Implement V2 key rotation support

* Add revision_date to org policies

Org policy JSON responses never included a revisionDate field, unlike
every other synced entity. The official Bitwarden server always sets
it, and current official clients (recently migrated to the WASM SDK's
typed PolicyView) now assume it is always a valid date string. Its
absence deserializes to undefined client-side, which then throws
(RangeError: Invalid time value) when the client formats it, breaking
the whole policy sync pipeline and silently emptying the vault view in
the browser and desktop apps.

Adds a revision_date column (mirroring the existing pattern used by
Send), stamped on creation and bumped on every save.

* Fix migration correctness for org policy revision_date

Caught by review: SQLite rejects non-constant defaults in ALTER TABLE
ADD COLUMN, so the sqlite migration would fail outright on every
existing installation (vaultwarden's default backend) rather than the
postgresql setup this was developed against.

- sqlite/mysql: add the column with a constant placeholder default,
  then backfill via UPDATE, since neither allows a volatile default
  in ALTER TABLE ADD COLUMN (mysql does allow it, but a constant
  keeps the three backends' migrations symmetric).
- mysql: use DATETIME instead of TIMESTAMP, matching this repo's
  existing revision_date columns, and backfill with UTC_TIMESTAMP()
  instead of a session-timezone-dependent CURRENT_TIMESTAMP.
- postgresql: backfill with `now() AT TIME ZONE 'utc'` instead of a
  DEFAULT now(), since assigning timestamptz now() into this naive
  TIMESTAMP column would otherwise cast through the server's TimeZone
  GUC and store local wall-clock instead of UTC on non-UTC servers.
- mysql/postgresql: add a real down.sql (DROP COLUMN) instead of
  leaving it empty.

* Move org policy revision_date migration after the latest one

---------

Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>

.env.template

@@ -394,11 +394,15 @@
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
 ## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
+## - "windows-desktop-autotype": Enable the autotype feature preview on Windows. (Desktop >= 2025.8.0)
+## - "windows-desktop-autotype-ga": Enable the new, still in development, autotype implementation on Windows. (Desktop >= 2026.9.1)
+##   Only enable one of the two autotype flags, the clients disable autotype completely when both are enabled.
 ## - "pm-30529-webauthn-related-origins":
 ## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
 ## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
 ## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
 ## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
+## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 
 ## Require new device emails. When a user logs in an email is required to be sent.

docker/DockerSettings.yaml

@@ -1,6 +1,6 @@
 ---
-vault_version: "v2026.7.0"
-vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c"
+vault_version: "v2026.8.0"
+vault_image_digest: "sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a"
 # Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags

docker/Dockerfile.alpine

@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
-#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
+#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
-#     [docker.io/vaultwarden/web-vault:v2026.7.0]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
+#     [docker.io/vaultwarden/web-vault:v2026.8.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
 
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64

docker/Dockerfile.debian

@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.7.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.7.0
-#     [docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
+#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c
-#     [docker.io/vaultwarden/web-vault:v2026.7.0]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
+#     [docker.io/vaultwarden/web-vault:v2026.8.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
 
 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts

migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/down.sql

@@ -0,0 +1 @@
+ALTER TABLE org_policies DROP COLUMN revision_date;

migrations/mysql/2026-10-07-120000_add_org_policy_revision_date/up.sql

@@ -0,0 +1,7 @@
+-- DATETIME (not TIMESTAMP) to match this repo's convention for revision_date
+-- columns elsewhere, and to avoid MySQL's implicit session-timezone
+-- conversion and 2038 range limit on TIMESTAMP.
+ALTER TABLE org_policies
+ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
+
+UPDATE org_policies SET revision_date = UTC_TIMESTAMP();

migrations/mysql/2026-10-10-120000_add_v2_upgrade_token/down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;

migrations/mysql/2026-10-10-120000_add_v2_upgrade_token/up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/down.sql

@@ -0,0 +1 @@
+ALTER TABLE org_policies DROP COLUMN revision_date;

migrations/postgresql/2026-10-07-120000_add_org_policy_revision_date/up.sql

@@ -0,0 +1,9 @@
+-- Backfill via `now() AT TIME ZONE 'utc'` rather than a DEFAULT of now():
+-- assigning timestamptz now() into a naive TIMESTAMP column casts through
+-- the server's TimeZone GUC, so a DEFAULT now() would store local wall-clock
+-- instead of UTC on non-UTC servers, unlike every other naive-UTC timestamp
+-- column in this schema.
+ALTER TABLE org_policies
+ADD COLUMN revision_date TIMESTAMP NOT NULL DEFAULT '1970-01-01 00:00:00';
+
+UPDATE org_policies SET revision_date = (now() AT TIME ZONE 'utc');

migrations/postgresql/2026-10-10-120000_add_v2_upgrade_token/down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;

migrations/postgresql/2026-10-10-120000_add_v2_upgrade_token/up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

migrations/sqlite/2026-10-07-120000_add_org_policy_revision_date/up.sql

@@ -0,0 +1,6 @@
+-- SQLite forbids non-constant defaults in ALTER TABLE ... ADD COLUMN, so add
+-- the column with a constant placeholder and backfill separately.
+ALTER TABLE org_policies
+ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
+
+UPDATE org_policies SET revision_date = CURRENT_TIMESTAMP;

migrations/sqlite/2026-10-10-120000_add_v2_upgrade_token/down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;

migrations/sqlite/2026-10-10-120000_add_v2_upgrade_token/up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

playwright/README.md

@@ -2,7 +2,7 @@
 
 This allows running integration tests using [Playwright](https://playwright.dev/).
 \
-It usse its own [test.env](/test/scenarios/test.env) with different ports to not collide with a running dev instance.
+It uses its own [test.env](./test.env) with different ports to not collide with a running dev instance.
 
 ## Install
 
@@ -62,7 +62,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 
 ### Keep services running
 
