Fix archiveDate update (#7722)

When `archiveDate` is set to `null` it should unarchive it for that
specific user, which is what Bitwarden does.

This should fix this by checking and validating if it is `null`

Fixes #7581

Signed-off-by: BlackDex <black.dex@gmail.com>

Cargo.lock

@@ -3520,6 +3520,20 @@ dependencies = [
  "web-time",
 ]
 
+[[package]]
+name = "opendal-http-transport-reqwest"
+version = "0.59.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "401999057db611e592f883fcf2cbd6754ff37af587deaadd07b8c1398b2b6b06"
+dependencies = [
+ "bytes",
+ "futures",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "opendal-core",
+ "reqwest",
+]
+
 [[package]]
 name = "opendal-service-fs"
 version = "0.59.1"
@@ -5989,6 +6003,7 @@ dependencies = [
  "num-derive",
  "num-traits",
  "opendal",
+ "opendal-http-transport-reqwest",
  "openidconnect",
  "openssl",
  "pastey 0.2.3",

Cargo.toml

@@ -40,6 +40,7 @@ vendored_openssl = ["openssl/vendored"]
 enable_mimalloc = ["dep:mimalloc"]
 s3 = [
     "opendal/services-s3",
+    "dep:opendal-http-transport-reqwest",
     "dep:aws-config",
     "dep:aws-credential-types",
     "dep:aws-smithy-runtime-api",
@@ -257,6 +258,7 @@ grass_compiler = { version = "0.13.4", default-features = false }
 
 # File are accessed through Apache OpenDAL
 opendal = { version = "0.59.1", default-features = false, features = ["services-fs"] }
+opendal-http-transport-reqwest = { version = "0.59.1", default-features = false, features = ["rustls-no-provider"], optional = true }
 
 # For retrieving AWS credentials, including temporary SSO credentials
 aws-config = { version = "1.12.0", optional = true, default-features = false, features = [

src/api/core/accounts.rs

@@ -1611,7 +1611,7 @@ async fn post_auth_request(
         _ => err!("AuthRequest doesn't exist", "Device verification failed"),
     };
 
-    let mut auth_request = AuthRequest::new(
+    let auth_request = AuthRequest::new(
         user.uuid.clone(),
         data.device_identifier.clone(),
         client_headers.device_type,

src/api/core/ciphers.rs

@@ -537,11 +537,12 @@ pub async fn update_cipher_from_data(
     cipher.move_to_folder(data.folder_id, &headers.user.uuid, conn).await?;
     cipher.set_favorite(data.favorite, &headers.user.uuid, conn).await?;
 
-    if let Some(dt_str) = data.archived_date {
-        match NaiveDateTime::parse_from_str(&dt_str, "%+") {
+    match data.archived_date {
+        Some(dt_str) => match NaiveDateTime::parse_from_str(&dt_str, "%+") {
             Ok(dt) => cipher.set_archived_at(dt, &headers.user.uuid, conn).await?,
             Err(err) => warn!("Error parsing ArchivedDate '{dt_str}': {err}"),
-        }
+        },
+        None => cipher.unarchive(&headers.user.uuid, conn).await?,
     }
 
     if ut != UpdateType::None {

src/api/identity.rs

@@ -3,7 +3,7 @@ use num_traits::FromPrimitive;
 use rocket::{
     Route,
     form::{Form, FromForm},
-    http::{Cookie, CookieJar, SameSite},
+    http::{Accept, Cookie, CookieJar, MediaType, SameSite},
     response::Redirect,
     serde::json::Json,
 };
@@ -1083,11 +1083,18 @@ enum RegisterVerificationResponse {
     #[response(status = 204)]
     NoContent(()),
     Token(Json<String>),
+    PlainToken(String),
+}
+
+// Return JSON only when the client explicitly requests it, otherwise return plain text.
+fn accepts_json(accept: Option<&Accept>) -> bool {
+    accept.is_some_and(|accept| accept.preferred().media_type() == &MediaType::JSON)
 }
 
