e.kind() == std::io::ErrorKind::NotFound => {
+            create_dir_all(&CONFIG.icon_cache_folder()).await.expect("Error creating icon cache folder");
+        }
+        Err(e) => {
+            warn!("Unable to save icon: {:?}", e);
        }
-    };
-
-    if let Err(e) = operator.write(path, icon).await {
-        warn!("Unable to save icon: {e:?}");
    }
 }

 fn get_icon_type(bytes: &[u8]) -> Option<&'static str> {
-    fn check_svg_after_xml_declaration(bytes: &[u8]) -> Option<&'static str> {
-        // Look for SVG tag within the first 1KB
-        if let Ok(content) = std::str::from_utf8(&bytes[..bytes.len().min(1024)]) {
-            if content.contains("<svg") || content.contains("<SVG") {
-                return Some("svg+xml");
-            }
-        }
-        None
-    }
-
    match bytes {
        [137, 80, 78, 71, ..] => Some("png"),
        [0, 0, 1, 0, ..] => Some("x-icon"),
@@ -628,8 +593,6 @@ fn get_icon_type(bytes: &[u8]) -> Option<&'static str> {
        [255, 216, 255, ..] => Some("jpeg"),
        [71, 73, 70, 56, ..] => Some("gif"),
        [66, 77, ..] => Some("bmp"),
-        [60, 115, 118, 103, ..] => Some("svg+xml"), // Normal svg
-        [60, 63, 120, 109, 108, ..] => check_svg_after_xml_declaration(bytes), // An svg starting with <?xml
        _ => None,
    }
 }
@@ -641,12 +604,6 @@ async fn stream_to_bytes_limit(res: Response, max_size: usize) -> Result<Bytes,
    let mut buf = BytesMut::new();
    let mut size = 0;
    while let Some(chunk) = stream.next().await {
-        // It is possible that there might occure UnexpectedEof errors or others
-        // This is most of the time no issue, and if there is no chunked data anymore or at all parsing the HTML will not happen anyway.
-        // Therfore if chunk is an err, just break and continue with the data be have received.
-        if chunk.is_err() {
-            break;
-        }
        let chunk = &chunk?;
        size += chunk.len();
        buf.extend(chunk);
@@ -705,7 +662,7 @@ impl reqwest::cookie::CookieStore for Jar {
 /// The FaviconEmitter is using an optimized version of the DefaultEmitter.
 /// This prevents emitting tags like comments, doctype and also strings between the tags.
 /// But it will also only emit the tags we need and only if they have the correct attributes
-/// Therefore parsing the HTML content is faster.
+/// Therefor parsing the HTML content is faster.
 use std::collections::BTreeMap;

 #[derive(Default)]
--- a/src/api/identity.rs
+++ b/src/api/identity.rs
@@ -14,30 +14,24 @@ use crate::{
            log_user_event,
            two_factor::{authenticator, duo, duo_oidc, email, enforce_2fa_policy, webauthn, yubikey},
        },
-        master_password_policy,
        push::register_push_device,
        ApiResult, EmptyResult, JsonResult,
    },
-    auth::{generate_organization_api_key_login_claims, ClientHeaders, ClientIp, ClientVersion},
+    auth::{generate_organization_api_key_login_claims, ClientHeaders, ClientIp},
    db::{models::*, DbConn},
    error::MapResult,
    mail, util, CONFIG,
 };

 pub fn routes() -> Vec<Route> {
-    routes![login, prelogin, identity_register, register_verification_email, register_finish]
+    routes![login, prelogin, identity_register]
 }

 #[post("/connect/token", data = "<data>")]
-async fn login(
-    data: Form<ConnectData>,
-    client_header: ClientHeaders,
-    client_version: Option<ClientVersion>,
-    mut conn: DbConn,
-) -> JsonResult {
+async fn login(data: Form<ConnectData>, client_header: ClientHeaders, mut conn: DbConn) -> JsonResult {
    let data: ConnectData = data.into_inner();

-    let mut user_id: Option<UserId> = None;
+    let mut user_uuid: Option<String> = None;

    let login_result = match data.grant_type.as_ref() {
        "refresh_token" => {
@@ -54,7 +48,7 @@ async fn login(
            _check_is_some(&data.device_name, "device_name cannot be blank")?;
            _check_is_some(&data.device_type, "device_type cannot be blank")?;

-            _password_login(data, &mut user_id, &mut conn, &client_header.ip, &client_version).await
+            _password_login(data, &mut user_uuid, &mut conn, &client_header.ip).await
        }
        "client_credentials" => {
            _check_is_some(&data.client_id, "client_id cannot be blank")?;
@@ -65,17 +59,17 @@ async fn login(
            _check_is_some(&data.device_name, "device_name cannot be blank")?;
            _check_is_some(&data.device_type, "device_type cannot be blank")?;

-            _api_key_login(data, &mut user_id, &mut conn, &client_header.ip).await
+            _api_key_login(data, &mut user_uuid, &mut conn, &client_header.ip).await
        }
        t => err!("Invalid type", t),
    };

-    if let Some(user_id) = user_id {
+    if let Some(user_uuid) = user_uuid {
        match &login_result {
            Ok(_) => {
                log_user_event(
                    EventType::UserLoggedIn as i32,
-                    &user_id,
+                    &user_uuid,
                    client_header.device_type,
                    &client_header.ip.ip,
                    &mut conn,
@@ -86,7 +80,7 @@ async fn login(
                if let Some(ev) = e.get_event() {
                    log_user_event(
                        ev.event as i32,
-                        &user_id,
+                        &user_uuid,
                        client_header.device_type,
                        &client_header.ip.ip,
                        &mut conn,
@@ -117,8 +111,8 @@ async fn _refresh_login(data: ConnectData, conn: &mut DbConn) -> JsonResult {
    // Because this might get used in the future, and is add by the Bitwarden Server, lets keep it, but then commented out
    // See: https://github.com/dani-garcia/vaultwarden/issues/4156
    // ---
-    // let members = Membership::find_confirmed_by_user(&user.uuid, conn).await;
-    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec, data.client_id);
+    // let orgs = UserOrganization::find_confirmed_by_user(&user.uuid, conn).await;
+    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec);
    device.save(conn).await?;

    let result = json!({
@@ -133,12 +127,23 @@ async fn _refresh_login(data: ConnectData, conn: &mut DbConn) -> JsonResult {
    Ok(Json(result))
 }

+#[derive(Default, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct MasterPasswordPolicy {
+    min_complexity: u8,
+    min_length: u32,
+    require_lower: bool,
+    require_upper: bool,
+    require_numbers: bool,
+    require_special: bool,
+    enforce_on_login: bool,
+}
+
 async fn _password_login(
    data: ConnectData,
-    user_id: &mut Option<UserId>,
+    user_uuid: &mut Option<String>,
    conn: &mut DbConn,
    ip: &ClientIp,
-    client_version: &Option<ClientVersion>,
 ) -> JsonResult {
    // Validate scope
    let scope = data.scope.as_ref().unwrap();
@@ -152,50 +157,31 @@ async fn _password_login(

    // Get the user
    let username = data.username.as_ref().unwrap().trim();
-    let Some(mut user) = User::find_by_mail(username, conn).await else {
-        err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {username}.", ip.ip))
+    let mut user = match User::find_by_mail(username, conn).await {
+        Some(user) => user,
+        None => err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {}.", ip.ip, username)),
    };

-    // Set the user_id here to be passed back used for event logging.
-    *user_id = Some(user.uuid.clone());
-
-    // Check if the user is disabled
-    if !user.enabled {
-        err!(
-            "This user has been disabled",
-            format!("IP: {}. Username: {username}.", ip.ip),
-            ErrorEvent {
-                event: EventType::UserFailedLogIn
-            }
-        )
-    }
+    // Set the user_uuid here to be passed back used for event logging.
+    *user_uuid = Some(user.uuid.clone());

+    // Check password
    let password = data.password.as_ref().unwrap();
-
-    // If we get an auth request, we don't check the user's password, but the access code of the auth request
-    if let Some(ref auth_request_id) = data.auth_request {
-        let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, conn).await else {
+    if let Some(auth_request_uuid) = data.auth_request.clone() {
+        if let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_uuid.as_str(), conn).await {
+            if !auth_request.check_access_code(password) {
+                err!(
+                    "Username or access code is incorrect. Try again",
+                    format!("IP: {}. Username: {}.", ip.ip, username),
+                    ErrorEvent {
+                        event: EventType::UserFailedLogIn,
+                    }
+                )
+            }
+        } else {
            err!(
                "Auth request not found. Try again.",
-                format!("IP: {}. Username: {username}.", ip.ip),
-                ErrorEvent {
-                    event: EventType::UserFailedLogIn,
-                }
-            )
-        };
-
-        let expiration_time = auth_request.creation_date + chrono::Duration::minutes(5);
-        let request_expired = Utc::now().naive_utc() >= expiration_time;
-
-        if auth_request.user_uuid != user.uuid
-            || !auth_request.approved.unwrap_or(false)
-            || request_expired
-            || ip.ip.to_string() != auth_request.request_ip
-            || !auth_request.check_access_code(password)
-        {
-            err!(
-                "Username or access code is incorrect. Try again",
-                format!("IP: {}. Username: {username}.", ip.ip),
+                format!("IP: {}. Username: {}.", ip.ip, username),
                ErrorEvent {
                    event: EventType::UserFailedLogIn,
                }
@@ -204,23 +190,34 @@ async fn _password_login(
    } else if !user.check_valid_password(password) {
        err!(
            "Username or password is incorrect. Try again",
-            format!("IP: {}. Username: {username}.", ip.ip),
+            format!("IP: {}. Username: {}.", ip.ip, username),
            ErrorEvent {
                event: EventType::UserFailedLogIn,
            }
        )
    }

-    // Change the KDF Iterations (only when not logging in with an auth request)
-    if data.auth_request.is_none() && user.password_iterations != CONFIG.password_iterations() {
+    // Change the KDF Iterations
+    if user.password_iterations != CONFIG.password_iterations() {
        user.password_iterations = CONFIG.password_iterations();
        user.set_password(password, None, false, None);

        if let Err(e) = user.save(conn).await {
-            error!("Error updating user: {e:#?}");
+            error!("Error updating user: {:#?}", e);
        }
    }

+    // Check if the user is disabled
+    if !user.enabled {
+        err!(
+            "This user has been disabled",
+            format!("IP: {}. Username: {}.", ip.ip, username),
+            ErrorEvent {
+                event: EventType::UserFailedLogIn
+            }
+        )
+    }
+
    let now = Utc::now().naive_utc();

    if user.verified_at.is_none() && CONFIG.mail_enabled() && CONFIG.signups_verify() {
@@ -236,11 +233,11 @@ async fn _password_login(
                user.login_verify_count += 1;

                if let Err(e) = user.save(conn).await {
-                    error!("Error updating user: {e:#?}");
+                    error!("Error updating user: {:#?}", e);
                }

                if let Err(e) = mail::send_verify_email(&user.email, &user.uuid).await {
-                    error!("Error auto-sending email verification email: {e:#?}");
+                    error!("Error auto-sending email verification email: {:#?}", e);
                }
            }
        }
@@ -248,7 +245,7 @@ async fn _password_login(
        // We still want the login to fail until they actually verified the email address
        err!(
            "Please verify your email before trying again.",
-            format!("IP: {}. Username: {username}.", ip.ip),
+            format!("IP: {}. Username: {}.", ip.ip, username),
            ErrorEvent {
                event: EventType::UserFailedLogIn
            }
@@ -257,11 +254,11 @@ async fn _password_login(

    let (mut device, new_device) = get_device(&data, conn, &user).await;

-    let twofactor_token = twofactor_auth(&user, &data, &mut device, ip, client_version, conn).await?;
+    let twofactor_token = twofactor_auth(&user, &data, &mut device, ip, conn).await?;

    if CONFIG.mail_enabled() && new_device {
        if let Err(e) = mail::send_new_device_logged_in(&user.email, &ip.ip.to_string(), &now, &device).await {
-            error!("Error sending new device email: {e:#?}");
+            error!("Error sending new device email: {:#?}", e);

            if CONFIG.require_device_email() {
                err!(
@@ -285,11 +282,39 @@ async fn _password_login(
    // Because this might get used in the future, and is add by the Bitwarden Server, lets keep it, but then commented out
    // See: https://github.com/dani-garcia/vaultwarden/issues/4156
    // ---
-    // let members = Membership::find_confirmed_by_user(&user.uuid, conn).await;
-    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec, data.client_id);
+    // let orgs = UserOrganization::find_confirmed_by_user(&user.uuid, conn).await;
+    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec);
    device.save(conn).await?;

-    let master_password_policy = master_password_policy(&user, conn).await;
+    // Fetch all valid Master Password Policies and merge them into one with all true's and larges numbers as one policy
+    let master_password_policies: Vec<MasterPasswordPolicy> =
+        OrgPolicy::find_accepted_and_confirmed_by_user_and_active_policy(
+            &user.uuid,
+            OrgPolicyType::MasterPassword,
+            conn,
+        )
+        .await
+        .into_iter()
+        .filter_map(|p| serde_json::from_str(&p.data).ok())
+        .collect();
+
+    let master_password_policy = if !master_password_policies.is_empty() {
+        let mut mpp_json = json!(master_password_policies.into_iter().reduce(|acc, policy| {
+            MasterPasswordPolicy {
+                min_complexity: acc.min_complexity.max(policy.min_complexity),
+                min_length: acc.min_length.max(policy.min_length),
+                require_lower: acc.require_lower || policy.require_lower,
+                require_upper: acc.require_upper || policy.require_upper,
+                require_numbers: acc.require_numbers || policy.require_numbers,
+                require_special: acc.require_special || policy.require_special,
+                enforce_on_login: acc.enforce_on_login || policy.enforce_on_login,
+            }
+        }));
+        mpp_json["object"] = json!("masterPasswordPolicy");
+        mpp_json
+    } else {
+        json!({"object": "masterPasswordPolicy"})
+    };

    let mut result = json!({
        "access_token": access_token,
@@ -319,13 +344,13 @@ async fn _password_login(
        result["TwoFactorToken"] = Value::String(token);
    }

-    info!("User {username} logged in successfully. IP: {}", ip.ip);
+    info!("User {} logged in successfully. IP: {}", username, ip.ip);
    Ok(Json(result))
 }

 async fn _api_key_login(
    data: ConnectData,
-    user_id: &mut Option<UserId>,
+    user_uuid: &mut Option<String>,
    conn: &mut DbConn,
    ip: &ClientIp,
 ) -> JsonResult {
@@ -334,7 +359,7 @@ async fn _api_key_login(

    // Validate scope
    match data.scope.as_ref().unwrap().as_ref() {
-        "api" => _user_api_key_login(data, user_id, conn, ip).await,
+        "api" => _user_api_key_login(data, user_uuid, conn, ip).await,
        "api.organization" => _organization_api_key_login(data, conn, ip).await,
        _ => err!("Scope not supported"),
    }
@@ -342,22 +367,23 @@ async fn _api_key_login(

 async fn _user_api_key_login(
    data: ConnectData,
-    user_id: &mut Option<UserId>,
+    user_uuid: &mut Option<String>,
    conn: &mut DbConn,
    ip: &ClientIp,
 ) -> JsonResult {
    // Get the user via the client_id
    let client_id = data.client_id.as_ref().unwrap();
-    let Some(client_user_id) = client_id.strip_prefix("user.") else {
-        err!("Malformed client_id", format!("IP: {}.", ip.ip))
+    let client_user_uuid = match client_id.strip_prefix("user.") {
+        Some(uuid) => uuid,
+        None => err!("Malformed client_id", format!("IP: {}.", ip.ip)),
    };
-    let client_user_id: UserId = client_user_id.into();
-    let Some(user) = User::find_by_uuid(&client_user_id, conn).await else {
-        err!("Invalid client_id", format!("IP: {}.", ip.ip))
+    let user = match User::find_by_uuid(client_user_uuid, conn).await {
+        Some(user) => user,
+        None => err!("Invalid client_id", format!("IP: {}.", ip.ip)),
    };

-    // Set the user_id here to be passed back used for event logging.
-    *user_id = Some(user.uuid.clone());
+    // Set the user_uuid here to be passed back used for event logging.
+    *user_uuid = Some(user.uuid.clone());

    // Check if the user is disabled
    if !user.enabled {
@@ -387,7 +413,7 @@ async fn _user_api_key_login(
    if CONFIG.mail_enabled() && new_device {
        let now = Utc::now().naive_utc();
        if let Err(e) = mail::send_new_device_logged_in(&user.email, &ip.ip.to_string(), &now, &device).await {
-            error!("Error sending new device email: {e:#?}");
+            error!("Error sending new device email: {:#?}", e);

            if CONFIG.require_device_email() {
                err!(
@@ -407,8 +433,8 @@ async fn _user_api_key_login(
    // Because this might get used in the future, and is add by the Bitwarden Server, lets keep it, but then commented out
    // See: https://github.com/dani-garcia/vaultwarden/issues/4156
    // ---
-    // let members = Membership::find_confirmed_by_user(&user.uuid, conn).await;
-    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec, data.client_id);
+    // let orgs = UserOrganization::find_confirmed_by_user(&user.uuid, conn).await;
+    let (access_token, expires_in) = device.refresh_tokens(&user, scope_vec);
    device.save(conn).await?;

    info!("User {} logged in successfully via API key. IP: {}", user.email, ip.ip);
@@ -436,12 +462,13 @@ async fn _user_api_key_login(
 async fn _organization_api_key_login(data: ConnectData, conn: &mut DbConn, ip: &ClientIp) -> JsonResult {
    // Get the org via the client_id
    let client_id = data.client_id.as_ref().unwrap();
-    let Some(org_id) = client_id.strip_prefix("organization.") else {
-        err!("Malformed client_id", format!("IP: {}.", ip.ip))
+    let org_uuid = match client_id.strip_prefix("organization.") {
+        Some(uuid) => uuid,
+        None => err!("Malformed client_id", format!("IP: {}.", ip.ip)),
    };
-    let org_id: OrganizationId = org_id.to_string().into();
-    let Some(org_api_key) = OrganizationApiKey::find_by_org_uuid(&org_id, conn).await else {
-        err!("Invalid client_id", format!("IP: {}.", ip.ip))
+    let org_api_key = match OrganizationApiKey::find_by_org_uuid(org_uuid, conn).await {
+        Some(org_api_key) => org_api_key,
+        None => err!("Invalid client_id", format!("IP: {}.", ip.ip)),
    };

    // Check API key.
@@ -487,7 +514,6 @@ async fn twofactor_auth(
    data: &ConnectData,
    device: &mut Device,
    ip: &ClientIp,
-    client_version: &Option<ClientVersion>,
    conn: &mut DbConn,
 ) -> ApiResult<Option<String>> {
    let twofactors = TwoFactor::find_by_user(&user.uuid, conn).await;
@@ -506,10 +532,7 @@ async fn twofactor_auth(
    let twofactor_code = match data.two_factor_token {
        Some(ref code) => code,
        None => {
-            err_json!(
-                _json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
-                "2FA token not provided"
-            )
+            err_json!(_json_err_twofactor(&twofactor_ids, &user.uuid, data, conn).await?, "2FA token not provided")
        }
    };

@@ -546,7 +569,7 @@ async fn twofactor_auth(
            }
        }
        Some(TwoFactorType::Email) => {
-            email::validate_email_code_str(&user.uuid, twofactor_code, &selected_data?, &ip.ip, conn).await?
+            email::validate_email_code_str(&user.uuid, twofactor_code, &selected_data?, conn).await?
        }

        Some(TwoFactorType::Remember) => {
@@ -556,7 +579,7 @@ async fn twofactor_auth(
                }
                _ => {
                    err_json!(
-                        _json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
+                        _json_err_twofactor(&twofactor_ids, &user.uuid, data, conn).await?,
                        "2FA Remember token not provided"
                    )
                }
@@ -586,9 +609,8 @@ fn _selected_data(tf: Option<TwoFactor>) -> ApiResult<String> {

 async fn _json_err_twofactor(
    providers: &[i32],
-    user_id: &UserId,
+    user_uuid: &str,
    data: &ConnectData,
-    client_version: &Option<ClientVersion>,
    conn: &mut DbConn,
 ) -> ApiResult<Value> {
    let mut result = json!({
@@ -608,12 +630,12 @@ async fn _json_err_twofactor(
            Some(TwoFactorType::Authenticator) => { /* Nothing to do for TOTP */ }

            Some(TwoFactorType::Webauthn) if CONFIG.domain_set() => {
-                let request = webauthn::generate_webauthn_login(user_id, conn).await?;
+                let request = webauthn::generate_webauthn_login(user_uuid, conn).await?;
                result["TwoFactorProviders2"][provider.to_string()] = request.0;
            }

            Some(TwoFactorType::Duo) => {
-                let email = match User::find_by_uuid(user_id, conn).await {
+                let email = match User::find_by_uuid(user_uuid, conn).await {
                    Some(u) => u.email,
                    None => err!("User does not exist"),
                };
@@ -645,8 +667,9 @@ async fn _json_err_twofactor(
            }

            Some(tf_type @ TwoFactorType::YubiKey) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
-                    err!("No YubiKey devices registered")
+                let twofactor = match TwoFactor::find_by_user_and_type(user_uuid, tf_type as i32, conn).await {
+                    Some(tf) => tf,
+                    None => err!("No YubiKey devices registered"),
                };

                let yubikey_metadata: yubikey::YubikeyMetadata = serde_json::from_str(&twofactor.data)?;
@@ -657,21 +680,14 @@ async fn _json_err_twofactor(
            }

            Some(tf_type @ TwoFactorType::Email) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
-                    err!("No twofactor email registered")
+                let twofactor = match TwoFactor::find_by_user_and_type(user_uuid, tf_type as i32, conn).await {
+                    Some(tf) => tf,
+                    None => err!("No twofactor email registered"),
                };

-                // Starting with version 2025.5.0 the client will call `/api/two-factor/send-email-login`.
-                let disabled_send = if let Some(cv) = client_version {
-                    let ver_match = semver::VersionReq::parse(">=2025.5.0").unwrap();
-                    ver_match.matches(&cv.0)
-                } else {
-                    false
-                };
-
-                // Send email immediately if email is the only 2FA option.
-                if providers.len() == 1 && !disabled_send {
-                    email::send_token(user_id, conn).await?
+                // Send email immediately if email is the only 2FA option
+                if providers.len() == 1 {
+                    email::send_token(user_uuid, conn).await?
                }

                let email_data = email::EmailTokenData::from_json(&twofactor.data)?;
@@ -694,69 +710,7 @@ async fn prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {

 #[post("/accounts/register", data = "<data>")]
 async fn identity_register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
-    _register(data, false, conn).await
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct RegisterVerificationData {
-    email: String,
-    name: Option<String>,
-    // receiveMarketingEmails: bool,
-}
-
-#[derive(rocket::Responder)]
-enum RegisterVerificationResponse {
-    NoContent(()),
-    Token(Json<String>),
-}
-
-#[post("/accounts/register/send-verification-email", data = "<data>")]
-async fn register_verification_email(
-    data: Json<RegisterVerificationData>,
-    mut conn: DbConn,
-) -> ApiResult<RegisterVerificationResponse> {
-    let data = data.into_inner();
-
-    // the registration can only continue if signup is allowed or there exists an invitation
-    if !(CONFIG.is_signup_allowed(&data.email)
-        || (!CONFIG.mail_enabled() && Invitation::find_by_mail(&data.email, &mut conn).await.is_some()))
-    {
-        err!("Registration not allowed or user already exists")
-    }
-
-    let should_send_mail = CONFIG.mail_enabled() && CONFIG.signups_verify();
-
-    let token_claims =
-        crate::auth::generate_register_verify_claims(data.email.clone(), data.name.clone(), should_send_mail);
-    let token = crate::auth::encode_jwt(&token_claims);
-
-    if should_send_mail {
-        let user = User::find_by_mail(&data.email, &mut conn).await;
-        if user.filter(|u| u.private_key.is_some()).is_some() {
-            // There is still a timing side channel here in that the code
-            // paths that send mail take noticeably longer than ones that
-            // don't. Add a randomized sleep to mitigate this somewhat.
-            use rand::{rngs::SmallRng, Rng, SeedableRng};
-            let mut rng = SmallRng::from_os_rng();
-            let delta: i32 = 100;
-            let sleep_ms = (1_000 + rng.random_range(-delta..=delta)) as u64;
-            tokio::time::sleep(tokio::time::Duration::from_millis(sleep_ms)).await;
-        } else {
-            mail::send_register_verify_email(&data.email, &token).await?;
-        }
-
-        Ok(RegisterVerificationResponse::NoContent(()))
-    } else {
-        // If email verification is not required, return the token directly
-        // the clients will use this token to finish the registration
-        Ok(RegisterVerificationResponse::Token(Json(token)))
-    }
-}
-
-#[post("/accounts/register/finish", data = "<data>")]
-async fn register_finish(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
-    _register(data, true, conn).await
+    _register(data, conn).await
 }

 // https://github.com/bitwarden/jslib/blob/master/common/src/models/request/tokenRequest.ts
@@ -788,7 +742,7 @@ struct ConnectData {

    #[field(name = uncased("device_identifier"))]
    #[field(name = uncased("deviceidentifier"))]
-    device_identifier: Option<DeviceId>,
+    device_identifier: Option<String>,
    #[field(name = uncased("device_name"))]
    #[field(name = uncased("devicename"))]
    device_name: Option<String>,
@@ -811,7 +765,7 @@ struct ConnectData {
    #[field(name = uncased("twofactorremember"))]
    two_factor_remember: Option<i32>,
    #[field(name = uncased("authrequest"))]
-    auth_request: Option<AuthRequestId>,
+    auth_request: Option<String>,
 }

 fn _check_is_some<T>(value: &Option<T>, msg: &str) -> EmptyResult {
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -32,10 +32,7 @@ pub use crate::api::{
    web::routes as web_routes,
    web::static_files,
 };
-use crate::db::{
-    models::{OrgPolicy, OrgPolicyType, User},
-    DbConn,
-};
+use crate::db::{models::User, DbConn};

 // Type aliases for API methods results
 type ApiResult<T> = Result<T, crate::error::Error>;
@@ -71,49 +68,3 @@ impl PasswordOrOtpData {
        Ok(())
    }
 }
-
-#[derive(Debug, Default, Deserialize, Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MasterPasswordPolicy {
-    min_complexity: Option<u8>,
-    min_length: Option<u32>,
-    require_lower: bool,
-    require_upper: bool,
-    require_numbers: bool,
-    require_special: bool,
-    enforce_on_login: bool,
-}
-
-// Fetch all valid Master Password Policies and merge them into one with all trues and largest numbers as one policy
-async fn master_password_policy(user: &User, conn: &DbConn) -> Value {
-    let master_password_policies: Vec<MasterPasswordPolicy> =
-        OrgPolicy::find_accepted_and_confirmed_by_user_and_active_policy(
-            &user.uuid,
-            OrgPolicyType::MasterPassword,
-            conn,
-        )
-        .await
-        .into_iter()
-        .filter_map(|p| serde_json::from_str(&p.data).ok())
-        .collect();
-
-    let mut mpp_json = if !master_password_policies.is_empty() {
-        json!(master_password_policies.into_iter().reduce(|acc, policy| {
-            MasterPasswordPolicy {
-                min_complexity: acc.min_complexity.max(policy.min_complexity),
-                min_length: acc.min_length.max(policy.min_length),
-                require_lower: acc.require_lower || policy.require_lower,
-                require_upper: acc.require_upper || policy.require_upper,
-                require_numbers: acc.require_numbers || policy.require_numbers,
-                require_special: acc.require_special || policy.require_special,
-                enforce_on_login: acc.enforce_on_login || policy.enforce_on_login,
-            }
-        }))
-    } else {
-        json!({})
-    };
-
-    // NOTE: Upstream still uses PascalCase here for `Object`!
-    mpp_json["Object"] = json!("masterPasswordPolicy");
-    mpp_json
-}
--- a/src/api/notifications.rs
+++ b/src/api/notifications.rs
@@ -10,7 +10,7 @@ use rocket_ws::{Message, WebSocket};
 use crate::{
    auth::{ClientIp, WsAccessTokenHeader},
    db::{
-        models::{AuthRequestId, Cipher, CollectionId, Device, DeviceId, Folder, PushId, Send as DbSend, User, UserId},
+        models::{Cipher, Folder, Send as DbSend, User},
        DbConn,
    },
    Error, CONFIG,
@@ -53,13 +53,13 @@ struct WsAccessToken {

 struct WSEntryMapGuard {
    users: Arc<WebSocketUsers>,
-    user_uuid: UserId,
+    user_uuid: String,
    entry_uuid: uuid::Uuid,
    addr: IpAddr,
 }

 impl WSEntryMapGuard {
-    fn new(users: Arc<WebSocketUsers>, user_uuid: UserId, entry_uuid: uuid::Uuid, addr: IpAddr) -> Self {
+    fn new(users: Arc<WebSocketUsers>, user_uuid: String, entry_uuid: uuid::Uuid, addr: IpAddr) -> Self {
        Self {
            users,
            user_uuid,
@@ -72,7 +72,7 @@ impl WSEntryMapGuard {
 impl Drop for WSEntryMapGuard {
    fn drop(&mut self) {
        info!("Closing WS connection from {}", self.addr);
-        if let Some(mut entry) = self.users.map.get_mut(self.user_uuid.as_ref()) {
+        if let Some(mut entry) = self.users.map.get_mut(&self.user_uuid) {
            entry.retain(|(uuid, _)| uuid != &self.entry_uuid);
        }
    }
@@ -101,7 +101,6 @@ impl Drop for WSAnonymousEntryMapGuard {
    }
 }

-#[allow(tail_expr_drop_order)]
 #[get("/hub?<data..>")]
 fn websockets_hub<'r>(
    ws: WebSocket,
@@ -130,7 +129,7 @@ fn websockets_hub<'r>(
        // Add a channel to send messages to this client to the map
        let entry_uuid = uuid::Uuid::new_v4();
        let (tx, rx) = tokio::sync::mpsc::channel::<Message>(100);
-        users.map.entry(claims.sub.to_string()).or_default().push((entry_uuid, tx));
+        users.map.entry(claims.sub.clone()).or_default().push((entry_uuid, tx));

        // Once the guard goes out of scope, the connection will have been closed and the entry will be deleted from the map
        (rx, WSEntryMapGuard::new(users, claims.sub, entry_uuid, addr))
@@ -157,6 +156,7 @@ fn websockets_hub<'r>(

                                        if serde_json::from_str(msg).ok() == Some(INITIAL_MESSAGE) {
                                            yield Message::binary(INITIAL_RESPONSE);
+                                            continue;
                                        }
                                    }

@@ -186,7 +186,6 @@ fn websockets_hub<'r>(
    })
 }

-#[allow(tail_expr_drop_order)]
 #[get("/anonymous-hub?<token..>")]
 fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> Result<rocket_ws::Stream!['r], Error> {
    let addr = ip.ip;
@@ -224,6 +223,7 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R

                                        if serde_json::from_str(msg).ok() == Some(INITIAL_MESSAGE) {
                                            yield Message::binary(INITIAL_RESPONSE);
+                                            continue;
                                        }
                                    }

@@ -290,7 +290,7 @@ fn serialize(val: Value) -> Vec<u8> {
 fn serialize_date(date: NaiveDateTime) -> Value {
    let seconds: i64 = date.and_utc().timestamp();
    let nanos: i64 = date.and_utc().timestamp_subsec_nanos().into();
-    let timestamp = (nanos << 34) | seconds;
+    let timestamp = nanos << 34 | seconds;

    let bs = timestamp.to_be_bytes();

@@ -328,8 +328,8 @@ pub struct WebSocketUsers {
 }

 impl WebSocketUsers {
-    async fn send_update(&self, user_id: &UserId, data: &[u8]) {
-        if let Some(user) = self.map.get(user_id.as_ref()).map(|v| v.clone()) {
+    async fn send_update(&self, user_uuid: &str, data: &[u8]) {
+        if let Some(user) = self.map.get(user_uuid).map(|v| v.clone()) {
            for (_, sender) in user.iter() {
                if let Err(e) = sender.send(Message::binary(data)).await {
                    error!("Error sending WS update {e}");
@@ -339,13 +339,13 @@ impl WebSocketUsers {
    }

    // NOTE: The last modified date needs to be updated before calling these methods
-    pub async fn send_user_update(&self, ut: UpdateType, user: &User, push_uuid: &Option<PushId>, conn: &mut DbConn) {
+    pub async fn send_user_update(&self, ut: UpdateType, user: &User) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
        let data = create_update(
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
+            vec![("UserId".into(), user.uuid.clone().into()), ("Date".into(), serialize_date(user.updated_at))],
            ut,
            None,
        );
@@ -355,19 +355,19 @@ impl WebSocketUsers {
        }

        if CONFIG.push_enabled() {
-            push_user_update(ut, user, push_uuid, conn).await;
+            push_user_update(ut, user);
        }
    }

-    pub async fn send_logout(&self, user: &User, acting_device_id: Option<DeviceId>, conn: &mut DbConn) {
+    pub async fn send_logout(&self, user: &User, acting_device_uuid: Option<String>) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
        let data = create_update(
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
+            vec![("UserId".into(), user.uuid.clone().into()), ("Date".into(), serialize_date(user.updated_at))],
            UpdateType::LogOut,
-            acting_device_id.clone(),
+            acting_device_uuid.clone(),
        );

        if CONFIG.enable_websocket() {
@@ -375,23 +375,29 @@ impl WebSocketUsers {
        }

        if CONFIG.push_enabled() {
-            push_logout(user, acting_device_id.clone(), conn).await;
+            push_logout(user, acting_device_uuid);
        }
    }

-    pub async fn send_folder_update(&self, ut: UpdateType, folder: &Folder, device: &Device, conn: &mut DbConn) {
+    pub async fn send_folder_update(
+        &self,
+        ut: UpdateType,
+        folder: &Folder,
+        acting_device_uuid: &String,
+        conn: &mut DbConn,
+    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
        let data = create_update(
            vec![
-                ("Id".into(), folder.uuid.to_string().into()),
-                ("UserId".into(), folder.user_uuid.to_string().into()),
+                ("Id".into(), folder.uuid.clone().into()),
+                ("UserId".into(), folder.user_uuid.clone().into()),
                ("RevisionDate".into(), serialize_date(folder.updated_at)),
            ],
            ut,
-            Some(device.uuid.clone()),
+            Some(acting_device_uuid.into()),
        );

        if CONFIG.enable_websocket() {
@@ -399,7 +405,7 @@ impl WebSocketUsers {
        }

        if CONFIG.push_enabled() {
-            push_folder_update(ut, folder, device, conn).await;
+            push_folder_update(ut, folder, acting_device_uuid, conn).await;
        }
    }

@@ -407,48 +413,48 @@ impl WebSocketUsers {
        &self,
        ut: UpdateType,
        cipher: &Cipher,
-        user_ids: &[UserId],
-        device: &Device,
-        collection_uuids: Option<Vec<CollectionId>>,
+        user_uuids: &[String],
+        acting_device_uuid: &String,
+        collection_uuids: Option<Vec<String>>,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
-        let org_id = convert_option(cipher.organization_uuid.as_deref());
+        let org_uuid = convert_option(cipher.organization_uuid.clone());
        // Depending if there are collections provided or not, we need to have different values for the following variables.
        // The user_uuid should be `null`, and the revision date should be set to now, else the clients won't sync the collection change.
-        let (user_id, collection_uuids, revision_date) = if let Some(collection_uuids) = collection_uuids {
+        let (user_uuid, collection_uuids, revision_date) = if let Some(collection_uuids) = collection_uuids {
            (
                Value::Nil,
-                Value::Array(collection_uuids.into_iter().map(|v| v.to_string().into()).collect::<Vec<Value>>()),
+                Value::Array(collection_uuids.into_iter().map(|v| v.into()).collect::<Vec<Value>>()),
                serialize_date(Utc::now().naive_utc()),
            )
        } else {
-            (convert_option(cipher.user_uuid.as_deref()), Value::Nil, serialize_date(cipher.updated_at))
+            (convert_option(cipher.user_uuid.clone()), Value::Nil, serialize_date(cipher.updated_at))
        };

        let data = create_update(
            vec![
-                ("Id".into(), cipher.uuid.to_string().into()),
-                ("UserId".into(), user_id),
-                ("OrganizationId".into(), org_id),
+                ("Id".into(), cipher.uuid.clone().into()),
+                ("UserId".into(), user_uuid),
+                ("OrganizationId".into(), org_uuid),
                ("CollectionIds".into(), collection_uuids),
                ("RevisionDate".into(), revision_date),
            ],
            ut,
-            Some(device.uuid.clone()), // Acting device id (unique device/app uuid)
+            Some(acting_device_uuid.into()),
        );

        if CONFIG.enable_websocket() {
-            for uuid in user_ids {
+            for uuid in user_uuids {
                self.send_update(uuid, &data).await;
            }
        }

-        if CONFIG.push_enabled() && user_ids.len() == 1 {
-            push_cipher_update(ut, cipher, device, conn).await;
+        if CONFIG.push_enabled() && user_uuids.len() == 1 {
+            push_cipher_update(ut, cipher, acting_device_uuid, conn).await;
        }
    }

@@ -456,20 +462,20 @@ impl WebSocketUsers {
        &self,
        ut: UpdateType,
        send: &DbSend,
-        user_ids: &[UserId],
-        device: &Device,
+        user_uuids: &[String],
+        acting_device_uuid: &String,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
-        let user_id = convert_option(send.user_uuid.as_deref());
+        let user_uuid = convert_option(send.user_uuid.clone());

        let data = create_update(
            vec![
-                ("Id".into(), send.uuid.to_string().into()),
-                ("UserId".into(), user_id),
+                ("Id".into(), send.uuid.clone().into()),
+                ("UserId".into(), user_uuid),
                ("RevisionDate".into(), serialize_date(send.revision_date)),
            ],
            ut,
@@ -477,20 +483,20 @@ impl WebSocketUsers {
        );

        if CONFIG.enable_websocket() {
-            for uuid in user_ids {
+            for uuid in user_uuids {
                self.send_update(uuid, &data).await;
            }
        }
-        if CONFIG.push_enabled() && user_ids.len() == 1 {
-            push_send_update(ut, send, device, conn).await;
+        if CONFIG.push_enabled() && user_uuids.len() == 1 {
+            push_send_update(ut, send, acting_device_uuid, conn).await;
        }
    }

    pub async fn send_auth_request(
        &self,
-        user_id: &UserId,
-        auth_request_uuid: &str,
-        device: &Device,
+        user_uuid: &String,
+        auth_request_uuid: &String,
+        acting_device_uuid: &String,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
@@ -498,24 +504,24 @@ impl WebSocketUsers {
            return;
        }
        let data = create_update(
-            vec![("Id".into(), auth_request_uuid.to_owned().into()), ("UserId".into(), user_id.to_string().into())],
+            vec![("Id".into(), auth_request_uuid.clone().into()), ("UserId".into(), user_uuid.clone().into())],
            UpdateType::AuthRequest,
-            Some(device.uuid.clone()),
+            Some(acting_device_uuid.to_string()),
        );
        if CONFIG.enable_websocket() {
-            self.send_update(user_id, &data).await;
+            self.send_update(user_uuid, &data).await;
        }

        if CONFIG.push_enabled() {
-            push_auth_request(user_id, auth_request_uuid, device, conn).await;
+            push_auth_request(user_uuid.to_string(), auth_request_uuid.to_string(), conn).await;
        }
    }

    pub async fn send_auth_response(
        &self,
-        user_id: &UserId,
-        auth_request_id: &AuthRequestId,
-        device: &Device,
+        user_uuid: &String,
+        auth_response_uuid: &str,
+        approving_device_uuid: String,
        conn: &mut DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
@@ -523,16 +529,17 @@ impl WebSocketUsers {
            return;
        }
        let data = create_update(
-            vec![("Id".into(), auth_request_id.to_string().into()), ("UserId".into(), user_id.to_string().into())],
+            vec![("Id".into(), auth_response_uuid.to_owned().into()), ("UserId".into(), user_uuid.clone().into())],
            UpdateType::AuthRequestResponse,
-            Some(device.uuid.clone()),
+            approving_device_uuid.clone().into(),
        );
        if CONFIG.enable_websocket() {
-            self.send_update(user_id, &data).await;
+            self.send_update(auth_response_uuid, &data).await;
        }

        if CONFIG.push_enabled() {
-            push_auth_response(user_id, auth_request_id, device, conn).await;
+            push_auth_response(user_uuid.to_string(), auth_response_uuid.to_string(), approving_device_uuid, conn)
+                .await;
        }
    }
 }
@@ -551,16 +558,16 @@ impl AnonymousWebSocketSubscriptions {
        }
    }

-    pub async fn send_auth_response(&self, user_id: &UserId, auth_request_id: &AuthRequestId) {
+    pub async fn send_auth_response(&self, user_uuid: &String, auth_response_uuid: &str) {
        if !CONFIG.enable_websocket() {
            return;
        }
        let data = create_anonymous_update(
-            vec![("Id".into(), auth_request_id.to_string().into()), ("UserId".into(), user_id.to_string().into())],
+            vec![("Id".into(), auth_response_uuid.to_owned().into()), ("UserId".into(), user_uuid.clone().into())],
            UpdateType::AuthRequestResponse,
-            user_id.clone(),
+            user_uuid.to_string(),
        );
-        self.send_update(auth_request_id, &data).await;
+        self.send_update(auth_response_uuid, &data).await;
    }
 }

@@ -572,14 +579,14 @@ impl AnonymousWebSocketSubscriptions {
    "ReceiveMessage", // Target
    [ // Arguments
        {
-            "ContextId": acting_device_id || Nil,
+            "ContextId": acting_device_uuid || Nil,
            "Type": ut as i32,
            "Payload": {}
        }
    ]
 ]
 */
-fn create_update(payload: Vec<(Value, Value)>, ut: UpdateType, acting_device_id: Option<DeviceId>) -> Vec<u8> {
+fn create_update(payload: Vec<(Value, Value)>, ut: UpdateType, acting_device_uuid: Option<String>) -> Vec<u8> {
    use rmpv::Value as V;

    let value = V::Array(vec![
@@ -588,7 +595,7 @@ fn create_update(payload: Vec<(Value, Value)>, ut: UpdateType, acting_device_id:
        V::Nil,
        "ReceiveMessage".into(),
        V::Array(vec![V::Map(vec![
-            ("ContextId".into(), acting_device_id.map(|v| v.to_string().into()).unwrap_or_else(|| V::Nil)),
+            ("ContextId".into(), acting_device_uuid.map(|v| v.into()).unwrap_or_else(|| V::Nil)),
            ("Type".into(), (ut as i32).into()),
            ("Payload".into(), payload.into()),
        ])]),
@@ -597,7 +604,7 @@ fn create_update(payload: Vec<(Value, Value)>, ut: UpdateType, acting_device_id:
    serialize(value)
 }

-fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id: UserId) -> Vec<u8> {
+fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id: String) -> Vec<u8> {
    use rmpv::Value as V;

    let value = V::Array(vec![
@@ -608,7 +615,7 @@ fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id
        V::Array(vec![V::Map(vec![
            ("Type".into(), (ut as i32).into()),
            ("Payload".into(), payload.into()),
-            ("UserId".into(), user_id.to_string().into()),
+            ("UserId".into(), user_id.into()),
        ])]),
    ]);

@@ -619,7 +626,7 @@ fn create_ping() -> Vec<u8> {
    serialize(Value::Array(vec![6.into()]))
 }

-// https://github.com/bitwarden/server/blob/375af7c43b10d9da03525d41452f95de3f921541/src/Core/Enums/PushType.cs
+#[allow(dead_code)]
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum UpdateType {
    SyncCipherUpdate = 0,
@@ -632,7 +639,7 @@ pub enum UpdateType {
    SyncOrgKeys = 6,
    SyncFolderCreate = 7,
    SyncFolderUpdate = 8,
-    // SyncCipherDelete = 9, // Redirects to `SyncLoginDelete` on upstream
+    SyncCipherDelete = 9,
    SyncSettings = 10,

    LogOut = 11,
@@ -644,14 +651,6 @@ pub enum UpdateType {
    AuthRequest = 15,
    AuthRequestResponse = 16,

-    // SyncOrganizations = 17, // Not supported
-    // SyncOrganizationStatusChanged = 18, // Not supported
-    // SyncOrganizationCollectionSettingChanged = 19, // Not supported
-
-    // Notification = 20, // Not supported
-    // NotificationStatus = 21, // Not supported
-
-    // RefreshSecurityTasks = 22, // Not supported
    None = 100,
 }

--- a/src/api/push.rs
+++ b/src/api/push.rs
@@ -7,9 +7,8 @@ use tokio::sync::RwLock;

 use crate::{
    api::{ApiResult, EmptyResult, UpdateType},
-    db::models::{AuthRequestId, Cipher, Device, DeviceId, Folder, PushId, Send, User, UserId},
+    db::models::{Cipher, Device, Folder, Send, User},
    http_client::make_http_request,
-    util::{format_date, get_uuid},
    CONFIG,
 };