-If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
+If you want you can keep the DB and Keycloak running (states are not impacted by the tests):
 
 ```bash
 PW_KEEP_SERVICE_RUNNING=true npx playwright test

playwright/tests/emergency.spec.ts

@@ -0,0 +1,131 @@
+import { test, expect, type Page, type TestInfo, Test } from '@playwright/test';
+import { MailDev } from 'maildev';
+
+import * as utils from "../global-utils";
+import { createAccount, logUser } from './setups/user';
+import { activateTOTP } from './setups/2fa';
+
+let users = utils.loadEnv();
+let mailserver;
+
+test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
+    mailserver = new MailDev({
+        port: process.env.MAILDEV_SMTP_PORT,
+        web: { port: process.env.MAILDEV_HTTP_PORT },
+    })
+
+    await mailserver.listen();
+
+    await utils.startVault(browser, testInfo, {
+        SMTP_HOST: process.env.MAILDEV_HOST,
+        SMTP_FROM: process.env.PW_SMTP_FROM,
+    });
+});
+
+test.afterAll('Teardown', async ({}) => {
+    utils.stopVault();
+    if( mailserver ){
+        await mailserver.close();
+    }
+});
+
+async function emergencyAccess(test: Test, page: Page, user: { name: string }) {
+    await test.step('Navigate', async () => {
+        await page.getByRole('button', { name: user.name }).click();
+        await page.getByRole('menuitem', { name: 'Account settings' }).click();
+        await page.getByRole('link', { name: 'Emergency access' }).click();
+        await expect(page.locator('#main-content').getByText('Emergency access', { exact: true })).toBeVisible();
+    });
+}
+
+test('Emergency access', async ({ browser, page }) => {
+    const context2 = await browser.newContext();
+    const page2 = await context2.newPage();
+
+    const mailBuffer = mailserver.buffer(users.user1.email);
+    const mailBuffer2 = mailserver.buffer(users.user2.email);
+
+    await createAccount(test, page, users.user1);
+    await createAccount(test, page2, users.user2);
+
+    await test.step('Add test2', async () => {
+        await emergencyAccess(test, page, users.user1);
+        await page.getByRole('button', { name: 'Add emergency contact' }).click();
+        await page.getByRole('textbox', { name: 'Email * (required)' }).fill(users.user2.email);
+        await page.getByRole('radio', { name: 'Takeover Can reset your' }).check();
+        await page.getByRole('button', { name: 'Save' }).click();
+        await utils.checkNotification(page, 'User(s) invited');
+    });
+
+    await test.step('Accept', async () => {
+        const email = await mailBuffer2.expect((m) => m.subject === "Emergency access for " + users.user1.name);
+        const pageE = await context2.newPage();
+        await pageE.setContent(email.html);
+        const link = await pageE.getByTestId("emergency").getAttribute("href");
+        await pageE.close();
+
+        await page2.goto(link);
+        await utils.checkNotification(page2, 'Invitation accepted');
+    });
+
+    await test.step('Confirm', async () => {
+        await emergencyAccess(test, page, users.user1);
+        await expect(page.locator('#main-content').getByText('Needs confirmation')).toBeVisible();
+        await page.getByRole('button', { name: 'Options' }).click();
+        await page.getByRole('menuitem', { name: 'Confirm' }).click();
+        await page.getByRole('button', { name: 'Confirm' }).click();
+        await utils.checkNotification(page, users.user2.name + ' confirmed');
+        await mailBuffer2.expect((m) => m.subject === "Emergency access contact for " + users.user1.name + " confirmed");
+    });
+
+    await test.step('Request', async () => {
+        await emergencyAccess(test, page2, users.user2);
+        await page2.getByRole('button', { name: 'Options' }).click();
+        await page2.getByRole('menuitem', { name: 'Request Access' }).click();
+        await page2.getByRole('button', { name: 'Request Access' }).click();
+        await utils.checkNotification(page2, 'Emergency access requested');
+        await mailBuffer.expect((m) => m.subject === "Emergency access request by " + users.user2.name + " initiated");
+    });
+
+    await test.step('Approved', async () => {
+        await emergencyAccess(test, page, users.user1);
+        await page.getByRole('button', { name: 'Options' }).click();
+        await page.getByRole('menuitem', { name: 'Approve' }).click();
+        await page.getByRole('button', { name: 'Approve' }).click();
+        await utils.checkNotification(page, 'Emergency access approved');
+        await mailBuffer2.expect((m) => m.subject === "Emergency access request for " + users.user1.name + " approved");
+    });
+    await activateTOTP(test, page, users.user1);
+
+    let newPassword = "TotoNewPassword";
+    await test.step('Access', async () => {
+        await emergencyAccess(test, page2, users.user2);
+        await page2.getByRole('button', { name: 'Options' }).click();
+        await page2.getByRole('menuitem', { name: 'Takeover' }).click();
+        await page2.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
+        await page2.getByRole('textbox', { name: 'Confirm new master password' }).fill(newPassword);
+        await page2.getByRole('button', { name: 'Save' }).click();
+        await utils.checkNotification(page2, 'Password reset for ' + users.user1.name);
+    });
+
+    await test.step('Changed no 2fa', async () => {
+        users.user1.password = newPassword;
+        await logUser(test, page, users.user1);
+    });
+
+    await test.step('Reject', async () => {
+        await emergencyAccess(test, page, users.user1);
+        await page.getByRole('button', { name: 'Options' }).click();
+        await page.getByRole('menuitem', { name: 'Reject' }).click();
+        await utils.checkNotification(page, 'Emergency access rejected');
+        await mailBuffer2.expect((m) => m.subject === "Emergency access request to " + users.user1.name + " rejected");
+    });
+
+    await test.step('Remove', async () => {
+        await page.getByRole('button', { name: 'Options' }).click();
+        await page.getByRole('menuitem', { name: 'Remove' }).click();
+        await page.getByRole('button', { name: 'Yes' }).click();
+        await utils.checkNotification(page, 'Removed user ' + users.user2.name);
+        await expect(page.getByText('You have not added any emergency contacts')).toBeVisible();
+    });
+});

playwright/tests/login.spec.ts

@@ -3,7 +3,7 @@ import * as OTPAuth from "otpauth";
 
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP } from './setups/2fa';
+import { activateTOTP, disableTOTP, recoveryCodes } from './setups/2fa';
 
 let users = utils.loadEnv();
 let totp;
@@ -31,21 +31,42 @@ test('Authenticator 2fa', async ({ page }) => {
 
     await utils.logout(test, page, users.user1);
 
-    await test.step('login', async () => {
-        let timestamp = Date.now(); // Needed to use the next token
-        timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
+    await logUser(test, page, users.user1, { totp });
 
+    await disableTOTP(test, page, users.user1);
+});
+
+test('Recovery codes', async ({ context, page }) => {
+    await logUser(test, page, users.user1);
+
+    await activateTOTP(test, page, users.user1);
+    let recovery = await recoveryCodes(test, page, users.user1);
+
+    await utils.logout(test, page, users.user1);
+
+    await test.step('login', async () => {
         await page.getByLabel(/Email address/).fill(users.user1.email);
         await page.getByRole('button', { name: 'Continue' }).click();
         await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
         await page.getByRole('button', { name: 'Log in', exact: true }).click();
 
         await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
-        await page.getByRole('button', { name: 'Continue' }).click();
 
         await expect(page).toHaveTitle(/Vaultwarden Web/);
-    });
 
-    await disableTOTP(test, page, users.user1);
+        const newPagePromise = context.waitForEvent('page');
+        await page.getByRole('button', { name: 'Use your recovery code' }).click();
+        const newPage = await newPagePromise;
+
+        const tabs = context.pages();
+        await tabs[1].bringToFront();
+        await expect(tabs[1].getByRole('heading', { name: 'Recover account two-step login' })).toBeVisible();
+        await tabs[1].getByRole('textbox', { name: 'Email address * (required)' }).fill(users.user1.email);
+        await tabs[1].getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
+        await tabs[1].getByRole('textbox', { name: 'Recovery code * (required)' }).fill(recovery);
+        await tabs[1].getByRole('button', { name: 'Submit' }).click();
+
+        await expect(tabs[1]).toHaveTitle(/Two-step login/);
+    });
 });
+

playwright/tests/setups/2fa.ts

@@ -4,6 +4,24 @@ import * as OTPAuth from "otpauth";
 
 import * as utils from '../../global-utils';
 
+export async function recoveryCodes(test: Test, page: Page, user: { name: string, password: string }): string {
+    return await test.step('Recovery code', async () => {
+        await page.getByRole('button', { name: user.name }).click();
+        await page.getByRole('menuitem', { name: 'Account settings' }).click();
+        await page.getByRole('link', { name: 'Security' }).click();
+        await page.getByRole('link', { name: 'Two-step login' }).click();
+
+        await page.getByRole('button', { name: 'View recovery code' }).click();
+        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByRole('button', { name: 'Continue' }).click();
+
+        const recovery = await page.getByRole('code').innerText();
+        await page.getByLabel('Close').click();
+
+        return recovery;
+    })
+}
+
 export async function activateTOTP(test: Test, page: Page, user: { name: string, password: string }): OTPAuth.TOTP {
     return await test.step('Activate TOTP 2FA', async () => {
         await page.getByRole('button', { name: user.name }).click();
@@ -21,7 +39,6 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
         await page.getByLabel(/Verification code/).fill(totp.generate());
         await page.getByRole('button', { name: 'Turn on' }).click();
         await page.getByRole('heading', { name: 'Turned on', exact: true });
-        await page.getByLabel('Close').click();
 
         return totp;
     })

playwright/tests/setups/user.ts

@@ -2,6 +2,7 @@ import { expect, type Browser, Page } from '@playwright/test';
 
 import { type MailBuffer } from 'maildev';
 
+import * as OTPAuth from "otpauth";
 import * as utils from '../../global-utils';
 import { retrieveEmailCode } from './2fa';
 
@@ -43,6 +44,7 @@ export async function logUser(
         mailBuffer ?: MailBuffer,
         mail2fa?: boolean,
         notNewDevice?: boolean,
+        totp?: OTPAuth.TOTP,
     } = {}
 ) {
     await test.step(`Log user ${user.email}`, async () => {
@@ -55,11 +57,23 @@ export async function logUser(
         await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
         await page.getByRole('button', { name: 'Log in', exact: true }).click();
 
-        if( options.mail2fa ){
+        if( options.mail2fa || options.totp ){
+            let code;
+
             await test.step('2FA check', async () => {
                 await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-                let code = await retrieveEmailCode(test, page, options.mailBuffer);
+
+                if( options.totp ) {
+                    const totp = options.totp;
+                    let timestamp = Date.now(); // Needed to use the next token
+                    timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
+                    code = totp.generate({timestamp});
+                } else if( options.mail2fa ){
+                    code = await retrieveEmailCode(test, page, options.mailBuffer);
+                }
+
                 await page.getByLabel(/Verification code/).fill(code);
+
                 await page.getByRole('button', { name: 'Continue' }).click();
             });
         }

src/api/core/accounts.rs

@@ -1,6 +1,7 @@
 use std::collections::HashSet;
 
 use chrono::Utc;
+use num_traits::FromPrimitive;
 use rocket::{
     http::Status,
     request::{FromRequest, Outcome, Request},
@@ -11,7 +12,7 @@ use serde_json::Value;
 use crate::{
     CONFIG,
     api::{
-        AnonymousNotify, ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
+        AnonymousNotify, ApiResult, EmptyResult, JsonResult, LogOutReason, Notify, PasswordOrOtpData,
         core::{accept_org_invite, log_user_event, two_factor::email},
         master_password_policy, register_push_device, unregister_push_device,
     },
@@ -31,7 +32,7 @@ use crate::{
 };
 
 use super::{
-    ciphers::{CipherData, update_cipher_from_data},
+    ciphers::{CipherData, rotate_cipher_data, validate_rotated_cipher},
     sends::SendData,
 };
 
@@ -48,8 +49,10 @@ pub fn routes() -> Vec<rocket::Route> {
         post_password,
         post_set_password,
         post_kdf,
+        get_key_rotation_data,
         post_rotatekey,
         post_user_key,
+        post_rotate_user_keys,
         post_sstamp,
         post_email_token,
         post_email,
@@ -94,6 +97,15 @@ pub struct KDFData {
     kdf_parallelism: Option<i32>,
 }
 
+impl KDFData {
+    pub(super) fn matches_user(&self, user: &User) -> bool {
+        self.kdf == user.client_kdf_type
+            && self.kdf_iterations == user.client_kdf_iter
+            && self.kdf_memory == user.client_kdf_memory
+            && self.kdf_parallelism == user.client_kdf_parallelism
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RegisterData {
@@ -327,6 +339,21 @@ impl AccountKeysData {
     }
 }
 
+impl WrappedAccountCryptographicState {
+    /// v2-only: the nested pair stands in for the top-level keys, so a partial state can't pass as v1.
+    fn validate(self) -> ApiResult<ValidatedAccountKeys> {
+        let key_pair = self.public_key_encryption_key_pair;
+        AccountKeysData {
+            user_key_encrypted_account_private_key: Some(key_pair.wrapped_private_key.clone()),
+            account_public_key: Some(key_pair.public_key.clone()),
+            public_key_encryption_key_pair: Some(key_pair),
+            signature_key_pair: Some(self.signature_key_pair),
+            security_state: Some(self.security_state),
+        }
+        .validate()
+    }
+}
+
 impl From<KeysData> for ValidatedAccountKeys {
     fn from(keys: KeysData) -> Self {
         Self {
@@ -750,8 +777,7 @@ async fn post_set_password(data: Json<Value>, headers: Headers, conn: DbConn) ->
         Membership::accept_user_invitations(&user.uuid, &conn).await?;
     }
 
-    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
-        .await;
+    log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     user.save(&conn).await?;
 
@@ -949,8 +975,7 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbCon
         err!("Invalid password")
     }
 
-    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
-        .await;
+    log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     let (new_master_password_hash, new_key) =
         if let (Some(unlock_data), Some(authentication_data)) = (data.unlock_data, data.authentication_data) {
@@ -958,7 +983,8 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbCon
                 err!("KDF settings must be equal for authentication and unlock")
             }
 
-            if user.email != authentication_data.salt || user.email != unlock_data.salt {
+            let salt = user.master_password_salt();
+            if salt != authentication_data.salt || salt != unlock_data.salt {
                 err!("Invalid master password salt")
             }
 
@@ -1037,21 +1063,35 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult {
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct AuthenticationData {
+pub(super) struct AuthenticationData {
     #[serde(alias = "Salt")]
     salt: String,
     #[serde(alias = "Kdf")]
-    kdf: KDFData,
+    pub(super) kdf: KDFData,
     #[serde(alias = "MasterPasswordAuthenticationHash")]
-    master_password_authentication_hash: String,
+    pub(super) master_password_authentication_hash: String,
+}
+
+impl AuthenticationData {
+    pub(super) fn check(&self, user: &User, unlock: &UnlockData) -> EmptyResult {
+        if self.kdf != unlock.kdf {
+            err!("KDF settings must be equal for authentication and unlock")
+        }
+
+        if self.salt != user.master_password_salt() || self.salt != unlock.salt {
+            err!("Invalid master password salt")
+        }
+
+        Ok(())
+    }
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct UnlockData {
+pub(super) struct UnlockData {
     salt: String,
     kdf: KDFData,
-    master_key_wrapped_user_key: String,
+    pub(super) master_key_wrapped_user_key: String,
     contained_key_id: Option<KeyId>,
 }
 
@@ -1067,6 +1107,17 @@ fn validate_key_id_unchanged(user: &User, unlock_data: &UnlockData) -> EmptyResu
     Ok(())
 }
 
+/// A rotation's unlock data has to wrap the new user key. Neither id is sent by clients that predate them.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs#L49-L61>
+fn validate_contained_key_id(contained_key_id: Option<&KeyId>, new_user_key_id: Option<&KeyId>) -> EmptyResult {
+    match (contained_key_id, new_user_key_id) {
+        (None, None) => Ok(()),
+        (Some(contained), Some(new)) if contained == new => Ok(()),
+        _ => err!("Invalid user key sent in master-password unlock data."),
+    }
+}
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct ChangeKdfData {
@@ -1083,13 +1134,7 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, conn: DbConn, nt:
         err!("Invalid password")
     }
 
-    if data.authentication_data.kdf != data.unlock_data.kdf {
-        err!("KDF settings must be equal for authentication and unlock")
-    }
-
-    if headers.user.email != data.authentication_data.salt || headers.user.email != data.unlock_data.salt {
-        err!("Invalid master password salt")
-    }
+    data.authentication_data.check(&headers.user, &data.unlock_data)?;
 
     validate_key_id_unchanged(&headers.user, &data.unlock_data)?;
 
@@ -1127,50 +1172,71 @@ struct UpdateFolderData {
 #[serde(rename_all = "camelCase")]
 struct UpdateEmergencyAccessData {
     id: EmergencyAccessId,
-    key_encrypted: String,
+    key_encrypted: Option<String>,
+    // Only validated, upstream doesn't store it either
+    wait_time_days: Option<i32>,
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct UpdateResetPasswordData {
     organization_id: OrganizationId,
-    reset_password_key: String,
+    // Absent in a v1 -> v2 upgrade, which keeps the key the organization already holds
+    reset_password_key: Option<String>,
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct KeyData {
     account_unlock_data: RotateAccountUnlockData,
-    account_keys: RotateAccountKeys,
+    account_keys: AccountKeysData,
     account_data: RotateAccountData,
     old_master_key_authentication_hash: String,
+    new_user_key_id: Option<KeyId>,
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RotateAccountUnlockData {
-    emergency_access_unlock_data: Vec<UpdateEmergencyAccessData>,
     master_password_unlock_data: MasterPasswordUnlockData,
-    organization_account_recovery_unlock_data: Vec<UpdateResetPasswordData>,
+    #[serde(flatten)]
+    common: CommonUnlockData,
 }
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct MasterPasswordUnlockData {
-    kdf_type: i32,
-    kdf_iterations: i32,
-    kdf_parallelism: Option<i32>,
-    kdf_memory: Option<i32>,
+    #[serde(flatten)]
+    kdf: KDFData,
     email: String,