 #[post("/accounts/register/send-verification-email", data = "<data>")]
 async fn register_verification_email(
     data: Json<RegisterVerificationData>,
+    accept: Option<&Accept>,
     ip: ClientIp,
     conn: DbConn,
 ) -> ApiResult<RegisterVerificationResponse> {
@@ -1125,7 +1132,11 @@ async fn register_verification_email(
     } else {
         // If email verification is not required, return the token directly
         // the clients will use this token to finish the registration
-        Ok(RegisterVerificationResponse::Token(Json(token)))
+        Ok(if accepts_json(accept) {
+            RegisterVerificationResponse::Token(Json(token))
+        } else {
+            RegisterVerificationResponse::PlainToken(token)
+        })
     }
 }
 

src/db/models/archive.rs

@@ -41,17 +41,20 @@ impl Archive {
     ) -> EmptyResult {
         User::update_uuid_revision(user_uuid, conn).await;
         db_run! { conn:
-            sqlite, mysql {
-                diesel::replace_into(archives::table)
+            mysql {
+                diesel::insert_into(archives::table)
                     .values((
                         archives::user_uuid.eq(user_uuid),
                         archives::cipher_uuid.eq(cipher_uuid),
                         archives::archived_at.eq(archived_at),
                     ))
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(archives::archived_at.eq(archived_at))
                     .execute(conn)
                     .map_res("Error saving archive")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(archives::table)
                     .values((
                         archives::user_uuid.eq(user_uuid),

src/db/models/attachment.rs

@@ -82,24 +82,16 @@ impl Attachment {
 impl Attachment {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(attachments::table)
+            mysql {
+                diesel::insert_into(attachments::table)
                     .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(attachments::table)
-                            .filter(attachments::id.eq(&self.id))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error saving attachment")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving attachment")
+                    .map_res("Error saving attachment")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(attachments::table)
                     .values(self)
                     .on_conflict(attachments::id)

src/db/models/auth_request.rs

@@ -82,31 +82,23 @@ impl AuthRequest {
 }
 
 impl AuthRequest {
-    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
+    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(auth_requests::table)
-                    .values(&*self)
-                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(auth_requests::table)
-                            .filter(auth_requests::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error auth_request")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error auth_request")
-            }
-            postgresql {
+            mysql {
                 diesel::insert_into(auth_requests::table)
-                    .values(&*self)
+                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
+                    .execute(conn)
+                    .map_res("Error saving auth_request")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(auth_requests::table)
+                    .values(self)
                     .on_conflict(auth_requests::uuid)
                     .do_update()
-                    .set(&*self)
+                    .set(self)
                     .execute(conn)
                     .map_res("Error saving auth_request")
             }

src/db/models/cipher.rs

@@ -440,24 +440,16 @@ impl Cipher {
         self.updated_at = Utc::now().naive_utc();
 
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(ciphers::table)
+            mysql {
+                diesel::insert_into(ciphers::table)
                     .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(ciphers::table)
-                            .filter(ciphers::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error saving cipher")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving cipher")
+                    .map_res("Error saving cipher")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(ciphers::table)
                     .values(&*self)
                     .on_conflict(ciphers::uuid)

src/db/models/collection.rs

@@ -168,24 +168,16 @@ impl Collection {
         self.update_users_revision(conn).await;
 
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(collections::table)
+            mysql {
+                diesel::insert_into(collections::table)
                     .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(collections::table)
-                            .filter(collections::uuid.eq(&self.uuid))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error saving collection")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving collection")
+                    .map_res("Error saving collection")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(collections::table)
                     .values(self)
                     .on_conflict(collections::uuid)
@@ -728,53 +720,30 @@ impl CollectionUser {
     ) -> EmptyResult {
         User::update_uuid_revision(user_uuid, conn).await;
 