@@ -28,20 +27,20 @@ struct LocalAuthPushToken {
    valid_until: Instant,
 }

-async fn get_auth_api_token() -> ApiResult<String> {
-    static API_TOKEN: Lazy<RwLock<LocalAuthPushToken>> = Lazy::new(|| {
+async fn get_auth_push_token() -> ApiResult<String> {
+    static PUSH_TOKEN: Lazy<RwLock<LocalAuthPushToken>> = Lazy::new(|| {
        RwLock::new(LocalAuthPushToken {
            access_token: String::new(),
            valid_until: Instant::now(),
        })
    });
-    let api_token = API_TOKEN.read().await;
+    let push_token = PUSH_TOKEN.read().await;

-    if api_token.valid_until.saturating_duration_since(Instant::now()).as_secs() > 0 {
+    if push_token.valid_until.saturating_duration_since(Instant::now()).as_secs() > 0 {
        debug!("Auth Push token still valid, no need for a new one");
-        return Ok(api_token.access_token.clone());
+        return Ok(push_token.access_token.clone());
    }
-    drop(api_token); // Drop the read lock now
+    drop(push_token); // Drop the read lock now

    let installation_id = CONFIG.push_installation_id();
    let client_id = format!("installation.{installation_id}");
@@ -68,48 +67,44 @@ async fn get_auth_api_token() -> ApiResult<String> {
        Err(e) => err!(format!("Unexpected push token received from bitwarden server: {e}")),
    };

-    let mut api_token = API_TOKEN.write().await;
-    api_token.valid_until = Instant::now()
+    let mut push_token = PUSH_TOKEN.write().await;
+    push_token.valid_until = Instant::now()
        .checked_add(Duration::new((json_pushtoken.expires_in / 2) as u64, 0)) // Token valid for half the specified time
        .unwrap();

-    api_token.access_token = json_pushtoken.access_token;
+    push_token.access_token = json_pushtoken.access_token;

-    debug!("Token still valid for {}", api_token.valid_until.saturating_duration_since(Instant::now()).as_secs());
-    Ok(api_token.access_token.clone())
+    debug!("Token still valid for {}", push_token.valid_until.saturating_duration_since(Instant::now()).as_secs());
+    Ok(push_token.access_token.clone())
 }

 pub async fn register_push_device(device: &mut Device, conn: &mut crate::db::DbConn) -> EmptyResult {
-    if !CONFIG.push_enabled() || !device.is_push_device() {
+    if !CONFIG.push_enabled() || !device.is_push_device() || device.is_registered() {
        return Ok(());
    }

    if device.push_token.is_none() {
-        warn!("Skipping the registration of the device {:?} because the push_token field is empty.", device.uuid);
-        warn!("To get rid of this message you need to logout, clear the app data and login again on the device.");
+        warn!("Skipping the registration of the device {} because the push_token field is empty.", device.uuid);
+        warn!("To get rid of this message you need to clear the app data and reconnect the device.");
        return Ok(());
    }

-    debug!("Registering Device {:?}", device.push_uuid);
+    debug!("Registering Device {}", device.uuid);

-    // Generate a random push_uuid so if it doesn't already have one
-    if device.push_uuid.is_none() {
-        device.push_uuid = Some(PushId(get_uuid()));
-    }
+    // generate a random push_uuid so we know the device is registered
+    device.push_uuid = Some(uuid::Uuid::new_v4().to_string());

    //Needed to register a device for push to bitwarden :
    let data = json!({
-        "deviceId": device.push_uuid, // Unique UUID per user/device
-        "pushToken": device.push_token,
        "userId": device.user_uuid,
+        "deviceId": device.push_uuid,
+        "identifier": device.uuid,
        "type": device.atype,
-        "identifier": device.uuid,    // Unique UUID of the device/app, determined by the device/app it self currently registering
-        // "organizationIds:" [] // TODO: This is not yet implemented by Vaultwarden!
-        "installationId": CONFIG.push_installation_id(),
+        "pushToken": device.push_token
    });

-    let auth_api_token = get_auth_api_token().await?;
-    let auth_header = format!("Bearer {auth_api_token}");
+    let auth_push_token = get_auth_push_token().await?;
+    let auth_header = format!("Bearer {}", &auth_push_token);

    if let Err(e) = make_http_request(Method::POST, &(CONFIG.push_relay_uri() + "/push/register"))?
        .header(CONTENT_TYPE, "application/json")
@@ -130,21 +125,18 @@ pub async fn register_push_device(device: &mut Device, conn: &mut crate::db::DbC
    Ok(())
 }

-pub async fn unregister_push_device(push_id: &Option<PushId>) -> EmptyResult {
-    if !CONFIG.push_enabled() || push_id.is_none() {
+pub async fn unregister_push_device(push_uuid: Option<String>) -> EmptyResult {
+    if !CONFIG.push_enabled() || push_uuid.is_none() {
        return Ok(());
    }
-    let auth_api_token = get_auth_api_token().await?;
+    let auth_push_token = get_auth_push_token().await?;

-    let auth_header = format!("Bearer {auth_api_token}");
+    let auth_header = format!("Bearer {}", &auth_push_token);

-    match make_http_request(
-        Method::POST,
-        &format!("{}/push/delete/{}", CONFIG.push_relay_uri(), push_id.as_ref().unwrap()),
-    )?
-    .header(AUTHORIZATION, auth_header)
-    .send()
-    .await
+    match make_http_request(Method::DELETE, &(CONFIG.push_relay_uri() + "/push/" + &push_uuid.unwrap()))?
+        .header(AUTHORIZATION, auth_header)
+        .send()
+        .await
    {
        Ok(r) => r,
        Err(e) => err!(format!("An error occurred during device unregistration: {e}")),
@@ -152,110 +144,108 @@ pub async fn unregister_push_device(push_id: &Option<PushId>) -> EmptyResult {
    Ok(())
 }

-pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device, conn: &mut crate::db::DbConn) {
+pub async fn push_cipher_update(
+    ut: UpdateType,
+    cipher: &Cipher,
+    acting_device_uuid: &String,
+    conn: &mut crate::db::DbConn,
+) {
    // We shouldn't send a push notification on cipher update if the cipher belongs to an organization, this isn't implemented in the upstream server too.
    if cipher.organization_uuid.is_some() {
        return;
    };
-    let Some(user_id) = &cipher.user_uuid else {
-        debug!("Cipher has no uuid");
-        return;
+    let user_uuid = match &cipher.user_uuid {
+        Some(c) => c,
+        None => {
+            debug!("Cipher has no uuid");
+            return;
+        }
    };

-    if Device::check_user_has_push_device(user_id, conn).await {
+    if Device::check_user_has_push_device(user_uuid, conn).await {
        send_to_push_relay(json!({
-            "userId": user_id,
-            "organizationId": null,
-            "deviceId": device.push_uuid, // Should be the records unique uuid of the acting device (unique uuid per user/device)
-            "identifier": device.uuid, // Should be the acting device id (aka uuid per device/app)
+            "userId": user_uuid,
+            "organizationId": (),
+            "deviceId": acting_device_uuid,
+            "identifier": acting_device_uuid,
            "type": ut as i32,
            "payload": {
                "id": cipher.uuid,
                "userId": cipher.user_uuid,
-                "organizationId": null,
-                "collectionIds": null,
-                "revisionDate": format_date(&cipher.updated_at)
-            },
-            "clientType": null,
-            "installationId": null
+                "organizationId": (),
+                "revisionDate": cipher.updated_at
+            }
        }))
        .await;
    }
 }

-pub async fn push_logout(user: &User, acting_device_id: Option<DeviceId>, conn: &mut crate::db::DbConn) {
-    let acting_device_id: Value = acting_device_id.map(|v| v.to_string().into()).unwrap_or_else(|| Value::Null);
+pub fn push_logout(user: &User, acting_device_uuid: Option<String>) {
+    let acting_device_uuid: Value = acting_device_uuid.map(|v| v.into()).unwrap_or_else(|| Value::Null);

-    if Device::check_user_has_push_device(&user.uuid, conn).await {
-        tokio::task::spawn(send_to_push_relay(json!({
+    tokio::task::spawn(send_to_push_relay(json!({
+        "userId": user.uuid,
+        "organizationId": (),
+        "deviceId": acting_device_uuid,
+        "identifier": acting_device_uuid,
+        "type": UpdateType::LogOut as i32,
+        "payload": {
            "userId": user.uuid,
-            "organizationId": (),
-            "deviceId": acting_device_id,
-            "identifier": acting_device_id,
-            "type": UpdateType::LogOut as i32,
-            "payload": {
-                "userId": user.uuid,
-                "date": format_date(&user.updated_at)
-            },
-            "clientType": null,
-            "installationId": null
-        })));
-    }
+            "date": user.updated_at
+        }
+    })));
 }

-pub async fn push_user_update(ut: UpdateType, user: &User, push_uuid: &Option<PushId>, conn: &mut crate::db::DbConn) {
-    if Device::check_user_has_push_device(&user.uuid, conn).await {
-        tokio::task::spawn(send_to_push_relay(json!({
+pub fn push_user_update(ut: UpdateType, user: &User) {
+    tokio::task::spawn(send_to_push_relay(json!({
+        "userId": user.uuid,
+        "organizationId": (),
+        "deviceId": (),
+        "identifier": (),
+        "type": ut as i32,
+        "payload": {
            "userId": user.uuid,
-            "organizationId": null,
-            "deviceId": push_uuid,
-            "identifier": null,
-            "type": ut as i32,
-            "payload": {
-                "userId": user.uuid,
-                "date": format_date(&user.updated_at)
-            },
-            "clientType": null,
-            "installationId": null
-        })));
-    }
+            "date": user.updated_at
+        }
+    })));
 }

-pub async fn push_folder_update(ut: UpdateType, folder: &Folder, device: &Device, conn: &mut crate::db::DbConn) {
+pub async fn push_folder_update(
+    ut: UpdateType,
+    folder: &Folder,
+    acting_device_uuid: &String,
+    conn: &mut crate::db::DbConn,
+) {
    if Device::check_user_has_push_device(&folder.user_uuid, conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
            "userId": folder.user_uuid,
-            "organizationId": null,
-            "deviceId": device.push_uuid, // Should be the records unique uuid of the acting device (unique uuid per user/device)
-            "identifier": device.uuid, // Should be the acting device id (aka uuid per device/app)
+            "organizationId": (),
+            "deviceId": acting_device_uuid,
+            "identifier": acting_device_uuid,
            "type": ut as i32,
            "payload": {
                "id": folder.uuid,
                "userId": folder.user_uuid,
-                "revisionDate": format_date(&folder.updated_at)
-            },
-            "clientType": null,
-            "installationId": null
+                "revisionDate": folder.updated_at
+            }
        })));
    }
 }

-pub async fn push_send_update(ut: UpdateType, send: &Send, device: &Device, conn: &mut crate::db::DbConn) {
+pub async fn push_send_update(ut: UpdateType, send: &Send, acting_device_uuid: &String, conn: &mut crate::db::DbConn) {
    if let Some(s) = &send.user_uuid {
        if Device::check_user_has_push_device(s, conn).await {
            tokio::task::spawn(send_to_push_relay(json!({
                "userId": send.user_uuid,
-                "organizationId": null,
-                "deviceId": device.push_uuid, // Should be the records unique uuid of the acting device (unique uuid per user/device)
-                "identifier": device.uuid, // Should be the acting device id (aka uuid per device/app)
+                "organizationId": (),
+                "deviceId": acting_device_uuid,
+                "identifier": acting_device_uuid,
                "type": ut as i32,
                "payload": {
                    "id": send.uuid,
                    "userId": send.user_uuid,
-                    "revisionDate": format_date(&send.revision_date)
-                },
-                "clientType": null,
-                "installationId": null
+                    "revisionDate": send.revision_date
+                }
            })));
        }
    }
@@ -266,20 +256,20 @@ async fn send_to_push_relay(notification_data: Value) {
        return;
    }

-    let auth_api_token = match get_auth_api_token().await {
+    let auth_push_token = match get_auth_push_token().await {
        Ok(s) => s,
        Err(e) => {
-            debug!("Could not get the auth push token: {e}");
+            debug!("Could not get the auth push token: {}", e);
            return;
        }
    };

-    let auth_header = format!("Bearer {auth_api_token}");
+    let auth_header = format!("Bearer {}", &auth_push_token);

    let req = match make_http_request(Method::POST, &(CONFIG.push_relay_uri() + "/push/send")) {
        Ok(r) => r,
        Err(e) => {
-            error!("An error occurred while sending a send update to the push relay: {e}");
+            error!("An error occurred while sending a send update to the push relay: {}", e);
            return;
        }
    };
@@ -292,47 +282,43 @@ async fn send_to_push_relay(notification_data: Value) {
        .send()
        .await
    {
-        error!("An error occurred while sending a send update to the push relay: {e}");
+        error!("An error occurred while sending a send update to the push relay: {}", e);
    };
 }

-pub async fn push_auth_request(user_id: &UserId, auth_request_id: &str, device: &Device, conn: &mut crate::db::DbConn) {
-    if Device::check_user_has_push_device(user_id, conn).await {
+pub async fn push_auth_request(user_uuid: String, auth_request_uuid: String, conn: &mut crate::db::DbConn) {
+    if Device::check_user_has_push_device(user_uuid.as_str(), conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
-            "userId": user_id,
-            "organizationId": null,
-            "deviceId": device.push_uuid, // Should be the records unique uuid of the acting device (unique uuid per user/device)
-            "identifier": device.uuid, // Should be the acting device id (aka uuid per device/app)
+            "userId": user_uuid,
+            "organizationId": (),
+            "deviceId": null,
+            "identifier": null,
            "type": UpdateType::AuthRequest as i32,
            "payload": {
-                "userId": user_id,
-                "id": auth_request_id,
-            },
-            "clientType": null,
-            "installationId": null
+                "id": auth_request_uuid,
+                "userId": user_uuid,
+            }
        })));
    }
 }

 pub async fn push_auth_response(
-    user_id: &UserId,
-    auth_request_id: &AuthRequestId,
-    device: &Device,
+    user_uuid: String,
+    auth_request_uuid: String,
+    approving_device_uuid: String,
    conn: &mut crate::db::DbConn,
 ) {
-    if Device::check_user_has_push_device(user_id, conn).await {
+    if Device::check_user_has_push_device(user_uuid.as_str(), conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
-            "userId": user_id,
-            "organizationId": null,
-            "deviceId": device.push_uuid, // Should be the records unique uuid of the acting device (unique uuid per user/device)
-            "identifier": device.uuid, // Should be the acting device id (aka uuid per device/app)
+            "userId": user_uuid,
+            "organizationId": (),
+            "deviceId": approving_device_uuid,
+            "identifier": approving_device_uuid,
            "type": UpdateType::AuthRequestResponse as i32,
            "payload": {
-                "userId": user_id,
-                "id": auth_request_id,
-            },
-            "clientType": null,
-            "installationId": null
+                "id": auth_request_uuid,
+                "userId": user_uuid,
+            }
        })));
    }
 }
--- a/src/api/web.rs
+++ b/src/api/web.rs
@@ -1,20 +1,13 @@
 use std::path::{Path, PathBuf};

-use rocket::{
-    fs::NamedFile,
-    http::ContentType,
-    response::{content::RawCss as Css, content::RawHtml as Html, Redirect},
-    serde::json::Json,
-    Catcher, Route,
-};
+use rocket::{fs::NamedFile, http::ContentType, response::content::RawHtml as Html, serde::json::Json, Catcher, Route};
 use serde_json::Value;

 use crate::{
    api::{core::now, ApiResult, EmptyResult},
    auth::decode_file_download,
-    db::models::{AttachmentId, CipherId},
    error::Error,
-    util::Cached,
+    util::{Cached, SafeString},
    CONFIG,
 };

@@ -23,7 +16,7 @@ pub fn routes() -> Vec<Route> {
    // crate::utils::LOGGED_ROUTES to make sure they appear in the log
    let mut routes = routes![attachments, alive, alive_head, static_files];
    if CONFIG.web_vault_enabled() {
-        routes.append(&mut routes![web_index, web_index_direct, web_index_head, app_id, web_files, vaultwarden_css]);
+        routes.append(&mut routes![web_index, web_index_head, app_id, web_files]);
    }

    #[cfg(debug_assertions)]
@@ -52,66 +45,11 @@ fn not_found() -> ApiResult<Html<String>> {
    Ok(Html(text))
 }

-#[get("/css/vaultwarden.css")]
-fn vaultwarden_css() -> Cached<Css<String>> {
-    let css_options = json!({
-        "signup_disabled": CONFIG.is_signup_disabled(),
-        "mail_enabled": CONFIG.mail_enabled(),
-        "mail_2fa_enabled": CONFIG._enable_email_2fa(),
-        "yubico_enabled": CONFIG._enable_yubico() && CONFIG.yubico_client_id().is_some() && CONFIG.yubico_secret_key().is_some(),
-        "emergency_access_allowed": CONFIG.emergency_access_allowed(),
-        "sends_allowed": CONFIG.sends_allowed(),
-        "load_user_scss": true,
-    });
-
-    let scss = match CONFIG.render_template("scss/vaultwarden.scss", &css_options) {
-        Ok(t) => t,
-        Err(e) => {
-            // Something went wrong loading the template. Use the fallback
-            warn!("Loading scss/vaultwarden.scss.hbs or scss/user.vaultwarden.scss.hbs failed. {e}");
-            CONFIG
-                .render_fallback_template("scss/vaultwarden.scss", &css_options)
-                .expect("Fallback scss/vaultwarden.scss.hbs to render")
-        }
-    };
-
-    let css = match grass_compiler::from_string(
-        scss,
-        &grass_compiler::Options::default().style(grass_compiler::OutputStyle::Compressed),
-    ) {
-        Ok(css) => css,
-        Err(e) => {
-            // Something went wrong compiling the scss. Use the fallback
-            warn!("Compiling the Vaultwarden SCSS styles failed. {e}");
-            let mut css_options = css_options;
-            css_options["load_user_scss"] = json!(false);
-            let scss = CONFIG
-                .render_fallback_template("scss/vaultwarden.scss", &css_options)
-                .expect("Fallback scss/vaultwarden.scss.hbs to render");
-            grass_compiler::from_string(
-                scss,
-                &grass_compiler::Options::default().style(grass_compiler::OutputStyle::Compressed),
-            )
-            .expect("SCSS to compile")
-        }
-    };
-
-    // Cache for one day should be enough and not too much
-    Cached::ttl(Css(css), 86_400, false)
-}
-
 #[get("/")]
 async fn web_index() -> Cached<Option<NamedFile>> {
    Cached::short(NamedFile::open(Path::new(&CONFIG.web_vault_folder()).join("index.html")).await.ok(), false)
 }

-// Make sure that `/index.html` redirect to actual domain path.
-// If not, this might cause issues with the web-vault
-#[get("/index.html")]
-fn web_index_direct() -> Redirect {
-    Redirect::to(format!("{}/", CONFIG.domain_path()))
-}
-
 #[head("/")]
 fn web_index_head() -> EmptyResult {
    // Add an explicit HEAD route to prevent uptime monitoring services from
@@ -160,16 +98,16 @@ async fn web_files(p: PathBuf) -> Cached<Option<NamedFile>> {
    Cached::long(NamedFile::open(Path::new(&CONFIG.web_vault_folder()).join(p)).await.ok(), true)
 }

-#[get("/attachments/<cipher_id>/<file_id>?<token>")]
-async fn attachments(cipher_id: CipherId, file_id: AttachmentId, token: String) -> Option<NamedFile> {
+#[get("/attachments/<uuid>/<file_id>?<token>")]
+async fn attachments(uuid: SafeString, file_id: SafeString, token: String) -> Option<NamedFile> {
    let Ok(claims) = decode_file_download(&token) else {
        return None;
    };
-    if claims.sub != cipher_id || claims.file_id != file_id {
+    if claims.sub != *uuid || claims.file_id != *file_id {
        return None;
    }

-    NamedFile::open(Path::new(&CONFIG.attachments_folder()).join(cipher_id.as_ref()).join(file_id.as_ref())).await.ok()
+    NamedFile::open(Path::new(&CONFIG.attachments_folder()).join(uuid).join(file_id)).await.ok()
 }

 // We use DbConn here to let the alive healthcheck also verify the database connection.
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -7,15 +7,13 @@ use once_cell::sync::{Lazy, OnceCell};
 use openssl::rsa::Rsa;
 use serde::de::DeserializeOwned;
 use serde::ser::Serialize;
-use std::{env, net::IpAddr};
-
-use crate::{
-    config::PathType,
-    db::models::{
-        AttachmentId, CipherId, CollectionId, DeviceId, EmergencyAccessId, MembershipId, OrgApiKeyId, OrganizationId,
-        SendFileId, SendId, UserId,
-    },
+use std::{
+    env,
+    fs::File,
+    io::{Read, Write},
+    net::IpAddr,
 };
+
 use crate::{error::Error, CONFIG};

 const JWT_ALGORITHM: Algorithm = Algorithm::RS256;
@@ -33,38 +31,41 @@ static JWT_ADMIN_ISSUER: Lazy<String> = Lazy::new(|| format!("{}|admin", CONFIG.
 static JWT_SEND_ISSUER: Lazy<String> = Lazy::new(|| format!("{}|send", CONFIG.domain_origin()));
 static JWT_ORG_API_KEY_ISSUER: Lazy<String> = Lazy::new(|| format!("{}|api.organization", CONFIG.domain_origin()));
 static JWT_FILE_DOWNLOAD_ISSUER: Lazy<String> = Lazy::new(|| format!("{}|file_download", CONFIG.domain_origin()));
-static JWT_REGISTER_VERIFY_ISSUER: Lazy<String> = Lazy::new(|| format!("{}|register_verify", CONFIG.domain_origin()));

 static PRIVATE_RSA_KEY: OnceCell<EncodingKey> = OnceCell::new();
 static PUBLIC_RSA_KEY: OnceCell<DecodingKey> = OnceCell::new();

-pub async fn initialize_keys() -> Result<(), Error> {
-    use std::io::Error;
+pub fn initialize_keys() -> Result<(), Error> {
+    fn read_key(create_if_missing: bool) -> Result<(Rsa<openssl::pkey::Private>, Vec<u8>), Error> {
+        let mut priv_key_buffer = Vec::with_capacity(2048);

-    let rsa_key_filename = std::path::PathBuf::from(CONFIG.private_rsa_key())
-        .file_name()
-        .ok_or_else(|| Error::other("Private RSA key path missing filename"))?
-        .to_str()
-        .ok_or_else(|| Error::other("Private RSA key path filename is not valid UTF-8"))?
-        .to_string();
+        let mut priv_key_file = File::options()
+            .create(create_if_missing)
+            .truncate(false)
+            .read(true)
+            .write(create_if_missing)
+            .open(CONFIG.private_rsa_key())?;

-    let operator = CONFIG.opendal_operator_for_path_type(PathType::RsaKey).map_err(Error::other)?;
+        #[allow(clippy::verbose_file_reads)]
+        let bytes_read = priv_key_file.read_to_end(&mut priv_key_buffer)?;

-    let priv_key_buffer = match operator.read(&rsa_key_filename).await {
-        Ok(buffer) => Some(buffer),
-        Err(e) if e.kind() == opendal::ErrorKind::NotFound => None,
-        Err(e) => return Err(e.into()),
-    };
+        let rsa_key = if bytes_read > 0 {
+            Rsa::private_key_from_pem(&priv_key_buffer[..bytes_read])?
+        } else if create_if_missing {
+            // Only create the key if the file doesn't exist or is empty
+            let rsa_key = Rsa::generate(2048)?;
+            priv_key_buffer = rsa_key.private_key_to_pem()?;
+            priv_key_file.write_all(&priv_key_buffer)?;
+            info!("Private key '{}' created correctly", CONFIG.private_rsa_key());
+            rsa_key
+        } else {
+            err!("Private key does not exist or invalid format", CONFIG.private_rsa_key());
+        };

-    let (priv_key, priv_key_buffer) = if let Some(priv_key_buffer) = priv_key_buffer {
-        (Rsa::private_key_from_pem(priv_key_buffer.to_vec().as_slice())?, priv_key_buffer.to_vec())
-    } else {
-        let rsa_key = Rsa::generate(2048)?;
-        let priv_key_buffer = rsa_key.private_key_to_pem()?;
-        operator.write(&rsa_key_filename, priv_key_buffer.clone()).await?;
-        info!("Private key '{}' created correctly", CONFIG.private_rsa_key());
-        (rsa_key, priv_key_buffer)
-    };
+        Ok((rsa_key, priv_key_buffer))
+    }
+
+    let (priv_key, priv_key_buffer) = read_key(true).or_else(|_| read_key(false))?;
    let pub_key_buffer = priv_key.public_key_to_pem()?;

    let enc = EncodingKey::from_rsa_pem(&priv_key_buffer)?;
@@ -140,10 +141,6 @@ pub fn decode_file_download(token: &str) -> Result<FileDownloadClaims, Error> {
    decode_jwt(token, JWT_FILE_DOWNLOAD_ISSUER.to_string())
 }

-pub fn decode_register_verify(token: &str) -> Result<RegisterVerifyClaims, Error> {
-    decode_jwt(token, JWT_REGISTER_VERIFY_ISSUER.to_string())
-}
-
 #[derive(Debug, Serialize, Deserialize)]
 pub struct LoginJwtClaims {
    // Not before
@@ -153,7 +150,7 @@ pub struct LoginJwtClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: UserId,
+    pub sub: String,

    pub premium: bool,
    pub name: String,
@@ -174,12 +171,7 @@ pub struct LoginJwtClaims {
    // user security_stamp
    pub sstamp: String,
    // device uuid
-    pub device: DeviceId,
-    // what kind of device, like FirefoxBrowser or Android derived from DeviceType
-    pub devicetype: String,
-    // the type of client_id, like web, cli, desktop, browser or mobile
-    pub client_id: String,
-
+    pub device: String,
    // [ "api", "offline_access" ]
    pub scope: Vec<String>,
    // [ "Application" ]
@@ -195,19 +187,19 @@ pub struct InviteJwtClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: UserId,
+    pub sub: String,

    pub email: String,
-    pub org_id: OrganizationId,
-    pub member_id: MembershipId,
+    pub org_id: Option<String>,
+    pub user_org_id: Option<String>,
    pub invited_by_email: Option<String>,
 }

 pub fn generate_invite_claims(
-    user_id: UserId,
+    uuid: String,
    email: String,
-    org_id: OrganizationId,
-    member_id: MembershipId,
+    org_id: Option<String>,
+    user_org_id: Option<String>,
    invited_by_email: Option<String>,
 ) -> InviteJwtClaims {
    let time_now = Utc::now();
@@ -216,10 +208,10 @@ pub fn generate_invite_claims(
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
        iss: JWT_INVITE_ISSUER.to_string(),
-        sub: user_id,
+        sub: uuid,
        email,
        org_id,
-        member_id,
+        user_org_id,
        invited_by_email,
    }
 }
@@ -233,18 +225,18 @@ pub struct EmergencyAccessInviteJwtClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: UserId,
+    pub sub: String,

    pub email: String,
-    pub emer_id: EmergencyAccessId,
+    pub emer_id: String,
    pub grantor_name: String,
    pub grantor_email: String,
 }

 pub fn generate_emergency_access_invite_claims(
-    user_id: UserId,
+    uuid: String,
    email: String,
-    emer_id: EmergencyAccessId,
+    emer_id: String,
    grantor_name: String,
    grantor_email: String,
 ) -> EmergencyAccessInviteJwtClaims {
@@ -254,7 +246,7 @@ pub fn generate_emergency_access_invite_claims(
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
        iss: JWT_EMERGENCY_ACCESS_INVITE_ISSUER.to_string(),
-        sub: user_id,
+        sub: uuid,
        email,
        emer_id,
        grantor_name,
@@ -271,23 +263,20 @@ pub struct OrgApiKeyLoginJwtClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: OrgApiKeyId,
+    pub sub: String,

    pub client_id: String,
-    pub client_sub: OrganizationId,
+    pub client_sub: String,
    pub scope: Vec<String>,
 }

-pub fn generate_organization_api_key_login_claims(
-    org_api_key_uuid: OrgApiKeyId,
-    org_id: OrganizationId,
-) -> OrgApiKeyLoginJwtClaims {
+pub fn generate_organization_api_key_login_claims(uuid: String, org_id: String) -> OrgApiKeyLoginJwtClaims {
    let time_now = Utc::now();
    OrgApiKeyLoginJwtClaims {
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_hours(1).unwrap()).timestamp(),
        iss: JWT_ORG_API_KEY_ISSUER.to_string(),
-        sub: org_api_key_uuid,
+        sub: uuid,
        client_id: format!("organization.{org_id}"),
        client_sub: org_id,
        scope: vec!["api.organization".into()],
@@ -303,49 +292,22 @@ pub struct FileDownloadClaims {
    // Issuer
    pub iss: String,
    // Subject
-    pub sub: CipherId,
+    pub sub: String,

-    pub file_id: AttachmentId,
+    pub file_id: String,
 }

-pub fn generate_file_download_claims(cipher_id: CipherId, file_id: AttachmentId) -> FileDownloadClaims {
+pub fn generate_file_download_claims(uuid: String, file_id: String) -> FileDownloadClaims {
    let time_now = Utc::now();
    FileDownloadClaims {
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
        iss: JWT_FILE_DOWNLOAD_ISSUER.to_string(),
-        sub: cipher_id,
+        sub: uuid,
        file_id,
    }
 }

-#[derive(Debug, Serialize, Deserialize)]
-pub struct RegisterVerifyClaims {
-    // Not before
-    pub nbf: i64,
-    // Expiration time
-    pub exp: i64,
-    // Issuer
-    pub iss: String,
-    // Subject
-    pub sub: String,
-
-    pub name: Option<String>,
-    pub verified: bool,
-}
-
-pub fn generate_register_verify_claims(email: String, name: Option<String>, verified: bool) -> RegisterVerifyClaims {
-    let time_now = Utc::now();
-    RegisterVerifyClaims {
-        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_minutes(30).unwrap()).timestamp(),
-        iss: JWT_REGISTER_VERIFY_ISSUER.to_string(),
-        sub: email,
-        name,
-        verified,
-    }
-}
-
 #[derive(Debug, Serialize, Deserialize)]
 pub struct BasicJwtClaims {
    // Not before
@@ -369,14 +331,14 @@ pub fn generate_delete_claims(uuid: String) -> BasicJwtClaims {
    }
 }

-pub fn generate_verify_email_claims(user_id: UserId) -> BasicJwtClaims {
+pub fn generate_verify_email_claims(uuid: String) -> BasicJwtClaims {
    let time_now = Utc::now();
    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
    BasicJwtClaims {
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
        iss: JWT_VERIFYEMAIL_ISSUER.to_string(),
-        sub: user_id.to_string(),
+        sub: uuid,
    }
 }

@@ -390,7 +352,7 @@ pub fn generate_admin_claims() -> BasicJwtClaims {
    }
 }

-pub fn generate_send_claims(send_id: &SendId, file_id: &SendFileId) -> BasicJwtClaims {
+pub fn generate_send_claims(send_id: &str, file_id: &str) -> BasicJwtClaims {
    let time_now = Utc::now();
    BasicJwtClaims {
        nbf: time_now.timestamp(),
@@ -409,7 +371,7 @@ use rocket::{
 };

 use crate::db::{
-    models::{Collection, Device, Membership, MembershipStatus, MembershipType, User, UserStampException},
+    models::{Collection, Device, User, UserOrgStatus, UserOrgType, UserOrganization, UserStampException},
    DbConn,
 };

@@ -509,32 +471,36 @@ impl<'r> FromRequest<'r> for Headers {
        };

        // Check JWT token is valid and get device and user from it
-        let Ok(claims) = decode_login(access_token) else {
-            err_handler!("Invalid claim")
+        let claims = match decode_login(access_token) {
+            Ok(claims) => claims,
+            Err(_) => err_handler!("Invalid claim"),
        };

-        let device_id = claims.device;
-        let user_id = claims.sub;
+        let device_uuid = claims.device;
+        let user_uuid = claims.sub;

        let mut conn = match DbConn::from_request(request).await {
            Outcome::Success(conn) => conn,
            _ => err_handler!("Error getting DB"),
        };

-        let Some(device) = Device::find_by_uuid_and_user(&device_id, &user_id, &mut conn).await else {
-            err_handler!("Invalid device id")
+        let device = match Device::find_by_uuid_and_user(&device_uuid, &user_uuid, &mut conn).await {
+            Some(device) => device,
+            None => err_handler!("Invalid device id"),
        };

-        let Some(user) = User::find_by_uuid(&user_id, &mut conn).await else {
-            err_handler!("Device has no user associated")
+        let user = match User::find_by_uuid(&user_uuid, &mut conn).await {
+            Some(user) => user,
+            None => err_handler!("Device has no user associated"),
        };

        if user.security_stamp != claims.sstamp {
            if let Some(stamp_exception) =
                user.stamp_exception.as_deref().and_then(|s| serde_json::from_str::<UserStampException>(s).ok())
            {
-                let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                    err_handler!("Error getting current route for stamp exception")
+                let current_route = match request.route().and_then(|r| r.name.as_deref()) {
+                    Some(name) => name,
+                    _ => err_handler!("Error getting current route for stamp exception"),
                };

                // Check if the stamp exception has expired first.
@@ -546,7 +512,7 @@ impl<'r> FromRequest<'r> for Headers {
                    let mut user = user;
                    user.reset_stamp_exception();
                    if let Err(e) = user.save(&mut conn).await {
-                        error!("Error updating user: {e:#?}");
+                        error!("Error updating user: {:#?}", e);
                    }
                    err_handler!("Stamp exception is expired")
                } else if !stamp_exception.routes.contains(&current_route.to_string()) {
@@ -572,30 +538,11 @@ pub struct OrgHeaders {
    pub host: String,
    pub device: Device,
    pub user: User,
-    pub membership_type: MembershipType,
-    pub membership_status: MembershipStatus,
-    pub membership: Membership,
+    pub org_user_type: UserOrgType,
+    pub org_user: UserOrganization,
    pub ip: ClientIp,
 }

-impl OrgHeaders {
-    fn is_member(&self) -> bool {
-        // NOTE: we don't care about MembershipStatus at the moment because this is only used
-        // where an invited, accepted or confirmed user is expected if this ever changes or
-        // if from_i32 is changed to return Some(Revoked) this check needs to be changed accordingly
-        self.membership_type >= MembershipType::User
-    }
-    fn is_confirmed_and_admin(&self) -> bool {
-        self.membership_status == MembershipStatus::Confirmed && self.membership_type >= MembershipType::Admin
-    }
-    fn is_confirmed_and_manager(&self) -> bool {
-        self.membership_status == MembershipStatus::Confirmed && self.membership_type >= MembershipType::Manager
-    }
-    fn is_confirmed_and_owner(&self) -> bool {
-        self.membership_status == MembershipStatus::Confirmed && self.membership_type == MembershipType::Owner
-    }
-}
-
 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for OrgHeaders {
    type Error = &'static str;
@@ -606,50 +553,55 @@ impl<'r> FromRequest<'r> for OrgHeaders {
        // org_id is usually the second path param ("/organizations/<org_id>"),
        // but there are cases where it is a query value.
        // First check the path, if this is not a valid uuid, try the query values.
-        let url_org_id: Option<OrganizationId> = {
-            if let Some(Ok(org_id)) = request.param::<OrganizationId>(1) {
-                Some(org_id.clone())
-            } else if let Some(Ok(org_id)) = request.query_value::<OrganizationId>("organizationId") {
-                Some(org_id.clone())
-            } else {
-                None
+        let url_org_id: Option<&str> = {
+            let mut url_org_id = None;
+            if let Some(Ok(org_id)) = request.param::<&str>(1) {
+                if uuid::Uuid::parse_str(org_id).is_ok() {
+                    url_org_id = Some(org_id);
+                }
            }
+
+            if let Some(Ok(org_id)) = request.query_value::<&str>("organizationId") {
+                if uuid::Uuid::parse_str(org_id).is_ok() {
+                    url_org_id = Some(org_id);
+                }
+            }
+
+            url_org_id
        };

        match url_org_id {
-            Some(org_id) if uuid::Uuid::parse_str(&org_id).is_ok() => {
+            Some(org_id) => {
                let mut conn = match DbConn::from_request(request).await {
                    Outcome::Success(conn) => conn,
                    _ => err_handler!("Error getting DB"),
                };

                let user = headers.user;
-                let Some(membership) = Membership::find_by_user_and_org(&user.uuid, &org_id, &mut conn).await else {
-                    err_handler!("The current user isn't member of the organization");
+                let org_user = match UserOrganization::find_by_user_and_org(&user.uuid, org_id, &mut conn).await {
+                    Some(user) => {
+                        if user.status == UserOrgStatus::Confirmed as i32 {
+                            user
+                        } else {
+                            err_handler!("The current user isn't confirmed member of the organization")
+                        }
+                    }
+                    None => err_handler!("The current user isn't member of the organization"),
                };

                Outcome::Success(Self {
                    host: headers.host,
                    device: headers.device,
                    user,
-                    membership_type: {
-                        if let Some(member_type) = MembershipType::from_i32(membership.atype) {
-                            member_type
+                    org_user_type: {
+                        if let Some(org_usr_type) = UserOrgType::from_i32(org_user.atype) {
+                            org_usr_type
                        } else {
                            // This should only happen if the DB is corrupted
                            err_handler!("Unknown user type in the database")
                        }
                    },
-                    membership_status: {
-                        if let Some(member_status) = MembershipStatus::from_i32(membership.status) {
-                            // NOTE: add additional check for revoked if from_i32 is ever changed
-                            // to return Revoked status.
-                            member_status
-                        } else {
-                            err_handler!("User status is either revoked or invalid.")
-                        }
-                    },
-                    membership,
+                    org_user,
                    ip: headers.ip,
                })
            }
@@ -662,9 +614,9 @@ pub struct AdminHeaders {
    pub host: String,
    pub device: Device,
    pub user: User,
-    pub membership_type: MembershipType,
+    pub org_user_type: UserOrgType,
+    pub client_version: Option<String>,
    pub ip: ClientIp,
-    pub org_id: OrganizationId,
 }

 #[rocket::async_trait]
@@ -673,14 +625,15 @@ impl<'r> FromRequest<'r> for AdminHeaders {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.is_confirmed_and_admin() {
+        let client_version = request.headers().get_one("Bitwarden-Client-Version").map(String::from);
+        if headers.org_user_type >= UserOrgType::Admin {
            Outcome::Success(Self {
                host: headers.host,
                device: headers.device,
                user: headers.user,
-                membership_type: headers.membership_type,
+                org_user_type: headers.org_user_type,
+                client_version,
                ip: headers.ip,
-                org_id: headers.membership.org_uuid,
            })
        } else {
            err_handler!("You need to be Admin or Owner to call this endpoint")
@@ -688,19 +641,30 @@ impl<'r> FromRequest<'r> for AdminHeaders {
    }
 }

+impl From<AdminHeaders> for Headers {
+    fn from(h: AdminHeaders) -> Headers {
+        Headers {
+            host: h.host,
+            device: h.device,
+            user: h.user,
+            ip: h.ip,
+        }
+    }
+}
+
 // col_id is usually the fourth path param ("/organizations/<org_id>/collections/<col_id>"),
 // but there could be cases where it is a query value.
 // First check the path, if this is not a valid uuid, try the query values.
-fn get_col_id(request: &Request<'_>) -> Option<CollectionId> {
+fn get_col_id(request: &Request<'_>) -> Option<String> {
    if let Some(Ok(col_id)) = request.param::<String>(3) {
        if uuid::Uuid::parse_str(&col_id).is_ok() {
-            return Some(col_id.into());
+            return Some(col_id);
        }
    }

    if let Some(Ok(col_id)) = request.query_value::<String>("collectionId") {
        if uuid::Uuid::parse_str(&col_id).is_ok() {
-            return Some(col_id.into());
+            return Some(col_id);
        }
    }

@@ -715,7 +679,6 @@ pub struct ManagerHeaders {
    pub device: Device,
    pub user: User,
    pub ip: ClientIp,
-    pub org_id: OrganizationId,
 }

 #[rocket::async_trait]
@@ -724,7 +687,7 @@ impl<'r> FromRequest<'r> for ManagerHeaders {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.is_confirmed_and_manager() {
+        if headers.org_user_type >= UserOrgType::Manager {
            match get_col_id(request) {
                Some(col_id) => {
                    let mut conn = match DbConn::from_request(request).await {
@@ -732,7 +695,7 @@ impl<'r> FromRequest<'r> for ManagerHeaders {
                        _ => err_handler!("Error getting DB"),
                    };

-                    if !Collection::can_access_collection(&headers.membership, &col_id, &mut conn).await {
+                    if !Collection::can_access_collection(&headers.org_user, &col_id, &mut conn).await {
                        err_handler!("The current user isn't a manager for this collection")
                    }
                }
@@ -744,7 +707,6 @@ impl<'r> FromRequest<'r> for ManagerHeaders {
                device: headers.device,
                user: headers.user,
                ip: headers.ip,
-                org_id: headers.membership.org_uuid,
            })
        } else {
            err_handler!("You need to be a Manager, Admin or Owner to call this endpoint")
@@ -769,7 +731,7 @@ pub struct ManagerHeadersLoose {
    pub host: String,
    pub device: Device,
    pub user: User,
-    pub membership: Membership,
+    pub org_user: UserOrganization,
    pub ip: ClientIp,
 }

@@ -779,12 +741,12 @@ impl<'r> FromRequest<'r> for ManagerHeadersLoose {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.is_confirmed_and_manager() {
+        if headers.org_user_type >= UserOrgType::Manager {
            Outcome::Success(Self {
                host: headers.host,
                device: headers.device,
                user: headers.user,
-                membership: headers.membership,
+                org_user: headers.org_user,
                ip: headers.ip,
            })
        } else {
@@ -807,14 +769,14 @@ impl From<ManagerHeadersLoose> for Headers {
 impl ManagerHeaders {
    pub async fn from_loose(
        h: ManagerHeadersLoose,
-        collections: &Vec<CollectionId>,
+        collections: &Vec<String>,
        conn: &mut DbConn,
    ) -> Result<ManagerHeaders, Error> {
        for col_id in collections {
-            if uuid::Uuid::parse_str(col_id.as_ref()).is_err() {
+            if uuid::Uuid::parse_str(col_id).is_err() {
                err!("Collection Id is malformed!");
            }
-            if !Collection::can_access_collection(&h.membership, col_id, conn).await {
+            if !Collection::can_access_collection(&h.org_user, col_id, conn).await {
                err!("You don't have access to all collections!");
            }
        }
@@ -824,7 +786,6 @@ impl ManagerHeaders {
            device: h.device,
            user: h.user,
            ip: h.ip,
-            org_id: h.membership.org_uuid,
        })
    }
 }
@@ -833,7 +794,6 @@ pub struct OwnerHeaders {
    pub device: Device,
    pub user: User,
    pub ip: ClientIp,
-    pub org_id: OrganizationId,
 }

 #[rocket::async_trait]
@@ -842,12 +802,11 @@ impl<'r> FromRequest<'r> for OwnerHeaders {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.is_confirmed_and_owner() {
+        if headers.org_user_type == UserOrgType::Owner {
            Outcome::Success(Self {
                device: headers.device,
                user: headers.user,
                ip: headers.ip,
-                org_id: headers.membership.org_uuid,
            })
        } else {
            err_handler!("You need to be Owner to call this endpoint")
@@ -855,45 +814,6 @@ impl<'r> FromRequest<'r> for OwnerHeaders {
    }
 }

