Some simplifications

Add typo exception
Implement V2 key rotation support
2026-10-23 07:28:10 +03:00 · 2026-09-23 23:53:12 +02:00 · 2026-09-23 23:30:19 +02:00 · 2026-09-23 23:30:19 +02:00 · 2026-09-23 23:30:18 +02:00
80 changed files with 3473 additions and 2687 deletions
@@ -180,7 +180,7 @@
 ## Defaults to every minute. Set blank to disable this job.
 # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
 ##
-## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
+## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
 ## Defaults to every minute. Set blank to disable this job.
 # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
 #
@@ -338,8 +338,6 @@
 ## "local" accepts it from any non global address, which covers a reverse proxy running on the same
 ## host or container network. Use "all" to accept it from anywhere, or list the addresses of your
 ## proxy as IPs and CIDR ranges if it connects from a public address.
 ## For a list header like X-Forwarded-For, the client IP is the rightmost address that isn't one of
 ## these proxies, so with several proxies in a row (a CDN in front of nginx, for example) list all of them.
 # IP_HEADER_TRUSTED_PROXIES=local
 ## Icon service
@@ -393,16 +391,24 @@
 ## The following flags are available:
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
 ## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
 ## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
-## - "windows-desktop-autotype": Enable the autotype feature preview on Windows. (Desktop >= 2025.8.0)
+## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
-## - "windows-desktop-autotype-ga": Enable the new, still in development, autotype implementation on Windows. (Desktop >= 2026.9.1)
+## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
-##   Only enable one of the two autotype flags, the clients disable autotype completely when both are enabled.
+## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0)
 ## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
 ## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
 ## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
 ## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
 ## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
 ## - "pm-30529-webauthn-related-origins":
 ## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
 ## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
 ## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
 ## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
 ## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -581,6 +587,11 @@
 # DUO_HOST=<API Hostname>
 ## After that, you should be able to follow the rest of the guide linked above,
 ## ignoring the fields that ask for the values that you already configured beforehand.
 ##
 ## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'.
 ## Duo no longer supports this, but it still works for some integrations.
 ## If you aren't sure, leave this alone.
 # DUO_USE_IFRAME=false
 ## Email 2FA settings
 ## Email token size
@@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH
      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          sarif_file: 'trivy-results.sarif'
@@ -23,4 +23,4 @@ jobs:
      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
+        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
@@ -18,7 +18,7 @@ repos:
  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
  - repo: https://github.com/crate-ci/typos
-    rev: 00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
+    rev: 512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
    hooks:
      - id: typos
        always_run: true
@@ -15,8 +15,10 @@ extend-ignore-re = [
    "(?i)helo_name",
    "Server name sent during.+HELO",
    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
    "COSE",
    "COSEKey",
    "COSEAlgorithm",
    "CoseEncrypt0",
    # Ignore this specific string as it's valid
    "Ensure they are valid OTPs",
    # This word is misspelled upstream
@@ -32,15 +32,15 @@ dependencies = [
 [[package]]
 name = "alloc-no-stdlib"
-version = "3.0.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2fb6cfd47bf496ff64095c20eaba0c201404ee38714d4142fcfa1dc334fcc7a"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
 [[package]]
 name = "alloc-stdlib"
-version = "0.3.0"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b5c1865780388bfa186411ab5f247819487fc4864c6e9c3106611fa347586e1"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
 dependencies = [
 "alloc-no-stdlib",
 ]
@@ -151,9 +151,9 @@ dependencies = [
 [[package]]
 name = "async-compression"
-version = "0.4.50"
+version = "0.4.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee19bd99b43e3691acbad4e840420a4881cea6c0b66a208125a824f8fd53f5a1"
+checksum = "fb61aea1a7def73ee7c350a184f0e70b32c182344e2e75bf70c9b621b83417fd"
 dependencies = [
 "compression-codecs",
 "compression-core",
@@ -323,9 +323,9 @@ dependencies = [
 [[package]]
 name = "asyncband"
-version = "0.7.3"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5161fb43cb8f231f06983cb2b8f9ee9cee14be0b1356d8383398cc0f312800d1"
+checksum = "f2d85fd3d291fabcc40c7232c92c280ec1754fd7b5d7ea769f143222143e179a"
 [[package]]
 name = "atomic"
@@ -399,9 +399,9 @@ dependencies = [
 [[package]]
 name = "aws-runtime"
-version = "1.10.0"
+version = "1.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b8a9911551b4ea6ca13805ef52ed96f7d2bbb43cc3b4a14cb0776a71f33cfaa"
+checksum = "25b43ad47adc2517efe3d706559d94b97e50e80e0321b3cadbc9f77cee88adcd"
 dependencies = [
 "aws-credential-types",
 "aws-sigv4",
@@ -424,9 +424,9 @@ dependencies = [
 [[package]]
 name = "aws-sdk-sso"
-version = "1.114.0"
+version = "1.111.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12be2f9c8eef7f5fc919c96d538e629698469a02b4cb75408b26b1bd984ebe79"
+checksum = "65700d75f6da78c89a61a49f1539979400a4609d3329376b1dc2133d7a1b2b90"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@@ -442,6 +442,7 @@ dependencies = [
 "aws-types",
 "bytes",
 "fastrand",
 "http 0.2.12",
 "http 1.5.0",
 "regex-lite",
 "tracing",
@@ -449,9 +450,9 @@ dependencies = [
 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.116.0"
+version = "1.113.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7645db8724ea3b82fdccfb67e1b0f637c9d8ab0e7ef29d84884d8d8d73f805d"
+checksum = "eb1147c254af7b6cee3ace90ae7da6f21366ce9a9b899035fa8a0fdf586eb75a"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@@ -467,6 +468,7 @@ dependencies = [
 "aws-types",
 "bytes",
 "fastrand",
 "http 0.2.12",
 "http 1.5.0",
 "regex-lite",
 "tracing",
@@ -474,9 +476,9 @@ dependencies = [
 [[package]]
 name = "aws-sdk-sts"
-version = "1.119.0"
+version = "1.116.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03e490aa904849b38e770922faac779dd245f5cf8be81f19065acf18d276e4ad"
+checksum = "035c7392e751d20bf1060d625d023587eb14099646110a9cff7c697bfe4b253a"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@@ -493,6 +495,7 @@ dependencies = [
 "aws-smithy-xml",
 "aws-types",
 "fastrand",
 "http 0.2.12",
 "http 1.5.0",
 "regex-lite",
 "tracing",
@@ -500,9 +503,9 @@ dependencies = [
 [[package]]
 name = "aws-sigv4"
-version = "1.6.0"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2312577f088c9fbf4206dfdb884cf1de9407b43e1a923cbed5237775116fc24b"
+checksum = "31d955e76ff96acd555bf06fa0fa6d5bf9335fa84ae7c64481b20ae61d231f70"
 dependencies = [
 "aws-credential-types",
 "aws-smithy-http",
@@ -512,6 +515,7 @@ dependencies = [
 "form_urlencoded",
 "hex",
 "hmac 0.13.0",
 "http 0.2.12",
 "http 1.5.0",
 "percent-encoding",
 "sha2 0.11.0",
@@ -532,9 +536,9 @@ dependencies = [
 [[package]]
 name = "aws-smithy-http"
-version = "0.64.1"
+version = "0.64.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "639b4d8f8555f24a9be649811c3eb0b4d4616f4d61daf0c32e28873bc1ea9af1"
+checksum = "37843d9add67c3aff5856f409c6dc315d3cdff60f9c0cb5b670dab1e9920306d"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
@@ -586,9 +590,9 @@ dependencies = [
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.16.0"
+version = "1.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6e302ac1d88b99652489df31abdec6ac42a2ab2ac3982ad0ac49f64dfaf28ba"
+checksum = "3296253d3a91b3f938a3f2bcce4daebadcb4aa4228153fcec90f9d23532b4484"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-http",
@@ -598,7 +602,9 @@ dependencies = [
 "aws-smithy-types",
 "bytes",
 "fastrand",
 "http 0.2.12",
 "http 1.5.0",
 "http-body 0.4.6",
 "http-body 1.1.0",
 "http-body-util",
 "pin-project-lite",
@@ -609,14 +615,15 @@ dependencies = [
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.19.0"
+version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0730c16f91124c6a2abb4932c77e299288b3dd9f967ea2e9ec48cc6731e87a4"
+checksum = "6d881a7b7ad179fd6611680c9de89f716fb00ab40299a9a7b8c6913e8f7511a8"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-runtime-api-macros",
 "aws-smithy-types",
 "bytes",
 "http 0.2.12",
 "http 1.5.0",
 "pin-project-lite",
 "tokio",
@@ -648,14 +655,16 @@ dependencies = [
 [[package]]
 name = "aws-smithy-types"
-version = "1.8.1"
+version = "1.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69bb407740a197147da48238ecc94498493c9e85445732360cec180296ca45f1"
+checksum = "0b791f3ac597193fe1d08b82366986eb1f5bc31f2ac6c194c0855276116c76cd"
 dependencies = [
 "base64-simd",
 "bytes",
 "bytes-utils",
 "http 0.2.12",
 "http 1.5.0",
 "http-body 0.4.6",
 "http-body 1.1.0",
 "http-body-util",
 "itoa",
@@ -747,9 +756,9 @@ dependencies = [
 [[package]]
 name = "bigdecimal"
-version = "0.4.11"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fa3f3d8cbf4dffcfe4991de61d012bef509a409ecbe9dd41049bfe32b4d4653"
+checksum = "4d6867f1565b3aad85681f1015055b087fcfd840d6aeee6eee7f2da317603695"
 dependencies = [
 "autocfg",
 "libm",
@@ -818,9 +827,9 @@ dependencies = [
 [[package]]
 name = "brotli"
-version = "9.0.0"
+version = "8.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8b851b75c23ca7873623d612fe49bd1989aeb03d08fb9432187eb253d3d4c6b"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
 dependencies = [
 "alloc-no-stdlib",
 "alloc-stdlib",
@@ -829,9 +838,9 @@ dependencies = [
 [[package]]
 name = "brotli-decompressor"
-version = "6.0.1"
+version = "5.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "941cd9bd4ddab83cb46fa5a2d428f1c857b24ac78cb876cf7beb710840934bd7"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
 dependencies = [
 "alloc-no-stdlib",
 "alloc-stdlib",
@@ -882,9 +891,9 @@ dependencies = [
 [[package]]
 name = "cached"
-version = "4.0.1"
+version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "292f39b5c459538e148825347c400cb2005a618b897d0e6be183bad677d460b7"
+checksum = "c5a6cf8262820194a1488ece477f5fb5ba9256ef25229d525470e71d6e9a5835"
 dependencies = [
 "ahash",
 "async-lock",
@@ -892,7 +901,7 @@ dependencies = [
 "cached_proc_macro_types",
 "hashbrown 0.17.1",
 "parking_lot",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 "web-time",
 ]
@@ -917,9 +926,9 @@ checksum = "f5813789573ae815c8b4be58c4428e0e7ae05f0227678ba9de332ded585b9159"
 [[package]]
 name = "cc"
-version = "1.6.0"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
+checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -998,9 +1007,9 @@ dependencies = [
 [[package]]
 name = "compression-codecs"
-version = "0.4.45"
+version = "0.4.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98fc98460ba0ad5317075d3632b8dfc45d0be8c4a49347c2a38272019717614a"
+checksum = "bef16c47ba2797aa6a909cc37d39911f3a6743811fe7408ac0b0cc0276b656e9"
 dependencies = [
 "brotli",
 "compression-core",
@@ -1437,7 +1446,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
 dependencies = [
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 ]
 [[package]]
@@ -1802,12 +1811,13 @@ dependencies = [
 [[package]]
 name = "encoding_rs"
-version = "0.8.42"
+version = "0.8.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
+checksum = "7b5ef0006ac9ab233c38522f5ae99cae3625151de8f706cacee1cba4b8e2832a"
 dependencies = [
 "cfg-if",
 "core_detect",
 "multiversion",
 "multiversion_no_op",
 "rustversion",
 "scopeguard",
@@ -1906,9 +1916,9 @@ dependencies = [
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.14"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"
 [[package]]
 name = "flate2"
@@ -2235,7 +2245,7 @@ dependencies = [
 "pest_derive",
 "serde",
 "serde_json",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 "walkdir",
 ]
@@ -2311,8 +2321,8 @@ dependencies = [
 "idna",
 "ipnet",
 "jni",
- "rand 0.10.3",
+ "rand 0.10.2",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 "tinyvec",
 "tokio",
 "tracing",
@@ -2331,9 +2341,9 @@ dependencies = [
 "jni",
 "once_cell",
 "prefix-trie",
- "rand 0.10.3",
+ "rand 0.10.2",
 "ring",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 "tinyvec",
 "tracing",
 "url",
@@ -2356,11 +2366,11 @@ dependencies = [
 "ndk-context",
 "once_cell",
 "parking_lot",
- "rand 0.10.3",
+ "rand 0.10.2",
 "resolv-conf",
 "smallvec",
 "system-configuration",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 "tokio",
 "tracing",
 ]
@@ -2534,32 +2544,31 @@ dependencies = [
 [[package]]
 name = "hyper-rustls"
-version = "0.27.10"
+version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
 "http 1.5.0",
 "hyper 1.11.1",
 "hyper-util",
 "rustls 0.23.45",
 "tokio",
- "tokio-rustls 0.26.6",
+ "tokio-rustls 0.26.5",
 "tower-service",
 ]
 [[package]]
 name = "hyper-util"
-version = "0.1.21"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64 0.23.1",
+ "base64 0.22.1",
 "bytes",
 "futures-channel",
 "futures-util",
 "http 1.5.0",
 "http-body 1.1.0",
 "httparse",
 "hyper 1.11.1",
 "ipnet",
 "libc",
@@ -2858,7 +2867,7 @@ dependencies = [
 "jni-sys",
 "log",
 "simd_cesu8",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 "walkdir",
 "windows-link",
 ]
@@ -2918,9 +2927,9 @@ dependencies = [
 [[package]]
 name = "js-sys"
-version = "0.3.106"
+version = "0.3.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
 dependencies = [
 "cfg-if",
 "futures-util",
@@ -2971,9 +2980,9 @@ dependencies = [
 [[package]]
 name = "lazy_static"
-version = "1.5.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 dependencies = [
 "spin 0.9.9",
 ]
@@ -3004,16 +3013,16 @@ dependencies = [
 "serde",
 "socket2 0.6.5",
 "tokio",
- "tokio-rustls 0.26.6",
+ "tokio-rustls 0.26.5",
 "tracing",
 "url",
 ]
 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 [[package]]
 name = "libm"
@@ -3119,6 +3128,16 @@ dependencies = [
 "digest 0.11.3",
 ]
 [[package]]
 name = "mea"
 version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c709842c4ce65cb91e2666ad5319dfc1efc3af0d34f02075eddca9000d9f8afb"
 dependencies = [
 "hashbrown 0.17.1",
 "slab",
 ]
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -3179,9 +3198,9 @@ dependencies = [
 [[package]]
 name = "mio"
-version = "1.2.4"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
 dependencies = [
 "libc",
 "wasi",
@@ -3227,6 +3246,27 @@ dependencies = [
 "version_check",
 ]
 [[package]]
 name = "multiversion"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ca4bea16ffc3f443cf7d866912118196bfef4c6a1556ca00f9f9b00bb43f7c"
 dependencies = [
 "multiversion-macros",
 ]
 [[package]]
 name = "multiversion-macros"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d416831a7317ef4b08bee00b69cbbb9c8763da7959a7026244d6266869f9c83"
 dependencies = [
 "proc-macro2",
 "quote",
 "rustversion",
 "syn 3.0.6",
 ]
 [[package]]
 name = "multiversion_no_op"
 version = "1.0.0"
@@ -3360,9 +3400,9 @@ dependencies = [
 [[package]]
 name = "num-modular"
-version = "0.6.6"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26ac76200f74e658124f95fa63e1a82b2fd2181c5b2fdde80b3d89d2d3f905e7"
+checksum = "bd8e500409e6cd603b03e477c26a6caecdc27ac58979a53e881c75eafc079f44"
 [[package]]
 name = "num-order"
@@ -3442,9 +3482,9 @@ dependencies = [
 [[package]]
 name = "opendal"
-version = "0.59.4"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cbd193aec6d62efaff87611dfae52c132aed650bb3cb0c684c0a9394f09a42a"
+checksum = "9fe43e16d96bed57937eb7c4a28559bf4c5fc4a3951656505d1fdd4f856349b4"
 dependencies = [
 "opendal-core",
 "opendal-service-fs",
@@ -3453,9 +3493,9 @@ dependencies = [
 [[package]]
 name = "opendal-core"
-version = "0.59.4"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54b5555d753dd6a6383dc0891254b72f3cdc40c011ba0372b560e0ae5aa29f5c"
+checksum = "de4566a412776e3f65d53dd9fceced5b432a0a9c9a1e8d50ccf58823795e5c5b"
 dependencies = [
 "anyhow",
 "asyncband",
@@ -3467,7 +3507,7 @@ dependencies = [
 "log",
 "md-5",
 "percent-encoding",
- "quick-xml 0.41.0",
+ "quick-xml",
 "reqsign-core",
 "serde",
 "serde_json",
@@ -3479,9 +3519,9 @@ dependencies = [
 [[package]]
 name = "opendal-http-transport-reqwest"
-version = "0.59.4"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d6588678f3040a3eab1819364dcbc6a746a8286d1ceb23a70a6614faa01dc6c"
+checksum = "f772ce6c137ab43647726116d505a649a88d41928fcd813438eb30b02312bcbb"
 dependencies = [
 "bytes",
 "futures",
@@ -3493,9 +3533,9 @@ dependencies = [
 [[package]]
 name = "opendal-service-fs"
-version = "0.59.4"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec5c16fe91b77c0364f66546a1c32b2999e9c3c3c75c2e908a282268e0890bac"
+checksum = "a0e7d8974aebd33be899200c9d0d50b2141fd5fa5c462b29e20653e3ddbfe339"
 dependencies = [
 "bytes",
 "log",
@@ -3507,9 +3547,9 @@ dependencies = [
 [[package]]
 name = "opendal-service-s3"
-version = "0.59.4"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d83e716c25a81fe2ca701894b8e14b9966acca3812af250e50132accb19da02"
+checksum = "2942f2d8d3d4953c0e8d07cd1244879628d084948e48ce6b6d808c5938f7858d"
 dependencies = [
 "base64 0.23.1",
 "bytes",
@@ -3518,7 +3558,7 @@ dependencies = [
 "log",
 "md-5",
 "opendal-core",
- "quick-xml 0.41.0",
+ "quick-xml",
 "reqsign-aws-v4",
 "reqsign-core",
 "reqsign-file-read-tokio",
@@ -3760,9 +3800,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 [[package]]
 name = "pest"
-version = "2.9.2"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45d3aca230fad2e6f6317ca0a72724338c4960cb97168a85cdee66df4a9a21a8"
+checksum = "6d45aeb61b4bf818e12d4205f2466f8c4748f85f4fce0146d1c03d69d753f0ad"
 dependencies = [
 "memchr",
 "ucd-trie",
@@ -3770,9 +3810,9 @@ dependencies = [
 [[package]]
 name = "pest_derive"
-version = "2.9.2"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "284b60557f2c4a2e72ad3f2d34d42685a2fa4a6a61d0d2a10c0ae2a5e916c2cf"
+checksum = "89cc5a242e25ed4e7704d0be240f2cfbe20a8c27e7e252d94835be93d92dc39f"
 dependencies = [
 "pest",
 "pest_generator",
@@ -3780,9 +3820,9 @@ dependencies = [
 [[package]]
 name = "pest_generator"
-version = "2.9.2"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d9d1f08a115309ee99268cf85e5228e0e56aa9caf8841ec12866b6be07c3109"
+checksum = "7abf21475cc3820fe4b2ca2dc2142902f67a02189f3b5b3a229f4febc01a43e5"
 dependencies = [
 "pest",
 "pest_meta",
@@ -3793,9 +3833,9 @@ dependencies = [
 [[package]]
 name = "pest_meta"
-version = "2.9.2"
+version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed93ba1a9ffcca32130a5188701c81c0c49cf00d4b7c5007d5148951d743adcb"
+checksum = "adba4db388f687393c18c51348d44a41d870ca9df71a2c98172ea3035dc6936e"
 dependencies = [
 "pest",
 ]
@@ -3885,9 +3925,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 [[package]]
 name = "pin-utils"
-version = "0.1.1"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13bee6c73da26345c729282832b60b0363cf3dd9f4bfd81d8551b7a1c889a113"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 [[package]]
 name = "piper"
@@ -3967,9 +4007,9 @@ dependencies = [
 [[package]]
 name = "powerfmt"
-version = "0.2.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 [[package]]
 name = "ppv-lite86"
@@ -3982,9 +4022,9 @@ dependencies = [
 [[package]]
 name = "pq-sys"
-version = "0.7.6"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9152654059e4fb5b66a4052acf3ee43a7a7132332e44cdb72a81ee93bd038950"
+checksum = "574ddd6a267294433f140b02a726b0640c43cf7c6f717084684aaa3b285aba61"
 dependencies = [
 "libc",
 "pkg-config",
@@ -4089,16 +4129,6 @@ dependencies = [
 "serde",
 ]
 [[package]]
 name = "quick-xml"
 version = "0.42.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
 dependencies = [
 "memchr",
 "serde",
 ]
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -4160,9 +4190,9 @@ dependencies = [
 [[package]]
 name = "rand"
-version = "0.10.3"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
 "chacha20",
 "getrandom 0.4.3",
@@ -4299,9 +4329,9 @@ dependencies = [
 [[package]]
 name = "reqsign-aws-core"
-version = "3.2.0"
+version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38c902d8ec745bd9eadd1abbcbe227f4c1fc2926b2ec8929f89234af3114500"
+checksum = "bac4749b7dfa7bfaccd01eb03e9dc795ed37e3f20d6f0f38e2c67ee85ad6bc86"
 dependencies = [
 "bytes",
 "form_urlencoded",
@@ -4309,7 +4339,7 @@ dependencies = [
 "http 1.5.0",
 "log",
 "percent-encoding",
- "quick-xml 0.42.0",
+ "quick-xml",
 "reqsign-core",
 "rust-ini",
 "serde",
@@ -4320,14 +4350,14 @@ dependencies = [
 [[package]]
 name = "reqsign-aws-v4"
-version = "3.3.1"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "906bfd028f96bfe73fdb892ce26f3b3f99b4f30feb9bd024be58bd6657f68b2b"
+checksum = "ff250f0fd0b913fbd565e405acc553da0f13bde30bfb5403178c9d0313cdc15f"
 dependencies = [
 "bytes",
 "http 1.5.0",
 "log",
- "quick-xml 0.42.0",
+ "quick-xml",
 "reqsign-aws-core",
 "reqsign-core",
 "serde",
@@ -4335,19 +4365,20 @@ dependencies = [
 [[package]]
 name = "reqsign-core"
-version = "3.3.2"
+version = "3.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85fed85c436b6b920e4b36310f699a77771a91e38ae483df48447bd7d162671c"
+checksum = "ff052daffb0599681c50f85c59e7236438976efe991ab864edd9f3b235501a0f"
 dependencies = [
 "anyhow",
 "asyncband",
 "base64 0.23.1",
 "bytes",
 "futures",
 "hex",
 "hmac 0.13.0",
 "http 1.5.0",
 "jiff",
 "log",
 "mea",
 "percent-encoding",
 "sha1 0.11.0",
 "sha2 0.11.0",
@@ -4356,9 +4387,9 @@ dependencies = [
 [[package]]
 name = "reqsign-file-read-tokio"
-version = "3.0.7"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "586a8e198057773f9616901fd723a4bc186812b9765bc0f20368661d6169d906"
+checksum = "b3235df90a6bca681aa47dd86f2393d122a6d77042aa8a7c81e218cd45c5bfc0"
 dependencies = [
 "anyhow",
 "reqsign-core",
@@ -4398,7 +4429,7 @@ dependencies = [
 "serde_urlencoded",
 "sync_wrapper",
 "tokio",
- "tokio-rustls 0.26.6",
+ "tokio-rustls 0.26.5",
 "tokio-util",
 "tower",
 "tower-http",
@@ -4591,7 +4622,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
 dependencies = [
 "hashbrown 0.16.1",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 ]
 [[package]]
@@ -4704,9 +4735,9 @@ dependencies = [
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.7.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
 "core-foundation 0.10.1",
 "core-foundation-sys",
@@ -4725,9 +4756,9 @@ dependencies = [
 [[package]]
 name = "rustls-platform-verifier-android"
-version = "0.2.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 [[package]]
 name = "rustls-webpki"
@@ -4993,9 +5024,9 @@ dependencies = [
 [[package]]
 name = "serde_with"
-version = "3.24.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df9adc193c780ef8f159aee8b61e2d5801aaa555e6eb0947fe45530ec506296f"
+checksum = "935177bb8c0cd8ca1a4e6d1a2ac8988bea69cab4f9d3a31311e012ad27868ea4"
 dependencies = [
 "base64 0.23.1",
 "bs58",
@@ -5014,9 +5045,9 @@ dependencies = [
 [[package]]
 name = "serde_with_macros"
-version = "3.24.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e17bbc68e28663bbbb90df47e058aa7eda4fb445b89fe70457bb94fbccf6e49"
+checksum = "1d607aa01a3cb0ad757d6fd216136910db3c97b102fe686585689615a02dbcdc"
 dependencies = [
 "darling 0.24.1",
 "proc-macro2",
@@ -5143,15 +5174,15 @@ checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
 dependencies = [
 "num-bigint",
 "num-traits",
- "thiserror 2.0.21",
+ "thiserror 2.0.20",
 "time",
 ]
 [[package]]
 name = "siphasher"
-version = "1.0.4"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 [[package]]
 name = "slab"
@@ -5161,9 +5192,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 [[package]]
 name = "smallvec"
-version = "1.16.2"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
+checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
 [[package]]
 name = "socket2"
@@ -5393,11 +5424,11 @@ dependencies = [
 [[package]]
 name = "thiserror"
-version = "2.0.21"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl 2.0.21",
+ "thiserror-impl 2.0.20",
 ]
 [[package]]
@@ -5413,9 +5444,9 @@ dependencies = [
 [[package]]
 name = "thiserror-impl"
-version = "2.0.21"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -5490,9 +5521,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
 [[package]]
 name = "tokio"
-version = "1.53.2"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
 "bytes",
 "libc",
@@ -5528,9 +5559,9 @@ dependencies = [
 [[package]]
 name = "tokio-rustls"
-version = "0.26.6"
+version = "0.26.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
+checksum = "b0c85f2c3ef0b1cd58b36682f4b17aaa995f0e5db534d85692b4903abce21f67"
 dependencies = [
 "rustls 0.23.45",
 "tokio",
@@ -5904,9 +5935,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 [[package]]
 name = "uuid"
-version = "1.27.0"
+version = "1.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
@@ -5977,7 +6008,7 @@ dependencies = [
 "pastey 0.2.3",
 "percent-encoding",
 "pico-args",
- "rand 0.10.3",
+ "rand 0.10.2",
 "regex",
 "reqsign-aws-v4",
 "reqsign-core",
@@ -6062,9 +6093,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.129"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
 dependencies = [
 "cfg-if",
 "once_cell",
@@ -6075,20 +6106,19 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.79"
+version = "0.4.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
+checksum = "6ef4c5d3d2cdf5c54f4231181768f5510842e350db025faf1f7163b1030ed928"
 dependencies = [
 "js-sys",
 "tokio",
 "wasm-bindgen",
 ]
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.129"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -6096,9 +6126,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.129"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
 dependencies = [
 "bumpalo",
 "proc-macro2",
@@ -6109,9 +6139,9 @@ dependencies = [
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.129"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
 dependencies = [
 "unicode-ident",
 ]
@@ -6131,9 +6161,9 @@ dependencies = [
 [[package]]
 name = "web-sys"
-version = "0.3.106"
+version = "0.3.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
+checksum = "9fbddc4a036f00ec4f18c83445bd3115cb306a91da554919a099d9222fe4a7f8"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
@@ -6581,9 +6611,9 @@ dependencies = [
 [[package]]
 name = "yoke-derive"
-version = "0.8.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+checksum = "33811428bee40dbceb6d545e95754741d17a6aef9a4849f0fd62e2ba4f412a78"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -6606,18 +6636,18 @@ dependencies = [
 [[package]]
 name = "zerocopy"
-version = "0.8.59"
+version = "0.8.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6df92bf3d9227be3d53173901ddbffac2babc27ae50f397776ffd6dc33f800cb"
+checksum = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873"
 dependencies = [
 "zerocopy-derive",
 ]
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.59"
+version = "0.8.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac4f328cf2f05d084e496c3e9c3f33ed0a183656a16e1fcec4d464d8373aec82"
+checksum = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1,6 +1,6 @@
 [workspace.package]
 edition = "2024"
-rust-version = "1.97.1"
+rust-version = "1.96.1"
 license = "AGPL-3.0-only"
 repository = "https://github.com/dani-garcia/vaultwarden"
 publish = false
@@ -77,7 +77,7 @@ dotenvy = { version = "0.15.7", default-features = false }
 # Numerical libraries
 num-traits = "0.2.19"
 num-derive = "0.5.1"
-bigdecimal = "0.4.11"
+bigdecimal = "0.4.10"
 # Web framework
 rocket = { version = "0.5.1", default-features = false, features = ["json", "tls"] }
@@ -91,7 +91,7 @@ dashmap = "6.2.1"
 # Async futures
 futures = "0.3.34"
-tokio = { version = "1.53.2", features = [
+tokio = { version = "1.53.1", features = [
    "fs",
    "io-util",
    "net",
@@ -107,7 +107,7 @@ serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
 diesel_migrations = "2.3.2"
 derive_more = { version = "2.1.1", features = [
@@ -123,13 +123,13 @@ diesel-derive-newtype = "2.1.3"
 libsqlite3-sys = { version = "0.38.2", optional = true }
 # Crypto-related libraries
-rand = "0.10.3"
+rand = "0.10.2"
 ring = "0.17.14"
 rustls = { version = "0.23.45", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"
 # UUID generation
-uuid = { version = "1.27.0", features = ["v4"] }
+uuid = { version = "1.26.1", features = ["v4"] }
 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
@@ -215,7 +215,7 @@ bytes = "1.12.1"
 svg-hush = "0.9.7"
 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "4.0.1", features = ["async"] }
+cached = { version = "4.0.0", features = ["async"] }
 # Used for custom short lived cookie jar during favicon extraction
 cookie = "0.18.2"
@@ -257,8 +257,8 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }
 # File are accessed through Apache OpenDAL
-opendal = { version = "0.59.4", default-features = false, features = ["services-fs"] }
+opendal = { version = "0.59.2", default-features = false, features = ["services-fs"] }
-opendal-http-transport-reqwest = { version = "0.59.4", default-features = false, features = ["rustls-no-provider"], optional = true }
+opendal-http-transport-reqwest = { version = "0.59.2", default-features = false, features = ["rustls-no-provider"], optional = true }
 # For retrieving AWS credentials, including temporary SSO credentials
 aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
@@ -268,10 +268,10 @@ aws-config = { version = "1.12.0", optional = true, default-features = false, fe
    "sso",
 ] }
 aws-credential-types = { version = "1.3.0", optional = true }
-aws-smithy-runtime-api = { version = "1.19.0", optional = true }
+aws-smithy-runtime-api = { version = "1.16.2", optional = true }
 http = { version = "1.5.0", optional = true }
-reqsign-aws-v4 = { version = "3.3.1", optional = true }
+reqsign-aws-v4 = { version = "3.3.0", optional = true }
-reqsign-core = { version = "3.3.2", optional = true }
+reqsign-core = { version = "3.3.1", optional = true }
 # Strip debuginfo from the release builds
 # The debug symbols are to provide better panic traces
@@ -1,6 +1,6 @@
 ---
-vault_version: "v2026.8.0"
+vault_version: "v2026.7.0"
-vault_image_digest: "sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a"
+vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c"
 # Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
@@ -19,23 +19,23 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
-#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
+#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
-#     [docker.io/vaultwarden/web-vault:v2026.8.0]
+#     [docker.io/vaultwarden/web-vault:v2026.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.99.0 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.98.1 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.99.0 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.98.1 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.99.0 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.98.1 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.99.0 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.98.1 AS build_armv6
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
-#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
+#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
-#     [docker.io/vaultwarden/web-vault:v2026.8.0]
+#     [docker.io/vaultwarden/web-vault:v2026.7.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
@@ -36,7 +36,7 @@ FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.99.0-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.1-slim-trixie AS build
 # hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH
@@ -101,17 +101,9 @@ RUN . /env-cargo && \
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
        export XX_RUSTFLAGS; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
    find . -not -path "./target*" -delete
@@ -131,17 +123,9 @@ RUN . /env-cargo && \
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
        export XX_RUSTFLAGS; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
@@ -32,17 +32,9 @@
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
+        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
        export XX_RUSTFLAGS; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}"
 {%- endmacro %}
 FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault
@@ -0,0 +1,7 @@
 DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
 ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -0,0 +1,16 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
 ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
 CREATE TABLE user_signature_key_pairs (
    uuid                CHAR(36) NOT NULL PRIMARY KEY,
    user_uuid           CHAR(36) NOT NULL UNIQUE,
    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
    signing_key         TEXT     NOT NULL,
    verifying_key       TEXT     NOT NULL,
    created_at          DATETIME NOT NULL,
    updated_at          DATETIME NOT NULL,
    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE
 );
@@ -1 +0,0 @@
 ALTER TABLE org_policies DROP COLUMN revision_date;
@@ -1,7 +0,0 @@
 -- DATETIME (not TIMESTAMP) to match this repo's convention for revision_date
 -- columns elsewhere, and to avoid MySQL's implicit session-timezone
 -- conversion and 2038 range limit on TIMESTAMP.