+        let values = (
+            users_collections::user_uuid.eq(user_uuid),
+            users_collections::collection_uuid.eq(collection_uuid),
+            users_collections::read_only.eq(read_only),
+            users_collections::hide_passwords.eq(hide_passwords),
+            users_collections::manage.eq(manage),
+        );
+
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(users_collections::table)
-                    .values((
-                        users_collections::user_uuid.eq(user_uuid),
-                        users_collections::collection_uuid.eq(collection_uuid),
-                        users_collections::read_only.eq(read_only),
-                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
-                    ))
-                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(users_collections::table)
-                            .filter(users_collections::user_uuid.eq(user_uuid))
-                            .filter(users_collections::collection_uuid.eq(collection_uuid))
-                            .set((
-                                users_collections::user_uuid.eq(user_uuid),
-                                users_collections::collection_uuid.eq(collection_uuid),
-                                users_collections::read_only.eq(read_only),
-                                users_collections::hide_passwords.eq(hide_passwords),
-                                users_collections::manage.eq(manage),
-                            ))
-                            .execute(conn)
-                            .map_res("Error adding user to collection")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error adding user to collection")
-            }
-            postgresql {
+            mysql {
                 diesel::insert_into(users_collections::table)
-                    .values((
-                        users_collections::user_uuid.eq(user_uuid),
-                        users_collections::collection_uuid.eq(collection_uuid),
-                        users_collections::read_only.eq(read_only),
-                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
-                    ))
+                    .values(values)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(values)
+                    .execute(conn)
+                    .map_res("Error adding user to collection")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(users_collections::table)
+                    .values(values)
                     .on_conflict((users_collections::user_uuid, users_collections::collection_uuid))
                     .do_update()
-                    .set((
-                        users_collections::read_only.eq(read_only),
-                        users_collections::hide_passwords.eq(hide_passwords),
-                        users_collections::manage.eq(manage),
-                    ))
+                    .set(values)
                     .execute(conn)
                     .map_res("Error adding user to collection")
             }
@@ -909,19 +878,18 @@ impl CollectionCipher {
         Self::update_users_revision(collection_uuid, conn).await;
 
         db_run! { conn:
-            sqlite, mysql {
-                // Not checking for ForeignKey Constraints here.
-                // Table ciphers_collections does not have ForeignKey Constraints which would cause conflicts.
-                // This table has no constraints pointing to itself, but only to others.
-                diesel::replace_into(ciphers_collections::table)
+            mysql {
+                diesel::insert_into(ciphers_collections::table)
                     .values((
                         ciphers_collections::cipher_uuid.eq(cipher_uuid),
                         ciphers_collections::collection_uuid.eq(collection_uuid),
                     ))
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_nothing()
                     .execute(conn)
                     .map_res("Error adding cipher to collection")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(ciphers_collections::table)
                     .values((
                         ciphers_collections::cipher_uuid.eq(cipher_uuid),

src/db/models/device.rs

@@ -146,15 +146,18 @@ impl Device {
         }
 
         db_run! { conn:
-            sqlite, mysql {
+            mysql {
                 crate::util::retry(||
-                    diesel::replace_into(devices::table)
+                    diesel::insert_into(devices::table)
                         .values(&*self)
+                        .on_conflict(diesel::dsl::DuplicatedKeys)
+                        .do_update()
+                        .set(&*self)
                         .execute(conn),
                     10,
                 ).map_res("Error saving device")
             }
-            postgresql {
+            postgresql, sqlite {
                 crate::util::retry(||
                     diesel::insert_into(devices::table)
                         .values(&*self)

src/db/models/emergency_access.rs

@@ -146,24 +146,16 @@ impl EmergencyAccess {
         self.updated_at = Utc::now().naive_utc();
 
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(emergency_access::table)
+            mysql {
+                diesel::insert_into(emergency_access::table)
                     .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(emergency_access::table)
-                            .filter(emergency_access::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error updating emergency access")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving emergency access")
+                    .map_res("Error saving emergency access")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(emergency_access::table)
                     .values(&*self)
                     .on_conflict(emergency_access::uuid)

src/db/models/event.rs

@@ -208,20 +208,23 @@ impl Event {
     /// Basic Queries
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            sqlite, mysql {
-                diesel::replace_into(event::table)
-                .values(self)
-                .execute(conn)
-                .map_res("Error saving event")
-            }
-            postgresql {
+            mysql {
                 diesel::insert_into(event::table)
-                .values(self)
-                .on_conflict(event::uuid)
-                .do_update()
-                .set(self)
-                .execute(conn)
-                .map_res("Error saving event")
+                    .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
+                    .execute(conn)
+                    .map_res("Error saving event")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(event::table)
+                    .values(self)
+                    .on_conflict(event::uuid)
+                    .do_update()
+                    .set(self)
+                    .execute(conn)
+                    .map_res("Error saving event")
             }
         }
     }

src/db/models/folder.rs

@@ -77,24 +77,16 @@ impl Folder {
         self.updated_at = Utc::now().naive_utc();
 