-pub struct OrgMemberHeaders {
-    pub host: String,
-    pub device: Device,
-    pub user: User,
-    pub membership: Membership,
-    pub ip: ClientIp,
-}
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for OrgMemberHeaders {
-    type Error = &'static str;
-
-    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.is_member() {
-            Outcome::Success(Self {
-                host: headers.host,
-                device: headers.device,
-                user: headers.user,
-                membership: headers.membership,
-                ip: headers.ip,
-            })
-        } else {
-            err_handler!("You need to be a Member of the Organization to call this endpoint")
-        }
-    }
-}
-
-impl From<OrgMemberHeaders> for Headers {
-    fn from(h: OrgMemberHeaders) -> Headers {
-        Headers {
-            host: h.host,
-            device: h.device,
-            user: h.user,
-            ip: h.ip,
-        }
-    }
-}
-
 //
 // Client IP address detection
 //
@@ -914,7 +834,7 @@ impl<'r> FromRequest<'r> for ClientIp {
                    None => ip,
                }
                .parse()
-                .map_err(|_| warn!("'{}' header is malformed: {ip}", CONFIG.ip_header()))
+                .map_err(|_| warn!("'{}' header is malformed: {}", CONFIG.ip_header(), ip))
                .ok()
            })
        } else {
@@ -980,24 +900,3 @@ impl<'r> FromRequest<'r> for WsAccessTokenHeader {
        })
    }
 }
-
-pub struct ClientVersion(pub semver::Version);
-
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for ClientVersion {
-    type Error = &'static str;
-
-    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let headers = request.headers();
-
-        let Some(version) = headers.get_one("Bitwarden-Client-Version") else {
-            err_handler!("No Bitwarden-Client-Version header provided")
-        };
-
-        let Ok(version) = semver::Version::parse(version) else {
-            err_handler!("Invalid Bitwarden-Client-Version header provided")
-        };
-
-        Outcome::Success(ClientVersion(version))
-    }
-}
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,10 +1,8 @@
-use std::{
-    env::consts::EXE_SUFFIX,
-    process::exit,
-    sync::{
-        atomic::{AtomicBool, Ordering},
-        LazyLock, RwLock,
-    },
+use std::env::consts::EXE_SUFFIX;
+use std::process::exit;
+use std::sync::{
+    atomic::{AtomicBool, Ordering},
+    RwLock,
 };

 use job_scheduler_ng::Schedule;
@@ -14,7 +12,7 @@ use reqwest::Url;
 use crate::{
    db::DbConnType,
    error::Error,
-    util::{get_env, get_env_bool, get_web_vault_version, is_valid_email, parse_experimental_client_feature_flags},
+    util::{get_env, get_env_bool, parse_experimental_client_feature_flags},
 };

 static CONFIG_FILE: Lazy<String> = Lazy::new(|| {
@@ -22,32 +20,10 @@ static CONFIG_FILE: Lazy<String> = Lazy::new(|| {
    get_env("CONFIG_FILE").unwrap_or_else(|| format!("{data_folder}/config.json"))
 });

-static CONFIG_FILE_PARENT_DIR: LazyLock<String> = LazyLock::new(|| {
-    let path = std::path::PathBuf::from(&*CONFIG_FILE);
-    path.parent().unwrap_or(std::path::Path::new("data")).to_str().unwrap_or("data").to_string()
-});
-
-static CONFIG_FILENAME: LazyLock<String> = LazyLock::new(|| {
-    let path = std::path::PathBuf::from(&*CONFIG_FILE);
-    path.file_name().unwrap_or(std::ffi::OsStr::new("config.json")).to_str().unwrap_or("config.json").to_string()
-});
-
 pub static SKIP_CONFIG_VALIDATION: AtomicBool = AtomicBool::new(false);

 pub static CONFIG: Lazy<Config> = Lazy::new(|| {
-    std::thread::spawn(|| {
-        let rt = tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap_or_else(|e| {
-            println!("Error loading config:\n  {e:?}\n");
-            exit(12)
-        });
-
-        rt.block_on(Config::load()).unwrap_or_else(|e| {
-            println!("Error loading config:\n  {e:?}\n");
-            exit(12)
-        })
-    })
-    .join()
-    .unwrap_or_else(|e| {
+    Config::load().unwrap_or_else(|e| {
        println!("Error loading config:\n  {e:?}\n");
        exit(12)
    })
@@ -126,25 +102,16 @@ macro_rules! make_config {

                let mut builder = ConfigBuilder::default();
                $($(
-                    builder.$name = make_config! { @getenv pastey::paste!(stringify!([<$name:upper>])), $ty };
+                    builder.$name = make_config! { @getenv paste::paste!(stringify!([<$name:upper>])), $ty };
                )+)+

                builder
            }

-            async fn from_file() -> Result<Self, Error> {
-                let operator = opendal_operator_for_path(&CONFIG_FILE_PARENT_DIR)?;
-                let config_bytes = operator.read(&CONFIG_FILENAME).await?;
-                println!("[INFO] Using saved config from `{}` for configuration.\n", *CONFIG_FILE);
-                serde_json::from_slice(&config_bytes.to_vec()).map_err(Into::into)
-            }
-
-            fn clear_non_editable(&mut self) {
-                $($(
-                    if !$editable {
-                        self.$name = None;
-                    }
-                )+)+
+            fn from_file(path: &str) -> Result<Self, Error> {
+                let config_str = std::fs::read_to_string(path)?;
+                println!("[INFO] Using saved config from `{path}` for configuration.\n");
+                serde_json::from_str(&config_str).map_err(Into::into)
            }

            /// Merges the values of both builders into a new builder.
@@ -156,7 +123,7 @@ macro_rules! make_config {
                        builder.$name = v.clone();

                        if self.$name.is_some() {
-                            overrides.push(pastey::paste!(stringify!([<$name:upper>])).into());
+                            overrides.push(paste::paste!(stringify!([<$name:upper>])).into());
                        }
                    }
                )+)+
@@ -254,7 +221,7 @@ macro_rules! make_config {
                                element.insert("default".into(), serde_json::to_value(def.$name).unwrap());
                                element.insert("type".into(), (_get_form_type(stringify!($ty))).into());
                                element.insert("doc".into(), (_get_doc(concat!($($doc),+))).into());
-                                element.insert("overridden".into(), (overridden.contains(&pastey::paste!(stringify!([<$name:upper>])).into())).into());
+                                element.insert("overridden".into(), (overridden.contains(&paste::paste!(stringify!([<$name:upper>])).into())).into());
                                element
                            }),
                        )+
@@ -271,7 +238,6 @@ macro_rules! make_config {
                // Besides Pass, only String types will be masked via _privacy_mask.
                const PRIVACY_CONFIG: &[&str] = &[
                    "allowed_iframe_ancestors",
-                    "allowed_connect_src",
                    "database_url",
                    "domain_origin",
                    "domain_path",
@@ -282,7 +248,6 @@ macro_rules! make_config {
                    "smtp_from",
                    "smtp_host",
                    "smtp_username",
-                    "_smtp_img_src",
                ];

                let cfg = {
@@ -398,19 +363,19 @@ make_config! {
        ///  Data folder |> Main data folder
        data_folder:            String, false,  def,    "data".to_string();
        /// Database URL
-        database_url:           String, false,  auto,   |c| format!("{}/db.sqlite3", c.data_folder);
+        database_url:           String, false,  auto,   |c| format!("{}/{}", c.data_folder, "db.sqlite3");
        /// Icon cache folder
-        icon_cache_folder:      String, false,  auto,   |c| format!("{}/icon_cache", c.data_folder);
+        icon_cache_folder:      String, false,  auto,   |c| format!("{}/{}", c.data_folder, "icon_cache");
        /// Attachments folder
-        attachments_folder:     String, false,  auto,   |c| format!("{}/attachments", c.data_folder);
+        attachments_folder:     String, false,  auto,   |c| format!("{}/{}", c.data_folder, "attachments");
        /// Sends folder
-        sends_folder:           String, false,  auto,   |c| format!("{}/sends", c.data_folder);
+        sends_folder:           String, false,  auto,   |c| format!("{}/{}", c.data_folder, "sends");
        /// Temp folder |> Used for storing temporary file uploads
-        tmp_folder:             String, false,  auto,   |c| format!("{}/tmp", c.data_folder);
+        tmp_folder:             String, false,  auto,   |c| format!("{}/{}", c.data_folder, "tmp");
        /// Templates folder
-        templates_folder:       String, false,  auto,   |c| format!("{}/templates", c.data_folder);
+        templates_folder:       String, false,  auto,   |c| format!("{}/{}", c.data_folder, "templates");
        /// Session JWT key
-        rsa_key_filename:       String, false,  auto,   |c| format!("{}/rsa_key", c.data_folder);
+        rsa_key_filename:       String, false,  auto,   |c| format!("{}/{}", c.data_folder, "rsa_key");
        /// Web vault folder
        web_vault_folder:       String, false,  def,    "web-vault/".to_string();
    },
@@ -507,8 +472,7 @@ make_config! {
        disable_icon_download:  bool,   true,   def,    false;
        /// Allow new signups |> Controls whether new users can register. Users can be invited by the vaultwarden admin even if this is disabled
        signups_allowed:        bool,   true,   def,    true;
-        /// Require email verification on signups. On new client versions, this will require verification at signup time. On older clients,
-        /// this will prevent logins from succeeding until the address has been verified
+        /// Require email verification on signups. This will prevent logins from succeeding until the address has been verified
        signups_verify:         bool,   true,   def,    false;
        /// If signups require email verification, automatically re-send verification email if it hasn't been sent for a while (in seconds)
        signups_verify_resend_time: u64, true,  def,    3_600;
@@ -533,11 +497,11 @@ make_config! {
        /// Password iterations |> Number of server-side passwords hashing iterations for the password hash.
        /// The default for new users. If changed, it will be updated during login for existing users.
        password_iterations:    i32,    true,   def,    600_000;
-        /// Allow password hints |> Controls whether users can set or show password hints. This setting applies globally to all users.
+        /// Allow password hints |> Controls whether users can set password hints. This setting applies globally to all users.
        password_hints_allowed: bool,   true,   def,    true;
-        /// Show password hint (Know the risks!) |> Controls whether a password hint should be shown directly in the web page
-        /// if SMTP service is not configured and password hints are allowed. Not recommended for publicly-accessible instances
-        /// because this provides unauthenticated access to potentially sensitive data.
+        /// Show password hint |> Controls whether a password hint should be shown directly in the web page
+        /// if SMTP service is not configured. Not recommended for publicly-accessible instances as this
+        /// provides unauthenticated access to potentially sensitive data.
        show_password_hint:     bool,   true,   def,    false;

        /// Admin token/Argon2 PHC |> The plain text token or Argon2 PHC string used to authenticate in this very same page. Changing it here will not deauthorize the current session!
@@ -602,7 +566,7 @@ make_config! {
        authenticator_disable_time_drift: bool, true, def, false;

        /// Customize the enabled feature flags on the clients |> This is a comma separated list of feature flags to enable.
-        experimental_client_feature_flags: String, false, def, String::new();
+        experimental_client_feature_flags: String, false, def, "fido2-vault-credentials".to_string();

        /// Require new device emails |> When a user logs in an email is required to be sent.
        /// If sending the email fails the login attempt will fail.
@@ -645,9 +609,6 @@ make_config! {
        /// Allowed iframe ancestors (Know the risks!) |> Allows other domains to embed the web vault into an iframe, useful for embedding into secure intranets
        allowed_iframe_ancestors: String, true, def,    String::new();

-        /// Allowed connect-src (Know the risks!) |> Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
-        allowed_connect_src:      String, true, def,    String::new();
-
        /// Seconds between login requests |> Number of seconds, on average, between login and 2FA requests from the same IP address before rate limiting kicks in
        login_ratelimit_seconds:       u64, false, def, 60;
        /// Max burst size for login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `login_ratelimit_seconds`. Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2
@@ -694,9 +655,9 @@ make_config! {
        _enable_duo:            bool,   true,   def,     true;
        /// Attempt to use deprecated iframe-based Traditional Prompt (Duo WebSDK 2)
        duo_use_iframe:         bool,   false,  def,     false;
-        /// Client Id
+        /// Integration Key
        duo_ikey:               String, true,   option;
-        /// Client Secret
+        /// Secret Key
        duo_skey:               Pass,   true,   option;
        /// Host
        duo_host:               String, true,   option;
@@ -711,7 +672,7 @@ make_config! {
        /// Use Sendmail |> Whether to send mail via the `sendmail` command
        use_sendmail:                  bool,   true,   def,     false;
        /// Sendmail Command |> Which sendmail command to use. The one found in the $PATH is used if not specified.
-        sendmail_command:              String, false,  option;
+        sendmail_command:              String, true,   option;
        /// Host
        smtp_host:                     String, true,   option;
        /// DEPRECATED smtp_ssl |> DEPRECATED - Please use SMTP_SECURITY
@@ -758,7 +719,7 @@ make_config! {
        email_expiration_time:  u64,    true,   def,      600;
        /// Maximum attempts |> Maximum attempts before an email token is reset and a new email will need to be sent
        email_attempts_limit:   u64,    true,   def,      3;
-        /// Setup email 2FA at signup |> Setup email 2FA provider on registration regardless of any organization policy
+        /// Automatically enforce at login |> Setup email 2FA provider regardless of any organization policy
        email_2fa_enforce_on_verified_invite: bool,   true,   def,      false;
        /// Auto-enable 2FA (Know the risks!) |> Automatically setup email 2FA as fallback provider when needed
        email_2fa_auto_fallback: bool,  true,   def,      false;
@@ -799,13 +760,6 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
        );
    }

-    let connect_src = cfg.allowed_connect_src.to_lowercase();
-    for url in connect_src.split_whitespace() {
-        if !url.starts_with("https://") || Url::parse(url).is_err() {
-            err!("ALLOWED_CONNECT_SRC variable contains one or more invalid URLs. Only FQDN's starting with https are allowed");
-        }
-    }
-
    let whitelist = &cfg.signups_domains_whitelist;
    if !whitelist.is_empty() && whitelist.split(',').any(|d| d.trim().is_empty()) {
        err!("`SIGNUPS_DOMAINS_WHITELIST` contains empty tokens");
@@ -856,26 +810,9 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
        }
    }

-    // Server (v2025.6.2): https://github.com/bitwarden/server/blob/d094be3267f2030bd0dc62106bc6871cf82682f5/src/Core/Constants.cs#L103
-    // Client (web-v2025.6.1): https://github.com/bitwarden/clients/blob/747c2fd6a1c348a57a76e4a7de8128466ffd3c01/libs/common/src/enums/feature-flag.enum.ts#L12
-    // Android (v2025.6.0): https://github.com/bitwarden/android/blob/b5b022caaad33390c31b3021b2c1205925b0e1a2/app/src/main/kotlin/com/x8bit/bitwarden/data/platform/manager/model/FlagKey.kt#L22
-    // iOS (v2025.6.0): https://github.com/bitwarden/ios/blob/ff06d9c6cc8da89f78f37f376495800201d7261a/BitwardenShared/Core/Platform/Models/Enum/FeatureFlag.swift#L7
-    //
-    // NOTE: Move deprecated flags to the utils::parse_experimental_client_feature_flags() DEPRECATED_FLAGS const!
-    const KNOWN_FLAGS: &[&str] = &[
-        // Autofill Team
-        "inline-menu-positioning-improvements",
-        "inline-menu-totp",
-        "ssh-agent",
-        // Key Management Team
-        "ssh-key-vault-item",
-        // Tools
-        "export-attachments",
-        // Mobile Team
-        "anon-addy-self-host-alias",
-        "simple-login-self-host-alias",
-        "mutual-tls",
-    ];
+    // TODO: deal with deprecated flags so they can be removed from this list, cf. #4263
+    const KNOWN_FLAGS: &[&str] =
+        &["autofill-overlay", "autofill-v2", "browser-fileless-import", "extension-refresh", "fido2-vault-credentials"];
    let configured_flags = parse_experimental_client_feature_flags(&cfg.experimental_client_feature_flags);
    let invalid_flags: Vec<_> = configured_flags.keys().filter(|flag| !KNOWN_FLAGS.contains(&flag.as_str())).collect();
    if !invalid_flags.is_empty() {
@@ -936,12 +873,12 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
            let command = cfg.sendmail_command.clone().unwrap_or_else(|| format!("sendmail{EXE_SUFFIX}"));

            let mut path = std::path::PathBuf::from(&command);
-            // Check if we can find the sendmail command to execute when no absolute path is given
+
            if !path.is_absolute() {
-                let Ok(which_path) = which::which(&command) else {
-                    err!(format!("sendmail command {command} not found in $PATH"))
-                };
-                path = which_path;
+                match which::which(&command) {
+                    Ok(result) => path = result,
+                    Err(_) => err!(format!("sendmail command {command:?} not found in $PATH")),
+                }
            }

            match path.metadata() {
@@ -975,8 +912,8 @@ fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
            }
        }

-        if (cfg.smtp_host.is_some() || cfg.use_sendmail) && !is_valid_email(&cfg.smtp_from) {
-            err!(format!("SMTP_FROM '{}' is not a valid email address", cfg.smtp_from))
+        if (cfg.smtp_host.is_some() || cfg.use_sendmail) && !cfg.smtp_from.contains('@') {
+            err!("SMTP_FROM does not contain a mandatory @ sign")
        }

        if cfg._enable_email_2fa && cfg.email_token_size < 6 {
@@ -1161,103 +1098,11 @@ fn smtp_convert_deprecated_ssl_options(smtp_ssl: Option<bool>, smtp_explicit_tls
    "starttls".to_string()
 }

-fn opendal_operator_for_path(path: &str) -> Result<opendal::Operator, Error> {
-    // Cache of previously built operators by path
-    static OPERATORS_BY_PATH: LazyLock<dashmap::DashMap<String, opendal::Operator>> =
-        LazyLock::new(dashmap::DashMap::new);
-
-    if let Some(operator) = OPERATORS_BY_PATH.get(path) {
-        return Ok(operator.clone());
-    }
-
-    let operator = if path.starts_with("s3://") {
-        #[cfg(not(s3))]
-        return Err(opendal::Error::new(opendal::ErrorKind::ConfigInvalid, "S3 support is not enabled").into());
-
-        #[cfg(s3)]
-        opendal_s3_operator_for_path(path)?
-    } else {
-        let builder = opendal::services::Fs::default().root(path);
-        opendal::Operator::new(builder)?.finish()
-    };
-
-    OPERATORS_BY_PATH.insert(path.to_string(), operator.clone());
-
-    Ok(operator)
-}
-
-#[cfg(s3)]
-fn opendal_s3_operator_for_path(path: &str) -> Result<opendal::Operator, Error> {
-    use crate::http_client::aws::AwsReqwestConnector;
-    use aws_config::{default_provider::credentials::DefaultCredentialsChain, provider_config::ProviderConfig};
-
-    // This is a custom AWS credential loader that uses the official AWS Rust
-    // SDK config crate to load credentials. This ensures maximum compatibility
-    // with AWS credential configurations. For example, OpenDAL doesn't support
-    // AWS SSO temporary credentials yet.
-    struct OpenDALS3CredentialLoader {}
-
-    #[async_trait]
-    impl reqsign::AwsCredentialLoad for OpenDALS3CredentialLoader {
-        async fn load_credential(&self, _client: reqwest::Client) -> anyhow::Result<Option<reqsign::AwsCredential>> {
-            use aws_credential_types::provider::ProvideCredentials as _;
-            use tokio::sync::OnceCell;
-
-            static DEFAULT_CREDENTIAL_CHAIN: OnceCell<DefaultCredentialsChain> = OnceCell::const_new();
-
-            let chain = DEFAULT_CREDENTIAL_CHAIN
-                .get_or_init(|| {
-                    let reqwest_client = reqwest::Client::builder().build().unwrap();
-                    let connector = AwsReqwestConnector {
-                        client: reqwest_client,
-                    };
-
-                    let conf = ProviderConfig::default().with_http_client(connector);
-
-                    DefaultCredentialsChain::builder().configure(conf).build()
-                })
-                .await;
-
-            let creds = chain.provide_credentials().await?;
-
-            Ok(Some(reqsign::AwsCredential {
-                access_key_id: creds.access_key_id().to_string(),
-                secret_access_key: creds.secret_access_key().to_string(),
-                session_token: creds.session_token().map(|s| s.to_string()),
-                expires_in: creds.expiry().map(|expiration| expiration.into()),
-            }))
-        }
-    }
-
-    const OPEN_DAL_S3_CREDENTIAL_LOADER: OpenDALS3CredentialLoader = OpenDALS3CredentialLoader {};
-
-    let url = Url::parse(path).map_err(|e| format!("Invalid path S3 URL path {path:?}: {e}"))?;
-
-    let bucket = url.host_str().ok_or_else(|| format!("Missing Bucket name in data folder S3 URL {path:?}"))?;
-
-    let builder = opendal::services::S3::default()
-        .customized_credential_load(Box::new(OPEN_DAL_S3_CREDENTIAL_LOADER))
-        .enable_virtual_host_style()
-        .bucket(bucket)
-        .root(url.path())
-        .default_storage_class("INTELLIGENT_TIERING");
-
-    Ok(opendal::Operator::new(builder)?.finish())
-}
-
-pub enum PathType {
-    Data,
-    IconCache,
-    Attachments,
-    Sends,
-    RsaKey,
-}
-
 impl Config {
-    pub async fn load() -> Result<Self, Error> {
+    pub fn load() -> Result<Self, Error> {
        // Loading from env and file
        let _env = ConfigBuilder::from_env();
-        let _usr = ConfigBuilder::from_file().await.unwrap_or_default();
+        let _usr = ConfigBuilder::from_file(&CONFIG_FILE).unwrap_or_default();

        // Create merged config, config file overwrites env
        let mut _overrides = Vec::new();
@@ -1281,17 +1126,12 @@ impl Config {
        })
    }

-    pub async fn update_config(&self, other: ConfigBuilder, ignore_non_editable: bool) -> Result<(), Error> {
+    pub fn update_config(&self, other: ConfigBuilder) -> Result<(), Error> {
        // Remove default values
        //let builder = other.remove(&self.inner.read().unwrap()._env);

        // TODO: Remove values that are defaults, above only checks those set by env and not the defaults
-        let mut builder = other;
-
-        // Remove values that are not editable
-        if ignore_non_editable {
-            builder.clear_non_editable();
-        }
+        let builder = other;

        // Serialize now before we consume the builder
        let config_str = serde_json::to_string_pretty(&builder)?;
@@ -1313,19 +1153,20 @@ impl Config {
        }

        //Save to file
-        let operator = opendal_operator_for_path(&CONFIG_FILE_PARENT_DIR)?;
-        operator.write(&CONFIG_FILENAME, config_str).await?;
+        use std::{fs::File, io::Write};
+        let mut file = File::create(&*CONFIG_FILE)?;
+        file.write_all(config_str.as_bytes())?;

        Ok(())
    }

-    async fn update_config_partial(&self, other: ConfigBuilder) -> Result<(), Error> {
+    fn update_config_partial(&self, other: ConfigBuilder) -> Result<(), Error> {
        let builder = {
            let usr = &self.inner.read().unwrap()._usr;
            let mut _overrides = Vec::new();
            usr.merge(&other, false, &mut _overrides)
        };
-        self.update_config(builder, false).await
+        self.update_config(builder)
    }

    /// Tests whether an email's domain is allowed. A domain is allowed if it
@@ -1334,7 +1175,7 @@ impl Config {
    pub fn is_email_domain_allowed(&self, email: &str) -> bool {
        let e: Vec<&str> = email.rsplitn(2, '@').collect();
        if e.len() != 2 || e[0].is_empty() || e[1].is_empty() {
-            warn!("Failed to parse email address '{email}'");
+            warn!("Failed to parse email address '{}'", email);
            return false;
        }
        let email_domain = e[0].to_lowercase();
@@ -1354,14 +1195,6 @@ impl Config {
        }
    }

-    // The registration link should be hidden if signup is not allowed and whitelist is empty
-    // unless mail is disabled and invitations are allowed
-    pub fn is_signup_disabled(&self) -> bool {
-        !self.signups_allowed()
-            && self.signups_domains_whitelist().is_empty()
-            && (self.mail_enabled() || !self.invitations_allowed())
-    }
-
    /// Tests whether the specified user is allowed to create an organization.
    pub fn is_org_creation_allowed(&self, email: &str) -> bool {
        let users = self.org_creation_users();
@@ -1375,9 +1208,8 @@ impl Config {
        }
    }

-    pub async fn delete_user_config(&self) -> Result<(), Error> {
-        let operator = opendal_operator_for_path(&CONFIG_FILE_PARENT_DIR)?;
-        operator.delete(&CONFIG_FILENAME).await?;
+    pub fn delete_user_config(&self) -> Result<(), Error> {
+        std::fs::remove_file(&*CONFIG_FILE)?;

        // Empty user config
        let usr = ConfigBuilder::default();
@@ -1407,7 +1239,7 @@ impl Config {
        inner._enable_smtp && (inner.smtp_host.is_some() || inner.use_sendmail)
    }

-    pub async fn get_duo_akey(&self) -> String {
+    pub fn get_duo_akey(&self) -> String {
        if let Some(akey) = self._duo_akey() {
            akey
        } else {
@@ -1418,7 +1250,7 @@ impl Config {
                _duo_akey: Some(akey_s.clone()),
                ..Default::default()
            };
-            self.update_config_partial(builder).await.ok();
+            self.update_config_partial(builder).ok();

            akey_s
        }
@@ -1431,39 +1263,17 @@ impl Config {
        token.is_some() && !token.unwrap().trim().is_empty()
    }

-    pub fn opendal_operator_for_path_type(&self, path_type: PathType) -> Result<opendal::Operator, Error> {
-        let path = match path_type {
-            PathType::Data => self.data_folder(),
-            PathType::IconCache => self.icon_cache_folder(),
-            PathType::Attachments => self.attachments_folder(),
-            PathType::Sends => self.sends_folder(),
-            PathType::RsaKey => std::path::Path::new(&self.rsa_key_filename())
-                .parent()
-                .ok_or_else(|| std::io::Error::other("Failed to get directory of RSA key file"))?
-                .to_str()
-                .ok_or_else(|| std::io::Error::other("Failed to convert RSA key file directory to UTF-8 string"))?
-                .to_string(),
-        };
-
-        opendal_operator_for_path(&path)
-    }
-
    pub fn render_template<T: serde::ser::Serialize>(&self, name: &str, data: &T) -> Result<String, Error> {
        if self.reload_templates() {
            warn!("RELOADING TEMPLATES");
            let hb = load_templates(CONFIG.templates_folder());
            hb.render(name, data).map_err(Into::into)
        } else {
-            let hb = &self.inner.read().unwrap().templates;
+            let hb = &CONFIG.inner.read().unwrap().templates;
            hb.render(name, data).map_err(Into::into)
        }
    }

-    pub fn render_fallback_template<T: serde::ser::Serialize>(&self, name: &str, data: &T) -> Result<String, Error> {
-        let hb = &self.inner.read().unwrap().templates;
-        hb.render(&format!("fallback_{name}"), data).map_err(Into::into)
-    }
-
    pub fn set_rocket_shutdown_handle(&self, handle: rocket::Shutdown) {
        self.inner.write().unwrap().rocket_shutdown_handle = Some(handle);
    }
@@ -1492,8 +1302,6 @@ where
    // Register helpers
    hb.register_helper("case", Box::new(case_helper));
    hb.register_helper("to_json", Box::new(to_json));
-    hb.register_helper("webver", Box::new(webver));
-    hb.register_helper("vwver", Box::new(vwver));

    macro_rules! reg {
        ($name:expr) => {{
@@ -1504,11 +1312,6 @@ where
            reg!($name);
            reg!(concat!($name, $ext));
        }};
-        (@withfallback $name:expr) => {{
-            let template = include_str!(concat!("static/templates/", $name, ".hbs"));
-            hb.register_template_string($name, template).unwrap();
-            hb.register_template_string(concat!("fallback_", $name), template).unwrap();
-        }};
    }

    // First register default templates here
@@ -1517,7 +1320,6 @@ where
    reg!("email/email_footer_text");

    reg!("email/admin_reset_password", ".html");
-    reg!("email/change_email_existing", ".html");
    reg!("email/change_email", ".html");
    reg!("email/delete_account", ".html");
    reg!("email/emergency_access_invite_accepted", ".html");
@@ -1534,7 +1336,6 @@ where
    reg!("email/protected_action", ".html");
    reg!("email/pw_hint_none", ".html");
    reg!("email/pw_hint_some", ".html");
-    reg!("email/register_verify_email", ".html");
    reg!("email/send_2fa_removed_from_org", ".html");
    reg!("email/send_emergency_access_invite", ".html");
    reg!("email/send_org_invite", ".html");
@@ -1554,9 +1355,6 @@ where

    reg!("404");

-    reg!(@withfallback "scss/vaultwarden.scss");
-    reg!("scss/user.vaultwarden.scss");
-
    // And then load user templates to overwrite the defaults
    // Use .hbs extension for the files
    // Templates get registered with their relative name
@@ -1599,42 +1397,3 @@ fn to_json<'reg, 'rc>(
    out.write(&json)?;
    Ok(())
 }
-
-// Configure the web-vault version as an integer so it can be used as a comparison smaller or greater then.
-// The default is based upon the version since this feature is added.
-static WEB_VAULT_VERSION: Lazy<semver::Version> = Lazy::new(|| {
-    let vault_version = get_web_vault_version();
-    // Use a single regex capture to extract version components
-    let re = regex::Regex::new(r"(\d{4})\.(\d{1,2})\.(\d{1,2})").unwrap();
-    re.captures(&vault_version)
-        .and_then(|c| {
-            (c.len() == 4).then(|| {
-                format!("{}.{}.{}", c.get(1).unwrap().as_str(), c.get(2).unwrap().as_str(), c.get(3).unwrap().as_str())
-            })
-        })
-        .and_then(|v| semver::Version::parse(&v).ok())
-        .unwrap_or_else(|| semver::Version::parse("2024.6.2").unwrap())
-});
-
-// Configure the Vaultwarden version as an integer so it can be used as a comparison smaller or greater then.
-// The default is based upon the version since this feature is added.
-static VW_VERSION: Lazy<semver::Version> = Lazy::new(|| {
-    let vw_version = crate::VERSION.unwrap_or("1.32.5");
-    // Use a single regex capture to extract version components
-    let re = regex::Regex::new(r"(\d{1})\.(\d{1,2})\.(\d{1,2})").unwrap();
-    re.captures(vw_version)
-        .and_then(|c| {
-            (c.len() == 4).then(|| {
-                format!("{}.{}.{}", c.get(1).unwrap().as_str(), c.get(2).unwrap().as_str(), c.get(3).unwrap().as_str())
-            })
-        })
-        .and_then(|v| semver::Version::parse(&v).ok())
-        .unwrap_or_else(|| semver::Version::parse("1.32.5").unwrap())
-});
-
-handlebars::handlebars_helper!(webver: | web_vault_version: String |
-    semver::VersionReq::parse(&web_vault_version).expect("Invalid web-vault version compare string").matches(&WEB_VAULT_VERSION)
-);
-handlebars::handlebars_helper!(vwver: | vw_version: String |
-    semver::VersionReq::parse(&vw_version).expect("Invalid Vaultwarden version compare string").matches(&VW_VERSION)
-);
--- a/src/crypto.rs
+++ b/src/crypto.rs
@@ -6,7 +6,7 @@ use std::num::NonZeroU32;
 use data_encoding::{Encoding, HEXLOWER};
 use ring::{digest, hmac, pbkdf2};

-const DIGEST_ALG: pbkdf2::Algorithm = pbkdf2::PBKDF2_HMAC_SHA256;
+static DIGEST_ALG: pbkdf2::Algorithm = pbkdf2::PBKDF2_HMAC_SHA256;
 const OUTPUT_LEN: usize = digest::SHA256_OUTPUT_LEN;

 pub fn hash_password(secret: &[u8], salt: &[u8], iterations: u32) -> Vec<u8> {
@@ -56,11 +56,11 @@ pub fn encode_random_bytes<const N: usize>(e: Encoding) -> String {
 pub fn get_random_string(alphabet: &[u8], num_chars: usize) -> String {
    // Ref: https://rust-lang-nursery.github.io/rust-cookbook/algorithms/randomness.html
    use rand::Rng;
-    let mut rng = rand::rng();
+    let mut rng = rand::thread_rng();

    (0..num_chars)
        .map(|_| {
-            let i = rng.random_range(0..alphabet.len());
+            let i = rng.gen_range(0..alphabet.len());
            alphabet[i] as char
        })
        .collect()
@@ -84,15 +84,14 @@ pub fn generate_id<const N: usize>() -> String {
    encode_random_bytes::<N>(HEXLOWER)
 }

-pub fn generate_send_file_id() -> String {
-    // Send File IDs are globally scoped, so make them longer to avoid collisions.
+pub fn generate_send_id() -> String {
+    // Send IDs are globally scoped, so make them longer to avoid collisions.
    generate_id::<32>() // 256 bits
 }

-use crate::db::models::AttachmentId;
-pub fn generate_attachment_id() -> AttachmentId {
+pub fn generate_attachment_id() -> String {
    // Attachment IDs are scoped to a cipher, so they can be smaller.
-    AttachmentId(generate_id::<10>()) // 80 bits
+    generate_id::<10>() // 80 bits
 }

 /// Generates a numeric token for email-based verifications.
@@ -110,6 +109,7 @@ pub fn generate_api_key() -> String {
 // Constant time compare
 //
 pub fn ct_eq<T: AsRef<[u8]>, U: AsRef<[u8]>>(a: T, b: U) -> bool {
-    use subtle::ConstantTimeEq;
-    a.as_ref().ct_eq(b.as_ref()).into()
+    use ring::constant_time::verify_slices_are_equal;
+
+    verify_slices_are_equal(a.as_ref(), b.as_ref()).is_ok()
 }
--- a/src/db/mod.rs
+++ b/src/db/mod.rs
@@ -130,7 +130,7 @@ macro_rules! generate_connections {
                    DbConnType::$name => {
                        #[cfg($name)]
                        {
-                            pastey::paste!{ [< $name _migrations >]::run_migrations()?; }
+                            paste::paste!{ [< $name _migrations >]::run_migrations()?; }
                            let manager = ConnectionManager::new(&url);
                            let pool = Pool::builder()
                                .max_size(CONFIG.database_max_conns())
@@ -259,7 +259,7 @@ macro_rules! db_run {
                $($(
                #[cfg($db)]
                $crate::db::DbConnInner::$db($conn) => {
-                    pastey::paste! {
+                    paste::paste! {
                        #[allow(unused)] use $crate::db::[<__ $db _schema>]::{self as schema, *};
                        #[allow(unused)] use [<__ $db _model>]::*;
                    }
@@ -280,7 +280,7 @@ macro_rules! db_run {
                $($(
                #[cfg($db)]
                $crate::db::DbConnInner::$db($conn) => {
-                    pastey::paste! {
+                    paste::paste! {
                        #[allow(unused)] use $crate::db::[<__ $db _schema>]::{self as schema, *};
                        // @ RAW: #[allow(unused)] use [<__ $db _model>]::*;
                    }
@@ -337,7 +337,7 @@ macro_rules! db_object {
    };

    ( @db $db:ident | $( #[$attr:meta] )* | $name:ident | $( $( #[$field_attr:meta] )* $vis:vis $field:ident : $typ:ty),+) => {
-        pastey::paste! {
+        paste::paste! {
            #[allow(unused)] use super::*;
            #[allow(unused)] use diesel::prelude::*;
            #[allow(unused)] use $crate::db::[<__ $db _schema>]::*;
@@ -373,18 +373,24 @@ pub async fn backup_database(conn: &mut DbConn) -> Result<String, Error> {
            err!("PostgreSQL and MySQL/MariaDB do not support this backup feature");
        }
        sqlite {
-            let db_url = CONFIG.database_url();
-            let db_path = std::path::Path::new(&db_url).parent().unwrap();
-            let backup_file = db_path
-                .join(format!("db_{}.sqlite3", chrono::Utc::now().format("%Y%m%d_%H%M%S")))
-                .to_string_lossy()
-                .into_owned();
-            diesel::sql_query(format!("VACUUM INTO '{backup_file}'")).execute(conn)?;
-            Ok(backup_file)
+            backup_sqlite_database(conn)
        }
    }
 }

+#[cfg(sqlite)]
+pub fn backup_sqlite_database(conn: &mut diesel::sqlite::SqliteConnection) -> Result<String, Error> {
+    use diesel::RunQueryDsl;
+    let db_url = CONFIG.database_url();
+    let db_path = std::path::Path::new(&db_url).parent().unwrap();
+    let backup_file = db_path
+        .join(format!("db_{}.sqlite3", chrono::Utc::now().format("%Y%m%d_%H%M%S")))
+        .to_string_lossy()
+        .into_owned();
+    diesel::sql_query(format!("VACUUM INTO '{backup_file}'")).execute(conn)?;
+    Ok(backup_file)
+}
+
 /// Get the SQL Server version
 pub async fn get_sql_server_version(conn: &mut DbConn) -> String {
    db_run! {@raw conn:
--- a/src/db/models/attachment.rs
+++ b/src/db/models/attachment.rs
@@ -1,12 +1,9 @@
-use std::time::Duration;
+use std::io::ErrorKind;

 use bigdecimal::{BigDecimal, ToPrimitive};
-use derive_more::{AsRef, Deref, Display};
 use serde_json::Value;

-use super::{CipherId, OrganizationId, UserId};
-use crate::{config::PathType, CONFIG};
-use macros::IdFromParam;
+use crate::CONFIG;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -14,8 +11,8 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(id))]
    pub struct Attachment {
-        pub id: AttachmentId,
-        pub cipher_uuid: CipherId,
+        pub id: String,
+        pub cipher_uuid: String,
        pub file_name: String, // encrypted
        pub file_size: i64,
        pub akey: Option<String>,
@@ -24,13 +21,7 @@ db_object! {

 /// Local methods
 impl Attachment {
-    pub const fn new(
-        id: AttachmentId,
-        cipher_uuid: CipherId,
-        file_name: String,
-        file_size: i64,
-        akey: Option<String>,
-    ) -> Self {
+    pub const fn new(id: String, cipher_uuid: String, file_name: String, file_size: i64, akey: Option<String>) -> Self {
        Self {
            id,
            cipher_uuid,
@@ -41,30 +32,24 @@ impl Attachment {
    }

    pub fn get_file_path(&self) -> String {
-        format!("{}/{}", self.cipher_uuid, self.id)
+        format!("{}/{}/{}", CONFIG.attachments_folder(), self.cipher_uuid, self.id)
    }

-    pub async fn get_url(&self, host: &str) -> Result<String, crate::Error> {
-        let operator = CONFIG.opendal_operator_for_path_type(PathType::Attachments)?;
-
-        if operator.info().scheme() == opendal::Scheme::Fs {
-            let token = encode_jwt(&generate_file_download_claims(self.cipher_uuid.clone(), self.id.clone()));
-            Ok(format!("{host}/attachments/{}/{}?token={token}", self.cipher_uuid, self.id))
-        } else {
-            Ok(operator.presign_read(&self.get_file_path(), Duration::from_secs(5 * 60)).await?.uri().to_string())
-        }
+    pub fn get_url(&self, host: &str) -> String {
+        let token = encode_jwt(&generate_file_download_claims(self.cipher_uuid.clone(), self.id.clone()));
+        format!("{}/attachments/{}/{}?token={}", host, self.cipher_uuid, self.id, token)
    }

-    pub async fn to_json(&self, host: &str) -> Result<Value, crate::Error> {
-        Ok(json!({
+    pub fn to_json(&self, host: &str) -> Value {
+        json!({
            "id": self.id,
-            "url": self.get_url(host).await?,
+            "url": self.get_url(host),
            "fileName": self.file_name,
            "size": self.file_size.to_string(),
            "sizeName": crate::util::get_display_size(self.file_size),
            "key": self.akey,
            "object": "attachment"
-        }))
+        })
    }
 }

@@ -110,36 +95,36 @@ impl Attachment {

    pub async fn delete(&self, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
-            crate::util::retry(
+            let _: () = crate::util::retry(
                || diesel::delete(attachments::table.filter(attachments::id.eq(&self.id))).execute(conn),
                10,
            )
-            .map(|_| ())
-            .map_res("Error deleting attachment")
-        }}?;
+            .map_res("Error deleting attachment")?;

-        let operator = CONFIG.opendal_operator_for_path_type(PathType::Attachments)?;
-        let file_path = self.get_file_path();
+            let file_path = &self.get_file_path();

-        if let Err(e) = operator.delete(&file_path).await {
-            if e.kind() == opendal::ErrorKind::NotFound {
-                debug!("File '{file_path}' already deleted.");
-            } else {
-                return Err(e.into());
+            match std::fs::remove_file(file_path) {
+                // Ignore "file not found" errors. This can happen when the
+                // upstream caller has already cleaned up the file as part of
+                // its own error handling.
+                Err(e) if e.kind() == ErrorKind::NotFound => {
+                    debug!("File '{}' already deleted.", file_path);
+                    Ok(())
+                }
+                Err(e) => Err(e.into()),
+                _ => Ok(()),
            }
-        }
-
-        Ok(())
+        }}
    }

-    pub async fn delete_all_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for attachment in Attachment::find_by_cipher(cipher_uuid, conn).await {
            attachment.delete(conn).await?;
        }
        Ok(())
    }

-    pub async fn find_by_id(id: &AttachmentId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_id(id: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            attachments::table
                .filter(attachments::id.eq(id.to_lowercase()))
@@ -149,7 +134,7 @@ impl Attachment {
        }}
    }

-    pub async fn find_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            attachments::table
                .filter(attachments::cipher_uuid.eq(cipher_uuid))
@@ -159,7 +144,7 @@ impl Attachment {
        }}
    }

-    pub async fn size_by_user(user_uuid: &UserId, conn: &mut DbConn) -> i64 {
+    pub async fn size_by_user(user_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            let result: Option<BigDecimal> = attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -176,7 +161,7 @@ impl Attachment {
        }}
    }

-    pub async fn count_by_user(user_uuid: &UserId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_user(user_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -187,7 +172,7 @@ impl Attachment {
        }}
    }

-    pub async fn size_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn size_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            let result: Option<BigDecimal> = attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -204,7 +189,7 @@ impl Attachment {
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -218,11 +203,7 @@ impl Attachment {
    // This will return all attachments linked to the user or org
    // There is no filtering done here if the user actually has access!
    // It is used to speed up the sync process, and the matching is done in a different part.
-    pub async fn find_all_by_user_and_orgs(
-        user_uuid: &UserId,
-        org_uuids: &Vec<OrganizationId>,
-        conn: &mut DbConn,
-    ) -> Vec<Self> {
+    pub async fn find_all_by_user_and_orgs(user_uuid: &str, org_uuids: &Vec<String>, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            attachments::table
                .left_join(ciphers::table.on(ciphers::uuid.eq(attachments::cipher_uuid)))
@@ -235,20 +216,3 @@ impl Attachment {
        }}
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    IdFromParam,
-)]
-pub struct AttachmentId(pub String);
--- a/src/db/models/auth_request.rs
+++ b/src/db/models/auth_request.rs
@@ -1,9 +1,5 @@
-use super::{DeviceId, OrganizationId, UserId};
-use crate::{crypto::ct_eq, util::format_date};
+use crate::crypto::ct_eq;
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{AsRef, Deref, Display, From};
-use macros::UuidFromParam;
-use serde_json::Value;

 db_object! {
    #[derive(Debug, Identifiable, Queryable, Insertable, AsChangeset, Deserialize, Serialize)]
@@ -11,15 +7,15 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct AuthRequest {
-        pub uuid: AuthRequestId,
-        pub user_uuid: UserId,
-        pub organization_uuid: Option<OrganizationId>,
+        pub uuid: String,
+        pub user_uuid: String,
+        pub organization_uuid: Option<String>,

-        pub request_device_identifier: DeviceId,
-        pub device_type: i32,  // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/Enums/DeviceType.cs
+        pub request_device_identifier: String,
+        pub device_type: i32,  // https://github.com/bitwarden/server/blob/master/src/Core/Enums/DeviceType.cs

        pub request_ip: String,
-        pub response_device_id: Option<DeviceId>,
+        pub response_device_id: Option<String>,

        pub access_code: String,
        pub public_key: String,
@@ -37,8 +33,8 @@ db_object! {

 impl AuthRequest {
    pub fn new(
-        user_uuid: UserId,
-        request_device_identifier: DeviceId,
+        user_uuid: String,
+        request_device_identifier: String,
        device_type: i32,
        request_ip: String,
        access_code: String,
@@ -47,7 +43,7 @@ impl AuthRequest {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: AuthRequestId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            user_uuid,
            organization_uuid: None,

@@ -65,13 +61,6 @@ impl AuthRequest {
            authentication_date: None,
        }
    }
-
-    pub fn to_json_for_pending_device(&self) -> Value {
-        json!({
-            "id": self.uuid,
-            "creationDate": format_date(&self.creation_date),
-        })
-    }
 }

 use crate::db::DbConn;
@@ -112,7 +101,7 @@ impl AuthRequest {
        }
    }

-    pub async fn find_by_uuid(uuid: &AuthRequestId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            auth_requests::table
                .filter(auth_requests::uuid.eq(uuid))
@@ -122,18 +111,7 @@ impl AuthRequest {
        }}
    }

-    pub async fn find_by_uuid_and_user(uuid: &AuthRequestId, user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
-        db_run! {conn: {
-            auth_requests::table
-                .filter(auth_requests::uuid.eq(uuid))
-                .filter(auth_requests::user_uuid.eq(user_uuid))
-                .first::<AuthRequestDb>(conn)
-                .ok()
-                .from_db()
-        }}
-    }
-
-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            auth_requests::table
                .filter(auth_requests::user_uuid.eq(user_uuid))
@@ -141,21 +119,6 @@ impl AuthRequest {
        }}
    }

