Speed up the Build workflow

- Pass the MariaDB client library to mysqlclient-sys through its environment variables, so a cached build no longer recompiles mysqlclient-sys, diesel and diesel_migrations in every MySQL build. The cache prefix changes once, because the old caches would keep rebuilding it. - Drop the sqlite,mysql,postgresql,enable_mimalloc test: enable_mimalloc is still tested on and off. - Only save caches on main, so pull requests and branches no longer push main's caches out of the 10 GB limit.
Add macOS native credential sync to supported feature flags (#7942 )
2026-11-14 00:36:04 +02:00 · 2026-11-13 22:08:57 +01:00 · 2026-11-13 20:38:00 +01:00 · 2026-11-13 20:24:59 +01:00 · 2026-11-13 19:48:10 +01:00 · 2026-11-13 18:59:10 +01:00
91 changed files with 7190 additions and 1785 deletions
@@ -78,7 +78,7 @@
 # DB_CONNECTION_RETRIES=15

 ## Database timeout
-## Timeout when acquiring database connection
+## Timeout in seconds when acquiring database connection
 # DATABASE_TIMEOUT=30

 ## Database idle timeout
@@ -173,7 +173,7 @@
 ## Defaults to daily. Set blank to disable this job. Also without EVENTS_DAYS_RETAIN set, this job will not start.
 # EVENT_CLEANUP_SCHEDULE="0 10 0 * * *"
 ## Number of days to retain events stored in the database.
-## If unset (the default), events are kept indefinitely and the scheduled job is disabled!
+## If unset (the default) or 0, events are kept indefinitely and the scheduled job is disabled!
 # EVENTS_DAYS_RETAIN=
 ##
 ## Cron schedule of the job that cleans old auth requests from the auth request.
@@ -233,7 +233,7 @@
 # USER_SEND_LIMIT=

 ## Number of days to wait before auto-deleting a trashed item.
-## If unset (the default), trashed items are not auto-deleted.
+## If unset (the default) or 0, trashed items are not auto-deleted.
 ## This setting applies globally, so make sure to inform all users of any changes to this setting.
 # TRASH_AUTO_DELETE_DAYS=

@@ -386,23 +386,35 @@
 # HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS=true

 ## Client Settings
+## Server-wide Fill Assist rules feed base directory URL, not a JSON file.
+## Defaults to https://fillassist.bitwarden.com.
+## Must be a valid HTTPS URL without credentials, query parameters, fragments, or surrounding whitespace.
+# FILL_ASSIST_RULES_URL=https://fillassist.bitwarden.com
+
 ## Enable experimental feature flags for clients.
 ## This is a comma-separated list of flags, e.g. "flag1,flag2,flag3".
 ## Note that clients cache the /api/config endpoint for about 1 hour and it could take some time before they are enabled or disabled!
 ##
 ## The following flags are available:
+## - "fill-assist-targeting-rules": Enable Fill Assist targeting rules in the browser extension. (Browser >= 2026.6.0)
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
 ## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
 ## - "windows-desktop-autotype": Enable the autotype feature preview on Windows. (Desktop >= 2025.8.0)
 ## - "windows-desktop-autotype-ga": Enable the new, still in development, autotype implementation on Windows. (Desktop >= 2026.9.1)
 ##   Only enable one of the two autotype flags, the clients disable autotype completely when both are enabled.
-## - "pm-30529-webauthn-related-origins":
+## - "pm-30529-webauthn-related-origins": Allow passkeys stored in the vault to be used on related origins listed in a site's /.well-known/webauthn file (Browser >= 2026.2.0)
 ## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
 ## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
 ## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
 ## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
 ## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
+## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers.
+##   Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet.
+## - "macos-native-credential-sync": Enable the desktop app as a passkey provider on macOS, so passkeys in the vault can be used by other apps and browsers.
+## - "pm-27278-v2-password-registration": Register new accounts with v2 encryption. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0, Android >= 2026.4.1, iOS >= 2026.5.1)
+## - "enable-account-encryption-v2-jit-password-registration": Give SSO users who set their master password on their first login v2 encryption. (Web >= 2026.1.1, Desktop/Browser/CLI >= 2026.1.0, Android >= 2026.4.1, iOS >= 2026.6.0)
+##   These two flags can't be undone: a v2 account stays v2, and it can only log in from clients that are 2026.10.1 or newer (2026.10.2 for the desktop app), so the versions above are only enough to create one.
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=

 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -489,6 +501,15 @@
 ## KNOW WHAT YOU ARE DOING!
 # ORG_GROUPS_ENABLED=false

+## EXPERIMENTAL FEATURE: Custom roles
+## Enables the Custom member role with granular permissions for organizations.
+## This is still being developed: only the permissions this version enforces can be granted.
+## This is enforced by the server and is unrelated to EXPERIMENTAL_CLIENT_FEATURE_FLAGS.
+## Disabling it again keeps the stored Custom roles and permissions, but they grant nothing until it is re-enabled.
+## Disabled by default because this is an experimental feature!
+## KNOW WHAT YOU ARE DOING!
+# EXPERIMENTAL_CUSTOM_ROLES=false
+
 ## Increase secure note size limit (Know the risks!)
 ## Sets the secure note size limit to 100_000 instead of the default 10_000.
 ## WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
@@ -606,6 +627,9 @@
 ## Note that the checkbox would still be present, but ignored.
 # DISABLE_2FA_REMEMBER=false
 ##
+## Number of days before a remembered 2FA login expires (min: 1, max: 90).
+# TWO_FACTOR_REMEMBER_DAYS=30
+##
 ## Authenticator Settings
 ## Disable authenticator time drifted codes to be valid.
 ## TOTP codes of the previous and next 30 seconds will be invalid
@@ -614,7 +638,7 @@
 ## we allow by default the TOTP code which was valid one step back and one in the future.
 ## This can however allow attackers to be a bit more lucky with their attempts because there are 3 valid codes.
 ## You can disable this, so that only the current TOTP Code is allowed.
-## Keep in mind that when a sever drifts out of time, valid codes could be marked as invalid.
+## Keep in mind that when a server drifts out of time, valid codes could be marked as invalid.
 ## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid.
 # AUTHENTICATOR_DISABLE_TIME_DRIFT=false