 ALTER TABLE org_policies
 ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
 UPDATE org_policies SET revision_date = UTC_TIMESTAMP();
@@ -0,0 +1,7 @@
 DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
 ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -0,0 +1,15 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
 ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
 CREATE TABLE user_signature_key_pairs (
    uuid                CHAR(36) NOT NULL PRIMARY KEY,
    user_uuid           CHAR(36) NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
    signing_key         TEXT     NOT NULL,
    verifying_key       TEXT     NOT NULL,
    created_at          TIMESTAMP NOT NULL,
    updated_at          TIMESTAMP NOT NULL
 );
@@ -1 +0,0 @@
 ALTER TABLE org_policies DROP COLUMN revision_date;
@@ -1,9 +0,0 @@
 -- Backfill via `now() AT TIME ZONE 'utc'` rather than a DEFAULT of now():
 -- assigning timestamptz now() into a naive TIMESTAMP column casts through
 -- the server's TimeZone GUC, so a DEFAULT now() would store local wall-clock
 -- instead of UTC on non-UTC servers, unlike every other naive-UTC timestamp
 -- column in this schema.
 ALTER TABLE org_policies
 ADD COLUMN revision_date TIMESTAMP NOT NULL DEFAULT '1970-01-01 00:00:00';
 UPDATE org_policies SET revision_date = (now() AT TIME ZONE 'utc');
@@ -0,0 +1,7 @@
 DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
 ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -0,0 +1,15 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
 ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
 CREATE TABLE user_signature_key_pairs (
    uuid                TEXT     NOT NULL PRIMARY KEY,
    user_uuid           TEXT     NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
    signing_key         TEXT     NOT NULL,
    verifying_key       TEXT     NOT NULL,
    created_at          DATETIME NOT NULL,
    updated_at          DATETIME NOT NULL
 );
@@ -1,6 +0,0 @@
 -- SQLite forbids non-constant defaults in ALTER TABLE ... ADD COLUMN, so add
 -- the column with a constant placeholder and backfill separately.
 ALTER TABLE org_policies
 ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
 UPDATE org_policies SET revision_date = CURRENT_TIMESTAMP;
@@ -2,7 +2,7 @@
 This allows running integration tests using [Playwright](https://playwright.dev/).
 \
-It uses its own [test.env](./test.env) with different ports to not collide with a running dev instance.
+It usse its own [test.env](/test/scenarios/test.env) with different ports to not collide with a running dev instance.
 ## Install
@@ -62,7 +62,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 ### Keep services running
-If you want you can keep the DB and Keycloak running (states are not impacted by the tests):
+If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
 ```bash
 PW_KEEP_SERVICE_RUNNING=true npx playwright test
@@ -1,131 +0,0 @@
 import { test, expect, type Page, type TestInfo, Test } from '@playwright/test';
 import { MailDev } from 'maildev';
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
 import { activateTOTP } from './setups/2fa';
 let users = utils.loadEnv();
 let mailserver;
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    mailserver = new MailDev({
        port: process.env.MAILDEV_SMTP_PORT,
        web: { port: process.env.MAILDEV_HTTP_PORT },
    })
    await mailserver.listen();
    await utils.startVault(browser, testInfo, {
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
    });
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
    if( mailserver ){
        await mailserver.close();
    }
 });
 async function emergencyAccess(test: Test, page: Page, user: { name: string }) {
    await test.step('Navigate', async () => {
        await page.getByRole('button', { name: user.name }).click();
        await page.getByRole('menuitem', { name: 'Account settings' }).click();
        await page.getByRole('link', { name: 'Emergency access' }).click();
        await expect(page.locator('#main-content').getByText('Emergency access', { exact: true })).toBeVisible();
    });
 }
 test('Emergency access', async ({ browser, page }) => {
    const context2 = await browser.newContext();
    const page2 = await context2.newPage();
    const mailBuffer = mailserver.buffer(users.user1.email);
    const mailBuffer2 = mailserver.buffer(users.user2.email);
    await createAccount(test, page, users.user1);
    await createAccount(test, page2, users.user2);
    await test.step('Add test2', async () => {
        await emergencyAccess(test, page, users.user1);
        await page.getByRole('button', { name: 'Add emergency contact' }).click();
        await page.getByRole('textbox', { name: 'Email * (required)' }).fill(users.user2.email);
        await page.getByRole('radio', { name: 'Takeover Can reset your' }).check();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'User(s) invited');
    });
    await test.step('Accept', async () => {
        const email = await mailBuffer2.expect((m) => m.subject === "Emergency access for " + users.user1.name);
        const pageE = await context2.newPage();
        await pageE.setContent(email.html);
        const link = await pageE.getByTestId("emergency").getAttribute("href");
        await pageE.close();
        await page2.goto(link);
        await utils.checkNotification(page2, 'Invitation accepted');
    });
    await test.step('Confirm', async () => {
        await emergencyAccess(test, page, users.user1);
        await expect(page.locator('#main-content').getByText('Needs confirmation')).toBeVisible();
        await page.getByRole('button', { name: 'Options' }).click();
        await page.getByRole('menuitem', { name: 'Confirm' }).click();
        await page.getByRole('button', { name: 'Confirm' }).click();
        await utils.checkNotification(page, users.user2.name + ' confirmed');
        await mailBuffer2.expect((m) => m.subject === "Emergency access contact for " + users.user1.name + " confirmed");
    });
    await test.step('Request', async () => {
        await emergencyAccess(test, page2, users.user2);
        await page2.getByRole('button', { name: 'Options' }).click();
        await page2.getByRole('menuitem', { name: 'Request Access' }).click();
        await page2.getByRole('button', { name: 'Request Access' }).click();
        await utils.checkNotification(page2, 'Emergency access requested');
        await mailBuffer.expect((m) => m.subject === "Emergency access request by " + users.user2.name + " initiated");
    });
    await test.step('Approved', async () => {
        await emergencyAccess(test, page, users.user1);
        await page.getByRole('button', { name: 'Options' }).click();
        await page.getByRole('menuitem', { name: 'Approve' }).click();
        await page.getByRole('button', { name: 'Approve' }).click();
        await utils.checkNotification(page, 'Emergency access approved');
        await mailBuffer2.expect((m) => m.subject === "Emergency access request for " + users.user1.name + " approved");
    });
    await activateTOTP(test, page, users.user1);
    let newPassword = "TotoNewPassword";
    await test.step('Access', async () => {
        await emergencyAccess(test, page2, users.user2);
        await page2.getByRole('button', { name: 'Options' }).click();
        await page2.getByRole('menuitem', { name: 'Takeover' }).click();
        await page2.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
        await page2.getByRole('textbox', { name: 'Confirm new master password' }).fill(newPassword);
        await page2.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page2, 'Password reset for ' + users.user1.name);
    });
    await test.step('Changed no 2fa', async () => {
        users.user1.password = newPassword;
        await logUser(test, page, users.user1);
    });
    await test.step('Reject', async () => {
        await emergencyAccess(test, page, users.user1);
        await page.getByRole('button', { name: 'Options' }).click();
        await page.getByRole('menuitem', { name: 'Reject' }).click();
        await utils.checkNotification(page, 'Emergency access rejected');
        await mailBuffer2.expect((m) => m.subject === "Emergency access request to " + users.user1.name + " rejected");
    });
    await test.step('Remove', async () => {
        await page.getByRole('button', { name: 'Options' }).click();
        await page.getByRole('menuitem', { name: 'Remove' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
        await utils.checkNotification(page, 'Removed user ' + users.user2.name);
        await expect(page.getByText('You have not added any emergency contacts')).toBeVisible();
    });
 });
@@ -3,7 +3,7 @@ import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP, recoveryCodes } from './setups/2fa';
+import { activateTOTP, disableTOTP } from './setups/2fa';
 let users = utils.loadEnv();
 let totp;
@@ -31,42 +31,21 @@ test('Authenticator 2fa', async ({ page }) => {
    await utils.logout(test, page, users.user1);
    await logUser(test, page, users.user1, { totp });
    await disableTOTP(test, page, users.user1);
 });
 test('Recovery codes', async ({ context, page }) => {
    await logUser(test, page, users.user1);
    await activateTOTP(test, page, users.user1);
    let recovery = await recoveryCodes(test, page, users.user1);
    await utils.logout(test, page, users.user1);
    await test.step('login', async () => {
        let timestamp = Date.now(); // Needed to use the next token
        timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
        await page.getByLabel(/Email address/).fill(users.user1.email);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Log in', exact: true }).click();
        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
        await page.getByRole('button', { name: 'Continue' }).click();
        await expect(page).toHaveTitle(/Vaultwarden Web/);
        const newPagePromise = context.waitForEvent('page');
        await page.getByRole('button', { name: 'Use your recovery code' }).click();
        const newPage = await newPagePromise;
        const tabs = context.pages();
        await tabs[1].bringToFront();
        await expect(tabs[1].getByRole('heading', { name: 'Recover account two-step login' })).toBeVisible();
        await tabs[1].getByRole('textbox', { name: 'Email address * (required)' }).fill(users.user1.email);
        await tabs[1].getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
        await tabs[1].getByRole('textbox', { name: 'Recovery code * (required)' }).fill(recovery);
        await tabs[1].getByRole('button', { name: 'Submit' }).click();
        await expect(tabs[1]).toHaveTitle(/Two-step login/);
    });
 });
    await disableTOTP(test, page, users.user1);
 });
@@ -4,24 +4,6 @@ import * as OTPAuth from "otpauth";
 import * as utils from '../../global-utils';
 export async function recoveryCodes(test: Test, page: Page, user: { name: string, password: string }): string {
    return await test.step('Recovery code', async () => {
        await page.getByRole('button', { name: user.name }).click();
        await page.getByRole('menuitem', { name: 'Account settings' }).click();
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.getByRole('button', { name: 'View recovery code' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        const recovery = await page.getByRole('code').innerText();
        await page.getByLabel('Close').click();
        return recovery;
    })
 }
 export async function activateTOTP(test: Test, page: Page, user: { name: string, password: string }): OTPAuth.TOTP {
    return await test.step('Activate TOTP 2FA', async () => {
        await page.getByRole('button', { name: user.name }).click();
@@ -39,6 +21,7 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
        await page.getByLabel(/Verification code/).fill(totp.generate());
        await page.getByRole('button', { name: 'Turn on' }).click();
        await page.getByRole('heading', { name: 'Turned on', exact: true });
        await page.getByLabel('Close').click();
        return totp;
    })
@@ -2,7 +2,6 @@ import { expect, type Browser, Page } from '@playwright/test';
 import { type MailBuffer } from 'maildev';
 import * as OTPAuth from "otpauth";
 import * as utils from '../../global-utils';
 import { retrieveEmailCode } from './2fa';
@@ -44,7 +43,6 @@ export async function logUser(
        mailBuffer ?: MailBuffer,
        mail2fa?: boolean,
        notNewDevice?: boolean,
        totp?: OTPAuth.TOTP,
    } = {}
 ) {
    await test.step(`Log user ${user.email}`, async () => {
@@ -57,23 +55,11 @@ export async function logUser(
        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
        await page.getByRole('button', { name: 'Log in', exact: true }).click();
-        if( options.mail2fa || options.totp ){
+        if( options.mail2fa ){
            let code;
            await test.step('2FA check', async () => {
                await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-
+                let code = await retrieveEmailCode(test, page, options.mailBuffer);
                if( options.totp ) {
                    const totp = options.totp;
                    let timestamp = Date.now(); // Needed to use the next token
                    timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
                    code = totp.generate({timestamp});
                } else if( options.mail2fa ){
                    code = await retrieveEmailCode(test, page, options.mailBuffer);
                }
                await page.getByLabel(/Verification code/).fill(code);
                await page.getByRole('button', { name: 'Continue' }).click();
            });
        }
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.99.0"
+channel = "1.98.1"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
@@ -508,7 +508,6 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty
 async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
    let mut user = get_user_or_404(&user_id, &conn).await?;
    TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
    Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
    two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?;
    user.totp_recover = None;
    user.save(&conn).await
@@ -906,23 +905,23 @@ mod tests {
    fn validate_web_vault_compare() {
        // web_vault_compare(active, latest)
        // Test normal versions
-        assert_eq!(web_vault_compare("2025.12.0", "2025.12.1"), -1);
+        assert!(web_vault_compare("2025.12.0", "2025.12.1") == -1);
-        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1"), 0);
+        assert!(web_vault_compare("2025.12.1", "2025.12.1") == 0);
-        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1"), 1);
+        assert!(web_vault_compare("2025.12.2", "2025.12.1") == 1);
        // Test patched/+build.n versions
        // Newer latest version
-        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1"), -1);
+        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1") == -1);
-        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1+build.1"), -1);
+        assert!(web_vault_compare("2025.12.1", "2025.12.1+build.1") == -1);
-        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1"), -1);
+        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1") == -1);
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2"), -1);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2") == -1);
        // Equal versions
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1"), 0);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1") == 0);
-        assert_eq!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2"), 0);
+        assert!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2") == 0);
        // Newer active version
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1"), 1);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1") == 1);
-        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1+build.1"), 1);
+        assert!(web_vault_compare("2025.12.2", "2025.12.1+build.1") == 1);
-        assert_eq!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1"), 1);
+        assert!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1") == 1);
-        assert_eq!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2"), 1);
+        assert!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2") == 1);
    }
 }
@@ -23,13 +23,14 @@ use crate::{
        models::{
            Archive, Attachment, AttachmentId, Cipher, CipherId, Collection, CollectionCipher, CollectionGroup,
            CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, KeyId,
-            Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, UserId,
+            Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, User, UserId,
            is_data_blob_encrypted,
        },
    },
    util::{NumberOrString, deser_opt_nonempty_str, save_temp_file},
 };
-use super::{folders::FolderData, sends::SIZE_525_MB};
+use super::folders::FolderData;
 pub fn routes() -> Vec<Route> {
    // Note that many routes have an `admin` variant; this seems to be
@@ -189,12 +190,22 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
            // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
            "masterKeyEncryptedUserKey": headers.user.akey,
            "masterKeyWrappedUserKey": headers.user.akey,
-            "salt": headers.user.email
+            "salt": headers.user.email,
            "containedKeyId": headers.user.key_id,
        })
    } else {
        Value::Null
    };
    // Upstream omits these two when unset rather than sending null.
    let mut user_decryption = json!({ "masterPasswordUnlock": master_password_unlock });
    if let Some(key_id) = &headers.user.key_id {
        user_decryption["userKeyId"] = json!(key_id);
    }
    if let Some(v2_upgrade_token) = headers.user.v2_upgrade_token_json() {
        user_decryption["v2UpgradeToken"] = v2_upgrade_token;
    }
    Ok(Json(json!({
        "profile": user_json,
        "folders": folders_json,
@@ -204,10 +215,7 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
        "ciphers": ciphers_json,
        "domains": domains_json,
        "sends": sends_json,
-        "userDecryption": {
+        "userDecryption": user_decryption,
            "masterPasswordUnlock": master_password_unlock,
            "userKeyId": headers.user.key_id,
        },
        "object": "sync"
    })))
 }
@@ -284,7 +292,8 @@ pub struct CipherData {
    Passport = 8
    */
    pub r#type: i32,
-    pub name: String,
+    // Absent on a blob-encrypted cipher, whose name is sealed inside `data`
    pub name: Option<String>,
    pub notes: Option<String>,
    fields: Option<Value>,
@@ -298,6 +307,9 @@ pub struct CipherData {
    drivers_license: Option<Value>,
    passport: Option<Value>,
    // The sealed blob of a v2 account's cipher, which replaces all of the fields above
    data: Option<String>,
    favorite: Option<bool>,
    reprompt: Option<i32>,
@@ -319,6 +331,70 @@ pub struct CipherData {
    archived_date: Option<String>,
 }
 /// A field of a [`CipherData`] that fails upstream's model validation.
 #[derive(Debug)]
 pub struct CipherValidationError {
    pub field: &'static str,
    pub message: String,
 }
 impl From<CipherValidationError> for crate::Error {
    fn from(e: CipherValidationError) -> Self {
        Self::new_msg(e.message)
    }
 }
 /// A user-owned cipher must be encrypted with the user's current key. Organization ciphers use the
 /// organization key, which has no id yet, and either id may be missing: from a client that predates
 /// the field, or a user whose key id isn't known yet. There is nothing to compare in those cases.
 ///
 /// Ref: upstream's `CiphersController.ValidateCipherEncryptedByUser`
 fn validate_encrypted_by_user_key(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
    if !is_org_cipher
        && let (Some(cipher_key_id), Some(user_key_id)) = (&data.encrypted_by_key_id, &user.key_id)
        && cipher_key_id != user_key_id
    {
        err!("Cipher was not encrypted with the current user key. Please try again.")
    }
    Ok(())
 }
 /// Upstream's `[StringLength(500000)]` on `CipherRequestModel.Data`
 const MAX_CIPHER_DATA_LENGTH: usize = 500_000;
 impl CipherData {
    /// Whether the content is a single blob rather than the per-type fields. This parses `data`, so
    /// callers that need the answer more than once should keep it.
    pub fn is_blob(&self) -> bool {
        self.data.as_deref().is_some_and(is_data_blob_encrypted)
    }
    /// Checks the content the way upstream's model validation does, before anything is saved.
    /// `is_blob` is [`Self::is_blob`].
    ///
    /// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/Vault/Models/Request/CipherRequestModel.cs>
    pub fn validate_content(&self, is_blob: bool) -> Result<(), CipherValidationError> {
        if let Some(data) = &self.data
            && data.len() > MAX_CIPHER_DATA_LENGTH
        {
            return Err(CipherValidationError {
                field: "Data",
                message: format!("The field Data must be a string with a maximum length of {MAX_CIPHER_DATA_LENGTH}."),
            });
        }
        // A blob carries the name inside it, so only the other formats need one
        if !is_blob && self.name.as_deref().is_none_or(|n| n.trim().is_empty()) {
            return Err(CipherValidationError {
                field: "Name",
                message: String::from("The Name field is required."),
            });
        }
        Ok(())
    }
 }
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PartialCipherData {
@@ -355,13 +431,14 @@ async fn post_ciphers_create(
    if data.cipher.encrypted_for != headers.user.uuid {
        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
    }
    validate_encrypted_by_user_key(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
    // This check is usually only needed in update_cipher_from_data(), but we
    // need it here as well to avoid creating an empty cipher in the call to
    // cipher.save() below.
    enforce_personal_ownership_policy(Some(&data.cipher), &headers, &conn).await?;
-    let mut cipher = Cipher::new(data.cipher.r#type, data.cipher.name.clone());
+    let mut cipher = Cipher::new(data.cipher.r#type, String::new());
    cipher.user_uuid = Some(headers.user.uuid.clone());
    cipher.save(&conn).await?;
@@ -389,12 +466,7 @@ async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt
        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
    }
-    if let Some(cipher_key_id) = &data.encrypted_by_key_id
+    validate_encrypted_by_user_key(&data, &headers.user, data.organization_id.is_some())?;
        && let Some(user_key_id) = &headers.user.key_id
        && cipher_key_id != user_key_id
    {
        err_code!("Invalid key cipher", Status::UnprocessableEntity.code);
    }
    // The web/browser clients set this field to null as expected, but the
    // mobile clients seem to set the invalid value `0001-01-01T00:00:00`,
@@ -402,7 +474,7 @@ async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt
    // needed when creating a new cipher, so just ignore it unconditionally.
    data.last_known_revision_date = None;
-    let mut cipher = Cipher::new(data.r#type, data.name.clone());
+    let mut cipher = Cipher::new(data.r#type, String::new());
    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherCreate).await?;
    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -441,16 +513,19 @@ pub async fn update_cipher_from_data(
    // We do not mind which data is in it, the keep our model more flexible when there are upstream changes.
    // But, we at least know we do not need to store and return this specific key.
    fn clean_cipher_data(mut json_data: Value) -> Value {
-        if let Some(items) = json_data.as_array_mut() {
+        if json_data.is_array() {
-            for item in items.iter_mut().filter_map(Value::as_object_mut) {
+            json_data.as_array_mut().unwrap().iter_mut().for_each(|ref mut f| {
-                item.remove("response");
+                f.as_object_mut().unwrap().remove("response");
-            }
+            });
        }
        json_data
    }
    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
    let is_blob = data.is_blob();
    data.validate_content(is_blob)?;
    // Check that the client isn't updating an existing cipher with stale data.
    // And only perform this check when not importing ciphers, else the date/time check will fail.
    if ut != UpdateType::None
@@ -486,10 +561,9 @@ pub async fn update_cipher_from_data(
            Some(member) => {
                // A non-empty list of collections implies the caller already validated the user's write
                // access to them, so we can move the cipher into the organization on that basis.
                // Write access to the cipher itself only counts when it already belongs to this organization.
                if shared_to_collections.as_ref().is_some_and(|cols| !cols.is_empty())
                    || member.has_full_access()
-                    || (!transfer_cipher && cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await)
+                    || cipher.is_write_accessible_to_user(&headers.user.uuid, conn).await
                {
                    cipher.organization_uuid = Some(org_id);
                    // After some discussion in PR #1329 re-added the user_uuid = None again.
@@ -551,26 +625,35 @@ pub async fn update_cipher_from_data(
        _ => err!("Invalid type"),
    };
-    let type_data = if let Some(mut data) = type_data_opt {
+    if let Some(blob) = data.data.filter(|_| is_blob) {
-        // Remove the 'Response' key from the base object.
+        // A blob holds all of the content, the name included, so nothing is kept outside it. The name
-        if let Some(data_obj) = data.as_object_mut() {
+        // column can't be null, so it's left empty; `to_json` reports it as null, as upstream does.
-            data_obj.remove("response");
+        // TODO: Make `ciphers.name` nullable and store `None` here instead.
-        }
+        cipher.name = String::new();
-        // Remove the 'Response' key from every Uri.
+        cipher.notes = None;
-        if data["uris"].is_array() {
+        cipher.fields = None;
-            data["uris"] = clean_cipher_data(data["uris"].clone());
+        cipher.password_history = None;
-        }
+        cipher.data = blob;
        data
    } else {
-        err!("Data missing")
+        let Some(mut type_data) = type_data_opt else {
-    };
+            err!("Data missing")
        };
        // Remove the 'Response' key from the base object.
        type_data.as_object_mut().unwrap().remove("response");
        // Remove the 'Response' key from every Uri.
        if type_data["uris"].is_array() {
            type_data["uris"] = clean_cipher_data(type_data["uris"].clone());
        }
        // `validate_content` made sure there is a name
        cipher.name = data.name.unwrap_or_default();
        cipher.notes = data.notes;
        cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
        cipher.password_history = data.password_history.map(|f| f.to_string());
        cipher.data = type_data.to_string();
    }
    cipher.key = data.key;
    cipher.name = data.name;
    cipher.notes = data.notes;
    cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
    cipher.data = type_data.to_string();
    cipher.password_history = data.password_history.map(|f| f.to_string());
    cipher.reprompt = data.reprompt.filter(|r| *r == RepromptType::None as i32 || *r == RepromptType::Password as i32);
    cipher.save(conn).await?;
@@ -667,7 +750,7 @@ async fn post_ciphers_import(data: Json<ImportData>, headers: Headers, conn: DbC
        let folder_id = relations_map.get(&index).and_then(|i| folders.get(*i).cloned());
        cipher_data.folder_id = folder_id;
-        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
+        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
        update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
    }
@@ -735,6 +818,8 @@ async fn put_cipher(
        err!("Cipher is not write accessible")
    }
    validate_encrypted_by_user_key(&data, &headers.user, cipher.organization_uuid.is_some())?;
    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherUpdate).await?;
    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -1185,10 +1270,6 @@ async fn post_attachment_v2(
    if file_size < 0 {
        err!("Attachment size can't be negative")
    }
    // Matches the "file" upload limit in main.rs, nothing larger can be uploaded
    if file_size > SIZE_525_MB {
        err!("Max file size is 525 MB.")
    }
    let attachment_id = crypto::generate_attachment_id();
    let attachment =
        Attachment::new(attachment_id.clone(), cipher.uuid.clone(), data.file_name, file_size, Some(data.key));
@@ -1876,7 +1957,7 @@ async fn delete_cipher_by_uuid(
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct CipherIdsData {
-    ids: HashSet<CipherId>,
+    ids: Vec<CipherId>,
 }
 async fn delete_multiple_ciphers(
@@ -2187,15 +2268,8 @@ impl CipherSyncData {
            }
        }
        // Generate a HashMap with the Organization UUID as key and the Membership record
        let members: HashMap<OrganizationId, Membership> = Membership::find_confirmed_by_user(user_id, conn)
            .await
            .into_iter()
            .map(|m| (m.org_uuid.clone(), m))
            .collect();
        // Generate a list of Cipher UUID's containing a Vec with one or more Attachment records
-        let orgs: Vec<OrganizationId> = members.keys().cloned().collect();
+        let orgs = Membership::get_orgs_by_user(user_id, conn).await;
        let attachments = Attachment::find_all_by_user_and_orgs(user_id, &orgs, conn).await;
        let mut cipher_attachments: HashMap<CipherId, Vec<Attachment>> = HashMap::with_capacity(attachments.len());
        for attachment in attachments {
@@ -2210,6 +2284,13 @@ impl CipherSyncData {
            cipher_collections.entry(cipher).or_default().push(collection);
        }
        // Generate a HashMap with the Organization UUID as key and the Membership record
        let members: HashMap<OrganizationId, Membership> = Membership::find_confirmed_by_user(user_id, conn)
            .await
            .into_iter()
            .map(|m| (m.org_uuid.clone(), m))
            .collect();
        // Generate a HashMap with the User_Collections UUID as key and the CollectionUser record
        let user_collections: HashMap<CollectionId, CollectionUser> = CollectionUser::find_by_user(user_id, conn)
            .await
@@ -6,10 +6,7 @@ use crate::{
    CONFIG,
    api::{
        EmptyResult, JsonResult,
-        core::{
+        core::{CipherSyncData, CipherSyncType},
            CipherSyncData, CipherSyncType,
            accounts::{AuthenticationData, UnlockData},
        },
    },
    auth::{Headers, decode_emergency_access_invite},
    db::{
@@ -228,7 +225,7 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
    let (grantee_user, new_user) = match User::find_by_mail(&email, &conn).await {
        None => {
            if !CONFIG.invitations_allowed() {
-                err!(format!("Grantee user does not exist: {}", email.escape_debug()))
+                err!(format!("Grantee user does not exist: {email}"))
            }
            if !CONFIG.is_email_domain_allowed(&email) {
@@ -618,7 +615,6 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
        "kdfMemory": grantor_user.client_kdf_memory,
        "kdfParallelism": grantor_user.client_kdf_parallelism,
        "keyEncrypted": &emergency_access.key_encrypted,
        "salt": grantor_user.master_password_salt(),
        "object": "emergencyAccessTakeover",
    });
@@ -628,13 +624,8 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EmergencyAccessPasswordData {
-    // Legacy payload
+    new_master_password_hash: String,
-    new_master_password_hash: Option<String>,
+    key: String,
    key: Option<String>,
    // Current payload
    authentication_data: Option<AuthenticationData>,
    unlock_data: Option<UnlockData>,
 }
 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
@@ -647,6 +638,8 @@ async fn password_emergency_access(
    check_emergency_access_enabled()?;
    let data: EmergencyAccessPasswordData = data.into_inner();
    let new_master_password_hash = &data.new_master_password_hash;
    //let key = &data.Key;
    let requesting_user = headers.user;
    let Some(emergency_access) =
@@ -663,23 +656,8 @@ async fn password_emergency_access(
        err!("Grantor user not found.")
    };
    let (new_master_password_hash, new_key) =
        if let (Some(authentication_data), Some(unlock_data)) = (data.authentication_data, data.unlock_data) {
            authentication_data.check(&grantor_user, &unlock_data)?;
            if !authentication_data.kdf.matches_user(&grantor_user) {
                err!("KDF settings do not match the grantor account")
            }
            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
            (new_master_password_hash, new_key)
        } else {
            err!("Invalid request!")