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(folders::table)
+            mysql {
+                diesel::insert_into(folders::table)
                     .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(folders::table)
-                            .filter(folders::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error saving folder")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving folder")
+                    .map_res("Error saving folder")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(folders::table)
                     .values(&*self)
                     .on_conflict(folders::uuid)
@@ -147,16 +139,15 @@ impl Folder {
 impl FolderCipher {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            sqlite, mysql {
-                // Not checking for ForeignKey Constraints here.
-                // Table folders_ciphers does not have ForeignKey Constraints which would cause conflicts.
-                // This table has no constraints pointing to itself, but only to others.
-                diesel::replace_into(folders_ciphers::table)
+            mysql {
+                diesel::insert_into(folders_ciphers::table)
                     .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_nothing()
                     .execute(conn)
                     .map_res("Error adding cipher to folder")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(folders_ciphers::table)
                     .values(self)
                     .on_conflict((folders_ciphers::cipher_uuid, folders_ciphers::folder_uuid))

src/db/models/group.rs

@@ -166,24 +166,16 @@ impl Group {
         self.revision_date = Utc::now().naive_utc();
 
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(groups::table)
+            mysql {
+                diesel::insert_into(groups::table)
                     .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(groups::table)
-                            .filter(groups::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error saving group")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving group")
+                    .map_res("Error saving group")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(groups::table)
                     .values(&*self)
                     .on_conflict(groups::uuid)
@@ -326,53 +318,30 @@ impl CollectionGroup {
             group_user.update_user_revision(conn).await;
         }
 
+        let values = (
+            collections_groups::collections_uuid.eq(&self.collections_uuid),
+            collections_groups::groups_uuid.eq(&self.groups_uuid),
+            collections_groups::read_only.eq(&self.read_only),
+            collections_groups::hide_passwords.eq(&self.hide_passwords),
+            collections_groups::manage.eq(&self.manage),
+        );
+
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(collections_groups::table)
-                    .values((
-                        collections_groups::collections_uuid.eq(&self.collections_uuid),
-                        collections_groups::groups_uuid.eq(&self.groups_uuid),
-                        collections_groups::read_only.eq(&self.read_only),
-                        collections_groups::hide_passwords.eq(&self.hide_passwords),
-                        collections_groups::manage.eq(&self.manage),
-                    ))
-                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(collections_groups::table)
-                            .filter(collections_groups::collections_uuid.eq(&self.collections_uuid))
-                            .filter(collections_groups::groups_uuid.eq(&self.groups_uuid))
-                            .set((
-                                collections_groups::collections_uuid.eq(&self.collections_uuid),
-                                collections_groups::groups_uuid.eq(&self.groups_uuid),
-                                collections_groups::read_only.eq(&self.read_only),
-                                collections_groups::hide_passwords.eq(&self.hide_passwords),
-                                collections_groups::manage.eq(&self.manage),
-                            ))
-                            .execute(conn)
-                            .map_res("Error adding group to collection")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error adding group to collection")
-            }
-            postgresql {
+            mysql {
                 diesel::insert_into(collections_groups::table)
-                    .values((
-                        collections_groups::collections_uuid.eq(&self.collections_uuid),
-                        collections_groups::groups_uuid.eq(&self.groups_uuid),
-                        collections_groups::read_only.eq(self.read_only),
-                        collections_groups::hide_passwords.eq(self.hide_passwords),
-                        collections_groups::manage.eq(self.manage),
-                    ))
+                    .values(values)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(values)
+                    .execute(conn)
+                    .map_res("Error adding group to collection")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(collections_groups::table)
+                    .values(values)
                     .on_conflict((collections_groups::collections_uuid, collections_groups::groups_uuid))
                     .do_update()
-                    .set((
-                        collections_groups::read_only.eq(self.read_only),
-                        collections_groups::hide_passwords.eq(self.hide_passwords),
-                        collections_groups::manage.eq(self.manage),
-                    ))
+                    .set(values)
                     .execute(conn)
                     .map_res("Error adding group to collection")
             }
@@ -497,43 +466,25 @@ impl GroupUser {
     pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
         self.update_user_revision(conn).await;
 