@@ -57,7 +57,25 @@ jobs:
    steps:
      # Install dependencies
      - name: "Install dependencies Ubuntu"
-        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends openssl build-essential libmariadb-dev-compat libpq-dev libssl-dev pkg-config
+        run: |
+          # Separate commands, so a failing update fails the step. The image already has Oracle's MySQL client
+          # library, so a skipped install would otherwise go unnoticed and build against that one.
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends openssl build-essential libmariadb-dev-compat libpq-dev libssl-dev pkg-config
+
+          # Pass the MariaDB client library to mysqlclient-sys through its environment variables.
+          # When it finds the library with pkg-config, its build script makes cargo rerun it whenever
+          # anything in the library directory changes, and the install above changes that directory on
+          # every run. So every MySQL build recompiled mysqlclient-sys, diesel and diesel_migrations,
+          # even with a cached build. Cargo compares environment variables by their value instead.
+          lib_dir="$(pkg-config --variable=libdir mysqlclient)"
+          version="$(pkg-config --modversion mysqlclient)"
+          {
+            echo "MYSQLCLIENT_NO_PKG_CONFIG=1"
+            echo "LIBMARIADB_NO_PKG_CONFIG=1"
+            echo "MYSQLCLIENT_LIB_DIR=${lib_dir}"
+            echo "MYSQLCLIENT_VERSION=${version}"
+          } | tee -a "${GITHUB_ENV}"
      # End Install dependencies

      # Checkout the repo
@@ -118,23 +136,21 @@ jobs:
          # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
          # Like changing the build host from Ubuntu 20.04 to 22.04 for example.
          # Only update when really needed! Use a <year>.<month>[.<inc>] format.
-          prefix-key: "v2025.09-rust"
+          prefix-key: "v2026.11-rust"
+          # Only main saves caches. The repository can keep 10 GB of caches, and the ones saved by pull
+          # requests and other branches were mostly copies of main's that pushed other caches out.
+          save-if: ${{ github.ref == 'refs/heads/main' }}
      # End Enable Rust Caching

      # Run cargo tests
      # First test all features together, afterwards test them separately.
+      # enable_mimalloc only selects the allocator, so it is tested on and off, not with every combination.
      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc,s3"
        id: test_sqlite_mysql_postgresql_mimalloc_s3
        if: ${{ !cancelled() }}
        run: |
          cargo test --profile ci --features sqlite,mysql,postgresql,enable_mimalloc,s3

-      - name: "test features: sqlite,mysql,postgresql,enable_mimalloc"
-        id: test_sqlite_mysql_postgresql_mimalloc
-        if: ${{ !cancelled() }}
-        run: |
-          cargo test --profile ci --features sqlite,mysql,postgresql,enable_mimalloc
-
      - name: "test features: sqlite,mysql,postgresql"
        id: test_sqlite_mysql_postgresql
        if: ${{ !cancelled() }}
@@ -158,6 +174,13 @@ jobs:
        if: ${{ !cancelled() }}
        run: |
          cargo test --profile ci --features postgresql
+
+      # The test seeder only exists with this feature, which no release build has
+      - name: "test features: sqlite,unsafe_test_mode"
+        id: test_unsafe_test_mode
+        if: ${{ !cancelled() }}
+        run: |
+          cargo test --profile ci --features sqlite,unsafe_test_mode
      # End Run cargo tests


@@ -167,6 +190,12 @@ jobs:
        if: ${{ !cancelled() && matrix.channel == 'rust-toolchain' }}
        run: |
          cargo clippy --profile ci --features sqlite,mysql,postgresql,enable_mimalloc,s3
+
+      - name: "clippy features: sqlite,unsafe_test_mode"
+        id: clippy_unsafe_test_mode
+        if: ${{ !cancelled() && matrix.channel == 'rust-toolchain' }}
+        run: |
+          cargo clippy --profile ci --features sqlite,unsafe_test_mode
      # End Run cargo clippy


@@ -185,12 +214,13 @@ jobs:
        if: ${{ failure() }}
        env:
          TEST_DB_M_S3: ${{ steps.test_sqlite_mysql_postgresql_mimalloc_s3.outcome }}
-          TEST_DB_M: ${{ steps.test_sqlite_mysql_postgresql_mimalloc.outcome }}
          TEST_DB: ${{ steps.test_sqlite_mysql_postgresql.outcome }}
          TEST_SQLITE: ${{ steps.test_sqlite.outcome }}
          TEST_MYSQL: ${{ steps.test_mysql.outcome }}
          TEST_POSTGRESQL: ${{ steps.test_postgresql.outcome }}
+          TEST_UNSAFE_TEST_MODE: ${{ steps.test_unsafe_test_mode.outcome }}
          CLIPPY: ${{ steps.clippy.outcome }}
+          CLIPPY_UNSAFE_TEST_MODE: ${{ steps.clippy_unsafe_test_mode.outcome }}
          FMT: ${{ steps.formatting.outcome }}
        run: |
          echo "### :x: Checks Failed!" >> "${GITHUB_STEP_SUMMARY}"
@@ -198,12 +228,13 @@ jobs:
          echo "|Job|Status|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|---|------|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (sqlite,mysql,postgresql,enable_mimalloc,s3)|${TEST_DB_M_S3}|" >> "${GITHUB_STEP_SUMMARY}"
-          echo "|test (sqlite,mysql,postgresql,enable_mimalloc)|${TEST_DB_M}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (sqlite,mysql,postgresql)|${TEST_DB}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (sqlite)|${TEST_SQLITE}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (mysql)|${TEST_MYSQL}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|test (postgresql)|${TEST_POSTGRESQL}|" >> "${GITHUB_STEP_SUMMARY}"
+          echo "|test (sqlite,unsafe_test_mode)|${TEST_UNSAFE_TEST_MODE}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|clippy (sqlite,mysql,postgresql,enable_mimalloc,s3)|${CLIPPY}|" >> "${GITHUB_STEP_SUMMARY}"
+          echo "|clippy (sqlite,unsafe_test_mode)|${CLIPPY_UNSAFE_TEST_MODE}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "|fmt|${FMT}|" >> "${GITHUB_STEP_SUMMARY}"
          echo "" >> "${GITHUB_STEP_SUMMARY}"
          echo "Please check the failed jobs and fix where needed." >> "${GITHUB_STEP_SUMMARY}"
@@ -106,7 +106,7 @@ jobs:

      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -121,7 +121,7 @@ jobs:

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -137,7 +137,7 @@ jobs:

      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -272,7 +272,7 @@ jobs:

      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -287,7 +287,7 @@ jobs:

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -303,7 +303,7 @@ jobs:

      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -0,0 +1,163 @@
+name: SDK live tests
+permissions: {}
+
+# Runs the live-server end-to-end tests of bitwarden/sdk-internal against this branch, see tools/sdk-live-tests/run.sh.
+# By default it tests the latest @bitwarden/sdk-internal on npm, which the SDK publishes for every commit to its main
+# branch, with the e2e tests from that commit. A manual run can name an npm version instead, or a branch, tag or commit
+# to build the SDK from. It runs daily, by hand, and on changes to the test seeder or the runner.
+on:
+  schedule:
+    # 04:15 UTC, off the top of the hour, when GitHub may delay or drop scheduled runs
+    - cron: "15 4 * * *"
+  workflow_dispatch:
+    inputs:
+      sdk_npm_version:
+        description: "Version of @bitwarden/sdk-internal on npm to test (empty for the latest)"
+        required: false
+        default: ""
+      sdk_ref:
+        description: "Or a branch, tag or commit of bitwarden/sdk-internal to build and test (slower)"
+        required: false
+        default: ""
+  pull_request:
+    paths:
+      - ".github/workflows/sdk-live-tests.yml"
+      - "src/api/test_seeder.rs"
+      - "tools/sdk-live-tests/**"
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  sdk-live-tests:
+    name: SDK live tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    env:
+      # Less to compile and link, and a smaller cache. Panics still show file and line.
+      CARGO_PROFILE_DEV_DEBUG: "0"
+    steps:
+      - name: "Install dependencies Ubuntu"
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends build-essential libssl-dev pkg-config
+
+      - name: "Checkout"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # A published package (npm) or a build from a git ref (git), and the sdk-internal commit to check out
+      - name: "Pick the SDK"
+        id: sdk
+        env:
+          NPM_VERSION: ${{ inputs.sdk_npm_version }}
+          GIT_REF: ${{ inputs.sdk_ref }}
+        run: |
+          if [[ -n "${NPM_VERSION}" && -n "${GIT_REF}" ]]; then
+            echo "::error::Give an npm version or a git ref, not both"
+            exit 1
+          fi
+          if [[ -n "${GIT_REF}" ]]; then
+            {
+              echo "source=git"
+              echo "ref=${GIT_REF}"
+            } >> "${GITHUB_OUTPUT}"
+            echo "SDK: bitwarden/sdk-internal \`${GIT_REF}\`, built from source" >> "${GITHUB_STEP_SUMMARY}"
+            exit 0
+          fi
+          spec="${NPM_VERSION:-latest}"
+          if [[ ! "${spec}" =~ ^[0-9A-Za-z.+-]+$ ]]; then
+            echo "::error::That is not an npm version or tag"
+            exit 1
+          fi
+          manifest="$(curl -fsS --retry 3 "https://registry.npmjs.org/@bitwarden%2Fsdk-internal/${spec}")"
+          version="$(jq -r .version <<< "${manifest}")"
+          commit="$(jq -r .gitHead <<< "${manifest}")"
+          if [[ ! "${commit}" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::@bitwarden/sdk-internal@${version} doesn't name the commit it was built from"
+            exit 1
+          fi
+          {
+            echo "source=npm"
+            echo "version=${version}"
+            echo "ref=${commit}"
+          } >> "${GITHUB_OUTPUT}"
+          echo "SDK: @bitwarden/sdk-internal ${version} from npm, e2e tests at ${commit}" >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: "Checkout sdk-internal"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: bitwarden/sdk-internal
+          ref: ${{ steps.sdk.outputs.ref }}
+          path: sdk-internal
+          persist-credentials: false
+
+      # Each checkout pins its own toolchain in rust-toolchain.toml. The SDK's is only needed to build it.
+      - name: "Install toolchains"
+        env:
+          SDK_SOURCE: ${{ steps.sdk.outputs.source }}
+        run: |
+          rustup toolchain install
+          if [[ "${SDK_SOURCE}" == git ]]; then
+            cd sdk-internal
+            rustup toolchain install
+            rustup target add wasm32-unknown-unknown
+            rustup component add rust-src
+          fi
+
+      # One cache per SDK source, so that neither restores the other's
+      - name: "Cache Rust builds"
+        if: ${{ steps.sdk.outputs.source == 'npm' }}
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          key: sdk-live-tests-npm
+          add-job-id-key: false
+          workspaces: ". -> target"
+
+      - name: "Cache Rust builds (with the SDK)"
+        if: ${{ steps.sdk.outputs.source == 'git' }}
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          key: sdk-live-tests-sdk-build
+          add-job-id-key: false
+          workspaces: |
+            . -> target
+            sdk-internal -> target
+
+      - name: "Setup Node"
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: sdk-internal/.nvmrc
+
+      # Where the SDK's build would put it
+      - name: "Download the SDK package"
+        if: ${{ steps.sdk.outputs.source == 'npm' }}
+        env:
+          SDK_VERSION: ${{ steps.sdk.outputs.version }}
+          SDK_COMMIT: ${{ steps.sdk.outputs.ref }}
+        run: |
+          # npm checks the tarball against the registry's checksum
+          tarball="$(npm pack "@bitwarden/sdk-internal@${SDK_VERSION}" --pack-destination "${RUNNER_TEMP}" --json | jq -r '.[0].filename')"
+          package_dir=sdk-internal/crates/bitwarden-wasm-internal/npm
+          tar -xzf "${RUNNER_TEMP}/${tarball}" --strip-components=1 -C "${package_dir}"
+          if [[ "$(cat "${package_dir}/VERSION")" != "${SDK_COMMIT}" ]]; then
+            echo "::error::The package's VERSION doesn't match its commit ${SDK_COMMIT}"
+            exit 1
+          fi
+
+      - name: "Run the SDK live tests"
+        env:
+          SDK_SOURCE: ${{ steps.sdk.outputs.source }}
+        run: |
+          args=(--sdk-dir sdk-internal)
+          if [[ "${SDK_SOURCE}" == npm ]]; then
+            args+=(--skip-sdk-build)
+          fi
+          tools/sdk-live-tests/run.sh "${args[@]}"
+
+      - name: "Upload logs"
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: sdk-live-tests-logs
+          path: target/sdk-live-tests/**/*.log
@@ -24,7 +24,7 @@ jobs:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
@@ -14,9 +14,8 @@ extend-ignore-re = [
    # In SMTP it's called HELO, so ignore it
    "(?i)helo_name",
    "Server name sent during.+HELO",
-    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
-    "COSEKey",
-    "COSEAlgorithm",
+    # COSE Is short for CBOR Object Signing and Encryption
+    "(?i)cose",
    # Ignore this specific string as it's valid
    "Ensure they are valid OTPs",
    # This word is misspelled upstream
@@ -57,6 +57,9 @@ oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]
 # Currently only used to enable rusts official ip support
 unstable = []