        };
    // change grantor_user password
-    grantor_user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
+    grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
    grantor_user.save(&conn).await?;
    // Disable TwoFactor providers since they will otherwise block logins
@@ -6,13 +6,12 @@ use serde_json::Value;
 use crate::{
    CONFIG,
-    api::{ApiResult, EmptyResult, JsonResult},
+    api::{EmptyResult, JsonResult},
    auth::{AdminHeaders, Headers},
    db::{
        DbConn, DbPool,
        models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
    },
    error::MapResult,
    util::parse_date,
 };
@@ -30,14 +29,6 @@ struct EventRange {
    continuation_token: Option<String>,
 }
 impl EventRange {
    fn date_range(&self) -> ApiResult<(NaiveDateTime, NaiveDateTime)> {
        let start_date = parse_date(&self.start).map_res("Invalid start date")?;
        let end_date = parse_date(self.continuation_token.as_ref().unwrap_or(&self.end)).map_res("Invalid end date")?;
        Ok((start_date, end_date))
    }
 }
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/EventsController.cs#L87
 #[get("/organizations/<org_id>/events?<data..>")]
 async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: AdminHeaders, conn: DbConn) -> JsonResult {
@@ -48,7 +39,12 @@ async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: Admin
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
        let end_date = if let Some(before_date) = &data.continuation_token {
            parse_date(before_date)
        } else {
            parse_date(&data.end)
        };
        Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &conn)
            .await
@@ -73,7 +69,12 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade
    let events_json: Vec<Value> = if CONFIG.org_events_enabled()
        && Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await
    {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
        let end_date = if let Some(before_date) = &data.continuation_token {
            parse_date(before_date)
        } else {
            parse_date(&data.end)
        };
        Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn).await.iter().map(Event::to_json).collect()
    } else {
@@ -101,7 +102,12 @@ async fn get_user_events(
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
        let end_date = if let Some(before_date) = &data.continuation_token {
            parse_date(before_date)
        } else {
            parse_date(&data.end)
        };
        Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &conn)
            .await
@@ -162,10 +168,9 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
    }
    for event in data.iter() {
-        let event_date = parse_date(&event.date).map_res("Invalid event date")?;
+        let event_date = parse_date(&event.date);
        // Only the event types upstream accepts from clients, the rest are written server-side.
        match event.r#type {
-            t if t == EventType::UserClientExportedVault as i32 => {
+            1000..=1099 => {
                log_user_event_impl(
                    event.r#type,
                    &headers.user.uuid,
@@ -176,7 +181,7 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                )
                .await;
            }
-            t if t == EventType::OrganizationClientExportedVault as i32 => {
+            1600..=1699 => {
                // Only allow logging events for an organization the user is actually a member of.
                if let Some(org_id) = &event.organization_id
                    && Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await.is_some()
@@ -214,8 +219,7 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
-            // Client-side cipher events (viewed, copied, toggled, autofilled).
+            _ => {
            1107..=1114 | 1117 | 1119..=1132 => {
                // The cipher determines the organization the event is logged to, so make sure the
                // user can actually access it instead of trusting the provided cipher uuid.
                if let Some(cipher_uuid) = &event.cipher_id
@@ -236,17 +240,16 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
            _ => {}
        }
    }
    Ok(())
 }
-pub async fn log_user_event(event_type: EventType, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
+pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
    if !CONFIG.org_events_enabled() {
        return;
    }
-    log_user_event_impl(event_type as i32, user_id, device_type, None, ip, conn).await;
+    log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await;
 }
 async fn log_user_event_impl(
@@ -15,10 +15,10 @@ use crate::{
    db::{
        DbConn,
        models::{
-            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, Device,
+            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType,
-            EventType, Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus,
+            Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus, MembershipType,
-            MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor,
+            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User,
-            TwoFactorType, User, UserId,
+            UserId,
        },
    },
    mail,
@@ -26,13 +26,12 @@ use crate::{
    util::{NumberOrString, convert_json_key_lcase_first},
 };
 use super::accounts::{AuthenticationData, UnlockData};
 pub fn routes() -> Vec<Route> {
    routes![
        get_organization,
        create_organization,
        delete_organization,
        post_delete_organization,
        leave_organization,
        get_user_collections,
        get_org_collections,
@@ -40,10 +39,13 @@ pub fn routes() -> Vec<Route> {
        get_org_collection_detail,
        get_collection_users,
        put_organization,
        post_organization,
        post_organization_collections,
        post_bulk_access_collections,
        post_organization_collection_update,
        put_organization_collection_update,
        delete_organization_collection,
        post_organization_collection_delete,
        bulk_delete_organization_collections,
        post_bulk_collections,
        get_org_details,
@@ -58,6 +60,7 @@ pub fn routes() -> Vec<Route> {
        get_org_user_mini_details,
        get_user,
        edit_member,
        put_member,
        delete_member,
        bulk_delete_member,
        post_org_import,
@@ -67,6 +70,7 @@ pub fn routes() -> Vec<Route> {
        get_master_password_policy,
        get_policy,
        put_policy,
        put_policy_vnext,
        get_plans,
        post_org_keys,
        get_organization_keys,
@@ -82,16 +86,22 @@ pub fn routes() -> Vec<Route> {
        post_groups,
        get_group,
        put_group,
        post_group,
        get_group_details,
        delete_group,
        post_delete_group,
        bulk_delete_groups,
        get_group_members,
        put_group_members,
        post_delete_group_member,
        put_reset_password_enrollment,
        get_reset_password_details,
        put_reset_password,
        put_recover_account,
        get_org_export,
        post_api_key,
        rotate_api_key,
        get_billing_metadata,
        get_billing_warnings,
        get_auto_enroll_status,
        get_self_host_billing_metadata,
@@ -235,6 +245,16 @@ async fn delete_organization(
    }
 }
 #[post("/organizations/<org_id>/delete", data = "<data>")]
 async fn post_delete_organization(
    org_id: OrganizationId,
    data: Json<PasswordOrOtpData>,
    headers: OwnerHeaders,
    conn: DbConn,
 ) -> EmptyResult {
    delete_organization(org_id, data, headers, conn).await
 }
 #[post("/organizations/<org_id>/leave")]
 async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> EmptyResult {
    if headers.membership.status != MembershipStatus::Confirmed as i32 {
@@ -280,6 +300,16 @@ async fn put_organization(
    headers: OwnerHeaders,
    data: Json<OrganizationUpdateData>,
    conn: DbConn,
 ) -> JsonResult {
    post_organization(org_id, headers, data, conn).await
 }
 #[post("/organizations/<org_id>", data = "<data>")]
 async fn post_organization(
    org_id: OrganizationId,
    headers: OwnerHeaders,
    data: Json<OrganizationUpdateData>,
    conn: DbConn,
 ) -> JsonResult {
    if org_id != headers.org_id {
        err!("Organization not found", "Organization id's do not match");
@@ -385,9 +415,8 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea
    let col_users = CollectionUser::find_by_organization_swap_user_uuid_with_member_uuid(&org_id, &conn).await;
    // Generate a HashMap to get the correct MembershipType per user to determine the manage permission
    // We use the uuid instead of the user_uuid here, since that is what is used in CollectionUser
    // This lists other members for admins, so it must not depend on the membership status
    let membership_type: HashMap<MembershipId, i32> =
-        Membership::find_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();
+        Membership::find_confirmed_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();
    // check if current user has full access to the organization (either directly or via any group)
    let has_full_access_to_org = member.has_full_access()
@@ -610,6 +639,17 @@ async fn put_organization_collection_update(
    headers: ManagerHeaders,
    data: Json<FullCollectionData>,
    conn: DbConn,
 ) -> JsonResult {
    post_organization_collection_update(org_id, col_id, headers, data, conn).await
 }
 #[post("/organizations/<org_id>/collections/<col_id>", data = "<data>", rank = 2)]
 async fn post_organization_collection_update(
    org_id: OrganizationId,
    col_id: CollectionId,
    headers: ManagerHeaders,
    data: Json<FullCollectionData>,
    conn: DbConn,
 ) -> JsonResult {
    if org_id != headers.org_id {
        err!("Organization not found", "Organization id's do not match");
@@ -705,6 +745,16 @@ async fn delete_organization_collection(
    delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
 }
 #[post("/organizations/<org_id>/collections/<col_id>/delete")]
 async fn post_organization_collection_delete(
    org_id: OrganizationId,
    col_id: CollectionId,
    headers: ManagerHeaders,
    conn: DbConn,
 ) -> EmptyResult {
    delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
 }
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "camelCase")]
 struct BulkCollectionIds {
@@ -768,9 +818,11 @@ async fn get_org_collection_detail(
            // Generate a HashMap to get the correct MembershipType per user to determine the manage permission
            // We use the uuid instead of the user_uuid here, since that is what is used in CollectionUser
-            // This lists other members for admins, so it must not depend on the membership status
+            let membership_type: HashMap<MembershipId, i32> = Membership::find_confirmed_by_org(&org_id, &conn)
-            let membership_type: HashMap<MembershipId, i32> =
+                .await
-                Membership::find_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();
+                .into_iter()
                .map(|m| (m.uuid, m.atype))
                .collect();
            let users: Vec<Value> =
                CollectionUser::find_by_org_and_coll_swap_user_uuid_with_member_uuid(&org_id, &collection.uuid, &conn)
@@ -908,9 +960,8 @@ async fn get_members(
    let mut users_json = Vec::new();
    for u in Membership::find_by_org(&org_id, &conn).await {
        // The user can be a manager instead of an admin, but we've checked above that they have full access
        users_json.push(
-            u.to_json_details_for_admin(
+            u.to_json_user_details(
                data.include_collections.unwrap_or(false),
                data.include_groups.unwrap_or(false),
                &conn,
@@ -1030,7 +1081,7 @@ async fn send_invite(
        let user = match User::find_by_mail(email, &conn).await {
            None => {
                if !CONFIG.invitations_allowed() {
-                    err!(format!("User does not exist: {}", email.escape_debug()))
+                    err!(format!("User does not exist: {email}"))
                }
                if !CONFIG.is_email_domain_allowed(email) {
@@ -1048,7 +1099,7 @@ async fn send_invite(
            }
            Some(user) => {
                if Membership::find_by_user_and_org(&user.uuid, &org_id, &conn).await.is_some() {
-                    err!(format!("User already in organization: {}", email.escape_debug()))
+                    err!(format!("User already in organization: {email}"))
                }
                if !CONFIG.mail_enabled() {
@@ -1323,9 +1374,7 @@ async fn bulk_confirm_invite(
    match data.keys {
        Some(keys) => {
            for invite in keys {
-                let Some(member_id) = invite.id else {
+                let member_id = invite.id.unwrap();
                    err!("Member id is required")
                };
                let user_key = invite.key.unwrap_or_default();
                let err_msg = match confirm_invite_impl(&org_id, &member_id, &user_key, &headers, &conn, &nt).await {
                    Ok(()) => String::new(),
@@ -1467,9 +1516,7 @@ async fn get_user(
    // In this case, when groups are requested we also need to include collections.
    // Else these will not be shown in the interface, and could lead to missing collections when saved.
    let include_groups = data.include_groups.unwrap_or(false);
-    Ok(Json(
+    Ok(Json(user.to_json_user_details(data.include_collections.unwrap_or(include_groups), include_groups, &conn).await))
        user.to_json_details_for_admin(data.include_collections.unwrap_or(include_groups), include_groups, &conn).await,
    ))
 }
 #[derive(Deserialize)]
@@ -1483,6 +1530,17 @@ struct EditUserData {
 }
 #[put("/organizations/<org_id>/users/<member_id>", data = "<data>", rank = 1)]
 async fn put_member(
    org_id: OrganizationId,
    member_id: MembershipId,
    data: Json<EditUserData>,
    headers: AdminHeaders,
    conn: DbConn,
 ) -> EmptyResult {
    edit_member(org_id, member_id, data, headers, conn).await
 }
 #[post("/organizations/<org_id>/users/<member_id>", data = "<data>", rank = 1)]
 async fn edit_member(
    org_id: OrganizationId,
    member_id: MembershipId,
@@ -1777,10 +1835,6 @@ async fn post_org_import(
    if org_id != headers.membership.org_uuid {
        err!("Organization not found", "Organization id's do not match");
    }
    // OrgMemberHeaders also allows invited and accepted members, which are not allowed to import
    if headers.membership.status != MembershipStatus::Confirmed as i32 {
        err!("You need to be a Member of the Organization to call this endpoint")
    }
    let data: ImportData = data.into_inner();
    // Validate the import before continuing
@@ -1831,7 +1885,7 @@ async fn post_org_import(
        cipher_data.folder_id = None;
        // Replace the client-provided, unvalidated organizationId with the real target org
        cipher_data.organization_id = Some(org_id.clone());
-        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
+        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
        update_cipher_from_data(
            &mut cipher,
            cipher_data,
@@ -1862,7 +1916,7 @@ async fn post_org_import(
 #[serde(rename_all = "camelCase")]
 struct BulkCollectionsData {
    organization_id: OrganizationId,
-    cipher_ids: HashSet<CipherId>,
+    cipher_ids: Vec<CipherId>,
    collection_ids: HashSet<CollectionId>,
    remove_collections: bool,
 }
@@ -2141,6 +2195,18 @@ async fn put_policy(
    Ok(Json(policy.to_json()))
 }
 // Deprecated with client v2026.5.0
 #[put("/organizations/<org_id>/policies/<pol_type>/vnext", data = "<data>")]
 async fn put_policy_vnext(
    org_id: OrganizationId,
    pol_type: i32,
    data: Json<PutPolicy>,
    headers: AdminHeaders,
    conn: DbConn,
 ) -> JsonResult {
    put_policy(org_id, pol_type, data, headers, conn).await
 }
 #[get("/plans")]
 fn get_plans() -> Json<Value> {
    // Respond with a minimal json just enough to allow the creation of an new organization.
@@ -2169,6 +2235,12 @@ fn get_plans() -> Json<Value> {
    }))
 }
 #[get("/organizations/<_org_id>/billing/metadata")]
 fn get_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json<Value> {
    // Prevent a 404 error, which also causes Javascript errors.
    Json(empty_data_json())
 }
 #[get("/organizations/<_org_id>/billing/vnext/warnings")]
 fn get_billing_warnings(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json<Value> {
    Json(json!({
@@ -2188,6 +2260,14 @@ fn get_self_host_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHe
    }))
 }
 fn empty_data_json() -> Value {
    json!({
        "object": "list",
        "data": [],
        "continuationToken": null
    })
 }
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "camelCase")]
 struct BulkRevokeMembershipIds {
@@ -2506,6 +2586,17 @@ impl CollectionData {
    }
 }
 #[post("/organizations/<org_id>/groups/<group_id>", data = "<data>")]
 async fn post_group(
    org_id: OrganizationId,
    group_id: GroupId,
    data: Json<GroupRequest>,
    headers: AdminHeaders,
    conn: DbConn,
 ) -> JsonResult {
    put_group(org_id, group_id, data, headers, conn).await
 }
 #[post("/organizations/<org_id>/groups", data = "<data>")]
 async fn post_groups(
    org_id: OrganizationId,
@@ -2615,6 +2706,7 @@ async fn add_update_group(
        "id": group.uuid,
        "organizationId": group.organizations_uuid,
        "name": group.name,
        "accessAll": group.access_all,
        "externalId": group.external_id,
        "object": "group"
    })))
@@ -2641,6 +2733,16 @@ async fn get_group_details(
    Ok(Json(group.to_json_details(&conn).await))
 }
 #[post("/organizations/<org_id>/groups/<group_id>/delete")]
 async fn post_delete_group(
    org_id: OrganizationId,
    group_id: GroupId,
    headers: AdminHeaders,
    conn: DbConn,
 ) -> EmptyResult {
    delete_group_impl(&org_id, &group_id, &headers, &conn).await
 }
 #[delete("/organizations/<org_id>/groups/<group_id>")]
 async fn delete_group(org_id: OrganizationId, group_id: GroupId, headers: AdminHeaders, conn: DbConn) -> EmptyResult {
    delete_group_impl(&org_id, &group_id, &headers, &conn).await
@@ -2742,6 +2844,90 @@ async fn get_group_members(
    Ok(Json(json!(group_members)))
 }
 #[put("/organizations/<org_id>/groups/<group_id>/users", data = "<data>")]
 async fn put_group_members(
    org_id: OrganizationId,
    group_id: GroupId,
    headers: AdminHeaders,
    data: Json<Vec<MembershipId>>,
    conn: DbConn,
 ) -> EmptyResult {
    if org_id != headers.org_id {
        err!("Organization not found", "Organization id's do not match");
    }
    if !CONFIG.org_groups_enabled() {
        err!("Group support is disabled");
    }
    if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() {
        err!("Group could not be found!", "Group uuid is invalid or does not belong to the organization")
    }
    let assigned_members = data.into_inner();
    let org_memberships = Membership::find_by_org(&org_id, &conn).await;
    let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
    if let Some(e) = assigned_members.iter().find(|m| !org_membership_ids.contains(m)) {
        err!("Invalid member", format!("Member {} does not belong to organization {}!", e, org_id))
    }
    GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?;
    for assigned_member in assigned_members {
        let mut user_entry = GroupUser::new(group_id.clone(), assigned_member.clone());
        user_entry.save(&conn).await?;
        log_event(
            EventType::OrganizationUserUpdatedGroups,
            &assigned_member,
            &org_id,
            &headers.user.uuid,
            headers.device.atype,
            &headers.ip.ip,
            &conn,
        )
        .await;
    }
    Ok(())
 }
 #[post("/organizations/<org_id>/groups/<group_id>/delete-user/<member_id>")]
 async fn post_delete_group_member(
    org_id: OrganizationId,
    group_id: GroupId,
    member_id: MembershipId,
    headers: AdminHeaders,
    conn: DbConn,
 ) -> EmptyResult {
    if org_id != headers.org_id {
        err!("Organization not found", "Organization id's do not match");
    }
    if !CONFIG.org_groups_enabled() {
        err!("Group support is disabled");
    }
    if Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await.is_none() {
        err!("User could not be found or does not belong to the organization.");
    }
    if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() {
        err!("Group could not be found or does not belong to the organization.");
    }
    log_event(
        EventType::OrganizationUserUpdatedGroups,
        &member_id,
        &org_id,
        &headers.user.uuid,
        headers.device.atype,
        &headers.ip.ip,
        &conn,
    )
    .await;
    GroupUser::delete_by_group_and_member(&group_id, &member_id, &conn).await
 }
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserResetPasswordEnrollmentRequest {
@@ -2753,14 +2939,9 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserRecoverAccountRequest {
    // Legacy payload
    new_master_password_hash: Option<String>,
    key: Option<String>,
    // Current payload
    authentication_data: Option<AuthenticationData>,
    unlock_data: Option<UnlockData>,
    #[serde(default)]
    reset_master_password: bool,
    #[serde(default)]
@@ -2806,6 +2987,19 @@ async fn put_recover_account(
    recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
 }
 // Deprecated since `v2026.4.2`
 #[put("/organizations/<org_id>/users/<member_id>/reset-password", data = "<data>")]
 async fn put_reset_password(
    org_id: OrganizationId,
    member_id: MembershipId,
    headers: AdminHeaders,
    data: Json<OrganizationUserRecoverAccountRequest>,
    conn: DbConn,
    nt: Notify<'_>,
 ) -> EmptyResult {
    recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
 }
 async fn recover_account(
    org_id: OrganizationId,
    member_id: MembershipId,
@@ -2838,34 +3032,10 @@ async fn recover_account(
        err!("Organization user must be confirmed for password reset functionality");
    }
-    let fallback_2fa_email =
+    let fallback_2fa_email = if req.reset_two_factor && CONFIG.email_2fa_auto_fallback() {
-        if req.reset_two_factor && CONFIG.mail_enabled() && CONFIG.email_2fa_auto_fallback() && user.verified() {
+        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
            TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await.is_none()
        } else {
            false
        };
    // Check the new password before the email below, so that a rejected request doesn't tell the user
    // their password was reset
    let new_password = if req.reset_master_password {
        let (new_master_password_hash, new_key) = if let (Some(authentication_data), Some(unlock_data)) =
            (req.authentication_data, req.unlock_data)
        {
            authentication_data.check(&user, &unlock_data)?;
            if !authentication_data.kdf.matches_user(&user) {
                err!("KDF settings do not match the user account")
            }
            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
        } else if let (Some(new_master_password_hash), Some(new_key)) = (req.new_master_password_hash, req.key) {
            (new_master_password_hash, new_key)
        } else {
            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
        };
        Some((new_master_password_hash, new_key))
    } else {
-        None
+        false
    };
    // Sending email first ensure working email configuration and the resulting user notification.
@@ -2883,13 +3053,18 @@ async fn recover_account(
        err!(format!("Error sending user reset password email: {e:#?}"));
    }
-    if let Some((new_master_password_hash, new_key)) = new_password {
+    if req.reset_master_password {
-        user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
+        if let Some(key) = req.key
            && let Some(hash) = req.new_master_password_hash
        {
            user.set_password(hash.as_str(), Some(key), true, None, &conn).await?;
        } else {
            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
        }
    }
    if req.reset_two_factor {
        TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
        if !fallback_2fa_email || two_factor::email::find_and_activate_email_2fa(&user.uuid, &conn).await.is_err() {
            two_factor::enforce_2fa_policy(&user, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                .await?;
@@ -2943,7 +3118,6 @@ async fn get_reset_password_details(
        "kdfIterations": user.client_kdf_iter,
        "kdfMemory": user.client_kdf_memory,
        "kdfParallelism": user.client_kdf_parallelism,
        "masterPasswordSalt": user.master_password_salt(),
        "resetPasswordKey": member.reset_password_key,
        "encryptedPrivateKey": org.private_key,
    })))
@@ -3059,7 +3233,7 @@ async fn api_key(
    org_id: &OrganizationId,
    data: Json<PasswordOrOtpData>,
    rotate: bool,
-    headers: OwnerHeaders,
+    headers: AdminHeaders,
    conn: DbConn,
 ) -> JsonResult {
    if org_id != &headers.org_id {
@@ -3068,7 +3242,7 @@ async fn api_key(
    let data: PasswordOrOtpData = data.into_inner();
    let user = headers.user;
-    // Validate the owner users password/otp
+    // Validate the admin users password/otp
    data.validate(&user, true, &conn).await?;
    let org_api_key = if let Some(mut org_api_key) = OrganizationApiKey::find_by_org_uuid(org_id, &conn).await {
@@ -3096,7 +3270,7 @@ async fn api_key(
 async fn post_api_key(
    org_id: OrganizationId,
    data: Json<PasswordOrOtpData>,
-    headers: OwnerHeaders,
+    headers: AdminHeaders,
    conn: DbConn,
 ) -> JsonResult {
    api_key(&org_id, data, false, headers, conn).await
@@ -3106,7 +3280,7 @@ async fn post_api_key(
 async fn rotate_api_key(
    org_id: OrganizationId,
    data: Json<PasswordOrOtpData>,
-    headers: OwnerHeaders,
+    headers: AdminHeaders,
    conn: DbConn,
 ) -> JsonResult {
    api_key(&org_id, data, true, headers, conn).await
@@ -58,13 +58,25 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
    let org_id = token.0;
    let data = data.into_inner();
    // Like upstream, the import never removes Owners, so it doesn't revoke or restore them either.
    for user_data in &data.members {
        let mut user_created: bool = false;
        if user_data.deleted {
            // If user is marked for deletion and it exists, revoke it
            if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &conn).await {
-                let revoked = member.atype != MembershipType::Owner && member.revoke();
+                // Only revoke a user if it is not the last confirmed owner
                let revoked = if member.atype == MembershipType::Owner
                    && member.status == MembershipStatus::Confirmed as i32
                {
                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &conn).await <= 1 {
                        warn!("Can't revoke the last owner");
                        false
                    } else {
                        member.revoke()
                    }
                } else {
                    member.revoke()
                };
                let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
                if revoked || ext_modified {
                    member.save(&conn).await?;
@@ -72,7 +84,7 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
            }
        // If user is part of the organization, restore it
        } else if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &conn).await {
-            let mut restored = member.atype != MembershipType::Owner && member.restore();
+            let mut restored = member.restore();
            let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
            // Enforce org policies as every other restore path does.
            // If the user is not allowed, we revoke again and continue so the external_id is still updated.
@@ -137,13 +149,9 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
    if CONFIG.org_groups_enabled() {
        for group_data in &data.groups {
-            let group_uuid = if let Some(mut group) =
+            let group_uuid = if let Some(group) =
                Group::find_by_external_id_and_org(&group_data.external_id, &org_id, &conn).await
            {
                if group.name != group_data.name {
                    group.name = group_data.name.clone();
                    group.save(&conn).await?;
                }
                group.uuid
            } else {
                let mut group =
@@ -172,8 +180,14 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
        for member in Membership::find_by_org(&org_id, &conn).await {
            if let Some(ref user_external_id) = member.external_id
                && !sync_members.contains(user_external_id)
                && member.atype != MembershipType::Owner
            {
                if member.atype == MembershipType::Owner && member.status == MembershipStatus::Confirmed as i32 {
                    // Removing owner, check that there is at least one other confirmed owner
                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &conn).await <= 1 {
                        warn!("Can't delete the last owner");
                        continue;
                    }
                }
                member.delete(&conn).await?;
            }
        }
@@ -12,7 +12,7 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::{ApiResult, EmptyResult, JsonResult, Notify, UpdateType},
-    auth::{Headers, Host, SendHeaders},
+    auth::{ClientIp, Headers, Host, SendHeaders},
    config::PathType,
    db::{
        DbConn, DbPool,
@@ -23,7 +23,7 @@ use crate::{
 const SEND_INACCESSIBLE_MSG: &str = "Send does not exist or is no longer available";
 static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
-    let dt = DateTime::UNIX_EPOCH.naive_utc();
+    let dt = crate::util::parse_date("1970-01-01T00:00:00.000000Z");
    Device {
        uuid: String::from("00000000-0000-0000-0000-000000000000").into(),
        created_at: dt,
@@ -39,15 +39,18 @@ static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
 });
 // The max file size allowed by Bitwarden clients and add an extra 5% to avoid issues
-pub(crate) const SIZE_525_MB: i64 = 550_502_400;
+const SIZE_525_MB: i64 = 550_502_400;
 pub fn routes() -> Vec<rocket::Route> {
    routes![
        get_sends,
        get_send,
        post_send,
        post_send_file,
        post_access,
        post_access_legacy,
        post_access_file,
        post_access_file_legacy,
        put_send,
        delete_send,
        put_remove_password,
@@ -70,7 +73,7 @@ pub async fn purge_sends(pool: DbPool) {
 #[serde(rename_all = "camelCase")]
 pub struct SendData {
    r#type: i32,
-    pub key: String,
+    key: String,
    password: Option<String>,
    max_access_count: Option<NumberOrString>,
    expiration_date: Option<DateTime<Utc>>,
@@ -198,7 +201,7 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
    enforce_disable_hide_email_policy(&data, &headers, &conn).await?;
    if data.r#type == SendType::File as i32 {
-        err!("File sends should use /api/sends/file/v2")
+        err!("File sends should use /api/sends/file")
    }
    let mut send = create_send(data, headers.user.uuid)?;
@@ -215,11 +218,93 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
    Ok(Json(send.to_json()))
 }
 #[derive(FromForm)]
 struct UploadData<'f> {
    model: Json<SendData>,
    data: TempFile<'f>,
 }
 #[derive(FromForm)]
 struct UploadDataV2<'f> {
    data: TempFile<'f>,
 }
 // @deprecated Mar 25 2021: This method has been deprecated in favor of direct uploads (v2).
 // This method still exists to support older clients, probably need to remove it sometime.
 // Upstream: https://github.com/bitwarden/server/blob/d0c793c95181dfb1b447eb450f85ba0bfd7ef643/src/Api/Controllers/SendsController.cs#L164-L167
 // 2025: This endpoint doesn't seem to exists anymore in the latest version
 // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs
 #[post("/sends/file", format = "multipart/form-data", data = "<data>")]
 async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    enforce_disable_send_policy(&headers, &conn).await?;
    let UploadData {
        model,
        data,
    } = data.into_inner();
    let model = model.into_inner();
    let Some(size) = data.len().to_i64() else {
        err!("Invalid send size");
    };
    if size < 0 {
        err!("Send size can't be negative")
    }
    enforce_disable_hide_email_policy(&model, &headers, &conn).await?;
    let size_limit = match CONFIG.user_send_limit() {
        Some(0) => err!("File uploads are disabled"),
        Some(limit_kb) => {
            let Some(already_used) = Send::size_by_user(&headers.user.uuid, &conn).await else {
                err!("Existing sends overflow")
            };
            let Some(left) = limit_kb.checked_mul(1024).and_then(|l| l.checked_sub(already_used)) else {
                err!("Send size overflow");
            };
            if left <= 0 {
                err!("Send storage limit reached! Delete some sends to free up space")
            }
            i64::clamp(left, 0, SIZE_525_MB)
        }
        None => SIZE_525_MB,
    };
    if size > size_limit {
        err!("Send storage limit exceeded with this file");
    }
    let mut send = create_send(model, headers.user.uuid)?;
    if send.atype != SendType::File as i32 {
        err!("Send content is not a file");
    }
    let file_id = crate::crypto::generate_send_file_id();
    save_temp_file(&PathType::Sends, &format!("{}/{file_id}", send.uuid), data, true).await?;
    let mut data_value: Value = serde_json::from_str(&send.data)?;
    if let Some(o) = data_value.as_object_mut() {
        o.insert(String::from("id"), Value::String(file_id));
        o.insert(String::from("size"), Value::Number(size.into()));
        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(size)));
    }
    send.data = serde_json::to_string(&data_value)?;
    // Save the changes in the database
    send.save(&conn).await?;
    nt.send_send_update(
        UpdateType::SyncSendCreate,
        &send,
        &send.update_users_revision(&conn).await,
        &headers.device,
        &conn,
    )
    .await;
    Ok(Json(send.to_json()))
 }
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L165
 #[post("/sends/file/v2", data = "<data>")]
 async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn) -> JsonResult {
@@ -328,8 +413,8 @@ async fn post_send_file_v2_data(
            "Send file name does not match.",
            format!(
                "Expected file name '{}' got '{}'",
-                send_data.fileName.escape_debug(),
+                send_data.fileName,
-                raw_file_name.dangerous_unsafe_unsanitized_raw().as_str().escape_debug()
+                raw_file_name.dangerous_unsafe_unsanitized_raw()
            )
        ),
        _ => err!("Send file name does not match or is not provided."),
@@ -365,16 +450,63 @@ async fn post_send_file_v2_data(
 #[post("/sends/access")]
 async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
+    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if !send.is_accessible() {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
-    // Files are incremented during the download
+    process_access(send, conn, nt).await
-    if send.atype == SendType::Text as i32 && !send.register_access(&conn).await? {
+}
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SendAccessData {
    pub password: Option<String>,
 }
 // Legacy since web-2026.6.0
 #[post("/sends/access/<access_id>", data = "<data>")]
 async fn post_access_legacy(
    access_id: &str,
    data: Json<SendAccessData>,
    conn: DbConn,
    ip: ClientIp,
    nt: Notify<'_>,
 ) -> JsonResult {
    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
    let Some(mut send) = Send::find_by_access_id(access_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if let Some(max_access_count) = send.max_access_count
        && send.access_count >= max_access_count
    {
        err_code!(SEND_INACCESSIBLE_MSG, 404);
    }
    if !send.is_accessible() {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.password_hash.is_some() {
        match data.into_inner().password {
            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
            Some(_) => err!("Invalid password", format!("IP: {}.", ip.ip)),
            None => err_code!("Password not provided", format!("IP: {}.", ip.ip), 401),
        }
    }
    // Files are incremented during the download
    if send.atype == SendType::Text as i32 {
        if !send.register_access(&conn).await? {
            err_code!(SEND_INACCESSIBLE_MSG, 404)
        }
    } else {
        send.save(&conn).await?;
    }
    process_access(send, conn, nt).await
 }
@@ -399,27 +531,55 @@ async fn post_access_file(
    conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
+    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if !send.is_accessible() {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    check_send_file_id(&send, &file_id)?;
    if !send.register_access(&conn).await? {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    process_access_file(send, file_id, host, conn, nt).await
 }
-fn check_send_file_id(send: &Send, file_id: &SendFileId) -> EmptyResult {
+// Legacy since web-2026.6.0
-    if send.atype != SendType::File as i32 {
+#[post("/sends/<send_id>/access/file/<file_id>", data = "<data>")]
-        err!("Send is not a file type send.");
+async fn post_access_file_legacy(
    send_id: SendId,
    file_id: SendFileId,
    data: Json<SendAccessData>,
    host: Host,
    conn: DbConn,
    ip: ClientIp,
    nt: Notify<'_>,
 ) -> JsonResult {
    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
    let Some(mut send) = Send::find_by_uuid(&send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if let Some(max_access_count) = send.max_access_count
        && send.access_count >= max_access_count
    {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
-    match serde_json::from_str::<SendFileData>(&send.data) {
+
-        Ok(data) if &data.id == file_id => Ok(()),
+    if !send.is_accessible() {
-        _ => err_code!(SEND_INACCESSIBLE_MSG, 404),
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.password_hash.is_some() {
        match data.into_inner().password {
            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
            Some(_) => err!("Invalid password."),
            None => err_code!("Password not provided", 401),
        }
    }
    if !send.register_access(&conn).await? {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    process_access_file(send, file_id, host, conn, nt).await
 }
 async fn process_access_file(send: Send, file_id: SendFileId, host: Host, conn: DbConn, nt: Notify<'_>) -> JsonResult {
@@ -482,7 +642,7 @@ async fn put_send(send_id: SendId, data: Json<SendData>, headers: Headers, conn:
    Ok(Json(send.to_json()))
 }
-async fn update_send_from_data(
+pub async fn update_send_from_data(
    send: &mut Send,
    data: SendData,
    headers: &Headers,
@@ -3,7 +3,7 @@ use rocket::{Route, serde::json::Json};
 use crate::{
    api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code},
-    auth::{ClientIp, Headers, two_factor},
+    auth::{ClientIp, Headers},
    crypto,
    db::{
        DbConn,
@@ -20,23 +20,27 @@ pub fn routes() -> Vec<Route> {
 #[post("/two-factor/get-authenticator", data = "<data>")]
 async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
    let data: PasswordOrOtpData = data.into_inner();
    let user = headers.user;
    data.validate(&user, false, &conn).await?;
-    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await;
+    let type_ = TwoFactorType::Authenticator as i32;
    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await;
    let (enabled, key) = match twofactor {
        Some(tf) => (true, tf.data),
        _ => (false, crypto::encode_random_bytes::<20>(&BASE32)),
    };
    // Upstream seems to also return `userVerificationToken`, but doesn't seem to be used at all.