-    pub async fn find_by_user_and_requested_device(
-        user_uuid: &UserId,
-        device_uuid: &DeviceId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
-        db_run! {conn: {
-            auth_requests::table
-                .filter(auth_requests::user_uuid.eq(user_uuid))
-                .filter(auth_requests::request_device_identifier.eq(device_uuid))
-                .filter(auth_requests::approved.is_null())
-                .order_by(auth_requests::creation_date.desc())
-                .first::<AuthRequestDb>(conn).ok().from_db()
-        }}
-    }
-
    pub async fn find_created_before(dt: &NaiveDateTime, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            auth_requests::table
@@ -183,21 +146,3 @@ impl AuthRequest {
        }
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct AuthRequestId(String);
--- a/src/db/models/cipher.rs
+++ b/src/db/models/cipher.rs
@@ -1,15 +1,13 @@
 use crate::util::LowerCase;
 use crate::CONFIG;
-use chrono::{NaiveDateTime, TimeDelta, Utc};
-use derive_more::{AsRef, Deref, Display, From};
+use chrono::{DateTime, NaiveDateTime, TimeDelta, Utc};
 use serde_json::Value;

 use super::{
-    Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership, MembershipStatus,
-    MembershipType, OrganizationId, User, UserId,
+    Attachment, CollectionCipher, Favorite, FolderCipher, Group, User, UserOrgStatus, UserOrgType, UserOrganization,
 };
+
 use crate::api::core::{CipherData, CipherSyncData, CipherSyncType};
-use macros::UuidFromParam;

 use std::borrow::Cow;

@@ -19,12 +17,12 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct Cipher {
-        pub uuid: CipherId,
+        pub uuid: String,
        pub created_at: NaiveDateTime,
        pub updated_at: NaiveDateTime,

-        pub user_uuid: Option<UserId>,
-        pub organization_uuid: Option<OrganizationId>,
+        pub user_uuid: Option<String>,
+        pub organization_uuid: Option<String>,

        pub key: Option<String>,

@@ -32,8 +30,7 @@ db_object! {
        Login = 1,
        SecureNote = 2,
        Card = 3,
-        Identity = 4,
-        SshKey = 5
+        Identity = 4
        */
        pub atype: i32,
        pub name: String,
@@ -48,9 +45,10 @@ db_object! {
    }
 }

+#[allow(dead_code)]
 pub enum RepromptType {
    None = 0,
-    Password = 1,
+    Password = 1, // not currently used in server
 }

 /// Local methods
@@ -59,7 +57,7 @@ impl Cipher {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: CipherId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            created_at: now,
            updated_at: now,

@@ -85,7 +83,7 @@ impl Cipher {
        let mut validation_errors = serde_json::Map::new();
        let max_note_size = CONFIG._max_note_size();
        let max_note_size_msg =
-            format!("The field Notes exceeds the maximum encrypted value length of {max_note_size} characters.");
+            format!("The field Notes exceeds the maximum encrypted value length of {} characters.", &max_note_size);
        for (index, cipher) in cipher_data.iter().enumerate() {
            // Validate the note size and if it is exceeded return a warning
            if let Some(note) = &cipher.notes {
@@ -137,47 +135,37 @@ impl Cipher {
    pub async fn to_json(
        &self,
        host: &str,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&CipherSyncData>,
        sync_type: CipherSyncType,
        conn: &mut DbConn,
-    ) -> Result<Value, crate::Error> {
-        use crate::util::{format_date, validate_and_format_date};
+    ) -> Value {
+        use crate::util::format_date;

        let mut attachments_json: Value = Value::Null;
        if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(attachments) = cipher_sync_data.cipher_attachments.get(&self.uuid) {
-                if !attachments.is_empty() {
-                    let mut attachments_json_vec = vec![];
-                    for attachment in attachments {
-                        attachments_json_vec.push(attachment.to_json(host).await?);
-                    }
-                    attachments_json = Value::Array(attachments_json_vec);
-                }
+                attachments_json = attachments.iter().map(|c| c.to_json(host)).collect();
            }
        } else {
            let attachments = Attachment::find_by_cipher(&self.uuid, conn).await;
            if !attachments.is_empty() {
-                let mut attachments_json_vec = vec![];
-                for attachment in attachments {
-                    attachments_json_vec.push(attachment.to_json(host).await?);
-                }
-                attachments_json = Value::Array(attachments_json_vec);
+                attachments_json = attachments.iter().map(|c| c.to_json(host)).collect()
            }
        }

        // We don't need these values at all for Organizational syncs
        // Skip any other database calls if this is the case and just return false.
-        let (read_only, hide_passwords, _) = if sync_type == CipherSyncType::User {
+        let (read_only, hide_passwords) = if sync_type == CipherSyncType::User {
            match self.get_access_restrictions(user_uuid, cipher_sync_data, conn).await {
-                Some((ro, hp, mn)) => (ro, hp, mn),
+                Some((ro, hp)) => (ro, hp),
                None => {
                    error!("Cipher ownership assertion failure");
-                    (true, true, false)
+                    (true, true)
                }
            }
        } else {
-            (false, false, false)
+            (false, false)
        };

        let fields_json: Vec<_> = self
@@ -228,13 +216,11 @@ impl Cipher {
                        Some(p) if p.is_string() => Some(d.data),
                        _ => None,
                    })
-                    .map(|mut d| match d.get("lastUsedDate").and_then(|l| l.as_str()) {
-                        Some(l) => {
-                            d["lastUsedDate"] = json!(validate_and_format_date(l));
-                            d
-                        }
+                    .map(|d| match d.get("lastUsedDate").and_then(|l| l.as_str()) {
+                        Some(l) if DateTime::parse_from_rfc3339(l).is_ok() => d,
                        _ => {
-                            d["lastUsedDate"] = json!("1970-01-01T00:00:00.000000Z");
+                            let mut d = d;
+                            d["lastUsedDate"] = json!("1970-01-01T00:00:00.000Z");
                            d
                        }
                    })
@@ -253,28 +239,12 @@ impl Cipher {
        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
        if self.atype == 1 {
-            // Upstream always has an `uri` key/value
-            type_data_json["uri"] = Value::Null;
-            if let Some(uris) = type_data_json["uris"].as_array_mut() {
-                if !uris.is_empty() {
-                    // Fix uri match values first, they are only allowed to be a number or null
-                    // If it is a string, convert it to an int or null if that fails
-                    for uri in &mut *uris {
-                        if uri["match"].is_string() {
-                            let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
-                                Ok(n) => json!(n),
-                                _ => Value::Null,
-                            };
-                            uri["match"] = match_value;
-                        }
-                    }
-                    type_data_json["uri"] = uris[0]["uri"].clone();
-                }
-            }
-
-            // Check if `passwordRevisionDate` is a valid date, else convert it
-            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
-                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
+            if type_data_json["uris"].is_array() {
+                let uri = type_data_json["uris"][0]["uri"].clone();
+                type_data_json["uri"] = uri;
+            } else {
+                // Upstream always has an Uri key/value
+                type_data_json["uri"] = Value::Null;
            }
        }

@@ -289,19 +259,6 @@ impl Cipher {
            }
        }

-        // Fix invalid SSH Entries
-        // This breaks at least the native mobile client if invalid
-        // The only way to fix this is by setting type_data_json to `null`
-        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
-        if self.atype == 5
-            && (type_data_json["keyFingerprint"].as_str().is_none_or(|v| v.is_empty())
-                || type_data_json["privateKey"].as_str().is_none_or(|v| v.is_empty())
-                || type_data_json["publicKey"].as_str().is_none_or(|v| v.is_empty()))
-        {
-            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
-            type_data_json = Value::Null;
-        }
-
        // Clone the type_data and add some default value.
        let mut data_json = type_data_json.clone();

@@ -319,7 +276,7 @@ impl Cipher {
                Cow::from(Vec::with_capacity(0))
            }
        } else {
-            Cow::from(self.get_admin_collections(user_uuid.clone(), conn).await)
+            Cow::from(self.get_admin_collections(user_uuid.to_string(), conn).await)
        };

        // There are three types of cipher response models in upstream
@@ -328,7 +285,7 @@ impl Cipher {
        // supports the "cipherDetails" type, though it seems like the
        // Bitwarden clients will ignore extra fields.
        //
-        // Ref: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Vault/Models/Response/CipherResponseModel.cs#L14
+        // Ref: https://github.com/bitwarden/server/blob/master/src/Core/Models/Api/Response/CipherResponseModel.cs
        let mut json_object = json!({
            "object": "cipherDetails",
            "id": self.uuid,
@@ -336,7 +293,7 @@ impl Cipher {
            "creationDate": format_date(&self.created_at),
            "revisionDate": format_date(&self.updated_at),
            "deletedDate": self.deleted_at.map_or(Value::Null, |d| Value::String(format_date(&d))),
-            "reprompt": self.reprompt.filter(|r| *r == RepromptType::None as i32 || *r == RepromptType::Password as i32).unwrap_or(RepromptType::None as i32),
+            "reprompt": self.reprompt.unwrap_or(RepromptType::None as i32),
            "organizationId": self.organization_uuid,
            "key": self.key,
            "attachments": attachments_json,
@@ -360,7 +317,6 @@ impl Cipher {
            "secureNote": null,
            "card": null,
            "identity": null,
-            "sshKey": null,
        });

        // These values are only needed for user/default syncs
@@ -368,7 +324,7 @@ impl Cipher {
        // Skip adding these fields in that case
        if sync_type == CipherSyncType::User {
            json_object["folderId"] = json!(if let Some(cipher_sync_data) = cipher_sync_data {
-                cipher_sync_data.cipher_folders.get(&self.uuid).cloned()
+                cipher_sync_data.cipher_folders.get(&self.uuid).map(|c| c.to_string())
            } else {
                self.get_folder_uuid(user_uuid, conn).await
            });
@@ -382,11 +338,6 @@ impl Cipher {
            // the "Read Only" or "Hide Passwords" restrictions for the user.
            json_object["edit"] = json!(!read_only);
            json_object["viewPassword"] = json!(!hide_passwords);
-            // The new key used by clients since v2025.6.0
-            json_object["permissions"] = json!({
-                "delete": !read_only,
-                "restore": !read_only,
-            });
        }

        let key = match self.atype {
@@ -394,15 +345,14 @@ impl Cipher {
            2 => "secureNote",
            3 => "card",
            4 => "identity",
-            5 => "sshKey",
            _ => panic!("Wrong type"),
        };

        json_object[key] = type_data_json;
-        Ok(json_object)
+        json_object
    }

-    pub async fn update_users_revision(&self, conn: &mut DbConn) -> Vec<UserId> {
+    pub async fn update_users_revision(&self, conn: &mut DbConn) -> Vec<String> {
        let mut user_uuids = Vec::new();
        match self.user_uuid {
            Some(ref user_uuid) => {
@@ -413,16 +363,17 @@ impl Cipher {
                // Belongs to Organization, need to update affected users
                if let Some(ref org_uuid) = self.organization_uuid {
                    // users having access to the collection
-                    let mut collection_users = Membership::find_by_cipher_and_org(&self.uuid, org_uuid, conn).await;
+                    let mut collection_users =
+                        UserOrganization::find_by_cipher_and_org(&self.uuid, org_uuid, conn).await;
                    if CONFIG.org_groups_enabled() {
                        // members of a group having access to the collection
                        let group_users =
-                            Membership::find_by_cipher_and_org_with_group(&self.uuid, org_uuid, conn).await;
+                            UserOrganization::find_by_cipher_and_org_with_group(&self.uuid, org_uuid, conn).await;
                        collection_users.extend(group_users);
                    }
-                    for member in collection_users {
-                        User::update_uuid_revision(&member.user_uuid, conn).await;
-                        user_uuids.push(member.user_uuid.clone())
+                    for user_org in collection_users {
+                        User::update_uuid_revision(&user_org.user_uuid, conn).await;
+                        user_uuids.push(user_org.user_uuid.clone())
                    }
                }
            }
@@ -480,7 +431,7 @@ impl Cipher {
        }}
    }

-    pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_organization(org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        // TODO: Optimize this by executing a DELETE directly on the database, instead of first fetching.
        for cipher in Self::find_by_org(org_uuid, conn).await {
            cipher.delete(conn).await?;
@@ -488,7 +439,7 @@ impl Cipher {
        Ok(())
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for cipher in Self::find_owned_by_user(user_uuid, conn).await {
            cipher.delete(conn).await?;
        }
@@ -506,59 +457,52 @@ impl Cipher {
        }
    }

-    pub async fn move_to_folder(
-        &self,
-        folder_uuid: Option<FolderId>,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn move_to_folder(&self, folder_uuid: Option<String>, user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;

        match (self.get_folder_uuid(user_uuid, conn).await, folder_uuid) {
            // No changes
            (None, None) => Ok(()),
-            (Some(ref old_folder), Some(ref new_folder)) if old_folder == new_folder => Ok(()),
+            (Some(ref old), Some(ref new)) if old == new => Ok(()),

            // Add to folder
-            (None, Some(new_folder)) => FolderCipher::new(new_folder, self.uuid.clone()).save(conn).await,
+            (None, Some(new)) => FolderCipher::new(&new, &self.uuid).save(conn).await,

            // Remove from folder
-            (Some(old_folder), None) => {
-                match FolderCipher::find_by_folder_and_cipher(&old_folder, &self.uuid, conn).await {
-                    Some(old_folder) => old_folder.delete(conn).await,
-                    None => err!("Couldn't move from previous folder"),
-                }
-            }
+            (Some(old), None) => match FolderCipher::find_by_folder_and_cipher(&old, &self.uuid, conn).await {
+                Some(old) => old.delete(conn).await,
+                None => err!("Couldn't move from previous folder"),
+            },

            // Move to another folder
-            (Some(old_folder), Some(new_folder)) => {
-                if let Some(old_folder) = FolderCipher::find_by_folder_and_cipher(&old_folder, &self.uuid, conn).await {
-                    old_folder.delete(conn).await?;
+            (Some(old), Some(new)) => {
+                if let Some(old) = FolderCipher::find_by_folder_and_cipher(&old, &self.uuid, conn).await {
+                    old.delete(conn).await?;
                }
-                FolderCipher::new(new_folder, self.uuid.clone()).save(conn).await
+                FolderCipher::new(&new, &self.uuid).save(conn).await
            }
        }
    }

    /// Returns whether this cipher is directly owned by the user.
-    pub fn is_owned_by_user(&self, user_uuid: &UserId) -> bool {
+    pub fn is_owned_by_user(&self, user_uuid: &str) -> bool {
        self.user_uuid.is_some() && self.user_uuid.as_ref().unwrap() == user_uuid
    }

    /// Returns whether this cipher is owned by an org in which the user has full access.
    async fn is_in_full_access_org(
        &self,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&CipherSyncData>,
        conn: &mut DbConn,
    ) -> bool {
        if let Some(ref org_uuid) = self.organization_uuid {
            if let Some(cipher_sync_data) = cipher_sync_data {
-                if let Some(cached_member) = cipher_sync_data.members.get(org_uuid) {
-                    return cached_member.has_full_access();
+                if let Some(cached_user_org) = cipher_sync_data.user_organizations.get(org_uuid) {
+                    return cached_user_org.has_full_access();
                }
-            } else if let Some(member) = Membership::find_by_user_and_org(user_uuid, org_uuid, conn).await {
-                return member.has_full_access();
+            } else if let Some(user_org) = UserOrganization::find_by_user_and_org(user_uuid, org_uuid, conn).await {
+                return user_org.has_full_access();
            }
        }
        false
@@ -567,7 +511,7 @@ impl Cipher {
    /// Returns whether this cipher is owned by an group in which the user has full access.
    async fn is_in_full_access_group(
        &self,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&CipherSyncData>,
        conn: &mut DbConn,
    ) -> bool {
@@ -587,14 +531,14 @@ impl Cipher {
    /// Returns the user's access restrictions to this cipher. A return value
    /// of None means that this cipher does not belong to the user, and is
    /// not in any collection the user has access to. Otherwise, the user has
-    /// access to this cipher, and Some(read_only, hide_passwords, manage) represents
+    /// access to this cipher, and Some(read_only, hide_passwords) represents
    /// the access restrictions.
    pub async fn get_access_restrictions(
        &self,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&CipherSyncData>,
        conn: &mut DbConn,
-    ) -> Option<(bool, bool, bool)> {
+    ) -> Option<(bool, bool)> {
        // Check whether this cipher is directly owned by the user, or is in
        // a collection that the user has full access to. If so, there are no
        // access restrictions.
@@ -602,30 +546,29 @@ impl Cipher {
            || self.is_in_full_access_org(user_uuid, cipher_sync_data, conn).await
            || self.is_in_full_access_group(user_uuid, cipher_sync_data, conn).await
        {
-            return Some((false, false, true));
+            return Some((false, false));
        }

        let rows = if let Some(cipher_sync_data) = cipher_sync_data {
-            let mut rows: Vec<(bool, bool, bool)> = Vec::new();
+            let mut rows: Vec<(bool, bool)> = Vec::new();
            if let Some(collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
                for collection in collections {
-                    // User permissions
-                    if let Some(cu) = cipher_sync_data.user_collections.get(collection) {
-                        rows.push((cu.read_only, cu.hide_passwords, cu.manage));
-                    // Group permissions
-                    } else if let Some(cg) = cipher_sync_data.user_collections_groups.get(collection) {
-                        rows.push((cg.read_only, cg.hide_passwords, cg.manage));
+                    //User permissions
+                    if let Some(uc) = cipher_sync_data.user_collections.get(collection) {
+                        rows.push((uc.read_only, uc.hide_passwords));
+                    }
+
+                    //Group permissions
+                    if let Some(cg) = cipher_sync_data.user_collections_groups.get(collection) {
+                        rows.push((cg.read_only, cg.hide_passwords));
                    }
                }
            }
            rows
        } else {
-            let user_permissions = self.get_user_collections_access_flags(user_uuid, conn).await;
-            if !user_permissions.is_empty() {
-                user_permissions
-            } else {
-                self.get_group_collections_access_flags(user_uuid, conn).await
-            }
+            let mut access_flags = self.get_user_collections_access_flags(user_uuid, conn).await;
+            access_flags.append(&mut self.get_group_collections_access_flags(user_uuid, conn).await);
+            access_flags
        };

        if rows.is_empty() {
@@ -634,9 +577,6 @@ impl Cipher {
        }

        // A cipher can be in multiple collections with inconsistent access flags.
-        // Also, user permission overrule group permissions
-        // and only user permissions are returned by the code above.
-        //
        // For example, a cipher could be in one collection where the user has
        // read-only access, but also in another collection where the user has
        // read/write access. For a flag to be in effect for a cipher, upstream
@@ -645,25 +585,17 @@ impl Cipher {
        // and `hide_passwords` columns. This could ideally be done as part of the
        // query, but Diesel doesn't support a min() or bool_and() function on
        // booleans and this behavior isn't portable anyway.
-        //
-        // The only exception is for the `manage` flag, that needs a boolean OR!
        let mut read_only = true;
        let mut hide_passwords = true;
-        let mut manage = false;
-        for (ro, hp, mn) in rows.iter() {
+        for (ro, hp) in rows.iter() {
            read_only &= ro;
            hide_passwords &= hp;
-            manage |= mn;
        }

-        Some((read_only, hide_passwords, manage))
+        Some((read_only, hide_passwords))
    }

-    async fn get_user_collections_access_flags(
-        &self,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Vec<(bool, bool, bool)> {
+    async fn get_user_collections_access_flags(&self, user_uuid: &str, conn: &mut DbConn) -> Vec<(bool, bool)> {
        db_run! {conn: {
            // Check whether this cipher is in any collections accessible to the
            // user. If so, retrieve the access flags for each collection.
@@ -674,17 +606,13 @@ impl Cipher {
                .inner_join(users_collections::table.on(
                    ciphers_collections::collection_uuid.eq(users_collections::collection_uuid)
                        .and(users_collections::user_uuid.eq(user_uuid))))
-                .select((users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
-                .load::<(bool, bool, bool)>(conn)
+                .select((users_collections::read_only, users_collections::hide_passwords))
+                .load::<(bool, bool)>(conn)
                .expect("Error getting user access restrictions")
        }}
    }

-    async fn get_group_collections_access_flags(
-        &self,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Vec<(bool, bool, bool)> {
+    async fn get_group_collections_access_flags(&self, user_uuid: &str, conn: &mut DbConn) -> Vec<(bool, bool)> {
        if !CONFIG.org_groups_enabled() {
            return Vec::new();
        }
@@ -704,49 +632,49 @@ impl Cipher {
                    users_organizations::uuid.eq(groups_users::users_organizations_uuid)
                ))
                .filter(users_organizations::user_uuid.eq(user_uuid))
-                .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage))
-                .load::<(bool, bool, bool)>(conn)
+                .select((collections_groups::read_only, collections_groups::hide_passwords))
+                .load::<(bool, bool)>(conn)
                .expect("Error getting group access restrictions")
        }}
    }

-    pub async fn is_write_accessible_to_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_write_accessible_to_user(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        match self.get_access_restrictions(user_uuid, None, conn).await {
-            Some((read_only, _hide_passwords, manage)) => !read_only || manage,
+            Some((read_only, _hide_passwords)) => !read_only,
            None => false,
        }
    }

-    pub async fn is_accessible_to_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_accessible_to_user(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        self.get_access_restrictions(user_uuid, None, conn).await.is_some()
    }

    // Returns whether this cipher is a favorite of the specified user.
-    pub async fn is_favorite(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_favorite(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        Favorite::is_favorite(&self.uuid, user_uuid, conn).await
    }

    // Sets whether this cipher is a favorite of the specified user.
-    pub async fn set_favorite(&self, favorite: Option<bool>, user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn set_favorite(&self, favorite: Option<bool>, user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        match favorite {
            None => Ok(()), // No change requested.
            Some(status) => Favorite::set_favorite(status, &self.uuid, user_uuid, conn).await,
        }
    }

-    pub async fn get_folder_uuid(&self, user_uuid: &UserId, conn: &mut DbConn) -> Option<FolderId> {
+    pub async fn get_folder_uuid(&self, user_uuid: &str, conn: &mut DbConn) -> Option<String> {
        db_run! {conn: {
            folders_ciphers::table
                .inner_join(folders::table)
                .filter(folders::user_uuid.eq(&user_uuid))
                .filter(folders_ciphers::cipher_uuid.eq(&self.uuid))
                .select(folders_ciphers::folder_uuid)
-                .first::<FolderId>(conn)
+                .first::<String>(conn)
                .ok()
        }}
    }

-    pub async fn find_by_uuid(uuid: &CipherId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::uuid.eq(uuid))
@@ -756,11 +684,7 @@ impl Cipher {
        }}
    }

-    pub async fn find_by_uuid_and_org(
-        cipher_uuid: &CipherId,
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_org(cipher_uuid: &str, org_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::uuid.eq(cipher_uuid))
@@ -783,7 +707,7 @@ impl Cipher {
    // true, then the non-interesting ciphers will not be returned. As a
    // result, those ciphers will not appear in "My Vault" for the org
    // owner/admin, but they can still be accessed via the org vault view.
-    pub async fn find_by_user(user_uuid: &UserId, visible_only: bool, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, visible_only: bool, conn: &mut DbConn) -> Vec<Self> {
        if CONFIG.org_groups_enabled() {
            db_run! {conn: {
                let mut query = ciphers::table
@@ -793,7 +717,7 @@ impl Cipher {
                    .left_join(users_organizations::table.on(
                            ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable())
                            .and(users_organizations::user_uuid.eq(user_uuid))
-                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
+                            .and(users_organizations::status.eq(UserOrgStatus::Confirmed as i32))
                            ))
                    .left_join(users_collections::table.on(
                            ciphers_collections::collection_uuid.eq(users_collections::collection_uuid)
@@ -820,7 +744,7 @@ impl Cipher {

                if !visible_only {
                    query = query.or_filter(
-                        users_organizations::atype.le(MembershipType::Admin as i32) // Org admin/owner
+                        users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin/owner
                        );
                }

@@ -838,7 +762,7 @@ impl Cipher {
                    .left_join(users_organizations::table.on(
                            ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable())
                            .and(users_organizations::user_uuid.eq(user_uuid))
-                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
+                            .and(users_organizations::status.eq(UserOrgStatus::Confirmed as i32))
                            ))
                    .left_join(users_collections::table.on(
                            ciphers_collections::collection_uuid.eq(users_collections::collection_uuid)
@@ -852,7 +776,7 @@ impl Cipher {

                    if !visible_only {
                        query = query.or_filter(
-                            users_organizations::atype.le(MembershipType::Admin as i32) // Org admin/owner
+                            users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin/owner
                            );
                    }

@@ -865,12 +789,12 @@ impl Cipher {
    }

    // Find all ciphers visible to the specified user.
-    pub async fn find_by_user_visible(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user_visible(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        Self::find_by_user(user_uuid, true, conn).await
    }

    // Find all ciphers directly owned by the specified user.
-    pub async fn find_owned_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_owned_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            ciphers::table
                .filter(
@@ -881,7 +805,7 @@ impl Cipher {
        }}
    }

-    pub async fn count_owned_by_user(user_uuid: &UserId, conn: &mut DbConn) -> i64 {
+    pub async fn count_owned_by_user(user_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::user_uuid.eq(user_uuid))
@@ -892,7 +816,7 @@ impl Cipher {
        }}
    }

-    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_org(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::organization_uuid.eq(org_uuid))
@@ -900,7 +824,7 @@ impl Cipher {
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! {conn: {
            ciphers::table
                .filter(ciphers::organization_uuid.eq(org_uuid))
@@ -911,7 +835,7 @@ impl Cipher {
        }}
    }

-    pub async fn find_by_folder(folder_uuid: &FolderId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_folder(folder_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            folders_ciphers::table.inner_join(ciphers::table)
                .filter(folders_ciphers::folder_uuid.eq(folder_uuid))
@@ -929,7 +853,7 @@ impl Cipher {
        }}
    }

-    pub async fn get_collections(&self, user_uuid: UserId, conn: &mut DbConn) -> Vec<CollectionId> {
+    pub async fn get_collections(&self, user_id: String, conn: &mut DbConn) -> Vec<String> {
        if CONFIG.org_groups_enabled() {
            db_run! {conn: {
                ciphers_collections::table
@@ -939,11 +863,11 @@ impl Cipher {
                    ))
                    .left_join(users_organizations::table.on(
                        users_organizations::org_uuid.eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                        .and(users_organizations::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(users_collections::table.on(
                        users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid.clone()))
+                        .and(users_collections::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(groups_users::table.on(
                        groups_users::users_organizations_uuid.eq(users_organizations::uuid)
@@ -954,14 +878,14 @@ impl Cipher {
                        .and(collections_groups::groups_uuid.eq(groups::uuid))
                    ))
                    .filter(users_organizations::access_all.eq(true) // User has access all
-                        .or(users_collections::user_uuid.eq(user_uuid) // User has access to collection
+                        .or(users_collections::user_uuid.eq(user_id) // User has access to collection
                            .and(users_collections::read_only.eq(false)))
                        .or(groups::access_all.eq(true)) // Access via groups
                        .or(collections_groups::collections_uuid.is_not_null() // Access via groups
                            .and(collections_groups::read_only.eq(false)))
                    )
                    .select(ciphers_collections::collection_uuid)
-                    .load::<CollectionId>(conn).unwrap_or_default()
+                    .load::<String>(conn).unwrap_or_default()
            }}
        } else {
            db_run! {conn: {
@@ -972,23 +896,23 @@ impl Cipher {
                    ))
                    .inner_join(users_organizations::table.on(
                        users_organizations::org_uuid.eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                        .and(users_organizations::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(users_collections::table.on(
                        users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid.clone()))
+                        .and(users_collections::user_uuid.eq(user_id.clone()))
                    ))
                    .filter(users_organizations::access_all.eq(true) // User has access all
-                        .or(users_collections::user_uuid.eq(user_uuid) // User has access to collection
+                        .or(users_collections::user_uuid.eq(user_id) // User has access to collection
                            .and(users_collections::read_only.eq(false)))
                    )
                    .select(ciphers_collections::collection_uuid)
-                    .load::<CollectionId>(conn).unwrap_or_default()
+                    .load::<String>(conn).unwrap_or_default()
            }}
        }
    }

-    pub async fn get_admin_collections(&self, user_uuid: UserId, conn: &mut DbConn) -> Vec<CollectionId> {
+    pub async fn get_admin_collections(&self, user_id: String, conn: &mut DbConn) -> Vec<String> {
        if CONFIG.org_groups_enabled() {
            db_run! {conn: {
                ciphers_collections::table
@@ -998,11 +922,11 @@ impl Cipher {
                    ))
                    .left_join(users_organizations::table.on(
                        users_organizations::org_uuid.eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                        .and(users_organizations::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(users_collections::table.on(
                        users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid.clone()))
+                        .and(users_collections::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(groups_users::table.on(
                        groups_users::users_organizations_uuid.eq(users_organizations::uuid)
@@ -1013,15 +937,15 @@ impl Cipher {
                        .and(collections_groups::groups_uuid.eq(groups::uuid))
                    ))
                    .filter(users_organizations::access_all.eq(true) // User has access all
-                        .or(users_collections::user_uuid.eq(user_uuid) // User has access to collection
+                        .or(users_collections::user_uuid.eq(user_id) // User has access to collection
                            .and(users_collections::read_only.eq(false)))
                        .or(groups::access_all.eq(true)) // Access via groups
                        .or(collections_groups::collections_uuid.is_not_null() // Access via groups
                            .and(collections_groups::read_only.eq(false)))
-                        .or(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
+                        .or(users_organizations::atype.le(UserOrgType::Admin as i32)) // User is admin or owner
                    )
                    .select(ciphers_collections::collection_uuid)
-                    .load::<CollectionId>(conn).unwrap_or_default()
+                    .load::<String>(conn).unwrap_or_default()
            }}
        } else {
            db_run! {conn: {
@@ -1032,29 +956,26 @@ impl Cipher {
                    ))
                    .inner_join(users_organizations::table.on(
                        users_organizations::org_uuid.eq(collections::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                        .and(users_organizations::user_uuid.eq(user_id.clone()))
                    ))
                    .left_join(users_collections::table.on(
                        users_collections::collection_uuid.eq(ciphers_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid.clone()))
+                        .and(users_collections::user_uuid.eq(user_id.clone()))
                    ))
                    .filter(users_organizations::access_all.eq(true) // User has access all
-                        .or(users_collections::user_uuid.eq(user_uuid) // User has access to collection
+                        .or(users_collections::user_uuid.eq(user_id) // User has access to collection
                            .and(users_collections::read_only.eq(false)))
-                        .or(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
+                        .or(users_organizations::atype.le(UserOrgType::Admin as i32)) // User is admin or owner
                    )
                    .select(ciphers_collections::collection_uuid)
-                    .load::<CollectionId>(conn).unwrap_or_default()
+                    .load::<String>(conn).unwrap_or_default()
            }}
        }
    }

    /// Return a Vec with (cipher_uuid, collection_uuid)
    /// This is used during a full sync so we only need one query for all collections accessible.
-    pub async fn get_collections_with_cipher_by_user(
-        user_uuid: UserId,
-        conn: &mut DbConn,
-    ) -> Vec<(CipherId, CollectionId)> {
+    pub async fn get_collections_with_cipher_by_user(user_id: String, conn: &mut DbConn) -> Vec<(String, String)> {
        db_run! {conn: {
            ciphers_collections::table
            .inner_join(collections::table.on(
@@ -1062,12 +983,12 @@ impl Cipher {
            ))
            .inner_join(users_organizations::table.on(
                users_organizations::org_uuid.eq(collections::org_uuid).and(
-                    users_organizations::user_uuid.eq(user_uuid.clone())
+                    users_organizations::user_uuid.eq(user_id.clone())
                )
            ))
            .left_join(users_collections::table.on(
                users_collections::collection_uuid.eq(ciphers_collections::collection_uuid).and(
-                    users_collections::user_uuid.eq(user_uuid.clone())
+                    users_collections::user_uuid.eq(user_id.clone())
                )
            ))
            .left_join(groups_users::table.on(
@@ -1081,32 +1002,14 @@ impl Cipher {
                    collections_groups::groups_uuid.eq(groups::uuid)
                )
            ))
-            .or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection
+            .or_filter(users_collections::user_uuid.eq(user_id)) // User has access to collection
            .or_filter(users_organizations::access_all.eq(true)) // User has access all
-            .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
+            .or_filter(users_organizations::atype.le(UserOrgType::Admin as i32)) // User is admin or owner
            .or_filter(groups::access_all.eq(true)) //Access via group
            .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group
            .select(ciphers_collections::all_columns)
            .distinct()
-            .load::<(CipherId, CollectionId)>(conn).unwrap_or_default()
+            .load::<(String, String)>(conn).unwrap_or_default()
        }}
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct CipherId(String);
--- a/src/db/models/collection.rs
+++ b/src/db/models/collection.rs
@@ -1,21 +1,15 @@
-use derive_more::{AsRef, Deref, Display, From};
 use serde_json::Value;

-use super::{
-    CipherId, CollectionGroup, GroupUser, Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId,
-    User, UserId,
-};
+use super::{CollectionGroup, GroupUser, User, UserOrgStatus, UserOrgType, UserOrganization};
 use crate::CONFIG;
-use macros::UuidFromParam;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = collections)]
-    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct Collection {
-        pub uuid: CollectionId,
-        pub org_uuid: OrganizationId,
+        pub uuid: String,
+        pub org_uuid: String,
        pub name: String,
        pub external_id: Option<String>,
    }
@@ -24,27 +18,26 @@ db_object! {
    #[diesel(table_name = users_collections)]
    #[diesel(primary_key(user_uuid, collection_uuid))]
    pub struct CollectionUser {
-        pub user_uuid: UserId,
-        pub collection_uuid: CollectionId,
+        pub user_uuid: String,
+        pub collection_uuid: String,
        pub read_only: bool,
        pub hide_passwords: bool,
-        pub manage: bool,
    }

    #[derive(Identifiable, Queryable, Insertable)]
    #[diesel(table_name = ciphers_collections)]
    #[diesel(primary_key(cipher_uuid, collection_uuid))]
    pub struct CollectionCipher {
-        pub cipher_uuid: CipherId,
-        pub collection_uuid: CollectionId,
+        pub cipher_uuid: String,
+        pub collection_uuid: String,
    }
 }

 /// Local methods
 impl Collection {
-    pub fn new(org_uuid: OrganizationId, name: String, external_id: Option<String>) -> Self {
+    pub fn new(org_uuid: String, name: String, external_id: Option<String>) -> Self {
        let mut new_model = Self {
-            uuid: CollectionId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            org_uuid,
            name,
            external_id: None,
@@ -81,30 +74,22 @@ impl Collection {

    pub async fn to_json_details(
        &self,
-        user_uuid: &UserId,
+        user_uuid: &str,
        cipher_sync_data: Option<&crate::api::core::CipherSyncData>,
        conn: &mut DbConn,
    ) -> Value {
-        let (read_only, hide_passwords, manage) = if let Some(cipher_sync_data) = cipher_sync_data {
-            match cipher_sync_data.members.get(&self.org_uuid) {
-                // Only for Manager types Bitwarden returns true for the manage option
-                // Owners and Admins always have true. Users are not able to have full access
-                Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager),
-                Some(m) => {
+        let (read_only, hide_passwords, can_manage) = if let Some(cipher_sync_data) = cipher_sync_data {
+            match cipher_sync_data.user_organizations.get(&self.org_uuid) {
+                // Only for Manager types Bitwarden returns true for the can_manage option
+                // Owners and Admins always have true
+                Some(uo) if uo.has_full_access() => (false, false, uo.atype >= UserOrgType::Manager),
+                Some(uo) => {
                    // Only let a manager manage collections when the have full read/write access
-                    let is_manager = m.atype == MembershipType::Manager;
-                    if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) {
-                        (
-                            cu.read_only,
-                            cu.hide_passwords,
-                            is_manager && (cu.manage || (!cu.read_only && !cu.hide_passwords)),
-                        )
+                    let is_manager = uo.atype == UserOrgType::Manager;
+                    if let Some(uc) = cipher_sync_data.user_collections.get(&self.uuid) {
+                        (uc.read_only, uc.hide_passwords, is_manager && !uc.read_only && !uc.hide_passwords)
                    } else if let Some(cg) = cipher_sync_data.user_collections_groups.get(&self.uuid) {
-                        (
-                            cg.read_only,
-                            cg.hide_passwords,
-                            is_manager && (cg.manage || (!cg.read_only && !cg.hide_passwords)),
-                        )
+                        (cg.read_only, cg.hide_passwords, is_manager && !cg.read_only && !cg.hide_passwords)
                    } else {
                        (false, false, false)
                    }
@@ -112,18 +97,19 @@ impl Collection {
                _ => (true, true, false),
            }
        } else {
-            match Membership::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await {
-                Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager),
-                Some(m) if m.atype == MembershipType::Manager && self.is_manageable_by_user(user_uuid, conn).await => {
-                    (false, false, true)
-                }
-                Some(m) => {
-                    let is_manager = m.atype == MembershipType::Manager;
+            match UserOrganization::find_confirmed_by_user_and_org(user_uuid, &self.org_uuid, conn).await {
+                Some(ou) if ou.has_full_access() => (false, false, ou.atype >= UserOrgType::Manager),
+                Some(ou) => {
+                    let is_manager = ou.atype == UserOrgType::Manager;
                    let read_only = !self.is_writable_by_user(user_uuid, conn).await;
                    let hide_passwords = self.hide_passwords_for_user(user_uuid, conn).await;
                    (read_only, hide_passwords, is_manager && !read_only && !hide_passwords)
                }
-                _ => (true, true, false),
+                _ => (
+                    !self.is_writable_by_user(user_uuid, conn).await,
+                    self.hide_passwords_for_user(user_uuid, conn).await,
+                    false,
+                ),
            }
        };

@@ -131,17 +117,17 @@ impl Collection {
        json_object["object"] = json!("collectionDetails");
        json_object["readOnly"] = json!(read_only);
        json_object["hidePasswords"] = json!(hide_passwords);
-        json_object["manage"] = json!(manage);
+        json_object["manage"] = json!(can_manage);
        json_object
    }

-    pub async fn can_access_collection(member: &Membership, col_id: &CollectionId, conn: &mut DbConn) -> bool {
-        member.has_status(MembershipStatus::Confirmed)
-            && (member.has_full_access()
-                || CollectionUser::has_access_to_collection_by_user(col_id, &member.user_uuid, conn).await
+    pub async fn can_access_collection(org_user: &UserOrganization, col_id: &str, conn: &mut DbConn) -> bool {
+        org_user.has_status(UserOrgStatus::Confirmed)
+            && (org_user.has_full_access()
+                || CollectionUser::has_access_to_collection_by_user(col_id, &org_user.user_uuid, conn).await
                || (CONFIG.org_groups_enabled()
-                    && (GroupUser::has_full_access_by_member(&member.org_uuid, &member.uuid, conn).await
-                        || GroupUser::has_access_to_collection_by_member(col_id, &member.uuid, conn).await)))
+                    && (GroupUser::has_full_access_by_member(&org_user.org_uuid, &org_user.uuid, conn).await
+                        || GroupUser::has_access_to_collection_by_member(col_id, &org_user.uuid, conn).await)))
    }
 }

@@ -199,7 +185,7 @@ impl Collection {
        }}
    }

-    pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_organization(org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for collection in Self::find_by_organization(org_uuid, conn).await {
            collection.delete(conn).await?;
        }
@@ -207,12 +193,12 @@ impl Collection {
    }

    pub async fn update_users_revision(&self, conn: &mut DbConn) {
-        for member in Membership::find_by_collection_and_org(&self.uuid, &self.org_uuid, conn).await.iter() {
-            User::update_uuid_revision(&member.user_uuid, conn).await;
+        for user_org in UserOrganization::find_by_collection_and_org(&self.uuid, &self.org_uuid, conn).await.iter() {
+            User::update_uuid_revision(&user_org.user_uuid, conn).await;
        }
    }

-    pub async fn find_by_uuid(uuid: &CollectionId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            collections::table
                .filter(collections::uuid.eq(uuid))
@@ -222,7 +208,7 @@ impl Collection {
        }}
    }

-    pub async fn find_by_user_uuid(user_uuid: UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user_uuid(user_uuid: String, conn: &mut DbConn) -> Vec<Self> {
        if CONFIG.org_groups_enabled() {
            db_run! { conn: {
                collections::table
@@ -248,7 +234,7 @@ impl Collection {
                    )
                ))
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .filter(
                    users_collections::user_uuid.eq(user_uuid).or( // Directly accessed collection
@@ -279,7 +265,7 @@ impl Collection {
                    )
                ))
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .filter(
                    users_collections::user_uuid.eq(user_uuid).or( // Directly accessed collection
@@ -293,19 +279,15 @@ impl Collection {
        }
    }

-    pub async fn find_by_organization_and_user_uuid(
-        org_uuid: &OrganizationId,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Vec<Self> {
+    pub async fn find_by_organization_and_user_uuid(org_uuid: &str, user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        Self::find_by_user_uuid(user_uuid.to_owned(), conn)
            .await
            .into_iter()
-            .filter(|c| &c.org_uuid == org_uuid)
+            .filter(|c| c.org_uuid == org_uuid)
            .collect()
    }

-    pub async fn find_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_organization(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            collections::table
                .filter(collections::org_uuid.eq(org_uuid))
@@ -315,7 +297,7 @@ impl Collection {
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            collections::table
                .filter(collections::org_uuid.eq(org_uuid))
@@ -326,11 +308,7 @@ impl Collection {
        }}
    }

-    pub async fn find_by_uuid_and_org(
-        uuid: &CollectionId,
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_org(uuid: &str, org_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            collections::table
                .filter(collections::uuid.eq(uuid))
@@ -342,7 +320,7 @@ impl Collection {
        }}
    }

-    pub async fn find_by_uuid_and_user(uuid: &CollectionId, user_uuid: UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid_and_user(uuid: &str, user_uuid: String, conn: &mut DbConn) -> Option<Self> {
        if CONFIG.org_groups_enabled() {
            db_run! { conn: {
                collections::table
@@ -371,7 +349,7 @@ impl Collection {
                .filter(
                    users_collections::collection_uuid.eq(uuid).or( // Directly accessed collection
                        users_organizations::access_all.eq(true).or( // access_all in Organization
-                            users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                            users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                    )).or(
                        groups::access_all.eq(true) // access_all in groups
                    ).or( // access via groups
@@ -400,7 +378,7 @@ impl Collection {
                .filter(
                    users_collections::collection_uuid.eq(uuid).or( // Directly accessed collection
                        users_organizations::access_all.eq(true).or( // access_all in Organization
-                            users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                            users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                    ))
                ).select(collections::all_columns)
                .first::<CollectionDb>(conn).ok()
@@ -409,7 +387,7 @@ impl Collection {
        }
    }

-    pub async fn is_writable_by_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_writable_by_user(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        let user_uuid = user_uuid.to_string();
        if CONFIG.org_groups_enabled() {
            db_run! { conn: {
@@ -433,7 +411,7 @@ impl Collection {
                        collections_groups::groups_uuid.eq(groups_users::groups_uuid)
                        .and(collections_groups::collections_uuid.eq(collections::uuid))
                    ))
-                    .filter(users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                    .filter(users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                        .or(users_organizations::access_all.eq(true)) // access_all via membership
                        .or(users_collections::collection_uuid.eq(&self.uuid) // write access given to collection
                            .and(users_collections::read_only.eq(false)))
@@ -458,7 +436,7 @@ impl Collection {
                        users_collections::collection_uuid.eq(collections::uuid)
                        .and(users_collections::user_uuid.eq(user_uuid))
                    ))
-                    .filter(users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                    .filter(users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                        .or(users_organizations::access_all.eq(true)) // access_all via membership
                        .or(users_collections::collection_uuid.eq(&self.uuid) // write access given to collection
                            .and(users_collections::read_only.eq(false)))
@@ -471,7 +449,7 @@ impl Collection {
        }
    }