+# Enables special test mode features. This should NEVER be enabled in production
+unsafe_test_mode = ["dep:serde_cbor_2"]
+
 [target."cfg(unix)".dependencies]
 nix = { version = "0.31.3", features = ["fs"] }
 # Logging
@@ -66,7 +69,7 @@ syslog = "7.0.0"
 macros = { path = "./macros" }

 # Logging
-log = "0.4.34"
+log = "0.4.35"
 fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
 # We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
 tracing = { version = "0.1.44", features = ["log"] }
@@ -80,7 +83,7 @@ num-derive = "0.5.1"
 bigdecimal = "0.4.11"

 # Web framework
-rocket = { version = "0.5.1", default-features = false, features = ["json", "tls"] }
+rocket = { version = "0.5.2", default-features = false, features = ["json", "tls"] }
 rocket_ws = { version = "0.1.1" }

 # WebSockets libraries
@@ -107,7 +110,7 @@ serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.154"

 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
 diesel_migrations = "2.3.2"

 derive_more = { version = "2.1.1", features = [
@@ -129,7 +132,7 @@ rustls = { version = "0.23.46", features = ["ring", "std"], default-features = f
 subtle = "2.6.1"

 # UUID generation
-uuid = { version = "1.28.0", features = ["v4"] }
+uuid = { version = "1.29.0", features = ["v4"] }

 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
@@ -157,6 +160,7 @@ yubico_ng = { version = "1.0.0", default-features = false }
 webauthn-rs = { version = "0.5.5", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
 webauthn-rs-proto = "0.5.5"
 webauthn-rs-core = "0.5.5"
+serde_cbor_2 = { version = "0.13.0", optional = true }

 # Handling of URL's for WebAuthn and favicons
 url = "2.5.8"
@@ -204,7 +208,7 @@ reqwest = { version = "0.13.5", default-features = false, features = [
 hickory-resolver = "0.26.3"

 # Favicon extraction libraries
-html5gum = "0.8.4"
+html5gum = "0.9.0"
 regex = { version = "1.13.1", default-features = false, features = [
    "perf",
    "std",
@@ -215,7 +219,7 @@ bytes = "1.12.1"
 svg-hush = "0.9.7"

 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "4.0.3", features = ["async"] }
+cached = { version = "4.1.0", features = ["async"] }

 # Used for custom short lived cookie jar during favicon extraction
 cookie = "0.18.2"
@@ -235,7 +239,7 @@ governor = "0.10.4"
 ipnet = "2.12.2"

 # OIDC for SSO
-openidconnect = { version = "4.0.1", default-features = false }
+openidconnect = { version = "4.1.0", default-features = false }
 moka = { version = "0.12.16", features = ["future"] }

 # Check client versions for specific features.
@@ -268,7 +272,7 @@ aws-config = { version = "1.13.0", optional = true, default-features = false, fe
    "sso",
 ] }
 aws-credential-types = { version = "1.3.1", optional = true }
-aws-smithy-runtime-api = { version = "1.19.1", optional = true }
+aws-smithy-runtime-api = { version = "1.19.2", optional = true }
 http = { version = "1.5.0", optional = true }
 reqsign-aws-v4 = { version = "3.3.1", optional = true }
 reqsign-core = { version = "3.3.2", optional = true }
@@ -1,6 +1,6 @@
 ---
-vault_version: "v2026.8.0"
-vault_image_digest: "sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a"
+vault_version: "v2026.10.1"
+vault_image_digest: "sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52"
 # Cross Compile Docker Helper Scripts v1.10.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
-#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.10.1
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.10.1
+#     [docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
-#     [docker.io/vaultwarden/web-vault:v2026.8.0]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52
+#     [docker.io/vaultwarden/web-vault:v2026.10.1]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52 AS vault

 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
@@ -19,15 +19,15 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
-#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.10.1
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.10.1
+#     [docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
-#     [docker.io/vaultwarden/web-vault:v2026.8.0]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52
+#     [docker.io/vaultwarden/web-vault:v2026.10.1]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52 AS vault