     master_key_authentication_hash: String,
     master_key_encrypted_user_key: String,
+    master_password_hint: Option<String>,
+    master_password_salt: Option<String>,
+    contained_key_id: Option<KeyId>,
 }
 
+/// The unlock data of both rotation endpoints; passkey and device keys are ignored, as we support neither.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/CommonUnlockDataRequestModel.cs#L7-L14>
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct RotateAccountKeys {
-    user_key_encrypted_account_private_key: String,
-    account_public_key: String,
+struct CommonUnlockData {
+    emergency_access_unlock_data: Vec<UpdateEmergencyAccessData>,
+    organization_account_recovery_unlock_data: Vec<UpdateResetPasswordData>,
+    #[expect(dead_code, reason = "Required like upstream, but unused")]
+    passkey_unlock_data: Vec<Value>,
+    #[expect(dead_code, reason = "Required like upstream, but unused")]
+    device_key_unlock_data: Vec<Value>,
+    v2_upgrade_token: Option<V2UpgradeTokenData>,
+}
+
+/// Lets other sessions with the v1 user key unwrap the v2 one after an upgrade. Opaque to us.
+#[derive(Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct V2UpgradeTokenData {
+    wrapped_user_key1: String,
+    wrapped_user_key2: String,
 }
 
 #[derive(Deserialize)]
@@ -1181,27 +1247,116 @@ struct RotateAccountData {
     sends: Vec<SendData>,
 }
 
-fn validate_keydata(
-    data: &KeyData,
+/// Body of `rotate-user-keys`, which rotates the keys without touching the master password.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RotateUserKeysData {
+    wrapped_account_cryptographic_state: WrappedAccountCryptographicState,
+    unlock_data: CommonUnlockData,
+    account_data: RotateAccountData,
+    unlock_method_data: UnlockMethodData,
+    new_user_key_id: Option<KeyId>,
+}
+
+/// The v2-only account cryptographic state, where all three parts are mandatory.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct WrappedAccountCryptographicState {
+    public_key_encryption_key_pair: PublicKeyEncryptionKeyPairData,
+    signature_key_pair: SignatureKeyPairData,
+    security_state: SecurityStateData,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct UnlockMethodData {
+    unlock_method: i32,
+    master_password_unlock_data: Option<UnlockData>,
+    key_connector_key_wrapped_user_key: Option<String>,
+}
+
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Enums/UnlockMethod.cs#L3-L8>
+#[derive(num_derive::FromPrimitive)]
+enum UnlockMethod {
+    Tde = 0,
+    MasterPassword = 1,
+    KeyConnector = 2,
+}
+
+/// The rotation checks on the new keys: the public key never changes, nor the verifying key of a v2 account.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs#L192-L287>
+async fn validate_rotation_account_keys(keys: &ValidatedAccountKeys, user: &User, conn: &DbConn) -> EmptyResult {
+    if user.public_key.as_ref() != Some(&keys.public_key) {
+        err!("Changing the asymmetric keypair is not possible during key rotation")
+    }
+
+    let Some(v2) = &keys.v2 else {
+        if user.is_v2() {
+            err!("Cannot downgrade an account from v2 to v1 encryption during key rotation")
+        }
+        // A v1 rotation: the private key stays wrapped by an AES-CBC-HMAC user key
+        if enc_string_type(&keys.private_key) != Some(ENC_TYPE_AES_CBC_256_HMAC_SHA256) {
+            err!("The provided account private key was not wrapped with AES-256-CBC-HMAC")
+        }
+        return Ok(());
+    };
+
+    // Both a v2 rotation and the v1 -> v2 upgrade end up with a COSE user key wrapping the private keys
+    if enc_string_type(&v2.signing_key) != Some(ENC_TYPE_COSE_ENCRYPT0) {
+        err!("The provided signing key data is not wrapped with XChaCha20-Poly1305.")
+    }
+    if enc_string_type(&keys.private_key) != Some(ENC_TYPE_COSE_ENCRYPT0) {
+        err!("The provided private key encryption key is not wrapped with XChaCha20-Poly1305.")
+    }
+    if v2.verifying_key.is_empty() || v2.signed_public_key.is_empty() || v2.security_state.is_empty() {
+        err!("The v2 account keys are missing the verifying key, signed public key or security state")
+    }
+
+    if !user.is_v2() {
+        // The v1 -> v2 upgrade, which is where the signature key pair comes from
+        return Ok(());
+    }
+
+    let Some(key_pair) = UserSignatureKeyPair::find_by_user(&user.uuid, conn).await else {
+        err!("The account is missing its signature key pair")
+    };
+    if key_pair.verifying_key != v2.verifying_key {
+        err!("Changing the verifying key is not possible during key rotation")
+    }
+
+    Ok(())
+}
+
+/// `AesCbc256_HmacSha256_B64`, the v1 user key
+const ENC_TYPE_AES_CBC_256_HMAC_SHA256: &str = "2";
+/// `CoseEncrypt0B64`, the v2 user key
+const ENC_TYPE_COSE_ENCRYPT0: &str = "7";
+
+/// The encryption type of an EncString, the number before the first `.`.
+fn enc_string_type(enc_string: &str) -> Option<&str> {
+    enc_string.split_once('.').map(|(enc_type, _)| enc_type)
+}
+
+impl KDFData {
+    /// Whether these are the settings the user already has, which a key rotation can't change.
+    fn is_unchanged_for(&self, user: &User) -> bool {
+        user.client_kdf_type == self.kdf
+            && user.client_kdf_iter == self.kdf_iterations
+            && user.client_kdf_memory == self.kdf_memory
+            && user.client_kdf_parallelism == self.kdf_parallelism
+    }
+}
+
+/// Every existing item must be in the rotation, or it would be unreadable afterwards.
+fn validate_rotation_data(
+    data: &RotateData,
     existing_ciphers: &[Cipher],
     existing_folders: &[Folder],
     existing_emergency_access: &[EmergencyAccess],
     existing_memberships: &[Membership],
     existing_sends: &[Send],
-    user: &User,
 ) -> EmptyResult {
-    if user.client_kdf_type != data.account_unlock_data.master_password_unlock_data.kdf_type
-        || user.client_kdf_iter != data.account_unlock_data.master_password_unlock_data.kdf_iterations
-        || user.client_kdf_memory != data.account_unlock_data.master_password_unlock_data.kdf_memory
-        || user.client_kdf_parallelism != data.account_unlock_data.master_password_unlock_data.kdf_parallelism
-        || user.email != data.account_unlock_data.master_password_unlock_data.email
-    {
-        err!("Changing the kdf variant or email is not supported during key rotation");
-    }
-    if user.public_key.as_ref() != Some(&data.account_keys.account_public_key) {
-        err!("Changing the asymmetric keypair is not possible during key rotation")
-    }
-
     // Check that we're correctly rotating all the user's ciphers
     let existing_cipher_ids = existing_ciphers.iter().map(|c| &c.uuid).collect::<HashSet<&CipherId>>();
     let provided_cipher_ids = data
@@ -1226,12 +1381,8 @@ fn validate_keydata(
     // Check that we're correctly rotating all the user's emergency access keys
     let existing_emergency_access_ids =
         existing_emergency_access.iter().map(|ea| &ea.uuid).collect::<HashSet<&EmergencyAccessId>>();
-    let provided_emergency_access_ids = data
-        .account_unlock_data
-        .emergency_access_unlock_data
-        .iter()
-        .map(|ea| &ea.id)
-        .collect::<HashSet<&EmergencyAccessId>>();
+    let provided_emergency_access_ids =
+        data.unlock_data.emergency_access_unlock_data.iter().map(|ea| &ea.id).collect::<HashSet<&EmergencyAccessId>>();
     if !provided_emergency_access_ids.is_superset(&existing_emergency_access_ids) {
         err!("All existing emergency access keys must be included in the rotation")
     }
@@ -1240,7 +1391,7 @@ fn validate_keydata(
     let existing_reset_password_ids =
         existing_memberships.iter().map(|m| &m.org_uuid).collect::<HashSet<&OrganizationId>>();
     let provided_reset_password_ids = data
-        .account_unlock_data
+        .unlock_data
         .organization_account_recovery_unlock_data
         .iter()
         .map(|rp| &rp.organization_id)
@@ -1259,137 +1410,430 @@ fn validate_keydata(
     Ok(())
 }
 
-#[post("/accounts/key-management/rotate-user-account-keys", data = "<data>")]
-async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    // TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
-    let data: KeyData = data.into_inner();
+/// The keys a rotation re-shares the new user key with. The SDK needs all four lists, even when empty.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Queries/KeyRotationDataQuery.cs#L14-L122>
+#[get("/accounts/key-management/key-rotation-data")]
+async fn get_key_rotation_data(headers: Headers, conn: DbConn) -> JsonResult {
+    let user_id = &headers.user.uuid;
 
-    if !headers.user.check_valid_password(&data.old_master_key_authentication_hash) {
-        err!("Invalid password")
+    let mut organization_data = Vec::new();
+    for membership in Membership::find_by_user(user_id, &conn).await {
+        // Only memberships actually enrolled in account recovery take part in the rotation.
+        if membership.reset_password_key.is_none() {
+            continue;
+        }
+        let Some(org) = Organization::find_by_uuid(&membership.org_uuid, &conn).await else {
+            continue;
+        };
+        let Some(public_key) = org.public_key else {
+            continue;
+        };
+        organization_data.push(json!({
+            "organizationId": org.uuid,
+            "organizationName": org.name,
+            "organizationPublicKey": public_key,
+            "object": "organizationPasswordResetKeyData",
+        }));
     }
 
-    // Rotating v2 keys, or upgrading to them, would leave an account that can't be unlocked here
-    if headers.user.is_v2() {
-        err!("Key rotation is not supported for v2 accounts")
+    let mut emergency_access_data = Vec::new();
+    for emergency_access in EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await {
+        // Without a stored key there is nothing to re-share.
+        if emergency_access.key_encrypted.is_none() {
+            continue;
+        }
+        let Some(grantee_id) = emergency_access.grantee_uuid.clone() else {
+            continue;
+        };
+        let Some(grantee) = User::find_by_uuid(&grantee_id, &conn).await else {
+            continue;
+        };
+        let Some(public_key) = grantee.public_key.clone() else {
+            continue;
+        };
+        emergency_access_data.push(json!({
+            "id": emergency_access.uuid,
+            "granteeId": grantee_id,
+            "granteeName": grantee.name,
+            "granteeEmail": grantee.email,
+            "publicKey": public_key,
+            "object": "emergencyAccessKeyData",
+        }));
     }
-    if !data.account_keys.user_key_encrypted_account_private_key.starts_with("2.") {
-        err!("The provided account private key was not wrapped with AES-256-CBC-HMAC")
+
+    Ok(Json(json!({
+        "organizationPasswordResetKeyData": organization_data,
+        "emergencyAccessKeyData": emergency_access_data,
+        "trustedDeviceKeyData": [],
+        "passkeyKeyData": [],
+        "object": "keyRotationData",
+    })))
+}
+
+/// Everything a rotation replaces, once each endpoint's wrapper has been peeled off.
+struct RotateData {
+    account_keys: ValidatedAccountKeys,
+    account_data: RotateAccountData,
+    unlock_data: CommonUnlockData,
+    /// `None` from clients that predate key ids.
+    new_user_key_id: Option<KeyId>,
+    /// The new user key, wrapped by the master key.
+    wrapped_user_key: String,
+    /// Only for `rotate-user-account-keys`: the new password hash and hint.
+    new_password: Option<(String, Option<String>)>,
+}
+
+/// Upstream's `[StringLength(max)]`, which counts UTF-16 code units.
+fn validate_max_length(value: &str, max: usize, field: &str) -> EmptyResult {
+    if value.encode_utf16().count() > max {
+        err!(format!("The field {field} must be a string with a maximum length of {max}."))
     }
+    Ok(())
+}
+
+impl KDFData {
+    /// Upstream's check that the parameters fit the KDF type.
+    fn validate_parameters(&self) -> EmptyResult {
+        let has_argon2_parameters = (self.kdf_memory.is_some(), self.kdf_parallelism.is_some());
+        if self.kdf == UserKdfType::Pbkdf2 as i32 {
+            if has_argon2_parameters != (false, false) {
+                err!("KdfMemory and KdfParallelism must be null for PBKDF2_SHA256")
+            }
+        } else if self.kdf == UserKdfType::Argon2id as i32 {
+            if has_argon2_parameters != (true, true) {
+                err!("KdfMemory and KdfParallelism must have values for Argon2id")
+            }
+        } else {
+            err!("Invalid KdfType")
+        }
+        Ok(())
+    }
+}
+
+impl MasterPasswordUnlockData {
+    /// Upstream's model validation.
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/MasterPasswordUnlockDataAndAuthenticationModel.cs#L8-L48>
+    fn validate(&self) -> EmptyResult {
+        self.kdf.validate_parameters()?;
+        if !crate::util::is_valid_email(&self.email) {
+            err!("The Email field is not a supported e-mail address format.")
+        }
+        validate_max_length(&self.email, 256, "Email")?;
+        required(Some(self.master_key_authentication_hash.clone()), "MasterKeyAuthenticationHash")?;
+        validate_max_length(&self.master_key_authentication_hash, 300, "MasterKeyAuthenticationHash")?;
+        required(Some(self.master_key_encrypted_user_key.clone()), "MasterKeyEncryptedUserKey")?;
+        if let Some(hint) = &self.master_password_hint {
+            validate_max_length(hint, 50, "MasterPasswordHint")?;
+        }
+        if self.master_password_salt.as_ref().is_some_and(|salt| salt.encode_utf16().count() > 256) {
+            err!("The field MasterPasswordSalt must be a string or array type with a maximum length of '256'.")
+        }
+        Ok(())
+    }
+}
+
+impl CommonUnlockData {
+    /// Upstream's model validation.
+    fn validate(&self) -> EmptyResult {
+        // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Auth/Models/Request/EmergencyAccessRequestModels.cs#L32-L39>
+        for emergency_access in &self.emergency_access_unlock_data {
+            if !emergency_access.wait_time_days.is_some_and(|days| (1..=i32::from(i16::MAX)).contains(&days)) {
+                err!("The field WaitTimeDays must be between 1 and 32767.")
+            }
+        }
+        if let Some(token) = &self.v2_upgrade_token {
+            required(Some(token.wrapped_user_key1.clone()), "WrappedUserKey1")?;
+            required(Some(token.wrapped_user_key2.clone()), "WrappedUserKey2")?;
+        }
+        Ok(())
+    }
+}
+
+/// The model validation of the parts both rotation endpoints share, which upstream runs before anything else.
+fn validate_rotation_request(account_data: &RotateAccountData, unlock_data: &CommonUnlockData) -> EmptyResult {
+    unlock_data.validate()?;
 
     // Validate the import before continuing
     // Bitwarden does not process the import if there is one item invalid.
     // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
     // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
-    Cipher::validate_cipher_data(&data.account_data.ciphers)?;
+    Cipher::validate_cipher_data(&account_data.ciphers)?;
 
+    for cipher in &account_data.ciphers {
+        if cipher.id.is_none() {
+            err!("The Id field is required.")
+        }
+        cipher.validate_type_data(cipher.is_blob())?;
+    }
+    if account_data.sends.iter().any(|send| send.id.is_none()) {
+        err!("The Id field is required.")
+    }
+    Ok(())
+}
+
+#[post("/accounts/key-management/rotate-user-account-keys", data = "<data>")]
+async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    let data: KeyData = data.into_inner();
+
+    let unlock_data = data.account_unlock_data.master_password_unlock_data;
+    validate_max_length(&data.old_master_key_authentication_hash, 300, "OldMasterKeyAuthenticationHash")?;
+    unlock_data.validate()?;
+    validate_rotation_request(&data.account_data, &data.account_unlock_data.common)?;
+
+    if !headers.user.check_valid_password(&data.old_master_key_authentication_hash) {
+        err!("Invalid password")
+    }
+
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Models/Data/PasswordChangeAndRotateUserAccountKeysData.cs#L17-L32>
+    let salt = unlock_data.master_password_salt.as_ref().unwrap_or(&unlock_data.email);
+    if !unlock_data.kdf.is_unchanged_for(&headers.user) || *salt != headers.user.master_password_salt() {
+        err!("The provided master password unlock data is not valid for this user.")
+    }
+    validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
+    let password_hint = clean_password_hint(unlock_data.master_password_hint.as_ref());
+    enforce_password_hint_setting(password_hint.as_ref())?;
+
+    let mut common = data.account_unlock_data.common;
+    // Like upstream, this endpoint logs every session out, so an upgrade token is never kept
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs#L94-L96>
+    common.v2_upgrade_token = None;
+
+    rotate_account(
+        RotateData {
+            account_keys: data.account_keys.validate()?,
+            account_data: data.account_data,
+            unlock_data: common,
+            new_user_key_id: data.new_user_key_id,
+            wrapped_user_key: unlock_data.master_key_encrypted_user_key,
+            new_password: Some((unlock_data.master_key_authentication_hash, password_hint)),
+        },
+        headers,
+        conn,
+        nt,
+    )
+    .await
+}
+
+/// Both rotation endpoints: every check first, then the re-encrypted data and the new keys are saved.
+async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
     let user_id = &headers.user.uuid;
-
-    // TODO: Ideally we'd do everything after this point in a single transaction.
-
     let mut existing_ciphers = Cipher::find_owned_by_user(user_id, &conn).await;
     let mut existing_folders = Folder::find_by_user(user_id, &conn).await;
     let mut existing_emergency_access = EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await;
+    // Like upstream, only the ones with a key take part
+    existing_emergency_access.retain(|ea| ea.key_encrypted.is_some());
     let mut existing_memberships = Membership::find_by_user(user_id, &conn).await;
     // We only rotate the reset password key if it is set.
     existing_memberships.retain(|m| m.reset_password_key.is_some());
     let mut existing_sends = Send::find_by_user(user_id, &conn).await;
 
-    validate_keydata(
+    validate_rotation_data(
         &data,
         &existing_ciphers,
         &existing_folders,
         &existing_emergency_access,
         &existing_memberships,
         &existing_sends,
-        &headers.user,
     )?;
 
-    // Update folder data
+    validate_rotation_account_keys(&data.account_keys, &headers.user, &conn).await?;
+
+    // An upgrade keeps the sessions; for an account already on v2 the token means nothing and is dropped
+    let is_upgrade = data.unlock_data.v2_upgrade_token.is_some() && !headers.user.is_v2();
+    let upgrade_token = match &data.unlock_data.v2_upgrade_token {
+        Some(token) if is_upgrade => Some(serde_json::to_string(token)?),
+        _ => None,
+    };
+
+    // An upgrade can't re-wrap the recovery keys without a trust prompt, so they're kept and get the token
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Validators/OrganizationUserRotationValidator.cs#L39-L64>
+    for membership in &existing_memberships {
+        let has_key = data
+            .unlock_data
+            .organization_account_recovery_unlock_data
+            .iter()
+            .find(|rp| rp.organization_id == membership.org_uuid)