-    pub async fn hide_passwords_for_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn hide_passwords_for_user(&self, user_uuid: &str, conn: &mut DbConn) -> bool {
        let user_uuid = user_uuid.to_string();
        db_run! { conn: {
            collections::table
@@ -500,7 +478,7 @@ impl Collection {
            .filter(
                users_collections::collection_uuid.eq(&self.uuid).and(users_collections::hide_passwords.eq(true)).or(// Directly accessed collection
                    users_organizations::access_all.eq(true).or( // access_all in Organization
-                        users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
+                        users_organizations::atype.le(UserOrgType::Admin as i32) // Org admin or owner
                )).or(
                    groups::access_all.eq(true) // access_all in groups
                ).or( // access via groups
@@ -516,61 +494,11 @@ impl Collection {
            .unwrap_or(0) != 0
        }}
    }
-
-    pub async fn is_manageable_by_user(&self, user_uuid: &UserId, conn: &mut DbConn) -> bool {
-        let user_uuid = user_uuid.to_string();
-        db_run! { conn: {
-            collections::table
-            .left_join(users_collections::table.on(
-                users_collections::collection_uuid.eq(collections::uuid).and(
-                    users_collections::user_uuid.eq(user_uuid.clone())
-                )
-            ))
-            .left_join(users_organizations::table.on(
-                collections::org_uuid.eq(users_organizations::org_uuid).and(
-                    users_organizations::user_uuid.eq(user_uuid)
-                )
-            ))
-            .left_join(groups_users::table.on(
-                groups_users::users_organizations_uuid.eq(users_organizations::uuid)
-            ))
-            .left_join(groups::table.on(
-                groups::uuid.eq(groups_users::groups_uuid)
-            ))
-            .left_join(collections_groups::table.on(
-                collections_groups::groups_uuid.eq(groups_users::groups_uuid).and(
-                    collections_groups::collections_uuid.eq(collections::uuid)
-                )
-            ))
-            .filter(collections::uuid.eq(&self.uuid))
-            .filter(
-                users_collections::collection_uuid.eq(&self.uuid).and(users_collections::manage.eq(true)).or(// Directly accessed collection
-                    users_organizations::access_all.eq(true).or( // access_all in Organization
-                        users_organizations::atype.le(MembershipType::Admin as i32) // Org admin or owner
-                )).or(
-                    groups::access_all.eq(true) // access_all in groups
-                ).or( // access via groups
-                    groups_users::users_organizations_uuid.eq(users_organizations::uuid).and(
-                        collections_groups::collections_uuid.is_not_null().and(
-                            collections_groups::manage.eq(true))
-                    )
-                )
-            )
-            .count()
-            .first::<i64>(conn)
-            .ok()
-            .unwrap_or(0) != 0
-        }}
-    }
 }

 /// Database methods
 impl CollectionUser {
-    pub async fn find_by_organization_and_user_uuid(
-        org_uuid: &OrganizationId,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Vec<Self> {
+    pub async fn find_by_organization_and_user_uuid(org_uuid: &str, user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            users_collections::table
                .filter(users_collections::user_uuid.eq(user_uuid))
@@ -583,30 +511,24 @@ impl CollectionUser {
        }}
    }

-    pub async fn find_by_organization_swap_user_uuid_with_member_uuid(
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> Vec<CollectionMembership> {
-        let col_users = db_run! { conn: {
+    pub async fn find_by_organization(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
+        db_run! { conn: {
            users_collections::table
                .inner_join(collections::table.on(collections::uuid.eq(users_collections::collection_uuid)))
                .filter(collections::org_uuid.eq(org_uuid))
                .inner_join(users_organizations::table.on(users_organizations::user_uuid.eq(users_collections::user_uuid)))
-                .filter(users_organizations::org_uuid.eq(org_uuid))
-                .select((users_organizations::uuid, users_collections::collection_uuid, users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
+                .select((users_organizations::uuid, users_collections::collection_uuid, users_collections::read_only, users_collections::hide_passwords))
                .load::<CollectionUserDb>(conn)
                .expect("Error loading users_collections")
                .from_db()
-        }};
-        col_users.into_iter().map(|c| c.into()).collect()
+        }}
    }

    pub async fn save(
-        user_uuid: &UserId,
-        collection_uuid: &CollectionId,
+        user_uuid: &str,
+        collection_uuid: &str,
        read_only: bool,
        hide_passwords: bool,
-        manage: bool,
        conn: &mut DbConn,
    ) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;
@@ -619,7 +541,6 @@ impl CollectionUser {
                        users_collections::collection_uuid.eq(collection_uuid),
                        users_collections::read_only.eq(read_only),
                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
                    ))
                    .execute(conn)
                {
@@ -634,7 +555,6 @@ impl CollectionUser {
                                users_collections::collection_uuid.eq(collection_uuid),
                                users_collections::read_only.eq(read_only),
                                users_collections::hide_passwords.eq(hide_passwords),
-                                users_collections::manage.eq(manage),
                            ))
                            .execute(conn)
                            .map_res("Error adding user to collection")
@@ -649,14 +569,12 @@ impl CollectionUser {
                        users_collections::collection_uuid.eq(collection_uuid),
                        users_collections::read_only.eq(read_only),
                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
                    ))
                    .on_conflict((users_collections::user_uuid, users_collections::collection_uuid))
                    .do_update()
                    .set((
                        users_collections::read_only.eq(read_only),
                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
                    ))
                    .execute(conn)
                    .map_res("Error adding user to collection")
@@ -678,7 +596,7 @@ impl CollectionUser {
        }}
    }

-    pub async fn find_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_collection(collection_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            users_collections::table
                .filter(users_collections::collection_uuid.eq(collection_uuid))
@@ -689,27 +607,24 @@ impl CollectionUser {
        }}
    }

-    pub async fn find_by_org_and_coll_swap_user_uuid_with_member_uuid(
-        org_uuid: &OrganizationId,
-        collection_uuid: &CollectionId,
+    pub async fn find_by_collection_swap_user_uuid_with_org_user_uuid(
+        collection_uuid: &str,
        conn: &mut DbConn,
-    ) -> Vec<CollectionMembership> {
-        let col_users = db_run! { conn: {
+    ) -> Vec<Self> {
+        db_run! { conn: {
            users_collections::table
                .filter(users_collections::collection_uuid.eq(collection_uuid))
-                .filter(users_organizations::org_uuid.eq(org_uuid))
                .inner_join(users_organizations::table.on(users_organizations::user_uuid.eq(users_collections::user_uuid)))
-                .select((users_organizations::uuid, users_collections::collection_uuid, users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
+                .select((users_organizations::uuid, users_collections::collection_uuid, users_collections::read_only, users_collections::hide_passwords))
                .load::<CollectionUserDb>(conn)
                .expect("Error loading users_collections")
                .from_db()
-        }};
-        col_users.into_iter().map(|c| c.into()).collect()
+        }}
    }

    pub async fn find_by_collection_and_user(
-        collection_uuid: &CollectionId,
-        user_uuid: &UserId,
+        collection_uuid: &str,
+        user_uuid: &str,
        conn: &mut DbConn,
    ) -> Option<Self> {
        db_run! { conn: {
@@ -723,7 +638,7 @@ impl CollectionUser {
        }}
    }

-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            users_collections::table
                .filter(users_collections::user_uuid.eq(user_uuid))
@@ -734,7 +649,7 @@ impl CollectionUser {
        }}
    }

-    pub async fn delete_all_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_collection(collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for collection in CollectionUser::find_by_collection(collection_uuid, conn).await.iter() {
            User::update_uuid_revision(&collection.user_uuid, conn).await;
        }
@@ -746,11 +661,7 @@ impl CollectionUser {
        }}
    }

-    pub async fn delete_all_by_user_and_org(
-        user_uuid: &UserId,
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn delete_all_by_user_and_org(user_uuid: &str, org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let collectionusers = Self::find_by_organization_and_user_uuid(org_uuid, user_uuid, conn).await;

        db_run! { conn: {
@@ -766,18 +677,14 @@ impl CollectionUser {
        }}
    }

-    pub async fn has_access_to_collection_by_user(
-        col_id: &CollectionId,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> bool {
+    pub async fn has_access_to_collection_by_user(col_id: &str, user_uuid: &str, conn: &mut DbConn) -> bool {
        Self::find_by_collection_and_user(col_id, user_uuid, conn).await.is_some()
    }
 }

 /// Database methods
 impl CollectionCipher {
-    pub async fn save(cipher_uuid: &CipherId, collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn save(cipher_uuid: &str, collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        Self::update_users_revision(collection_uuid, conn).await;

        db_run! { conn:
@@ -807,7 +714,7 @@ impl CollectionCipher {
        }
    }

-    pub async fn delete(cipher_uuid: &CipherId, collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete(cipher_uuid: &str, collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        Self::update_users_revision(collection_uuid, conn).await;

        db_run! { conn: {
@@ -821,7 +728,7 @@ impl CollectionCipher {
        }}
    }

-    pub async fn delete_all_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(ciphers_collections::table.filter(ciphers_collections::cipher_uuid.eq(cipher_uuid)))
                .execute(conn)
@@ -829,7 +736,7 @@ impl CollectionCipher {
        }}
    }

-    pub async fn delete_all_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_collection(collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(ciphers_collections::table.filter(ciphers_collections::collection_uuid.eq(collection_uuid)))
                .execute(conn)
@@ -837,63 +744,9 @@ impl CollectionCipher {
        }}
    }

-    pub async fn update_users_revision(collection_uuid: &CollectionId, conn: &mut DbConn) {
+    pub async fn update_users_revision(collection_uuid: &str, conn: &mut DbConn) {
        if let Some(collection) = Collection::find_by_uuid(collection_uuid, conn).await {
            collection.update_users_revision(conn).await;
        }
    }
 }
-
-// Added in case we need the membership_uuid instead of the user_uuid
-pub struct CollectionMembership {
-    pub membership_uuid: MembershipId,
-    pub collection_uuid: CollectionId,
-    pub read_only: bool,
-    pub hide_passwords: bool,
-    pub manage: bool,
-}
-
-impl CollectionMembership {
-    pub fn to_json_details_for_member(&self, membership_type: i32) -> Value {
-        json!({
-            "id": self.membership_uuid,
-            "readOnly": self.read_only,
-            "hidePasswords": self.hide_passwords,
-            "manage": membership_type >= MembershipType::Admin
-                || self.manage
-                || (membership_type == MembershipType::Manager
-                    && !self.read_only
-                    && !self.hide_passwords),
-        })
-    }
-}
-
-impl From<CollectionUser> for CollectionMembership {
-    fn from(c: CollectionUser) -> Self {
-        Self {
-            membership_uuid: c.user_uuid.to_string().into(),
-            collection_uuid: c.collection_uuid,
-            read_only: c.read_only,
-            hide_passwords: c.hide_passwords,
-            manage: c.manage,
-        }
-    }
-}
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct CollectionId(String);
--- a/src/db/models/device.rs
+++ b/src/db/models/device.rs
@@ -1,14 +1,7 @@
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{Display, From};
-use serde_json::Value;

-use super::{AuthRequest, UserId};
-use crate::{
-    crypto,
-    util::{format_date, get_uuid},
-    CONFIG,
-};
-use macros::{IdFromParam, UuidFromParam};
+use crate::{crypto, CONFIG};
+use core::fmt;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -16,25 +9,26 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid, user_uuid))]
    pub struct Device {
-        pub uuid: DeviceId,
+        pub uuid: String,
        pub created_at: NaiveDateTime,
        pub updated_at: NaiveDateTime,

-        pub user_uuid: UserId,
+        pub user_uuid: String,

        pub name: String,
-        pub atype: i32,         // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/Enums/DeviceType.cs
-        pub push_uuid: Option<PushId>,
+        pub atype: i32,         // https://github.com/bitwarden/server/blob/dcc199bcce4aa2d5621f6fab80f1b49d8b143418/src/Core/Enums/DeviceType.cs
+        pub push_uuid: Option<String>,
        pub push_token: Option<String>,

        pub refresh_token: String,
+
        pub twofactor_remember: Option<String>,
    }
 }

 /// Local methods
 impl Device {
-    pub fn new(uuid: DeviceId, user_uuid: UserId, name: String, atype: i32) -> Self {
+    pub fn new(uuid: String, user_uuid: String, name: String, atype: i32) -> Self {
        let now = Utc::now().naive_utc();

        Self {
@@ -46,25 +40,13 @@ impl Device {
            name,
            atype,

-            push_uuid: Some(PushId(get_uuid())),
+            push_uuid: None,
            push_token: None,
            refresh_token: String::new(),
            twofactor_remember: None,
        }
    }

-    pub fn to_json(&self) -> Value {
-        json!({
-            "id": self.uuid,
-            "name": self.name,
-            "type": self.atype,
-            "identifier": self.uuid,
-            "creationDate": format_date(&self.created_at),
-            "isTrusted": false,
-            "object":"device"
-        })
-    }
-
    pub fn refresh_twofactor_remember(&mut self) -> String {
        use data_encoding::BASE64;
        let twofactor_remember = crypto::encode_random_bytes::<180>(BASE64);
@@ -77,12 +59,7 @@ impl Device {
        self.twofactor_remember = None;
    }

-    pub fn refresh_tokens(
-        &mut self,
-        user: &super::User,
-        scope: Vec<String>,
-        client_id: Option<String>,
-    ) -> (String, i64) {
+    pub fn refresh_tokens(&mut self, user: &super::User, scope: Vec<String>) -> (String, i64) {
        // If there is no refresh token, we create one
        if self.refresh_token.is_empty() {
            use data_encoding::BASE64URL;
@@ -93,22 +70,17 @@ impl Device {
        let time_now = Utc::now();
        self.updated_at = time_now.naive_utc();

-        // Generate a random push_uuid so if it doesn't already have one
-        if self.push_uuid.is_none() {
-            self.push_uuid = Some(PushId(get_uuid()));
-        }
-
        // ---
        // Disabled these keys to be added to the JWT since they could cause the JWT to get too large
        // Also These key/value pairs are not used anywhere by either Vaultwarden or Bitwarden Clients
        // Because these might get used in the future, and they are added by the Bitwarden Server, lets keep it, but then commented out
        // ---
-        // fn arg: members: Vec<super::Membership>,
+        // fn arg: orgs: Vec<super::UserOrganization>,
        // ---
-        // let orgowner: Vec<_> = members.iter().filter(|m| m.atype == 0).map(|o| o.org_uuid.clone()).collect();
-        // let orgadmin: Vec<_> = members.iter().filter(|m| m.atype == 1).map(|o| o.org_uuid.clone()).collect();
-        // let orguser: Vec<_> = members.iter().filter(|m| m.atype == 2).map(|o| o.org_uuid.clone()).collect();
-        // let orgmanager: Vec<_> = members.iter().filter(|m| m.atype == 3).map(|o| o.org_uuid.clone()).collect();
+        // let orgowner: Vec<_> = orgs.iter().filter(|o| o.atype == 0).map(|o| o.org_uuid.clone()).collect();
+        // let orgadmin: Vec<_> = orgs.iter().filter(|o| o.atype == 1).map(|o| o.org_uuid.clone()).collect();
+        // let orguser: Vec<_> = orgs.iter().filter(|o| o.atype == 2).map(|o| o.org_uuid.clone()).collect();
+        // let orgmanager: Vec<_> = orgs.iter().filter(|o| o.atype == 3).map(|o| o.org_uuid.clone()).collect();

        // Create the JWT claims struct, to send to the client
        use crate::auth::{encode_jwt, LoginJwtClaims, DEFAULT_VALIDITY, JWT_LOGIN_ISSUER};
@@ -135,8 +107,6 @@ impl Device {
            // orgmanager,
            sstamp: user.security_stamp.clone(),
            device: self.uuid.clone(),
-            devicetype: DeviceType::from_i32(self.atype).to_string(),
-            client_id: client_id.unwrap_or("undefined".to_string()),
            scope,
            amr: vec!["Application".into()],
        };
@@ -148,43 +118,11 @@ impl Device {
        matches!(DeviceType::from_i32(self.atype), DeviceType::Android | DeviceType::Ios)
    }

-    pub fn is_cli(&self) -> bool {
-        matches!(DeviceType::from_i32(self.atype), DeviceType::WindowsCLI | DeviceType::MacOsCLI | DeviceType::LinuxCLI)
+    pub fn is_registered(&self) -> bool {
+        self.push_uuid.is_some()
    }
 }

-pub struct DeviceWithAuthRequest {
-    pub device: Device,
-    pub pending_auth_request: Option<AuthRequest>,
-}
-
-impl DeviceWithAuthRequest {
-    pub fn to_json(&self) -> Value {
-        let auth_request = match &self.pending_auth_request {
-            Some(auth_request) => auth_request.to_json_for_pending_device(),
-            None => Value::Null,
-        };
-        json!({
-            "id": self.device.uuid,
-            "name": self.device.name,
-            "type": self.device.atype,
-            "identifier": self.device.uuid,
-            "creationDate": format_date(&self.device.created_at),
-            "devicePendingAuthRequest": auth_request,
-            "isTrusted": false,
-            "encryptedPublicKey": null,
-            "encryptedUserKey": null,
-            "object": "device",
-        })
-    }
-
-    pub fn from(c: Device, a: Option<AuthRequest>) -> Self {
-        Self {
-            device: c,
-            pending_auth_request: a,
-        }
-    }
-}
 use crate::db::DbConn;

 use crate::api::EmptyResult;
@@ -212,7 +150,7 @@ impl Device {
        }
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(devices::table.filter(devices::user_uuid.eq(user_uuid)))
                .execute(conn)
@@ -220,7 +158,7 @@ impl Device {
        }}
    }

-    pub async fn find_by_uuid_and_user(uuid: &DeviceId, user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid_and_user(uuid: &str, user_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::uuid.eq(uuid))
@@ -231,17 +169,7 @@ impl Device {
        }}
    }

-    pub async fn find_with_auth_request_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<DeviceWithAuthRequest> {
-        let devices = Self::find_by_user(user_uuid, conn).await;
-        let mut result = Vec::new();
-        for device in devices {
-            let auth_request = AuthRequest::find_by_user_and_requested_device(user_uuid, &device.uuid, conn).await;
-            result.push(DeviceWithAuthRequest::from(device, auth_request));
-        }
-        result
-    }
-
-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::user_uuid.eq(user_uuid))
@@ -251,7 +179,7 @@ impl Device {
        }}
    }

-    pub async fn find_by_uuid(uuid: &DeviceId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::uuid.eq(uuid))
@@ -261,7 +189,7 @@ impl Device {
        }}
    }

-    pub async fn clear_push_token_by_uuid(uuid: &DeviceId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn clear_push_token_by_uuid(uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::update(devices::table)
                .filter(devices::uuid.eq(uuid))
@@ -280,7 +208,7 @@ impl Device {
        }}
    }

-    pub async fn find_latest_active_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_latest_active_by_user(user_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::user_uuid.eq(user_uuid))
@@ -291,7 +219,7 @@ impl Device {
        }}
    }

-    pub async fn find_push_devices_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_push_devices_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            devices::table
                .filter(devices::user_uuid.eq(user_uuid))
@@ -302,7 +230,7 @@ impl Device {
        }}
    }

-    pub async fn check_user_has_push_device(user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn check_user_has_push_device(user_uuid: &str, conn: &mut DbConn) -> bool {
        db_run! { conn: {
            devices::table
            .filter(devices::user_uuid.eq(user_uuid))
@@ -315,62 +243,68 @@ impl Device {
    }
 }

-#[derive(Display)]
 pub enum DeviceType {
-    #[display("Android")]
    Android = 0,
-    #[display("iOS")]
    Ios = 1,
-    #[display("Chrome Extension")]
    ChromeExtension = 2,
-    #[display("Firefox Extension")]
    FirefoxExtension = 3,
-    #[display("Opera Extension")]
    OperaExtension = 4,
-    #[display("Edge Extension")]
    EdgeExtension = 5,
-    #[display("Windows")]
    WindowsDesktop = 6,
-    #[display("macOS")]
    MacOsDesktop = 7,
-    #[display("Linux")]
    LinuxDesktop = 8,
-    #[display("Chrome")]
    ChromeBrowser = 9,
-    #[display("Firefox")]
    FirefoxBrowser = 10,
-    #[display("Opera")]
    OperaBrowser = 11,
-    #[display("Edge")]
    EdgeBrowser = 12,
-    #[display("Internet Explorer")]
    IEBrowser = 13,
-    #[display("Unknown Browser")]
    UnknownBrowser = 14,
-    #[display("Android")]
    AndroidAmazon = 15,
-    #[display("UWP")]
    Uwp = 16,
-    #[display("Safari")]
    SafariBrowser = 17,
-    #[display("Vivaldi")]
    VivaldiBrowser = 18,
-    #[display("Vivaldi Extension")]
    VivaldiExtension = 19,
-    #[display("Safari Extension")]
    SafariExtension = 20,
-    #[display("SDK")]
    Sdk = 21,
-    #[display("Server")]
    Server = 22,
-    #[display("Windows CLI")]
    WindowsCLI = 23,
-    #[display("macOS CLI")]
    MacOsCLI = 24,
-    #[display("Linux CLI")]
    LinuxCLI = 25,
 }

+impl fmt::Display for DeviceType {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            DeviceType::Android => write!(f, "Android"),
+            DeviceType::Ios => write!(f, "iOS"),
+            DeviceType::ChromeExtension => write!(f, "Chrome Extension"),
+            DeviceType::FirefoxExtension => write!(f, "Firefox Extension"),
+            DeviceType::OperaExtension => write!(f, "Opera Extension"),
+            DeviceType::EdgeExtension => write!(f, "Edge Extension"),
+            DeviceType::WindowsDesktop => write!(f, "Windows"),
+            DeviceType::MacOsDesktop => write!(f, "macOS"),
+            DeviceType::LinuxDesktop => write!(f, "Linux"),
+            DeviceType::ChromeBrowser => write!(f, "Chrome"),
+            DeviceType::FirefoxBrowser => write!(f, "Firefox"),
+            DeviceType::OperaBrowser => write!(f, "Opera"),
+            DeviceType::EdgeBrowser => write!(f, "Edge"),
+            DeviceType::IEBrowser => write!(f, "Internet Explorer"),
+            DeviceType::UnknownBrowser => write!(f, "Unknown Browser"),
+            DeviceType::AndroidAmazon => write!(f, "Android"),
+            DeviceType::Uwp => write!(f, "UWP"),
+            DeviceType::SafariBrowser => write!(f, "Safari"),
+            DeviceType::VivaldiBrowser => write!(f, "Vivaldi"),
+            DeviceType::VivaldiExtension => write!(f, "Vivaldi Extension"),
+            DeviceType::SafariExtension => write!(f, "Safari Extension"),
+            DeviceType::Sdk => write!(f, "SDK"),
+            DeviceType::Server => write!(f, "Server"),
+            DeviceType::WindowsCLI => write!(f, "Windows CLI"),
+            DeviceType::MacOsCLI => write!(f, "macOS CLI"),
+            DeviceType::LinuxCLI => write!(f, "Linux CLI"),
+        }
+    }
+}
+
 impl DeviceType {
    pub fn from_i32(value: i32) -> DeviceType {
        match value {
@@ -404,11 +338,3 @@ impl DeviceType {
        }
    }
 }
-
-#[derive(
-    Clone, Debug, DieselNewType, Display, From, FromForm, Hash, PartialEq, Eq, Serialize, Deserialize, IdFromParam,
-)]
-pub struct DeviceId(String);
-
-#[derive(Clone, Debug, DieselNewType, Display, From, FromForm, Serialize, Deserialize, UuidFromParam)]
-pub struct PushId(pub String);
--- a/src/db/models/emergency_access.rs
+++ b/src/db/models/emergency_access.rs
@@ -1,10 +1,9 @@
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{AsRef, Deref, Display, From};
 use serde_json::Value;

-use super::{User, UserId};
 use crate::{api::EmptyResult, db::DbConn, error::MapResult};
-use macros::UuidFromParam;
+
+use super::User;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -12,9 +11,9 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct EmergencyAccess {
-        pub uuid: EmergencyAccessId,
-        pub grantor_uuid: UserId,
-        pub grantee_uuid: Option<UserId>,
+        pub uuid: String,
+        pub grantor_uuid: String,
+        pub grantee_uuid: Option<String>,
        pub email: Option<String>,
        pub key_encrypted: Option<String>,
        pub atype: i32, //EmergencyAccessType
@@ -30,11 +29,11 @@ db_object! {
 // Local methods

 impl EmergencyAccess {
-    pub fn new(grantor_uuid: UserId, email: String, status: i32, atype: i32, wait_time_days: i32) -> Self {
+    pub fn new(grantor_uuid: String, email: String, status: i32, atype: i32, wait_time_days: i32) -> Self {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: EmergencyAccessId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            grantor_uuid,
            grantee_uuid: None,
            email: Some(email),
@@ -78,13 +77,12 @@ impl EmergencyAccess {
            "grantorId": grantor_user.uuid,
            "email": grantor_user.email,
            "name": grantor_user.name,
-            "avatarColor": grantor_user.avatar_color,
            "object": "emergencyAccessGrantorDetails",
        })
    }

    pub async fn to_json_grantee_details(&self, conn: &mut DbConn) -> Option<Value> {
-        let grantee_user = if let Some(grantee_uuid) = &self.grantee_uuid {
+        let grantee_user = if let Some(grantee_uuid) = self.grantee_uuid.as_deref() {
            User::find_by_uuid(grantee_uuid, conn).await.expect("Grantee user not found.")
        } else if let Some(email) = self.email.as_deref() {
            match User::find_by_mail(email, conn).await {
@@ -107,7 +105,6 @@ impl EmergencyAccess {
            "granteeId": grantee_user.uuid,
            "email": grantee_user.email,
            "name": grantee_user.name,
-            "avatarColor": grantee_user.avatar_color,
            "object": "emergencyAccessGranteeDetails",
        }))
    }
@@ -214,7 +211,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for ea in Self::find_all_by_grantor_uuid(user_uuid, conn).await {
            ea.delete(conn).await?;
        }
@@ -242,8 +239,8 @@ impl EmergencyAccess {
    }

    pub async fn find_by_grantor_uuid_and_grantee_uuid_or_email(
-        grantor_uuid: &UserId,
-        grantee_uuid: &UserId,
+        grantor_uuid: &str,
+        grantee_uuid: &str,
        email: &str,
        conn: &mut DbConn,
    ) -> Option<Self> {
@@ -265,11 +262,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_by_uuid_and_grantor_uuid(
-        uuid: &EmergencyAccessId,
-        grantor_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_grantor_uuid(uuid: &str, grantor_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::uuid.eq(uuid))
@@ -279,11 +272,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_by_uuid_and_grantee_uuid(
-        uuid: &EmergencyAccessId,
-        grantee_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_grantee_uuid(uuid: &str, grantee_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::uuid.eq(uuid))
@@ -293,11 +282,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_by_uuid_and_grantee_email(
-        uuid: &EmergencyAccessId,
-        grantee_email: &str,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_uuid_and_grantee_email(uuid: &str, grantee_email: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::uuid.eq(uuid))
@@ -307,7 +292,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_all_by_grantee_uuid(grantee_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_all_by_grantee_uuid(grantee_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::grantee_uuid.eq(grantee_uuid))
@@ -334,7 +319,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn find_all_by_grantor_uuid(grantor_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_all_by_grantor_uuid(grantor_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            emergency_access::table
                .filter(emergency_access::grantor_uuid.eq(grantor_uuid))
@@ -342,12 +327,7 @@ impl EmergencyAccess {
        }}
    }

-    pub async fn accept_invite(
-        &mut self,
-        grantee_uuid: &UserId,
-        grantee_email: &str,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn accept_invite(&mut self, grantee_uuid: &str, grantee_email: &str, conn: &mut DbConn) -> EmptyResult {
        if self.email.is_none() || self.email.as_ref().unwrap() != grantee_email {
            err!("User email does not match invite.");
        }
@@ -357,28 +337,10 @@ impl EmergencyAccess {
        }

        self.status = EmergencyAccessStatus::Accepted as i32;
-        self.grantee_uuid = Some(grantee_uuid.clone());
+        self.grantee_uuid = Some(String::from(grantee_uuid));
        self.email = None;
        self.save(conn).await
    }
 }

 // endregion
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct EmergencyAccessId(String);
--- a/src/db/models/event.rs
+++ b/src/db/models/event.rs
@@ -1,42 +1,41 @@
-use chrono::{NaiveDateTime, TimeDelta, Utc};
-//use derive_more::{AsRef, Deref, Display, From};
+use crate::db::DbConn;
 use serde_json::Value;

-use super::{CipherId, CollectionId, GroupId, MembershipId, OrgPolicyId, OrganizationId, UserId};
-use crate::{api::EmptyResult, db::DbConn, error::MapResult, CONFIG};
+use crate::{api::EmptyResult, error::MapResult, CONFIG};
+
+use chrono::{NaiveDateTime, TimeDelta, Utc};

 // https://bitwarden.com/help/event-logs/

 db_object! {
-    // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Services/Implementations/EventService.cs
-    // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Public/Models/Response/EventResponseModel.cs
-    // Upstream SQL: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Sql/dbo/Tables/Event.sql
+    // Upstream: https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Core/Services/Implementations/EventService.cs
+    // Upstream: https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Api/Models/Public/Response/EventResponseModel.cs
+    // Upstream SQL: https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Sql/dbo/Tables/Event.sql
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = event)]
-    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct Event {
-        pub uuid: EventId,
+        pub uuid: String,
        pub event_type: i32, // EventType
-        pub user_uuid: Option<UserId>,
-        pub org_uuid: Option<OrganizationId>,
-        pub cipher_uuid: Option<CipherId>,
-        pub collection_uuid: Option<CollectionId>,
-        pub group_uuid: Option<GroupId>,
-        pub org_user_uuid: Option<MembershipId>,
-        pub act_user_uuid: Option<UserId>,
-        // Upstream enum: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/Enums/DeviceType.cs
+        pub user_uuid: Option<String>,
+        pub org_uuid: Option<String>,
+        pub cipher_uuid: Option<String>,
+        pub collection_uuid: Option<String>,
+        pub group_uuid: Option<String>,
+        pub org_user_uuid: Option<String>,
+        pub act_user_uuid: Option<String>,
+        // Upstream enum: https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Core/Enums/DeviceType.cs
        pub device_type: Option<i32>,
        pub ip_address: Option<String>,
        pub event_date: NaiveDateTime,
-        pub policy_uuid: Option<OrgPolicyId>,
+        pub policy_uuid: Option<String>,
        pub provider_uuid: Option<String>,
        pub provider_user_uuid: Option<String>,
        pub provider_org_uuid: Option<String>,
    }
 }

-// Upstream enum: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/EventType.cs
+// Upstream enum: https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Core/Enums/EventType.cs
 #[derive(Debug, Copy, Clone)]
 pub enum EventType {
    // User
@@ -50,8 +49,6 @@ pub enum EventType {
    UserClientExportedVault = 1007,
    // UserUpdatedTempPassword = 1008, // Not supported
    // UserMigratedKeyToKeyConnector = 1009, // Not supported
-    UserRequestedDeviceApproval = 1010,
-    // UserTdeOffboardingPasswordSet = 1011, // Not supported

    // Cipher
    CipherCreated = 1100,
@@ -87,7 +84,7 @@ pub enum EventType {
    OrganizationUserInvited = 1500,
    OrganizationUserConfirmed = 1501,
    OrganizationUserUpdated = 1502,
-    OrganizationUserRemoved = 1503, // Organization user data was deleted
+    OrganizationUserRemoved = 1503,
    OrganizationUserUpdatedGroups = 1504,
    // OrganizationUserUnlinkedSso = 1505, // Not supported
    OrganizationUserResetPasswordEnroll = 1506,
@@ -97,10 +94,6 @@ pub enum EventType {
    // OrganizationUserFirstSsoLogin = 1510, // Not supported
    OrganizationUserRevoked = 1511,
    OrganizationUserRestored = 1512,
-    OrganizationUserApprovedAuthRequest = 1513,
-    OrganizationUserRejectedAuthRequest = 1514,
-    OrganizationUserDeleted = 1515, // Both user and organization user data were deleted
-    OrganizationUserLeft = 1516,    // User voluntarily left the organization

    // Organization
    OrganizationUpdated = 1600,
@@ -112,7 +105,6 @@ pub enum EventType {
    // OrganizationEnabledKeyConnector = 1606, // Not supported
    // OrganizationDisabledKeyConnector = 1607, // Not supported
    // OrganizationSponsorshipsSynced = 1608, // Not supported
-    // OrganizationCollectionManagementUpdated = 1609, // Not supported

    // Policy
    PolicyUpdated = 1700,
@@ -125,13 +117,6 @@ pub enum EventType {
    // ProviderOrganizationAdded = 1901, // Not supported
    // ProviderOrganizationRemoved = 1902, // Not supported
    // ProviderOrganizationVaultAccessed = 1903, // Not supported
-
-    // OrganizationDomainAdded = 2000, // Not supported
-    // OrganizationDomainRemoved = 2001, // Not supported
-    // OrganizationDomainVerified = 2002, // Not supported
-    // OrganizationDomainNotVerified = 2003, // Not supported
-
-    // SecretRetrieved = 2100, // Not supported
 }

 /// Local methods
@@ -143,7 +128,7 @@ impl Event {
        };

        Self {
-            uuid: EventId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            event_type,
            user_uuid: None,
            org_uuid: None,
@@ -187,7 +172,7 @@ impl Event {
 }

 /// Database methods
-/// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Services/Implementations/EventService.cs
+/// https://github.com/bitwarden/server/blob/8a22c0479e987e756ce7412c48a732f9002f0a2d/src/Core/Services/Implementations/EventService.cs
 impl Event {
    pub const PAGE_SIZE: i64 = 30;

@@ -261,7 +246,7 @@ impl Event {
    /// ##############
    /// Custom Queries
    pub async fn find_by_organization_uuid(
-        org_uuid: &OrganizationId,
+        org_uuid: &str,
        start: &NaiveDateTime,
        end: &NaiveDateTime,
        conn: &mut DbConn,
@@ -278,7 +263,7 @@ impl Event {
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(org_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            event::table
                .filter(event::org_uuid.eq(org_uuid))
@@ -289,16 +274,16 @@ impl Event {
        }}
    }

-    pub async fn find_by_org_and_member(
-        org_uuid: &OrganizationId,
-        member_uuid: &MembershipId,
+    pub async fn find_by_org_and_user_org(
+        org_uuid: &str,
+        user_org_uuid: &str,
        start: &NaiveDateTime,
        end: &NaiveDateTime,
        conn: &mut DbConn,
    ) -> Vec<Self> {
        db_run! { conn: {
            event::table
-                .inner_join(users_organizations::table.on(users_organizations::uuid.eq(member_uuid)))
+                .inner_join(users_organizations::table.on(users_organizations::uuid.eq(user_org_uuid)))
                .filter(event::org_uuid.eq(org_uuid))
                .filter(event::event_date.between(start, end))
                .filter(event::user_uuid.eq(users_organizations::user_uuid.nullable()).or(event::act_user_uuid.eq(users_organizations::user_uuid.nullable())))
@@ -312,7 +297,7 @@ impl Event {
    }

    pub async fn find_by_cipher_uuid(
-        cipher_uuid: &CipherId,
+        cipher_uuid: &str,
        start: &NaiveDateTime,
        end: &NaiveDateTime,
        conn: &mut DbConn,
@@ -342,6 +327,3 @@ impl Event {
        }
    }
 }
-
-#[derive(Clone, Debug, DieselNewType, FromForm, Hash, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EventId(String);
--- a/src/db/models/favorite.rs
+++ b/src/db/models/favorite.rs
@@ -1,12 +1,12 @@
-use super::{CipherId, User, UserId};
+use super::User;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable)]
    #[diesel(table_name = favorites)]
    #[diesel(primary_key(user_uuid, cipher_uuid))]
    pub struct Favorite {
-        pub user_uuid: UserId,
-        pub cipher_uuid: CipherId,
+        pub user_uuid: String,
+        pub cipher_uuid: String,
    }
 }

@@ -17,7 +17,7 @@ use crate::error::MapResult;

 impl Favorite {
    // Returns whether the specified cipher is a favorite of the specified user.
-    pub async fn is_favorite(cipher_uuid: &CipherId, user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_favorite(cipher_uuid: &str, user_uuid: &str, conn: &mut DbConn) -> bool {
        db_run! { conn: {
            let query = favorites::table
                .filter(favorites::cipher_uuid.eq(cipher_uuid))
@@ -29,12 +29,7 @@ impl Favorite {
    }

    // Sets whether the specified cipher is a favorite of the specified user.
-    pub async fn set_favorite(
-        favorite: bool,
-        cipher_uuid: &CipherId,
-        user_uuid: &UserId,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn set_favorite(favorite: bool, cipher_uuid: &str, user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let (old, new) = (Self::is_favorite(cipher_uuid, user_uuid, conn).await, favorite);
        match (old, new) {
            (false, true) => {
@@ -67,7 +62,7 @@ impl Favorite {
    }

    // Delete all favorite entries associated with the specified cipher.
-    pub async fn delete_all_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(favorites::table.filter(favorites::cipher_uuid.eq(cipher_uuid)))
                .execute(conn)
@@ -76,7 +71,7 @@ impl Favorite {
    }

    // Delete all favorite entries associated with the specified user.
-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(favorites::table.filter(favorites::user_uuid.eq(user_uuid)))
                .execute(conn)
@@ -86,12 +81,12 @@ impl Favorite {

    /// Return a vec with (cipher_uuid) this will only contain favorite flagged ciphers
    /// This is used during a full sync so we only need one query for all favorite cipher matches.
-    pub async fn get_all_cipher_uuid_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<CipherId> {
+    pub async fn get_all_cipher_uuid_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<String> {
        db_run! { conn: {
            favorites::table
                .filter(favorites::user_uuid.eq(user_uuid))
                .select(favorites::cipher_uuid)
-                .load::<CipherId>(conn)
+                .load::<String>(conn)
                .unwrap_or_default()
        }}
    }
--- a/src/db/models/folder.rs
+++ b/src/db/models/folder.rs
@@ -1,19 +1,17 @@
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{AsRef, Deref, Display, From};
 use serde_json::Value;

-use super::{CipherId, User, UserId};
-use macros::UuidFromParam;
+use super::User;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = folders)]
    #[diesel(primary_key(uuid))]
    pub struct Folder {
-        pub uuid: FolderId,
+        pub uuid: String,
        pub created_at: NaiveDateTime,
        pub updated_at: NaiveDateTime,
-        pub user_uuid: UserId,
+        pub user_uuid: String,
        pub name: String,
    }

@@ -21,18 +19,18 @@ db_object! {
    #[diesel(table_name = folders_ciphers)]
    #[diesel(primary_key(cipher_uuid, folder_uuid))]
    pub struct FolderCipher {
-        pub cipher_uuid: CipherId,
-        pub folder_uuid: FolderId,
+        pub cipher_uuid: String,
+        pub folder_uuid: String,
    }
 }

 /// Local methods
 impl Folder {
-    pub fn new(user_uuid: UserId, name: String) -> Self {
+    pub fn new(user_uuid: String, name: String) -> Self {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: FolderId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            created_at: now,
            updated_at: now,

@@ -54,10 +52,10 @@ impl Folder {
 }

 impl FolderCipher {
-    pub fn new(folder_uuid: FolderId, cipher_uuid: CipherId) -> Self {
+    pub fn new(folder_uuid: &str, cipher_uuid: &str) -> Self {
        Self {
-            folder_uuid,
-            cipher_uuid,
+            folder_uuid: folder_uuid.to_string(),
+            cipher_uuid: cipher_uuid.to_string(),
        }
    }
 }
@@ -115,25 +113,24 @@ impl Folder {
        }}
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for folder in Self::find_by_user(user_uuid, conn).await {
            folder.delete(conn).await?;
        }
        Ok(())
    }

-    pub async fn find_by_uuid_and_user(uuid: &FolderId, user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            folders::table
                .filter(folders::uuid.eq(uuid))
-                .filter(folders::user_uuid.eq(user_uuid))
                .first::<FolderDb>(conn)
                .ok()
                .from_db()
        }}
    }

-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            folders::table
                .filter(folders::user_uuid.eq(user_uuid))
@@ -179,7 +176,7 @@ impl FolderCipher {
        }}
    }

-    pub async fn delete_all_by_cipher(cipher_uuid: &CipherId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_cipher(cipher_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(folders_ciphers::table.filter(folders_ciphers::cipher_uuid.eq(cipher_uuid)))
                .execute(conn)
@@ -187,7 +184,7 @@ impl FolderCipher {
        }}
    }

-    pub async fn delete_all_by_folder(folder_uuid: &FolderId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_folder(folder_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(folders_ciphers::table.filter(folders_ciphers::folder_uuid.eq(folder_uuid)))
                .execute(conn)
@@ -195,11 +192,7 @@ impl FolderCipher {
        }}
    }

-    pub async fn find_by_folder_and_cipher(
-        folder_uuid: &FolderId,
-        cipher_uuid: &CipherId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_folder_and_cipher(folder_uuid: &str, cipher_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            folders_ciphers::table
                .filter(folders_ciphers::folder_uuid.eq(folder_uuid))
@@ -210,7 +203,7 @@ impl FolderCipher {
        }}
    }

-    pub async fn find_by_folder(folder_uuid: &FolderId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_folder(folder_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            folders_ciphers::table
                .filter(folders_ciphers::folder_uuid.eq(folder_uuid))
@@ -222,32 +215,14 @@ impl FolderCipher {

    /// Return a vec with (cipher_uuid, folder_uuid)
    /// This is used during a full sync so we only need one query for all folder matches.
-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<(CipherId, FolderId)> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<(String, String)> {
        db_run! { conn: {
            folders_ciphers::table
                .inner_join(folders::table)
                .filter(folders::user_uuid.eq(user_uuid))
                .select(folders_ciphers::all_columns)
-                .load::<(CipherId, FolderId)>(conn)
+                .load::<(String, String)>(conn)
                .unwrap_or_default()
        }}
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct FolderId(String);
--- a/src/db/models/group.rs
+++ b/src/db/models/group.rs
@@ -1,20 +1,17 @@
-use super::{CollectionId, Membership, MembershipId, OrganizationId, User, UserId};
+use super::{User, UserOrgType, UserOrganization};
 use crate::api::EmptyResult;
 use crate::db::DbConn;
 use crate::error::MapResult;
 use chrono::{NaiveDateTime, Utc};
-use derive_more::{AsRef, Deref, Display, From};
-use macros::UuidFromParam;
 use serde_json::Value;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = groups)]
-    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct Group {
-        pub uuid: GroupId,
-        pub organizations_uuid: OrganizationId,
+        pub uuid: String,
+        pub organizations_uuid: String,
        pub name: String,
        pub access_all: bool,
        pub external_id: Option<String>,
@@ -26,34 +23,28 @@ db_object! {
    #[diesel(table_name = collections_groups)]
    #[diesel(primary_key(collections_uuid, groups_uuid))]
    pub struct CollectionGroup {
-        pub collections_uuid: CollectionId,
-        pub groups_uuid: GroupId,
+        pub collections_uuid: String,
+        pub groups_uuid: String,
        pub read_only: bool,
        pub hide_passwords: bool,
-        pub manage: bool,
    }

    #[derive(Identifiable, Queryable, Insertable)]
    #[diesel(table_name = groups_users)]
    #[diesel(primary_key(groups_uuid, users_organizations_uuid))]
    pub struct GroupUser {
-        pub groups_uuid: GroupId,
-        pub users_organizations_uuid: MembershipId
+        pub groups_uuid: String,
+        pub users_organizations_uuid: String
    }
 }

 /// Local methods
 impl Group {
-    pub fn new(
-        organizations_uuid: OrganizationId,
-        name: String,
-        access_all: bool,
-        external_id: Option<String>,
-    ) -> Self {
+    pub fn new(organizations_uuid: String, name: String, access_all: bool, external_id: Option<String>) -> Self {
        let now = Utc::now().naive_utc();

        let mut new_model = Self {
-            uuid: GroupId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            organizations_uuid,
            name,
            access_all,
@@ -68,19 +59,21 @@ impl Group {
    }

    pub fn to_json(&self) -> Value {
+        use crate::util::format_date;
+
        json!({
            "id": self.uuid,
            "organizationId": self.organizations_uuid,
            "name": self.name,
+            "accessAll": self.access_all,
            "externalId": self.external_id,
+            "creationDate": format_date(&self.creation_date),
+            "revisionDate": format_date(&self.revision_date),
            "object": "group"
        })
    }

-    pub async fn to_json_details(&self, conn: &mut DbConn) -> Value {
-        // If both read_only and hide_passwords are false, then manage should be true
-        // You can't have an entry with read_only and manage, or hide_passwords and manage
-        // Or an entry with everything to false
+    pub async fn to_json_details(&self, user_org_type: &i32, conn: &mut DbConn) -> Value {
        let collections_groups: Vec<Value> = CollectionGroup::find_by_group(&self.uuid, conn)
            .await
            .iter()
@@ -89,7 +82,7 @@ impl Group {
                    "id": entry.collections_uuid,
                    "readOnly": entry.read_only,
                    "hidePasswords": entry.hide_passwords,
-                    "manage": entry.manage,
+                    "manage": *user_org_type >= UserOrgType::Admin || (*user_org_type == UserOrgType::Manager && !entry.read_only && !entry.hide_passwords)
                })
            })
            .collect();
@@ -115,38 +108,18 @@ impl Group {
 }

 impl CollectionGroup {
-    pub fn new(
-        collections_uuid: CollectionId,
-        groups_uuid: GroupId,
-        read_only: bool,
-        hide_passwords: bool,
-        manage: bool,
-    ) -> Self {
+    pub fn new(collections_uuid: String, groups_uuid: String, read_only: bool, hide_passwords: bool) -> Self {
        Self {
            collections_uuid,
            groups_uuid,
            read_only,
            hide_passwords,
-            manage,
        }
    }
-
-    pub fn to_json_details_for_group(&self) -> Value {
-        // If both read_only and hide_passwords are false, then manage should be true
-        // You can't have an entry with read_only and manage, or hide_passwords and manage
-        // Or an entry with everything to false
-        // For backwards compaibility and migration proposes we keep checking read_only and hide_password
-        json!({
-            "id": self.groups_uuid,
-            "readOnly": self.read_only,
-            "hidePasswords": self.hide_passwords,
-            "manage": self.manage || (!self.read_only && !self.hide_passwords),
-        })
-    }
 }

 impl GroupUser {
-    pub fn new(groups_uuid: GroupId, users_organizations_uuid: MembershipId) -> Self {
+    pub fn new(groups_uuid: String, users_organizations_uuid: String) -> Self {
        Self {
            groups_uuid,
            users_organizations_uuid,
@@ -190,27 +163,27 @@ impl Group {
        }
    }