 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
@@ -0,0 +1,3 @@
+-- A blob-encrypted cipher keeps all of its content in `data`, up to 500,000 characters, so the
+-- 64 KiB of TEXT is too small. Like upstream, which uses LONGTEXT.
+ALTER TABLE ciphers MODIFY data LONGTEXT NOT NULL;
@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;
@@ -0,0 +1,14 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          DATETIME NOT NULL,
+    updated_at          DATETIME NOT NULL,
+    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE
+);
@@ -0,0 +1,22 @@
+-- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
+-- versions before this one don't know. So while there are any, this fails on the duplicate key below, before anything
+-- is dropped: change their role first, or restore the backup taken before the upgrade.
+-- A failed attempt leaves the temporary table on this connection. Clear it before retrying.
+DROP TEMPORARY TABLE IF EXISTS custom_role_downgrade;
+CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
+INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
+INSERT INTO custom_role_downgrade
+    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
+    FROM users_organizations WHERE atype = 4 LIMIT 1;
+DROP TEMPORARY TABLE custom_role_downgrade;
+
+ALTER TABLE users_organizations
+    DROP COLUMN manage_users,
+    DROP COLUMN manage_groups,
+    DROP COLUMN manage_policies,
+    DROP COLUMN create_new_collections,
+    DROP COLUMN edit_any_collection,
+    DROP COLUMN delete_any_collection,
+    DROP COLUMN access_event_logs,
+    DROP COLUMN access_import_export,
+    DROP COLUMN access_reports;
@@ -0,0 +1,13 @@
+-- The granular permissions of the Custom member role. They only take effect on a Custom membership
+-- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
+-- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
+ALTER TABLE users_organizations
+    ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;
@@ -0,0 +1,4 @@
+-- Key rotations before this kept the id of the old user key, so every new
+-- cipher was refused from then on. Stale ids can't be told apart, so clear
+-- all of them; clients record their current key's id again when it's empty.
+UPDATE users SET key_id = NULL;
@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
@@ -0,0 +1,3 @@
+-- TEXT has no size limit here, only MySQL needed the change.
+-- PostgreSQL rejects a migration that is only comments ("Received an empty query"), hence the no-op.
+SELECT 1;
@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;
@@ -0,0 +1,13 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          TIMESTAMP NOT NULL,
+    updated_at          TIMESTAMP NOT NULL
+);
@@ -0,0 +1,20 @@
+-- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
+-- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
+-- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
+CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
+INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
+INSERT INTO custom_role_downgrade
+    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
+    FROM users_organizations WHERE atype = 4 LIMIT 1;
+DROP TABLE custom_role_downgrade;
+
+ALTER TABLE users_organizations
+    DROP COLUMN manage_users,
+    DROP COLUMN manage_groups,
+    DROP COLUMN manage_policies,
+    DROP COLUMN create_new_collections,
+    DROP COLUMN edit_any_collection,
+    DROP COLUMN delete_any_collection,
+    DROP COLUMN access_event_logs,
+    DROP COLUMN access_import_export,
+    DROP COLUMN access_reports;
@@ -0,0 +1,13 @@
+-- The granular permissions of the Custom member role. They only take effect on a Custom membership
+-- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
+-- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
+ALTER TABLE users_organizations
+    ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;
@@ -0,0 +1,4 @@
+-- Key rotations before this kept the id of the old user key, so every new
+-- cipher was refused from then on. Stale ids can't be told apart, so clear
+-- all of them; clients record their current key's id again when it's empty.
+UPDATE users SET key_id = NULL;
@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
@@ -0,0 +1 @@
+-- TEXT has no size limit here, only MySQL needed the change
@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;
@@ -0,0 +1,13 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                TEXT     NOT NULL PRIMARY KEY,
+    user_uuid           TEXT     NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          DATETIME NOT NULL,
+    updated_at          DATETIME NOT NULL
+);
@@ -0,0 +1,19 @@
+-- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
+-- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
+-- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
+CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
+INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
+INSERT INTO custom_role_downgrade
+    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
+    FROM users_organizations WHERE atype = 4 LIMIT 1;
+DROP TABLE custom_role_downgrade;
+
+ALTER TABLE users_organizations DROP COLUMN manage_users;
+ALTER TABLE users_organizations DROP COLUMN manage_groups;
+ALTER TABLE users_organizations DROP COLUMN manage_policies;
+ALTER TABLE users_organizations DROP COLUMN create_new_collections;
+ALTER TABLE users_organizations DROP COLUMN edit_any_collection;
+ALTER TABLE users_organizations DROP COLUMN delete_any_collection;
+ALTER TABLE users_organizations DROP COLUMN access_event_logs;
+ALTER TABLE users_organizations DROP COLUMN access_import_export;
+ALTER TABLE users_organizations DROP COLUMN access_reports;
@@ -0,0 +1,11 @@
+-- The granular permissions of the Custom member role. They only take effect on a Custom membership
+-- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
+ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT 0; -- FALSE
@@ -0,0 +1,4 @@
+-- Key rotations before this kept the id of the old user key, so every new
+-- cipher was refused from then on. Stale ids can't be told apart, so clear
+-- all of them; clients record their current key's id again when it's empty.
+UPDATE users SET key_id = NULL;
@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
@@ -1,4 +1,4 @@
-use std::{env, sync::LazyLock};
+use std::{collections::HashMap, env, sync::LazyLock};

 use reqwest::Method;
 use rocket::{
@@ -17,7 +17,7 @@ use crate::{
    api::{
        ApiResult, EmptyResult, JsonResult, Notify,
        core::{log_event, two_factor},
-        unregister_push_device,
+        push_logout_to_relay, unregister_push_device,
    },
    auth::{ClientIp, Secure, decode_admin, encode_jwt, generate_admin_claims},
    config::ConfigBuilder,
@@ -26,6 +26,7 @@ use crate::{
        models::{
            Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
            MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
+            custom_roles_enabled,
        },
    },
    error::{Error, MapResult},
@@ -201,12 +202,15 @@ fn post_admin_login(
    // If the token is invalid, redirect to login page
    if validate_token(&data.token) {
        // If the token received is valid, generate JWT and save it as a cookie
-        let claims = generate_admin_claims();
+        let claims = match generate_admin_claims() {
+            Ok(claims) => claims,
+            Err(e) => return Err(AdminResponse::Ok(render_admin_login(Some(e.message()), redirect.as_deref()))),
+        };
        let jwt = encode_jwt(&claims);