+            .and_then(|rp| rp.reset_password_key.as_deref())
+            .is_some_and(|key| !key.trim().is_empty());
+        if is_upgrade && has_key {
+            err!("Account recovery keys cannot be rotated during a V1 to V2 upgrade rotation.")
+        }
+        if !is_upgrade && !has_key {
+            err!("Account recovery keys cannot be null or empty during rotation.")
+        }
+    }
+
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Validators/EmergencyAccessRotationValidator.cs#L23-L53>
+    for emergency_access in &existing_emergency_access {
+        if data
+            .unlock_data
+            .emergency_access_unlock_data
+            .iter()
+            .find(|ea| ea.id == emergency_access.uuid)
+            .is_some_and(|ea| ea.key_encrypted.is_none())
+        {
+            err!("Emergency access keys cannot be set to null during rotation.")
+        }
+    }
+
+    // Saving's own checks, so that they can't fail halfway
+    for cipher_data in data.account_data.ciphers.iter().filter(|c| c.organization_id.is_none()) {
+        if let Some(cipher) = existing_ciphers.iter().find(|c| cipher_data.id.as_ref() == Some(&c.uuid)) {
+            validate_rotated_cipher(cipher, cipher_data, &headers, &conn).await?;
+        }
+    }
+
+    // TODO: Ideally we'd do everything after this point in a single transaction.
+
+    // Update folder data, ignoring ids that aren't the user's, like upstream
     for folder_data in data.account_data.folders {
         // Skip `null` folder id entries.
         // See: https://github.com/bitwarden/clients/issues/8453
-        if let Some(folder_id) = folder_data.id {
-            let Some(saved_folder) = existing_folders.iter_mut().find(|f| f.uuid == folder_id) else {
-                err!("Folder doesn't exist")
-            };
-
+        if let Some(saved_folder) = folder_data.id.and_then(|id| existing_folders.iter_mut().find(|f| f.uuid == id)) {
             saved_folder.name = folder_data.name;
             saved_folder.save(&conn).await?;
         }
     }
 
-    // Update emergency access data
-    for emergency_access_data in data.account_unlock_data.emergency_access_unlock_data {
-        let Some(saved_emergency_access) =
-            existing_emergency_access.iter_mut().find(|ea| ea.uuid == emergency_access_data.id)
-        else {
-            err!("Emergency access doesn't exist or is not owned by the user")
-        };
-
-        saved_emergency_access.key_encrypted = Some(emergency_access_data.key_encrypted);
-        saved_emergency_access.save(&conn).await?;
+    // Like upstream, the unlock data below comes from the first entry for each, as checked above
+    for saved_emergency_access in &mut existing_emergency_access {
+        if let Some(emergency_access_data) =
+            data.unlock_data.emergency_access_unlock_data.iter().find(|ea| ea.id == saved_emergency_access.uuid)
+        {
+            saved_emergency_access.key_encrypted.clone_from(&emergency_access_data.key_encrypted);
+            saved_emergency_access.save(&conn).await?;
+        }
     }
 
-    // Update reset password data
-    for reset_password_data in data.account_unlock_data.organization_account_recovery_unlock_data {
-        let Some(membership) =
-            existing_memberships.iter_mut().find(|m| m.org_uuid == reset_password_data.organization_id)
-        else {
-            err!("Reset password doesn't exist")
-        };
-
-        membership.reset_password_key = Some(reset_password_data.reset_password_key);
-        membership.save(&conn).await?;
+    for membership in &mut existing_memberships {
+        if let Some(reset_password_data) = data
+            .unlock_data
+            .organization_account_recovery_unlock_data
+            .iter()
+            .find(|rp| rp.organization_id == membership.org_uuid)
+        {
+            if !is_upgrade {
+                membership.reset_password_key.clone_from(&reset_password_data.reset_password_key);
+            }
+            membership.v2_upgrade_token.clone_from(&upgrade_token);
+            membership.save(&conn).await?;
+        }
     }
 
     // Update send data
     for send_data in data.account_data.sends {
-        let Some(send) = send_data.id.as_ref().and_then(|id| existing_sends.iter_mut().find(|s| &s.uuid == id)) else {
-            err!("Send doesn't exist")
-        };
-
-        // Like upstream, only the key changes on rotation
-        send.akey = send_data.key;
-        send.save(&conn).await?;
+        if let Some(send) = send_data.id.as_ref().and_then(|id| existing_sends.iter_mut().find(|s| &s.uuid == id)) {
+            // Like upstream, only the key changes on rotation
+            send.akey = send_data.key;
+            send.save(&conn).await?;
+        }
     }
 
     // Update cipher data
     for cipher_data in data.account_data.ciphers {
-        if cipher_data.organization_id.is_none() {
-            let Some(saved_cipher) =
+        if cipher_data.organization_id.is_none()
+            && let Some(saved_cipher) =
                 cipher_data.id.as_ref().and_then(|id| existing_ciphers.iter_mut().find(|c| &c.uuid == id))
-            else {
-                err!("Cipher doesn't exist")
-            };
-
-            // Prevent triggering cipher updates via WebSockets by settings UpdateType::None
-            // The user sessions are invalidated because all the ciphers were re-encrypted and thus triggering an update could cause issues.
-            // We force the users to logout after the user has been saved to try and prevent these issues.
-            update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
+        {
+            // No cipher pushes: the other sessions still hold the old user key
+            rotate_cipher_data(saved_cipher, cipher_data, &headers, &conn, &nt).await?;
         }
     }
 
     // Update user data
     let mut user = headers.user;
+    user.v2_upgrade_token = upgrade_token;
 
-    user.private_key = Some(data.account_keys.user_key_encrypted_account_private_key);
-    user.set_password(
-        &data.account_unlock_data.master_password_unlock_data.master_key_authentication_hash,
-        Some(data.account_unlock_data.master_password_unlock_data.master_key_encrypted_user_key),
-        true,
-        None,
-        &conn,
-    )
-    .await?;
+    data.account_keys.apply(&mut user)?;
+    // The old id names a key that no longer exists, so it is replaced even when the new key has none.
+    user.key_id = data.new_user_key_id;
 
-    let save_result = user.save(&conn).await;
+    user.akey = data.wrapped_user_key;
+    if let Some((new_password_hash, new_password_hint)) = data.new_password {
+        // A password change ends every session, as `/accounts/password` does
+        user.password_hint = new_password_hint;
+        user.set_password(&new_password_hash, None, true, None, &conn).await?;
+    } else if !is_upgrade {
+        // An upgrade keeps the sessions alive, see `is_upgrade` above
+        user.reset_security_stamp_after_key_rotation(&conn).await?;
+    }
+
+    // The key pair first: if saving the user then fails, an upgraded account stays v1 instead of broken
+    data.account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
+    user.save(&conn).await?;
 
     // Prevent logging out the client where the user requested this endpoint from.
     // If you do logout the user it will causes issues at the client side.
     // Adding the device uuid will prevent this.
-    nt.send_logout(&user, Some(&headers.device), &conn).await;
+    // On an upgrade, the reason lets clients with `pm-31050-no-logout-key-upgrade-rotation` sync instead
+    let reason = is_upgrade.then_some(LogOutReason::KeyRotation);
+    nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await;
 
-    save_result
+    Ok(())
+}
+
+/// Rotates the keys without changing the master password; like upstream, the session is the only proof.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs#L174-L208>
+#[post("/accounts/key-management/rotate-user-keys", data = "<data>")]
+async fn post_rotate_user_keys(
+    data: Json<RotateUserKeysData>,
+    headers: Headers,
+    conn: DbConn,
+    nt: Notify<'_>,
+) -> EmptyResult {
+    let data: RotateUserKeysData = data.into_inner();
+    validate_rotation_request(&data.account_data, &data.unlock_data)?;
+
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/KeyManagement/Models/Requests/UnlockMethodRequestModel.cs#L20-L46>
+    let wrapped_user_key = match UnlockMethod::from_i32(data.unlock_method_data.unlock_method) {
+        Some(UnlockMethod::MasterPassword) => {
+            let (Some(unlock_data), None) = (
+                data.unlock_method_data.master_password_unlock_data,
+                data.unlock_method_data.key_connector_key_wrapped_user_key,
+            ) else {
+                err!(
+                    "Invalid MasterPassword unlock method request, MasterPasswordUnlockData must be provided and KeyConnectorKeyWrappedUserKey must be null"
+                )
+            };
+            required(Some(unlock_data.master_key_wrapped_user_key.clone()), "MasterKeyWrappedUserKey")?;
+            required(Some(unlock_data.salt.clone()), "Salt")?;
+            validate_max_length(&unlock_data.salt, 256, "Salt")?;
+
+            // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/UserKey/Models/Data/MasterPasswordRotateUserAccountKeysData.cs#L12-L23>
+            if headers.user.password_hash.is_empty() || headers.user.akey.is_empty() {
+                err!("User is in an invalid state for master password key rotation.")
+            }
+            if unlock_data.salt != headers.user.master_password_salt() {
+                err!("Invalid master password salt.")
+            }
+            if !unlock_data.kdf.is_unchanged_for(&headers.user) {
+                err!("Invalid KDF settings.")
+            }
+            validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
+            unlock_data.master_key_wrapped_user_key
+        }
+        Some(UnlockMethod::Tde) => err!("Trusted device encryption is not supported"),
+        Some(UnlockMethod::KeyConnector) => err!("Key connector is not supported"),
+        None => err!("Unrecognized unlock method"),
+    };
+
+    rotate_account(
+        RotateData {
+            account_keys: data.wrapped_account_cryptographic_state.validate()?,
+            account_data: data.account_data,
+            unlock_data: data.unlock_data,
+            new_user_key_id: data.new_user_key_id,
+            wrapped_user_key,
+            new_password: None,
+        },
+        headers,
+        conn,
+        nt,
+    )
+    .await
 }
 
 #[derive(Deserialize)]
@@ -2023,7 +2467,7 @@ async fn post_auth_request(
     nt.send_auth_request(&user.uuid, &auth_request.uuid, &device, &conn).await;
 
     log_user_event(
-        EventType::UserRequestedDeviceApproval as i32,
+        EventType::UserRequestedDeviceApproval,
         &user.uuid,
         client_headers.device_type,
         &client_headers.ip.ip,
@@ -2117,7 +2561,7 @@ async fn put_auth_request(
         nt.send_auth_response(&auth_request.user_uuid, &auth_request.uuid, &headers.device, &conn).await;
 
         log_user_event(
-            EventType::OrganizationUserApprovedAuthRequest as i32,
+            EventType::OrganizationUserApprovedAuthRequest,
             &headers.user.uuid,
             headers.device.atype,
             &headers.ip.ip,
@@ -2128,7 +2572,7 @@ async fn put_auth_request(
         // If denied, there's no reason to keep the request
         auth_request.delete(&conn).await?;
         log_user_event(
-            EventType::OrganizationUserRejectedAuthRequest as i32,
+            EventType::OrganizationUserRejectedAuthRequest,
             &headers.user.uuid,
             headers.device.atype,
             &headers.ip.ip,

src/api/core/ciphers.rs

@@ -190,7 +190,7 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "masterKeyEncryptedUserKey": headers.user.akey,
             "masterKeyWrappedUserKey": headers.user.akey,
-            "salt": headers.user.email,
+            "salt": headers.user.master_password_salt(),
             "containedKeyId": headers.user.key_id,
         })
     } else {
@@ -202,6 +202,9 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
     if let Some(key_id) = &headers.user.key_id {
         user_decryption["userKeyId"] = json!(key_id);
     }
+    if let Some(v2_upgrade_token) = headers.user.v2_upgrade_token_json() {
+        user_decryption["v2UpgradeToken"] = v2_upgrade_token;
+    }
 
     Ok(Json(json!({
         "profile": user_json,
@@ -376,6 +379,25 @@ impl CipherData {
         self.data.as_deref().is_some_and(is_data_blob_encrypted)
     }
 
+    /// Saving's last checks: a known type, and its data unless it's a blob.
+    pub fn validate_type_data(&self, is_blob: bool) -> EmptyResult {
+        let type_data = match self.r#type {
+            1 => &self.login,
+            2 => &self.secure_note,
+            3 => &self.card,
+            4 => &self.identity,
+            5 => &self.ssh_key,
+            6 => &self.bank_account,
+            7 => &self.drivers_license,
+            8 => &self.passport,
+            _ => err!("Invalid type"),
+        };
+        if !is_blob && type_data.is_none() {
+            err!("Data missing")
+        }
+        Ok(())
+    }
+
     /// Upstream's model checks that depend on the format: the size of `data`, and a name unless it's a blob.
     ///
     /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L76-L77>
@@ -544,6 +566,40 @@ pub async fn update_cipher_from_data(
     conn: &DbConn,
     nt: &Notify<'_>,
     ut: UpdateType,
+) -> EmptyResult {
+    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
+    save_cipher_data(cipher, data, headers, shared_to_collections, conn, nt, ut).await
+}
+
+/// [`update_cipher_from_data`] for a rotation: like upstream, the personal ownership policy doesn't apply.
+pub async fn rotate_cipher_data(
+    cipher: &mut Cipher,
+    data: CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+    nt: &Notify<'_>,
+) -> EmptyResult {
+    save_cipher_data(cipher, data, headers, None, conn, nt, UpdateType::None).await
+}
+
+/// The checks of [`rotate_cipher_data`] that need the database, to run on every cipher before the first is saved
+pub async fn validate_rotated_cipher(
+    cipher: &Cipher,
+    data: &CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+) -> EmptyResult {
+    validate_cipher_update(cipher, data, headers, conn, UpdateType::None).await
+}
+
+async fn save_cipher_data(
+    cipher: &mut Cipher,
+    data: CipherData,
+    headers: &Headers,
+    shared_to_collections: Option<Vec<CollectionId>>,
+    conn: &DbConn,
+    nt: &Notify<'_>,
+    ut: UpdateType,
 ) -> EmptyResult {
     // Cleanup cipher data, like removing the 'Response' key.
     // This key is somewhere generated during Javascript so no way for us this fix this.
@@ -559,8 +615,6 @@ pub async fn update_cipher_from_data(
         json_data
     }
 
-    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
-
     let is_blob = data.is_blob();
     data.validate_content(is_blob)?;
     validate_cipher_update(cipher, &data, headers, conn, ut).await?;
@@ -1155,7 +1209,9 @@ async fn put_cipher_share_selected(
         err!("You must select at least one collection.")
     }
     for cipher in &data.ciphers {
-        cipher.validate_content(cipher.is_blob())?;
+        let is_blob = cipher.is_blob();
+        cipher.validate_content(is_blob)?;
+        cipher.validate_type_data(is_blob)?;
     }
     for cipher in &data.ciphers {
         validate_encrypted_for_user(cipher, &headers.user.uuid)?;
@@ -1223,7 +1279,9 @@ async fn share_cipher_by_uuid(
     };
 
     // For the same reason, the other checks of saving
-    data.cipher.validate_content(data.cipher.is_blob())?;
+    let is_blob = data.cipher.is_blob();
+    data.cipher.validate_content(is_blob)?;
+    data.cipher.validate_type_data(is_blob)?;
     validate_cipher_update(&cipher, &data.cipher, headers, conn, ut).await?;
 
     let mut shared_to_collections = vec![];

src/api/core/emergency_access.rs

@@ -6,7 +6,10 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult,
-        core::{CipherSyncData, CipherSyncType},
+        core::{
+            CipherSyncData, CipherSyncType,
+            accounts::{AuthenticationData, UnlockData},
+        },
     },
     auth::{Headers, decode_emergency_access_invite},
     db::{
@@ -615,6 +618,7 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
         "kdfMemory": grantor_user.client_kdf_memory,
         "kdfParallelism": grantor_user.client_kdf_parallelism,
         "keyEncrypted": &emergency_access.key_encrypted,
+        "salt": grantor_user.master_password_salt(),
         "object": "emergencyAccessTakeover",
     });
 
@@ -624,8 +628,13 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EmergencyAccessPasswordData {
-    new_master_password_hash: String,
-    key: String,
+    // Legacy payload
+    new_master_password_hash: Option<String>,
+    key: Option<String>,
+
+    // Current payload
+    authentication_data: Option<AuthenticationData>,
+    unlock_data: Option<UnlockData>,
 }
 
 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
@@ -638,8 +647,6 @@ async fn password_emergency_access(
     check_emergency_access_enabled()?;
 
     let data: EmergencyAccessPasswordData = data.into_inner();
-    let new_master_password_hash = &data.new_master_password_hash;
-    //let key = &data.Key;
 
     let requesting_user = headers.user;
     let Some(emergency_access) =
@@ -656,8 +663,23 @@ async fn password_emergency_access(
         err!("Grantor user not found.")
     };
 
+    let (new_master_password_hash, new_key) =
+        if let (Some(authentication_data), Some(unlock_data)) = (data.authentication_data, data.unlock_data) {
+            authentication_data.check(&grantor_user, &unlock_data)?;
+
+            if !authentication_data.kdf.matches_user(&grantor_user) {
+                err!("KDF settings do not match the grantor account")
+            }
+
+            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
+        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
+            (new_master_password_hash, new_key)
+        } else {
+            err!("Invalid request!")
+        };
+
     // change grantor_user password
-    grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
+    grantor_user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
     grantor_user.save(&conn).await?;
 
     // Disable TwoFactor providers since they will otherwise block logins

src/api/core/events.rs

@@ -242,11 +242,11 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
     Ok(())
 }
 
-pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
+pub async fn log_user_event(event_type: EventType, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
     if !CONFIG.org_events_enabled() {
         return;
     }
-    log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await;
+    log_user_event_impl(event_type as i32, user_id, device_type, None, ip, conn).await;
 }
 
 async fn log_user_event_impl(

src/api/core/organizations.rs

@@ -26,6 +26,8 @@ use crate::{
     util::{NumberOrString, convert_json_key_lcase_first},
 };
 
+use super::accounts::{AuthenticationData, UnlockData};
+
 pub fn routes() -> Vec<Route> {
     routes![
         get_organization,
@@ -2751,9 +2753,14 @@ struct OrganizationUserResetPasswordEnrollmentRequest {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserRecoverAccountRequest {
+    // Legacy payload
     new_master_password_hash: Option<String>,
     key: Option<String>,
 
+    // Current payload