    // It should help prevent TOTP disclosure if someone keeps their vault unlocked.
    // Since it doesn't seem to be used, and also does not cause any issues, lets leave it out of the response.
    // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Controllers/TwoFactorController.cs#L94
    Ok(Json(json!({
-        "authenticator": json!({
+        "enabled": enabled,
-            "enabled": enabled,
+        "key": key,
-            "key": key,
+        "object": "twoFactorAuthenticator"
        }),
        "userVerificationToken": two_factor::authenticator_token(user.uuid, key, enabled),
    })))
 }
@@ -45,7 +49,8 @@ async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers,
 struct EnableAuthenticatorData {
    key: String,
    token: NumberOrString,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 #[post("/two-factor/authenticator", data = "<data>")]
@@ -56,7 +61,12 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
    let mut user = headers.user;
-    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &key, false)?;
+    PasswordOrOtpData {
        master_password_hash: data.master_password_hash,
        otp: data.otp,
    }
    .validate(&user, true, &conn)
    .await?;
    // Validate key as base32 and 20 bytes length
    let decoded_key: Vec<u8> = if let Ok(decoded) = BASE32.decode(key.as_bytes()) {
@@ -74,13 +84,12 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
    generate_recover_code(&mut user, &conn).await;
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    Ok(Json(json!({
-        "authenticator": json!({
+        "enabled": true,
-            "enabled": true,
+        "key": key,
-            "key": key,
+        "object": "twoFactorAuthenticator"
        }),
    })))
 }
@@ -116,7 +125,8 @@ pub async fn validate_totp_code(
        err!("Invalid TOTP secret")
    };
-    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator, conn).await {
+    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
    {
        Some(tf) => tf,
        _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_owned()),
    };
@@ -174,25 +184,36 @@ pub async fn validate_totp_code(
 #[serde(rename_all = "camelCase")]
 struct DisableAuthenticatorData {
    key: String,
-    user_verification_token: String,
+    master_password_hash: String,
    r#type: NumberOrString,
 }
 #[delete("/two-factor/authenticator", data = "<data>")]
-async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> EmptyResult {
+async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> JsonResult {
    let user = headers.user;
    let type_ = data.r#type.into_i32()?;
-    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &data.key, true)?;
+    if !user.check_valid_password(&data.master_password_hash) {
        err!("Invalid password");
    }
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await {
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
        if twofactor.data == data.key {
            twofactor.delete(&conn).await?;
-            log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+            log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                .await;
        } else {
            err!(format!("TOTP key for user {} does not match recorded value, cannot deactivate", &user.email));
        }
    }
-    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
        super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
    }
-    Ok(())
+    Ok(Json(json!({
        "enabled": false,
        "keys": type_,
        "object": "twoFactorProvider"
    })))
 }
@@ -1,13 +1,14 @@
 use chrono::Utc;
 use data_encoding::BASE64;
 use rocket::{Route, serde::json::Json};
 use crate::{
    CONFIG,
    api::{
-        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData,
+        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event,
-        core::log_user_event,
+        core::two_factor::generate_recover_code,
        core::two_factor::{VerificationTokenData, generate_recover_code},
    },
-    auth::{Headers, two_factor, two_factor::DuoData},
+    auth::Headers,
    crypto,
    db::{
        DbConn,
@@ -18,7 +19,55 @@ use crate::{
 };
 pub fn routes() -> Vec<Route> {
-    routes![get_duo, activate_duo, activate_duo_put, disable_duo,]
+    routes![get_duo, activate_duo, activate_duo_put,]
 }
 #[derive(Serialize, Deserialize)]
 struct DuoData {
    host: String, // Duo API hostname
    ik: String,   // client id
    sk: String,   // client secret
 }
 impl DuoData {
    fn global() -> Option<Self> {
        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
            (true, Some(host)) => Some(Self {
                host,
                ik: CONFIG.duo_ikey().unwrap(),
                sk: CONFIG.duo_skey().unwrap(),
            }),
            _ => None,
        }
    }
    fn msg(s: &str) -> Self {
        Self {
            host: s.into(),
            ik: s.into(),
            sk: s.into(),
        }
    }
    fn secret() -> Self {
        Self::msg("<global_secret>")
    }
    fn obscure(self) -> Self {
        let mut host = self.host;
        let mut ik = self.ik;
        let mut sk = self.sk;
        let digits = 4;
        let replaced = "************";
        host.replace_range(digits.., replaced);
        ik.replace_range(digits.., replaced);
        sk.replace_range(digits.., replaced);
        Self {
            host,
            ik,
            sk,
        }
    }
 }
 enum DuoStatus {
@@ -47,19 +96,22 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
    data.validate(&user, false, &conn).await?;
-    let (enabled, duo) = match get_user_duo_data(&user.uuid, &conn).await {
+    let data = get_user_duo_data(&user.uuid, &conn).await;
    let (enabled, data) = match data {
        DuoStatus::Global(_) => (true, Some(DuoData::secret())),
        DuoStatus::User(data) => (true, Some(data.obscure())),
        DuoStatus::Disabled(true) => (false, Some(DuoData::msg(DISABLED_MESSAGE_DEFAULT))),
        DuoStatus::Disabled(false) => (false, None),
    };
-    let duo_json = if let Some(data) = duo.as_ref() {
+    let json = if let Some(data) = data {
        json!({
            "enabled": enabled,
            "host": data.host,
            "clientSecret": data.sk,
            "clientId": data.ik,
            "object": "twoFactorDuo"
        })
    } else {
        json!({
@@ -67,13 +119,11 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
            "host": null,
            "clientSecret": null,
            "clientId": null,
            "object": "twoFactorDuo"
        })
    };
-    Ok(Json(rocket::serde::json::json!({
+    Ok(Json(json))
        "duo": duo_json,
        "userVerificationToken": two_factor::duo_token(user.uuid, duo, enabled),
    })))
 }
 #[derive(Deserialize)]
@@ -82,7 +132,8 @@ struct EnableDuoData {
    host: String,
    client_secret: String,
    client_id: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 impl From<EnableDuoData> for DuoData {
@@ -109,7 +160,12 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
    let data: EnableDuoData = data.into_inner();
    let mut user = headers.user;
-    two_factor::validate_duo(&data.user_verification_token, &user.uuid, None, false)?;
+    PasswordOrOtpData {
        master_password_hash: data.master_password_hash.clone(),
        otp: data.otp.clone(),
    }
    .validate(&user, true, &conn)
    .await?;
    let (data, data_str) = if check_duo_fields_custom(&data) {
        let data_req: DuoData = data.into();
@@ -126,15 +182,14 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
    generate_recover_code(&mut user, &conn).await;
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    Ok(Json(json!({
-        "duo": json!({
+        "enabled": true,
-            "enabled": true,
+        "host": data.host,
-            "host": data.host,
+        "clientSecret": data.sk,
-            "clientSecret": data.sk,
+        "clientId": data.ik,
-            "clientId": data.ik,
+        "object": "twoFactorDuo"
        }),
    })))
 }
@@ -143,29 +198,6 @@ async fn activate_duo_put(data: Json<EnableDuoData>, headers: Headers, conn: DbC
    activate_duo(data, headers, conn).await
 }
 #[delete("/two-factor/duo", data = "<data>")]
 async fn disable_duo(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
    let user = headers.user;
    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Duo, &conn).await {
        // Apply the same transformation than in `get_duo` to check we are disabling the correct one
        let duo = match to_user_duo_data(&twofactor) {
            DuoStatus::Global(_) => Some(DuoData::secret()),
            DuoStatus::User(data) => Some(data.obscure()),
            DuoStatus::Disabled(_) => None,
        };
        two_factor::validate_duo(&data.user_verification_token, &user.uuid, duo.as_ref(), true)?;
        twofactor.delete(&conn).await?;
        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    }
    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
    Ok(())
 }
 async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) -> EmptyResult {
    use reqwest::{Method, header};
    use std::str::FromStr;
@@ -190,16 +222,21 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
    Ok(())
 }
 const DUO_EXPIRE: i64 = 300;
 const APP_EXPIRE: i64 = 3600;
 const AUTH_PREFIX: &str = "AUTH";
 const DUO_PREFIX: &str = "TX";
 const APP_PREFIX: &str = "APP";
 async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
    let type_ = TwoFactorType::Duo as i32;
    // If the user doesn't have an entry, disabled
-    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Duo, conn).await else {
+    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await else {
        return DuoStatus::Disabled(DuoData::global().is_some());
    };
    to_user_duo_data(&twofactor)
 }
 fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
    // If the user has the required values, we use those
    if let Ok(data) = serde_json::from_str(&twofactor.data) {
        return DuoStatus::User(data);
@@ -214,13 +251,118 @@ fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
    DuoStatus::Disabled(false)
 }
-// let (ik, sk, host) = get_duo_keys_email();
+// let (ik, sk, ak, host) = get_duo_keys();
-pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String)> {
+pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String, String)> {
    let data = match User::find_by_mail(email, conn).await {
        Some(u) => get_user_duo_data(&u.uuid, conn).await.data(),
        _ => DuoData::global(),
    }
    .map_res("Can't fetch Duo Keys")?;
-    Ok((data.ik, data.sk, data.host))
+    Ok((data.ik, data.sk, CONFIG.get_duo_akey().await, data.host))
 }
 pub async fn generate_duo_signature(email: &str, conn: &DbConn) -> ApiResult<(String, String)> {
    let now = Utc::now().timestamp();
    let (ik, sk, ak, host) = get_duo_keys_email(email, conn).await?;
    let duo_sign = sign_duo_values(&sk, email, &ik, DUO_PREFIX, now + DUO_EXPIRE);
    let app_sign = sign_duo_values(&ak, email, &ik, APP_PREFIX, now + APP_EXPIRE);
    Ok((format!("{duo_sign}:{app_sign}"), host))
 }
 fn sign_duo_values(key: &str, email: &str, ikey: &str, prefix: &str, expire: i64) -> String {
    let val = format!("{email}|{ikey}|{expire}");
    let cookie = format!("{prefix}|{}", BASE64.encode(val.as_bytes()));
    format!("{cookie}|{}", crypto::hmac_sign(key, &cookie))
 }
 pub async fn validate_duo_login(email: &str, response: &str, conn: &DbConn) -> EmptyResult {
    let split: Vec<&str> = response.split(':').collect();
    if split.len() != 2 {
        err!(
            "Invalid response length",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
        );
    }
    let auth_sig = split[0];
    let app_sig = split[1];
    let now = Utc::now().timestamp();
    let (ik, sk, ak, _host) = get_duo_keys_email(email, conn).await?;
    let auth_user = parse_duo_values(&sk, auth_sig, &ik, AUTH_PREFIX, now)?;
    let app_user = parse_duo_values(&ak, app_sig, &ik, APP_PREFIX, now)?;
    if !crypto::ct_eq(&auth_user, app_user) || !crypto::ct_eq(&auth_user, email) {
        err!(
            "Error validating duo authentication",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
        )
    }
    Ok(())
 }
 fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -> ApiResult<String> {
    let split: Vec<&str> = val.split('|').collect();
    if split.len() != 3 {
        err!("Invalid value length")
    }
    let u_prefix = split[0];
    let u_b64 = split[1];
    let u_sig = split[2];
    let sig = crypto::hmac_sign(key, &format!("{u_prefix}|{u_b64}"));
    if !crypto::ct_eq(crypto::hmac_sign(key, &sig), crypto::hmac_sign(key, u_sig)) {
        err!("Duo signatures don't match")
    }
    if u_prefix != prefix {
        err!("Prefixes don't match")
    }
    let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else {
        err!("Invalid Duo cookie encoding")
    };
    let Ok(cookie) = String::from_utf8(cookie_vec) else {
        err!("Invalid Duo cookie encoding")
    };
    let cookie_split: Vec<&str> = cookie.split('|').collect();
    if cookie_split.len() != 3 {
        err!("Invalid cookie length")
    }
    let username = cookie_split[0];
    let u_ikey = cookie_split[1];
    let expire = cookie_split[2];
    if !crypto::ct_eq(ikey, u_ikey) {
        err!("Invalid ikey")
    }
    let expire: i64 = if let Ok(e) = expire.parse() {
        e
    } else {
        err!("Invalid expire time")
    };
    if time >= expire {
        err!("Expired authorization")
    }
    Ok(username.into())
 }
@@ -383,7 +383,7 @@ pub async fn get_duo_auth_url(
    device_identifier: &DeviceId,
    conn: &DbConn,
 ) -> Result<String, Error> {
-    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
    let callback_url = match make_callback_url(client_id) {
        Ok(url) => url,
@@ -435,7 +435,7 @@ pub async fn validate_duo_login(
    let code = split[0];
    let state = split[1];
-    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
    // Get the context by the state reported by the client. If we don't have one,
    // it means the context is either missing or expired.
@@ -5,26 +5,20 @@ use crate::{
    CONFIG,
    api::{
        EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{
+        core::{log_user_event, two_factor::generate_recover_code},
            log_user_event,
            two_factor::{VerificationTokenData, generate_recover_code},
        },
    },
-    auth::{ClientHeaders, Headers, two_factor},
+    auth::{ClientHeaders, Headers},
    crypto,
    db::{
        DbConn,
-        models::{
+        models::{AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorType, User, UserId},
            AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorIncomplete, TwoFactorType, User,
            UserId,
        },
    },
    error::{Error, MapResult},
    mail,
 };
 pub fn routes() -> Vec<Route> {
-    routes![get_email, send_email_login, send_email, email, disable_email]
+    routes![get_email, send_email_login, send_email, email,]
 }
 #[derive(Deserialize)]
@@ -71,7 +65,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
        let Some(user) = User::find_by_mail(email, &conn).await else {
            err!(
                "Username or password is incorrect. Try again",
-                format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
+                format!("IP: {}. Username: {email}.", client_headers.ip.ip)
            )
        };
@@ -80,7 +74,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
            if !user.check_valid_password(master_password_hash) {
                err!(
                    "Username or password is incorrect. Try again",
-                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
+                    format!("IP: {}. Username: {email}.", client_headers.ip.ip)
                )
            }
        } else if let Some(auth_request_id) = auth_request_id {
@@ -97,20 +91,6 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
            {
                err!("AuthRequest doesn't exist", "Invalid device, IP or code")
            }
        } else if let Some(device_identifier) = &data.device_identifier {
            // iOS/Android SSO logins send the email and device id but no password hash,
            // so accept a device that has a pending 2FA login for this user
            if TwoFactorIncomplete::find_by_user_and_device(&user.uuid, device_identifier, &conn).await.is_none() {
                err!(
                    "Username or password is incorrect. Try again",
                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
                )
            }
            debug!(
                "Email 2FA fallback: pending login. Username: {}. Device: {}.",
                user.email,
                device_identifier.to_string().escape_debug()
            );
        } else {
            err!("No password hash has been submitted.")
        }
@@ -124,7 +104,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
        let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
            err!(
                "Username or password is incorrect. Try again",
-                format!("IP: {}. Device: {}.", client_headers.ip.ip, device_identifier.to_string().escape_debug())
+                format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
            )
        };
@@ -136,8 +116,8 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
 /// Generate the token, save the data for later verification and send email to user
 pub async fn send_token(user_id: &UserId, conn: &DbConn) -> EmptyResult {
-    let mut twofactor =
+    let type_ = TwoFactorType::Email as i32;
-        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
+    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, type_, conn).await.map_res("Two factor not found")?;
    let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
@@ -160,19 +140,18 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
    data.validate(&user, false, &conn).await?;
    let (enabled, mfa_email) =
-        if let Some(x) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await {
-            let twofactor_data = EmailTokenData::from_json(&x.data)?;
+            Some(x) => {
-            (true, Some(twofactor_data.email))
+                let twofactor_data = EmailTokenData::from_json(&x.data)?;
-        } else {
+                (true, json!(twofactor_data.email))
-            (false, None)
+            }
            _ => (false, serde_json::value::Value::Null),
        };
-    Ok(Json(rocket::serde::json::json!({
+    Ok(Json(json!({
-        "email": rocket::serde::json::json!({
+        "email": mfa_email,
-            "enabled": enabled,
+        "enabled": enabled,
-            "email": mfa_email,
+        "object": "twoFactorEmail"
        }),
        "userVerificationToken": two_factor::email_token(user.uuid, mfa_email, enabled),
    })))
 }
@@ -181,36 +160,43 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
 struct SendEmailData {
    /// Email where 2FA codes will be sent to, can be different than user email account.
    email: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 /// Send a verification email to the specified email address to check whether it exists/belongs to user.
 #[post("/two-factor/send-email", data = "<data>")]
-async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> EmptyResult {
    let data: SendEmailData = data.into_inner();
    let user = headers.user;
-    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email.clone(), false)?;
+    PasswordOrOtpData {
        master_password_hash: data.master_password_hash,
        otp: data.otp,
    }
    .validate(&user, false, &conn)
    .await?;
    if !CONFIG._enable_email_2fa() {
        err!("Email 2FA is disabled")
    }
-    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+    let type_ = TwoFactorType::Email as i32;
    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
        tf.delete(&conn).await?;
    }
    let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
-    let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));
+    let twofactor_data = EmailTokenData::new(data.email, generated_token);
    // Uses EmailVerificationChallenge as type to show that it's not verified yet.
-    let twofactor =
+    let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
        TwoFactor::new(user.uuid.clone(), TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
    twofactor.save(&conn).await?;
    mail::send_token(&twofactor_data.email, &twofactor_data.last_token.map_res("Token is empty")?).await?;
-    Ok(Json(json!({})))
+    Ok(())
 }
 #[derive(Deserialize, Serialize)]
@@ -218,7 +204,8 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
 struct EmailData {
    email: String,
    token: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 /// Verify email belongs to user and can be used for 2FA email codes.
@@ -227,11 +214,17 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
    let data: EmailData = data.into_inner();
    let mut user = headers.user;
-    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email, false)?;
+    // This is the last step in the verification process, delete the otp directly afterwards
    PasswordOrOtpData {
        master_password_hash: data.master_password_hash,
        otp: data.otp,
    }
    .validate(&user, true, &conn)
    .await?;
-    let mut twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::EmailVerificationChallenge, &conn)
+    let type_ = TwoFactorType::EmailVerificationChallenge as i32;
-        .await
+    let mut twofactor =
-        .map_res("Two factor not found")?;
+        TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await.map_res("Two factor not found")?;
    let mut email_data = EmailTokenData::from_json(&twofactor.data)?;
@@ -250,26 +243,13 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
    generate_recover_code(&mut user, &conn).await;
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
-    Ok(Json(json!({})))
+    Ok(Json(json!({
-}
+        "email": email_data.email,
-
+        "enabled": "true",
-#[delete("/two-factor/email", data = "<data>")]
+        "object": "twoFactorEmail"
-async fn disable_email(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    })))
    let user = headers.user;
    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
        let twofactor_data = EmailTokenData::from_json(&twofactor.data)?;
        two_factor::validate_email(&data.user_verification_token, &user.uuid, twofactor_data.email, true)?;
        twofactor.delete(&conn).await?;
        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    }
    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
    Ok(())
 }
 /// Validate the email code when used as TwoFactor token mechanism
@@ -281,8 +261,9 @@ pub async fn validate_email_code_str(
    conn: &DbConn,
 ) -> EmptyResult {
    let mut email_data = EmailTokenData::from_json(data)?;
-    let mut twofactor =
+    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email as i32, conn)
-        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
+        .await
        .map_res("Two factor not found")?;
    let Some(issued_token) = &email_data.last_token else {
        err!(
            format!("No token available! IP: {ip}"),
@@ -341,10 +322,10 @@ pub struct EmailTokenData {
 }
 impl EmailTokenData {
-    pub fn new(email: String, token: Option<String>) -> EmailTokenData {
+    pub fn new(email: String, token: String) -> EmailTokenData {
        EmailTokenData {
            email,
-            last_token: token,
+            last_token: Some(token),
            token_sent: Utc::now().timestamp(),
            attempts: 0,
        }
@@ -382,8 +363,7 @@ pub async fn activate_email_2fa(user: &User, conn: &DbConn) -> EmptyResult {
    if user.verified_at.is_none() {
        err!("Auto-enabling of email 2FA failed because the users email address has not been verified!");
    }
-    // The token is set when the first code is sent
+    let twofactor_data = EmailTokenData::new(user.email.clone(), String::new());
    let twofactor_data = EmailTokenData::new(user.email.clone(), None);
    let twofactor = TwoFactor::new(user.uuid.clone(), TwoFactorType::Email, twofactor_data.to_json());
    twofactor.save(conn).await
 }
@@ -7,7 +7,10 @@ use serde_json::Value;
 use crate::{
    CONFIG,
-    api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_event},
+    api::{
        EmptyResult, JsonResult, PasswordOrOtpData,
        core::{log_event, log_user_event},
    },
    auth::Headers,
    crypto,
    db::{
@@ -18,6 +21,7 @@ use crate::{
        },
    },
    mail,
    util::NumberOrString,
 };
 pub mod authenticator;
@@ -65,7 +69,13 @@ pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data
 }
 pub fn routes() -> Vec<Route> {
-    let mut routes = routes![get_twofactor, get_recover, get_device_verification_settings];
+    let mut routes = routes![
        get_twofactor,
        get_recover,
        disable_twofactor,
        disable_twofactor_put,
        get_device_verification_settings,
    ];
    routes.append(&mut authenticator::routes());
    routes.append(&mut duo::routes());
@@ -77,12 +87,6 @@ pub fn routes() -> Vec<Route> {
    routes
 }
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct VerificationTokenData {
    user_verification_token: String,
 }
 #[get("/two-factor")]
 async fn get_twofactor(headers: Headers, conn: DbConn) -> Json<Value> {
    let twofactors = TwoFactor::find_by_user(&headers.user.uuid, &conn).await;
@@ -122,14 +126,50 @@ async fn generate_recover_code(user: &mut User, conn: &DbConn) {
    }
 }
-/// Call after a 2FA provider, or one of its keys, was removed. No remembered device may keep skipping
+#[derive(Deserialize)]
-/// the providers that are left, and once every provider is gone the 2FA policy applies.
+#[serde(rename_all = "camelCase")]
-pub async fn check_2fa_state(user: &User, device_type: i32, ip: &std::net::IpAddr, conn: &DbConn) -> EmptyResult {
+struct DisableTwoFactorData {
-    Device::clear_twofactor_remember_by_user(&user.uuid, conn).await?;
+    master_password_hash: Option<String>,
-    if TwoFactor::find_by_user(&user.uuid, conn).await.is_empty() {
+    otp: Option<String>,
-        enforce_2fa_policy(user, &user.uuid, device_type, ip, conn).await?;
+    r#type: NumberOrString,
 }
 #[post("/two-factor/disable", data = "<data>")]
 async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
    let data: DisableTwoFactorData = data.into_inner();
    let user = headers.user;
    // Delete directly after a valid token has been provided
    PasswordOrOtpData {
        master_password_hash: data.master_password_hash,
        otp: data.otp,
    }
-    Ok(())
+    .validate(&user, true, &conn)
    .await?;
    let type_ = data.r#type.into_i32()?;
    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
        twofactor.delete(&conn).await?;
        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
        log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
            .await;
    }
    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
        enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
    }
    Ok(Json(json!({
        "enabled": false,
        "type": type_,
        "object": "twoFactorProvider"
    })))
 }
 #[put("/two-factor/disable", data = "<data>")]
 async fn disable_twofactor_put(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
    disable_twofactor(data, headers, conn).await
 }
 pub async fn enforce_2fa_policy(
@@ -72,7 +72,8 @@ async fn request_otp(headers: Headers, conn: DbConn) -> EmptyResult {
    let user = headers.user;
    // Only one Protected Action per user is allowed to take place, delete the previous one
-    if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions, &conn).await {
+    if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions as i32, &conn).await
    {
        let pa_data = ProtectedActionData::from_json(&pa.data)?;
        let elapsed = pa_data.time_since_sent().num_seconds();
        let delay = 30;
@@ -124,7 +125,7 @@ pub async fn validate_protected_action_otp(
    delete_if_valid: bool,
    conn: &DbConn,
 ) -> EmptyResult {
-    let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions, conn)
+    let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions as i32, conn)
        .await
        .map_res("Protected action token not found, try sending the code again or restart the process")?;
    let mut pa_data = ProtectedActionData::from_json(&pa.data)?;
@@ -1,4 +1,4 @@
-use std::{collections::HashSet, str::FromStr, sync::LazyLock, time::Duration};
+use std::{str::FromStr, sync::LazyLock, time::Duration};
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
@@ -18,18 +18,16 @@ use crate::{
    CONFIG,
    api::{
        EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{
+        core::{log_user_event, two_factor::generate_recover_code},
            log_user_event,
            two_factor::{VerificationTokenData, generate_recover_code},
        },
    },
-    auth::{Headers, two_factor},
+    auth::Headers,
    crypto::ct_eq,
    db::{
        DbConn,
        models::{EventType, TwoFactor, TwoFactorType, UserId},
    },
    error::Error,
    util::NumberOrString,
 };
 static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
@@ -47,14 +45,7 @@ static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
 });
 pub fn routes() -> Vec<Route> {
-    routes![
+    routes![get_webauthn, generate_webauthn_challenge, activate_webauthn, activate_webauthn_put, delete_webauthn,]
        get_webauthn,
        generate_webauthn_challenge,
        activate_webauthn,
        activate_webauthn_put,
        delete_webauthn,
        delete_webauthns
    ]
 }
 // Some old u2f structs still needed for migrating from u2f to WebAuthn
@@ -128,36 +119,34 @@ async fn get_webauthn(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbC
    data.validate(&user, false, &conn).await?;
    let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
    let registrations_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect();
    Ok(Json(json!({
-        "webAuthn": json!({
+        "enabled": enabled,
-            "enabled": enabled,
+        "keys": registrations_json,
-            "keys": registrations_json,
+        "object": "twoFactorWebAuthn"
        }),
        "userVerificationToken": two_factor::webauthn_token(user.uuid, keys, enabled),
    })))
 }
 #[post("/two-factor/get-webauthn-challenge", data = "<data>")]
-async fn generate_webauthn_challenge(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
    let data: PasswordOrOtpData = data.into_inner();
    let user = headers.user;
-    let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
+    data.validate(&user, false, &conn).await?;
-    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
+
-    let creds = registrations
+    let registrations = get_webauthn_registrations(&user.uuid, &conn)
        .await?
        .1
        .into_iter()
        .map(|r| r.credential.cred_id().to_owned()) // We return the credentialIds to the clients to avoid double registering
        .collect();
    two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, enabled)?;
    let (mut challenge, state) = WEBAUTHN.start_passkey_registration(
        Uuid::from_str(&user.uuid).expect("Failed to parse UUID"), // Should never fail
        &user.email,
        user.display_name(),
-        Some(creds),
+        Some(registrations),
    )?;
    let mut state = serde_json::to_value(&state)?;
@@ -177,19 +166,17 @@ async fn generate_webauthn_challenge(data: Json<VerificationTokenData>, headers:
    let mut challenge_value = serde_json::to_value(challenge.public_key)?;
    challenge_value["status"] = "ok".into();
    challenge_value["errorMessage"] = "".into();
-
+    Ok(Json(challenge_value))
    Ok(Json(json!({
        "options": challenge_value
    })))
 }
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EnableWebauthnData {
-    id: i32,
+    id: NumberOrString, // 1..5
    name: String,
    device_response: RegisterPublicKeyCredentialCopy,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 #[derive(Debug, Deserialize)]
@@ -270,14 +257,16 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
    let data: EnableWebauthnData = data.into_inner();
    let mut user = headers.user;
-    let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
+    PasswordOrOtpData {
-    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
+        master_password_hash: data.master_password_hash,
-    two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, !keys.is_empty())?;
+        otp: data.otp,
    }
    .validate(&user, true, &conn)
    .await?;
    // Retrieve and delete the saved challenge state
-    let state = if let Some(tf) =
+    let type_ = TwoFactorType::WebauthnRegisterChallenge as i32;
-        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::WebauthnRegisterChallenge, &conn).await
+    let state = if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
    {
        let state: PasskeyRegistration = serde_json::from_str(&tf.data)?;
        tf.delete(&conn).await?;
        state
@@ -288,9 +277,10 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
    // Verify the credentials with the saved state
    let credential = WEBAUTHN.finish_passkey_registration(&data.device_response.into(), &state)?;
    let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
    // TODO: Check for repeated ID's
    registrations.push(WebauthnRegistration {
-        id: data.id,
+        id: data.id.into_i32()?,
        name: data.name,
        migrated: false,
@@ -303,13 +293,13 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
        .await?;
    generate_recover_code(&mut user, &conn).await;
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    let keys_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect();
    Ok(Json(json!({
-        "webAuthn": json!({
+        "enabled": true,
-            "enabled": true,
+        "keys": keys_json,
-            "keys": registrations.iter().map(WebauthnRegistration::to_json).collect::<Vec<Value>>(),
+        "object": "twoFactorU2f"
        }),
    })))
 }
@@ -320,87 +310,57 @@ async fn activate_webauthn_put(data: Json<EnableWebauthnData>, headers: Headers,
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct DeleteWebauthnData {
+struct DeleteU2FData {
-    id: i32,
+    id: NumberOrString,
-    user_verification_token: String,
+    master_password_hash: String,
 }
 #[delete("/two-factor/webauthn", data = "<data>")]
-async fn delete_webauthn(data: Json<DeleteWebauthnData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, conn: DbConn) -> JsonResult {
-    inner_delete_webauthns(&data.user_verification_token, |key| key.id != data.id, headers, &conn).await
+    let id = data.id.into_i32()?;
-}
+    if !headers.user.check_valid_password(&data.master_password_hash) {
        err!("Invalid password");
    }
-#[delete("/two-factor/webauthn/all", data = "<data>")]
+    let Some(mut tf) =
-async fn delete_webauthns(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> JsonResult {
+        TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &conn).await
-    inner_delete_webauthns(&data.user_verification_token, |_| false, headers, &conn).await
+    else {
 }
 async fn inner_delete_webauthns(
    token: &str,
    retain: impl Fn(&WebauthnRegistration) -> bool,
    headers: Headers,
    conn: &DbConn,
 ) -> JsonResult {
    let user = headers.user;
    let Some(mut tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Webauthn, conn).await else {
        err!("Webauthn data not found!")