+        let values = (
+            groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+            groups_users::groups_uuid.eq(&self.groups_uuid),
+        );
+
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(groups_users::table)
-                    .values((
-                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                        groups_users::groups_uuid.eq(&self.groups_uuid),
-                    ))
-                    .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(groups_users::table)
-                            .filter(groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid))
-                            .filter(groups_users::groups_uuid.eq(&self.groups_uuid))
-                            .set((
-                                groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                                groups_users::groups_uuid.eq(&self.groups_uuid),
-                            ))
-                            .execute(conn)
-                            .map_res("Error adding user to group")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error adding user to group")
-            }
-            postgresql {
+            mysql {
                 diesel::insert_into(groups_users::table)
-                    .values((
-                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                        groups_users::groups_uuid.eq(&self.groups_uuid),
-                    ))
+                    .values(values)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_nothing()
+                    .execute(conn)
+                    .map_res("Error adding user to group")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(groups_users::table)
+                    .values(values)
                     .on_conflict((groups_users::users_organizations_uuid, groups_users::groups_uuid))
-                    .do_update()
-                    .set((
-                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-                        groups_users::groups_uuid.eq(&self.groups_uuid),
-                    ))
+                    .do_nothing()
                     .execute(conn)
                     .map_res("Error adding user to group")
             }

src/db/models/organization.rs

@@ -353,25 +353,16 @@ impl Organization {
         }
 
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(organizations::table)
+            mysql {
+                diesel::insert_into(organizations::table)
                     .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(organizations::table)
-                            .filter(organizations::uuid.eq(&self.uuid))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error saving organization")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving organization")
-
+                    .map_res("Error saving organization")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(organizations::table)
                     .values(self)
                     .on_conflict(organizations::uuid)
@@ -753,24 +744,16 @@ impl Membership {
         User::update_uuid_revision(&self.user_uuid, conn).await;
 
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(users_organizations::table)
+            mysql {
+                diesel::insert_into(users_organizations::table)
                     .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(users_organizations::table)
-                            .filter(users_organizations::uuid.eq(&self.uuid))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error adding user to organization")
-                    },
-                    Err(e) => Err(e.into()),
-                }.map_res("Error adding user to organization")
+                    .map_res("Error adding user to organization")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(users_organizations::table)
                     .values(self)
                     .on_conflict(users_organizations::uuid)
@@ -1186,25 +1169,16 @@ impl Membership {
 impl OrganizationApiKey {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(organization_api_key::table)
+            mysql {
+                diesel::insert_into(organization_api_key::table)
                     .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(organization_api_key::table)
-                            .filter(organization_api_key::uuid.eq(&self.uuid))
-                            .set(self)
-                            .execute(conn)
-                            .map_res("Error saving organization")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving organization")
-
+                    .map_res("Error saving organization")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(organization_api_key::table)
                     .values(self)
                     .on_conflict((organization_api_key::uuid, organization_api_key::org_uuid))

src/db/models/send.rs

@@ -202,24 +202,16 @@ impl Send {
         self.revision_date = Utc::now().naive_utc();
 
         db_run! { conn:
-            sqlite, mysql {
-                match diesel::replace_into(sends::table)
+            mysql {
+                diesel::insert_into(sends::table)
                     .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
                     .execute(conn)
-                {
-                    Ok(_) => Ok(()),
-                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
-                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
-                        diesel::update(sends::table)
-                            .filter(sends::uuid.eq(&self.uuid))
-                            .set(&*self)
-                            .execute(conn)
-                            .map_res("Error saving send")
-                    }
-                    Err(e) => Err(e.into()),
-                }.map_res("Error saving send")
+                    .map_res("Error saving send")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(sends::table)
                     .values(&*self)
                     .on_conflict(sends::uuid)

src/db/models/user.rs

@@ -463,15 +463,17 @@ impl Invitation {
         }
 
         db_run! { conn:
-            sqlite, mysql {
-                // Not checking for ForeignKey Constraints here
-                // Table invitations does not have any ForeignKey Constraints.
-                diesel::replace_into(invitations::table)
+            // Not checking for ForeignKey Constraints here
+            // Table invitations does not have any ForeignKey Constraints.
+            mysql {
+                diesel::insert_into(invitations::table)
                     .values(self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_nothing()
                     .execute(conn)
                     .map_res("Error saving invitation")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(invitations::table)
                     .values(self)
                     .on_conflict(invitations::email)
@@ -528,13 +530,13 @@ pub struct UserId(String);
 impl SsoUser {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
-            sqlite, mysql {
-                diesel::replace_into(sso_users::table)
+            mysql {
+                diesel::insert_into(sso_users::table)
                     .values(self)
                     .execute(conn)
                     .map_res("Error saving SSO user")
             }
-            postgresql {
+            postgresql, sqlite {
                 diesel::insert_into(sso_users::table)
                     .values(self)
                     .execute(conn)

src/http_client.rs

@@ -14,7 +14,10 @@ use reqwest::{
 };
 use url::Host;
 