+    authentication_data: Option<AuthenticationData>,
+    unlock_data: Option<UnlockData>,
+
     #[serde(default)]
     reset_master_password: bool,
     #[serde(default)]
@@ -2870,11 +2877,34 @@ async fn recover_account(
 
     let fallback_2fa_email =
         if req.reset_two_factor && CONFIG.mail_enabled() && CONFIG.email_2fa_auto_fallback() && user.verified() {
-            TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
+            TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await.is_none()
         } else {
             false
         };
 
+    // Check the new password before the email below, so that a rejected request doesn't tell the user
+    // their password was reset
+    let new_password = if req.reset_master_password {
+        let (new_master_password_hash, new_key) = if let (Some(authentication_data), Some(unlock_data)) =
+            (req.authentication_data, req.unlock_data)
+        {
+            authentication_data.check(&user, &unlock_data)?;
+
+            if !authentication_data.kdf.matches_user(&user) {
+                err!("KDF settings do not match the user account")
+            }
+
+            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
+        } else if let (Some(new_master_password_hash), Some(new_key)) = (req.new_master_password_hash, req.key) {
+            (new_master_password_hash, new_key)
+        } else {
+            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
+        };
+        Some((new_master_password_hash, new_key))
+    } else {
+        None
+    };
+
     // Sending email first ensure working email configuration and the resulting user notification.
     // Also this might add some protection against security flaws and misuse
     if let Err(e) = mail::send_admin_account_recovery(
@@ -2890,14 +2920,8 @@ async fn recover_account(
         err!(format!("Error sending user reset password email: {e:#?}"));
     }
 
-    if req.reset_master_password {
-        if let Some(key) = req.key
-            && let Some(hash) = req.new_master_password_hash
-        {
-            user.set_password(hash.as_str(), Some(key), true, None, &conn).await?;
-        } else {
-            err_code!("Unprocessable request", "Missing fields to reset password", Status::UnprocessableEntity.code);
-        }
+    if let Some((new_master_password_hash, new_key)) = new_password {
+        user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
     }
 
     if req.reset_two_factor {
@@ -2956,6 +2980,7 @@ async fn get_reset_password_details(
         "kdfIterations": user.client_kdf_iter,
         "kdfMemory": user.client_kdf_memory,
         "kdfParallelism": user.client_kdf_parallelism,
+        "masterPasswordSalt": user.master_password_salt(),
         "resetPasswordKey": member.reset_password_key,
         "encryptedPrivateKey": org.private_key,
     })))

src/api/core/public.rs

@@ -137,9 +137,13 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
 
     if CONFIG.org_groups_enabled() {
         for group_data in &data.groups {
-            let group_uuid = if let Some(group) =
+            let group_uuid = if let Some(mut group) =
                 Group::find_by_external_id_and_org(&group_data.external_id, &org_id, &conn).await
             {
+                if group.name != group_data.name {
+                    group.name = group_data.name.clone();
+                    group.save(&conn).await?;
+                }
                 group.uuid
             } else {
                 let mut group =

src/api/core/two_factor/authenticator.rs

@@ -3,11 +3,11 @@ use rocket::{Route, serde::json::Json};
 
 use crate::{
     api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code},
-    auth::{ClientIp, Headers},
+    auth::{ClientIp, Headers, two_factor},
     crypto,
     db::{
         DbConn,
-        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
+        models::{EventType, TwoFactor, TwoFactorType, UserId},
     },
     util::NumberOrString,
 };
@@ -20,27 +20,23 @@ pub fn routes() -> Vec<Route> {
 
 #[post("/two-factor/get-authenticator", data = "<data>")]
 async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: PasswordOrOtpData = data.into_inner();
     let user = headers.user;
 
     data.validate(&user, false, &conn).await?;
 
-    let type_ = TwoFactorType::Authenticator as i32;
-    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await;
+    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await;
 
     let (enabled, key) = match twofactor {
         Some(tf) => (true, tf.data),
         _ => (false, crypto::encode_random_bytes::<20>(&BASE32)),
     };
 
-    // Upstream seems to also return `userVerificationToken`, but doesn't seem to be used at all.
-    // It should help prevent TOTP disclosure if someone keeps their vault unlocked.
-    // Since it doesn't seem to be used, and also does not cause any issues, lets leave it out of the response.
-    // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Controllers/TwoFactorController.cs#L94
     Ok(Json(json!({
-        "enabled": enabled,
-        "key": key,
-        "object": "twoFactorAuthenticator"
+        "authenticator": json!({
+            "enabled": enabled,
+            "key": key,
+        }),
+        "userVerificationToken": two_factor::authenticator_token(user.uuid, key, enabled),
     })))
 }
 
@@ -49,8 +45,7 @@ async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers,
 struct EnableAuthenticatorData {
     key: String,
     token: NumberOrString,
-    master_password_hash: Option<String>,
-    otp: Option<String>,
+    user_verification_token: String,
 }
 
 #[post("/two-factor/authenticator", data = "<data>")]
@@ -61,12 +56,7 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
 
     let mut user = headers.user;
 
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
-    }
-    .validate(&user, true, &conn)
-    .await?;
+    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &key, false)?;
 
     // Validate key as base32 and 20 bytes length
     let decoded_key: Vec<u8> = if let Ok(decoded) = BASE32.decode(key.as_bytes()) {
@@ -84,12 +74,13 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     Ok(Json(json!({
-        "enabled": true,
-        "key": key,
-        "object": "twoFactorAuthenticator"
+        "authenticator": json!({
+            "enabled": true,
+            "key": key,
+        }),
     })))
 }
 
@@ -125,8 +116,7 @@ pub async fn validate_totp_code(
         err!("Invalid TOTP secret")
     };
 
-    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
-    {
+    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator, conn).await {
         Some(tf) => tf,
         _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_owned()),
     };
@@ -184,37 +174,25 @@ pub async fn validate_totp_code(
 #[serde(rename_all = "camelCase")]
 struct DisableAuthenticatorData {
     key: String,
-    master_password_hash: String,
-    r#type: NumberOrString,
+    user_verification_token: String,
 }
 
 #[delete("/two-factor/authenticator", data = "<data>")]
-async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> EmptyResult {
     let user = headers.user;
-    let type_ = data.r#type.into_i32()?;
 
-    if !user.check_valid_password(&data.master_password_hash) {
-        err!("Invalid password");
-    }
+    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &data.key, true)?;
 
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await {
         if twofactor.data == data.key {
             twofactor.delete(&conn).await?;
-            Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
-            log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
-                .await;
+            log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
         } else {
             err!(format!("TOTP key for user {} does not match recorded value, cannot deactivate", &user.email));
         }
     }
 
-    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
-        super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
-    }
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
 
-    Ok(Json(json!({
-        "enabled": false,
-        "keys": type_,
-        "object": "twoFactorProvider"
-    })))
+    Ok(())
 }

src/api/core/two_factor/duo.rs

@@ -2,12 +2,12 @@ use chrono::Utc;
 use rocket::{Route, serde::json::Json};
 
 use crate::{
-    CONFIG,
     api::{
-        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event,
-        core::two_factor::generate_recover_code,
+        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData,
+        core::log_user_event,
+        core::two_factor::{VerificationTokenData, generate_recover_code},
     },
-    auth::Headers,
+    auth::{Headers, two_factor, two_factor::DuoData},
     crypto,
     db::{
         DbConn,
@@ -18,55 +18,7 @@ use crate::{
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![get_duo, activate_duo, activate_duo_put,]
-}
-
-#[derive(Serialize, Deserialize)]
-struct DuoData {
-    host: String, // Duo API hostname
-    ik: String,   // client id
-    sk: String,   // client secret
-}
-
-impl DuoData {
-    fn global() -> Option<Self> {
-        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
-            (true, Some(host)) => Some(Self {
-                host,
-                ik: CONFIG.duo_ikey().unwrap(),
-                sk: CONFIG.duo_skey().unwrap(),
-            }),
-            _ => None,
-        }
-    }
-    fn msg(s: &str) -> Self {
-        Self {
-            host: s.into(),
-            ik: s.into(),
-            sk: s.into(),
-        }
-    }
-    fn secret() -> Self {
-        Self::msg("<global_secret>")
-    }
-    fn obscure(self) -> Self {
-        let mut host = self.host;
-        let mut ik = self.ik;
-        let mut sk = self.sk;
-
-        let digits = 4;
-        let replaced = "************";
-
-        host.replace_range(digits.., replaced);
-        ik.replace_range(digits.., replaced);
-        sk.replace_range(digits.., replaced);
-
-        Self {
-            host,
-            ik,
-            sk,
-        }
-    }
+    routes![get_duo, activate_duo, activate_duo_put, disable_duo,]
 }
 
 enum DuoStatus {
@@ -95,22 +47,19 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
 
     data.validate(&user, false, &conn).await?;
 
-    let data = get_user_duo_data(&user.uuid, &conn).await;
-
-    let (enabled, data) = match data {
+    let (enabled, duo) = match get_user_duo_data(&user.uuid, &conn).await {
         DuoStatus::Global(_) => (true, Some(DuoData::secret())),
         DuoStatus::User(data) => (true, Some(data.obscure())),
         DuoStatus::Disabled(true) => (false, Some(DuoData::msg(DISABLED_MESSAGE_DEFAULT))),
         DuoStatus::Disabled(false) => (false, None),
     };
 
-    let json = if let Some(data) = data {
+    let duo_json = if let Some(data) = duo.as_ref() {
         json!({
             "enabled": enabled,
             "host": data.host,
             "clientSecret": data.sk,
             "clientId": data.ik,
-            "object": "twoFactorDuo"
         })
     } else {
         json!({
@@ -118,11 +67,13 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
             "host": null,
             "clientSecret": null,
             "clientId": null,
-            "object": "twoFactorDuo"
         })
     };
 
-    Ok(Json(json))
+    Ok(Json(rocket::serde::json::json!({
+        "duo": duo_json,
+        "userVerificationToken": two_factor::duo_token(user.uuid, duo, enabled),
+    })))
 }
 
 #[derive(Deserialize)]
@@ -131,8 +82,7 @@ struct EnableDuoData {
     host: String,
     client_secret: String,
     client_id: String,
-    master_password_hash: Option<String>,
-    otp: Option<String>,
+    user_verification_token: String,
 }
 
 impl From<EnableDuoData> for DuoData {
@@ -159,12 +109,7 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
     let data: EnableDuoData = data.into_inner();
     let mut user = headers.user;
 
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash.clone(),
-        otp: data.otp.clone(),
-    }
-    .validate(&user, true, &conn)
-    .await?;
+    two_factor::validate_duo(&data.user_verification_token, &user.uuid, None, false)?;
 
     let (data, data_str) = if check_duo_fields_custom(&data) {
         let data_req: DuoData = data.into();
@@ -181,14 +126,15 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     Ok(Json(json!({
-        "enabled": true,
-        "host": data.host,
-        "clientSecret": data.sk,
-        "clientId": data.ik,
-        "object": "twoFactorDuo"
+        "duo": json!({
+            "enabled": true,
+            "host": data.host,
+            "clientSecret": data.sk,
+            "clientId": data.ik,
+        }),
     })))
 }
 
@@ -197,6 +143,29 @@ async fn activate_duo_put(data: Json<EnableDuoData>, headers: Headers, conn: DbC
     activate_duo(data, headers, conn).await
 }
 
+#[delete("/two-factor/duo", data = "<data>")]
+async fn disable_duo(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    let user = headers.user;
+
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Duo, &conn).await {
+        // Apply the same transformation than in `get_duo` to check we are disabling the correct one
+        let duo = match to_user_duo_data(&twofactor) {
+            DuoStatus::Global(_) => Some(DuoData::secret()),
+            DuoStatus::User(data) => Some(data.obscure()),
+            DuoStatus::Disabled(_) => None,
+        };
+
+        two_factor::validate_duo(&data.user_verification_token, &user.uuid, duo.as_ref(), true)?;
+
+        twofactor.delete(&conn).await?;
+        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    }
+
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+
+    Ok(())
+}
+
 async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) -> EmptyResult {
     use reqwest::{Method, header};
     use std::str::FromStr;
@@ -222,13 +191,15 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
 }
 
 async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
-    let type_ = TwoFactorType::Duo as i32;
-
     // If the user doesn't have an entry, disabled
-    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await else {
+    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Duo, conn).await else {
         return DuoStatus::Disabled(DuoData::global().is_some());
     };
 
+    to_user_duo_data(&twofactor)
+}
+
+fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
     // If the user has the required values, we use those
     if let Ok(data) = serde_json::from_str(&twofactor.data) {
         return DuoStatus::User(data);

src/api/core/two_factor/email.rs

@@ -5,20 +5,26 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{log_user_event, two_factor::generate_recover_code},
+        core::{
+            log_user_event,
+            two_factor::{VerificationTokenData, generate_recover_code},
+        },
     },
-    auth::{ClientHeaders, Headers},
+    auth::{ClientHeaders, Headers, two_factor},
     crypto,
     db::{
         DbConn,
-        models::{AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorType, User, UserId},
+        models::{
+            AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorIncomplete, TwoFactorType, User,
+            UserId,
+        },
     },
     error::{Error, MapResult},
     mail,
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![get_email, send_email_login, send_email, email,]
+    routes![get_email, send_email_login, send_email, email, disable_email]
 }
 
 #[derive(Deserialize)]
@@ -91,6 +97,20 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
             {
                 err!("AuthRequest doesn't exist", "Invalid device, IP or code")
             }
+        } else if let Some(device_identifier) = &data.device_identifier {
+            // iOS/Android SSO logins send the email and device id but no password hash,
+            // so accept a device that has a pending 2FA login for this user
+            if TwoFactorIncomplete::find_by_user_and_device(&user.uuid, device_identifier, &conn).await.is_none() {
+                err!(
+                    "Username or password is incorrect. Try again",
+                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
+                )
+            }
+            debug!(
+                "Email 2FA fallback: pending login. Username: {}. Device: {}.",
+                user.email,
+                device_identifier.to_string().escape_debug()
+            );
         } else {
             err!("No password hash has been submitted.")
         }
@@ -104,7 +124,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
         let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
             err!(
                 "Username or password is incorrect. Try again",
-                format!("IP: {}. Device: {device_identifier}.", client_headers.ip.ip)
+                format!("IP: {}. Device: {}.", client_headers.ip.ip, device_identifier.to_string().escape_debug())
             )
         };
 
@@ -116,8 +136,8 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
 
 /// Generate the token, save the data for later verification and send email to user
 pub async fn send_token(user_id: &UserId, conn: &DbConn) -> EmptyResult {
-    let type_ = TwoFactorType::Email as i32;
-    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, type_, conn).await.map_res("Two factor not found")?;
+    let mut twofactor =
+        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
 
     let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
 
@@ -140,18 +160,19 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
     data.validate(&user, false, &conn).await?;
 
     let (enabled, mfa_email) =
-        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await {
-            Some(x) => {
-                let twofactor_data = EmailTokenData::from_json(&x.data)?;
-                (true, json!(twofactor_data.email))
-            }
-            _ => (false, serde_json::value::Value::Null),
+        if let Some(x) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+            let twofactor_data = EmailTokenData::from_json(&x.data)?;
+            (true, Some(twofactor_data.email))
+        } else {
+            (false, None)
         };
 
-    Ok(Json(json!({
-        "email": mfa_email,
-        "enabled": enabled,
-        "object": "twoFactorEmail"
+    Ok(Json(rocket::serde::json::json!({
+        "email": rocket::serde::json::json!({
+            "enabled": enabled,
+            "email": mfa_email,
+        }),
+        "userVerificationToken": two_factor::email_token(user.uuid, mfa_email, enabled),
     })))
 }
 
@@ -160,30 +181,22 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
 struct SendEmailData {
     /// Email where 2FA codes will be sent to, can be different than user email account.
     email: String,
-    master_password_hash: Option<String>,
-    otp: Option<String>,
+    user_verification_token: String,
 }
 
 /// Send a verification email to the specified email address to check whether it exists/belongs to user.
 #[post("/two-factor/send-email", data = "<data>")]
-async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> EmptyResult {
+async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> JsonResult {
     let data: SendEmailData = data.into_inner();
     let user = headers.user;
 
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
-    }
-    .validate(&user, false, &conn)
-    .await?;
+    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email.clone(), false)?;
 
     if !CONFIG._enable_email_2fa() {
         err!("Email 2FA is disabled")
     }
 
-    let type_ = TwoFactorType::Email as i32;
-
-    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