        let cookie = Cookie::build((COOKIE_NAME, jwt))
            .path(admin_path())
-            .max_age(time::Duration::minutes(CONFIG.admin_session_lifetime()))
+            .max_age(time::Duration::minutes(i64::from(CONFIG.admin_session_lifetime())))
            .same_site(SameSite::Strict)
            .http_only(true)
            .secure(secure.https);
@@ -253,6 +257,7 @@ struct AdminTemplateData {
    logged_in: bool,
    urlpath: String,
    sso_enabled: bool,
+    custom_roles_enabled: bool,
 }

 impl AdminTemplateData {
@@ -263,6 +268,7 @@ impl AdminTemplateData {
            logged_in: true,
            urlpath: CONFIG.domain_path(),
            sso_enabled: CONFIG.sso_enabled(),
+            custom_roles_enabled: custom_roles_enabled(),
        }
    }

@@ -387,6 +393,18 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri

        usr["sso_identifier"] = json!(sso_u.map_or(String::new(), |u| u.identifier.to_string()));

+        // The clients are shown a Manager as a Custom member, but the admin panel tells the two roles apart
+        let roles: HashMap<String, i32> = Membership::find_confirmed_by_user(&u.uuid, &conn)
+            .await
+            .into_iter()
+            .map(|member| (member.org_uuid.to_string(), member.atype))
+            .collect();
+        for org in usr["organizations"].as_array_mut().into_iter().flatten() {
+            if let Some(atype) = org["id"].as_str().and_then(|org_id| roles.get(org_id)) {
+                org["type"] = json!(atype);
+            }
+        }
+
        users_json.push(usr);
    }

@@ -416,13 +434,21 @@ async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> Jso
 }

 #[post("/users/<user_id>/delete", format = "application/json")]
-async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
+async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
    let user = get_user_or_404(&user_id, &conn).await?;

-    // Get the membership records before deleting the actual user
+    // Get the membership records and push devices before deleting the actual user
    let memberships = Membership::find_any_state_by_user(&user_id, &conn).await;
+    let has_push_device = CONFIG.push_enabled() && Device::check_user_has_push_device(&user_id, &conn).await;
    let res = user.delete(&conn).await;

+    if res.is_ok() {
+        nt.send_logout(&user, None, &conn).await;
+        if has_push_device {
+            push_logout_to_relay(&user, None, None);
+        }
+    }
+
    for membership in memberships {
        log_event(
            EventType::OrganizationUserDeleted,
@@ -554,10 +580,14 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
        err!("The specified user isn't member of the organization")
    };

-    let new_type = if let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) {
-        new_type as i32
-    } else {
-        err!("Invalid type")
+    let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
+        // Unlike the clients, the admin panel tells the Custom and the legacy Manager role apart. Unless Custom roles
+        // are enabled, a Custom role is a Manager here as well, but an existing Custom member is kept as one.
+        Some(MembershipType::Custom) if !custom_roles_enabled() && !member_to_edit.has_type(MembershipType::Custom) => {
+            MembershipType::Manager
+        }
+        Some(new_type) => new_type,
+        None => err!("Invalid type"),
    };

    if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
@@ -567,7 +597,16 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
        }
    }

-    member_to_edit.atype = new_type;
+    // A Manager only becomes a Custom member if that changes nothing they may do. Here they would keep the permissions
+    // they are shown with, the admin panel can't give up their access to all collections, so that is refused.
+    if new_type == MembershipType::Custom
+        && let Some(loss) =
+            member_to_edit.custom_role_conversion_loss(&member_to_edit.legacy_manager_permissions(), &conn).await
+    {
+        err!(loss)
+    }
+
+    member_to_edit.set_type(new_type);
    // This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type
    OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;

@@ -779,6 +818,8 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
    .into_keys()
    .collect();

+    let invalid_env_vars = crate::util::INVALID_ENV_VARS.lock().unwrap().join(", ");
+
    let diagnostics_json = json!({
        "dns_resolved": dns_resolved,
        "current_release": VERSION,
@@ -801,7 +842,9 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
        "db_version": get_sql_server_version(&conn).await,
        "admin_url": format!("{}/diagnostics", admin_url()),
        "overrides": &CONFIG.get_overrides().join(", "),
+        "config_file_status": &CONFIG.get_config_file_status(),
        "template_overrides": check_template_overrides().join(", "),
+        "invalid_env_vars": invalid_env_vars,
        "invalid_feature_flags": invalid_feature_flags,
        "host_arch": env::consts::ARCH,
        "host_os":  env::consts::OS,
@@ -1,4 +1,4 @@
-use chrono::{TimeDelta, Utc};
+use chrono::Utc;
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;

@@ -15,8 +15,8 @@ use crate::{
    db::{
        DbConn, DbPool,
        models::{
-            Cipher, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType, Invitation,
-            Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
+            Cipher, EMERGENCY_ACCESS_TIMEOUT_RANGE, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus,
+            EmergencyAccessType, Invitation, Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
        },
    },
    mail,
@@ -136,19 +136,21 @@ async fn post_emergency_access(

    let data: EmergencyAccessUpdateData = data.into_inner();

+    let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
+        err!("Invalid emergency access type.")
+    };
+
+    if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&data.wait_time_days) {
+        err!("Emergency access wait time is out-of-bounds!")
+    }
+
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
    else {
        err!("Emergency access not valid.")
    };

-    let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
-        new_type as i32
-    } else {
-        err!("Invalid emergency access type.")
-    };
-
-    emergency_access.atype = new_type;
+    emergency_access.atype = new_type as i32;
    emergency_access.wait_time_days = data.wait_time_days;
    if data.key_encrypted.is_some() {
        emergency_access.key_encrypted = data.key_encrypted;
@@ -210,11 +212,11 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
    let email = data.email.to_lowercase();
    let wait_time_days = data.wait_time_days;