-    pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_organization(org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for group in Self::find_by_organization(org_uuid, conn).await {
            group.delete(conn).await?;
        }
        Ok(())
    }

-    pub async fn find_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_organization(organizations_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            groups::table
-                .filter(groups::organizations_uuid.eq(org_uuid))
+                .filter(groups::organizations_uuid.eq(organizations_uuid))
                .load::<GroupDb>(conn)
                .expect("Error loading groups")
                .from_db()
        }}
    }

-    pub async fn count_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> i64 {
+    pub async fn count_by_org(organizations_uuid: &str, conn: &mut DbConn) -> i64 {
        db_run! { conn: {
            groups::table
-                .filter(groups::organizations_uuid.eq(org_uuid))
+                .filter(groups::organizations_uuid.eq(organizations_uuid))
                .count()
                .first::<i64>(conn)
                .ok()
@@ -218,22 +191,17 @@ impl Group {
        }}
    }

-    pub async fn find_by_uuid_and_org(uuid: &GroupId, org_uuid: &OrganizationId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            groups::table
                .filter(groups::uuid.eq(uuid))
-                .filter(groups::organizations_uuid.eq(org_uuid))
                .first::<GroupDb>(conn)
                .ok()
                .from_db()
        }}
    }

-    pub async fn find_by_external_id_and_org(
-        external_id: &str,
-        org_uuid: &OrganizationId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_external_id_and_org(external_id: &str, org_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            groups::table
                .filter(groups::external_id.eq(external_id))
@@ -244,7 +212,7 @@ impl Group {
        }}
    }
    //Returns all organizations the user has full access to
-    pub async fn get_orgs_by_user_with_full_access(user_uuid: &UserId, conn: &mut DbConn) -> Vec<OrganizationId> {
+    pub async fn gather_user_organizations_full_access(user_uuid: &str, conn: &mut DbConn) -> Vec<String> {
        db_run! { conn: {
            groups_users::table
                .inner_join(users_organizations::table.on(
@@ -257,12 +225,12 @@ impl Group {
                .filter(groups::access_all.eq(true))
                .select(groups::organizations_uuid)
                .distinct()
-                .load::<OrganizationId>(conn)
+                .load::<String>(conn)
                .expect("Error loading organization group full access information for user")
        }}
    }

-    pub async fn is_in_full_access_group(user_uuid: &UserId, org_uuid: &OrganizationId, conn: &mut DbConn) -> bool {
+    pub async fn is_in_full_access_group(user_uuid: &str, org_uuid: &str, conn: &mut DbConn) -> bool {
        db_run! { conn: {
            groups::table
                .inner_join(groups_users::table.on(
@@ -291,13 +259,13 @@ impl Group {
        }}
    }

-    pub async fn update_revision(uuid: &GroupId, conn: &mut DbConn) {
+    pub async fn update_revision(uuid: &str, conn: &mut DbConn) {
        if let Err(e) = Self::_update_revision(uuid, &Utc::now().naive_utc(), conn).await {
-            warn!("Failed to update revision for {uuid}: {e:#?}");
+            warn!("Failed to update revision for {}: {:#?}", uuid, e);
        }
    }

-    async fn _update_revision(uuid: &GroupId, date: &NaiveDateTime, conn: &mut DbConn) -> EmptyResult {
+    async fn _update_revision(uuid: &str, date: &NaiveDateTime, conn: &mut DbConn) -> EmptyResult {
        db_run! {conn: {
            crate::util::retry(|| {
                diesel::update(groups::table.filter(groups::uuid.eq(uuid)))
@@ -324,7 +292,6 @@ impl CollectionGroup {
                        collections_groups::groups_uuid.eq(&self.groups_uuid),
                        collections_groups::read_only.eq(&self.read_only),
                        collections_groups::hide_passwords.eq(&self.hide_passwords),
-                        collections_groups::manage.eq(&self.manage),
                    ))
                    .execute(conn)
                {
@@ -339,7 +306,6 @@ impl CollectionGroup {
                                collections_groups::groups_uuid.eq(&self.groups_uuid),
                                collections_groups::read_only.eq(&self.read_only),
                                collections_groups::hide_passwords.eq(&self.hide_passwords),
-                                collections_groups::manage.eq(&self.manage),
                            ))
                            .execute(conn)
                            .map_res("Error adding group to collection")
@@ -354,14 +320,12 @@ impl CollectionGroup {
                        collections_groups::groups_uuid.eq(&self.groups_uuid),
                        collections_groups::read_only.eq(self.read_only),
                        collections_groups::hide_passwords.eq(self.hide_passwords),
-                        collections_groups::manage.eq(self.manage),
                    ))
                    .on_conflict((collections_groups::collections_uuid, collections_groups::groups_uuid))
                    .do_update()
                    .set((
                        collections_groups::read_only.eq(self.read_only),
                        collections_groups::hide_passwords.eq(self.hide_passwords),
-                        collections_groups::manage.eq(self.manage),
                    ))
                    .execute(conn)
                    .map_res("Error adding group to collection")
@@ -369,7 +333,7 @@ impl CollectionGroup {
        }
    }

-    pub async fn find_by_group(group_uuid: &GroupId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_group(group_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            collections_groups::table
                .filter(collections_groups::groups_uuid.eq(group_uuid))
@@ -379,7 +343,7 @@ impl CollectionGroup {
        }}
    }

-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            collections_groups::table
                .inner_join(groups_users::table.on(
@@ -396,7 +360,7 @@ impl CollectionGroup {
        }}
    }

-    pub async fn find_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_collection(collection_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            collections_groups::table
                .filter(collections_groups::collections_uuid.eq(collection_uuid))
@@ -422,7 +386,7 @@ impl CollectionGroup {
        }}
    }

-    pub async fn delete_all_by_group(group_uuid: &GroupId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_group(group_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let group_users = GroupUser::find_by_group(group_uuid, conn).await;
        for group_user in group_users {
            group_user.update_user_revision(conn).await;
@@ -436,7 +400,7 @@ impl CollectionGroup {
        }}
    }

-    pub async fn delete_all_by_collection(collection_uuid: &CollectionId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_collection(collection_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let collection_assigned_to_groups = CollectionGroup::find_by_collection(collection_uuid, conn).await;
        for collection_assigned_to_group in collection_assigned_to_groups {
            let group_users = GroupUser::find_by_group(&collection_assigned_to_group.groups_uuid, conn).await;
@@ -501,7 +465,7 @@ impl GroupUser {
        }
    }

-    pub async fn find_by_group(group_uuid: &GroupId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_group(group_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            groups_users::table
                .filter(groups_users::groups_uuid.eq(group_uuid))
@@ -511,10 +475,10 @@ impl GroupUser {
        }}
    }

-    pub async fn find_by_member(member_uuid: &MembershipId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(users_organizations_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            groups_users::table
-                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
+                .filter(groups_users::users_organizations_uuid.eq(users_organizations_uuid))
                .load::<GroupUserDb>(conn)
                .expect("Error loading groups for user")
                .from_db()
@@ -522,8 +486,8 @@ impl GroupUser {
    }

    pub async fn has_access_to_collection_by_member(
-        collection_uuid: &CollectionId,
-        member_uuid: &MembershipId,
+        collection_uuid: &str,
+        member_uuid: &str,
        conn: &mut DbConn,
    ) -> bool {
        db_run! { conn: {
@@ -539,11 +503,7 @@ impl GroupUser {
        }}
    }

-    pub async fn has_full_access_by_member(
-        org_uuid: &OrganizationId,
-        member_uuid: &MembershipId,
-        conn: &mut DbConn,
-    ) -> bool {
+    pub async fn has_full_access_by_member(org_uuid: &str, member_uuid: &str, conn: &mut DbConn) -> bool {
        db_run! { conn: {
            groups_users::table
                .inner_join(groups::table.on(
@@ -559,32 +519,32 @@ impl GroupUser {
    }

    pub async fn update_user_revision(&self, conn: &mut DbConn) {
-        match Membership::find_by_uuid(&self.users_organizations_uuid, conn).await {
-            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
-            None => warn!("Member could not be found!"),
+        match UserOrganization::find_by_uuid(&self.users_organizations_uuid, conn).await {
+            Some(user) => User::update_uuid_revision(&user.user_uuid, conn).await,
+            None => warn!("User could not be found!"),
        }
    }

-    pub async fn delete_by_group_and_member(
-        group_uuid: &GroupId,
-        member_uuid: &MembershipId,
+    pub async fn delete_by_group_id_and_user_id(
+        group_uuid: &str,
+        users_organizations_uuid: &str,
        conn: &mut DbConn,
    ) -> EmptyResult {
-        match Membership::find_by_uuid(member_uuid, conn).await {
-            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
-            None => warn!("Member could not be found!"),
+        match UserOrganization::find_by_uuid(users_organizations_uuid, conn).await {
+            Some(user) => User::update_uuid_revision(&user.user_uuid, conn).await,
+            None => warn!("User could not be found!"),
        };

        db_run! { conn: {
            diesel::delete(groups_users::table)
                .filter(groups_users::groups_uuid.eq(group_uuid))
-                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
+                .filter(groups_users::users_organizations_uuid.eq(users_organizations_uuid))
                .execute(conn)
                .map_res("Error deleting group users")
        }}
    }

-    pub async fn delete_all_by_group(group_uuid: &GroupId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_group(group_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        let group_users = GroupUser::find_by_group(group_uuid, conn).await;
        for group_user in group_users {
            group_user.update_user_revision(conn).await;
@@ -598,35 +558,17 @@ impl GroupUser {
        }}
    }

-    pub async fn delete_all_by_member(member_uuid: &MembershipId, conn: &mut DbConn) -> EmptyResult {
-        match Membership::find_by_uuid(member_uuid, conn).await {
-            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
-            None => warn!("Member could not be found!"),
+    pub async fn delete_all_by_user(users_organizations_uuid: &str, conn: &mut DbConn) -> EmptyResult {
+        match UserOrganization::find_by_uuid(users_organizations_uuid, conn).await {
+            Some(user) => User::update_uuid_revision(&user.user_uuid, conn).await,
+            None => warn!("User could not be found!"),
        }

        db_run! { conn: {
            diesel::delete(groups_users::table)
-                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
+                .filter(groups_users::users_organizations_uuid.eq(users_organizations_uuid))
                .execute(conn)
                .map_res("Error deleting user groups")
        }}
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    AsRef,
-    Deref,
-    DieselNewType,
-    Display,
-    From,
-    FromForm,
-    Hash,
-    PartialEq,
-    Eq,
-    Serialize,
-    Deserialize,
-    UuidFromParam,
-)]
-pub struct GroupId(String);
--- a/src/db/models/mod.rs
+++ b/src/db/models/mod.rs
@@ -16,26 +16,20 @@ mod two_factor_duo_context;
 mod two_factor_incomplete;
 mod user;

-pub use self::attachment::{Attachment, AttachmentId};
-pub use self::auth_request::{AuthRequest, AuthRequestId};
-pub use self::cipher::{Cipher, CipherId, RepromptType};
-pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
-pub use self::device::{Device, DeviceId, DeviceType, PushId};
-pub use self::emergency_access::{EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType};
+pub use self::attachment::Attachment;
+pub use self::auth_request::AuthRequest;
+pub use self::cipher::Cipher;
+pub use self::collection::{Collection, CollectionCipher, CollectionUser};
+pub use self::device::{Device, DeviceType};
+pub use self::emergency_access::{EmergencyAccess, EmergencyAccessStatus, EmergencyAccessType};
 pub use self::event::{Event, EventType};
 pub use self::favorite::Favorite;
-pub use self::folder::{Folder, FolderCipher, FolderId};
-pub use self::group::{CollectionGroup, Group, GroupId, GroupUser};
-pub use self::org_policy::{OrgPolicy, OrgPolicyErr, OrgPolicyId, OrgPolicyType};
-pub use self::organization::{
-    Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization, OrganizationApiKey,
-    OrganizationId,
-};
-pub use self::send::{
-    id::{SendFileId, SendId},
-    Send, SendType,
-};
+pub use self::folder::{Folder, FolderCipher};
+pub use self::group::{CollectionGroup, Group, GroupUser};
+pub use self::org_policy::{OrgPolicy, OrgPolicyErr, OrgPolicyType};
+pub use self::organization::{Organization, OrganizationApiKey, UserOrgStatus, UserOrgType, UserOrganization};
+pub use self::send::{Send, SendType};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, User, UserId, UserKdfType, UserStampException};
+pub use self::user::{Invitation, User, UserKdfType, UserStampException};
--- a/src/db/models/org_policy.rs
+++ b/src/db/models/org_policy.rs
@@ -1,4 +1,3 @@
-use derive_more::{AsRef, From};
 use serde::Deserialize;
 use serde_json::Value;

@@ -6,22 +5,22 @@ use crate::api::EmptyResult;
 use crate::db::DbConn;
 use crate::error::MapResult;

-use super::{Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, TwoFactor, UserId};
+use super::{TwoFactor, UserOrgStatus, UserOrgType, UserOrganization};

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = org_policies)]
    #[diesel(primary_key(uuid))]
    pub struct OrgPolicy {
-        pub uuid: OrgPolicyId,
-        pub org_uuid: OrganizationId,
+        pub uuid: String,
+        pub org_uuid: String,
        pub atype: i32,
        pub enabled: bool,
        pub data: String,
    }
 }

-// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/PolicyType.cs
+// https://github.com/bitwarden/server/blob/b86a04cef9f1e1b82cf18e49fc94e017c641130c/src/Core/Enums/PolicyType.cs
 #[derive(Copy, Clone, Eq, PartialEq, num_derive::FromPrimitive)]
 pub enum OrgPolicyType {
    TwoFactorAuthentication = 0,
@@ -35,13 +34,9 @@ pub enum OrgPolicyType {
    ResetPassword = 8,
    // MaximumVaultTimeout = 9, // Not supported (Not AGPLv3 Licensed)
    // DisablePersonalVaultExport = 10, // Not supported (Not AGPLv3 Licensed)
-    // ActivateAutofill = 11,
-    // AutomaticAppLogIn = 12,
-    // FreeFamiliesSponsorshipPolicy = 13,
-    RemoveUnlockWithPin = 14,
 }

-// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs#L5
+// https://github.com/bitwarden/server/blob/5cbdee137921a19b1f722920f0fa3cd45af2ef0f/src/Core/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SendOptionsPolicyData {
@@ -49,7 +44,7 @@ pub struct SendOptionsPolicyData {
    pub disable_hide_email: bool,
 }

-// https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/ResetPasswordDataModel.cs
+// https://github.com/bitwarden/server/blob/5cbdee137921a19b1f722920f0fa3cd45af2ef0f/src/Core/Models/Data/Organizations/Policies/ResetPasswordDataModel.cs
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ResetPasswordDataModel {
@@ -67,9 +62,9 @@ pub enum OrgPolicyErr {

 /// Local methods
 impl OrgPolicy {
-    pub fn new(org_uuid: OrganizationId, atype: OrgPolicyType, data: String) -> Self {
+    pub fn new(org_uuid: String, atype: OrgPolicyType, data: String) -> Self {
        Self {
-            uuid: OrgPolicyId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            org_uuid,
            atype: atype as i32,
            enabled: false,
@@ -83,24 +78,14 @@ impl OrgPolicy {

    pub fn to_json(&self) -> Value {
        let data_json: Value = serde_json::from_str(&self.data).unwrap_or(Value::Null);
-        let mut policy = json!({
+        json!({
            "id": self.uuid,
            "organizationId": self.org_uuid,
            "type": self.atype,
            "data": data_json,
            "enabled": self.enabled,
            "object": "policy",
-        });
-
-        // Upstream adds this key/value
-        // Allow enabling Single Org policy when the organization has claimed domains.
-        // See: (https://github.com/bitwarden/server/pull/5565)
-        // We return the same to prevent possible issues
-        if self.atype == 8i32 {
-            policy["canToggleState"] = json!(true);
-        }
-
-        policy
+        })
    }
 }

@@ -157,7 +142,17 @@ impl OrgPolicy {
        }}
    }

-    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
+        db_run! { conn: {
+            org_policies::table
+                .filter(org_policies::uuid.eq(uuid))
+                .first::<OrgPolicyDb>(conn)
+                .ok()
+                .from_db()
+        }}
+    }
+
+    pub async fn find_by_org(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            org_policies::table
                .filter(org_policies::org_uuid.eq(org_uuid))
@@ -167,7 +162,7 @@ impl OrgPolicy {
        }}
    }

-    pub async fn find_confirmed_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_confirmed_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            org_policies::table
                .inner_join(
@@ -176,7 +171,7 @@ impl OrgPolicy {
                            .and(users_organizations::user_uuid.eq(user_uuid)))
                )
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .select(org_policies::all_columns)
                .load::<OrgPolicyDb>(conn)
@@ -185,11 +180,7 @@ impl OrgPolicy {
        }}
    }

-    pub async fn find_by_org_and_type(
-        org_uuid: &OrganizationId,
-        policy_type: OrgPolicyType,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_org_and_type(org_uuid: &str, policy_type: OrgPolicyType, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            org_policies::table
                .filter(org_policies::org_uuid.eq(org_uuid))
@@ -200,7 +191,7 @@ impl OrgPolicy {
        }}
    }

-    pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_organization(org_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(org_policies::table.filter(org_policies::org_uuid.eq(org_uuid)))
                .execute(conn)
@@ -209,9 +200,9 @@ impl OrgPolicy {
    }

    pub async fn find_accepted_and_confirmed_by_user_and_active_policy(
-        user_uuid: &UserId,
+        user_uuid: &str,
        policy_type: OrgPolicyType,
-        conn: &DbConn,
+        conn: &mut DbConn,
    ) -> Vec<Self> {
        db_run! { conn: {
            org_policies::table
@@ -221,10 +212,10 @@ impl OrgPolicy {
                            .and(users_organizations::user_uuid.eq(user_uuid)))
                )
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Accepted as i32)
+                    users_organizations::status.eq(UserOrgStatus::Accepted as i32)
                )
                .or_filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .filter(org_policies::atype.eq(policy_type as i32))
                .filter(org_policies::enabled.eq(true))
@@ -236,7 +227,7 @@ impl OrgPolicy {
    }

    pub async fn find_confirmed_by_user_and_active_policy(
-        user_uuid: &UserId,
+        user_uuid: &str,
        policy_type: OrgPolicyType,
        conn: &mut DbConn,
    ) -> Vec<Self> {
@@ -248,7 +239,7 @@ impl OrgPolicy {
                            .and(users_organizations::user_uuid.eq(user_uuid)))
                )
                .filter(
-                    users_organizations::status.eq(MembershipStatus::Confirmed as i32)
+                    users_organizations::status.eq(UserOrgStatus::Confirmed as i32)
                )
                .filter(org_policies::atype.eq(policy_type as i32))
                .filter(org_policies::enabled.eq(true))
@@ -263,21 +254,21 @@ impl OrgPolicy {
    /// and the user is not an owner or admin of that org. This is only useful for checking
    /// applicability of policy types that have these particular semantics.
    pub async fn is_applicable_to_user(
-        user_uuid: &UserId,
+        user_uuid: &str,
        policy_type: OrgPolicyType,
-        exclude_org_uuid: Option<&OrganizationId>,
+        exclude_org_uuid: Option<&str>,
        conn: &mut DbConn,
    ) -> bool {
        for policy in
            OrgPolicy::find_accepted_and_confirmed_by_user_and_active_policy(user_uuid, policy_type, conn).await
        {
            // Check if we need to skip this organization.
-            if exclude_org_uuid.is_some() && *exclude_org_uuid.unwrap() == policy.org_uuid {
+            if exclude_org_uuid.is_some() && exclude_org_uuid.unwrap() == policy.org_uuid {
                continue;
            }

-            if let Some(user) = Membership::find_by_user_and_org(user_uuid, &policy.org_uuid, conn).await {
-                if user.atype < MembershipType::Admin {
+            if let Some(user) = UserOrganization::find_by_user_and_org(user_uuid, &policy.org_uuid, conn).await {
+                if user.atype < UserOrgType::Admin {
                    return true;
                }
            }
@@ -286,8 +277,8 @@ impl OrgPolicy {
    }

    pub async fn is_user_allowed(
-        user_uuid: &UserId,
-        org_uuid: &OrganizationId,
+        user_uuid: &str,
+        org_uuid: &str,
        exclude_current_org: bool,
        conn: &mut DbConn,
    ) -> OrgPolicyResult {
@@ -315,7 +306,7 @@ impl OrgPolicy {
        Ok(())
    }

-    pub async fn org_is_reset_password_auto_enroll(org_uuid: &OrganizationId, conn: &mut DbConn) -> bool {
+    pub async fn org_is_reset_password_auto_enroll(org_uuid: &str, conn: &mut DbConn) -> bool {
        match OrgPolicy::find_by_org_and_type(org_uuid, OrgPolicyType::ResetPassword, conn).await {
            Some(policy) => match serde_json::from_str::<ResetPasswordDataModel>(&policy.data) {
                Ok(opts) => {
@@ -331,12 +322,12 @@ impl OrgPolicy {

    /// Returns true if the user belongs to an org that has enabled the `DisableHideEmail`
    /// option of the `Send Options` policy, and the user is not an owner or admin of that org.
-    pub async fn is_hide_email_disabled(user_uuid: &UserId, conn: &mut DbConn) -> bool {
+    pub async fn is_hide_email_disabled(user_uuid: &str, conn: &mut DbConn) -> bool {
        for policy in
            OrgPolicy::find_confirmed_by_user_and_active_policy(user_uuid, OrgPolicyType::SendOptions, conn).await
        {
-            if let Some(user) = Membership::find_by_user_and_org(user_uuid, &policy.org_uuid, conn).await {
-                if user.atype < MembershipType::Admin {
+            if let Some(user) = UserOrganization::find_by_user_and_org(user_uuid, &policy.org_uuid, conn).await {
+                if user.atype < UserOrgType::Admin {
                    match serde_json::from_str::<SendOptionsPolicyData>(&policy.data) {
                        Ok(opts) => {
                            if opts.disable_hide_email {
@@ -351,19 +342,12 @@ impl OrgPolicy {
        false
    }

-    pub async fn is_enabled_for_member(
-        member_uuid: &MembershipId,
-        policy_type: OrgPolicyType,
-        conn: &mut DbConn,
-    ) -> bool {
-        if let Some(member) = Membership::find_by_uuid(member_uuid, conn).await {
-            if let Some(policy) = OrgPolicy::find_by_org_and_type(&member.org_uuid, policy_type, conn).await {
+    pub async fn is_enabled_for_member(org_user_uuid: &str, policy_type: OrgPolicyType, conn: &mut DbConn) -> bool {
+        if let Some(membership) = UserOrganization::find_by_uuid(org_user_uuid, conn).await {
+            if let Some(policy) = OrgPolicy::find_by_org_and_type(&membership.org_uuid, policy_type, conn).await {
                return policy.enabled;
            }
        }
        false
    }
 }
-
-#[derive(Clone, Debug, AsRef, DieselNewType, From, FromForm, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct OrgPolicyId(String);
--- a/src/db/models/organization.rs
+++ b/src/db/models/organization.rs
--- a/src/db/models/send.rs
+++ b/src/db/models/send.rs
@@ -1,10 +1,9 @@
 use chrono::{NaiveDateTime, Utc};
 use serde_json::Value;

-use crate::{config::PathType, util::LowerCase, CONFIG};
+use crate::util::LowerCase;

-use super::{OrganizationId, User, UserId};
-use id::SendId;
+use super::User;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -12,10 +11,11 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct Send {
-        pub uuid: SendId,
+        pub uuid: String,
+
+        pub user_uuid: Option<String>,
+        pub organization_uuid: Option<String>,

-        pub user_uuid: Option<UserId>,
-        pub organization_uuid: Option<OrganizationId>,

        pub name: String,
        pub notes: Option<String>,
@@ -51,7 +51,7 @@ impl Send {
        let now = Utc::now().naive_utc();

        Self {
-            uuid: SendId::from(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            user_uuid: None,
            organization_uuid: None,

@@ -226,8 +226,7 @@ impl Send {
        self.update_users_revision(conn).await;

        if self.atype == SendType::File as i32 {
-            let operator = CONFIG.opendal_operator_for_path_type(PathType::Sends)?;
-            operator.remove_all(&self.uuid).await.ok();
+            std::fs::remove_dir_all(std::path::Path::new(&crate::CONFIG.sends_folder()).join(&self.uuid)).ok();
        }

        db_run! { conn: {
@@ -244,7 +243,7 @@ impl Send {
        }
    }

-    pub async fn update_users_revision(&self, conn: &mut DbConn) -> Vec<UserId> {
+    pub async fn update_users_revision(&self, conn: &mut DbConn) -> Vec<String> {
        let mut user_uuids = Vec::new();
        match &self.user_uuid {
            Some(user_uuid) => {
@@ -258,7 +257,7 @@ impl Send {
        user_uuids
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        for send in Self::find_by_user(user_uuid, conn).await {
            send.delete(conn).await?;
        }
@@ -269,19 +268,20 @@ impl Send {
        use data_encoding::BASE64URL_NOPAD;
        use uuid::Uuid;

-        let Ok(uuid_vec) = BASE64URL_NOPAD.decode(access_id.as_bytes()) else {
-            return None;
+        let uuid_vec = match BASE64URL_NOPAD.decode(access_id.as_bytes()) {
+            Ok(v) => v,
+            Err(_) => return None,
        };

        let uuid = match Uuid::from_slice(&uuid_vec) {
-            Ok(u) => SendId::from(u.to_string()),
+            Ok(u) => u.to_string(),
            Err(_) => return None,
        };

        Self::find_by_uuid(&uuid, conn).await
    }

-    pub async fn find_by_uuid(uuid: &SendId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            sends::table
                .filter(sends::uuid.eq(uuid))
@@ -291,18 +291,7 @@ impl Send {
        }}
    }

-    pub async fn find_by_uuid_and_user(uuid: &SendId, user_uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
-        db_run! {conn: {
-            sends::table
-                .filter(sends::uuid.eq(uuid))
-                .filter(sends::user_uuid.eq(user_uuid))
-                .first::<SendDb>(conn)
-                .ok()
-                .from_db()
-        }}
-    }
-
-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            sends::table
                .filter(sends::user_uuid.eq(user_uuid))
@@ -310,7 +299,7 @@ impl Send {
        }}
    }

-    pub async fn size_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Option<i64> {
+    pub async fn size_by_user(user_uuid: &str, conn: &mut DbConn) -> Option<i64> {
        let sends = Self::find_by_user(user_uuid, conn).await;

        #[derive(serde::Deserialize)]
@@ -333,7 +322,7 @@ impl Send {
        Some(total)
    }

-    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_org(org_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! {conn: {
            sends::table
                .filter(sends::organization_uuid.eq(org_uuid))
@@ -350,48 +339,3 @@ impl Send {
        }}
    }
 }
-
-// separate namespace to avoid name collision with std::marker::Send
-pub mod id {
-    use derive_more::{AsRef, Deref, Display, From};
-    use macros::{IdFromParam, UuidFromParam};
-    use std::marker::Send;
-    use std::path::Path;
-
-    #[derive(
-        Clone,
-        Debug,
-        AsRef,
-        Deref,
-        DieselNewType,
-        Display,
-        From,
-        FromForm,
-        Hash,
-        PartialEq,
-        Eq,
-        Serialize,
-        Deserialize,
-        UuidFromParam,
-    )]
-    pub struct SendId(String);
-
-    impl AsRef<Path> for SendId {
-        #[inline]
-        fn as_ref(&self) -> &Path {
-            Path::new(&self.0)
-        }
-    }
-
-    #[derive(
-        Clone, Debug, AsRef, Deref, Display, From, FromForm, Hash, PartialEq, Eq, Serialize, Deserialize, IdFromParam,
-    )]
-    pub struct SendFileId(String);
-
-    impl AsRef<Path> for SendFileId {
-        #[inline]
-        fn as_ref(&self) -> &Path {
-            Path::new(&self.0)
-        }
-    }
-}
--- a/src/db/models/two_factor.rs
+++ b/src/db/models/two_factor.rs
@@ -1,6 +1,5 @@
 use serde_json::Value;

-use super::UserId;
 use crate::{api::EmptyResult, db::DbConn, error::MapResult};

 db_object! {
@@ -8,8 +7,8 @@ db_object! {
    #[diesel(table_name = twofactor)]
    #[diesel(primary_key(uuid))]
    pub struct TwoFactor {
-        pub uuid: TwoFactorId,
-        pub user_uuid: UserId,
+        pub uuid: String,
+        pub user_uuid: String,
        pub atype: i32,
        pub enabled: bool,
        pub data: String,
@@ -42,9 +41,9 @@ pub enum TwoFactorType {

 /// Local methods
 impl TwoFactor {
-    pub fn new(user_uuid: UserId, atype: TwoFactorType, data: String) -> Self {
+    pub fn new(user_uuid: String, atype: TwoFactorType, data: String) -> Self {
        Self {
-            uuid: TwoFactorId(crate::util::get_uuid()),
+            uuid: crate::util::get_uuid(),
            user_uuid,
            atype: atype as i32,
            enabled: true,
@@ -119,7 +118,7 @@ impl TwoFactor {
        }}
    }

-    pub async fn find_by_user(user_uuid: &UserId, conn: &mut DbConn) -> Vec<Self> {
+    pub async fn find_by_user(user_uuid: &str, conn: &mut DbConn) -> Vec<Self> {
        db_run! { conn: {
            twofactor::table
                .filter(twofactor::user_uuid.eq(user_uuid))
@@ -130,7 +129,7 @@ impl TwoFactor {
        }}
    }

-    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: i32, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_user_and_type(user_uuid: &str, atype: i32, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            twofactor::table
                .filter(twofactor::user_uuid.eq(user_uuid))
@@ -141,7 +140,7 @@ impl TwoFactor {
        }}
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(twofactor::table.filter(twofactor::user_uuid.eq(user_uuid)))
                .execute(conn)
@@ -218,6 +217,3 @@ impl TwoFactor {
        Ok(())
    }
 }
-
-#[derive(Clone, Debug, DieselNewType, FromForm, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct TwoFactorId(String);
--- a/src/db/models/two_factor_incomplete.rs
+++ b/src/db/models/two_factor_incomplete.rs
@@ -1,26 +1,17 @@
 use chrono::{NaiveDateTime, Utc};

-use crate::{
-    api::EmptyResult,
-    auth::ClientIp,
-    db::{
-        models::{DeviceId, UserId},
-        DbConn,
-    },
-    error::MapResult,
-    CONFIG,
-};
+use crate::{api::EmptyResult, auth::ClientIp, db::DbConn, error::MapResult, CONFIG};

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
    #[diesel(table_name = twofactor_incomplete)]
    #[diesel(primary_key(user_uuid, device_uuid))]
    pub struct TwoFactorIncomplete {
-        pub user_uuid: UserId,
+        pub user_uuid: String,
        // This device UUID is simply what's claimed by the device. It doesn't
        // necessarily correspond to any UUID in the devices table, since a device
        // must complete 2FA login before being added into the devices table.
-        pub device_uuid: DeviceId,
+        pub device_uuid: String,
        pub device_name: String,
        pub device_type: i32,
        pub login_time: NaiveDateTime,
@@ -30,8 +21,8 @@ db_object! {

 impl TwoFactorIncomplete {
    pub async fn mark_incomplete(
-        user_uuid: &UserId,
-        device_uuid: &DeviceId,
+        user_uuid: &str,
+        device_uuid: &str,
        device_name: &str,
        device_type: i32,
        ip: &ClientIp,
@@ -64,7 +55,7 @@ impl TwoFactorIncomplete {
        }}
    }

-    pub async fn mark_complete(user_uuid: &UserId, device_uuid: &DeviceId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn mark_complete(user_uuid: &str, device_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
            return Ok(());
        }
@@ -72,11 +63,7 @@ impl TwoFactorIncomplete {
        Self::delete_by_user_and_device(user_uuid, device_uuid, conn).await
    }

-    pub async fn find_by_user_and_device(
-        user_uuid: &UserId,
-        device_uuid: &DeviceId,
-        conn: &mut DbConn,
-    ) -> Option<Self> {
+    pub async fn find_by_user_and_device(user_uuid: &str, device_uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! { conn: {
            twofactor_incomplete::table
                .filter(twofactor_incomplete::user_uuid.eq(user_uuid))
@@ -101,11 +88,7 @@ impl TwoFactorIncomplete {
        Self::delete_by_user_and_device(&self.user_uuid, &self.device_uuid, conn).await
    }

-    pub async fn delete_by_user_and_device(
-        user_uuid: &UserId,
-        device_uuid: &DeviceId,
-        conn: &mut DbConn,
-    ) -> EmptyResult {
+    pub async fn delete_by_user_and_device(user_uuid: &str, device_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(twofactor_incomplete::table
                           .filter(twofactor_incomplete::user_uuid.eq(user_uuid))
@@ -115,7 +98,7 @@ impl TwoFactorIncomplete {
        }}
    }

-    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &mut DbConn) -> EmptyResult {
+    pub async fn delete_all_by_user(user_uuid: &str, conn: &mut DbConn) -> EmptyResult {
        db_run! { conn: {
            diesel::delete(twofactor_incomplete::table.filter(twofactor_incomplete::user_uuid.eq(user_uuid)))
                .execute(conn)
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -1,19 +1,9 @@
+use crate::util::{format_date, get_uuid, retry};
 use chrono::{NaiveDateTime, TimeDelta, Utc};
-use derive_more::{AsRef, Deref, Display, From};
 use serde_json::Value;

-use super::{
-    Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor, TwoFactorIncomplete,
-};
-use crate::{
-    api::EmptyResult,
-    crypto,
-    db::DbConn,
-    error::MapResult,
-    util::{format_date, get_uuid, retry},
-    CONFIG,
-};
-use macros::UuidFromParam;
+use crate::crypto;
+use crate::CONFIG;

 db_object! {
    #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -21,7 +11,7 @@ db_object! {
    #[diesel(treat_none_as_null = true)]
    #[diesel(primary_key(uuid))]
    pub struct User {
-        pub uuid: UserId,
+        pub uuid: String,
        pub enabled: bool,
        pub created_at: NaiveDateTime,
        pub updated_at: NaiveDateTime,
@@ -101,7 +91,7 @@ impl User {
        let email = email.to_lowercase();

        Self {
-            uuid: UserId(get_uuid()),
+            uuid: get_uuid(),
            enabled: true,
            created_at: now,
            updated_at: now,
@@ -173,8 +163,8 @@ impl User {
    /// * `password` - A str which contains a hashed version of the users master password.
    /// * `new_key` - A String  which contains the new aKey value of the users master password.
    /// * `allow_next_route` - A Option<Vec<String>> with the function names of the next allowed (rocket) routes.
-    ///   These routes are able to use the previous stamp id for the next 2 minutes.
-    ///   After these 2 minutes this stamp will expire.
+    ///                       These routes are able to use the previous stamp id for the next 2 minutes.
+    ///                       After these 2 minutes this stamp will expire.
    ///
    pub fn set_password(
        &mut self,
@@ -206,8 +196,8 @@ impl User {
    ///
    /// # Arguments
    /// * `route_exception` - A Vec<String> with the function names of the next allowed (rocket) routes.
-    ///   These routes are able to use the previous stamp id for the next 2 minutes.
-    ///   After these 2 minutes this stamp will expire.
+    ///                       These routes are able to use the previous stamp id for the next 2 minutes.
+    ///                       After these 2 minutes this stamp will expire.
    ///
    pub fn set_stamp_exception(&mut self, route_exception: Vec<String>) {
        let stamp_exception = UserStampException {
@@ -224,11 +214,20 @@ impl User {
    }
 }

+use super::{
+    Cipher, Device, EmergencyAccess, Favorite, Folder, Send, TwoFactor, TwoFactorIncomplete, UserOrgType,
+    UserOrganization,
+};
+use crate::db::DbConn;
+
+use crate::api::EmptyResult;
+use crate::error::MapResult;
+
 /// Database methods
 impl User {
    pub async fn to_json(&self, conn: &mut DbConn) -> Value {
        let mut orgs_json = Vec::new();
-        for c in Membership::find_confirmed_by_user(&self.uuid, conn).await {
+        for c in UserOrganization::find_confirmed_by_user(&self.uuid, conn).await {
            orgs_json.push(c.to_json(conn).await);
        }

@@ -249,6 +248,7 @@ impl User {
            "emailVerified": !CONFIG.mail_enabled() || self.verified_at.is_some(),
            "premium": true,
            "premiumFromOrganization": false,
+            "masterPasswordHint": self.password_hint,
            "culture": "en-US",
            "twoFactorEnabled": twofactor_enabled,
            "key": self.akey,
@@ -266,8 +266,8 @@ impl User {
    }

    pub async fn save(&mut self, conn: &mut DbConn) -> EmptyResult {
-        if !crate::util::is_valid_email(&self.email) {
-            err!(format!("User email {} is not a valid email address", self.email))
+        if self.email.trim().is_empty() {
+            err!("User email can't be empty")
        }

        self.updated_at = Utc::now().naive_utc();
@@ -304,18 +304,19 @@ impl User {
    }

    pub async fn delete(self, conn: &mut DbConn) -> EmptyResult {
-        for member in Membership::find_confirmed_by_user(&self.uuid, conn).await {
-            if member.atype == MembershipType::Owner
-                && Membership::count_confirmed_by_org_and_type(&member.org_uuid, MembershipType::Owner, conn).await <= 1
+        for user_org in UserOrganization::find_confirmed_by_user(&self.uuid, conn).await {
+            if user_org.atype == UserOrgType::Owner
+                && UserOrganization::count_confirmed_by_org_and_type(&user_org.org_uuid, UserOrgType::Owner, conn).await
+                    <= 1
            {
                err!("Can't delete last owner")
            }
        }

-        super::Send::delete_all_by_user(&self.uuid, conn).await?;
+        Send::delete_all_by_user(&self.uuid, conn).await?;
        EmergencyAccess::delete_all_by_user(&self.uuid, conn).await?;
        EmergencyAccess::delete_all_by_grantee_email(&self.email, conn).await?;
-        Membership::delete_all_by_user(&self.uuid, conn).await?;
+        UserOrganization::delete_all_by_user(&self.uuid, conn).await?;
        Cipher::delete_all_by_user(&self.uuid, conn).await?;
        Favorite::delete_all_by_user(&self.uuid, conn).await?;
        Folder::delete_all_by_user(&self.uuid, conn).await?;
@@ -331,9 +332,9 @@ impl User {
        }}
    }

-    pub async fn update_uuid_revision(uuid: &UserId, conn: &mut DbConn) {
+    pub async fn update_uuid_revision(uuid: &str, conn: &mut DbConn) {
        if let Err(e) = Self::_update_revision(uuid, &Utc::now().naive_utc(), conn).await {
-            warn!("Failed to update revision for {uuid}: {e:#?}");
+            warn!("Failed to update revision for {}: {:#?}", uuid, e);
        }
    }

@@ -356,7 +357,7 @@ impl User {
        Self::_update_revision(&self.uuid, &self.updated_at, conn).await
    }

-    async fn _update_revision(uuid: &UserId, date: &NaiveDateTime, conn: &mut DbConn) -> EmptyResult {
+    async fn _update_revision(uuid: &str, date: &NaiveDateTime, conn: &mut DbConn) -> EmptyResult {
        db_run! {conn: {
            retry(|| {
                diesel::update(users::table.filter(users::uuid.eq(uuid)))
@@ -378,7 +379,7 @@ impl User {
        }}
    }

-    pub async fn find_by_uuid(uuid: &UserId, conn: &mut DbConn) -> Option<Self> {
+    pub async fn find_by_uuid(uuid: &str, conn: &mut DbConn) -> Option<Self> {
        db_run! {conn: {
            users::table.filter(users::uuid.eq(uuid)).first::<UserDb>(conn).ok().from_db()
        }}
@@ -407,8 +408,8 @@ impl Invitation {
    }

    pub async fn save(&self, conn: &mut DbConn) -> EmptyResult {
-        if !crate::util::is_valid_email(&self.email) {
-            err!(format!("Invitation email {} is not a valid email address", self.email))
+        if self.email.trim().is_empty() {
+            err!("Invitation email can't be empty")
        }

        db_run! {conn:
@@ -457,23 +458,3 @@ impl Invitation {
        }
    }
 }
-
-#[derive(
-    Clone,
-    Debug,
-    DieselNewType,
-    FromForm,
-    PartialEq,
-    Eq,
-    Hash,
-    Serialize,
-    Deserialize,
-    AsRef,
-    Deref,
-    Display,
-    From,
-    UuidFromParam,
-)]
-#[deref(forward)]
-#[from(forward)]
-pub struct UserId(String);
--- a/src/db/schemas/mysql/schema.rs
+++ b/src/db/schemas/mysql/schema.rs
@@ -226,7 +226,6 @@ table! {
        collection_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

@@ -296,7 +295,6 @@ table! {
        groups_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

--- a/src/db/schemas/postgresql/schema.rs
+++ b/src/db/schemas/postgresql/schema.rs
@@ -226,7 +226,6 @@ table! {
        collection_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

@@ -296,7 +295,6 @@ table! {
        groups_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

--- a/src/db/schemas/sqlite/schema.rs
+++ b/src/db/schemas/sqlite/schema.rs
@@ -226,7 +226,6 @@ table! {
        collection_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

@@ -296,7 +295,6 @@ table! {
        groups_uuid -> Text,
        read_only -> Bool,
        hide_passwords -> Bool,
-        manage -> Bool,
    }
 }

--- a/src/error.rs
+++ b/src/error.rs
@@ -46,7 +46,6 @@ use jsonwebtoken::errors::Error as JwtErr;
 use lettre::address::AddressError as AddrErr;
 use lettre::error::Error as LettreErr;
 use lettre::transport::smtp::Error as SmtpErr;
-use opendal::Error as OpenDALErr;
 use openssl::error::ErrorStack as SSLErr;
 use regex::Error as RegexErr;
 use reqwest::Error as ReqErr;
@@ -60,8 +59,6 @@ use yubico::yubicoerror::YubicoError as YubiErr;
 #[derive(Serialize)]
 pub struct Empty {}

-pub struct Compact {}
-
 // Error struct
 // Contains a String error message, meant for the user and an enum variant, with an error of different types.
 //
@@ -72,7 +69,6 @@ make_error! {
    Empty(Empty):     _no_source, _serialize,
    // Used to represent err! calls
    Simple(String):  _no_source,  _api_error,
-    Compact(Compact):  _no_source,  _api_error_small,

    // Used in our custom http client to handle non-global IPs and blocked domains
    CustomHttpClient(CustomHttpClientError): _has_source, _api_error,
@@ -99,8 +95,6 @@ make_error! {

    DieselCon(DieselConErr): _has_source, _api_error,
    Webauthn(WebauthnErr):   _has_source, _api_error,
-
-    OpenDAL(OpenDALErr): _has_source, _api_error,
 }

 impl std::fmt::Debug for Error {
@@ -138,12 +132,6 @@ impl Error {
        self
    }

-    #[must_use]
-    pub fn with_kind(mut self, kind: ErrorKind) -> Self {
-        self.error = kind;
-        self
-    }
-
    #[must_use]
    pub const fn with_code(mut self, code: u16) -> Self {
        self.error_code = code;
@@ -212,18 +200,6 @@ fn _api_error(_: &impl std::any::Any, msg: &str) -> String {
    _serialize(&json, "")
 }

-fn _api_error_small(_: &impl std::any::Any, msg: &str) -> String {
-    let json = json!({
-        "message": msg,
-        "validationErrors": null,
-        "exceptionMessage": null,
-        "exceptionStackTrace": null,
-        "innerExceptionMessage": null,
-        "object": "error"
-    });
-    _serialize(&json, "")
-}
-
 //
 // Rocket responder impl
 //
@@ -236,8 +212,9 @@ use rocket::response::{self, Responder, Response};
 impl Responder<'_, 'static> for Error {
    fn respond_to(self, _: &Request<'_>) -> response::Result<'static> {
        match self.error {
-            ErrorKind::Empty(_) | ErrorKind::Simple(_) | ErrorKind::Compact(_) => {} // Don't print the error in this situation
-            _ => error!(target: "error", "{self:#?}"),
+            ErrorKind::Empty(_) => {}  // Don't print the error in this situation
+            ErrorKind::Simple(_) => {} // Don't print the error in this situation
+            _ => error!(target: "error", "{:#?}", self),
        };

        let code = Status::from_code(self.error_code).unwrap_or(Status::BadRequest);
@@ -251,10 +228,6 @@ impl Responder<'_, 'static> for Error {
 //
 #[macro_export]
 macro_rules! err {
-    ($kind:ident, $msg:expr) => {{
-        error!("{}", $msg);
-        return Err($crate::error::Error::new($msg, $msg).with_kind($crate::error::ErrorKind::$kind($crate::error::$kind {})));
-    }};
    ($msg:expr) => {{
        error!("{}", $msg);
        return Err($crate::error::Error::new($msg, $msg));
--- a/src/http_client.rs
+++ b/src/http_client.rs
@@ -6,7 +6,7 @@ use std::{
    time::Duration,
 };