+    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
         tf.delete(&conn).await?;
     }
 
@@ -191,12 +204,13 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
     let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));
 
     // Uses EmailVerificationChallenge as type to show that it's not verified yet.
-    let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
+    let twofactor =
+        TwoFactor::new(user.uuid.clone(), TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
     twofactor.save(&conn).await?;
 
     mail::send_token(&twofactor_data.email, &twofactor_data.last_token.map_res("Token is empty")?).await?;
 
-    Ok(())
+    Ok(Json(json!({})))
 }
 
 #[derive(Deserialize, Serialize)]
@@ -204,8 +218,7 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
 struct EmailData {
     email: String,
     token: String,
-    master_password_hash: Option<String>,
-    otp: Option<String>,
+    user_verification_token: String,
 }
 
 /// Verify email belongs to user and can be used for 2FA email codes.
@@ -214,17 +227,11 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
     let data: EmailData = data.into_inner();
     let mut user = headers.user;
 
-    // This is the last step in the verification process, delete the otp directly afterwards
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
-    }
-    .validate(&user, true, &conn)
-    .await?;
+    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email, false)?;
 
-    let type_ = TwoFactorType::EmailVerificationChallenge as i32;
-    let mut twofactor =
-        TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await.map_res("Two factor not found")?;
+    let mut twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::EmailVerificationChallenge, &conn)
+        .await
+        .map_res("Two factor not found")?;
 
     let mut email_data = EmailTokenData::from_json(&twofactor.data)?;
 
@@ -243,13 +250,26 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
-    Ok(Json(json!({
-        "email": email_data.email,
-        "enabled": "true",
-        "object": "twoFactorEmail"
-    })))
+    Ok(Json(json!({})))
+}
+
+#[delete("/two-factor/email", data = "<data>")]
+async fn disable_email(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    let user = headers.user;
+
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+        let twofactor_data = EmailTokenData::from_json(&twofactor.data)?;
+        two_factor::validate_email(&data.user_verification_token, &user.uuid, twofactor_data.email, true)?;
+
+        twofactor.delete(&conn).await?;
+        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    }
+
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+
+    Ok(())
 }
 
 /// Validate the email code when used as TwoFactor token mechanism
@@ -261,9 +281,8 @@ pub async fn validate_email_code_str(
     conn: &DbConn,
 ) -> EmptyResult {
     let mut email_data = EmailTokenData::from_json(data)?;
-    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email as i32, conn)
-        .await
-        .map_res("Two factor not found")?;
+    let mut twofactor =
+        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
     let Some(issued_token) = &email_data.last_token else {
         err!(
             format!("No token available! IP: {ip}"),

src/api/core/two_factor/mod.rs

@@ -7,10 +7,7 @@ use serde_json::Value;
 
 use crate::{
     CONFIG,
-    api::{
-        EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{log_event, log_user_event},
-    },
+    api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_event},
     auth::Headers,
     crypto,
     db::{
@@ -21,7 +18,6 @@ use crate::{
         },
     },
     mail,
-    util::NumberOrString,
 };
 
 pub mod authenticator;
@@ -69,7 +65,7 @@ pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data
 }
 
 pub fn routes() -> Vec<Route> {
-    let mut routes = routes![get_twofactor, get_recover, disable_twofactor, get_device_verification_settings];
+    let mut routes = routes![get_twofactor, get_recover, get_device_verification_settings];
 
     routes.append(&mut authenticator::routes());
     routes.append(&mut duo::routes());
@@ -81,6 +77,12 @@ pub fn routes() -> Vec<Route> {
     routes
 }
 
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct VerificationTokenData {
+    user_verification_token: String,
+}
+
 #[get("/two-factor")]
 async fn get_twofactor(headers: Headers, conn: DbConn) -> Json<Value> {
     let twofactors = TwoFactor::find_by_user(&headers.user.uuid, &conn).await;
@@ -120,45 +122,14 @@ async fn generate_recover_code(user: &mut User, conn: &DbConn) {
     }
 }
 
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct DisableTwoFactorData {
-    master_password_hash: Option<String>,
-    otp: Option<String>,
-    r#type: NumberOrString,
-}
-
-#[put("/two-factor/disable", data = "<data>")]
-async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: DisableTwoFactorData = data.into_inner();
-    let user = headers.user;
-
-    // Delete directly after a valid token has been provided
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
+/// Call after a 2FA provider, or one of its keys, was removed. No remembered device may keep skipping
+/// the providers that are left, and once every provider is gone the 2FA policy applies.
+pub async fn check_2fa_state(user: &User, device_type: i32, ip: &std::net::IpAddr, conn: &DbConn) -> EmptyResult {
+    Device::clear_twofactor_remember_by_user(&user.uuid, conn).await?;
+    if TwoFactor::find_by_user(&user.uuid, conn).await.is_empty() {
+        enforce_2fa_policy(user, &user.uuid, device_type, ip, conn).await?;
     }
-    .validate(&user, true, &conn)
-    .await?;
-
-    let type_ = data.r#type.into_i32()?;
-
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
-        twofactor.delete(&conn).await?;
-        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
-        log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
-            .await;
-    }
-
-    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
-        enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
-    }
-
-    Ok(Json(json!({
-        "enabled": false,
-        "type": type_,
-        "object": "twoFactorProvider"
-    })))
+    Ok(())
 }
 
 pub async fn enforce_2fa_policy(

src/api/core/two_factor/protected_actions.rs

@@ -72,8 +72,7 @@ async fn request_otp(headers: Headers, conn: DbConn) -> EmptyResult {
     let user = headers.user;
 
     // Only one Protected Action per user is allowed to take place, delete the previous one
-    if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions as i32, &conn).await
-    {
+    if let Some(pa) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::ProtectedActions, &conn).await {
         let pa_data = ProtectedActionData::from_json(&pa.data)?;
         let elapsed = pa_data.time_since_sent().num_seconds();
         let delay = 30;
@@ -125,7 +124,7 @@ pub async fn validate_protected_action_otp(
     delete_if_valid: bool,
     conn: &DbConn,
 ) -> EmptyResult {
-    let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions as i32, conn)
+    let mut pa = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::ProtectedActions, conn)
         .await
         .map_res("Protected action token not found, try sending the code again or restart the process")?;
     let mut pa_data = ProtectedActionData::from_json(&pa.data)?;

src/api/core/two_factor/webauthn.rs

@@ -1,4 +1,4 @@
-use std::{str::FromStr, sync::LazyLock, time::Duration};
+use std::{collections::HashSet, str::FromStr, sync::LazyLock, time::Duration};
 
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
@@ -18,16 +18,18 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{log_user_event, two_factor::generate_recover_code},
+        core::{
+            log_user_event,
+            two_factor::{VerificationTokenData, generate_recover_code},
+        },
     },
-    auth::Headers,
+    auth::{Headers, two_factor},
     crypto::ct_eq,
     db::{
         DbConn,
-        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
+        models::{EventType, TwoFactor, TwoFactorType, UserId},
     },
     error::Error,
-    util::NumberOrString,
 };
 
 static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
@@ -45,7 +47,14 @@ static WEBAUTHN: LazyLock<Webauthn> = LazyLock::new(|| {
 });
 
 pub fn routes() -> Vec<Route> {
-    routes![get_webauthn, generate_webauthn_challenge, activate_webauthn, activate_webauthn_put, delete_webauthn,]
+    routes![
+        get_webauthn,
+        generate_webauthn_challenge,
+        activate_webauthn,
+        activate_webauthn_put,
+        delete_webauthn,
+        delete_webauthns
+    ]
 }
 
 // Some old u2f structs still needed for migrating from u2f to WebAuthn
@@ -119,34 +128,36 @@ async fn get_webauthn(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbC
     data.validate(&user, false, &conn).await?;
 
     let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
+    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
     let registrations_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect();
 
     Ok(Json(json!({
-        "enabled": enabled,
-        "keys": registrations_json,
-        "object": "twoFactorWebAuthn"
+        "webAuthn": json!({
+            "enabled": enabled,
+            "keys": registrations_json,
+        }),
+        "userVerificationToken": two_factor::webauthn_token(user.uuid, keys, enabled),
     })))
 }
 
 #[post("/two-factor/get-webauthn-challenge", data = "<data>")]
-async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let data: PasswordOrOtpData = data.into_inner();
+async fn generate_webauthn_challenge(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> JsonResult {
     let user = headers.user;
 
-    data.validate(&user, false, &conn).await?;
-
-    let registrations = get_webauthn_registrations(&user.uuid, &conn)
-        .await?
-        .1
+    let (enabled, registrations) = get_webauthn_registrations(&user.uuid, &conn).await?;
+    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
+    let creds = registrations
         .into_iter()
         .map(|r| r.credential.cred_id().to_owned()) // We return the credentialIds to the clients to avoid double registering
         .collect();
 
+    two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, enabled)?;
+
     let (mut challenge, state) = WEBAUTHN.start_passkey_registration(
         Uuid::from_str(&user.uuid).expect("Failed to parse UUID"), // Should never fail
         &user.email,
         user.display_name(),
-        Some(registrations),
+        Some(creds),
     )?;
 
     let mut state = serde_json::to_value(&state)?;
@@ -166,17 +177,19 @@ async fn generate_webauthn_challenge(data: Json<PasswordOrOtpData>, headers: Hea
     let mut challenge_value = serde_json::to_value(challenge.public_key)?;
     challenge_value["status"] = "ok".into();
     challenge_value["errorMessage"] = "".into();
-    Ok(Json(challenge_value))
+
+    Ok(Json(json!({
+        "options": challenge_value
+    })))
 }
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EnableWebauthnData {
-    id: NumberOrString, // 1..5
+    id: i32,
     name: String,
     device_response: RegisterPublicKeyCredentialCopy,
-    master_password_hash: Option<String>,
-    otp: Option<String>,
+    user_verification_token: String,
 }
 
 #[derive(Debug, Deserialize)]
@@ -257,16 +270,14 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
     let data: EnableWebauthnData = data.into_inner();
     let mut user = headers.user;
 
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash,
-        otp: data.otp,
-    }
-    .validate(&user, true, &conn)
-    .await?;
+    let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
+    let keys: Vec<i32> = registrations.iter().map(|r| r.id).collect();
+    two_factor::validate_webauthn(&data.user_verification_token, &user.uuid, &keys, !keys.is_empty())?;
 
     // Retrieve and delete the saved challenge state
-    let type_ = TwoFactorType::WebauthnRegisterChallenge as i32;
-    let state = if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
+    let state = if let Some(tf) =
+        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::WebauthnRegisterChallenge, &conn).await
+    {
         let state: PasskeyRegistration = serde_json::from_str(&tf.data)?;
         tf.delete(&conn).await?;
         state
@@ -277,10 +288,9 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
     // Verify the credentials with the saved state
     let credential = WEBAUTHN.finish_passkey_registration(&data.device_response.into(), &state)?;
 
-    let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn).await?.1;
     // TODO: Check for repeated ID's
     registrations.push(WebauthnRegistration {
-        id: data.id.into_i32()?,
+        id: data.id,
         name: data.name,
         migrated: false,
 
@@ -293,13 +303,13 @@ async fn activate_webauthn(data: Json<EnableWebauthnData>, headers: Headers, con
         .await?;
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
-    let keys_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect();
     Ok(Json(json!({
-        "enabled": true,
-        "keys": keys_json,
-        "object": "twoFactorU2f"
+        "webAuthn": json!({
+            "enabled": true,
+            "keys": registrations.iter().map(WebauthnRegistration::to_json).collect::<Vec<Value>>(),
+        }),
     })))
 }
 
@@ -310,58 +320,87 @@ async fn activate_webauthn_put(data: Json<EnableWebauthnData>, headers: Headers,
 
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct DeleteU2FData {
-    id: NumberOrString,
-    master_password_hash: String,
+struct DeleteWebauthnData {
+    id: i32,
+    user_verification_token: String,
 }
 
 #[delete("/two-factor/webauthn", data = "<data>")]
-async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, conn: DbConn) -> JsonResult {
-    let id = data.id.into_i32()?;
-    if !headers.user.check_valid_password(&data.master_password_hash) {
-        err!("Invalid password");
-    }
+async fn delete_webauthn(data: Json<DeleteWebauthnData>, headers: Headers, conn: DbConn) -> JsonResult {
+    inner_delete_webauthns(&data.user_verification_token, |key| key.id != data.id, headers, &conn).await
+}
 
-    let Some(mut tf) =
-        TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::Webauthn as i32, &conn).await
-    else {
+#[delete("/two-factor/webauthn/all", data = "<data>")]
+async fn delete_webauthns(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> JsonResult {
+    inner_delete_webauthns(&data.user_verification_token, |_| false, headers, &conn).await
+}
+
+async fn inner_delete_webauthns(
+    token: &str,
+    retain: impl Fn(&WebauthnRegistration) -> bool,
+    headers: Headers,
+    conn: &DbConn,
+) -> JsonResult {
+    let user = headers.user;
+
+    let Some(mut tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Webauthn, conn).await else {
         err!("Webauthn data not found!")
     };
 
-    let mut data: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;
+    let mut keys: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?;
+    let keys_id: Vec<i32> = keys.iter().map(|r| r.id).collect();
 
-    let Some(item_pos) = data.iter().position(|r| r.id == id) else {
+    two_factor::validate_webauthn(token, &user.uuid, &keys_id, true)?;
+
+    let mut removed: HashSet<Vec<u8>> = HashSet::new();
+    let mut migrated = false;
+
+    keys.retain(|key| {
+        let retained = retain(key);
+        if !retained {
+            removed.insert(key.credential.cred_id().to_vec());
+            migrated = migrated || key.migrated;
+        }
+        retained
+    });
+
+    if removed.is_empty() {
         err!("Webauthn entry not found")
-    };
+    }
 
-    let removed_item = data.remove(item_pos);
-    tf.data = serde_json::to_string(&data)?;
-    tf.save(&conn).await?;
-    drop(tf);
-    Device::clear_twofactor_remember_by_user(&headers.user.uuid, &conn).await?;
+    if keys.is_empty() {
+        tf.delete(conn).await?;
+        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, conn).await;
+    } else {
+        tf.data = serde_json::to_string(&keys)?;
+        tf.save(conn).await?;
+        drop(tf);
+    }
 
     // If entry is migrated from u2f, delete the u2f entry as well
-    if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await
-    {
-        let mut data: Vec<U2FRegistration> = if let Ok(d) = serde_json::from_str(&u2f.data) {
-            d
-        } else {
+    if migrated && let Some(mut u2f) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::U2f, conn).await {
+        let Ok(mut data) = serde_json::from_str::<Vec<U2FRegistration>>(&u2f.data) else {
             err!("Error parsing U2F data")
         };
 
-        data.retain(|r| r.reg.key_handle != removed_item.credential.cred_id().as_slice());
-        let new_data_str = serde_json::to_string(&data)?;
+        data.retain(|old| !removed.contains(&old.reg.key_handle));
 
-        u2f.data = new_data_str;
-        u2f.save(&conn).await?;
+        if data.is_empty() {
+            u2f.delete(conn).await?;
+        } else {
+            let new_data_str = serde_json::to_string(&data)?;
+            u2f.data = new_data_str;
+            u2f.save(conn).await?;
+        }
     }
 
-    let keys_json: Vec<Value> = data.iter().map(WebauthnRegistration::to_json).collect();
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, conn).await?;
 
     Ok(Json(json!({
-        "enabled": true,
-        "keys": keys_json,
-        "object": "twoFactorU2f"
+        "webAuthn": json!({
+            "enabled": !keys.is_empty(),
+            "keys": keys.iter().map(WebauthnRegistration::to_json).collect::<Vec<Value>>(),
+        }),
     })))
 }
 
@@ -369,8 +408,7 @@ pub async fn get_webauthn_registrations(
     user_id: &UserId,
     conn: &DbConn,
 ) -> Result<(bool, Vec<WebauthnRegistration>), Error> {
-    let type_ = TwoFactorType::Webauthn as i32;
-    match TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
+    match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Webauthn, conn).await {
         Some(tf) => Ok((tf.enabled, serde_json::from_str(&tf.data)?)),
         None => Ok((false, Vec::new())), // If no data, return empty list
     }
@@ -417,8 +455,9 @@ pub async fn generate_webauthn_login(user_id: &UserId, conn: &DbConn) -> JsonRes
 }
 
 pub async fn validate_webauthn_login(user_id: &UserId, response: &str, conn: &DbConn) -> EmptyResult {
-    let type_ = TwoFactorType::WebauthnLoginChallenge as i32;
-    let mut state = if let Some(tf) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await {
+    let mut state = if let Some(tf) =
+        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::WebauthnLoginChallenge, conn).await
+    {
         let state: PasskeyAuthentication = serde_json::from_str(&tf.data)?;
         tf.delete(conn).await?;
         state

src/api/core/two_factor/yubikey.rs

@@ -10,9 +10,12 @@ use crate::{
     CONFIG,
     api::{
         EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{log_user_event, two_factor::generate_recover_code},
+        core::{
+            log_user_event,
+            two_factor::{VerificationTokenData, generate_recover_code},
+        },
     },
-    auth::Headers,
+    auth::{Headers, two_factor},
     db::{
         DbConn,
         models::{EventType, TwoFactor, TwoFactorType},
@@ -22,7 +25,7 @@ use crate::{
 };
 
 pub fn routes() -> Vec<Route> {
-    routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
+    routes![generate_yubikey, activate_yubikey, activate_yubikey_put, delete_yubikeys,]
 }
 
 struct HttpClientTransport {
@@ -60,8 +63,7 @@ struct EnableYubikeyData {
     key4: Option<String>,