    };
-    let mut keys: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;
+    let mut data: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;
    let keys_id: Vec<i32> = keys.iter().map(|r| r.id).collect();
-    two_factor::validate_webauthn(token, &user.uuid, &keys_id, true)?;
+    let Some(item_pos) = data.iter().position(|r| r.id == id) else {
    let mut removed: HashSet<Vec<u8>> = HashSet::new();
    let mut migrated = false;
    keys.retain(|key| {
        let retained = retain(key);
        if !retained {
            removed.insert(key.credential.cred_id().to_vec());
            migrated = migrated || key.migrated;
        }
        retained
    });
    if removed.is_empty() {
        err!("Webauthn entry not found")
-    }
+    };
-    if keys.is_empty() {
+    let removed_item = data.remove(item_pos);
-        tf.delete(conn).await?;
+    tf.data = serde_json::to_string(&data)?;
-        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, conn).await;
+    tf.save(&conn).await?;
-    } else {
+    drop(tf);
        tf.data = serde_json::to_string(&keys)?;
        tf.save(conn).await?;
        drop(tf);
    }
    // If entry is migrated from u2f, delete the u2f entry as well
-    if migrated && let Some(mut u2f) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::U2f, conn).await {
+    if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await
-        let Ok(mut data) = serde_json::from_str::<Vec<U2FRegistration>>(&u2f.data) else {
+    {
        let mut data: Vec<U2FRegistration> = if let Ok(d) = serde_json::from_str(&u2f.data) {
            d
        } else {
            err!("Error parsing U2F data")
        };
-        data.retain(|old| !removed.contains(&old.reg.key_handle));
+        data.retain(|r| r.reg.key_handle != removed_item.credential.cred_id().as_slice());
        let new_data_str = serde_json::to_string(&data)?;
-        if data.is_empty() {
+        u2f.data = new_data_str;
-            u2f.delete(conn).await?;
+        u2f.save(&conn).await?;
        } else {
            let new_data_str = serde_json::to_string(&data)?;
            u2f.data = new_data_str;
            u2f.save(conn).await?;
        }
    }
-    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, conn).await?;
+    let keys_json: Vec<Value> = data.iter().map(WebauthnRegistration::to_json).collect();
    Ok(Json(json!({
-        "webAuthn": json!({
+        "enabled": true,
-            "enabled": !keys.is_empty(),
+        "keys": keys_json,
-            "keys": keys.iter().map(WebauthnRegistration::to_json).collect::<Vec<Value>>(),
+        "object": "twoFactorU2f"
        }),
    })))
 }
@@ -408,7 +368,8 @@ pub async fn get_webauthn_registrations(
    user_id: &UserId,
    conn: &DbConn,
 ) -> Result<(bool, Vec<WebauthnRegistration>), Error> {
-    match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Webauthn, conn).await {
+    let type_ = TwoFactorType::Webauthn as i32;
    match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
        Some(tf) => Ok((tf.enabled, serde_json::from_str(&tf.data)?)),
        None => Ok((false, Vec::new())), // If no data, return empty list
    }
@@ -455,9 +416,8 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &DbConn) -> JsonRes
 }
 pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &DbConn) -> EmptyResult {
-    let mut state = if let Some(tf) =
+    let type_ = TwoFactorType::WebauthnLoginChallenge as i32;
-        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::WebauthnLoginChallenge, conn).await
+    let mut state = if let Some(tf) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
    {
        let state: PasskeyAuthentication = serde_json::from_str(&tf.data)?;
        tf.delete(conn).await?;
        state
@@ -10,12 +10,9 @@ use crate::{
    CONFIG,
    api::{
        EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{
+        core::{log_user_event, two_factor::generate_recover_code},
            log_user_event,
            two_factor::{VerificationTokenData, generate_recover_code},
        },
    },
-    auth::{Headers, two_factor},
+    auth::Headers,
    db::{
        DbConn,
        models::{EventType, TwoFactor, TwoFactorType},
@@ -25,7 +22,7 @@ use crate::{
 };
 pub fn routes() -> Vec<Route> {
-    routes![generate_yubikey, activate_yubikey, activate_yubikey_put, delete_yubikeys,]
+    routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
 }
 struct HttpClientTransport {
@@ -63,7 +60,8 @@ struct EnableYubikeyData {
    key4: Option<String>,
    key5: Option<String>,
    nfc: bool,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 #[derive(Deserialize, Serialize, Debug)]
@@ -127,47 +125,55 @@ async fn generate_yubikey(data: Json<PasswordOrOtpData>, headers: Headers, conn:
    data.validate(&user, false, &conn).await?;
    let user_id = &user.uuid;
    let yubikey_type = TwoFactorType::YubiKey as i32;
-    let (enabled, keys, yubikey_json) =
+    let r = TwoFactor::find_by_user_and_type(user_id, yubikey_type, &conn).await;
-        if let Some(r) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::YubiKey, &conn).await {
+
-            let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
+    if let Some(r) = r {
-            let enabled = !yubikey_metadata.keys.is_empty();
+        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
-            let mut result = jsonify_yubikeys(yubikey_metadata.keys.clone());
+
-            result["enabled"] = Value::Bool(enabled);
+        let mut result = jsonify_yubikeys(yubikey_metadata.keys);
-            result["nfc"] = Value::Bool(yubikey_metadata.nfc);
+
-            (enabled, yubikey_metadata.keys, result)
+        result["enabled"] = Value::Bool(true);
-        } else {
+        result["nfc"] = Value::Bool(yubikey_metadata.nfc);
-            (false, Vec::new(), json!({"enabled": false}))
+        result["object"] = Value::String("twoFactorU2f".to_owned());
-        };
+
-    Ok(Json(json!({
+        Ok(Json(result))
-        "yubiKey": yubikey_json,
+    } else {
-        "userVerificationToken": two_factor::yubikey_token(user.uuid, keys, enabled),
+        Ok(Json(json!({
-    })))
+            "enabled": false,
            "object": "twoFactorU2f",
        })))
    }
 }
 #[post("/two-factor/yubikey", data = "<data>")]
 async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn: DbConn) -> JsonResult {
    let data: EnableYubikeyData = data.into_inner();
    let yubikeys = parse_yubikeys(&data);
    let mut user = headers.user;
    PasswordOrOtpData {
        master_password_hash: data.master_password_hash.clone(),
        otp: data.otp.clone(),
    }
    .validate(&user, true, &conn)
    .await?;
    // Check if we already have some data
    let mut yubikey_data =
        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey as i32, &conn).await {
            Some(data) => data,
            None => TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new()),
        };
    let yubikeys = parse_yubikeys(&data);
    if yubikeys.is_empty() {
        // Return an error to prevent saving empty keys which would cause users not being able to login anymore.
        // To remove all keys users should click the `Deactivate all keys` button
        err!("A key is required.");
    }
    // Check if we already have some data
    let mut yubikey_data =
        if let Some(yd) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
            let ym: YubikeyMetadata = serde_json::from_str(&yd.data)?;
            two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &ym.keys, !ym.keys.is_empty())?;
            yd
        } else {
            two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &Vec::new(), false)?;
            TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new())
        };
    // Ensure they are valid OTPs
    for yubikey in &yubikeys {
        if yubikey.is_empty() || yubikey.len() == 12 {
@@ -189,12 +195,15 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
    generate_recover_code(&mut user, &conn).await;
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    let mut result = jsonify_yubikeys(yubikey_metadata.keys);
    result["enabled"] = Value::Bool(true);
    result["nfc"] = Value::Bool(yubikey_metadata.nfc);
-    Ok(Json(json!({"yubiKey": result})))
+    result["object"] = Value::String("twoFactorU2f".to_owned());
    Ok(Json(result))
 }
 #[put("/two-factor/yubikey", data = "<data>")]
@@ -202,32 +211,13 @@ async fn activate_yubikey_put(data: Json<EnableYubikeyData>, headers: Headers, c
    activate_yubikey(data, headers, conn).await
 }
 #[delete("/two-factor/yubikey", data = "<data>")]
 async fn delete_yubikeys(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
    let user = headers.user;
    if let Some(r) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
        two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &yubikey_metadata.keys, true)?;
        r.delete(&conn).await?;
        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    }
    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
    Ok(())
 }
 pub async fn validate_yubikey_login(response: &str, twofactor_data: &str) -> EmptyResult {
    if response.len() != 44 {
        err!("Invalid Yubikey OTP length");
    }
    let yubikey_metadata: YubikeyMetadata = serde_json::from_str(twofactor_data).expect("Can't parse Yubikey Metadata");
-    let Some(response_id) = response.get(..12) else {
+    let response_id = &response[..12];
        err!("Invalid Yubikey OTP");
    };
    if !yubikey_metadata.keys.contains(&response_id.to_owned()) {
        err!("Given Yubikey is not registered");
@@ -85,7 +85,7 @@ static ICON_SIZE_REGEX: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"(?x)(\d+
 #[get("/<host>/icon.png")]
 fn icon_external(host: &str) -> Cached<Option<Redirect>> {
    let Ok(host) = get_valid_host(host) else {
-        warn!("Invalid host: {}", host.escape_debug());
+        warn!("Invalid host: {host}");
        return Cached::ttl(None, CONFIG.icon_cache_negttl(), true);
    };
@@ -113,7 +113,7 @@ async fn icon_internal(host: &str) -> Cached<(ContentType, Vec<u8>)> {
    const FALLBACK_ICON: &[u8] = include_bytes!("../static/images/fallback-icon.png");
    let Ok(host) = get_valid_host(host) else {
-        warn!("Invalid host: {}", host.escape_debug());
+        warn!("Invalid host: {host}");
        return Cached::ttl(
            (ContentType::new("image", "png"), FALLBACK_ICON.to_vec()),
            CONFIG.icon_cache_negttl(),
@@ -17,14 +17,15 @@ use crate::{
            accounts::{PreloginData, RegisterData, kdf_upgrade, prelogin, register},
            log_user_event,
            two_factor::{
-                authenticator, duo_oidc, email, enforce_2fa_policy, is_twofactor_provider_usable, webauthn, yubikey,
+                authenticator, duo, duo_oidc, email, enforce_2fa_policy, is_twofactor_provider_usable, webauthn,
                yubikey,
            },
        },
-        identity_master_password_policy,
+        master_password_policy,
        push::register_push_device,
    },
    auth,
-    auth::{AuthMethod, ClientHeaders, ClientIp, Secure, generate_organization_api_key_login_claims},
+    auth::{AuthMethod, ClientHeaders, ClientIp, ClientVersion, Secure, generate_organization_api_key_login_claims},
    crypto,
    db::{
        DbConn,
@@ -45,6 +46,7 @@ pub fn routes() -> Vec<Route> {
        login,
        post_prelogin,
        prelogin_password,
        identity_register,
        register_verification_email,
        register_finish,
        prevalidate,
@@ -55,7 +57,12 @@ pub fn routes() -> Vec<Route> {
 }
 #[post("/connect/token", data = "<data>")]
-async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbConn) -> JsonResult {
+async fn login(
    data: Form<ConnectData>,
    client_header: ClientHeaders,
    client_version: Option<ClientVersion>,
    conn: DbConn,
 ) -> JsonResult {
    let data: ConnectData = data.into_inner();
    let mut user_id: Option<UserId> = None;
@@ -76,13 +83,17 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
-            password_login(data, &mut user_id, &conn, &client_header.ip).await
+            password_login(data, &mut user_id, &conn, &client_header.ip, client_version.as_ref()).await
        }
        "client_credentials" => {
            check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?;
            check_is_some(data.client_secret.as_ref(), "client_secret cannot be blank")?;
            check_is_some(data.scope.as_ref(), "scope cannot be blank")?;
            check_is_some(data.device_identifier.as_ref(), "device_identifier cannot be blank")?;
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
            api_key_login(data, &mut user_id, &conn, &client_header.ip).await
        }
        "authorization_code" if CONFIG.sso_enabled() => {
@@ -94,7 +105,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
-            sso_login(data, &mut user_id, &conn, &client_header.ip).await
+            sso_login(data, &mut user_id, &conn, &client_header.ip, client_version.as_ref()).await
        }
        "authorization_code" => err!("SSO sign-in is not available"),
        "send_access" => {
@@ -118,7 +129,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
        match &login_result {
            Ok(_) => {
                log_user_event(
-                    EventType::UserLoggedIn,
+                    EventType::UserLoggedIn as i32,
                    &user_id,
                    client_header.device_type,
                    &client_header.ip.ip,
@@ -128,7 +139,8 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
            }
            Err(e) => {
                if let Some(ev) = e.get_event() {
-                    log_user_event(ev.event, &user_id, client_header.device_type, &client_header.ip.ip, &conn).await;
+                    log_user_event(ev.event as i32, &user_id, client_header.device_type, &client_header.ip.ip, &conn)
                        .await;
                }
            }
        }
@@ -178,7 +190,13 @@ async fn refresh_login(data: ConnectData, conn: &DbConn, ip: &ClientIp) -> JsonR
 }
 // After exchanging the code we need to check first if 2FA is needed before continuing
-async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
+async fn sso_login(
    data: ConnectData,
    user_id: &mut Option<UserId>,
    conn: &DbConn,
    ip: &ClientIp,
    client_version: Option<&ClientVersion>,
 ) -> JsonResult {
    AuthMethod::Sso.check_scope(data.scope.as_ref())?;
    // Ratelimit the login
@@ -335,7 +353,7 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
        Some((mut user, sso_user)) => {
            let mut device = get_device(&data, conn, &user).await?;
-            let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?;
+            let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?;
            if user.private_key.is_none() {
                // User was invited a stub was created
@@ -367,7 +385,13 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
    authenticated_response(&user, &mut device, auth_tokens, twofactor_token, conn, ip).await
 }
-async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
+async fn password_login(
    data: ConnectData,
    user_id: &mut Option<UserId>,
    conn: &DbConn,
    ip: &ClientIp,
    client_version: Option<&ClientVersion>,
 ) -> JsonResult {
    // Validate scope
    AuthMethod::Password.check_scope(data.scope.as_ref())?;
@@ -376,14 +400,24 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
    // Get the user
    let username = data.username.as_ref().unwrap().trim();
    let log_username = username.escape_debug();
    let Some(mut user) = User::find_by_mail(username, conn).await else {
-        err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {log_username}.", ip.ip))
+        err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {username}.", ip.ip))
    };
    // Set the user_id here to be passed back used for event logging.
    *user_id = Some(user.uuid.clone());
    // Check if the user is disabled
    if !user.enabled {
        err!(
            "This user has been disabled",
            format!("IP: {}. Username: {username}.", ip.ip),
            ErrorEvent {
                event: EventType::UserFailedLogIn
            }
        )
    }
    let password = data.password.as_ref().unwrap();
    // If we get an auth request, we don't check the user's password, but the access code of the auth request
@@ -391,7 +425,7 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
        let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, conn).await else {
            err!(
                "Auth request not found. Try again.",
-                format!("IP: {}. Username: {log_username}.", ip.ip),
+                format!("IP: {}. Username: {username}.", ip.ip),
                ErrorEvent {
                    event: EventType::UserFailedLogIn,
                }
@@ -403,14 +437,13 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
        if auth_request.user_uuid != user.uuid
            || !auth_request.approved.unwrap_or(false)
            || auth_request.authentication_date.is_some()
            || request_expired
            || ip.ip.to_string() != auth_request.request_ip
            || !auth_request.check_access_code(password)
        {
            err!(
                "Username or access code is incorrect. Try again",
-                format!("IP: {}. Username: {log_username}.", ip.ip),
+                format!("IP: {}. Username: {username}.", ip.ip),
                ErrorEvent {
                    event: EventType::UserFailedLogIn,
                }
@@ -419,24 +452,13 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
    } else if !user.check_valid_password(password) {
        err!(
            "Username or password is incorrect. Try again",
-            format!("IP: {}. Username: {log_username}.", ip.ip),
+            format!("IP: {}. Username: {username}.", ip.ip),
            ErrorEvent {
                event: EventType::UserFailedLogIn,
            }
        )
    }
    // Check if the user is disabled
    if !user.enabled {
        err!(
            "This user has been disabled",
            format!("IP: {}. Username: {log_username}.", ip.ip),
            ErrorEvent {
                event: EventType::UserFailedLogIn
            }
        )
    }
    // Change the KDF Iterations (only when not logging in with an auth request)
    if data.auth_request.is_none() {
        kdf_upgrade(&mut user, password, conn).await?;
@@ -469,7 +491,7 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
        // We still want the login to fail until they actually verified the email address
        err!(
            "Please verify your email before trying again.",
-            format!("IP: {}. Username: {log_username}.", ip.ip),
+            format!("IP: {}. Username: {username}.", ip.ip),
            ErrorEvent {
                event: EventType::UserFailedLogIn
            }
@@ -478,20 +500,7 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
    let mut device = get_device(&data, conn, &user).await?;
-    let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?;
+    let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?;
    // Like upstream, an auth request can be used for one login only. Marked after 2FA so a 2FA prompt doesn't use it up.
    if let Some(ref auth_request_id) = data.auth_request
        && !AuthRequest::set_authentication_date(auth_request_id, conn).await?
    {
        err!(
            "Username or access code is incorrect. Try again",
            format!("IP: {}. Username: {log_username}.", ip.ip),
            ErrorEvent {
                event: EventType::UserFailedLogIn,
            }
        )
    }
    let auth_tokens = auth::AuthTokens::new(&device, &user, AuthMethod::Password, data.client_id);
@@ -530,7 +539,7 @@ async fn authenticated_response(
    // Save to update `device.updated_at` to track usage and toggle new status
    device.save(true, conn).await?;
-    let master_password_policy = identity_master_password_policy(user, conn).await;
+    let master_password_policy = master_password_policy(user, conn).await;
    let has_master_password = !user.password_hash.is_empty();
    let master_password_unlock = if has_master_password {
@@ -551,18 +560,7 @@ async fn authenticated_response(
        Value::Null
    };
-    let account_keys = if user.private_key.is_some() {
+    let account_keys = user.account_keys_json(conn).await;
        json!({
            "publicKeyEncryptionKeyPair": {
                "wrappedPrivateKey": user.private_key,
                "publicKey": user.public_key,
                "Object": "publicKeyEncryptionKeyPair"
            },
            "Object": "privateKeys"
        })
    } else {
        Value::Null
    };
    let mut result = json!({
        "access_token": auth_tokens.access_token(),
@@ -574,6 +572,7 @@ async fn authenticated_response(
        "KdfIterations": user.client_kdf_iter,
        "KdfMemory": user.client_kdf_memory,
        "KdfParallelism": user.client_kdf_parallelism,
        "ResetMasterPassword": false, // TODO: Same as above
        "ForcePasswordReset": false,
        "MasterPasswordPolicy": master_password_policy,
        "scope": auth_tokens.scope(),
@@ -603,14 +602,7 @@ async fn api_key_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &D
    // Validate scope
    match data.scope.as_ref() {
-        Some(scope) if scope == &AuthMethod::UserApiKey.scope() => {
+        Some(scope) if scope == &AuthMethod::UserApiKey.scope() => user_api_key_login(data, user_id, conn, ip).await,
            // Like upstream, only the user API key logs in a device
            check_is_some(data.device_identifier.as_ref(), "device_identifier cannot be blank")?;
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
            user_api_key_login(data, user_id, conn, ip).await
        }
        Some(scope) if scope == &AuthMethod::OrgApiKey.scope() => organization_api_key_login(data, conn, ip).await,
        _ => err!("Scope not supported"),
    }
@@ -708,18 +700,7 @@ async fn user_api_key_login(
        Value::Null
    };
-    let account_keys = if user.private_key.is_some() {
+    let account_keys = user.account_keys_json(conn).await;
        json!({
            "publicKeyEncryptionKeyPair": {
                "wrappedPrivateKey": user.private_key,
                "publicKey": user.public_key,
                "Object": "publicKeyEncryptionKeyPair"
            },
            "Object": "privateKeys"
        })
    } else {
        Value::Null
    };
    // Note: No refresh_token is returned. The CLI just repeats the
    // client_credentials login flow when the existing token expires.
@@ -734,6 +715,7 @@ async fn user_api_key_login(
        "KdfIterations": user.client_kdf_iter,
        "KdfMemory": user.client_kdf_memory,
        "KdfParallelism": user.client_kdf_parallelism,
        "ResetMasterPassword": false, // TODO: according to official server seems something like: user.password_hash.is_empty(), but would need testing
        "ForcePasswordReset": false,
        "scope": AuthMethod::UserApiKey.scope(),
        "AccountKeys": account_keys,
@@ -799,6 +781,7 @@ async fn twofactor_auth(
    data: &ConnectData,
    device: &mut Device,
    ip: &ClientIp,
    client_version: Option<&ClientVersion>,
    conn: &DbConn,
 ) -> ApiResult<Option<String>> {
    let twofactors = TwoFactor::find_by_user(&user.uuid, conn).await;
@@ -827,12 +810,17 @@ async fn twofactor_auth(
    if ![TwoFactorType::Remember as i32, TwoFactorType::RecoveryCode as i32].contains(&selected_id)
        && !twofactor_ids.contains(&selected_id)
    {
-        err_json!(json_err_twofactor(&twofactor_ids, user, data, conn).await?, "Invalid two factor provider")
+        err_json!(
            json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
            "Invalid two factor provider"
        )
    }
-    // Like upstream, a blank token counts as not provided
+    let Some(ref twofactor_code) = data.two_factor_token else {
-    let Some(twofactor_code) = data.two_factor_token.as_deref().filter(|t| !t.trim().is_empty()) else {
+        err_json!(
-        err_json!(json_err_twofactor(&twofactor_ids, user, data, conn).await?, "2FA token not provided")
+            json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
            "2FA token not provided"
        )
    };
    let selected_twofactor = twofactors.into_iter().find(|tf| tf.atype == selected_id && tf.enabled);
@@ -846,14 +834,20 @@ async fn twofactor_auth(
        Some(TwoFactorType::Webauthn) => webauthn::validate_webauthn_login(&user.uuid, twofactor_code, conn).await?,
        Some(TwoFactorType::YubiKey) => yubikey::validate_yubikey_login(twofactor_code, &selected_data?).await?,
        Some(TwoFactorType::Duo) => {
-            duo_oidc::validate_duo_login(
+            if CONFIG.duo_use_iframe() {
-                &user.email,
+                // Legacy iframe prompt flow
-                twofactor_code,
+                duo::validate_duo_login(&user.email, twofactor_code, conn).await?;
-                data.client_id.as_ref().unwrap(),
+            } else {
-                data.device_identifier.as_ref().unwrap(),
+                // OIDC based flow
-                conn,
+                duo_oidc::validate_duo_login(
-            )
+                    &user.email,
-            .await?;
+                    twofactor_code,
                    data.client_id.as_ref().unwrap(),
                    data.device_identifier.as_ref().unwrap(),
                    conn,
                )
                .await?;
            }
        }
        Some(TwoFactorType::Email) => {
            email::validate_email_code_str(&user.uuid, twofactor_code, &selected_data?, &ip.ip, conn).await?;
@@ -875,22 +869,16 @@ async fn twofactor_auth(
                        device.save(true, conn).await?;
                    }
                    err_json!(
-                        json_err_twofactor(&twofactor_ids, user, data, conn).await?,
+                        json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
                        "2FA Remember token not provided or expired"
                    )
                }
            }
        }
        Some(TwoFactorType::RecoveryCode) => {
-            // Like upstream, spaces and case don't matter
+            // Check if recovery code is correct
-            let recovery_code = twofactor_code.replace(' ', "").trim().to_lowercase();
+            if !user.check_valid_recovery_code(twofactor_code) {
-            if !user.check_valid_recovery_code(&recovery_code) {
+                err!("Recovery code is incorrect. Try again.")
                err!(
                    "Two-step token is invalid. Try again.",
                    ErrorEvent {
                        event: EventType::UserFailedLogIn2fa
                    }
                )
            }
            // Remove all twofactors from the user
@@ -903,14 +891,7 @@ async fn twofactor_auth(
            enforce_2fa_policy(user, &user.uuid, device.atype, &ip.ip, conn).await?;
-            log_user_event(EventType::UserRecovered2fa, &user.uuid, device.atype, &ip.ip, conn).await;
+            log_user_event(EventType::UserRecovered2fa as i32, &user.uuid, device.atype, &ip.ip, conn).await;
            if CONFIG.mail_enabled()
                && let Err(e) =
                    mail::send_recover_twofactor(&user.email, &ip.ip.to_string(), &Utc::now().naive_utc()).await
            {
                error!("Error sending two-step login recovered email: {e:#?}");
            }
            // Remove the recovery code, not needed without twofactors
            user.totp_recover = None;
@@ -939,14 +920,21 @@ fn selected_data(tf: Option<TwoFactor>) -> ApiResult<String> {
    tf.map(|t| t.data).map_res("Two factor doesn't exist")
 }
-async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData, conn: &DbConn) -> ApiResult<Value> {
+async fn json_err_twofactor(
-    let user_id = &user.uuid;
+    providers: &[i32],
    user_id: &UserId,
    data: &ConnectData,
    client_version: Option<&ClientVersion>,
    conn: &DbConn,
 ) -> ApiResult<Value> {
    let mut result = json!({
        "error" : "invalid_grant",
        "error_description" : "Two factor required.",
        "TwoFactorProviders" : providers.iter().map(ToString::to_string).collect::<Vec<String>>(),
        "TwoFactorProviders2" : {}, // { "0" : null }
-        "MasterPasswordPolicy": identity_master_password_policy(user, conn).await,
+        "MasterPasswordPolicy": {
            "Object": "masterPasswordPolicy"
        }
    });
    for provider in providers {
@@ -959,21 +947,37 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
            }
            Some(TwoFactorType::Duo) => {
-                let auth_url = duo_oidc::get_duo_auth_url(
+                let email = if let Some(u) = User::find_by_uuid(user_id, conn).await {
-                    &user.email,
+                    u.email
-                    data.client_id.as_ref().unwrap(),
+                } else {
-                    data.device_identifier.as_ref().unwrap(),
+                    err!("User does not exist")
-                    conn,
+                };
                )
                .await?;
-                result["TwoFactorProviders2"][provider.to_string()] = json!({
+                if CONFIG.duo_use_iframe() {
-                    "AuthUrl": auth_url,
+                    // Legacy iframe prompt flow
-                });
+                    let (signature, host) = duo::generate_duo_signature(&email, conn).await?;
                    result["TwoFactorProviders2"][provider.to_string()] = json!({
                        "Host": host,
                        "Signature": signature,
                    });
                } else {
                    // OIDC based flow
                    let auth_url = duo_oidc::get_duo_auth_url(
                        &email,
                        data.client_id.as_ref().unwrap(),
                        data.device_identifier.as_ref().unwrap(),
                        conn,
                    )
                    .await?;
                    result["TwoFactorProviders2"][provider.to_string()] = json!({
                        "AuthUrl": auth_url,
                    });
                }
            }
            Some(tf_type @ TwoFactorType::YubiKey) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
+                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
                    err!("No YubiKey devices registered")
                };
@@ -985,10 +989,23 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
            }
            Some(tf_type @ TwoFactorType::Email) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
+                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
                    err!("No twofactor email registered")
                };
                // Starting with version 2025.5.0 the client will call `/api/two-factor/send-email-login`.
                let disabled_send = if let Some(cv) = client_version {
                    let ver_match = semver::VersionReq::parse(">=2025.5.0").unwrap();
                    ver_match.matches(&cv.0)
                } else {
                    false
                };
                // Send email immediately if email is the only 2FA option.
                if providers.len() == 1 && !disabled_send {
                    email::send_token(user_id, conn).await?;
                }
                let email_data = email::EmailTokenData::from_json(&twofactor.data)?;
                result["TwoFactorProviders2"][provider.to_string()] = json!({
                    "Email": email::obscure_email(&email_data.email),
@@ -1026,6 +1043,11 @@ async fn prelogin_password(data: Json<PreloginData>, ip: ClientIp, conn: DbConn)
    prelogin(data, ip, conn).await
 }
 #[post("/accounts/register", data = "<data>")]
 async fn identity_register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
    register(data, false, conn).await
 }
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RegisterVerificationData {
@@ -1097,9 +1119,8 @@ async fn register_verification_email(
 }
 #[post("/accounts/register/finish", data = "<data>")]
-async fn register_finish(data: Json<RegisterData>, ip: ClientIp, conn: DbConn) -> JsonResult {
+async fn register_finish(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
+    register(data, true, conn).await
    register(data, conn).await
 }
 // https://github.com/bitwarden/jslib/blob/master/common/src/models/request/tokenRequest.ts
@@ -1229,7 +1250,7 @@ async fn oidcsignin_redirect(
    let state = sso::decode_state(&base64_state)?;
    let Some(mut sso_auth) = SsoAuth::find(&state, conn).await else {
-        err!(format!("Cannot retrieve sso_auth for {}", state.escape_debug()))
+        err!(format!("Cannot retrieve sso_auth for {state}"))
    };
    // Browser-binding check
@@ -1238,7 +1259,7 @@ async fn oidcsignin_redirect(
    let provided_hash = cookie_value.as_deref().map(|v| crypto::sha256_hex(v.as_bytes()));
    match (sso_auth.binding_hash.as_deref(), provided_hash.as_deref()) {
        (Some(expected), Some(actual)) if crypto::ct_eq(expected, actual) => {}
-        _ => err!(format!("SSO session binding mismatch for {}", state.escape_debug())),
+        _ => err!(format!("SSO session binding mismatch for {state}")),
    }
    cookies
        .remove(Cookie::build(SSO_BINDING_COOKIE).path(format!("{}/identity/connect/", CONFIG.domain_path())).build());
@@ -23,7 +23,7 @@ pub use crate::api::{
    icons::routes as icons_routes,
    identity::routes as identity_routes,
    notifications::routes as notifications_routes,
-    notifications::{AnonymousNotify, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
+    notifications::{AnonymousNotify, LogOutReason, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
    push::{
        push_cipher_update, push_folder_update, push_logout, push_send_update, push_user_update, register_push_device,
        unregister_push_device,
@@ -46,7 +46,7 @@ pub type JsonResult = ApiResult<Json<Value>>;
 pub type EmptyResult = ApiResult<()>;
 // Common structs representing JSON data received
-#[derive(Debug, Deserialize)]
+#[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct PasswordOrOtpData {
    #[serde(alias = "MasterPasswordHash")]
@@ -124,21 +124,3 @@ async fn master_password_policy(user: &User, conn: &DbConn) -> Value {
    mpp_json["Object"] = json!("masterPasswordPolicy");
    mpp_json
 }
 // Identity responses use PascalCase keys like upstream, some clients (Android) only read those
 async fn identity_master_password_policy(user: &User, conn: &DbConn) -> Value {
    match master_password_policy(user, conn).await {
        Value::Object(policy) => Value::Object(
            policy
                .into_iter()
                .map(|(mut key, value)| {
                    if let Some(first) = key.get_mut(..1) {
                        first.make_ascii_uppercase();
                    }
                    (key, value)
                })
                .collect(),
        ),
        policy => policy,
    }
 }
@@ -1,7 +1,7 @@
 use std::{
    net::IpAddr,
    sync::{Arc, LazyLock},
-    time::{Duration, Instant},
+    time::Duration,
 };
 use chrono::{NaiveDateTime, Utc};
@@ -41,14 +41,6 @@ pub static WS_ANONYMOUS_SUBSCRIPTIONS: LazyLock<Arc<AnonymousWebSocketSubscripti
 /// One connection is needed per pending login request, several at once are only expected behind NAT.
 const MAX_ANONYMOUS_CONNECTIONS_PER_IP: u32 = 25;
 /// How often a Ping is sent to the client.
 const WS_PING_INTERVAL: Duration = Duration::from_secs(15);
 /// Close the connection if nothing, not even a Pong, was received from the client for this long.