-use hickory_resolver::{name_server::TokioConnectionProvider, TokioResolver};
+use hickory_resolver::{system_conf::read_system_conf, TokioAsyncResolver};
 use once_cell::sync::Lazy;
 use regex::Regex;
 use reqwest::{
@@ -173,7 +173,7 @@ impl std::error::Error for CustomHttpClientError {}
 #[derive(Debug, Clone)]
 enum CustomDnsResolver {
    Default(),
-    Hickory(Arc<TokioResolver>),
+    Hickory(Arc<TokioAsyncResolver>),
 }
 type BoxError = Box<dyn std::error::Error + Send + Sync>;

@@ -184,9 +184,9 @@ impl CustomDnsResolver {
    }

    fn new() -> Arc<Self> {
-        match TokioResolver::builder(TokioConnectionProvider::default()) {
-            Ok(builder) => {
-                let resolver = builder.build();
+        match read_system_conf() {
+            Ok((config, opts)) => {
+                let resolver = TokioAsyncResolver::tokio(config.clone(), opts.clone());
                Arc::new(Self::Hickory(Arc::new(resolver)))
            }
            Err(e) => {
@@ -244,61 +244,3 @@ impl Resolve for CustomDnsResolver {
        })
    }
 }
-
-#[cfg(s3)]
-pub(crate) mod aws {
-    use aws_smithy_runtime_api::client::{
-        http::{HttpClient, HttpConnector, HttpConnectorFuture, HttpConnectorSettings, SharedHttpConnector},
-        orchestrator::HttpResponse,
-        result::ConnectorError,
-        runtime_components::RuntimeComponents,
-    };
-    use reqwest::Client;
-
-    // Adapter that wraps reqwest to be compatible with the AWS SDK
-    #[derive(Debug)]
-    pub(crate) struct AwsReqwestConnector {
-        pub(crate) client: Client,
-    }
-
-    impl HttpConnector for AwsReqwestConnector {
-        fn call(&self, request: aws_smithy_runtime_api::client::orchestrator::HttpRequest) -> HttpConnectorFuture {
-            // Convert the AWS-style request to a reqwest request
-            let client = self.client.clone();
-            let future = async move {
-                let method = reqwest::Method::from_bytes(request.method().as_bytes())
-                    .map_err(|e| ConnectorError::user(Box::new(e)))?;
-                let mut req_builder = client.request(method, request.uri().to_string());
-
-                for (name, value) in request.headers() {
-                    req_builder = req_builder.header(name, value);
-                }
-
-                if let Some(body_bytes) = request.body().bytes() {
-                    req_builder = req_builder.body(body_bytes.to_vec());
-                }
-
-                let response = req_builder.send().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
-
-                let status = response.status().into();
-                let bytes = response.bytes().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
-
-                Ok(HttpResponse::new(status, bytes.into()))
-            };
-
-            HttpConnectorFuture::new(Box::pin(future))
-        }
-    }
-
-    impl HttpClient for AwsReqwestConnector {
-        fn http_connector(
-            &self,
-            _settings: &HttpConnectorSettings,
-            _components: &RuntimeComponents,
-        ) -> SharedHttpConnector {
-            SharedHttpConnector::new(AwsReqwestConnector {
-                client: self.client.clone(),
-            })
-        }
-    }
-}
--- a/src/mail.rs
+++ b/src/mail.rs
@@ -1,6 +1,7 @@
+use std::str::FromStr;
+
 use chrono::NaiveDateTime;
 use percent_encoding::{percent_encode, NON_ALPHANUMERIC};
-use std::{env::consts::EXE_SUFFIX, str::FromStr};

 use lettre::{
    message::{Attachment, Body, Mailbox, Message, MultiPart, SinglePart},
@@ -16,7 +17,7 @@ use crate::{
        encode_jwt, generate_delete_claims, generate_emergency_access_invite_claims, generate_invite_claims,
        generate_verify_email_claims,
    },
-    db::models::{Device, DeviceType, EmergencyAccessId, MembershipId, OrganizationId, User, UserId},
+    db::models::{Device, DeviceType, User},
    error::Error,
    CONFIG,
 };
@@ -25,7 +26,7 @@ fn sendmail_transport() -> AsyncSendmailTransport<Tokio1Executor> {
    if let Some(command) = CONFIG.sendmail_command() {
        AsyncSendmailTransport::new_with_command(command)
    } else {
-        AsyncSendmailTransport::new_with_command(format!("sendmail{EXE_SUFFIX}"))
+        AsyncSendmailTransport::new()
    }
 }

@@ -85,7 +86,7 @@ fn smtp_transport() -> AsyncSmtpTransport<Tokio1Executor> {
                smtp_client.authentication(selected_mechanisms)
            } else {
                // Only show a warning, and return without setting an actual authentication mechanism
-                warn!("No valid SMTP Auth mechanism found for '{mechanism}', using default values");
+                warn!("No valid SMTP Auth mechanism found for '{}', using default values", mechanism);
                smtp_client
            }
        }
@@ -95,31 +96,7 @@ fn smtp_transport() -> AsyncSmtpTransport<Tokio1Executor> {
    smtp_client.build()
 }

-// This will sanitize the string values by stripping all the html tags to prevent XSS and HTML Injections
-fn sanitize_data(data: &mut serde_json::Value) {
-    use regex::Regex;
-    use std::sync::LazyLock;
-    static RE: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"<[^>]+>").unwrap());
-
-    match data {
-        serde_json::Value::String(s) => *s = RE.replace_all(s, "").to_string(),
-        serde_json::Value::Object(obj) => {
-            for d in obj.values_mut() {
-                sanitize_data(d);
-            }
-        }
-        serde_json::Value::Array(arr) => {
-            for d in arr.iter_mut() {
-                sanitize_data(d);
-            }
-        }
-        _ => {}
-    }
-}
-
 fn get_text(template_name: &'static str, data: serde_json::Value) -> Result<(String, String, String), Error> {
-    let mut data = data;
-    sanitize_data(&mut data);
    let (subject_html, body_html) = get_template(&format!("{template_name}.html"), &data)?;
    let (_subject_text, body_text) = get_template(template_name, &data)?;
    Ok((subject_html, body_html, body_text))
@@ -139,10 +116,6 @@ fn get_template(template_name: &str, data: &serde_json::Value) -> Result<(String
        None => err!("Template doesn't contain body"),
    };

-    if text_split.next().is_some() {
-        err!("Template contains more than one body");
-    }
-
    Ok((subject, body))
 }

@@ -165,8 +138,8 @@ pub async fn send_password_hint(address: &str, hint: Option<String>) -> EmptyRes
    send_email(address, &subject, body_html, body_text).await
 }

-pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_delete_claims(user_id.to_string());
+pub async fn send_delete_account(address: &str, uuid: &str) -> EmptyResult {
+    let claims = generate_delete_claims(uuid.to_string());
    let delete_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -174,7 +147,7 @@ pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult
        json!({
            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
-            "user_id": user_id,
+            "user_id": uuid,
            "email": percent_encode(address.as_bytes(), NON_ALPHANUMERIC).to_string(),
            "token": delete_token,
        }),
@@ -183,8 +156,8 @@ pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult
    send_email(address, &subject, body_html, body_text).await
 }

-pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_verify_email_claims(user_id.clone());
+pub async fn send_verify_email(address: &str, uuid: &str) -> EmptyResult {
+    let claims = generate_verify_email_claims(uuid.to_string());
    let verify_email_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -192,7 +165,7 @@ pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {
        json!({
            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
-            "user_id": user_id,
+            "user_id": uuid,
            "email": percent_encode(address.as_bytes(), NON_ALPHANUMERIC).to_string(),
            "token": verify_email_token,
        }),
@@ -201,27 +174,6 @@ pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {
    send_email(address, &subject, body_html, body_text).await
 }

-pub async fn send_register_verify_email(email: &str, token: &str) -> EmptyResult {
-    let mut query = url::Url::parse("https://query.builder").unwrap();
-    query.query_pairs_mut().append_pair("email", email).append_pair("token", token);
-    let query_string = match query.query() {
-        None => err!("Failed to build verify URL query parameters"),
-        Some(query) => query,
-    };
-
-    let (subject, body_html, body_text) = get_text(
-        "email/register_verify_email",
-        json!({
-            // `url.Url` would place the anchor `#` after the query parameters
-            "url": format!("{}/#/finish-signup/?{query_string}", CONFIG.domain()),
-            "img_src": CONFIG._smtp_img_src(),
-            "email": email,
-        }),
-    )?;
-
-    send_email(email, &subject, body_html, body_text).await
-}
-
 pub async fn send_welcome(address: &str) -> EmptyResult {
    let (subject, body_html, body_text) = get_text(
        "email/welcome",
@@ -234,8 +186,8 @@ pub async fn send_welcome(address: &str) -> EmptyResult {
    send_email(address, &subject, body_html, body_text).await
 }

-pub async fn send_welcome_must_verify(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_verify_email_claims(user_id.clone());
+pub async fn send_welcome_must_verify(address: &str, uuid: &str) -> EmptyResult {
+    let claims = generate_verify_email_claims(uuid.to_string());
    let verify_email_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -243,7 +195,7 @@ pub async fn send_welcome_must_verify(address: &str, user_id: &UserId) -> EmptyR
        json!({
            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
-            "user_id": user_id,
+            "user_id": uuid,
            "token": verify_email_token,
        }),
    )?;
@@ -279,8 +231,8 @@ pub async fn send_single_org_removed_from_org(address: &str, org_name: &str) ->

 pub async fn send_invite(
    user: &User,
-    org_id: OrganizationId,
-    member_id: MembershipId,
+    org_id: Option<String>,
+    org_user_id: Option<String>,
    org_name: &str,
    invited_by_email: Option<String>,
 ) -> EmptyResult {
@@ -288,7 +240,7 @@ pub async fn send_invite(
        user.uuid.clone(),
        user.email.clone(),
        org_id.clone(),
-        member_id.clone(),
+        org_user_id.clone(),
        invited_by_email,
    );
    let invite_token = encode_jwt(&claims);
@@ -298,23 +250,25 @@ pub async fn send_invite(
        query_params
            .append_pair("email", &user.email)
            .append_pair("organizationName", org_name)
-            .append_pair("organizationId", &org_id)
-            .append_pair("organizationUserId", &member_id)
+            .append_pair("organizationId", org_id.as_deref().unwrap_or("_"))
+            .append_pair("organizationUserId", org_user_id.as_deref().unwrap_or("_"))
            .append_pair("token", &invite_token);
        if user.private_key.is_some() {
            query_params.append_pair("orgUserHasExistingUser", "true");
        }
    }

-    let Some(query_string) = query.query() else {
-        err!("Failed to build invite URL query parameters")
+    let query_string = match query.query() {
+        None => err!(format!("Failed to build invite URL query parameters")),
+        Some(query) => query,
    };

+    // `url.Url` would place the anchor `#` after the query parameters
+    let url = format!("{}/#/accept-organization/?{}", CONFIG.domain(), query_string);
    let (subject, body_html, body_text) = get_text(
        "email/send_org_invite",
        json!({
-            // `url.Url` would place the anchor `#` after the query parameters
-            "url": format!("{}/#/accept-organization/?{query_string}", CONFIG.domain()),
+            "url": url,
            "img_src": CONFIG._smtp_img_src(),
            "org_name": org_name,
        }),
@@ -325,41 +279,30 @@ pub async fn send_invite(

 pub async fn send_emergency_access_invite(
    address: &str,
-    user_id: UserId,
-    emer_id: EmergencyAccessId,
+    uuid: &str,
+    emer_id: &str,
    grantor_name: &str,
    grantor_email: &str,
 ) -> EmptyResult {
    let claims = generate_emergency_access_invite_claims(
-        user_id,
+        String::from(uuid),
        String::from(address),
-        emer_id.clone(),
+        String::from(emer_id),
        String::from(grantor_name),
        String::from(grantor_email),
    );

-    // Build the query here to ensure proper escaping
-    let mut query = url::Url::parse("https://query.builder").unwrap();
-    {
-        let mut query_params = query.query_pairs_mut();
-        query_params
-            .append_pair("id", &emer_id.to_string())
-            .append_pair("name", grantor_name)
-            .append_pair("email", address)
-            .append_pair("token", &encode_jwt(&claims));
-    }
-
-    let Some(query_string) = query.query() else {
-        err!("Failed to build emergency invite URL query parameters")
-    };
+    let invite_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
        "email/send_emergency_access_invite",
        json!({
-            // `url.Url` would place the anchor `#` after the query parameters
-            "url": format!("{}/#/accept-emergency/?{query_string}", CONFIG.domain()),
+            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
+            "emer_id": emer_id,
+            "email": percent_encode(address.as_bytes(), NON_ALPHANUMERIC).to_string(),
            "grantor_name": grantor_name,
+            "token": invite_token,
        }),
    )?;

@@ -570,20 +513,6 @@ pub async fn send_change_email(address: &str, token: &str) -> EmptyResult {
    send_email(address, &subject, body_html, body_text).await
 }

-pub async fn send_change_email_existing(address: &str, acting_address: &str) -> EmptyResult {
-    let (subject, body_html, body_text) = get_text(
-        "email/change_email_existing",
-        json!({
-            "url": CONFIG.domain(),
-            "img_src": CONFIG._smtp_img_src(),
-            "existing_address": address,
-            "acting_address": acting_address,
-        }),
-    )?;
-
-    send_email(address, &subject, body_html, body_text).await
-}
-
 pub async fn send_test(address: &str) -> EmptyResult {
    let (subject, body_html, body_text) = get_text(
        "email/smtp_test",
@@ -629,13 +558,13 @@ async fn send_with_selected_transport(email: Message) -> EmptyResult {
            // Match some common errors and make them more user friendly
            Err(e) => {
                if e.is_client() {
-                    debug!("Sendmail client error: {e:?}");
+                    debug!("Sendmail client error: {:#?}", e);
                    err!(format!("Sendmail client error: {e}"));
                } else if e.is_response() {
-                    debug!("Sendmail response error: {e:?}");
+                    debug!("Sendmail response error: {:#?}", e);
                    err!(format!("Sendmail response error: {e}"));
                } else {
-                    debug!("Sendmail error: {e:?}");
+                    debug!("Sendmail error: {:#?}", e);
                    err!(format!("Sendmail error: {e}"));
                }
            }
@@ -646,13 +575,13 @@ async fn send_with_selected_transport(email: Message) -> EmptyResult {
            // Match some common errors and make them more user friendly
            Err(e) => {
                if e.is_client() {
-                    debug!("SMTP client error: {e:#?}");
+                    debug!("SMTP client error: {:#?}", e);
                    err!(format!("SMTP client error: {e}"));
                } else if e.is_transient() {
-                    debug!("SMTP 4xx error: {e:#?}");
+                    debug!("SMTP 4xx error: {:#?}", e);
                    err!(format!("SMTP 4xx error: {e}"));
                } else if e.is_permanent() {
-                    debug!("SMTP 5xx error: {e:#?}");
+                    debug!("SMTP 5xx error: {:#?}", e);
                    let mut msg = e.to_string();
                    // Add a special check for 535 to add a more descriptive message
                    if msg.contains("(535)") {
@@ -660,13 +589,13 @@ async fn send_with_selected_transport(email: Message) -> EmptyResult {
                    }
                    err!(format!("SMTP 5xx error: {msg}"));
                } else if e.is_timeout() {
-                    debug!("SMTP timeout error: {e:#?}");
+                    debug!("SMTP timeout error: {:#?}", e);
                    err!(format!("SMTP timeout error: {e}"));
                } else if e.is_tls() {
-                    debug!("SMTP encryption error: {e:#?}");
+                    debug!("SMTP encryption error: {:#?}", e);
                    err!(format!("SMTP encryption error: {e}"));
                } else {
-                    debug!("SMTP error: {e:#?}");
+                    debug!("SMTP error: {:#?}", e);
                    err!(format!("SMTP error: {e}"));
                }
            }
--- a/src/main.rs
+++ b/src/main.rs
@@ -24,8 +24,6 @@ extern crate log;
 extern crate diesel;
 #[macro_use]
 extern crate diesel_migrations;
-#[macro_use]
-extern crate diesel_derive_newtype;

 use std::{
    collections::HashMap,
@@ -61,7 +59,7 @@ mod util;
 use crate::api::core::two_factor::duo_oidc::purge_duo_contexts;
 use crate::api::purge_auth_requests;
 use crate::api::{WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS};
-pub use config::{PathType, CONFIG};
+pub use config::CONFIG;
 pub use error::{Error, MapResult};
 use rocket::data::{Limits, ToByteUnit};
 use std::sync::{atomic::Ordering, Arc};
@@ -69,19 +67,22 @@ pub use util::is_running_in_container;

 #[rocket::main]
 async fn main() -> Result<(), Error> {
-    parse_args().await;
+    parse_args();
    launch_info();

    let level = init_logging()?;

    check_data_folder().await;
-    auth::initialize_keys().await.unwrap_or_else(|e| {
+    auth::initialize_keys().unwrap_or_else(|e| {
        error!("Error creating private key '{}'\n{e:?}\nExiting Vaultwarden!", CONFIG.private_rsa_key());
        exit(1);
    });
    check_web_vault();

+    create_dir(&CONFIG.icon_cache_folder(), "icon cache");
    create_dir(&CONFIG.tmp_folder(), "tmp folder");
+    create_dir(&CONFIG.sends_folder(), "sends folder");
+    create_dir(&CONFIG.attachments_folder(), "attachments folder");

    let pool = create_db_pool().await;
    schedule_jobs(pool.clone());
@@ -114,7 +115,7 @@ PRESETS:                  m=         t=          p=

 pub const VERSION: Option<&str> = option_env!("VW_VERSION");

-async fn parse_args() {
+fn parse_args() {
    let mut pargs = pico_args::Arguments::from_env();
    let version = VERSION.unwrap_or("(Version info from Git not present)");

@@ -185,7 +186,7 @@ async fn parse_args() {
                exit(1);
            }
        } else if command == "backup" {
-            match backup_sqlite().await {
+            match backup_sqlite() {
                Ok(f) => {
                    println!("Backup to '{f}' was successful");
                    exit(0);
@@ -200,20 +201,25 @@ async fn parse_args() {
    }
 }

-async fn backup_sqlite() -> Result<String, Error> {
-    use crate::db::{backup_database, DbConnType};
-    if DbConnType::from_url(&CONFIG.database_url()).map(|t| t == DbConnType::sqlite).unwrap_or(false) {
-        // Establish a connection to the sqlite database
-        let mut conn = db::DbPool::from_config()
-            .expect("SQLite database connection failed")
-            .get()
-            .await
-            .expect("Unable to get SQLite db pool");
+fn backup_sqlite() -> Result<String, Error> {
+    #[cfg(sqlite)]
+    {
+        use crate::db::{backup_sqlite_database, DbConnType};
+        if DbConnType::from_url(&CONFIG.database_url()).map(|t| t == DbConnType::sqlite).unwrap_or(false) {
+            use diesel::Connection;
+            let url = CONFIG.database_url();

-        let backup_file = backup_database(&mut conn).await?;
-        Ok(backup_file)
-    } else {
-        err_silent!("The database type is not SQLite. Backups only works for SQLite databases")
+            // Establish a connection to the sqlite database
+            let mut conn = diesel::sqlite::SqliteConnection::establish(&url)?;
+            let backup_file = backup_sqlite_database(&mut conn)?;
+            Ok(backup_file)
+        } else {
+            err_silent!("The database type is not SQLite. Backups only works for SQLite databases")
+        }
+    }
+    #[cfg(not(sqlite))]
+    {
+        err_silent!("The 'sqlite' feature is not enabled. Backups only works for SQLite databases")
    }
 }

@@ -427,7 +433,10 @@ fn init_logging() -> Result<log::LevelFilter, Error> {
            }
            None => error!(
                target: "panic",
-                "thread '{thread}' panicked at '{msg}'\n{backtrace:}"
+                "thread '{}' panicked at '{}'\n{:}",
+                thread,
+                msg,
+                backtrace
            ),
        }
    }));
@@ -447,7 +456,7 @@ fn chain_syslog(logger: fern::Dispatch) -> fern::Dispatch {
    match syslog::unix(syslog_fmt) {
        Ok(sl) => logger.chain(sl),
        Err(e) => {
-            error!("Unable to connect to syslog: {e:?}");
+            error!("Unable to connect to syslog: {:?}", e);
            logger
        }
    }
@@ -461,27 +470,9 @@ fn create_dir(path: &str, description: &str) {

 async fn check_data_folder() {
    let data_folder = &CONFIG.data_folder();
-
-    if data_folder.starts_with("s3://") {
-        if let Err(e) = CONFIG
-            .opendal_operator_for_path_type(PathType::Data)
-            .unwrap_or_else(|e| {
-                error!("Failed to create S3 operator for data folder '{data_folder}': {e:?}");
-                exit(1);
-            })
-            .check()
-            .await
-        {
-            error!("Could not access S3 data folder '{data_folder}': {e:?}");
-            exit(1);
-        }
-
-        return;
-    }
-
    let path = Path::new(data_folder);
    if !path.exists() {
-        error!("Data folder '{data_folder}' doesn't exist.");
+        error!("Data folder '{}' doesn't exist.", data_folder);
        if is_running_in_container() {
            error!("Verify that your data volume is mounted at the correct location.");
        } else {
@@ -490,7 +481,7 @@ async fn check_data_folder() {
        exit(1);
    }
    if !path.is_dir() {
-        error!("Data folder '{data_folder}' is not a directory.");
+        error!("Data folder '{}' is not a directory.", data_folder);
        exit(1);
    }

@@ -564,7 +555,7 @@ async fn create_db_pool() -> db::DbPool {
    match util::retry_db(db::DbPool::from_config, CONFIG.db_connection_retries()).await {
        Ok(p) => p,
        Err(e) => {
-            error!("Error creating database pool: {e:?}");
+            error!("Error creating database pool: {:?}", e);
            exit(1);
        }
    }
@@ -619,7 +610,7 @@ async fn launch_rocket(pool: db::DbPool, extra_debug: bool) -> Result<(), Error>
                // If we need more signals to act upon, we might want to use select! here.
                // With only one item to listen for this is enough.
                let _ = signal_user1.recv().await;
-                match backup_sqlite().await {
+                match backup_sqlite() {
                    Ok(f) => info!("Backup to '{f}' was successful"),
                    Err(e) => error!("Backup failed. {e:?}"),
                }
--- a/src/static/scripts/admin.css
+++ b/src/static/scripts/admin.css
@@ -38,8 +38,8 @@ img {
    max-width: 130px;
 }
 #users-table .vw-actions, #orgs-table .vw-actions {
-    min-width: 155px;
-    max-width: 160px;
+    min-width: 130px;
+    max-width: 130px;
 }
 #users-table .vw-org-cell {
    max-height: 120px;
@@ -54,7 +54,3 @@ img {
 .vw-copy-toast {
    width: 15rem;
 }
-
-.abbr-badge {
-    cursor: help;
-}
--- a/src/static/scripts/admin_diagnostics.js
+++ b/src/static/scripts/admin_diagnostics.js
@@ -7,8 +7,6 @@ var timeCheck = false;
 var ntpTimeCheck = false;
 var domainCheck = false;
 var httpsCheck = false;
-var websocketCheck = false;
-var httpResponseCheck = false;

 // ================================
 // Date & Time Check
@@ -29,7 +27,7 @@ function isValidIp(ip) {
    return ipv4Regex.test(ip) || ipv6Regex.test(ip);
 }

-function checkVersions(platform, installed, latest, commit=null, pre_release=false) {
+function checkVersions(platform, installed, latest, commit=null) {
    if (installed === "-" || latest === "-") {
        document.getElementById(`${platform}-failed`).classList.remove("d-none");
        return;
@@ -37,12 +35,10 @@ function checkVersions(platform, installed, latest, commit=null, pre_release=fal

    // Only check basic versions, no commit revisions
    if (commit === null || installed.indexOf("-") === -1) {
-        if (platform === "web" && pre_release === true) {
-            document.getElementById(`${platform}-prerelease`).classList.remove("d-none");
-        } else if (installed == latest) {
-            document.getElementById(`${platform}-success`).classList.remove("d-none");
-        } else {
+        if (installed !== latest) {
            document.getElementById(`${platform}-warning`).classList.remove("d-none");
+        } else {
+            document.getElementById(`${platform}-success`).classList.remove("d-none");
        }
    } else {
        // Check if this is a branched version.
@@ -80,15 +76,18 @@ async function generateSupportString(event, dj) {
    event.preventDefault();
    event.stopPropagation();

-    let supportString = "### Your environment (Generated via diagnostics page)\n\n";
+    let supportString = "### Your environment (Generated via diagnostics page)\n";

    supportString += `* Vaultwarden version: v${dj.current_release}\n`;
    supportString += `* Web-vault version: v${dj.web_vault_version}\n`;
    supportString += `* OS/Arch: ${dj.host_os}/${dj.host_arch}\n`;
    supportString += `* Running within a container: ${dj.running_within_container} (Base: ${dj.container_base_image})\n`;
-    supportString += `* Database type: ${dj.db_type}\n`;
-    supportString += `* Database version: ${dj.db_version}\n`;
-    supportString += `* Uses config.json: ${dj.overrides !== ""}\n`;
+    supportString += "* Environment settings overridden: ";
+    if (dj.overrides != "") {
+        supportString += "true\n";
+    } else {
+        supportString += "false\n";
+    }
    supportString += `* Uses a reverse proxy: ${dj.ip_header_exists}\n`;
    if (dj.ip_header_exists) {
        supportString += `* IP Header check: ${dj.ip_header_match} (${dj.ip_header_name})\n`;
@@ -96,19 +95,15 @@ async function generateSupportString(event, dj) {
    supportString += `* Internet access: ${dj.has_http_access}\n`;
    supportString += `* Internet access via a proxy: ${dj.uses_proxy}\n`;
    supportString += `* DNS Check: ${dnsCheck}\n`;
-    if (dj.tz_env !== "") {
-        supportString += `* TZ environment: ${dj.tz_env}\n`;
-    }
    supportString += `* Browser/Server Time Check: ${timeCheck}\n`;
    supportString += `* Server/NTP Time Check: ${ntpTimeCheck}\n`;
    supportString += `* Domain Configuration Check: ${domainCheck}\n`;
    supportString += `* HTTPS Check: ${httpsCheck}\n`;
-    if (dj.enable_websocket) {
-        supportString += `* Websocket Check: ${websocketCheck}\n`;
-    } else {
-        supportString += "* Websocket Check: disabled\n";
-    }
-    supportString += `* HTTP Response Checks: ${httpResponseCheck}\n`;
+    supportString += `* Database type: ${dj.db_type}\n`;
+    supportString += `* Database version: ${dj.db_version}\n`;
+    supportString += "* Clients used: \n";
+    supportString += "* Reverse proxy and version: \n";
+    supportString += "* Other relevant information: \n";

    const jsonResponse = await fetch(`${BASE_URL}/admin/diagnostics/config`, {
        "headers": { "Accept": "application/json" }
@@ -118,30 +113,10 @@ async function generateSupportString(event, dj) {
        throw new Error(jsonResponse);
    }
    const configJson = await jsonResponse.json();
+    supportString += "\n### Config (Generated via diagnostics page)\n<details><summary>Show Running Config</summary>\n";
+    supportString += `\n**Environment settings which are overridden:** ${dj.overrides}\n`;
+    supportString += "\n\n```json\n" + JSON.stringify(configJson, undefined, 2) + "\n```\n</details>\n";

-    // Start Config and Details section within a details block which is collapsed by default
-    supportString += "\n### Config & Details (Generated via diagnostics page)\n\n";
-    supportString += "<details><summary>Show Config & Details</summary>\n";
-
-    // Add overrides if they exists
-    if (dj.overrides != "") {
-        supportString += `\n**Environment settings which are overridden:** ${dj.overrides}\n`;
-    }
-
-    // Add http response check messages if they exists
-    if (httpResponseCheck === false) {
-        supportString += "\n**Failed HTTP Checks:**\n";
-        // We use `innerText` here since that will convert <br> into new-lines
-        supportString += "\n```yaml\n" + document.getElementById("http-response-errors").innerText.trim() + "\n```\n";
-    }
-
-    // Add the current config in json form
-    supportString += "\n**Config:**\n";
-    supportString += "\n```json\n" + JSON.stringify(configJson, undefined, 2) + "\n```\n";
-
-    supportString += "\n</details>\n";
-
-    // Add the support string to the textbox so it can be viewed and copied
    document.getElementById("support-string").textContent = supportString;
    document.getElementById("support-string").classList.remove("d-none");
    document.getElementById("copy-support").classList.remove("d-none");
@@ -208,9 +183,11 @@ function initVersionCheck(dj) {
    }
    checkVersions("server", serverInstalled, serverLatest, serverLatestCommit);

-    const webInstalled = dj.web_vault_version;
-    const webLatest = dj.latest_web_build;
-    checkVersions("web", webInstalled, webLatest, null, dj.web_vault_pre_release);
+    if (!dj.running_within_container) {
+        const webInstalled = dj.web_vault_version;
+        const webLatest = dj.latest_web_build;
+        checkVersions("web", webInstalled, webLatest);
+    }
 }

 function checkDns(dns_resolved) {
@@ -222,165 +199,6 @@ function checkDns(dns_resolved) {
    }
 }

-async function fetchCheckUrl(url) {
-    try {
-        const response = await fetch(url);
-        return { headers: response.headers, status: response.status, text: await response.text() };
-    } catch (error) {
-        console.error(`Error fetching ${url}: ${error}`);
-        return { error };
-    }
-}
-
-function checkSecurityHeaders(headers, omit) {
-    let securityHeaders = {
-        "x-frame-options": ["SAMEORIGIN"],
-        "x-content-type-options": ["nosniff"],
-        "referrer-policy": ["same-origin"],
-        "x-xss-protection": ["0"],
-        "x-robots-tag": ["noindex", "nofollow"],
-        "cross-origin-resource-policy": ["same-origin"],
-        "content-security-policy": [
-            "default-src 'none'",
-            "font-src 'self'",
-            "manifest-src 'self'",
-            "base-uri 'self'",
-            "form-action 'self'",
-            "object-src 'self' blob:",
-            "script-src 'self' 'wasm-unsafe-eval'",
-            "style-src 'self' 'unsafe-inline'",
-            "child-src 'self' https://*.duosecurity.com https://*.duofederal.com",
-            "frame-src 'self' https://*.duosecurity.com https://*.duofederal.com",
-            "frame-ancestors 'self' chrome-extension://nngceckbapebfimnlniiiahkandclblb chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh moz-extension://*",
-            "img-src 'self' data: https://haveibeenpwned.com",
-            "connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net",
-        ]
-    };
-
-    let messages = [];
-    for (let header in securityHeaders) {
-        // Skip some headers for specific endpoints if needed
-        if (typeof omit === "object" && omit.includes(header) === true) {
-            continue;
-        }
-        // If the header exists, check if the contents matches what we expect it to be
-        let headerValue = headers.get(header);
-        if (headerValue !== null) {
-            securityHeaders[header].forEach((expectedValue) => {
-                if (headerValue.indexOf(expectedValue) === -1) {
-                    messages.push(`'${header}' does not contain '${expectedValue}'`);
-                }
-            });
-        } else {
-            messages.push(`'${header}' is missing!`);
-        }
-    }
-    return messages;
-}
-
-async function checkHttpResponse() {
-    const [apiConfig, webauthnConnector, notFound, notFoundApi, badRequest, unauthorized, forbidden] = await Promise.all([
-        fetchCheckUrl(`${BASE_URL}/api/config`),
-        fetchCheckUrl(`${BASE_URL}/webauthn-connector.html`),
-        fetchCheckUrl(`${BASE_URL}/admin/does-not-exist`),
-        fetchCheckUrl(`${BASE_URL}/admin/diagnostics/http?code=404`),
-        fetchCheckUrl(`${BASE_URL}/admin/diagnostics/http?code=400`),
-        fetchCheckUrl(`${BASE_URL}/admin/diagnostics/http?code=401`),
-        fetchCheckUrl(`${BASE_URL}/admin/diagnostics/http?code=403`),
-    ]);
-
-    const respErrorElm = document.getElementById("http-response-errors");
-
-    // Check and validate the default API header responses
-    let apiErrors = checkSecurityHeaders(apiConfig.headers);
-    if (apiErrors.length >= 1) {
-        respErrorElm.innerHTML += "<b>API calls:</b><br>";
-        apiErrors.forEach((errMsg) => {
-            respErrorElm.innerHTML += `<b>Header:</b> ${errMsg}<br>`;
-        });
-    }
-
-    // Check the special `-connector.html` headers, these should have some headers omitted.
-    const omitConnectorHeaders = ["x-frame-options", "content-security-policy"];
-    let connectorErrors = checkSecurityHeaders(webauthnConnector.headers, omitConnectorHeaders);
-    omitConnectorHeaders.forEach((header) => {
-        if (webauthnConnector.headers.get(header) !== null) {
-            connectorErrors.push(`'${header}' is present while it should not`);
-        }
-    });
-    if (connectorErrors.length >= 1) {
-        respErrorElm.innerHTML += "<b>2FA Connector calls:</b><br>";
-        connectorErrors.forEach((errMsg) => {
-            respErrorElm.innerHTML += `<b>Header:</b> ${errMsg}<br>`;
-        });
-    }
-
-    // Check specific error code responses if they are not re-written by a reverse proxy
-    let responseErrors = [];
-    if (notFound.status !== 404 || notFound.text.indexOf("return to the web-vault") === -1) {
-        responseErrors.push("404 (Not Found) HTML is invalid");
-    }
-
-    if (notFoundApi.status !== 404 || notFoundApi.text.indexOf("\"message\":\"Testing error 404 response\",") === -1) {
-        responseErrors.push("404 (Not Found) JSON is invalid");
-    }
-
-    if (badRequest.status !== 400 || badRequest.text.indexOf("\"message\":\"Testing error 400 response\",") === -1) {
-        responseErrors.push("400 (Bad Request) is invalid");
-    }
-
-    if (unauthorized.status !== 401 || unauthorized.text.indexOf("\"message\":\"Testing error 401 response\",") === -1) {
-        responseErrors.push("401 (Unauthorized) is invalid");
-    }
-
-    if (forbidden.status !== 403 || forbidden.text.indexOf("\"message\":\"Testing error 403 response\",") === -1) {
-        responseErrors.push("403 (Forbidden) is invalid");
-    }
-
-    if (responseErrors.length >= 1) {
-        respErrorElm.innerHTML += "<b>HTTP error responses:</b><br>";
-        responseErrors.forEach((errMsg) => {
-            respErrorElm.innerHTML += `<b>Response to:</b> ${errMsg}<br>`;
-        });
-    }
-
-    if (responseErrors.length >= 1 || connectorErrors.length >= 1 || apiErrors.length >= 1) {
-        document.getElementById("http-response-warning").classList.remove("d-none");
-    } else {
-        httpResponseCheck = true;
-        document.getElementById("http-response-success").classList.remove("d-none");
-    }
-}
-
-async function fetchWsUrl(wsUrl) {
-    return new Promise((resolve, reject) => {
-        try {
-            const ws = new WebSocket(wsUrl);
-            ws.onopen = () => {
-                ws.close();
-                resolve(true);
-            };
-
-            ws.onerror = () => {
-                reject(false);
-            };
-        } catch (_) {
-            reject(false);
-        }
-    });
-}
-
-async function checkWebsocketConnection() {
-    // Test Websocket connections via the anonymous (login with device) connection
-    const isConnected = await fetchWsUrl(`${BASE_URL}/notifications/anonymous-hub?token=admin-diagnostics`).catch(() => false);
-    if (isConnected) {
-        websocketCheck = true;
-        document.getElementById("websocket-success").classList.remove("d-none");
-    } else {
-        document.getElementById("websocket-error").classList.remove("d-none");
-    }
-}
-
 function init(dj) {
    // Time check
    document.getElementById("time-browser-string").textContent = browserUTC;
@@ -407,12 +225,6 @@ function init(dj) {

    // DNS Check
    checkDns(dj.dns_resolved);
-
-    checkHttpResponse();
-
-    if (dj.enable_websocket) {
-        checkWebsocketConnection();
-    }
 }

 // onLoad events
--- a/src/static/scripts/admin_users.js
+++ b/src/static/scripts/admin_users.js
@@ -152,7 +152,7 @@ const ORG_TYPES = {
        "name": "User",
        "bg": "blue"
    },
-    "4": {
+    "3": {
        "name": "Manager",
        "bg": "green"
    },
--- a/src/static/scripts/bootstrap.bundle.js
+++ b/src/static/scripts/bootstrap.bundle.js
@@ -1,6 +1,6 @@
 /*!
-  * Bootstrap v5.3.7 (https://getbootstrap.com/)
-  * Copyright 2011-2025 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)
+  * Bootstrap v5.3.3 (https://getbootstrap.com/)
+  * Copyright 2011-2024 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)
  * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
  */
 (function (global, factory) {
@@ -205,7 +205,7 @@
   * @param {HTMLElement} element
   * @return void
   *
-   * @see https://www.harrytheo.com/blog/2021/02/restart-a-css-animation-with-javascript/#restarting-a-css-animation
+   * @see https://www.charistheo.io/blog/2021/02/restart-a-css-animation-with-javascript/#restarting-a-css-animation
   */
  const reflow = element => {
    element.offsetHeight; // eslint-disable-line no-unused-expressions
@@ -250,7 +250,7 @@
    });
  };
  const execute = (possibleCallback, args = [], defaultValue = possibleCallback) => {
-    return typeof possibleCallback === 'function' ? possibleCallback.call(...args) : defaultValue;
+    return typeof possibleCallback === 'function' ? possibleCallback(...args) : defaultValue;
  };
  const executeAfterTransition = (callback, transitionElement, waitForTransition = true) => {
    if (!waitForTransition) {
@@ -572,7 +572,7 @@
      const bsKeys = Object.keys(element.dataset).filter(key => key.startsWith('bs') && !key.startsWith('bsConfig'));
      for (const key of bsKeys) {
        let pureKey = key.replace(/^bs/, '');
-        pureKey = pureKey.charAt(0).toLowerCase() + pureKey.slice(1);
+        pureKey = pureKey.charAt(0).toLowerCase() + pureKey.slice(1, pureKey.length);
        attributes[pureKey] = normalizeData(element.dataset[key]);
      }
      return attributes;
@@ -647,7 +647,7 @@
   * Constants
   */

-  const VERSION = '5.3.7';
+  const VERSION = '5.3.3';

  /**
   * Class definition
@@ -673,8 +673,6 @@
        this[propertyName] = null;
      }
    }
-
-    // Private
    _queueCallback(callback, element, isAnimated = true) {
      executeAfterTransition(callback, element, isAnimated);
    }
@@ -1606,11 +1604,11 @@
      this._element.style[dimension] = '';
      this._queueCallback(complete, this._element, true);
    }
-
-    // Private
    _isShown(element = this._element) {
      return element.classList.contains(CLASS_NAME_SHOW$7);
    }
+
+    // Private
    _configAfterMerge(config) {
      config.toggle = Boolean(config.toggle); // Coerce string values
      config.parent = getElement(config.parent);
@@ -2668,6 +2666,7 @@
    var popperOffsets = computeOffsets({
      reference: referenceClientRect,
      element: popperRect,
+      strategy: 'absolute',
      placement: placement
    });
    var popperClientRect = rectToClientRect(Object.assign({}, popperRect, popperOffsets));
@@ -2995,6 +2994,7 @@
    state.modifiersData[name] = computeOffsets({
      reference: state.rects.reference,
      element: state.rects.popper,
+      strategy: 'absolute',
      placement: state.placement
    });
  } // eslint-disable-next-line import/no-unused-modules
@@ -3690,9 +3690,6 @@
      this._element.setAttribute('aria-expanded', 'false');
      Manipulator.removeDataAttribute(this._menu, 'popper');
      EventHandler.trigger(this._element, EVENT_HIDDEN$5, relatedTarget);
-
-      // Explicitly return focus to the trigger element
-      this._element.focus();
    }
    _getConfig(config) {
      config = super._getConfig(config);
@@ -3704,7 +3701,7 @@
    }
    _createPopper() {
      if (typeof Popper === 'undefined') {
-        throw new TypeError('Bootstrap\'s dropdowns require Popper (https://popper.js.org/docs/v2/)');
+        throw new TypeError('Bootstrap\'s dropdowns require Popper (https://popper.js.org)');
      }
      let referenceElement = this._element;
      if (this._config.reference === 'parent') {
@@ -3783,7 +3780,7 @@
      }
      return {
        ...defaultBsPopperConfig,
-        ...execute(this._config.popperConfig, [undefined, defaultBsPopperConfig])
+        ...execute(this._config.popperConfig, [defaultBsPopperConfig])
      };
    }
    _selectMenuItem({
@@ -4805,6 +4802,7 @@
   *
   * Shout-out to Angular https://github.com/angular/angular/blob/15.2.8/packages/core/src/sanitization/url_sanitizer.ts#L38
   */
+  // eslint-disable-next-line unicorn/better-regex
  const SAFE_URL_PATTERN = /^(?!javascript:)(?:[a-z0-9+.-]+:|[^&:/?#]*(?:[/?#]|$))/i;
  const allowedAttribute = (attribute, allowedAttributeList) => {
    const attributeName = attribute.nodeName.toLowerCase();
@@ -4969,7 +4967,7 @@
      return this._config.sanitize ? sanitizeHtml(arg, this._config.allowList, this._config.sanitizeFn) : arg;
    }
    _resolvePossibleFunction(arg) {
-      return execute(arg, [undefined, this]);
+      return execute(arg, [this]);
    }
    _putElementInTemplate(element, templateElement) {
      if (this._config.html) {
@@ -5068,7 +5066,7 @@
  class Tooltip extends BaseComponent {
    constructor(element, config) {
      if (typeof Popper === 'undefined') {
-        throw new TypeError('Bootstrap\'s tooltips require Popper (https://popper.js.org/docs/v2/)');
+        throw new TypeError('Bootstrap\'s tooltips require Popper (https://popper.js.org)');
      }
      super(element, config);

@@ -5114,6 +5112,7 @@
      if (!this._isEnabled) {
        return;
      }
+      this._activeTrigger.click = !this._activeTrigger.click;
      if (this._isShown()) {
        this._leave();
        return;
@@ -5301,7 +5300,7 @@
      return offset;
    }
    _resolvePossibleFunction(arg) {
-      return execute(arg, [this._element, this._element]);
+      return execute(arg, [this._element]);
    }
    _getPopperConfig(attachment) {
      const defaultBsPopperConfig = {
@@ -5339,7 +5338,7 @@
      };
      return {
        ...defaultBsPopperConfig,
-        ...execute(this._config.popperConfig, [undefined, defaultBsPopperConfig])
+        ...execute(this._config.popperConfig, [defaultBsPopperConfig])
      };
    }
    _setListeners() {
@@ -5348,7 +5347,6 @@
        if (trigger === 'click') {
          EventHandler.on(this._element, this.constructor.eventName(EVENT_CLICK$1), this._config.selector, event => {
            const context = this._initializeOnDelegatedTarget(event);
-            context._activeTrigger[TRIGGER_CLICK] = !(context._isShown() && context._activeTrigger[TRIGGER_CLICK]);
            context.toggle();
          });
        } else if (trigger !== TRIGGER_MANUAL) {
@@ -6214,6 +6212,7 @@
    }

    // Private
+
    _maybeScheduleHide() {
      if (!this._config.autohide) {
        return;
--- a/src/static/scripts/bootstrap.css
+++ b/src/static/scripts/bootstrap.css
@@ -1,7 +1,7 @@
@charset "UTF-8";
 /*!
- * Bootstrap  v5.3.7 (https://getbootstrap.com/)
- * Copyright 2011-2025 The Bootstrap Authors
+ * Bootstrap  v5.3.3 (https://getbootstrap.com/)
+ * Copyright 2011-2024 The Bootstrap Authors
 * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
 */
 :root,
@@ -517,8 +517,8 @@ legend {
  width: 100%;
  padding: 0;
  margin-bottom: 0.5rem;
-  line-height: inherit;
  font-size: calc(1.275rem + 0.3vw);
+  line-height: inherit;
 }
@media (min-width: 1200px) {
  legend {
@@ -601,9 +601,9 @@ progress {
 }