     key5: Option<String>,
     nfc: bool,
-    master_password_hash: Option<String>,
-    otp: Option<String>,
+    user_verification_token: String,
 }
 
 #[derive(Deserialize, Serialize, Debug)]
@@ -125,48 +127,29 @@ async fn generate_yubikey(data: Json<PasswordOrOtpData>, headers: Headers, conn:
     data.validate(&user, false, &conn).await?;
 
     let user_id = &user.uuid;
-    let yubikey_type = TwoFactorType::YubiKey as i32;
 
-    let r = TwoFactor::find_by_user_and_type(user_id, yubikey_type, &conn).await;
-
-    if let Some(r) = r {
-        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
-
-        let mut result = jsonify_yubikeys(yubikey_metadata.keys);
-
-        result["enabled"] = Value::Bool(true);
-        result["nfc"] = Value::Bool(yubikey_metadata.nfc);
-        result["object"] = Value::String("twoFactorU2f".to_owned());
-
-        Ok(Json(result))
-    } else {
-        Ok(Json(json!({
-            "enabled": false,
-            "object": "twoFactorU2f",
-        })))
-    }
+    let (enabled, keys, yubikey_json) =
+        if let Some(r) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::YubiKey, &conn).await {
+            let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
+            let enabled = !yubikey_metadata.keys.is_empty();
+            let mut result = jsonify_yubikeys(yubikey_metadata.keys.clone());
+            result["enabled"] = Value::Bool(enabled);
+            result["nfc"] = Value::Bool(yubikey_metadata.nfc);
+            (enabled, yubikey_metadata.keys, result)
+        } else {
+            (false, Vec::new(), json!({"enabled": false}))
+        };
+    Ok(Json(json!({
+        "yubiKey": yubikey_json,
+        "userVerificationToken": two_factor::yubikey_token(user.uuid, keys, enabled),
+    })))
 }
 
 #[post("/two-factor/yubikey", data = "<data>")]
 async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn: DbConn) -> JsonResult {
     let data: EnableYubikeyData = data.into_inner();
-    let mut user = headers.user;
-
-    PasswordOrOtpData {
-        master_password_hash: data.master_password_hash.clone(),
-        otp: data.otp.clone(),
-    }
-    .validate(&user, true, &conn)
-    .await?;
-
-    // Check if we already have some data
-    let mut yubikey_data =
-        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey as i32, &conn).await {
-            Some(data) => data,
-            None => TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new()),
-        };
-
     let yubikeys = parse_yubikeys(&data);
+    let mut user = headers.user;
 
     if yubikeys.is_empty() {
         // Return an error to prevent saving empty keys which would cause users not being able to login anymore.
@@ -174,6 +157,17 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
         err!("A key is required.");
     }
 
+    // Check if we already have some data
+    let mut yubikey_data =
+        if let Some(yd) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
+            let ym: YubikeyMetadata = serde_json::from_str(&yd.data)?;
+            two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &ym.keys, !ym.keys.is_empty())?;
+            yd
+        } else {
+            two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &Vec::new(), false)?;
+            TwoFactor::new(user.uuid.clone(), TwoFactorType::YubiKey, String::new())
+        };
+
     // Ensure they are valid OTPs
     for yubikey in &yubikeys {
         if yubikey.is_empty() || yubikey.len() == 12 {
@@ -195,15 +189,12 @@ async fn activate_yubikey(data: Json<EnableYubikeyData>, headers: Headers, conn:
 
     generate_recover_code(&mut user, &conn).await;
 
-    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
 
     let mut result = jsonify_yubikeys(yubikey_metadata.keys);
-
     result["enabled"] = Value::Bool(true);
     result["nfc"] = Value::Bool(yubikey_metadata.nfc);
-    result["object"] = Value::String("twoFactorU2f".to_owned());
-
-    Ok(Json(result))
+    Ok(Json(json!({"yubiKey": result})))
 }
 
 #[put("/two-factor/yubikey", data = "<data>")]
@@ -211,6 +202,23 @@ async fn activate_yubikey_put(data: Json<EnableYubikeyData>, headers: Headers, c
     activate_yubikey(data, headers, conn).await
 }
 
+#[delete("/two-factor/yubikey", data = "<data>")]
+async fn delete_yubikeys(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    let user = headers.user;
+
+    if let Some(r) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::YubiKey, &conn).await {
+        let yubikey_metadata: YubikeyMetadata = serde_json::from_str(&r.data)?;
+        two_factor::validate_yubikey(&data.user_verification_token, &user.uuid, &yubikey_metadata.keys, true)?;
+
+        r.delete(&conn).await?;
+        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    }
+
+    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+
+    Ok(())
+}
+
 pub async fn validate_yubikey_login(response: &str, twofactor_data: &str) -> EmptyResult {
     if response.len() != 44 {
         err!("Invalid Yubikey OTP length");

src/api/identity.rs

@@ -118,7 +118,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
         match &login_result {
             Ok(_) => {
                 log_user_event(
-                    EventType::UserLoggedIn as i32,
+                    EventType::UserLoggedIn,
                     &user_id,
                     client_header.device_type,
                     &client_header.ip.ip,
@@ -128,8 +128,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
             }
             Err(e) => {
                 if let Some(ev) = e.get_event() {
-                    log_user_event(ev.event as i32, &user_id, client_header.device_type, &client_header.ip.ip, &conn)
-                        .await;
+                    log_user_event(ev.event, &user_id, client_header.device_type, &client_header.ip.ip, &conn).await;
                 }
             }
         }
@@ -546,7 +545,7 @@ async fn authenticated_response(
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "MasterKeyEncryptedUserKey": user.akey,
             "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.email
+            "Salt": user.master_password_salt()
         })
     } else {
         Value::Null
@@ -692,7 +691,7 @@ async fn user_api_key_login(
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "MasterKeyEncryptedUserKey": user.akey,
             "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.email
+            "Salt": user.master_password_salt()
         })
     } else {
         Value::Null
@@ -882,7 +881,7 @@ async fn twofactor_auth(
 
             enforce_2fa_policy(user, &user.uuid, device.atype, &ip.ip, conn).await?;
 
-            log_user_event(EventType::UserRecovered2fa as i32, &user.uuid, device.atype, &ip.ip, conn).await;
+            log_user_event(EventType::UserRecovered2fa, &user.uuid, device.atype, &ip.ip, conn).await;
 
             if CONFIG.mail_enabled()
                 && let Err(e) =
@@ -952,7 +951,7 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
             }
 
             Some(tf_type @ TwoFactorType::YubiKey) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
+                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
                     err!("No YubiKey devices registered")
                 };
 
@@ -964,7 +963,7 @@ async fn json_err_twofactor(providers: &[i32], user: &User, data: &ConnectData,
             }
 
             Some(tf_type @ TwoFactorType::Email) => {
-                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type as i32, conn).await else {
+                let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, tf_type, conn).await else {
                     err!("No twofactor email registered")
                 };
 

src/api/mod.rs

@@ -23,7 +23,7 @@ pub use crate::api::{
     icons::routes as icons_routes,
     identity::routes as identity_routes,
     notifications::routes as notifications_routes,
-    notifications::{AnonymousNotify, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
+    notifications::{AnonymousNotify, LogOutReason, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
     push::{
         push_cipher_update, push_folder_update, push_logout, push_send_update, push_user_update, register_push_device,
         unregister_push_device,
@@ -46,7 +46,7 @@ pub type JsonResult = ApiResult<Json<Value>>;
 pub type EmptyResult = ApiResult<()>;
 
 // Common structs representing JSON data received
-#[derive(Deserialize)]
+#[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct PasswordOrOtpData {
     #[serde(alias = "MasterPasswordHash")]

src/api/notifications.rs

@@ -1,7 +1,7 @@
 use std::{
     net::IpAddr,
     sync::{Arc, LazyLock},
-    time::Duration,
+    time::{Duration, Instant},
 };
 
 use chrono::{NaiveDateTime, Utc};
@@ -41,6 +41,14 @@ pub static WS_ANONYMOUS_SUBSCRIPTIONS: LazyLock<Arc<AnonymousWebSocketSubscripti
 /// One connection is needed per pending login request, several at once are only expected behind NAT.
 const MAX_ANONYMOUS_CONNECTIONS_PER_IP: u32 = 25;
 
+/// How often a Ping is sent to the client.
+const WS_PING_INTERVAL: Duration = Duration::from_secs(15);
+
+/// Close the connection if nothing, not even a Pong, was received from the client for this long.
+/// Otherwise half-open connections (client gone without a FIN, e.g. behind a proxy or NAT) are kept forever.
+/// Same as the default `ClientTimeoutInterval` of ASP.NET Core SignalR, which the official server uses.
+const WS_CLIENT_TIMEOUT: Duration = Duration::from_secs(30);
+
 static NOTIFICATIONS_DISABLED: LazyLock<bool> = LazyLock::new(|| !CONFIG.enable_websocket() && !CONFIG.push_enabled());
 
 pub fn routes() -> Vec<Route> {
@@ -156,12 +164,16 @@ fn websockets_hub<'r>(
         rocket_ws::Stream! { ws => {
             let mut ws = ws;
             let _guard = guard;
-            let mut interval = tokio::time::interval(Duration::from_secs(15));
+            let mut interval = tokio::time::interval(WS_PING_INTERVAL);
+            let mut last_received = Instant::now();
             loop {
                 tokio::select! {
                     res = ws.next() =>  {
                         match res {
                             Some(Ok(message)) => {
+                                // Any message, including a Pong, means the client is still there
+                                last_received = Instant::now();
+
                                 match message {
                                     // Respond to any pings
                                     Message::Ping(ping) => yield Message::Pong(ping),
@@ -195,7 +207,13 @@ fn websockets_hub<'r>(
                         }
                     }
 
-                    _ = interval.tick() => yield Message::Ping(create_ping())
+                    _ = interval.tick() => {
+                        // The client stopped responding without closing the connection, drop it
+                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
+                            break;
+                        }
+                        yield Message::Ping(create_ping());
+                    }
                 }
             }
         }}
@@ -229,12 +247,16 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
         rocket_ws::Stream! { ws => {
             let mut ws = ws;
             let _guard = guard;
-            let mut interval = tokio::time::interval(Duration::from_secs(15));
+            let mut interval = tokio::time::interval(WS_PING_INTERVAL);
+            let mut last_received = Instant::now();
             loop {
                 tokio::select! {
                     res = ws.next() =>  {
                         match res {
                             Some(Ok(message)) => {
+                                // Any message, including a Pong, means the client is still there
+                                last_received = Instant::now();
+
                                 match message {
                                     // Respond to any pings
                                     Message::Ping(ping) => yield Message::Pong(ping),
@@ -268,7 +290,13 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
                         }
                     }
 
-                    _ = interval.tick() => yield Message::Ping(create_ping())
+                    _ = interval.tick() => {
+                        // The client stopped responding without closing the connection, drop it
+                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
+                            break;
+                        }
+                        yield Message::Ping(create_ping());
+                    }
                 }
             }
         }}
@@ -383,23 +411,35 @@ impl WebSocketUsers {
     }
 
     pub async fn send_logout(&self, user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+        self.send_logout_with_reason(user, acting_device, None, conn).await;
+    }
+
+    /// A logout that clients may handle differently depending on `reason`
+    pub async fn send_logout_with_reason(
+        &self,
+        user: &User,
+        acting_device: Option<&Device>,
+        reason: Option<LogOutReason>,
+        conn: &DbConn,
+    ) {
         // Skip any processing if both WebSockets and Push are not active
         if *NOTIFICATIONS_DISABLED {
             return;
         }
         let acting_device_id = acting_device.map(|d| d.uuid.clone());
-        let data = create_update(
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
-            UpdateType::LogOut,
-            acting_device_id,
-        );
+        let mut payload =
+            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))];
+        if let Some(reason) = reason {
+            payload.push(("Reason".into(), (reason as i32).into()));
+        }
+        let data = create_update(payload, UpdateType::LogOut, acting_device_id);
 
         if CONFIG.enable_websocket() {
             self.send_update(&user.uuid, &data).await;
         }
 
         if CONFIG.push_enabled() {
-            push_logout(user, acting_device, conn).await;
+            push_logout(user, acting_device, reason, conn).await;
         }
     }
 
@@ -667,6 +707,14 @@ fn create_ping() -> Vec<u8> {
     serialize(&Value::Array(vec![6.into()]))
 }
 
+/// Why a logout was pushed, absent for a plain one. `KdfChange` isn't sent yet.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Enums/PushNotificationLogOutReason.cs#L3-L7>
+#[derive(Copy, Clone, Eq, PartialEq)]
+pub enum LogOutReason {
+    KeyRotation = 1,
+}
+
 // https://github.com/bitwarden/server/blob/375af7c43b10d9da03525d41452f95de3f921541/src/Core/Enums/PushType.cs
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum UpdateType {

src/api/push.rs

@@ -12,7 +12,7 @@ use tokio::sync::RwLock;
 
 use crate::{
     CONFIG,
-    api::{ApiResult, EmptyResult, UpdateType},
+    api::{ApiResult, EmptyResult, LogOutReason, UpdateType},
     db::{
         DbConn,
         models::{AuthRequestId, Cipher, Device, Folder, PushId, Send, User, UserId},
@@ -188,7 +188,7 @@ pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device
     }
 }
 
-pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+pub async fn push_logout(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>, conn: &DbConn) {
     if Device::check_user_has_push_device(&user.uuid, conn).await {
         tokio::task::spawn(send_to_push_relay(json!({
             "userId": user.uuid,
@@ -198,7 +198,8 @@ pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbC
             "type": UpdateType::LogOut as i32,
             "payload": {
                 "userId": user.uuid,
-                "date": format_date(&user.updated_at)
+                "date": format_date(&user.updated_at),
+                "reason": reason.map(|r| r as i32),
             },
             "clientType": null,
             "installationId": null

src/auth.rs

@@ -1,3 +1,6 @@
+#[path = "auth/two_factor.rs"]
+pub mod two_factor;
+
 #[path = "auth/send.rs"]
 pub mod send;
 pub type SendTokens = send::SendTokens;
@@ -31,7 +34,7 @@ use crate::{
         models::{
             AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
             EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
-            SendFileId, SendId, User, UserId, UserStampException,
+            SendFileId, SendId, User, UserId,
         },
     },
     error::Error,
@@ -682,31 +685,12 @@ impl<'r> FromRequest<'r> for Headers {
         };
 
         if user.security_stamp != claims.sstamp {
-            if let Some(stamp_exception) =
-                user.stamp_exception.as_deref().and_then(|s| serde_json::from_str::<UserStampException>(s).ok())
-            {
-                let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                    err_handler!("Error getting current route for stamp exception")
-                };
+            let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
+                err_handler!("Error getting current route for stamp exception")
+            };
 
-                // Check if the stamp exception has expired first.
-                // Then, check if the current route matches any of the allowed routes.
-                // After that check the stamp in exception matches the one in the claims.
-                if Utc::now().timestamp() > stamp_exception.expire {
-                    // If the stamp exception has been expired remove it from the database.
-                    // This prevents checking this stamp exception for new requests.
-                    let mut user = user;
-                    user.reset_stamp_exception();
-                    if let Err(e) = user.save(&conn).await {
-                        error!("Error updating user: {e:#?}");
-                    }
-                    err_handler!("Stamp exception is expired")
-                } else if !stamp_exception.routes.contains(&current_route.to_owned()) {
-                    err_handler!("Invalid security stamp: Current route and exception route do not match")
-                } else if stamp_exception.security_stamp != claims.sstamp {
-                    err_handler!("Invalid security stamp for matched stamp exception")
-                }
-            } else {
+            // Expired exceptions are only dropped on reset; writing them back here could undo a newer reset
+            if !user.stamp_exceptions().iter().any(|e| e.allows(&claims.sstamp, current_route)) {
                 err_handler!("Invalid security stamp")
             }
         }

src/auth/two_factor.rs

@@ -0,0 +1,281 @@
+use chrono::{TimeDelta, Utc};
+use serde::{de::DeserializeOwned, ser::Serialize};
+use std::sync::LazyLock;
+
+use crate::{
+    CONFIG,
+    api::{ApiResult, EmptyResult},
+    auth::{decode_jwt, encode_jwt},
+    db::models::UserId,
+};
+
+static JWT_2FA_AUTH_ISSUER: LazyLock<String> = LazyLock::new(|| format!("{}|api.2fa", CONFIG.domain_origin()));
+
+#[derive(Serialize, Deserialize)]
+pub struct TwoFactorClaims<T> {
+    // Not before
+    pub nbf: i64,
+    // Expiration time
+    pub exp: i64,
+    // Issuer
+    pub iss: String,
+    // Subject
+    pub sub: UserId,
+
+    pub enabled: bool,
+
+    pub claims: T,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AuthenticatorClaims {
+    #[serde(rename = "authenticator_key")]
+    pub key: String,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct DuoClaims {
+    #[serde(rename = "duo_data")]
+    pub data: Option<DuoData>,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WebauthnClaims {
+    #[serde(rename = "webauthn_keys")]
+    pub keys: Vec<i32>,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct YubikeyClaims {
+    #[serde(rename = "yubi_keys")]
+    pub keys: Vec<String>,