-    let emergency_access_status = EmergencyAccessStatus::Invited as i32;
+    if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&wait_time_days) {
+        err!("Emergency access wait time is out-of-bounds!")
+    }

-    let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
-        new_type as i32
-    } else {
+    let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
        err!("Invalid emergency access type.")
    };

@@ -260,6 +262,8 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
        err!(format!("Grantee user already invited: {}", &grantee_user.email))
    }

+    let new_type = new_type as i32;
+    let emergency_access_status = EmergencyAccessStatus::Invited as i32;
    let mut new_emergency_access =
        EmergencyAccess::new(grantor_user.uuid, grantee_user.email, emergency_access_status, new_type, wait_time_days);
    new_emergency_access.save(&conn).await?;
@@ -292,7 +296,7 @@ async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, conn: DbCon
    };

    if emergency_access.status != EmergencyAccessStatus::Invited as i32 {
-        err!("The grantee user is already accepted or confirmed to the organization");
+        err!("The grantee user is already accepted or confirmed for emergency access");
    }

    let Some(email) = emergency_access.email.clone() else {
@@ -453,11 +457,24 @@ async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &initiating_user.uuid, &conn).await
    else {
-        err!("Emergency access not valid.")
+        err!(
+            "Emergency access not valid.",
+            format!("Emergency access '{emer_id}', not found for user '{}'.", initiating_user.email)
+        )
    };

    if emergency_access.status != EmergencyAccessStatus::Confirmed as i32 {
-        err!("Emergency access not valid.")
+        err!(
+            "Emergency access not valid.",
+            format!("Emergency access '{emer_id}', not confirmed for user '{}'.", initiating_user.email)
+        )
+    }
+
+    if !EMERGENCY_ACCESS_TIMEOUT_RANGE.contains(&emergency_access.wait_time_days) {
+        err!(
+            "Emergency access not valid.",
+            format!("Emergency access '{emer_id}' timeout range '{}' is invalid", emergency_access.wait_time_days)
+        )
    }

    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &conn).await else {
@@ -490,11 +507,17 @@ async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
    else {
-        err!("Emergency access not valid.")
+        err!(
+            "Emergency access not valid.",
+            format!("Emergency access '{emer_id}', not found for user '{}'.", headers.user.email)
+        )
    };

    if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32 {
-        err!("Emergency access not valid.")
+        err!(
+            "Emergency access not valid.",
+            format!("Emergency access '{emer_id}', not initiated for user '{}'.", headers.user.email)
+        )
    }

    let Some(grantor_user) = User::find_by_uuid(&headers.user.uuid, &conn).await else {
@@ -747,52 +770,71 @@ pub async fn emergency_request_timeout_job(pool: DbPool) {
        return;
    }

-    if let Ok(conn) = pool.get().await {
-        let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
+    let Ok(conn) = pool.get().await else {
+        error!("Failed to get DB connection for emergency time-outs!");
+        return;
+    };

-        if emergency_access_list.is_empty() {
-            debug!("No emergency request timeout to approve");
-        }
+    let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;

-        let now = Utc::now().naive_utc();
-        for mut emer in emergency_access_list {
-            // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
-            let recovery_allowed_at =
-                emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days)).unwrap();
-            if recovery_allowed_at.le(&now) {
-                // Only update the access status
-                // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
-                emer.update_access_status_and_save(EmergencyAccessStatus::RecoveryApproved as i32, &now, &conn)
-                    .await
-                    .expect("Unable to update emergency access status");
+    if emergency_access_list.is_empty() {
+        debug!("No emergency request timeout to approve");
+        return;
+    }

-                if CONFIG.mail_enabled() {
-                    // get grantor user to send Accepted email
-                    let grantor_user =
-                        User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
-
-                    // get grantee user to send Accepted email
-                    let grantee_user =
-                        User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
-                            .await
-                            .expect("Grantee user not found");
-
-                    mail::send_emergency_access_recovery_timed_out(
-                        &grantor_user.email,
-                        &grantee_user.name,
-                        emer.get_type_as_str(),
-                    )
-                    .await
-                    .expect("Error on sending email");
-
-                    mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name)
-                        .await
-                        .expect("Error on sending email");
-                }
+    let now = Utc::now().naive_utc();
+    for mut emer in emergency_access_list {
+        match emer.is_recovery_allowed(&now) {
+            Ok(true) => {} // Recovery is allowed
+            Ok(false) => continue,
+            Err(e) => {
+                error!("Failed to check if recovery is allowed for '{}': {e}", emer.uuid);
+                continue;
+            }
+        }
+
+        // Get grantor user to send Accepted email
+        let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
+            error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
+            continue;
+        };
+
+        let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
+            error!("Missing grantee for emergency access '{}'", emer.uuid);
+            continue;
+        };
+
+        // Get grantee user to send Accepted email
+        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
+            error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
+            continue;
+        };
+
+        // Only update the access status
+        // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
+        let status_initiated = EmergencyAccessStatus::RecoveryInitiated as i32;
+        let status_approved = EmergencyAccessStatus::RecoveryApproved as i32;
+        if let Err(e) = emer.update_access_status_and_save(status_initiated, status_approved, &now, &conn).await {
+            error!("Unable to update emergency access status for '{}': {e}", emer.uuid);
+            continue;
+        }
+
+        if CONFIG.mail_enabled() {
+            if let Err(e) = mail::send_emergency_access_recovery_timed_out(
+                &grantor_user.email,
+                &grantee_user.name,
+                emer.get_type_as_str(),
+            )
+            .await
+            {
+                error!("Failed to send emergency access recovery time-out email for '{}': {e}", emer.uuid);
+            }
+
+            if let Err(e) = mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name).await
+            {
+                error!("Failed to send emergency access recovery approved email for '{}': {e}", emer.uuid);
            }
        }
-    } else {
-        error!("Failed to get DB connection while searching emergency request timed out");
    }
 }