 .display-1 {
+  font-size: calc(1.625rem + 4.5vw);
  font-weight: 300;
  line-height: 1.2;
-  font-size: calc(1.625rem + 4.5vw);
 }
@media (min-width: 1200px) {
  .display-1 {
@@ -612,9 +612,9 @@ progress {
 }

 .display-2 {
+  font-size: calc(1.575rem + 3.9vw);
  font-weight: 300;
  line-height: 1.2;
-  font-size: calc(1.575rem + 3.9vw);
 }
@media (min-width: 1200px) {
  .display-2 {
@@ -623,9 +623,9 @@ progress {
 }

 .display-3 {
+  font-size: calc(1.525rem + 3.3vw);
  font-weight: 300;
  line-height: 1.2;
-  font-size: calc(1.525rem + 3.3vw);
 }
@media (min-width: 1200px) {
  .display-3 {
@@ -634,9 +634,9 @@ progress {
 }

 .display-4 {
+  font-size: calc(1.475rem + 2.7vw);
  font-weight: 300;
  line-height: 1.2;
-  font-size: calc(1.475rem + 2.7vw);
 }
@media (min-width: 1200px) {
  .display-4 {
@@ -645,9 +645,9 @@ progress {
 }

 .display-5 {
+  font-size: calc(1.425rem + 2.1vw);
  font-weight: 300;
  line-height: 1.2;
-  font-size: calc(1.425rem + 2.1vw);
 }
@media (min-width: 1200px) {
  .display-5 {
@@ -656,9 +656,9 @@ progress {
 }

 .display-6 {
+  font-size: calc(1.375rem + 1.5vw);
  font-weight: 300;
  line-height: 1.2;
-  font-size: calc(1.375rem + 1.5vw);
 }
@media (min-width: 1200px) {
  .display-6 {
@@ -803,7 +803,7 @@ progress {
 }

 .col {
-  flex: 1 0 0;
+  flex: 1 0 0%;
 }

 .row-cols-auto > * {
@@ -1012,7 +1012,7 @@ progress {

@media (min-width: 576px) {
  .col-sm {
-    flex: 1 0 0;
+    flex: 1 0 0%;
  }
  .row-cols-sm-auto > * {
    flex: 0 0 auto;
@@ -1181,7 +1181,7 @@ progress {
 }
@media (min-width: 768px) {
  .col-md {
-    flex: 1 0 0;
+    flex: 1 0 0%;
  }
  .row-cols-md-auto > * {
    flex: 0 0 auto;
@@ -1350,7 +1350,7 @@ progress {
 }
@media (min-width: 992px) {
  .col-lg {
-    flex: 1 0 0;
+    flex: 1 0 0%;
  }
  .row-cols-lg-auto > * {
    flex: 0 0 auto;
@@ -1519,7 +1519,7 @@ progress {
 }
@media (min-width: 1200px) {
  .col-xl {
-    flex: 1 0 0;
+    flex: 1 0 0%;
  }
  .row-cols-xl-auto > * {
    flex: 0 0 auto;
@@ -1688,7 +1688,7 @@ progress {
 }
@media (min-width: 1400px) {
  .col-xxl {
-    flex: 1 0 0;
+    flex: 1 0 0%;
  }
  .row-cols-xxl-auto > * {
    flex: 0 0 auto;
@@ -2156,6 +2156,10 @@ progress {
  display: block;
  padding: 0;
 }
+.form-control::-moz-placeholder {
+  color: var(--bs-secondary-color);
+  opacity: 1;
+}
 .form-control::placeholder {
  color: var(--bs-secondary-color);
  opacity: 1;
@@ -2603,11 +2607,9 @@ textarea.form-control-lg {
  top: 0;
  left: 0;
  z-index: 2;
-  max-width: 100%;
  height: 100%;
  padding: 1rem 0.75rem;
  overflow: hidden;
-  color: rgba(var(--bs-body-color-rgb), 0.65);
  text-align: start;
  text-overflow: ellipsis;
  white-space: nowrap;
@@ -2625,10 +2627,17 @@ textarea.form-control-lg {
 .form-floating > .form-control-plaintext {
  padding: 1rem 0.75rem;
 }
+.form-floating > .form-control::-moz-placeholder, .form-floating > .form-control-plaintext::-moz-placeholder {
+  color: transparent;
+}
 .form-floating > .form-control::placeholder,
 .form-floating > .form-control-plaintext::placeholder {
  color: transparent;
 }
+.form-floating > .form-control:not(:-moz-placeholder-shown), .form-floating > .form-control-plaintext:not(:-moz-placeholder-shown) {
+  padding-top: 1.625rem;
+  padding-bottom: 0.625rem;
+}
 .form-floating > .form-control:focus, .form-floating > .form-control:not(:placeholder-shown),
 .form-floating > .form-control-plaintext:focus,
 .form-floating > .form-control-plaintext:not(:placeholder-shown) {
@@ -2643,19 +2652,19 @@ textarea.form-control-lg {
 .form-floating > .form-select {
  padding-top: 1.625rem;
  padding-bottom: 0.625rem;
-  padding-left: 0.75rem;
+}
+.form-floating > .form-control:not(:-moz-placeholder-shown) ~ label {
+  color: rgba(var(--bs-body-color-rgb), 0.65);
+  transform: scale(0.85) translateY(-0.5rem) translateX(0.15rem);
 }
 .form-floating > .form-control:focus ~ label,
 .form-floating > .form-control:not(:placeholder-shown) ~ label,
 .form-floating > .form-control-plaintext ~ label,
 .form-floating > .form-select ~ label {
+  color: rgba(var(--bs-body-color-rgb), 0.65);
  transform: scale(0.85) translateY(-0.5rem) translateX(0.15rem);
 }
-.form-floating > .form-control:-webkit-autofill ~ label {
-  transform: scale(0.85) translateY(-0.5rem) translateX(0.15rem);
-}
-.form-floating > textarea:focus ~ label::after,
-.form-floating > textarea:not(:placeholder-shown) ~ label::after {
+.form-floating > .form-control:not(:-moz-placeholder-shown) ~ label::after {
  position: absolute;
  inset: 1rem 0.375rem;
  z-index: -1;
@@ -2664,8 +2673,21 @@ textarea.form-control-lg {
  background-color: var(--bs-body-bg);
  border-radius: var(--bs-border-radius);
 }
-.form-floating > textarea:disabled ~ label::after {
-  background-color: var(--bs-secondary-bg);
+.form-floating > .form-control:focus ~ label::after,
+.form-floating > .form-control:not(:placeholder-shown) ~ label::after,
+.form-floating > .form-control-plaintext ~ label::after,
+.form-floating > .form-select ~ label::after {
+  position: absolute;
+  inset: 1rem 0.375rem;
+  z-index: -1;
+  height: 1.5em;
+  content: "";
+  background-color: var(--bs-body-bg);
+  border-radius: var(--bs-border-radius);
+}
+.form-floating > .form-control:-webkit-autofill ~ label {
+  color: rgba(var(--bs-body-color-rgb), 0.65);
+  transform: scale(0.85) translateY(-0.5rem) translateX(0.15rem);
 }
 .form-floating > .form-control-plaintext ~ label {
  border-width: var(--bs-border-width) 0;
@@ -2674,6 +2696,10 @@ textarea.form-control-lg {
 .form-floating > .form-control:disabled ~ label {
  color: #6c757d;
 }
+.form-floating > :disabled ~ label::after,
+.form-floating > .form-control:disabled ~ label::after {
+  background-color: var(--bs-secondary-bg);
+}

 .input-group {
  position: relative;
@@ -2756,7 +2782,7 @@ textarea.form-control-lg {
  border-bottom-right-radius: 0;
 }
 .input-group > :not(:first-child):not(.dropdown-menu):not(.valid-tooltip):not(.valid-feedback):not(.invalid-tooltip):not(.invalid-feedback) {
-  margin-left: calc(-1 * var(--bs-border-width));
+  margin-left: calc(var(--bs-border-width) * -1);
  border-top-left-radius: 0;
  border-bottom-left-radius: 0;
 }
@@ -2798,7 +2824,7 @@ textarea.form-control-lg {
 .was-validated .form-control:valid, .form-control.is-valid {
  border-color: var(--bs-form-valid-border-color);
  padding-right: calc(1.5em + 0.75rem);
-  background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3e%3cpath fill='%23198754' d='M2.3 6.73.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1'/%3e%3c/svg%3e");
+  background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3e%3cpath fill='%23198754' d='M2.3 6.73.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3e%3c/svg%3e");
  background-repeat: no-repeat;
  background-position: right calc(0.375em + 0.1875rem) center;
  background-size: calc(0.75em + 0.375rem) calc(0.75em + 0.375rem);
@@ -2817,7 +2843,7 @@ textarea.form-control-lg {
  border-color: var(--bs-form-valid-border-color);
 }
 .was-validated .form-select:valid:not([multiple]):not([size]), .was-validated .form-select:valid:not([multiple])[size="1"], .form-select.is-valid:not([multiple]):not([size]), .form-select.is-valid:not([multiple])[size="1"] {
-  --bs-form-select-bg-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3e%3cpath fill='%23198754' d='M2.3 6.73.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1'/%3e%3c/svg%3e");
+  --bs-form-select-bg-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3e%3cpath fill='%23198754' d='M2.3 6.73.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3e%3c/svg%3e");
  padding-right: 4.125rem;
  background-position: right 0.75rem center, center right 2.25rem;
  background-size: 16px 12px, calc(0.75em + 0.375rem) calc(0.75em + 0.375rem);
@@ -3729,7 +3755,7 @@ textarea.form-control-lg {
 }
 .btn-group > :not(.btn-check:first-child) + .btn,
 .btn-group > .btn-group:not(:first-child) {
-  margin-left: calc(-1 * var(--bs-border-width));
+  margin-left: calc(var(--bs-border-width) * -1);
 }
 .btn-group > .btn:not(:last-child):not(.dropdown-toggle),
 .btn-group > .btn.dropdown-toggle-split:first-child,
@@ -3776,15 +3802,14 @@ textarea.form-control-lg {
 }
 .btn-group-vertical > .btn:not(:first-child),
 .btn-group-vertical > .btn-group:not(:first-child) {
-  margin-top: calc(-1 * var(--bs-border-width));
+  margin-top: calc(var(--bs-border-width) * -1);
 }
 .btn-group-vertical > .btn:not(:last-child):not(.dropdown-toggle),
 .btn-group-vertical > .btn-group:not(:last-child) > .btn {
  border-bottom-right-radius: 0;
  border-bottom-left-radius: 0;
 }
-.btn-group-vertical > .btn:nth-child(n+3),
-.btn-group-vertical > :not(.btn-check) + .btn,
+.btn-group-vertical > .btn ~ .btn,
 .btn-group-vertical > .btn-group:not(:first-child) > .btn {
  border-top-left-radius: 0;
  border-top-right-radius: 0;
@@ -3908,8 +3933,8 @@ textarea.form-control-lg {

 .nav-justified > .nav-link,
 .nav-justified .nav-item {
-  flex-grow: 1;
  flex-basis: 0;
+  flex-grow: 1;
  text-align: center;
 }

@@ -4010,8 +4035,8 @@ textarea.form-control-lg {
 }

 .navbar-collapse {
-  flex-grow: 1;
  flex-basis: 100%;
+  flex-grow: 1;
  align-items: center;
 }

@@ -4506,7 +4531,7 @@ textarea.form-control-lg {
    flex-flow: row wrap;
  }
  .card-group > .card {
-    flex: 1 0 0;
+    flex: 1 0 0%;
    margin-bottom: 0;
  }
  .card-group > .card + .card {
@@ -4517,24 +4542,24 @@ textarea.form-control-lg {
    border-top-right-radius: 0;
    border-bottom-right-radius: 0;
  }
-  .card-group > .card:not(:last-child) > .card-img-top,
-  .card-group > .card:not(:last-child) > .card-header {
+  .card-group > .card:not(:last-child) .card-img-top,
+  .card-group > .card:not(:last-child) .card-header {
    border-top-right-radius: 0;
  }
-  .card-group > .card:not(:last-child) > .card-img-bottom,
-  .card-group > .card:not(:last-child) > .card-footer {
+  .card-group > .card:not(:last-child) .card-img-bottom,
+  .card-group > .card:not(:last-child) .card-footer {
    border-bottom-right-radius: 0;
  }
  .card-group > .card:not(:first-child) {
    border-top-left-radius: 0;
    border-bottom-left-radius: 0;
  }
-  .card-group > .card:not(:first-child) > .card-img-top,
-  .card-group > .card:not(:first-child) > .card-header {
+  .card-group > .card:not(:first-child) .card-img-top,
+  .card-group > .card:not(:first-child) .card-header {
    border-top-left-radius: 0;
  }
-  .card-group > .card:not(:first-child) > .card-img-bottom,
-  .card-group > .card:not(:first-child) > .card-footer {
+  .card-group > .card:not(:first-child) .card-img-bottom,
+  .card-group > .card:not(:first-child) .card-footer {
    border-bottom-left-radius: 0;
  }
 }
@@ -4551,11 +4576,11 @@ textarea.form-control-lg {
  --bs-accordion-btn-padding-y: 1rem;
  --bs-accordion-btn-color: var(--bs-body-color);
  --bs-accordion-btn-bg: var(--bs-accordion-bg);
-  --bs-accordion-btn-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='%23212529' stroke-linecap='round' stroke-linejoin='round'%3e%3cpath d='m2 5 6 6 6-6'/%3e%3c/svg%3e");
+  --bs-accordion-btn-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='%23212529' stroke-linecap='round' stroke-linejoin='round'%3e%3cpath d='M2 5L8 11L14 5'/%3e%3c/svg%3e");
  --bs-accordion-btn-icon-width: 1.25rem;
  --bs-accordion-btn-icon-transform: rotate(-180deg);
  --bs-accordion-btn-icon-transition: transform 0.2s ease-in-out;
-  --bs-accordion-btn-active-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='%23052c65' stroke-linecap='round' stroke-linejoin='round'%3e%3cpath d='m2 5 6 6 6-6'/%3e%3c/svg%3e");
+  --bs-accordion-btn-active-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='%23052c65' stroke-linecap='round' stroke-linejoin='round'%3e%3cpath d='M2 5L8 11L14 5'/%3e%3c/svg%3e");
  --bs-accordion-btn-focus-box-shadow: 0 0 0 0.25rem rgba(13, 110, 253, 0.25);
  --bs-accordion-body-padding-x: 1.25rem;
  --bs-accordion-body-padding-y: 1rem;
@@ -4665,15 +4690,16 @@ textarea.form-control-lg {
 .accordion-flush > .accordion-item:last-child {
  border-bottom: 0;
 }
-.accordion-flush > .accordion-item > .accordion-collapse,
-.accordion-flush > .accordion-item > .accordion-header .accordion-button,
-.accordion-flush > .accordion-item > .accordion-header .accordion-button.collapsed {
+.accordion-flush > .accordion-item > .accordion-header .accordion-button, .accordion-flush > .accordion-item > .accordion-header .accordion-button.collapsed {
+  border-radius: 0;
+}
+.accordion-flush > .accordion-item > .accordion-collapse {
  border-radius: 0;
 }

 [data-bs-theme=dark] .accordion-button::after {
-  --bs-accordion-btn-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%236ea8fe'%3e%3cpath fill-rule='evenodd' d='M1.646 4.646a.5.5 0 0 1 .708 0L8 10.293l5.646-5.647a.5.5 0 0 1 .708.708l-6 6a.5.5 0 0 1-.708 0l-6-6a.5.5 0 0 1 0-.708'/%3e%3c/svg%3e");
-  --bs-accordion-btn-active-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%236ea8fe'%3e%3cpath fill-rule='evenodd' d='M1.646 4.646a.5.5 0 0 1 .708 0L8 10.293l5.646-5.647a.5.5 0 0 1 .708.708l-6 6a.5.5 0 0 1-.708 0l-6-6a.5.5 0 0 1 0-.708'/%3e%3c/svg%3e");
+  --bs-accordion-btn-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%236ea8fe'%3e%3cpath fill-rule='evenodd' d='M1.646 4.646a.5.5 0 0 1 .708 0L8 10.293l5.646-5.647a.5.5 0 0 1 .708.708l-6 6a.5.5 0 0 1-.708 0l-6-6a.5.5 0 0 1 0-.708z'/%3e%3c/svg%3e");
+  --bs-accordion-btn-active-icon: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%236ea8fe'%3e%3cpath fill-rule='evenodd' d='M1.646 4.646a.5.5 0 0 1 .708 0L8 10.293l5.646-5.647a.5.5 0 0 1 .708.708l-6 6a.5.5 0 0 1-.708 0l-6-6a.5.5 0 0 1 0-.708z'/%3e%3c/svg%3e");
 }

 .breadcrumb {
@@ -4777,7 +4803,7 @@ textarea.form-control-lg {
 }

 .page-item:not(:first-child) .page-link {
-  margin-left: calc(-1 * var(--bs-border-width));
+  margin-left: calc(var(--bs-border-width) * -1);
 }
 .page-item:first-child .page-link {
  border-top-left-radius: var(--bs-pagination-border-radius);
@@ -4926,7 +4952,7 @@ textarea.form-control-lg {

@keyframes progress-bar-stripes {
  0% {
-    background-position-x: var(--bs-progress-height);
+    background-position-x: 1rem;
  }
 }
 .progress,
@@ -5020,6 +5046,22 @@ textarea.form-control-lg {
  counter-increment: section;
 }

+.list-group-item-action {
+  width: 100%;
+  color: var(--bs-list-group-action-color);
+  text-align: inherit;
+}
+.list-group-item-action:hover, .list-group-item-action:focus {
+  z-index: 1;
+  color: var(--bs-list-group-action-hover-color);
+  text-decoration: none;
+  background-color: var(--bs-list-group-action-hover-bg);
+}
+.list-group-item-action:active {
+  color: var(--bs-list-group-action-active-color);
+  background-color: var(--bs-list-group-action-active-bg);
+}
+
 .list-group-item {
  position: relative;
  display: block;
@@ -5056,22 +5098,6 @@ textarea.form-control-lg {
  border-top-width: var(--bs-list-group-border-width);
 }

-.list-group-item-action {
-  width: 100%;
-  color: var(--bs-list-group-action-color);
-  text-align: inherit;
-}
-.list-group-item-action:not(.active):hover, .list-group-item-action:not(.active):focus {
-  z-index: 1;
-  color: var(--bs-list-group-action-hover-color);
-  text-decoration: none;
-  background-color: var(--bs-list-group-action-hover-bg);
-}
-.list-group-item-action:not(.active):active {
-  color: var(--bs-list-group-action-active-color);
-  background-color: var(--bs-list-group-action-active-bg);
-}
-
 .list-group-horizontal {
  flex-direction: row;
 }
@@ -5331,19 +5357,19 @@ textarea.form-control-lg {

 .btn-close {
  --bs-btn-close-color: #000;
-  --bs-btn-close-bg: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23000'%3e%3cpath d='M.293.293a1 1 0 0 1 1.414 0L8 6.586 14.293.293a1 1 0 1 1 1.414 1.414L9.414 8l6.293 6.293a1 1 0 0 1-1.414 1.414L8 9.414l-6.293 6.293a1 1 0 0 1-1.414-1.414L6.586 8 .293 1.707a1 1 0 0 1 0-1.414'/%3e%3c/svg%3e");
+  --bs-btn-close-bg: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23000'%3e%3cpath d='M.293.293a1 1 0 0 1 1.414 0L8 6.586 14.293.293a1 1 0 1 1 1.414 1.414L9.414 8l6.293 6.293a1 1 0 0 1-1.414 1.414L8 9.414l-6.293 6.293a1 1 0 0 1-1.414-1.414L6.586 8 .293 1.707a1 1 0 0 1 0-1.414z'/%3e%3c/svg%3e");
  --bs-btn-close-opacity: 0.5;
  --bs-btn-close-hover-opacity: 0.75;
  --bs-btn-close-focus-shadow: 0 0 0 0.25rem rgba(13, 110, 253, 0.25);
  --bs-btn-close-focus-opacity: 1;
  --bs-btn-close-disabled-opacity: 0.25;
+  --bs-btn-close-white-filter: invert(1) grayscale(100%) brightness(200%);
  box-sizing: content-box;
  width: 1em;
  height: 1em;
  padding: 0.25em 0.25em;
  color: var(--bs-btn-close-color);
  background: transparent var(--bs-btn-close-bg) center/1em auto no-repeat;
-  filter: var(--bs-btn-close-filter);
  border: 0;
  border-radius: 0.375rem;
  opacity: var(--bs-btn-close-opacity);
@@ -5367,16 +5393,11 @@ textarea.form-control-lg {
 }

 .btn-close-white {
-  --bs-btn-close-filter: invert(1) grayscale(100%) brightness(200%);
+  filter: var(--bs-btn-close-white-filter);
 }

-:root,
-[data-bs-theme=light] {
-  --bs-btn-close-filter: ;
-}
-
-[data-bs-theme=dark] {
-  --bs-btn-close-filter: invert(1) grayscale(100%) brightness(200%);
+[data-bs-theme=dark] .btn-close {
+  filter: var(--bs-btn-close-white-filter);
 }

 .toast {
@@ -5453,7 +5474,7 @@ textarea.form-control-lg {
  --bs-modal-width: 500px;
  --bs-modal-padding: 1rem;
  --bs-modal-margin: 0.5rem;
-  --bs-modal-color: var(--bs-body-color);
+  --bs-modal-color: ;
  --bs-modal-bg: var(--bs-body-bg);
  --bs-modal-border-color: var(--bs-border-color-translucent);
  --bs-modal-border-width: var(--bs-border-width);
@@ -5489,8 +5510,8 @@ textarea.form-control-lg {
  pointer-events: none;
 }
 .modal.fade .modal-dialog {
-  transform: translate(0, -50px);
  transition: transform 0.3s ease-out;
+  transform: translate(0, -50px);
 }
@media (prefers-reduced-motion: reduce) {
  .modal.fade .modal-dialog {
@@ -5565,10 +5586,7 @@ textarea.form-control-lg {
 }
 .modal-header .btn-close {
  padding: calc(var(--bs-modal-header-padding-y) * 0.5) calc(var(--bs-modal-header-padding-x) * 0.5);
-  margin-top: calc(-0.5 * var(--bs-modal-header-padding-y));
-  margin-right: calc(-0.5 * var(--bs-modal-header-padding-x));
-  margin-bottom: calc(-0.5 * var(--bs-modal-header-padding-y));
-  margin-left: auto;
+  margin: calc(-0.5 * var(--bs-modal-header-padding-y)) calc(-0.5 * var(--bs-modal-header-padding-x)) calc(-0.5 * var(--bs-modal-header-padding-y)) auto;
 }

 .modal-title {
@@ -6089,7 +6107,6 @@ textarea.form-control-lg {
  color: #fff;
  text-align: center;
  background: none;
-  filter: var(--bs-carousel-control-icon-filter);
  border: 0;
  opacity: 0.5;
  transition: opacity 0.15s ease;
@@ -6128,11 +6145,11 @@ textarea.form-control-lg {
 }

 .carousel-control-prev-icon {
-  background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M11.354 1.646a.5.5 0 0 1 0 .708L5.707 8l5.647 5.646a.5.5 0 0 1-.708.708l-6-6a.5.5 0 0 1 0-.708l6-6a.5.5 0 0 1 .708 0'/%3e%3c/svg%3e") /*rtl:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M4.646 1.646a.5.5 0 0 1 .708 0l6 6a.5.5 0 0 1 0 .708l-6 6a.5.5 0 0 1-.708-.708L10.293 8 4.646 2.354a.5.5 0 0 1 0-.708'/%3e%3c/svg%3e")*/;
+  background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M11.354 1.646a.5.5 0 0 1 0 .708L5.707 8l5.647 5.646a.5.5 0 0 1-.708.708l-6-6a.5.5 0 0 1 0-.708l6-6a.5.5 0 0 1 .708 0z'/%3e%3c/svg%3e") /*rtl:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M4.646 1.646a.5.5 0 0 1 .708 0l6 6a.5.5 0 0 1 0 .708l-6 6a.5.5 0 0 1-.708-.708L10.293 8 4.646 2.354a.5.5 0 0 1 0-.708z'/%3e%3c/svg%3e")*/;
 }

 .carousel-control-next-icon {
-  background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M4.646 1.646a.5.5 0 0 1 .708 0l6 6a.5.5 0 0 1 0 .708l-6 6a.5.5 0 0 1-.708-.708L10.293 8 4.646 2.354a.5.5 0 0 1 0-.708'/%3e%3c/svg%3e") /*rtl:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M11.354 1.646a.5.5 0 0 1 0 .708L5.707 8l5.647 5.646a.5.5 0 0 1-.708.708l-6-6a.5.5 0 0 1 0-.708l6-6a.5.5 0 0 1 .708 0'/%3e%3c/svg%3e")*/;
+  background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M4.646 1.646a.5.5 0 0 1 .708 0l6 6a.5.5 0 0 1 0 .708l-6 6a.5.5 0 0 1-.708-.708L10.293 8 4.646 2.354a.5.5 0 0 1 0-.708z'/%3e%3c/svg%3e") /*rtl:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M11.354 1.646a.5.5 0 0 1 0 .708L5.707 8l5.647 5.646a.5.5 0 0 1-.708.708l-6-6a.5.5 0 0 1 0-.708l6-6a.5.5 0 0 1 .708 0z'/%3e%3c/svg%3e")*/;
 }

 .carousel-indicators {
@@ -6158,7 +6175,7 @@ textarea.form-control-lg {
  margin-left: 3px;
  text-indent: -999px;
  cursor: pointer;
-  background-color: var(--bs-carousel-indicator-active-bg);
+  background-color: #fff;
  background-clip: padding-box;
  border: 0;
  border-top: 10px solid transparent;
@@ -6182,27 +6199,31 @@ textarea.form-control-lg {
  left: 15%;
  padding-top: 1.25rem;
  padding-bottom: 1.25rem;
-  color: var(--bs-carousel-caption-color);
+  color: #fff;
  text-align: center;
 }

-.carousel-dark {
-  --bs-carousel-indicator-active-bg: #000;
-  --bs-carousel-caption-color: #000;
-  --bs-carousel-control-icon-filter: invert(1) grayscale(100);
+.carousel-dark .carousel-control-prev-icon,
+.carousel-dark .carousel-control-next-icon {
+  filter: invert(1) grayscale(100);
+}
+.carousel-dark .carousel-indicators [data-bs-target] {
+  background-color: #000;
+}
+.carousel-dark .carousel-caption {
+  color: #000;
 }

-:root,
-[data-bs-theme=light] {
-  --bs-carousel-indicator-active-bg: #fff;
-  --bs-carousel-caption-color: #fff;
-  --bs-carousel-control-icon-filter: ;
+[data-bs-theme=dark] .carousel .carousel-control-prev-icon,
+[data-bs-theme=dark] .carousel .carousel-control-next-icon, [data-bs-theme=dark].carousel .carousel-control-prev-icon,
+[data-bs-theme=dark].carousel .carousel-control-next-icon {
+  filter: invert(1) grayscale(100);
 }
-
-[data-bs-theme=dark] {
-  --bs-carousel-indicator-active-bg: #000;
-  --bs-carousel-caption-color: #000;
-  --bs-carousel-control-icon-filter: invert(1) grayscale(100);
+[data-bs-theme=dark] .carousel .carousel-indicators [data-bs-target], [data-bs-theme=dark].carousel .carousel-indicators [data-bs-target] {
+  background-color: #000;
+}
+[data-bs-theme=dark] .carousel .carousel-caption, [data-bs-theme=dark].carousel .carousel-caption {
+  color: #000;
 }

 .spinner-grow,
@@ -6752,10 +6773,7 @@ textarea.form-control-lg {
 }
 .offcanvas-header .btn-close {
  padding: calc(var(--bs-offcanvas-padding-y) * 0.5) calc(var(--bs-offcanvas-padding-x) * 0.5);
-  margin-top: calc(-0.5 * var(--bs-offcanvas-padding-y));
-  margin-right: calc(-0.5 * var(--bs-offcanvas-padding-x));
-  margin-bottom: calc(-0.5 * var(--bs-offcanvas-padding-y));
-  margin-left: auto;
+  margin: calc(-0.5 * var(--bs-offcanvas-padding-y)) calc(-0.5 * var(--bs-offcanvas-padding-x)) calc(-0.5 * var(--bs-offcanvas-padding-y)) auto;
 }

 .offcanvas-title {
@@ -7156,10 +7174,6 @@ textarea.form-control-lg {
 .visually-hidden-focusable:not(:focus):not(:focus-within):not(caption) {
  position: absolute !important;
 }
-.visually-hidden *,
-.visually-hidden-focusable:not(:focus):not(:focus-within) * {
-  overflow: hidden !important;
-}

 .stretched-link::after {
  position: absolute;
--- a/src/static/scripts/datatables.css
+++ b/src/static/scripts/datatables.css
@@ -4,12 +4,13 @@
 *
 * To rebuild or modify this file with the latest versions of the included
 * software please visit:
- *   https://datatables.net/download/#bs5/dt-2.3.2
+ *   https://datatables.net/download/#bs5/dt-2.0.8
 *
 * Included libraries:
- *   DataTables 2.3.2
+ *   DataTables 2.0.8
 */

+@charset "UTF-8";
 :root {
  --dt-row-selected: 13, 110, 253;
  --dt-row-selected-text: 255, 255, 255;
@@ -17,18 +18,17 @@
  --dt-row-stripe: 0, 0, 0;
  --dt-row-hover: 0, 0, 0;
  --dt-column-ordering: 0, 0, 0;
-  --dt-header-align-items: center;
  --dt-html-background: white;
 }
 :root.dark {
  --dt-html-background: rgb(33, 37, 41);
 }

-table.dataTable tbody td.dt-control {
+table.dataTable td.dt-control {
  text-align: center;
  cursor: pointer;
 }
-table.dataTable tbody td.dt-control:before {
+table.dataTable td.dt-control:before {
  display: inline-block;
  box-sizing: border-box;
  content: "";
@@ -37,32 +37,23 @@ table.dataTable tbody td.dt-control:before {
  border-bottom: 5px solid transparent;
  border-right: 0px solid transparent;
 }
-table.dataTable tbody tr.dt-hasChild td.dt-control:before {
+table.dataTable tr.dt-hasChild td.dt-control:before {
  border-top: 10px solid rgba(0, 0, 0, 0.5);
  border-left: 5px solid transparent;
  border-bottom: 0px solid transparent;
  border-right: 5px solid transparent;
 }
-table.dataTable tfoot:empty {
-  display: none;
-}

 html.dark table.dataTable td.dt-control:before,
-:root[data-bs-theme=dark] table.dataTable td.dt-control:before,
-:root[data-theme=dark] table.dataTable td.dt-control:before {
+:root[data-bs-theme=dark] table.dataTable td.dt-control:before {
  border-left-color: rgba(255, 255, 255, 0.5);
 }
 html.dark table.dataTable tr.dt-hasChild td.dt-control:before,
-:root[data-bs-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before,
-:root[data-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before {
+:root[data-bs-theme=dark] table.dataTable tr.dt-hasChild td.dt-control:before {
  border-top-color: rgba(255, 255, 255, 0.5);
  border-left-color: transparent;
 }

-div.dt-scroll {
-  width: 100%;
-}
-
 div.dt-scroll-body thead tr,
 div.dt-scroll-body tfoot tr {
  height: 0;
@@ -93,8 +84,8 @@ table.dataTable thead > tr > td.dt-ordering-asc span.dt-column-order:before {
  position: absolute;
  display: block;
  bottom: 50%;
-  content: "\25B2";
-  content: "\25B2"/"";
+  content: "▲";
+  content: "▲"/"";
 }
 table.dataTable thead > tr > th.dt-orderable-desc span.dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-desc span.dt-column-order:after,
 table.dataTable thead > tr > td.dt-orderable-desc span.dt-column-order:after,
@@ -102,17 +93,27 @@ table.dataTable thead > tr > td.dt-ordering-desc span.dt-column-order:after {
  position: absolute;
  display: block;
  top: 50%;
-  content: "\25BC";
-  content: "\25BC"/"";
+  content: "▼";
+  content: "▼"/"";
+}
+table.dataTable thead > tr > th.dt-orderable-asc, table.dataTable thead > tr > th.dt-orderable-desc, table.dataTable thead > tr > th.dt-ordering-asc, table.dataTable thead > tr > th.dt-ordering-desc,
+table.dataTable thead > tr > td.dt-orderable-asc,
+table.dataTable thead > tr > td.dt-orderable-desc,
+table.dataTable thead > tr > td.dt-ordering-asc,
+table.dataTable thead > tr > td.dt-ordering-desc {
+  position: relative;
+  padding-right: 30px;
 }
 table.dataTable thead > tr > th.dt-orderable-asc span.dt-column-order, table.dataTable thead > tr > th.dt-orderable-desc span.dt-column-order, table.dataTable thead > tr > th.dt-ordering-asc span.dt-column-order, table.dataTable thead > tr > th.dt-ordering-desc span.dt-column-order,
 table.dataTable thead > tr > td.dt-orderable-asc span.dt-column-order,
 table.dataTable thead > tr > td.dt-orderable-desc span.dt-column-order,
 table.dataTable thead > tr > td.dt-ordering-asc span.dt-column-order,
 table.dataTable thead > tr > td.dt-ordering-desc span.dt-column-order {
-  position: relative;
+  position: absolute;
+  right: 12px;
+  top: 0;
+  bottom: 0;
  width: 12px;
-  height: 20px;
 }
 table.dataTable thead > tr > th.dt-orderable-asc span.dt-column-order:before, table.dataTable thead > tr > th.dt-orderable-asc span.dt-column-order:after, table.dataTable thead > tr > th.dt-orderable-desc span.dt-column-order:before, table.dataTable thead > tr > th.dt-orderable-desc span.dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-asc span.dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-asc span.dt-column-order:after, table.dataTable thead > tr > th.dt-ordering-desc span.dt-column-order:before, table.dataTable thead > tr > th.dt-ordering-desc span.dt-column-order:after,
 table.dataTable thead > tr > td.dt-orderable-asc span.dt-column-order:before,
@@ -154,40 +155,6 @@ table.dataTable thead > tr > td:active {
  outline: none;
 }

-table.dataTable thead > tr > th div.dt-column-header,
-table.dataTable thead > tr > th div.dt-column-footer,
-table.dataTable thead > tr > td div.dt-column-header,
-table.dataTable thead > tr > td div.dt-column-footer,
-table.dataTable tfoot > tr > th div.dt-column-header,
-table.dataTable tfoot > tr > th div.dt-column-footer,
-table.dataTable tfoot > tr > td div.dt-column-header,
-table.dataTable tfoot > tr > td div.dt-column-footer {
-  display: flex;
-  justify-content: space-between;
-  align-items: var(--dt-header-align-items);
-  gap: 4px;
-}
-table.dataTable thead > tr > th div.dt-column-header span.dt-column-title,
-table.dataTable thead > tr > th div.dt-column-footer span.dt-column-title,
-table.dataTable thead > tr > td div.dt-column-header span.dt-column-title,
-table.dataTable thead > tr > td div.dt-column-footer span.dt-column-title,
-table.dataTable tfoot > tr > th div.dt-column-header span.dt-column-title,
-table.dataTable tfoot > tr > th div.dt-column-footer span.dt-column-title,
-table.dataTable tfoot > tr > td div.dt-column-header span.dt-column-title,
-table.dataTable tfoot > tr > td div.dt-column-footer span.dt-column-title {
-  flex-grow: 1;
-}
-table.dataTable thead > tr > th div.dt-column-header span.dt-column-title:empty,
-table.dataTable thead > tr > th div.dt-column-footer span.dt-column-title:empty,
-table.dataTable thead > tr > td div.dt-column-header span.dt-column-title:empty,
-table.dataTable thead > tr > td div.dt-column-footer span.dt-column-title:empty,
-table.dataTable tfoot > tr > th div.dt-column-header span.dt-column-title:empty,
-table.dataTable tfoot > tr > th div.dt-column-footer span.dt-column-title:empty,
-table.dataTable tfoot > tr > td div.dt-column-header span.dt-column-title:empty,
-table.dataTable tfoot > tr > td div.dt-column-footer span.dt-column-title:empty {
-  display: none;
-}
-
 div.dt-scroll-body > table.dataTable > thead > tr > th,
 div.dt-scroll-body > table.dataTable > thead > tr > td {
  overflow: hidden;
@@ -278,30 +245,10 @@ table.dataTable th,
 table.dataTable td {
  box-sizing: border-box;
 }
-table.dataTable th.dt-type-numeric, table.dataTable th.dt-type-date,
-table.dataTable td.dt-type-numeric,
-table.dataTable td.dt-type-date {
-  text-align: right;
-}
-table.dataTable th.dt-type-numeric div.dt-column-header,
-table.dataTable th.dt-type-numeric div.dt-column-footer, table.dataTable th.dt-type-date div.dt-column-header,
-table.dataTable th.dt-type-date div.dt-column-footer,
-table.dataTable td.dt-type-numeric div.dt-column-header,
-table.dataTable td.dt-type-numeric div.dt-column-footer,
-table.dataTable td.dt-type-date div.dt-column-header,
-table.dataTable td.dt-type-date div.dt-column-footer {
-  flex-direction: row-reverse;
-}
 table.dataTable th.dt-left,
 table.dataTable td.dt-left {
  text-align: left;
 }
-table.dataTable th.dt-left div.dt-column-header,
-table.dataTable th.dt-left div.dt-column-footer,
-table.dataTable td.dt-left div.dt-column-header,
-table.dataTable td.dt-left div.dt-column-footer {
-  flex-direction: row;
-}
 table.dataTable th.dt-center,
 table.dataTable td.dt-center {
  text-align: center;
@@ -310,22 +257,10 @@ table.dataTable th.dt-right,
 table.dataTable td.dt-right {
  text-align: right;
 }
-table.dataTable th.dt-right div.dt-column-header,
-table.dataTable th.dt-right div.dt-column-footer,
-table.dataTable td.dt-right div.dt-column-header,
-table.dataTable td.dt-right div.dt-column-footer {
-  flex-direction: row-reverse;
-}
 table.dataTable th.dt-justify,
 table.dataTable td.dt-justify {
  text-align: justify;
 }
-table.dataTable th.dt-justify div.dt-column-header,
-table.dataTable th.dt-justify div.dt-column-footer,
-table.dataTable td.dt-justify div.dt-column-header,
-table.dataTable td.dt-justify div.dt-column-footer {
-  flex-direction: row;
-}
 table.dataTable th.dt-nowrap,
 table.dataTable td.dt-nowrap {
  white-space: nowrap;
@@ -335,6 +270,11 @@ table.dataTable td.dt-empty {
  text-align: center;
  vertical-align: top;
 }
+table.dataTable th.dt-type-numeric, table.dataTable th.dt-type-date,
+table.dataTable td.dt-type-numeric,
+table.dataTable td.dt-type-date {
+  text-align: right;
+}
 table.dataTable thead th,
 table.dataTable thead td,
 table.dataTable tfoot th,
@@ -347,16 +287,6 @@ table.dataTable tfoot th.dt-head-left,
 table.dataTable tfoot td.dt-head-left {
  text-align: left;
 }
-table.dataTable thead th.dt-head-left div.dt-column-header,
-table.dataTable thead th.dt-head-left div.dt-column-footer,
-table.dataTable thead td.dt-head-left div.dt-column-header,
-table.dataTable thead td.dt-head-left div.dt-column-footer,
-table.dataTable tfoot th.dt-head-left div.dt-column-header,
-table.dataTable tfoot th.dt-head-left div.dt-column-footer,
-table.dataTable tfoot td.dt-head-left div.dt-column-header,
-table.dataTable tfoot td.dt-head-left div.dt-column-footer {
-  flex-direction: row;
-}
 table.dataTable thead th.dt-head-center,
 table.dataTable thead td.dt-head-center,
 table.dataTable tfoot th.dt-head-center,
@@ -369,32 +299,12 @@ table.dataTable tfoot th.dt-head-right,
 table.dataTable tfoot td.dt-head-right {
  text-align: right;
 }
-table.dataTable thead th.dt-head-right div.dt-column-header,
-table.dataTable thead th.dt-head-right div.dt-column-footer,
-table.dataTable thead td.dt-head-right div.dt-column-header,
-table.dataTable thead td.dt-head-right div.dt-column-footer,
-table.dataTable tfoot th.dt-head-right div.dt-column-header,
-table.dataTable tfoot th.dt-head-right div.dt-column-footer,
-table.dataTable tfoot td.dt-head-right div.dt-column-header,
-table.dataTable tfoot td.dt-head-right div.dt-column-footer {
-  flex-direction: row-reverse;
-}
 table.dataTable thead th.dt-head-justify,
 table.dataTable thead td.dt-head-justify,
 table.dataTable tfoot th.dt-head-justify,
 table.dataTable tfoot td.dt-head-justify {
  text-align: justify;
 }
-table.dataTable thead th.dt-head-justify div.dt-column-header,
-table.dataTable thead th.dt-head-justify div.dt-column-footer,
-table.dataTable thead td.dt-head-justify div.dt-column-header,
-table.dataTable thead td.dt-head-justify div.dt-column-footer,
-table.dataTable tfoot th.dt-head-justify div.dt-column-header,
-table.dataTable tfoot th.dt-head-justify div.dt-column-footer,
-table.dataTable tfoot td.dt-head-justify div.dt-column-header,
-table.dataTable tfoot td.dt-head-justify div.dt-column-footer {
-  flex-direction: row;
-}
 table.dataTable thead th.dt-head-nowrap,
 table.dataTable thead td.dt-head-nowrap,
 table.dataTable tfoot th.dt-head-nowrap,
@@ -422,10 +332,6 @@ table.dataTable tbody td.dt-body-nowrap {
  white-space: nowrap;
 }

-:root {
-  --dt-header-align-items: flex-end;
-}
-
 /*! Bootstrap 5 integration for DataTables
 *
 * ©2020 SpryMedia Ltd, all rights reserved.
@@ -471,34 +377,6 @@ table.table.dataTable.table-hover > tbody > tr.selected:hover > * {
  box-shadow: inset 0 0 0 9999px rgba(var(--dt-row-selected), 0.975);
 }

-div.dt-container div.dt-layout-start > *:not(:last-child) {
-  margin-right: 1em;
-}
-div.dt-container div.dt-layout-end > *:not(:first-child) {
-  margin-left: 1em;
-}
-div.dt-container div.dt-layout-full {
-  width: 100%;
-}
-div.dt-container div.dt-layout-full > *:only-child {
-  margin-left: auto;
-  margin-right: auto;
-}
-div.dt-container div.dt-layout-table > div {
-  display: block !important;
-}
-
-@media screen and (max-width: 767px) {
-  div.dt-container div.dt-layout-start > *:not(:last-child) {
-    margin-right: 0;
-  }
-  div.dt-container div.dt-layout-end > *:not(:first-child) {
-    margin-left: 0;
-  }
-}
-div.dt-container {
-  position: relative;
-}
 div.dt-container div.dt-length label {
  font-weight: normal;
  text-align: left;
@@ -522,6 +400,9 @@ div.dt-container div.dt-search input {
  display: inline-block;
  width: auto;
 }
+div.dt-container div.dt-info {
+  padding-top: 0.85em;
+}
 div.dt-container div.dt-paging {
  margin: 0;
 }
@@ -587,19 +468,14 @@ table.dataTable.table-sm > thead > tr td.dt-orderable-asc,
 table.dataTable.table-sm > thead > tr td.dt-orderable-desc,
 table.dataTable.table-sm > thead > tr td.dt-ordering-asc,
 table.dataTable.table-sm > thead > tr td.dt-ordering-desc {
-  padding-right: 0.25rem;
+  padding-right: 20px;
 }
 table.dataTable.table-sm > thead > tr th.dt-orderable-asc span.dt-column-order, table.dataTable.table-sm > thead > tr th.dt-orderable-desc span.dt-column-order, table.dataTable.table-sm > thead > tr th.dt-ordering-asc span.dt-column-order, table.dataTable.table-sm > thead > tr th.dt-ordering-desc span.dt-column-order,
 table.dataTable.table-sm > thead > tr td.dt-orderable-asc span.dt-column-order,
 table.dataTable.table-sm > thead > tr td.dt-orderable-desc span.dt-column-order,
 table.dataTable.table-sm > thead > tr td.dt-ordering-asc span.dt-column-order,
 table.dataTable.table-sm > thead > tr td.dt-ordering-desc span.dt-column-order {
-  right: 0.25rem;
-}
-table.dataTable.table-sm > thead > tr th.dt-type-date span.dt-column-order, table.dataTable.table-sm > thead > tr th.dt-type-numeric span.dt-column-order,
-table.dataTable.table-sm > thead > tr td.dt-type-date span.dt-column-order,
-table.dataTable.table-sm > thead > tr td.dt-type-numeric span.dt-column-order {
-  left: 0.25rem;
+  right: 5px;
 }

 div.dt-scroll-head table.table-bordered {
--- a/src/static/scripts/datatables.js
+++ b/src/static/scripts/datatables.js
--- a/Show More
+++ b/Show More