-use crate::{CONFIG, util::is_global};
+use crate::{
+    CONFIG,
+    util::{get_env_bool, is_global},
+};
 
 pub fn make_http_request(method: reqwest::Method, url: &str) -> Result<reqwest::RequestBuilder, crate::Error> {
     static INSTANCE: LazyLock<Client> =
@@ -36,7 +39,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
     let mut headers = header::HeaderMap::new();
     headers.insert(header::USER_AGENT, header::HeaderValue::from_static("Vaultwarden"));
 
-    let redirect_policy = reqwest::redirect::Policy::custom(|attempt| {
+    let redirect_policy = reqwest::redirect::Policy::custom(move |attempt| {
         if attempt.previous().len() >= 5 {
             return attempt.error("Too many redirects");
         }
@@ -45,7 +48,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
             return attempt.error("Invalid host");
         };
 
-        if let Err(e) = should_block_host(&host) {
+        if enforce_block && let Err(e) = should_block_host(&host) {
             return attempt.error(e);
         }
 
@@ -59,6 +62,14 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
         .timeout(Duration::from_secs(10))
 }
 
+fn dns_prefer_ipv6() -> bool {
+    // CONFIG may require DNS to initialize, so avoid forcing it during bootstrap.
+    match LazyLock::get(&CONFIG) {
+        Some(config) => config.dns_prefer_ipv6(),
+        None => get_env_bool("DNS_PREFER_IPV6").unwrap_or(false),
+    }
+}
+
 fn should_block_ip(ip: IpAddr) -> bool {
     if !CONFIG.http_request_block_non_global_ips() {
         return false;
@@ -258,12 +269,8 @@ impl CustomDnsResolver {
     fn new() -> Arc<Self> {
         TokioResolver::builder(TokioRuntimeProvider::default())
             .and_then(|mut builder| {
-                // Hickory's default since v0.26 is `Ipv6AndIpv4`, which sorts IPv6 first
-                // This might cause issues on IPv4 only systems or containers
-                // Unless someone enabled DNS_PREFER_IPV6, use Ipv4AndIpv6, which returns IPv4 first which was our previous default
-                if !CONFIG.dns_prefer_ipv6() {
-                    builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
-                }
+                // Query both families; the preferred order is applied per lookup below.
+                builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
                 builder.build()
             })
             .inspect_err(|e| warn!("Error creating Hickory resolver, falling back to default: {e:?}"))
@@ -289,6 +296,17 @@ impl CustomDnsResolver {
     }
 }
 
+fn sort_addresses(addresses: &mut [SocketAddr], prefer_ipv6: bool) {
+    // `sort_by_key` orders `false` before `true`.
+    // When IPv6 is preferred, IPv6 addresses return `false` for `is_ipv4()` and sort first.
+    // When IPv4 is preferred, IPv4 addresses return `false` for `is_ipv6()` and sort first.
+    if prefer_ipv6 {
+        addresses.sort_by_key(SocketAddr::is_ipv4);
+    } else {
+        addresses.sort_by_key(SocketAddr::is_ipv6);
+    }
+}
+
 fn pre_resolve(name: &str, enforce_block: bool) -> Result<(), CustomHttpClientError> {
     let Ok(host) = get_valid_host(name) else {
         return Err(CustomHttpClientError::Invalid {
@@ -320,7 +338,9 @@ impl Resolve for CustomDns {
         let this = Arc::clone(&self.resolver);
         Box::pin(async move {
             let name = name.as_str();
-            let results = this.resolve_domain(name, enforce_block).await?;
+            let mut results = this.resolve_domain(name, enforce_block).await?;
+            // Recheck after bootstrap so long-lived clients adopt the loaded config.
+            sort_addresses(&mut results, dns_prefer_ipv6());
             if results.is_empty() {
                 warn!("Unable to resolve {name} to any valid IP address");
             }
@@ -339,10 +359,29 @@ pub(crate) mod aws {
     };
     use reqwest::Client;
 