 /// Otherwise half-open connections (client gone without a FIN, e.g. behind a proxy or NAT) are kept forever.
 /// Same as the default `ClientTimeoutInterval` of ASP.NET Core SignalR, which the official server uses.
 const WS_CLIENT_TIMEOUT: Duration = Duration::from_secs(30);
 static NOTIFICATIONS_DISABLED: LazyLock<bool> = LazyLock::new(|| !CONFIG.enable_websocket() && !CONFIG.push_enabled());
 pub fn routes() -> Vec<Route> {
@@ -164,16 +156,12 @@ fn websockets_hub<'r>(
        rocket_ws::Stream! { ws => {
            let mut ws = ws;
            let _guard = guard;
-            let mut interval = tokio::time::interval(WS_PING_INTERVAL);
+            let mut interval = tokio::time::interval(Duration::from_secs(15));
            let mut last_received = Instant::now();
            loop {
                tokio::select! {
                    res = ws.next() =>  {
                        match res {
                            Some(Ok(message)) => {
                                // Any message, including a Pong, means the client is still there
                                last_received = Instant::now();
                                match message {
                                    // Respond to any pings
                                    Message::Ping(ping) => yield Message::Pong(ping),
@@ -207,13 +195,7 @@ fn websockets_hub<'r>(
                        }
                    }
-                    _ = interval.tick() => {
+                    _ = interval.tick() => yield Message::Ping(create_ping())
                        // The client stopped responding without closing the connection, drop it
                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
                            break;
                        }
                        yield Message::Ping(create_ping());
                    }
                }
            }
        }}
@@ -247,16 +229,12 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
        rocket_ws::Stream! { ws => {
            let mut ws = ws;
            let _guard = guard;
-            let mut interval = tokio::time::interval(WS_PING_INTERVAL);
+            let mut interval = tokio::time::interval(Duration::from_secs(15));
            let mut last_received = Instant::now();
            loop {
                tokio::select! {
                    res = ws.next() =>  {
                        match res {
                            Some(Ok(message)) => {
                                // Any message, including a Pong, means the client is still there
                                last_received = Instant::now();
                                match message {
                                    // Respond to any pings
                                    Message::Ping(ping) => yield Message::Pong(ping),
@@ -290,13 +268,7 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
                        }
                    }
-                    _ = interval.tick() => {
+                    _ = interval.tick() => yield Message::Ping(create_ping())
                        // The client stopped responding without closing the connection, drop it
                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
                            break;
                        }
                        yield Message::Ping(create_ping());
                    }
                }
            }
        }}
@@ -411,23 +383,36 @@ impl WebSocketUsers {
    }
    pub async fn send_logout(&self, user: &User, acting_device: Option<&Device>, conn: &DbConn) {
        self.send_logout_with_reason(user, acting_device, None, conn).await;
    }
    /// A logout that clients may handle differently depending on `reason`, e.g. syncing instead of
    /// logging out after a key rotation that kept the sessions alive.
    pub async fn send_logout_with_reason(
        &self,
        user: &User,
        acting_device: Option<&Device>,
        reason: Option<LogOutReason>,
        conn: &DbConn,
    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
        let acting_device_id = acting_device.map(|d| d.uuid.clone());
-        let data = create_update(
+        let mut payload =
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
+            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))];
-            UpdateType::LogOut,
+        if let Some(reason) = reason {
-            acting_device_id,
+            payload.push(("Reason".into(), (reason as i32).into()));
-        );
+        }
        let data = create_update(payload, UpdateType::LogOut, acting_device_id);
        if CONFIG.enable_websocket() {
            self.send_update(&user.uuid, &data).await;
        }
        if CONFIG.push_enabled() {
-            push_logout(user, acting_device, conn).await;
+            push_logout(user, acting_device, reason, conn).await;
        }
    }
@@ -695,6 +680,15 @@ fn create_ping() -> Vec<u8> {
    serialize(&Value::Array(vec![6.into()]))
 }
 /// Why a logout was pushed. Absent for a plain logout.
 ///
 /// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Enums/PushNotificationLogOutReason.cs>
 /// (`KdfChange = 0` is not sent by vaultwarden yet.)
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum LogOutReason {
    KeyRotation = 1,
 }
 // https://github.com/bitwarden/server/blob/375af7c43b10d9da03525d41452f95de3f921541/src/Core/Enums/PushType.cs
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum UpdateType {
@@ -12,7 +12,7 @@ use tokio::sync::RwLock;
 use crate::{
    CONFIG,
-    api::{ApiResult, EmptyResult, UpdateType},
+    api::{ApiResult, EmptyResult, LogOutReason, UpdateType},
    db::{
        DbConn,
        models::{AuthRequestId, Cipher, Device, Folder, PushId, Send, User, UserId},
@@ -188,7 +188,7 @@ pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device
    }
 }
-pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+pub async fn push_logout(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>, conn: &DbConn) {
    if Device::check_user_has_push_device(&user.uuid, conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
            "userId": user.uuid,
@@ -198,7 +198,8 @@ pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbC
            "type": UpdateType::LogOut as i32,
            "payload": {
                "userId": user.uuid,
-                "date": format_date(&user.updated_at)
+                "date": format_date(&user.updated_at),
                "reason": reason.map(|r| r as i32),
            },
            "clientType": null,
            "installationId": null
@@ -89,7 +89,6 @@ fn vaultwarden_css() -> EtagCached<Css<String>> {
    // Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS
    let css_options = json!({
        "email_change_allowed": CONFIG.email_change_allowed(),
        "emergency_access_allowed": CONFIG.emergency_access_allowed(),
        "load_user_scss": true,
        "mail_2fa_enabled": CONFIG._enable_email_2fa(),
@@ -1,6 +1,3 @@
 #[path = "auth/two_factor.rs"]
 pub mod two_factor;
 #[path = "auth/send.rs"]
 pub mod send;
 pub type SendTokens = send::SendTokens;
@@ -17,7 +14,6 @@ use ipnet::IpNet;
 use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header, errors::ErrorKind};
 use num_traits::FromPrimitive;
 use openssl::rsa::Rsa;
 use ring::hmac;
 use serde::{de::DeserializeOwned, ser::Serialize};
 use rocket::{
@@ -34,7 +30,7 @@ use crate::{
        models::{
            AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
            EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
-            SendFileId, SendId, User, UserId, UserStampException,
+            SendFileId, SendId, User, UserId,
        },
    },
    error::Error,
@@ -69,7 +65,6 @@ static JWT_2FA_REMEMBER_ISSUER: LazyLock<String> = LazyLock::new(|| format!("{}|
 static PRIVATE_RSA_KEY: OnceLock<EncodingKey> = OnceLock::new();
 static PUBLIC_RSA_KEY: OnceLock<DecodingKey> = OnceLock::new();
 static PRELOGIN_KDF_KEY: OnceLock<hmac::Key> = OnceLock::new();
 pub async fn initialize_keys() -> Result<(), Error> {
    use std::io::Error as IoError;
@@ -104,22 +99,9 @@ pub async fn initialize_keys() -> Result<(), Error> {
    if PUBLIC_RSA_KEY.set(dec).is_err() {
        err!("PUBLIC_RSA_KEY must only be initialized once")
    }
    // Derived from the RSA key, so it stays the same across restarts without storing another secret
    let prelogin_kdf_key = hmac::sign(&hmac::Key::new(hmac::HMAC_SHA256, &priv_key_buffer), b"prelogin-kdf");
    if PRELOGIN_KDF_KEY.set(hmac::Key::new(hmac::HMAC_SHA256, prelogin_kdf_key.as_ref())).is_err() {
        err!("PRELOGIN_KDF_KEY must only be initialized once")
    }
    Ok(())
 }
 /// Returns an index in `0..len` derived from the email, the same for every request
 pub fn prelogin_kdf_index(email: &str, len: usize) -> usize {
    let tag = hmac::sign(PRELOGIN_KDF_KEY.wait(), email.as_bytes());
    let tag = tag.as_ref();
    usize::from(u16::from_be_bytes([tag[0], tag[1]])) % len
 }
 pub fn encode_jwt<T: Serialize>(claims: &T) -> String {
    match jsonwebtoken::encode(&JWT_HEADER, claims, PRIVATE_RSA_KEY.wait()) {
        Ok(token) => token,
@@ -271,7 +253,7 @@ impl LoginJwtClaims {
            premium: true,
            name: user.name.clone(),
            email: user.email.clone(),
-            email_verified: user.verified(),
+            email_verified: !CONFIG.mail_enabled() || user.verified_at.is_some(),
            // ---
            // Disabled these keys to be added to the JWT since they could cause the JWT to get too large
@@ -440,7 +422,7 @@ pub fn generate_file_download_claims(cipher_id: CipherId, file_id: AttachmentId)
    let time_now = Utc::now();
    FileDownloadClaims {
        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_minutes(1).unwrap()).timestamp(),
+        exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
        iss: JWT_FILE_DOWNLOAD_ISSUER.to_string(),
        sub: cipher_id,
        file_id,
@@ -685,31 +667,13 @@ impl<'r> FromRequest<'r> for Headers {
        };
        if user.security_stamp != claims.sstamp {
-            if let Some(stamp_exception) =
+            let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                user.stamp_exception.as_deref().and_then(|s| serde_json::from_str::<UserStampException>(s).ok())
+                err_handler!("Error getting current route for stamp exception")
-            {
+            };
                let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
                    err_handler!("Error getting current route for stamp exception")
                };
-                // Check if the stamp exception has expired first.
+            // Expired exceptions are dropped the next time the stamp is reset, not here: writing them
-                // Then, check if the current route matches any of the allowed routes.
+            // back from this request could undo a reset made since the user was read.
-                // After that check the stamp in exception matches the one in the claims.
+            if !user.stamp_exceptions().iter().any(|e| e.allows(&claims.sstamp, current_route)) {
                if Utc::now().timestamp() > stamp_exception.expire {
                    // If the stamp exception has been expired remove it from the database.
                    // This prevents checking this stamp exception for new requests.
                    let mut user = user;
                    user.reset_stamp_exception();
                    if let Err(e) = user.save(&conn).await {
                        error!("Error updating user: {e:#?}");
                    }
                    err_handler!("Stamp exception is expired")
                } else if !stamp_exception.routes.contains(&current_route.to_owned()) {
                    err_handler!("Invalid security stamp: Current route and exception route do not match")
                } else if stamp_exception.security_stamp != claims.sstamp {
                    err_handler!("Invalid security stamp for matched stamp exception")
                }
            } else {
                err_handler!("Invalid security stamp")
            }
        }
@@ -1109,31 +1073,6 @@ fn ip_header_is_trusted(remote: Option<IpAddr>) -> bool {
    trusted.split(',').filter_map(parse_trusted_proxy).any(|net| net.contains(&remote))
 }
 /// Each proxy appends the address it received the request from to a list header (`X-Forwarded-For: client, proxy1`).
 /// Like ASP.NET's ForwardedHeaders, walk the entries of every occurrence of the header from the right and take the
 /// first one that isn't a trusted proxy. If they all are, the leftmost one is the client.
 fn client_ip_from_header(req: &Request<'_>, header: &str, is_trusted: impl Fn(IpAddr) -> bool) -> Option<IpAddr> {
    let values: Vec<&str> = req.headers().get(header).collect();
    client_ip_from_header_values(&values, header, is_trusted)
 }
 fn client_ip_from_header_values(values: &[&str], header: &str, is_trusted: impl Fn(IpAddr) -> bool) -> Option<IpAddr> {
    let entries: Vec<&str> = values.iter().flat_map(|value| value.split(',')).map(str::trim).collect();
    let mut client_ip = None;
    for entry in entries.into_iter().rev() {
        let Ok(ip) = entry.parse() else {
            warn!("'{header}' header is malformed: {entry}");
            break;
        };
        client_ip = Some(ip);
        if !is_trusted(ip) {
            break;
        }
    }
    client_ip
 }
 #[rocket::async_trait]
 impl<'r> FromRequest<'r> for ClientIp {
    type Error = ();
@@ -1142,7 +1081,15 @@ impl<'r> FromRequest<'r> for ClientIp {
        let remote = req.remote().map(|r| r.ip());
        let ip = if CONFIG._ip_header_enabled() && ip_header_is_trusted(remote) {
-            client_ip_from_header(req, &CONFIG.ip_header(), |ip| ip_header_is_trusted(Some(ip)))
+            req.headers().get_one(&CONFIG.ip_header()).and_then(|ip| {
                match ip.find(',') {
                    Some(idx) => &ip[..idx],
                    None => ip,
                }
                .parse()
                .map_err(|_| warn!("'{}' header is malformed: {ip}", CONFIG.ip_header()))
                .ok()
            })
        } else {
            if CONFIG._ip_header_enabled() && req.headers().get_one(&CONFIG.ip_header()).is_some() {
                // Log the canonical IP, which is what the user filter will need to match against
@@ -1261,7 +1208,7 @@ impl AuthMethod {
        match scope {
            None => err!("Missing scope"),
            Some(scope) if scope == &method_scope => Ok(method_scope),
-            Some(scope) => err!(format!("Scope ({}) not supported", scope.escape_debug())),
+            Some(scope) => err!(format!("Scope ({scope}) not supported")),
        }
    }
 }
@@ -1380,52 +1327,3 @@ pub async fn refresh_tokens(
    Ok((device, auth_tokens))
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    fn client_ip(values: &[&str]) -> Option<IpAddr> {
        let is_trusted = |ip: IpAddr| match ip {
            IpAddr::V4(v4) => v4.is_private() || v4.is_loopback(),
            IpAddr::V6(v6) => v6.is_loopback(),
        };
        client_ip_from_header_values(values, "X-Forwarded-For", is_trusted)
    }
    fn ip(s: &str) -> Option<IpAddr> {
        Some(s.parse().unwrap())
    }
    #[test]
    fn ip_header_single_value() {
        assert_eq!(client_ip(&["203.0.113.5"]), ip("203.0.113.5"));
        assert_eq!(client_ip(&["10.0.0.7"]), ip("10.0.0.7"));
        assert_eq!(client_ip(&["2001:db8::1"]), ip("2001:db8::1"));
    }
    #[test]
    fn ip_header_uses_rightmost_untrusted_entry() {
        // Entries already in the request come before the one the proxy appended
        assert_eq!(client_ip(&["198.51.100.1, 203.0.113.5"]), ip("203.0.113.5"));
        // Trusted proxies on the right are skipped
        assert_eq!(client_ip(&["198.51.100.1, 203.0.113.5, 10.0.0.2, 127.0.0.1"]), ip("203.0.113.5"));
        // All trusted, so the leftmost entry is the client
        assert_eq!(client_ip(&["192.168.1.10, 10.0.0.2"]), ip("192.168.1.10"));
    }
    #[test]
    fn ip_header_reads_every_occurrence() {
        assert_eq!(client_ip(&["198.51.100.1", "203.0.113.5"]), ip("203.0.113.5"));
        assert_eq!(client_ip(&["198.51.100.1", "203.0.113.5, 10.0.0.2"]), ip("203.0.113.5"));
    }
    #[test]
    fn ip_header_malformed_entries() {
        assert_eq!(client_ip(&[]), None);
        assert_eq!(client_ip(&[""]), None);
        assert_eq!(client_ip(&["203.0.113.5, not-an-ip"]), None);
        // Stops at the malformed entry and keeps the closest proxy
        assert_eq!(client_ip(&["not-an-ip, 10.0.0.2"]), ip("10.0.0.2"));
    }
 }
@@ -75,7 +75,7 @@ impl SendTokens {
            return Self::invalid_error(&format!("Can't convert {access_id}"), "send_id_invalid", false);
        };
-        let Some(send) = Send::find_by_uuid(&send_id, conn).await else {
+        let Some(mut send) = Send::find_by_uuid(&send_id, conn).await else {
            return Self::invalid_error(&format!("Can't find {send_id}"), "send_id_invalid", false);
        };
@@ -103,6 +103,10 @@ impl SendTokens {
            }
        }
        if !send.register_access(conn).await? {
            return Self::invalid_error(&format!("Send {send_id}, max access reached"), "send_id_invalid", true);
        }
        Ok(Self {
            access_claims: generate_send_access_claims(&send_id),
        })
@@ -1,281 +0,0 @@
 use chrono::{TimeDelta, Utc};
 use serde::{de::DeserializeOwned, ser::Serialize};
 use std::sync::LazyLock;
 use crate::{
    CONFIG,
    api::{ApiResult, EmptyResult},
    auth::{decode_jwt, encode_jwt},
    db::models::UserId,
 };
 static JWT_2FA_AUTH_ISSUER: LazyLock<String> = LazyLock::new(|| format!("{}|api.2fa", CONFIG.domain_origin()));
 #[derive(Serialize, Deserialize)]
 pub struct TwoFactorClaims<T> {
    // Not before
    pub nbf: i64,
    // Expiration time
    pub exp: i64,
    // Issuer
    pub iss: String,
    // Subject
    pub sub: UserId,
    pub enabled: bool,
    pub claims: T,
 }
 #[derive(Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct AuthenticatorClaims {
    #[serde(rename = "authenticator_key")]
    pub key: String,
 }
 #[derive(Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct DuoClaims {
    #[serde(rename = "duo_data")]
    pub data: Option<DuoData>,
 }
 #[derive(Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct WebauthnClaims {
    #[serde(rename = "webauthn_keys")]
    pub keys: Vec<i32>,
 }
 #[derive(Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct YubikeyClaims {
    #[serde(rename = "yubi_keys")]
    pub keys: Vec<String>,
 }
 #[derive(Serialize, Deserialize, PartialEq)]
 pub struct DuoData {
    pub host: String, // Duo API hostname
    pub ik: String,   // client id
    pub sk: String,   // client secret
 }
 impl DuoData {
    pub fn global() -> Option<Self> {
        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
            (true, Some(host)) => Some(Self {
                host,
                ik: CONFIG.duo_ikey().unwrap(),
                sk: CONFIG.duo_skey().unwrap(),
            }),
            _ => None,
        }
    }
    pub fn msg(s: &str) -> Self {
        Self {
            host: s.into(),
            ik: s.into(),
            sk: s.into(),
        }
    }
    pub fn secret() -> Self {
        Self::msg("<global_secret>")
    }
    pub fn obscure(self) -> Self {
        let mut host = self.host;
        let mut ik = self.ik;
        let mut sk = self.sk;
        let digits = 4;
        let replaced = "************";
        host.replace_range(digits.., replaced);
        ik.replace_range(digits.., replaced);
        sk.replace_range(digits.., replaced);
        Self {
            host,
            ik,
            sk,
        }
    }
 }
 #[derive(Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct EmailClaims {
    pub email: Option<String>,
 }
 fn token<T: Serialize>(user_id: UserId, enabled: bool, claims: T) -> String {
    let time_now = Utc::now();
    let claims = TwoFactorClaims {
        nbf: time_now.timestamp(),
        exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
        iss: JWT_2FA_AUTH_ISSUER.to_string(),
        sub: user_id,
        enabled,
        claims,
    };
    encode_jwt(&claims)
 }
 fn validate<T: DeserializeOwned>(token: &str, user_id: &UserId, enabled: bool) -> ApiResult<T> {
    match decode_jwt::<TwoFactorClaims<T>>(token, JWT_2FA_AUTH_ISSUER.to_string()) {
        Ok(claims) => {
            if claims.sub != *user_id {
                err!("Invalid verification token: Invalid user");
            }
            if claims.enabled != enabled {
                err!("Invalid verification token: Invalid state");
            }
            Ok(claims.claims)
        }
        Err(err) => err!(format!("Failed to decode verification token: {err}")),
    }
 }
 pub fn authenticator_token(user_id: UserId, key: String, enabled: bool) -> String {
    token(
        user_id,
        enabled,
        AuthenticatorClaims {
            key,
        },
    )
 }
 pub fn validate_authenticator(token: &str, user_id: &UserId, key: &str, enabled: bool) -> EmptyResult {
    let claims = validate::<AuthenticatorClaims>(token, user_id, enabled)?;
    if claims.key != key {
        err!("Invalid verification token: Invalid key");
    }
    Ok(())
 }
 pub fn duo_token(user_id: UserId, data: Option<DuoData>, enabled: bool) -> String {
    token(
        user_id,
        enabled,
        DuoClaims {
            data,
        },
    )
 }
 // When disabling we check that it's the correct data
 pub fn validate_duo(token: &str, user_id: &UserId, data: Option<&DuoData>, enabled: bool) -> EmptyResult {
    let claims = validate::<DuoClaims>(token, user_id, enabled)?;
    if enabled && claims.data.as_ref() != data {
        err!("Invalid verification token: Invalid duo data");
    }
    Ok(())
 }
 pub fn email_token(user_id: UserId, email: Option<String>, enabled: bool) -> String {
    token(
        user_id,
        enabled,
        EmailClaims {
            email,
        },
    )
 }
 // When disabling we check that it's the correct `email`
 pub fn validate_email(token: &str, user_id: &UserId, email: String, enabled: bool) -> EmptyResult {
    let claims = validate::<EmailClaims>(token, user_id, enabled)?;
    if enabled && claims.email != Some(email) {
        err!("Invalid verification token: Invalid email");
    }
    Ok(())
 }
 pub fn webauthn_token(user_id: UserId, keys: Vec<i32>, enabled: bool) -> String {
    token(
        user_id,
        enabled,
        WebauthnClaims {
            keys,
        },
    )
 }
 pub fn validate_webauthn(token: &str, user_id: &UserId, keys: &[i32], enabled: bool) -> EmptyResult {
    let claims = validate::<WebauthnClaims>(token, user_id, enabled)?;
    if keys != claims.keys {
        err!("Invalid verification token: Invalid keys");
    }
    Ok(())
 }
 pub fn yubikey_token(user_id: UserId, keys: Vec<String>, enabled: bool) -> String {
    token(
        user_id,
        enabled,
        YubikeyClaims {
            keys,
        },
    )
 }
 pub fn validate_yubikey(token: &str, user_id: &UserId, keys: &Vec<String>, enabled: bool) -> EmptyResult {
    let claims = validate::<YubikeyClaims>(token, user_id, enabled)?;
    if *keys != claims.keys {
        err!("Invalid verification token: Invalid keys");
    }
    Ok(())
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use serde_json::{Value, from_value, to_value};
    fn token<T: Serialize>(claims: T) -> Value {
        to_value(TwoFactorClaims {
            nbf: 0,
            exp: 0,
            iss: String::new(),
            sub: UserId::from(String::from("4ff0f0a4-0aa4-4c1d-9d43-1f2bd4d5e8b1")),
            enabled: false,
            claims,
        })
        .unwrap()
    }
    #[test]
    fn claims_only_parse_as_their_own_provider() {
        let tokens = [
            token(AuthenticatorClaims {
                key: String::from("JBSWY3DPEHPK3PXP"),
            }),
            token(DuoClaims {
                data: None,
            }),
            token(WebauthnClaims {
                keys: vec![1],
            }),
            token(YubikeyClaims {
                keys: Vec::new(),
            }),
            token(EmailClaims {
                email: None,
            }),
        ];
        for (issued, token) in tokens.iter().enumerate() {
            let parsed = [
                from_value::<TwoFactorClaims<AuthenticatorClaims>>(token.clone()).is_ok(),
                from_value::<TwoFactorClaims<DuoClaims>>(token.clone()).is_ok(),
                from_value::<TwoFactorClaims<WebauthnClaims>>(token.clone()).is_ok(),
                from_value::<TwoFactorClaims<YubikeyClaims>>(token.clone()).is_ok(),
                from_value::<TwoFactorClaims<EmailClaims>>(token.clone()).is_ok(),
            ];
            for (checked, ok) in parsed.into_iter().enumerate() {
                assert_eq!(ok, issued == checked, "token {issued} parsed as {checked}");
            }
        }
    }
 }
@@ -561,7 +561,7 @@ make_config! {
        /// Auth Request cleanup schedule |> Cron schedule of the job that cleans old auth requests from the auth request.
        /// Defaults to every minute. Set blank to disable this job.
        auth_request_purge_schedule:   String, false,  def,    "30 * * * * *".to_owned();
-        /// Duo Auth context cleanup schedule |> Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
+        /// Duo Auth context cleanup schedule |> Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
        /// Defaults to once every minute. Set blank to disable this job.
        duo_context_purge_schedule:   String, false,  def,    "30 * * * * *".to_owned();
        /// Purge incomplete SSO auth. |> Cron schedule of the job that cleans leftover auth in db due to incomplete SSO login.
@@ -675,8 +675,7 @@ make_config! {
        /// other address use the remote IP instead, so a client can't spoof the header.
        /// Either the string "local" (the default, any non-global address, which covers a reverse proxy
        /// running on the same host or container network), the string "all" to accept it from anywhere,
-        /// or a comma separated list of IPs and CIDR ranges. For a list header like X-Forwarded-For, the
+        /// or a comma separated list of IPs and CIDR ranges.
        /// client IP is the rightmost address that isn't a trusted proxy, so list every proxy in the chain.
        ip_header_trusted_proxies: String, true, def,    "local".to_owned();
        /// Icon service |> The predefined icon services are: internal, bitwarden, duckduckgo, google.
        /// To specify a custom icon service, set a URL template with exactly one instance of `{}`,
@@ -866,12 +865,16 @@ make_config! {
    duo: _enable_duo {
        /// Enabled
        _enable_duo:            bool,   true,   def,     true;
        /// Attempt to use deprecated iframe-based Traditional Prompt (Duo WebSDK 2)
        duo_use_iframe:         bool,   false,  def,     false;
        /// Client Id
        duo_ikey:               String, true,   option;
        /// Client Secret
        duo_skey:               Pass,   true,   option;
        /// Host
        duo_host:               String, true,   option;
        /// Application Key (generated automatically)
        _duo_akey:              Pass,   false,  option;
    },
    /// SMTP Email Settings
@@ -1266,14 +1269,6 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
        err!("`AUTH_REQUEST_PURGE_SCHEDULE` is not a valid cron expression")
    }
    if !cfg.duo_context_purge_schedule.is_empty() && cfg.duo_context_purge_schedule.parse::<Schedule>().is_err() {
        err!("`DUO_CONTEXT_PURGE_SCHEDULE` is not a valid cron expression")
    }
    if !cfg.purge_incomplete_sso_auth.is_empty() && cfg.purge_incomplete_sso_auth.parse::<Schedule>().is_err() {
        err!("`PURGE_INCOMPLETE_SSO_AUTH` is not a valid cron expression")
    }
    if !cfg.disable_admin_token {
        match cfg.admin_token.as_ref() {
            Some(t) if t.starts_with("$argon2") => {
@@ -1423,19 +1418,33 @@ pub enum PathType {
 // Android (v2026.2.1): https://github.com/bitwarden/android/blob/6902c19c0093fa476bbf74ccaa70c9f14afbb82f/core/src/main/kotlin/com/bitwarden/core/data/manager/model/FlagKey.kt#L31
 // iOS (v2026.2.1): https://github.com/bitwarden/ios/blob/cdd9ba1770ca2ffc098d02d12cc3208e3a830454/BitwardenShared/Core/Platform/Models/Enum/FeatureFlag.swift#L7
 pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
    // Architecture
    "desktop-ui-migration-milestone-1",
    "desktop-ui-migration-milestone-2",
    "desktop-ui-migration-milestone-3",
    "desktop-ui-migration-milestone-4",
    // Auth Team
    "pm-5594-safari-account-switching",
    "pm-32413-multi-client-password-management",
    // Autofill Team
    "undetermined-cipher-scenario-logic",
    "enable-basic-auth-response",
    "ssh-agent",
    "ssh-agent-v2",
    "windows-desktop-autotype",
    "windows-desktop-autotype-ga",
    // Key Management Team
-    "biometrics-sdk-ipc",
+    "ssh-key-vault-item",
-    "windows-native-credential-sync",
+    "pm-25373-windows-biometrics-v2",
    "pm-26340-linux-biometrics-v2",
    "pm-31050-no-logout-key-upgrade-rotation",
    "pm-27278-v2-password-registration",
    "enable-account-encryption-v2-jit-password-registration",
    "pm-30144-sdk-key-rotation",
    "force-upgrade-v2-encryption",
    // Mobile Team
    "anon-addy-self-host-alias",
    "simple-login-self-host-alias",
    "mutual-tls",
    "cxp-import-mobile",
    "cxp-export-mobile",
    "pm-34171-card-scanner",
    // Platform Team
    "pm-30529-webauthn-related-origins",
@@ -1512,6 +1521,15 @@ impl Config {
        Ok(())
    }
    async fn update_config_partial(&self, other: ConfigBuilder) -> Result<(), Error> {
        let builder = {
            let usr = &self.inner.read().unwrap()._usr;
            let mut overrides = Vec::new();
            usr.merge(&other, false, &mut overrides)
        };
        self.update_config(builder, false).await
    }
    /// Tests whether an email's domain is allowed. A domain is allowed if it
    /// is in signups_domains_whitelist, or if no whitelist is set (so there
    /// are no domain restrictions in effect).