+}
+
+#[derive(Serialize, Deserialize, PartialEq)]
+pub struct DuoData {
+    pub host: String, // Duo API hostname
+    pub ik: String,   // client id
+    pub sk: String,   // client secret
+}
+
+impl DuoData {
+    pub fn global() -> Option<Self> {
+        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
+            (true, Some(host)) => Some(Self {
+                host,
+                ik: CONFIG.duo_ikey().unwrap(),
+                sk: CONFIG.duo_skey().unwrap(),
+            }),
+            _ => None,
+        }
+    }
+    pub fn msg(s: &str) -> Self {
+        Self {
+            host: s.into(),
+            ik: s.into(),
+            sk: s.into(),
+        }
+    }
+    pub fn secret() -> Self {
+        Self::msg("<global_secret>")
+    }
+    pub fn obscure(self) -> Self {
+        let mut host = self.host;
+        let mut ik = self.ik;
+        let mut sk = self.sk;
+
+        let digits = 4;
+        let replaced = "************";
+
+        host.replace_range(digits.., replaced);
+        ik.replace_range(digits.., replaced);
+        sk.replace_range(digits.., replaced);
+
+        Self {
+            host,
+            ik,
+            sk,
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EmailClaims {
+    pub email: Option<String>,
+}
+
+fn token<T: Serialize>(user_id: UserId, enabled: bool, claims: T) -> String {
+    let time_now = Utc::now();
+    let claims = TwoFactorClaims {
+        nbf: time_now.timestamp(),
+        exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(),
+        iss: JWT_2FA_AUTH_ISSUER.to_string(),
+        sub: user_id,
+        enabled,
+        claims,
+    };
+    encode_jwt(&claims)
+}
+
+fn validate<T: DeserializeOwned>(token: &str, user_id: &UserId, enabled: bool) -> ApiResult<T> {
+    match decode_jwt::<TwoFactorClaims<T>>(token, JWT_2FA_AUTH_ISSUER.to_string()) {
+        Ok(claims) => {
+            if claims.sub != *user_id {
+                err!("Invalid verification token: Invalid user");
+            }
+            if claims.enabled != enabled {
+                err!("Invalid verification token: Invalid state");
+            }
+            Ok(claims.claims)
+        }
+        Err(err) => err!(format!("Failed to decode verification token: {err}")),
+    }
+}
+
+pub fn authenticator_token(user_id: UserId, key: String, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        AuthenticatorClaims {
+            key,
+        },
+    )
+}
+
+pub fn validate_authenticator(token: &str, user_id: &UserId, key: &str, enabled: bool) -> EmptyResult {
+    let claims = validate::<AuthenticatorClaims>(token, user_id, enabled)?;
+    if claims.key != key {
+        err!("Invalid verification token: Invalid key");
+    }
+    Ok(())
+}
+
+pub fn duo_token(user_id: UserId, data: Option<DuoData>, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        DuoClaims {
+            data,
+        },
+    )
+}
+
+// When disabling we check that it's the correct data
+pub fn validate_duo(token: &str, user_id: &UserId, data: Option<&DuoData>, enabled: bool) -> EmptyResult {
+    let claims = validate::<DuoClaims>(token, user_id, enabled)?;
+    if enabled && claims.data.as_ref() != data {
+        err!("Invalid verification token: Invalid duo data");
+    }
+    Ok(())
+}
+
+pub fn email_token(user_id: UserId, email: Option<String>, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        EmailClaims {
+            email,
+        },
+    )
+}
+
+// When disabling we check that it's the correct `email`
+pub fn validate_email(token: &str, user_id: &UserId, email: String, enabled: bool) -> EmptyResult {
+    let claims = validate::<EmailClaims>(token, user_id, enabled)?;
+    if enabled && claims.email != Some(email) {
+        err!("Invalid verification token: Invalid email");
+    }
+    Ok(())
+}
+
+pub fn webauthn_token(user_id: UserId, keys: Vec<i32>, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        WebauthnClaims {
+            keys,
+        },
+    )
+}
+
+pub fn validate_webauthn(token: &str, user_id: &UserId, keys: &[i32], enabled: bool) -> EmptyResult {
+    let claims = validate::<WebauthnClaims>(token, user_id, enabled)?;
+    if keys != claims.keys {
+        err!("Invalid verification token: Invalid keys");
+    }
+    Ok(())
+}
+
+pub fn yubikey_token(user_id: UserId, keys: Vec<String>, enabled: bool) -> String {
+    token(
+        user_id,
+        enabled,
+        YubikeyClaims {
+            keys,
+        },
+    )
+}
+
+pub fn validate_yubikey(token: &str, user_id: &UserId, keys: &Vec<String>, enabled: bool) -> EmptyResult {
+    let claims = validate::<YubikeyClaims>(token, user_id, enabled)?;
+    if *keys != claims.keys {
+        err!("Invalid verification token: Invalid keys");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{Value, from_value, to_value};
+
+    fn token<T: Serialize>(claims: T) -> Value {
+        to_value(TwoFactorClaims {
+            nbf: 0,
+            exp: 0,
+            iss: String::new(),
+            sub: UserId::from(String::from("4ff0f0a4-0aa4-4c1d-9d43-1f2bd4d5e8b1")),
+            enabled: false,
+            claims,
+        })
+        .unwrap()
+    }
+
+    #[test]
+    fn claims_only_parse_as_their_own_provider() {
+        let tokens = [
+            token(AuthenticatorClaims {
+                key: String::from("JBSWY3DPEHPK3PXP"),
+            }),
+            token(DuoClaims {
+                data: None,
+            }),
+            token(WebauthnClaims {
+                keys: vec![1],
+            }),
+            token(YubikeyClaims {
+                keys: Vec::new(),
+            }),
+            token(EmailClaims {
+                email: None,
+            }),
+        ];
+        for (issued, token) in tokens.iter().enumerate() {
+            let parsed = [
+                from_value::<TwoFactorClaims<AuthenticatorClaims>>(token.clone()).is_ok(),
+                from_value::<TwoFactorClaims<DuoClaims>>(token.clone()).is_ok(),
+                from_value::<TwoFactorClaims<WebauthnClaims>>(token.clone()).is_ok(),
+                from_value::<TwoFactorClaims<YubikeyClaims>>(token.clone()).is_ok(),
+                from_value::<TwoFactorClaims<EmailClaims>>(token.clone()).is_ok(),
+            ];
+            for (checked, ok) in parsed.into_iter().enumerate() {
+                assert_eq!(ok, issued == checked, "token {issued} parsed as {checked}");
+            }
+        }
+    }
+}

src/config.rs

@@ -1266,6 +1266,14 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         err!("`AUTH_REQUEST_PURGE_SCHEDULE` is not a valid cron expression")
     }
 
+    if !cfg.duo_context_purge_schedule.is_empty() && cfg.duo_context_purge_schedule.parse::<Schedule>().is_err() {
+        err!("`DUO_CONTEXT_PURGE_SCHEDULE` is not a valid cron expression")
+    }
+
+    if !cfg.purge_incomplete_sso_auth.is_empty() && cfg.purge_incomplete_sso_auth.parse::<Schedule>().is_err() {
+        err!("`PURGE_INCOMPLETE_SSO_AUTH` is not a valid cron expression")
+    }
+
     if !cfg.disable_admin_token {
         match cfg.admin_token.as_ref() {
             Some(t) if t.starts_with("$argon2") => {
@@ -1422,10 +1430,16 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     "undetermined-cipher-scenario-logic",
     "enable-basic-auth-response",
     "ssh-agent-v2",
+    "windows-desktop-autotype",
+    "windows-desktop-autotype-ga",
     // Key Management Team
+    "biometrics-sdk-ipc",
     "windows-native-credential-sync",
+    "pm-30144-sdk-key-rotation",
+    "pm-31050-no-logout-key-upgrade-rotation",
     "enable-account-encryption-v2-jit-password-registration",
     "pm-27278-v2-password-registration",
+    "force-upgrade-v2-encryption",
     // Mobile Team
     "pm-34171-card-scanner",
     // Platform Team

src/db/models/mod.rs

@@ -40,5 +40,5 @@ pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType, UserStampException};
+pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType};
 pub use self::user_signature_key_pair::{SignatureAlgorithm, UserSignatureKeyPair};

src/db/models/org_policy.rs

@@ -1,3 +1,4 @@
+use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, From};
 use diesel::prelude::*;
 use serde::Deserialize;
@@ -11,6 +12,7 @@ use crate::{
         schema::{org_policies, users_organizations},
     },
     error::MapResult,
+    util::format_date,
 };
 
 use super::{Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId, TwoFactor, UserId};
@@ -24,6 +26,7 @@ pub struct OrgPolicy {
     pub atype: i32,
     pub enabled: bool,
     pub data: String,
+    pub revision_date: NaiveDateTime,
 }
 
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Enums/PolicyType.cs
@@ -46,7 +49,7 @@ pub enum OrgPolicyType {
     RemoveUnlockWithPin = 14,
     RestrictedItemTypes = 15,
     UriMatchDefaults = 16,
-    // AutotypeDefaultSetting = 17, // Not supported yet
+    AutotypeDefaultSetting = 17,
     // AutoConfirm = 18, // Not supported (not implemented yet)
     // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
     OrganizationUserNotification = 20,
@@ -77,6 +80,7 @@ impl OrgPolicy {
             atype: atype as i32,
             enabled,
             data,
+            revision_date: Utc::now().naive_utc(),
         }
     }
 
@@ -92,7 +96,7 @@ impl OrgPolicy {
             "type": self.atype,
             "data": data_json,
             "enabled": self.enabled,
-            "revisionDate": null,
+            "revisionDate": format_date(&self.revision_date),
             "object": "policy",
         });
 
@@ -110,11 +114,13 @@ impl OrgPolicy {
 
 /// Database methods
 impl OrgPolicy {
-    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
+    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
+        self.revision_date = Utc::now().naive_utc();
+
         db_run! { conn:
             sqlite, mysql {
                 match diesel::replace_into(org_policies::table)
-                    .values(self)
+                    .values(&*self)
                     .execute(conn)
                 {
                     Ok(_) => Ok(()),
@@ -122,7 +128,7 @@ impl OrgPolicy {
                     Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
                         diesel::update(org_policies::table)
                             .filter(org_policies::uuid.eq(&self.uuid))
-                            .set(self)
+                            .set(&*self)
                             .execute(conn)
                             .map_res("Error saving org_policy")
                     }
@@ -142,10 +148,10 @@ impl OrgPolicy {
                 .map_res("Error deleting org_policy for insert")?;
 
                 diesel::insert_into(org_policies::table)
-                    .values(self)
+                    .values(&*self)
                     .on_conflict(org_policies::uuid)
                     .do_update()
-                    .set(self)
+                    .set(&*self)
                     .execute(conn)
                     .map_res("Error saving org_policy")
             }

src/db/models/organization.rs

@@ -54,6 +54,8 @@ pub struct Membership {
     pub atype: i32,
     pub reset_password_key: Option<String>,
     pub external_id: Option<String>,
+    /// The user's v2 upgrade token, for the org to unwrap the v2 user key after an upgrade. Opaque to us.
+    pub v2_upgrade_token: Option<String>,
 }
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -271,6 +273,7 @@ impl Membership {
             atype: MembershipType::User as i32,
             reset_password_key: None,
             external_id: None,
+            v2_upgrade_token: None,
         }
     }
 

src/db/models/two_factor.rs

@@ -137,11 +137,11 @@ impl TwoFactor {
         .await
     }
 
-    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: i32, conn: &DbConn) -> Option<Self> {
+    pub async fn find_by_user_and_type(user_uuid: &UserId, atype: TwoFactorType, conn: &DbConn) -> Option<Self> {
         conn.run(move |conn| {
             twofactor::table
                 .filter(twofactor::user_uuid.eq(user_uuid))
-                .filter(twofactor::atype.eq(atype))
+                .filter(twofactor::atype.eq(atype as i32))
                 .first::<Self>(conn)
                 .ok()
         })

src/db/models/user.rs

@@ -6,6 +6,7 @@ use serde_json::Value;
 use crate::{
     CONFIG,
     api::EmptyResult,
+    auth::DEFAULT_ACCESS_VALIDITY,
     crypto,
     db::{
         DbConn,
@@ -77,6 +78,8 @@ pub struct User {
     pub signed_public_key: Option<String>,
     pub security_state: Option<String>,
     pub security_version: Option<i32>,
+    /// JSON `{"wrappedUserKey1", "wrappedUserKey2"}` for sessions that still hold the v1 user key. Opaque to us.
+    pub v2_upgrade_token: Option<String>,
 }
 
 #[derive(Identifiable, Queryable, Insertable)]
@@ -105,13 +108,28 @@ enum UserStatus {
     _Disabled = 2,
 }
 
+/// A previous security stamp that is still accepted, until `expire`.
 #[derive(Serialize, Deserialize)]
 pub struct UserStampException {
-    pub routes: Vec<String>,
+    /// The routes the stamp is still accepted on, or `None` for any route.
+    pub routes: Option<Vec<String>>,
     pub security_stamp: String,
     pub expire: i64,
 }
 
+impl UserStampException {
+    pub fn is_expired(&self) -> bool {
+        Utc::now().timestamp() > self.expire
+    }
+
+    /// Whether this exception lets a token carrying `security_stamp` through on `route`.
+    pub fn allows(&self, security_stamp: &str, route: &str) -> bool {
+        !self.is_expired()
+            && self.security_stamp == security_stamp
+            && self.routes.as_ref().is_none_or(|routes| routes.iter().any(|r| r == route))
+    }
+}
+
 /// Local methods
 impl User {
     pub const CLIENT_KDF_TYPE_DEFAULT: i32 = UserKdfType::Pbkdf2 as i32;
@@ -168,6 +186,7 @@ impl User {
             signed_public_key: None,
             security_state: None,
             security_version: None,
+            v2_upgrade_token: None,
         }
     }
 
@@ -184,6 +203,11 @@ impl User {
         )
     }
 
+    /// Upstream's `GetMasterPasswordSalt`: there is no separate salt, so the normalized email
+    pub fn master_password_salt(&self) -> String {
+        self.email.trim().to_lowercase()
+    }
+
     pub fn check_valid_recovery_code(&self, recovery_code: &str) -> bool {
         if let Some(ref totp_recover) = self.totp_recover {
             crypto::ct_eq(recovery_code, totp_recover.to_lowercase())
@@ -234,10 +258,33 @@ impl User {
 
     pub async fn reset_security_stamp(&mut self, conn: &DbConn) -> EmptyResult {
         self.security_stamp = get_uuid();
+        // Keeps the unexpired route exceptions, set for the stamp being replaced, and drops a rotation's grace
+        let mut exceptions = self.stamp_exceptions();
+        exceptions.retain(|e| e.routes.is_some() && !e.is_expired());
+        self.set_stamp_exceptions(&exceptions);
         Device::rotate_refresh_tokens_by_user(&self.uuid, conn).await?;
         Ok(())
     }
 
+    /// Resets the stamp but lets issued access tokens run out, as upstream only checks it on refresh.
+    pub async fn reset_security_stamp_after_key_rotation(&mut self, conn: &DbConn) -> EmptyResult {
+        let previous_stamp = self.security_stamp.clone();
+        let mut grace: Vec<UserStampException> =
+            self.stamp_exceptions().into_iter().filter(|e| e.routes.is_none() && !e.is_expired()).collect();
+
+        self.reset_security_stamp(conn).await?;
+
+        grace.push(UserStampException {
+            routes: None,
+            security_stamp: previous_stamp,
+            expire: (Utc::now() + *DEFAULT_ACCESS_VALIDITY).timestamp(),
+        });
+        let mut exceptions = self.stamp_exceptions();
+        exceptions.extend(grace);
+        self.set_stamp_exceptions(&exceptions);
+        Ok(())
+    }
+
     /// Set the stamp_exception to only allow a subsequent request matching a specific route using the current security-stamp.
     ///
     /// # Arguments
@@ -246,17 +293,30 @@ impl User {
     ///   After these 2 minutes this stamp will expire.
     ///
     pub fn set_stamp_exception(&mut self, route_exception: Vec<String>) {
-        let stamp_exception = UserStampException {
-            routes: route_exception,
+        self.set_stamp_exceptions(&[UserStampException {
+            routes: Some(route_exception),
             security_stamp: self.security_stamp.clone(),
             expire: (Utc::now() + TimeDelta::try_minutes(2).unwrap()).timestamp(),
-        };
-        self.stamp_exception = Some(serde_json::to_string(&stamp_exception).unwrap_or_default());
+        }]);
     }
 
-    /// Resets the stamp_exception to prevent re-use of the previous security-stamp
-    pub fn reset_stamp_exception(&mut self) {
-        self.stamp_exception = None;
+    /// The previous security stamps that are still accepted, expired ones included.
+    pub fn stamp_exceptions(&self) -> Vec<UserStampException> {
+        let Some(stored) = self.stamp_exception.as_deref() else {
+            return Vec::new();
+        };
+        // Before key rotations kept sessions alive, only a single route exception was stored.
+        serde_json::from_str::<Vec<UserStampException>>(stored)
+            .or_else(|_| serde_json::from_str::<UserStampException>(stored).map(|e| vec![e]))
+            .unwrap_or_default()
+    }
+
+    fn set_stamp_exceptions(&mut self, exceptions: &[UserStampException]) {
+        self.stamp_exception = if exceptions.is_empty() {
+            None
+        } else {
+            Some(serde_json::to_string(&exceptions).unwrap_or_default())
+        };
     }
 
     pub fn display_name(&self) -> &str {
@@ -327,6 +387,10 @@ impl User {
         })
     }
 
+    pub fn v2_upgrade_token_json(&self) -> Option<Value> {
+        self.v2_upgrade_token.as_ref().and_then(|token| serde_json::from_str(token).ok())
+    }
+
     pub async fn to_json(&self, conn: &DbConn) -> Value {
         let mut orgs_json = Vec::new();
         for c in Membership::find_confirmed_by_user(&self.uuid, conn).await {

src/db/schema.rs

@@ -116,6 +116,7 @@ table! {
         atype -> Integer,
         enabled -> Bool,
         data -> Text,
+        revision_date -> Timestamp,
     }
 }
 
@@ -221,6 +222,7 @@ table! {
         signed_public_key -> Nullable<Text>,
         security_state -> Nullable<Text>,
         security_version -> Nullable<Integer>,
+        v2_upgrade_token -> Nullable<Text>,
     }
 }
 
@@ -258,6 +260,7 @@ table! {
         atype -> Integer,
         reset_password_key -> Nullable<Text>,
         external_id -> Nullable<Text>,
+        v2_upgrade_token -> Nullable<Text>,
     }
 }
 

src/static/templates/email/send_emergency_access_invite.html.hbs

@@ -9,7 +9,7 @@ Emergency access for {{{grantor_name}}}
     </tr>
     <tr style="margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
        <td class="content-block" style="font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; color: #333; line-height: 25px; margin: 0; -webkit-font-smoothing: antialiased; padding: 0 0 10px; -webkit-text-size-adjust: none; text-align: center;" valign="top" align="center">
-          <a href="{{{url}}}"
+          <a data-testid="emergency" href="{{{url}}}"
              clicktracking=off target="_blank" style="color: #ffffff; text-decoration: none; text-align: center; cursor: pointer; display: inline-block; border-radius: 5px; background-color: #3c8dbc; border-color: #3c8dbc; border-style: solid; border-width: 10px 20px; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; box-sizing: border-box; font-size: 16px; line-height: 25px; -webkit-font-smoothing: antialiased; -webkit-text-size-adjust: none;">
           Become emergency contact
           </a>