+    use super::get_reqwest_client_builder;
+
     // Adapter that wraps reqwest to be compatible with the AWS SDK
     #[derive(Debug)]
     pub(crate) struct AwsReqwestConnector {
-        pub(crate) client: Client,
+        client: Client,
+    }
+
+    impl AwsReqwestConnector {
+        pub(crate) fn new() -> Self {
+            let client = get_reqwest_client_builder(false).build().expect("Failed to build AWS HTTP client");
+            Self {
+                client,
+            }
+        }
+    }
+
+    fn connector_error(error: reqwest::Error) -> ConnectorError {
+        if error.is_timeout() {
+            ConnectorError::timeout(Box::new(error))
+        } else {
+            ConnectorError::io(Box::new(error))
+        }
     }
 
     impl HttpConnector for AwsReqwestConnector {
@@ -362,10 +401,10 @@ pub(crate) mod aws {
                     req_builder = req_builder.body(body_bytes.to_vec());
                 }
 
-                let response = req_builder.send().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
+                let response = req_builder.send().await.map_err(connector_error)?;
 
                 let status = response.status().into();
-                let bytes = response.bytes().await.map_err(|e| ConnectorError::io(Box::new(e)))?;
+                let bytes = response.bytes().await.map_err(connector_error)?;
 
                 Ok(HttpResponse::new(status, bytes.into()))
             };
@@ -391,7 +430,7 @@ pub(crate) mod aws {
 mod tests {
     use super::*;
     use crate::util::is_global_hardcoded;
-    use std::net::Ipv4Addr;
+    use std::net::{Ipv4Addr, Ipv6Addr};
     use url::Host;
 
     // ===
@@ -404,6 +443,26 @@ mod tests {
         }
     }
 
+    #[test]
+    fn dns_setup_does_not_initialize_config() {
+        assert!(LazyLock::get(&CONFIG).is_none());
+        drop(CustomDns::instance(false));
+        assert!(LazyLock::get(&CONFIG).is_none());
+    }
+
+    #[test]
+    fn dns_preference_orders_addresses() {
+        let ipv4 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);
+        let ipv6 = SocketAddr::new(IpAddr::V6(Ipv6Addr::LOCALHOST), 0);
+        let mut addresses = [ipv6, ipv4];
+
+        sort_addresses(&mut addresses, false);
+        assert_eq!(addresses, [ipv4, ipv6]);
+
+        sort_addresses(&mut addresses, true);
+        assert_eq!(addresses, [ipv6, ipv4]);
+    }
+
     #[test]
     fn dotted_decimal_loopback_normalizes() {
         let ip = parse_to_ip("127.0.0.1").unwrap();

src/storage.rs

@@ -77,10 +77,18 @@ pub(crate) fn operator_for_path(path: &str) -> Result<opendal::Operator, crate::
 
 #[cfg(s3)]
 mod s3 {
+    use std::sync::LazyLock;
+
+    use opendal_http_transport_reqwest::ReqwestTransport;
     use reqwest::Url;
 
     use crate::error::Error;
 
+    static HTTP_CLIENT: LazyLock<reqwest::Client> = LazyLock::new(|| {
+        // Storage endpoints are administrator-configured and may be private.
+        crate::http_client::get_reqwest_client_builder(false).build().expect("Failed to build OpenDAL HTTP client")
+    });
+
     pub(super) fn is_uri(path: &str) -> bool {
         path.starts_with("s3://")
     }
@@ -177,12 +185,7 @@ mod s3 {
 
                 let chain = DEFAULT_CREDENTIAL_CHAIN
                     .get_or_init(|| {
-                        let reqwest_client = reqwest::Client::builder().build().unwrap();
-                        let connector = AwsReqwestConnector {
-                            client: reqwest_client,
-                        };
-
-                        let conf = ProviderConfig::default().with_http_client(connector);
+                        let conf = ProviderConfig::default().with_http_client(AwsReqwestConnector::new());
 
                         DefaultCredentialsChain::builder().configure(conf).build()
                     })
@@ -236,7 +239,9 @@ mod s3 {
                 builder.credential_provider_chain(ProvideCredentialChain::new().push(OpenDALS3CredentialProvider));
         }
 
-        Ok(opendal::Operator::new(builder)?)
+        let http_transport = opendal::HttpTransporter::new(ReqwestTransport::new(HTTP_CLIENT.clone()));
+        let context = opendal::OperationContext::new().with_http_transport(http_transport);
+        Ok(opendal::Operator::new(builder)?.with_context(context))
     }
 
     fn uri_has_option(uri: &opendal::OperatorUri, names: &[&str]) -> bool {