@@ -1607,6 +1625,23 @@ impl Config {
        inner._enable_smtp && (inner.smtp_host.is_some() || inner.use_sendmail)
    }
    pub async fn get_duo_akey(&self) -> String {
        if let Some(akey) = self._duo_akey() {
            akey
        } else {
            let akey_s = crate::crypto::encode_random_bytes::<64>(&data_encoding::BASE64);
            // Save the new value
            let builder = ConfigBuilder {
                _duo_akey: Some(akey_s.clone()),
                ..Default::default()
            };
            self.update_config_partial(builder).await.ok();
            akey_s
        }
    }
    pub fn is_webauthn_2fa_supported(&self) -> bool {
        Url::parse(&self.domain()).expect("DOMAIN not a valid URL").domain().is_some()
    }
@@ -1738,7 +1773,6 @@ where
    reg!("email/protected_action", ".html");
    reg!("email/pw_hint_none", ".html");
    reg!("email/pw_hint_some", ".html");
    reg!("email/recover_twofactor", ".html");
    reg!("email/register_verify_email", ".html");
    reg!("email/send_2fa_removed_from_org", ".html");
    reg!("email/send_emergency_access_invite", ".html");
@@ -61,7 +61,7 @@ impl Attachment {
            let token = encode_jwt(&generate_file_download_claims(self.cipher_uuid.clone(), self.id.clone()));
            Ok(format!("{host}/attachments/{}/{}?token={token}", self.cipher_uuid, self.id))
        } else {
-            Ok(operator.presign_read(&self.get_file_path(), Duration::from_mins(1)).await?.uri().to_string())
+            Ok(operator.presign_read(&self.get_file_path(), Duration::from_mins(5)).await?.uri().to_string())
        }
    }
@@ -4,7 +4,7 @@ use diesel::prelude::*;
 use serde_json::Value;
 use crate::{
-    api::{ApiResult, EmptyResult},
+    api::EmptyResult,
    crypto::ct_eq,
    db::{DbConn, schema::auth_requests},
    error::MapResult,
@@ -166,21 +166,6 @@ impl AuthRequest {
        .await
    }
    /// Marks the request as used to log in. Returns false when it already was, so it only works once.
    pub async fn set_authentication_date(uuid: &AuthRequestId, conn: &DbConn) -> ApiResult<bool> {
        let now = Utc::now().naive_utc();
        conn.run(move |conn| {
            diesel::update(auth_requests::table)
                .filter(auth_requests::uuid.eq(uuid))
                .filter(auth_requests::authentication_date.is_null())
                .set(auth_requests::authentication_date.eq(now))
                .execute(conn)
                .map(|updated| updated == 1)
                .map_res("Error updating auth request")
        })
        .await
    }
    pub fn check_access_code(&self, access_code: &str) -> bool {
        ct_eq(&self.access_code, access_code)
    }
@@ -63,6 +63,22 @@ pub struct Cipher {
    pub reprompt: Option<i32>,
 }
 /// Whether `data` is a sealed cipher blob rather than the legacy per-type JSON.
 ///
 /// Ciphers of v2 accounts are encrypted as a single blob that carries everything, name included,
 /// and is opaque to us. It is recognized the same way upstream does, by a top-level
 /// `format_version` key that the legacy JSON never has.
 ///
 /// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Vault/Entities/Cipher.cs>
 pub fn is_data_blob_encrypted(data: &str) -> bool {
    serde_json::from_str::<Value>(data).is_ok_and(|d| is_blob_value(&d))
 }
 /// [`is_data_blob_encrypted`] for `data` that was already parsed.
 fn is_blob_value(data: &Value) -> bool {
    data.get("format_version").is_some()
 }
 pub enum RepromptType {
    None = 0,
    Password = 1,
@@ -110,6 +126,11 @@ impl Cipher {
                    .insert(format!("Ciphers[{index}].Notes"), serde_json::to_value([&max_note_size_msg]).unwrap());
            }
            if let Err(e) = cipher.validate_content(cipher.is_blob()) {
                validation_errors
                    .insert(format!("Ciphers[{index}].{}", e.field), serde_json::to_value([e.message]).unwrap());
            }
            // Validate the password history if it contains `null` values and if so, return a warning
            if let Some(Value::Array(password_history)) = &cipher.password_history {
                for pwh in password_history {
@@ -154,6 +175,11 @@ impl Cipher {
    ) -> Result<Value, crate::Error> {
        use crate::util::{format_date, validate_and_format_date};
        // Parsed once here, since `data` can be large and this runs for every cipher in a sync.
        // `LowerCase` only lowercases the first letter of each key, so it keeps `format_version`.
        let type_data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data);
        let is_blob_encrypted = type_data.as_ref().is_ok_and(is_blob_value);
        let mut attachments_json: Value = Value::Null;
        if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(attachments) = cipher_sync_data.cipher_attachments.get(&self.uuid)
@@ -189,124 +215,62 @@ impl Cipher {
            (false, false, false)
        };
-        let fields_json: Vec<_> = self
+        // Like upstream, a cipher that was stored without fields or password history reports them as
-            .fields
+        // null rather than as an empty list; clients keep the two apart.
-            .as_ref()
+        let fields_json: Option<Vec<_>> = self.fields.as_ref().map(|s| {
-            .and_then(|s| {
+            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
-                    .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
+                .ok()
-                    .ok()
+                .map(|d| {
-            })
+                    d.into_iter()
-            .map(|d| {
+                        .map(|mut f| {
-                d.into_iter()
+                            // Check if the `type` key is a number, strings break some clients
-                    .map(|mut f| {
+                            // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
-                        // Check if the `type` key is a number, strings break some clients
+                            // If not try to convert the string value to a number and fallback to `1`
-                        // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
+                            // If it is both not a number and not a string, fallback to `1`
-                        // If not try to convert the string value to a number and fallback to `1`
+                            match f.data.get("type") {
-                        // If it is both not a number and not a string, fallback to `1`
+                                Some(t) if t.is_number() => {}
-                        match f.data.get("type") {
+                                Some(t) if t.is_string() => {
-                            Some(t) if t.is_number() => {}
+                                    let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
-                            Some(t) if t.is_string() => {
+                                    f.data["type"] = json!(type_num);
-                                let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
+                                }
-                                f.data["type"] = json!(type_num);
+                                _ => {
                                    f.data["type"] = json!(1);
                                }
                            }
-                            _ => {
+                            f.data
-                                f.data["type"] = json!(1);
+                        })
-                            }
+                        .collect()
-                        }
+                })
-                        f.data
+                .unwrap_or_default()
-                    })
+        });
                    .collect()
            })
            .unwrap_or_default();
-        let password_history_json: Vec<_> = self
+        let password_history_json: Option<Vec<_>> = self.password_history.as_ref().map(|s| {
-            .password_history
+            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-            .as_ref()
+                .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
-            .and_then(|s| {
+                .ok()
-                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                .map(|d| {
-                    .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
+                    // Check every password history item if they are valid and return it.
-                    .ok()
+                    // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
-            })
+                    // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
-            .map(|d| {
+                    d.into_iter()
-                // Check every password history item if they are valid and return it.
+                        .filter_map(|d| match d.data.get("password") {
-                // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
+                            Some(p) if p.is_string() => Some(d.data),
-                // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
+                            _ => None,
-                d.into_iter()
+                        })
-                    .filter_map(|d| match d.data.get("password") {
+                        .map(|mut d| {
-                        Some(p) if p.is_string() => Some(d.data),
+                            let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
-                        _ => None,
+                                validate_and_format_date(l)
-                    })
+                            } else {
-                    .map(|mut d| {
+                                "1970-01-01T00:00:00.000000Z".to_owned()
-                        let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
+                            };
-                            validate_and_format_date(l)
+                            d["lastUsedDate"] = json!(lud);
-                        } else {
+                            d
-                            "1970-01-01T00:00:00.000000Z".to_owned()
+                        })
-                        };
+                        .collect()
-                        d["lastUsedDate"] = json!(lud);
+                })
-                        d
+                .unwrap_or_default()
-                    })
+        });
                    .collect()
            })
            .unwrap_or_default();
        // Get the type_data or a default to an empty json object '{}'.
        // If not passing an empty object, mobile clients will crash.
        let mut type_data_json = serde_json::from_str::<LowerCase<Value>>(&self.data)
            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
            .map_or_else(|_| Value::Object(serde_json::Map::new()), |d| d.data);
        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
        if self.atype == 1 {
            // Upstream always has an `uri` key/value
            type_data_json["uri"] = Value::Null;
            if let Some(uris) = type_data_json["uris"].as_array_mut()
                && !uris.is_empty()
            {
                // Fix uri match values first, they are only allowed to be a number or null
                // If it is a string, convert it to an int or null if that fails
                for uri in &mut *uris {
                    if uri["match"].is_string() {
                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
                            Ok(n) => json!(n),
                            _ => Value::Null,
                        };
                        uri["match"] = match_value;
                    }
                }
                type_data_json["uri"] = uris[0]["uri"].clone();
            }
            // Check if `passwordRevisionDate` is a valid date, else convert it
            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
            }
        }
        // Fix secure note issues when data is invalid
        // This breaks at least the native mobile clients
        if self.atype == 2 {
            match type_data_json {
                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
                _ => {
                    type_data_json = json!({"type": 0});
                }
            }
        }
        // Fix invalid SSH Entries
        // This breaks at least the native mobile client if invalid
        // The only way to fix this is by setting type_data_json to `null`
        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
        if self.atype == 5
            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
        {
            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
            type_data_json = Value::Null;
        }
        let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
@@ -403,10 +367,83 @@ impl Cipher {
            _ => err!(format!("Cipher {} has an invalid type {}", self.uuid, self.atype)),
        };
-        json_object[key] = type_data_json;
+        if is_blob_encrypted {
            // The blob holds all of the content, so it is sent back as-is and the structured fields
            // stay null, as upstream does. Only the name needs clearing, the others are never stored.
            json_object["data"] = json!(self.data);
            json_object["name"] = Value::Null;
        } else {
            json_object[key] = self.legacy_type_data_json(type_data);
        }
        Ok(json_object)
    }
    /// The per-type data (`login`, `card`, …) of a legacy cipher, from `type_data` as parsed from
    /// `self.data`, with fixups for values that are known to break clients.
    fn legacy_type_data_json(&self, type_data: Result<Value, serde_json::Error>) -> Value {
        use crate::util::validate_and_format_date;
        // Get the type_data or a default to an empty json object '{}'.
        // If not passing an empty object, mobile clients will crash.
        let mut type_data_json = type_data
            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
            .unwrap_or_else(|_| Value::Object(serde_json::Map::new()));
        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
        if self.atype == 1 {
            // Upstream always has an `uri` key/value
            type_data_json["uri"] = Value::Null;
            if let Some(uris) = type_data_json["uris"].as_array_mut()
                && !uris.is_empty()
            {
                // Fix uri match values first, they are only allowed to be a number or null
                // If it is a string, convert it to an int or null if that fails
                for uri in &mut *uris {
                    if uri["match"].is_string() {
                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
                            Ok(n) => json!(n),
                            _ => Value::Null,
                        };
                        uri["match"] = match_value;
                    }
                }
                type_data_json["uri"] = uris[0]["uri"].clone();
            }
            // Check if `passwordRevisionDate` is a valid date, else convert it
            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
            }
        }
        // Fix secure note issues when data is invalid
        // This breaks at least the native mobile clients
        if self.atype == 2 {
            match type_data_json {
                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
                _ => {
                    type_data_json = json!({"type": 0});
                }
            }
        }
        // Fix invalid SSH Entries
        // This breaks at least the native mobile client if invalid
        // The only way to fix this is by setting type_data_json to `null`
        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
        if self.atype == 5
            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
        {
            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
            type_data_json = Value::Null;
        }
        type_data_json
    }
    pub async fn update_users_revision(&self, conn: &DbConn) -> Vec<UserId> {
        let mut user_uuids = Vec::new();
        match self.user_uuid {
@@ -711,7 +748,6 @@ impl Cipher {
                // Only allow group access via a confirmed membership, since
                // groups_users rows are kept when a membership is revoked.
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable()))
                .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage))
                .load::<(bool, bool, bool)>(conn)
                .expect("Error getting group access restrictions")
@@ -1004,7 +1040,6 @@ impl Cipher {
                            .eq(ciphers_collections::collection_uuid)
                            .and(collections_groups::groups_uuid.eq(groups::uuid))),
                    )
                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_organizations::access_all
                            .eq(true) // User has access all
@@ -1036,7 +1071,6 @@ impl Cipher {
                            .eq(ciphers_collections::collection_uuid)
                            .and(users_collections::user_uuid.eq(user_uuid.clone()))),
                    )
                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_organizations::access_all
                            .eq(true) // User has access all
@@ -1081,7 +1115,6 @@ impl Cipher {
                            .eq(ciphers_collections::collection_uuid)
                            .and(collections_groups::groups_uuid.eq(groups::uuid))),
                    )
                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_organizations::access_all
                            .eq(true) // User has access all
@@ -1114,7 +1147,6 @@ impl Cipher {
                            .eq(ciphers_collections::collection_uuid)
                            .and(users_collections::user_uuid.eq(user_uuid.clone()))),
                    )
                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_organizations::access_all
                            .eq(true) // User has access all
@@ -1166,7 +1198,6 @@ impl Cipher {
                .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
                .or_filter(groups::access_all.eq(true)) //Access via group
                .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .select(ciphers_collections::all_columns)
                .distinct()
                .load::<(CipherId, CollectionId)>(conn)
@@ -367,7 +367,6 @@ impl Collection {
                            .and(collections_groups::collections_uuid.eq(collections::uuid))),
                    )
                    .filter(collections::uuid.eq(uuid))
                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_collections::collection_uuid
                            .eq(uuid)
@@ -407,7 +406,6 @@ impl Collection {
                            .and(users_organizations::user_uuid.eq(user_uuid))),
                    )
                    .filter(collections::uuid.eq(uuid))
                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(users_collections::collection_uuid.eq(uuid).or(
                        // Directly accessed collection
                        users_organizations::access_all.eq(true).or(
@@ -432,8 +430,7 @@ impl Collection {
                    .inner_join(
                        users_organizations::table.on(collections::org_uuid
                            .eq(users_organizations::org_uuid)
-                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))),
                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
                    )
                    .left_join(
                        users_collections::table.on(users_collections::collection_uuid
@@ -479,8 +476,7 @@ impl Collection {
                    .inner_join(
                        users_organizations::table.on(collections::org_uuid
                            .eq(users_organizations::org_uuid)
-                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))),
                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
                    )
                    .left_join(
                        users_collections::table.on(users_collections::collection_uuid
@@ -531,7 +527,6 @@ impl Collection {
                        .and(collections_groups::collections_uuid.eq(collections::uuid))),
                )
                .filter(collections::uuid.eq(&self.uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
                    users_collections::collection_uuid
                        .eq(&self.uuid)
@@ -591,7 +586,6 @@ impl Collection {
                        .and(collections_groups::collections_uuid.eq(collections::uuid))),
                )
                .filter(collections::uuid.eq(&uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
                    users_collections::collection_uuid
                        .eq(&uuid)
@@ -656,7 +650,6 @@ impl Collection {
                        .and(collections_groups::collections_uuid.eq(collections::uuid))),
                )
                .filter(collections::org_uuid.eq(&org_uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
                    // Manage permission on a collection assigned directly or via a group.
                    users_collections::manage.eq(true).or(collections_groups::manage.eq(true)),
@@ -826,18 +819,10 @@ impl CollectionUser {
        .await
    }
    // Only returns the collections of organizations the user is a confirmed member of
    pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            users_collections::table
                .inner_join(collections::table.on(collections::uuid.eq(users_collections::collection_uuid)))
                .inner_join(
                    users_organizations::table.on(users_organizations::org_uuid
                        .eq(collections::org_uuid)
                        .and(users_organizations::user_uuid.eq(users_collections::user_uuid))),
                )
                .filter(users_collections::user_uuid.eq(user_uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .select(users_collections::all_columns)
                .load::<Self>(conn)
                .expect("Error loading users_collections")
@@ -104,6 +104,7 @@ impl Group {
            "id": self.uuid,
            "organizationId": self.organizations_uuid,
            "name": self.name,
            "accessAll": self.access_all,
            "externalId": self.external_id,
            "collections": collections_groups,
            "object": "groupDetails"
@@ -248,7 +249,6 @@ impl Group {
                        .and(groups::organizations_uuid.eq(users_organizations::org_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(groups::access_all.eq(true))
                .select(groups::organizations_uuid)
                .distinct()
@@ -387,7 +387,6 @@ impl CollectionGroup {
                        .and(collections::org_uuid.eq(groups::organizations_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .select(collections_groups::all_columns)
                .load::<Self>(conn)
                .expect("Error loading user collection groups")
@@ -573,6 +572,26 @@ impl GroupUser {
        }
    }
    pub async fn delete_by_group_and_member(
        group_uuid: &GroupId,
        member_uuid: &MembershipId,
        conn: &DbConn,
    ) -> EmptyResult {
        match Membership::find_by_uuid(member_uuid, conn).await {
            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
            None => warn!("Member could not be found!"),
        }
        conn.run(move |conn| {
            diesel::delete(groups_users::table)
                .filter(groups_users::groups_uuid.eq(group_uuid))
                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
                .execute(conn)
                .map_res("Error deleting group users")
        })
        .await
    }
    pub async fn delete_all_by_group(group_uuid: &GroupId, org_uuid: &OrganizationId, conn: &DbConn) -> EmptyResult {
        let group_users = GroupUser::find_by_group(group_uuid, org_uuid, conn).await;
        for group_user in group_users {
@@ -17,11 +17,12 @@ mod two_factor;
 mod two_factor_duo_context;
 mod two_factor_incomplete;
 mod user;
 mod user_signature_key_pair;
 pub use self::archive::Archive;
 pub use self::attachment::{Attachment, AttachmentId};
 pub use self::auth_request::{AuthRequest, AuthRequestId};
-pub use self::cipher::{Cipher, CipherId, RepromptType};
+pub use self::cipher::{Cipher, CipherId, RepromptType, is_data_blob_encrypted};
 pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
 pub use self::device::{Device, DeviceId, DeviceType, DeviceWithAuthRequest, PushId};
 pub use self::emergency_access::{EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType};
@@ -39,4 +40,5 @@ pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType, UserStampException};
+pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType};
 pub use self::user_signature_key_pair::{SignatureAlgorithm, UserSignatureKeyPair};
@@ -1,4 +1,3 @@
 use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, From};
 use diesel::prelude::*;
 use serde::Deserialize;
@@ -12,7 +11,6 @@ use crate::{
        schema::{org_policies, users_organizations},
    },
    error::MapResult,
    util::format_date,
 };
 use super::{Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, TwoFactor, UserId};
@@ -26,7 +24,6 @@ pub struct OrgPolicy {
    pub atype: i32,
    pub enabled: bool,
    pub data: String,
    pub revision_date: NaiveDateTime,
 }
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/PolicyType.cs
@@ -49,7 +46,7 @@ pub enum OrgPolicyType {
    RemoveUnlockWithPin = 14,
    RestrictedItemTypes = 15,
    UriMatchDefaults = 16,
-    AutotypeDefaultSetting = 17,
+    // AutotypeDefaultSetting = 17, // Not supported yet
    // AutoConfirm = 18, // Not supported (not implemented yet)
    // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
    OrganizationUserNotification = 20,
@@ -80,7 +77,6 @@ impl OrgPolicy {
            atype: atype as i32,
            enabled,
            data,
            revision_date: Utc::now().naive_utc(),
        }
    }
@@ -96,7 +92,7 @@ impl OrgPolicy {
            "type": self.atype,
            "data": data_json,
            "enabled": self.enabled,
-            "revisionDate": format_date(&self.revision_date),
+            "revisionDate": null,
            "object": "policy",
        });
@@ -114,13 +110,11 @@ impl OrgPolicy {
 /// Database methods
 impl OrgPolicy {
-    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
+    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        self.revision_date = Utc::now().naive_utc();
        db_run! { conn:
            sqlite, mysql {
                match diesel::replace_into(org_policies::table)
-                    .values(&*self)
+                    .values(self)
                    .execute(conn)
                {
                    Ok(_) => Ok(()),
@@ -128,7 +122,7 @@ impl OrgPolicy {
                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
                        diesel::update(org_policies::table)
                            .filter(org_policies::uuid.eq(&self.uuid))
-                            .set(&*self)
+                            .set(self)
                            .execute(conn)
                            .map_res("Error saving org_policy")
                    }
@@ -148,10 +142,10 @@ impl OrgPolicy {
                .map_res("Error deleting org_policy for insert")?;
                diesel::insert_into(org_policies::table)
-                    .values(&*self)
+                    .values(self)
                    .on_conflict(org_policies::uuid)
                    .do_update()
-                    .set(&*self)
+                    .set(self)
                    .execute(conn)
                    .map_res("Error saving org_policy")
            }
@@ -1,4 +1,7 @@
-use std::cmp::Ordering;
+use std::{
    cmp::Ordering,
    collections::{HashMap, HashSet},
 };
 use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, Deref, Display, From};
@@ -21,8 +24,8 @@ use crate::{
 use macros::UuidFromParam;
 use super::{
-    Cipher, CipherId, Collection, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, OrgPolicyType,
+    Cipher, CipherId, Collection, CollectionGroup, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy,
-    TwoFactor, User, UserId,
+    OrgPolicyType, TwoFactor, User, UserId,
 };
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -54,6 +57,10 @@ pub struct Membership {
    pub atype: i32,
    pub reset_password_key: Option<String>,
    pub external_id: Option<String>,
    /// A copy of the user's v2 upgrade token, kept when a v1 -> v2 upgrade leaves the account
    /// recovery key (`reset_password_key`) wrapped by the v1 user key. It lets the organization
    /// unwrap the v2 user key from it. Opaque to us, like `User::v2_upgrade_token`.
    pub v2_upgrade_token: Option<String>,
 }
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -271,6 +278,7 @@ impl Membership {
            atype: MembershipType::User as i32,
            reset_password_key: None,
            external_id: None,
            v2_upgrade_token: None,
        }
    }
@@ -342,7 +350,7 @@ impl OrganizationApiKey {
 impl Organization {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        if !crate::util::is_valid_email(&self.billing_email) {
-            err!(format!("BillingEmail {} is not a valid email address", self.billing_email.escape_debug()))
+            err!(format!("BillingEmail {} is not a valid email address", self.billing_email))
        }
        for member in &Membership::find_by_org(&self.uuid, conn).await {
@@ -515,7 +523,8 @@ impl Membership {
            "limitCollectionDeletion": true,
            "limitItemDeletion": false,
            "allowAdminAccessToAllCollectionItems": true,
-            "userIsClaimedByOrganization": false, // Means not managed via the Members UI, like SSO
+            "userIsManagedByOrganization": false, // Means not managed via the Members UI, like SSO
            "userIsClaimedByOrganization": false, // The new key instead of the obsolete userIsManagedByOrganization
            "permissions": permissions,
@@ -532,13 +541,7 @@ impl Membership {
        })
    }
-    // Used by admins to view other members, so nothing here may depend on this member's status
+    pub async fn to_json_user_details(&self, include_collections: bool, include_groups: bool, conn: &DbConn) -> Value {
    pub async fn to_json_details_for_admin(
        &self,
        include_collections: bool,
        include_groups: bool,
        conn: &DbConn,
    ) -> Value {
        let user = User::find_by_uuid(&self.user_uuid, conn).await.unwrap();
        // Because BitWarden want the status to be -1 for revoked users we need to catch that here.
@@ -561,23 +564,52 @@ impl Membership {
        // Check if a user is in a group which has access to all collections
        // If that is the case, we should not return individual collections!
        // This is used by admins to view other members, so it must not depend on the membership status
        let full_access_group =
-            CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(&self.org_uuid, &self.uuid, conn).await;
+            CONFIG.org_groups_enabled() && Group::is_in_full_access_group(&self.user_uuid, &self.org_uuid, conn).await;
        // If collections are to be included, only include them if the user does not have full access via a group or defined to the user it self
        // Only the collections assigned directly are returned, the ones assigned via a group are returned via a special group endpoint
        let collections: Vec<Value> = if include_collections && !(full_access_group || self.access_all) {
-            CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
+            // Get all collections for the user here already to prevent more queries
            let cu: HashMap<CollectionId, CollectionUser> =
                CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
                    .await
                    .into_iter()
                    .map(|cu| (cu.collection_uuid.clone(), cu))
                    .collect();
            // Get all collection groups for this user to prevent there inclusion
            let cg: HashSet<CollectionId> = CollectionGroup::find_by_user(&self.user_uuid, conn)
                .await
                .into_iter()
-                .map(|cu| {
+                .map(|cg| cg.collections_uuid)
-                    json!({
+                .collect();
-                        "id": cu.collection_uuid,
+
-                        "readOnly": cu.read_only,
+            Collection::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
-                        "hidePasswords": cu.hide_passwords,
+                .await
-                        "manage": cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords),
+                .into_iter()
-                    })
+                .filter_map(|c| {
                    let (read_only, hide_passwords, manage) = if self.has_full_access() {
                        (false, false, self.atype >= MembershipType::Manager)
                    } else if let Some(cu) = cu.get(&c.uuid) {
                        (
                            cu.read_only,
                            cu.hide_passwords,
                            cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords),
                        )
                    // If previous checks failed it might be that this user has access via a group, but we should not return those elements here
                    // Those are returned via a special group endpoint
                    } else if cg.contains(&c.uuid) {
                        return None;
                    } else {
                        (true, true, false)
                    };
                    Some(json!({
                        "id": c.uuid,
                        "readOnly": read_only,
                        "hidePasswords": hide_passwords,
                        "manage": manage,
                    }))
                })
                .collect()
        } else {
@@ -625,6 +657,7 @@ impl Membership {
            "status": status,
            "type": membership_type,
            "accessAll": self.access_all,
            "twoFactorEnabled": twofactor_enabled,
            "resetPasswordEnrolled": self.reset_password_key.is_some(),
            "hasMasterPassword": !user.password_hash.is_empty(),
@@ -632,6 +665,7 @@ impl Membership {
            "permissions": permissions,
            "ssoBound": false, // Not supported
            "managedByOrganization": false, // This key is obsolete replaced by claimedByOrganization
            "claimedByOrganization": false, // Means not managed via the Members UI, like SSO
            "usesKeyConnector": false, // Not supported
            "accessSecretsManager": false, // Not supported (Not AGPLv3 Licensed)
@@ -682,6 +716,7 @@ impl Membership {
            "status": status,
            "type": self.atype,
            "accessAll": self.access_all,
            "collections": coll_uuids,
            "object": "organizationUserDetails",
@@ -1002,6 +1037,17 @@ impl Membership {
        .await
    }
    pub async fn get_orgs_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<OrganizationId> {
        conn.run(move |conn| {
            users_organizations::table
                .filter(users_organizations::user_uuid.eq(user_uuid))
                .select(users_organizations::org_uuid)
                .load::<OrganizationId>(conn)
                .unwrap_or_default()
        })
        .await
    }
    pub async fn find_by_user_and_policy(user_uuid: &UserId, policy_type: OrgPolicyType, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            users_organizations::table
@@ -1024,7 +1070,6 @@ impl Membership {
        conn.run(move |conn| {
            users_organizations::table
                .filter(users_organizations::org_uuid.eq(org_uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .left_join(users_collections::table.on(users_collections::user_uuid.eq(users_organizations::user_uuid)))
                .left_join(
                    ciphers_collections::table.on(ciphers_collections::collection_uuid
@@ -1051,7 +1096,6 @@ impl Membership {
        conn.run(move |conn| {
            users_organizations::table
                .filter(users_organizations::org_uuid.eq(org_uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .inner_join(
                    groups_users::table.on(groups_users::users_organizations_uuid.eq(users_organizations::uuid)),
                )
@@ -1087,7 +1131,6 @@ impl Membership {
                        .and(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable()))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
                    users_organizations::atype.eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]),
                )
@@ -140,10 +140,6 @@ impl Send {
        None
    }
    fn access_id(&self) -> String {
        BASE64URL_NOPAD.encode(Uuid::parse_str(&self.uuid).unwrap_or_default().as_bytes())
    }
    pub fn to_json(&self) -> Value {
        let mut data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data).unwrap_or_default();
@@ -154,7 +150,7 @@ impl Send {
        json!({
            "id": self.uuid,
-            "accessId": self.access_id(),
+            "accessId": BASE64URL_NOPAD.encode(Uuid::parse_str(&self.uuid).unwrap_or_default().as_bytes()),
            "type": self.atype,
            "name": self.name,
@@ -186,7 +182,7 @@ impl Send {
        }
        json!({
-            "id": self.access_id(),
+            "id": self.uuid,
            "type": self.atype,
            "name": self.name,
@@ -260,7 +256,7 @@ impl Send {
    /// Whether the Send is currently within its validity window: not disabled, not past its
    /// expiration date, and not past its deletion date. Does not consider `max_access_count`
-    /// (counted on each access) or the password.
+    /// (consumed at token issuance) or the password.
    pub fn is_accessible(&self) -> bool {
        let now = Utc::now().naive_utc();
        if self.disabled {
@@ -313,6 +309,19 @@ impl Send {
        Ok(())
    }
    pub async fn find_by_access_id(access_id: &str, conn: &DbConn) -> Option<Self> {
        let Ok(uuid_vec) = BASE64URL_NOPAD.decode(access_id.as_bytes()) else {
            return None;
        };
        let uuid = match Uuid::from_slice(&uuid_vec) {
            Ok(u) => SendId::from(u.to_string()),
            Err(_) => return None,
        };
        Self::find_by_uuid(&uuid, conn).await
    }
    pub async fn find_by_uuid(uuid: &SendId, conn: &DbConn) -> Option<Self> {
        conn.run(move |conn| sends::table.filter(sends::uuid.eq(uuid)).first::<Self>(conn).ok()).await
    }
@@ -352,6 +361,13 @@ impl Send {
        Some(total)
    }
    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            sends::table.filter(sends::organization_uuid.eq(org_uuid)).load::<Self>(conn).expect("Error loading sends")
        })
        .await
    }
    pub async fn find_by_past_deletion_date(conn: &DbConn) -> Vec<Self> {
        let now = Utc::now().naive_utc();
        conn.run(move |conn| {
@@ -137,11 +137,11 @@ impl TwoFactor {
        .await
    }
-    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: TwoFactorType, conn: &DbConn) -> Option<Self> {
+    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: i32, conn: &DbConn) -> Option<Self> {
        conn.run(move |conn| {
            twofactor::table
                .filter(twofactor::user_uuid.eq(user_uuid))
-                .filter(twofactor::atype.eq(atype as i32))
+                .filter(twofactor::atype.eq(atype))
                .first::<Self>(conn)
                .ok()
        })
@@ -6,6 +6,7 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::EmptyResult,
    auth::DEFAULT_ACCESS_VALIDITY,
    crypto,
    db::{
        DbConn,
@@ -20,6 +21,7 @@ use macros::UuidFromParam;
 use super::{
    Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor, TwoFactorIncomplete,
    UserSignatureKeyPair,
 };
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
@@ -71,6 +73,15 @@ pub struct User {
    pub external_id: Option<String>, // Todo: Needs to be removed in the future, this is not used anymore.
    pub key_id: Option<KeyId>,
    // "v2" account cryptographic state. Either all of these are set (together with a row in
    // `user_signature_key_pairs`) or none of them are; see `User::is_v2`.
    pub signed_public_key: Option<String>,
    pub security_state: Option<String>,
    pub security_version: Option<i32>,
    /// JSON `{"wrappedUserKey1": ..., "wrappedUserKey2": ...}`, letting clients that still hold the
    /// v1 user key obtain the v2 one after another client performed the upgrade. Opaque to us.
    pub v2_upgrade_token: Option<String>,
 }
 #[derive(Identifiable, Queryable, Insertable)]
@@ -99,13 +110,28 @@ enum UserStatus {
    _Disabled = 2,
 }
 /// A previous security stamp that is still accepted, until `expire`.
 #[derive(Serialize, Deserialize)]
 pub struct UserStampException {
-    pub routes: Vec<String>,
+    /// The routes the stamp is still accepted on, or `None` for any route.
    pub routes: Option<Vec<String>>,
    pub security_stamp: String,
    pub expire: i64,
 }
 impl UserStampException {
    pub fn is_expired(&self) -> bool {
        Utc::now().timestamp() > self.expire
    }
    /// Whether this exception lets a token carrying `security_stamp` through on `route`.
    pub fn allows(&self, security_stamp: &str, route: &str) -> bool {
        !self.is_expired()
            && self.security_stamp == security_stamp
            && self.routes.as_ref().is_none_or(|routes| routes.iter().any(|r| r == route))
    }
 }
 /// Local methods
 impl User {
    pub const CLIENT_KDF_TYPE_DEFAULT: i32 = UserKdfType::Pbkdf2 as i32;
@@ -158,9 +184,18 @@ impl User {
            external_id: None, // Todo: Needs to be removed in the future, this is not used anymore.
            key_id: None,
            signed_public_key: None,
            security_state: None,
            security_version: None,
            v2_upgrade_token: None,
        }
    }
    pub fn is_v2(&self) -> bool {
        self.signed_public_key.is_some() && self.security_state.is_some() && self.security_version.is_some()
    }
    pub fn check_valid_password(&self, password: &str) -> bool {
        crypto::verify_password_hash(
            password.as_bytes(),
@@ -170,10 +205,6 @@ impl User {
        )
    }
    pub fn master_password_salt(&self) -> String {
        self.email.trim().to_lowercase()
    }
    pub fn check_valid_recovery_code(&self, recovery_code: &str) -> bool {
        if let Some(ref totp_recover) = self.totp_recover {
            crypto::ct_eq(recovery_code, totp_recover.to_lowercase())
@@ -224,10 +255,41 @@ impl User {
    pub async fn reset_security_stamp(&mut self, conn: &DbConn) -> EmptyResult {
        self.security_stamp = get_uuid();
        // A reset is meant to end the other sessions, which a key rotation's grace would undo. The
        // route exceptions stay, since they are set right before a reset, for the stamp it replaces.
        // This is also where expired exceptions get dropped.
        let mut exceptions = self.stamp_exceptions();
        exceptions.retain(|e| e.routes.is_some() && !e.is_expired());
        self.set_stamp_exceptions(&exceptions);
        Device::rotate_refresh_tokens_by_user(&self.uuid, conn).await?;
        Ok(())
    }
    /// Resets the security stamp after a key rotation, while letting the access tokens already
    /// issued keep working until they expire.
    ///
    /// This is what upstream does: there the stamp is only checked when a token is refreshed, so a
    /// rotation invalidates refresh tokens but not the access tokens in use. Clients rely on it to
    /// keep a session going across a rotation. Chained rotations keep every earlier stamp that is
    /// still within its window.
    pub async fn reset_security_stamp_after_key_rotation(&mut self, conn: &DbConn) -> EmptyResult {
        let previous_stamp = self.security_stamp.clone();
        let mut grace: Vec<UserStampException> =
            self.stamp_exceptions().into_iter().filter(|e| e.routes.is_none() && !e.is_expired()).collect();
        self.reset_security_stamp(conn).await?;
        grace.push(UserStampException {
            routes: None,
            security_stamp: previous_stamp,
            expire: (Utc::now() + *DEFAULT_ACCESS_VALIDITY).timestamp(),
        });
        let mut exceptions = self.stamp_exceptions();
        exceptions.extend(grace);
        self.set_stamp_exceptions(&exceptions);
        Ok(())
    }
    /// Set the stamp_exception to only allow a subsequent request matching a specific route using the current security-stamp.
    ///
    /// # Arguments
@@ -236,17 +298,30 @@ impl User {
    ///   After these 2 minutes this stamp will expire.
    ///
    pub fn set_stamp_exception(&mut self, route_exception: Vec<String>) {
-        let stamp_exception = UserStampException {
+        self.set_stamp_exceptions(&[UserStampException {
-            routes: route_exception,
+            routes: Some(route_exception),
            security_stamp: self.security_stamp.clone(),
            expire: (Utc::now() + TimeDelta::try_minutes(2).unwrap()).timestamp(),
-        };
+        }]);
        self.stamp_exception = Some(serde_json::to_string(&stamp_exception).unwrap_or_default());
    }
-    /// Resets the stamp_exception to prevent re-use of the previous security-stamp
+    /// The previous security stamps that are still accepted, expired ones included.
-    pub fn reset_stamp_exception(&mut self) {
+    pub fn stamp_exceptions(&self) -> Vec<UserStampException> {
-        self.stamp_exception = None;
+        let Some(stored) = self.stamp_exception.as_deref() else {
            return Vec::new();
        };
        // Before key rotations kept sessions alive, only a single route exception was stored.
        serde_json::from_str::<Vec<UserStampException>>(stored)
            .or_else(|_| serde_json::from_str::<UserStampException>(stored).map(|e| vec![e]))
            .unwrap_or_default()
    }
    fn set_stamp_exceptions(&mut self, exceptions: &[UserStampException]) {
        self.stamp_exception = if exceptions.is_empty() {
            None
        } else {
            Some(serde_json::to_string(&exceptions).unwrap_or_default())
        };
    }
    pub fn display_name(&self) -> &str {
@@ -261,27 +336,59 @@ impl User {
 /// Database methods
 impl User {
-    pub fn verified(&self) -> bool {
+    async fn v2_signature_key_pair(&self, conn: &DbConn) -> Option<UserSignatureKeyPair> {
-        !CONFIG.mail_enabled() || self.verified_at.is_some()
+        if !self.is_v2() {
            return None;
        }
        UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
    }
-    /// The `accountKeys` object (upstream's `PrivateKeysResponseModel`), null without a key pair
+    pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
-    pub fn account_keys_json(&self) -> Value {
+        if self.private_key.is_none() {
-        if self.private_key.is_some() {
+            return Value::Null;
            json!({
                "publicKeyEncryptionKeyPair": {
                    "wrappedPrivateKey": self.private_key,
                    "publicKey": self.public_key,
                    "signedPublicKey": null,
                    "object": "publicKeyEncryptionKeyPair",
                },
                "securityState": null,
                "signatureKeyPair": null,
                "object": "privateKeys"
            })
        } else {
            Value::Null
        }
        let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
            Some(key_pair) => (
                json!(self.signed_public_key),
                key_pair.to_json(),
                json!({
                    "securityState": self.security_state,
                    "securityVersion": self.security_version,
                }),
            ),
            None => (Value::Null, Value::Null, Value::Null),
        };
        json!({
            "publicKeyEncryptionKeyPair": {
                "wrappedPrivateKey": self.private_key,
                "publicKey": self.public_key,
                "signedPublicKey": signed_public_key,
                "object": "publicKeyEncryptionKeyPair",
            },
            "signatureKeyPair": signature_key_pair,
            "securityState": security_state,
            "object": "privateKeys"
        })
    }
    pub async fn public_keys_json(&self, conn: &DbConn) -> Value {
        let (signed_public_key, verifying_key) = match self.v2_signature_key_pair(conn).await {
            Some(key_pair) => (json!(self.signed_public_key), json!(key_pair.verifying_key)),
            None => (Value::Null, Value::Null),
        };
        json!({
            "publicKey": self.public_key,
            "signedPublicKey": signed_public_key,
            "verifyingKey": verifying_key,
            "object": "publicKeys"
        })
    }
    pub fn v2_upgrade_token_json(&self) -> Option<Value> {
        self.v2_upgrade_token.as_ref().and_then(|token| serde_json::from_str(token).ok())
    }
    pub async fn to_json(&self, conn: &DbConn) -> Value {
@@ -304,7 +411,7 @@ impl User {
            UserStatus::Enabled
        };
-        let account_keys = self.account_keys_json();
+        let account_keys = self.account_keys_json(conn).await;
        json!({
            "_status": status as i32,
@@ -312,7 +419,7 @@ impl User {
            "id": self.uuid,
            "name": self.name,
            "email": self.email,
-            "emailVerified": self.verified(),
+            "emailVerified": !CONFIG.mail_enabled() || self.verified_at.is_some(),
            "premium": true,
            "premiumFromOrganization": false,
            "culture": "en-US",
@@ -334,7 +441,7 @@ impl User {
    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
        if !crate::util::is_valid_email(&self.email) {
-            err!(format!("User email {} is not a valid email address", self.email.escape_debug()))
+            err!(format!("User email {} is not a valid email address", self.email))
        }
        self.updated_at = Utc::now().naive_utc();
@@ -380,6 +487,7 @@ impl User {
        Device::delete_all_by_user(&self.uuid, conn).await?;
        TwoFactor::delete_all_by_user(&self.uuid, conn).await?;
        TwoFactorIncomplete::delete_all_by_user(&self.uuid, conn).await?;
        UserSignatureKeyPair::delete_all_by_user(&self.uuid, conn).await?;
        Invitation::take(&self.email, conn).await; // Delete invitation if any
        conn.run(move |conn| {
@@ -482,7 +590,7 @@ impl Invitation {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        if !crate::util::is_valid_email(&self.email) {
-            err!(format!("Invitation email {} is not a valid email address", self.email.escape_debug()))
+            err!(format!("Invitation email {} is not a valid email address", self.email))
        }
        db_run! { conn:
@@ -568,7 +676,18 @@ pub struct UserId(String);
 )]
 #[deref(forward)]
 #[from(forward)]
-pub struct KeyId(String);
+pub struct KeyId(#[serde(deserialize_with = "deserialize_key_id")] String);
 /// Rejects a key id from a request that isn't 16 bytes as lowercase hex, as upstream's `[KeyId]` does.
 ///
 /// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/KeyId.cs>
 fn deserialize_key_id<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
    let key_id = <String as serde::Deserialize>::deserialize(deserializer)?;
    if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
        return Err(serde::de::Error::custom("Key id must be a 32 character lowercase hex-encoded string."));
    }
    Ok(key_id)
 }
 impl SsoUser {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
@@ -0,0 +1,137 @@
 use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, Deref, Display, From};
 use diesel::prelude::*;
 use serde_json::Value;
 use crate::{
    api::EmptyResult,
    db::{DbConn, schema::user_signature_key_pairs},
    error::MapResult,
    util::get_uuid,
 };
 use super::UserId;
 /// A user's signature key pair, part of the "v2" account cryptographic state.
 ///
 /// Upstream keeps this in its own table rather than as columns on the user, with a unique index on
 /// the user id. The stated intent is to eventually keep superseded key pairs around (an `active`
 /// flag was sketched but not shipped), which is why this is modelled as a row with its own identity
 /// instead of a set of user attributes.
 ///
 /// Ref: <https://github.com/bitwarden/server/blob/main/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql>
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
 #[diesel(table_name = user_signature_key_pairs)]
 #[diesel(treat_none_as_null = true)]
 #[diesel(primary_key(uuid))]
 pub struct UserSignatureKeyPair {
    pub uuid: UserSignatureKeyPairId,
    pub user_uuid: UserId,
    pub signature_algorithm: i32,
    /// The signing (private) key, wrapped by the user key.
    pub signing_key: String,
    /// The COSE-encoded public verifying key.
    pub verifying_key: String,
    pub created_at: NaiveDateTime,
    pub updated_at: NaiveDateTime,
 }
 /// https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum SignatureAlgorithm {
    Ed25519 = 0,
    MlDsa44 = 1,
 }
 impl SignatureAlgorithm {
    pub fn parse(algorithm: &str) -> Option<Self> {
        match algorithm {
            "ed25519" => Some(Self::Ed25519),
            "mldsa44" => Some(Self::MlDsa44),
            _ => None,
        }
    }
 }
 /// Local methods
 impl UserSignatureKeyPair {
    pub fn new(
        user_uuid: UserId,
        signature_algorithm: SignatureAlgorithm,
        signing_key: String,
        verifying_key: String,
    ) -> Self {
        let now = Utc::now().naive_utc();
        Self {
            uuid: UserSignatureKeyPairId(get_uuid()),
            user_uuid,
            signature_algorithm: signature_algorithm as i32,
            signing_key,
            verifying_key,
            created_at: now,
            updated_at: now,
        }
    }
    pub fn to_json(&self) -> Value {
        json!({
            "wrappedSigningKey": self.signing_key,
            "verifyingKey": self.verifying_key,
            "object": "signatureKeyPair",
        })
    }
 }
 /// Database methods
 impl UserSignatureKeyPair {
    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
        self.updated_at = Utc::now().naive_utc();
        db_run! { conn:
            mysql {
                diesel::insert_into(user_signature_key_pairs::table)
                    .values(&*self)
                    .on_conflict(diesel::dsl::DuplicatedKeys)
                    .do_update()
                    .set(&*self)
                    .execute(conn)
                    .map_res("Error saving user signature key pair")
            }
            postgresql, sqlite {
                diesel::insert_into(user_signature_key_pairs::table)
                    .values(&*self)
                    .on_conflict(user_signature_key_pairs::user_uuid)
                    .do_update()
                    .set(&*self)
                    .execute(conn)
                    .map_res("Error saving user signature key pair")
            }
        }
    }
    /// The user's key pair. There is at most one, enforced by a unique index on `user_uuid`.
    pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<Self> {
        conn.run(move |conn| {
            user_signature_key_pairs::table
                .filter(user_signature_key_pairs::user_uuid.eq(user_uuid))
                .first::<Self>(conn)
                .ok()
        })
        .await
    }
    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
        conn.run(move |conn| {
            diesel::delete(user_signature_key_pairs::table.filter(user_signature_key_pairs::user_uuid.eq(user_uuid)))
                .execute(conn)
                .map_res("Error deleting user signature key pairs")
        })
        .await
    }
 }
 #[derive(Clone, Debug, AsRef, Deref, DieselNewType, Display, From, Hash, PartialEq, Eq, Serialize, Deserialize)]
 pub struct UserSignatureKeyPairId(String);
@@ -116,7 +116,6 @@ table! {
        atype -> Integer,
        enabled -> Bool,
        data -> Text,
        revision_date -> Timestamp,
    }
 }
@@ -219,6 +218,22 @@ table! {
        avatar_color -> Nullable<Text>,
        external_id -> Nullable<Text>,
        key_id -> Nullable<Text>,
        signed_public_key -> Nullable<Text>,
        security_state -> Nullable<Text>,
        security_version -> Nullable<Integer>,
        v2_upgrade_token -> Nullable<Text>,
    }
 }
 table! {
    user_signature_key_pairs (uuid) {
        uuid -> Text,
        user_uuid -> Text,
        signature_algorithm -> Integer,
        signing_key -> Text,
        verifying_key -> Text,
        created_at -> Timestamp,
        updated_at -> Timestamp,
    }
 }
@@ -244,6 +259,7 @@ table! {
        atype -> Integer,
        reset_password_key -> Nullable<Text>,
        external_id -> Nullable<Text>,
        v2_upgrade_token -> Nullable<Text>,
    }
 }
@@ -384,6 +400,7 @@ joinable!(collections_groups -> groups (groups_uuid));
 joinable!(event -> users_organizations (uuid));
 joinable!(auth_requests -> users (user_uuid));
 joinable!(sso_users -> users (user_uuid));
 joinable!(user_signature_key_pairs -> users (user_uuid));
 allow_tables_to_appear_in_same_query!(
    archives,
@@ -410,4 +427,5 @@ allow_tables_to_appear_in_same_query!(
    collections_groups,
    event,
    auth_requests,
    user_signature_key_pairs,
 );
@@ -466,7 +466,7 @@ mod tests {
    #[test]
    fn dotted_decimal_loopback_normalizes() {
        let ip = parse_to_ip("127.0.0.1").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
        assert!(!is_global_hardcoded(ip));
    }
@@ -474,21 +474,21 @@ mod tests {
    fn single_decimal_loopback_normalizes() {
        // 127.0.0.1 == 2130706433
        let ip = parse_to_ip("2130706433").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
        assert!(!is_global_hardcoded(ip));
    }
    #[test]
    fn hex_loopback_normalizes() {
        let ip = parse_to_ip("0x7f000001").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
        assert!(!is_global_hardcoded(ip));
    }
    #[test]
    fn dotted_hex_loopback_normalizes() {
        let ip = parse_to_ip("0x7f.0.0.1").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
        assert!(!is_global_hardcoded(ip));
    }
@@ -496,14 +496,14 @@ mod tests {
    fn octal_loopback_normalizes() {
        // 017700000001 == 127.0.0.1
        let ip = parse_to_ip("017700000001").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
        assert!(!is_global_hardcoded(ip));
    }
    #[test]
    fn dotted_octal_loopback_normalizes() {
        let ip = parse_to_ip("0177.0.0.01").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
        assert!(!is_global_hardcoded(ip));
    }
@@ -535,19 +535,19 @@ mod tests {
    #[test]
    fn get_valid_host_normalizes_decimal_int() {
        let h = get_valid_host("2130706433").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
    }
    #[test]
    fn get_valid_host_normalizes_hex() {
        let h = get_valid_host("0x7f000001").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
    }
    #[test]
    fn get_valid_host_normalizes_octal() {
        let h = get_valid_host("017700000001").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
    }
    // ===
@@ -531,21 +531,6 @@ pub async fn send_new_device_logged_in(address: &str, ip: &str, dt: &NaiveDateTi
    send_email(address, &subject, body_html, body_text).await
 }
 pub async fn send_recover_twofactor(address: &str, ip: &str, dt: &NaiveDateTime) -> EmptyResult {
    let fmt = "%A, %B %_d, %Y at %r %Z";
    let (subject, body_html, body_text) = get_text(
        "email/recover_twofactor",
        json!({
            "url": CONFIG.domain(),
            "img_src": CONFIG._smtp_img_src(),
            "ip": ip,
            "datetime": crate::util::format_naive_datetime_local(dt, fmt),
        }),
    )?;
    send_email(address, &subject, body_html, body_text).await
 }
 pub async fn send_incomplete_2fa_login(
    address: &str,
    ip: &str,
@@ -720,7 +720,7 @@ fn schedule_jobs(pool: db::DbPool) {
            }
            // Clean unused, expired Duo authentication contexts.
-            if !CONFIG.duo_context_purge_schedule().is_empty() && CONFIG._enable_duo() {
+            if !CONFIG.duo_context_purge_schedule().is_empty() && CONFIG._enable_duo() && !CONFIG.duo_use_iframe() {
                sched.add(Job::new(CONFIG.duo_context_purge_schedule().parse().unwrap(), || {
                    runtime.spawn(purge_duo_contexts(pool.clone()));
                }));
@@ -2,6 +2,7 @@ use std::{sync::LazyLock, time::Duration};
 use chrono::Utc;
 use derive_more::{AsRef, Deref, Display, From, Into};
 use regex::Regex;
 use url::Url;
 use crate::{
@@ -174,16 +175,16 @@ pub fn decode_state(base64_state: &str) -> ApiResult<OIDCState> {
        if let Ok(valid) = String::from_utf8(vec) {
            OIDCState(valid)
        } else {
-            err!(format!("Invalid utf8 chars in {} after base64 decoding", base64_state.escape_debug()))
+            err!(format!("Invalid utf8 chars in {base64_state} after base64 decoding"))
        }
    } else {
-        err!(format!("Failed to decode {} using base64", base64_state.escape_debug()))
+        err!(format!("Failed to decode {base64_state} using base64"))
    };
    Ok(state)
 }
-// redirect_uri from: https://github.com/bitwarden/server/blob/main/src/Identity/IdentityServer/StaticClientStore.cs
+// redirect_uri from: https://github.com/bitwarden/server/blob/main/src/Identity/IdentityServer/ApiClient.cs
 pub async fn authorize_url(
    state: OIDCState,
    client_challenge: OIDCCodeChallenge,
@@ -192,21 +193,20 @@ pub async fn authorize_url(
    binding_hash: Option<String>,
    conn: DbConn,
 ) -> ApiResult<Url> {
    // The desktop app uses the localhost callback when it can't register the custom scheme (AppImage, dev builds)
    let localhost_redirect_uri =
        (8065..=8070).map(|port| format!("http://localhost:{port}")).find(|uri| uri == raw_redirect_uri);
    let redirect_uri = match client_id {
        "web" | "browser" => format!("{}/sso-connector.html", CONFIG.domain()),
-        "desktop" => localhost_redirect_uri.unwrap_or_else(|| "bitwarden://sso-callback".to_owned()),
+        "desktop" | "mobile" => "bitwarden://sso-callback".to_owned(),
        "mobile" => "bitwarden://sso-callback".to_owned(),
        "cli" => {
-            let Some(uri) = localhost_redirect_uri else {
+            let port_regex = Regex::new(r"^http://localhost:([0-9]{4})$").unwrap();
-                err!(format!("Unsupported redirect uri {}", raw_redirect_uri.escape_debug()))
+            if let Some(port) =
-            };
+                port_regex.captures(raw_redirect_uri).and_then(|captures| captures.get(1).map(|c| c.as_str()))
-            uri
+            {
                format!("http://localhost:{port}")
            } else {
                err!("Failed to extract port number")
            }
        }
-        _ => err!(format!("Unsupported client {}", client_id.escape_debug())),
+        _ => err!(format!("Unsupported client {client_id}")),
    };
    let (auth_url, sso_auth) = Client::authorize_url(state, client_challenge, redirect_uri, binding_hash).await?;
@@ -242,8 +242,7 @@ impl OIDCIdentifier {
 // During the 2FA flow we will
 //  - retrieve the user information and then only discover he needs 2FA.
-//  - second time we will rely on `SsoAuth.auth_response` since the `code` has already been exchanged,
+//  - second time we will rely on `SsoAuth.auth_response` since the `code` has already been exchanged.
 //    after checking the PKCE verifier again like upstream does on every redemption.
 // The `SsoAuth` will ensure that the user is authorized only once.
 pub async fn exchange_code(
    code: &OIDCCode,
@@ -257,7 +256,6 @@ pub async fn exchange_code(
    };
    if let Some(authenticated_user) = sso_auth.auth_response.clone() {
        Client::check_client_verifier(&client_verifier, &sso_auth)?;
        return Ok((sso_auth, authenticated_user));
    }
@@ -212,16 +212,6 @@ impl Client {
        Ok((auth_url, SsoAuth::new(state, client_challenge, nonce.secret().clone(), redirect_uri, binding_hash)))
    }
    // Check the client's PKCE verifier against the challenge it sent when starting the flow
    pub fn check_client_verifier(client_verifier: &OIDCCodeVerifier, sso_auth: &SsoAuth) -> EmptyResult {
        let verifier = PkceCodeVerifier::new(client_verifier.to_string());
        let challenge = PkceCodeChallenge::from_code_verifier_sha256(&verifier);
        if challenge.as_str() != &*sso_auth.client_challenge {
            err!("PKCE client challenge failed")
        }
        Ok(())
    }
    pub async fn exchange_code(
        &self,
        code: OIDCCode,
@@ -244,10 +234,15 @@ impl Client {
        let mut exchange = self.core_client.exchange_code(oidc_code);
        let verifier = PkceCodeVerifier::new(client_verifier.into());
        if CONFIG.sso_pkce() {
-            exchange = exchange.set_pkce_verifier(PkceCodeVerifier::new(client_verifier.into()));
+            exchange = exchange.set_pkce_verifier(verifier);
        } else {
-            Self::check_client_verifier(&client_verifier, sso_auth)?;
+            let challenge = PkceCodeChallenge::from_code_verifier_sha256(&verifier);
            if challenge.as_str() != String::from(sso_auth.client_challenge.clone()) {
                err!("PKCE client challenge failed")
                // Might need to notify admin ? how ?
            }
        }
        match exchange.request_async(&self.http_client).await {
@@ -4,10 +4,10 @@
 *
 * To rebuild or modify this file with the latest versions of the included
 * software please visit:
- *   https://datatables.net/download/#bs5/dt-3.1.3
+ *   https://datatables.net/download/#bs5/dt-3.0.4
 *
 * Included libraries:
- *   DataTables 3.1.3
+ *   DataTables 3.0.4
 */
 /*! DataTables Bootstrap 5 integration
@@ -1,9 +0,0 @@
 Two-Step Login Recovered From {{ip}}
 <!---------------->
 Two-step login on your account has been disabled by using the account's recovery code.
 * Date: {{datetime}}
 * IP Address: {{ip}}
 If you did not perform this action, you should immediately take steps to secure your account.
 {{> email/email_footer_text }}
@@ -1,26 +0,0 @@
 Two-Step Login Recovered From {{ip}}
 <!---------------->
 {{> email/email_header }}
 <table width="100%" cellpadding="0" cellspacing="0" style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
   <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
      <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
         Two-step login on your account has been disabled by using the account's recovery code.
      </td>
   </tr>
   <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
      <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
         <b>Date:</b> {{datetime}}
      </td>
   </tr>
   <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
      <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none;" valign="top">
         <b>IP Address:</b> {{ip}}
      </td>
   </tr>
   <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
      <td class="content-block last" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0; -webkit-text-size-adjust: none;" valign="top">
         If you did not perform this action, you should immediately take steps to secure your account.
      </td>
   </tr>
 </table>
 {{> email/email_footer }}
@@ -9,7 +9,7 @@ Emergency access for {{{grantor_name}}}
    </tr>
    <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
       <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none; text-align: center;" valign="top" align="center">
-          <a data-testid="emergency" href="{{{url}}}"
+          <a href="{{{url}}}"
             clicktracking=off target="_blank" style="color: #ffffff; text-decoration: none; text-align: center; cursor: pointer; display: inline-block; border-radius: 5px; background-color: #3c8dbc; border-color: #3c8dbc; border-style: solid; border-width: 10px 20px; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
          Become emergency contact
          </a>
@@ -42,27 +42,45 @@ a[href$="/settings/sponsored-families"] {
 {{/if}}
 /* Hide the `Enterprise Single Sign-On` button on the login page */
 {{#if (webver ">=2025.5.1")}}
 {{#if (not sso_enabled)}}
 .vw-sso-login {
  @extend %vw-hide;
 }
 {{/if}}
 {{else}}
 app-root ng-component > form > div:nth-child(1) > div > button[buttontype="secondary"].\!tw-text-primary-600:nth-child(4) {
  @extend %vw-hide;
 }
 {{/if}}
 /* Hide the `Log in with passkey` settings */
 app-user-layout app-password-settings app-webauthn-login-settings {
  @extend %vw-hide;
 }
 /* Hide Log in with passkey on the login page */
 {{#if (webver ">=2025.5.1")}}
 .vw-passkey-login {
  @extend %vw-hide;
 }
 {{else}}
 app-root ng-component > form > div:nth-child(1) > div > button[buttontype="secondary"].\!tw-text-primary-600:nth-child(3) {
  @extend %vw-hide;
 }
 {{/if}}
 /* Hide the or text followed by the two buttons hidden above */
 {{#if (webver ">=2025.5.1")}}
 {{#if (or (not sso_enabled) sso_only)}}
 .vw-or-text {
  @extend %vw-hide;
 }
 {{/if}}
 {{else}}
 app-root ng-component > form > div:nth-child(1) > div:nth-child(3) > div:nth-child(2) {
  @extend %vw-hide;
 }
 {{/if}}
 /* Hide the `Other` button on the login page */
 {{#if (or (not sso_enabled) sso_only)}}
@@ -136,10 +154,17 @@ ng-dropdown-panel div.ng-dropdown-panel-items div:has(> [title="DuckDuckGo"]) {
  take a while for the change to take effect. To avoid the button appearing
  when it shouldn't, we'll keep this style in place for a couple of versions */
 /* Hide the register link on the login screen */
 {{#if (webver "<2025.3.0")}}
 app-login form div + div + div + div + hr,
 app-login form div + div + div + div + hr + p {
  @extend %vw-hide;
 }
 {{else}}
 app-root a[routerlink="/signup"] {
  @extend %vw-hide;
 }
 {{/if}}
 {{/if}}
 {{#if remember_2fa_disabled}}
 /* Hide checkbox to remember 2FA token for 30 days */
@@ -195,13 +220,6 @@ auth-input-password > form > bit-form-field:nth-child(4) {
  @extend %vw-hide;
 }
 {{/unless}}
 {{#unless email_change_allowed}}
 /* Hide the whole `Change email` section, including its heading, if not allowed */
 div:has(> app-change-email) {
  @extend %vw-hide;
 }
 {{/unless}}
 /**** End Dynamic Vaultwarden Changes ****/
 /**** Include a special user stylesheet for custom changes ****/
 {{#if load_user_scss}}
@@ -380,7 +380,7 @@ pub fn get_display_size(size: i64) -> String {
    let mut unit_counter = 0;
    loop {
-        if size > 1024. && unit_counter < UNITS.len() - 1 {
+        if size > 1024. {
            size /= 1024.;
            unit_counter += 1;
        } else {
@@ -522,8 +522,8 @@ pub fn format_datetime_http(dt: &DateTime<Local>) -> String {
    expiry_time.to_rfc2822().replace("+0000", "GMT")
 }
-pub fn parse_date(date: &str) -> Option<NaiveDateTime> {
+pub fn parse_date(date: &str) -> NaiveDateTime {
-    DateTime::parse_from_rfc3339(date).ok().map(|dt| dt.naive_utc())
+    DateTime::parse_from_rfc3339(date).unwrap().naive_utc()
 }
 /// Returns true or false if an email address is valid or not
@@ -943,15 +943,15 @@ mod tests {
    use std::net::IpAddr;
    #[test]
-    #[ignore = "exhaustive IPv4 check is too slow for the regular test suite"]
+    #[ignore]
    fn test_ipv4_global() {
        for a in 0..u8::MAX {
-            println!("Iter: {a}/255");
+            println!("Iter: {}/255", a);
            for b in 0..u8::MAX {
                for c in 0..u8::MAX {
                    for d in 0..u8::MAX {
                        let ip = IpAddr::V4(std::net::Ipv4Addr::new(a, b, c, d));
-                        assert_eq!(ip.is_global(), is_global_hardcoded(ip), "IP mismatch: {ip}");
+                        assert_eq!(ip.is_global(), is_global_hardcoded(ip), "IP mismatch: {}", ip)
                    }
                }
            }
@@ -959,15 +959,15 @@ mod tests {
    }
    #[test]
-    #[ignore = "random IPv6 check is too slow for the regular test suite"]
+    #[ignore]
    fn test_ipv6_global() {
-        use rand::RngExt;
+        use rand::Rng;
        std::thread::scope(|s| {
            for t in 0..16 {
-                let _handle = s.spawn(move || {
+                let handle = s.spawn(move || {
                    let mut v = [0u8; 16];
-                    let mut rng = rand::rng();
+                    let mut rng = rand::thread_rng();
                    for i in 0..20 {
                        println!("Thread {t} Iter: {i}/50");
Author	SHA1	Message	Date
Daniel García	d01db37e75	Some simplifications	2026-09-23 23:53:12 +02:00
Daniel García	fe212a425f	Add typo exception	2026-09-23 23:30:19 +02:00
Daniel García	72a39ae90b	Implement V2 key rotation support	2026-09-23 23:30:19 +02:00
Daniel García	fd7e1be788	Implement V2 registration support Signed-off-by: BlackDex <black.dex@gmail.com>	2026-09-23 23:30:18 +02:00
		`@@ -1 +0,0 @@`
			`ALTER TABLE org_policies DROP COLUMN revision_date;`