@@ -802,55 +844,85 @@ pub async fn emergency_notification_reminder_job(pool: DbPool) {
        return;
    }

-    if let Ok(conn) = pool.get().await {
-        let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
+    let Ok(conn) = pool.get().await else {
+        error!("Failed to get DB connection for emergency reminders!");
+        return;
+    };

-        if emergency_access_list.is_empty() {
-            debug!("No emergency request reminder notification to send");
+    let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
+
+    if emergency_access_list.is_empty() {
+        debug!("No emergency request reminder notification to send");
+        return;
+    }
+
+    let now = Utc::now().naive_utc();
+    for mut emer in emergency_access_list {
+        let Ok(deadline_at) = emer.deadline_at() else {
+            error!("Invalid deadline for emergency access '{}'", emer.uuid);
+            continue;
+        };
+
+        let Some(final_reminder_at) = deadline_at.checked_sub_days(chrono::Days::new(1)) else {
+            error!("Cannot calculate reminder date for emergency access '{}'", emer.uuid);
+            continue;
+        };
+
+        // Only send reminders during the last 24 hours, else continue
+        if now < final_reminder_at || now >= deadline_at {
+            continue;
        }

-        let now = Utc::now().naive_utc();
-        for mut emer in emergency_access_list {
-            // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
-            // Calculate the day before the recovery will become active
-            let final_recovery_reminder_at =
-                emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days - 1)).unwrap();
-            // Calculate if a day has passed since the previous notification, else no notification has been sent before
-            let next_recovery_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
-                last_notification_at + TimeDelta::try_days(1).unwrap()
-            } else {
-                now
-            };
-            if final_recovery_reminder_at.le(&now) && next_recovery_reminder_at.le(&now) {
-                // Only update the last notification date
-                // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
-                emer.update_last_notification_date_and_save(&now, &conn)
-                    .await
-                    .expect("Unable to update emergency access notification date");
+        // Check if we did not sent a recovery mail in the past 24h already, else skip it.
+        // In case something goes wrong with the date calculation or `last_notification_at` is None we use now.
+        // This is to prevent possible missed reminders, this might cause an extra reminder,
+        // but that is better then no reminder at all.
+        let next_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
+            last_notification_at.checked_add_days(chrono::Days::new(1)).unwrap_or(now)
+        } else {
+            now
+        };

-                if CONFIG.mail_enabled() {
-                    // get grantor user to send Accepted email
-                    let grantor_user =
-                        User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
-
-                    // get grantee user to send Accepted email
-                    let grantee_user =
-                        User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
-                            .await
-                            .expect("Grantee user not found");
-
-                    mail::send_emergency_access_recovery_reminder(
-                        &grantor_user.email,
-                        &grantee_user.name,
-                        emer.get_type_as_str(),
-                        "1", // This notification is only triggered one day before the activation
-                    )
-                    .await
-                    .expect("Error on sending email");
-                }
-            }
+        // Only send a reminder if the `next_reminder_at` is less then or equal to `now`
+        // Else we can skip the current emergency access this run.
+        if next_reminder_at.gt(&now) {
+            continue;
+        }
+
+        // Get grantor user to send Reminder email
+        let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
+            error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
+            continue;
+        };
+
+        let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
+            error!("Missing grantee for emergency access '{}'", emer.uuid);
+            continue;
+        };
+
+        // Get grantee user to send Reminder email
+        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
+            error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
+            continue;
+        };
+
+        // Only update the last notification date
+        // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
+        if let Err(e) = emer.update_last_notification_date_and_save(&now, &conn).await {
+            error!("Unable to update emergency access reminder date for '{}': {e}", emer.uuid);
+            continue;
+        }
+
+        if CONFIG.mail_enabled()
+            && let Err(e) = mail::send_emergency_access_recovery_reminder(
+                &grantor_user.email,
+                &grantee_user.name,
+                emer.get_type_as_str(),
+                "1", // This notification is only triggered one day before the activation
+            )
+            .await
+        {
+            error!("Failed to send emergency access reminder email for '{}': {e}", emer.uuid);
        }
-    } else {
-        error!("Failed to get DB connection while searching emergency notification reminder");
    }
 }
@@ -10,7 +10,9 @@ use crate::{
    auth::{AdminHeaders, Headers},
    db::{
        DbConn, DbPool,
-        models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
+        models::{
+            Cipher, CipherAccessScope, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId,
+        },
    },
    error::MapResult,
    util::parse_date,
@@ -214,13 +216,13 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
-            // Client-side cipher events (viewed, copied, toggled, autofilled).
-            1107..=1114 | 1117 | 1119..=1132 => {
+            // Client-side cipher events (viewed, copied, toggled, autofilled, HTTP auth).
+            1107..=1114 | 1117 | 1119..=1133 => {
                // The cipher determines the organization the event is logged to, so make sure the
                // user can actually access it instead of trusting the provided cipher uuid.
                if let Some(cipher_uuid) = &event.cipher_id
                    && let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &conn).await
-                    && cipher.is_accessible_to_user(&headers.user.uuid, &conn).await
+                    && cipher.is_accessible_to_user(&headers.user.uuid, CipherAccessScope::User, &conn).await
                    && let Some(org_id) = cipher.organization_uuid
                {
                    log_event_impl(
@@ -347,14 +349,17 @@ async fn log_event_impl(

 pub async fn event_cleanup_job(pool: DbPool) {
    debug!("Start events cleanup job");
-    if CONFIG.events_days_retain().is_none() {
-        debug!("events_days_retain is not configured, abort");
+    if CONFIG.events_days_retain().is_none_or(|d| d == 0) {
+        debug!("events_days_retain is not configured or set to 0, skipping");
        return;
    }

-    if let Ok(conn) = pool.get().await {
-        Event::clean_events(&conn).await.ok();
-    } else {
+    let Ok(conn) = pool.get().await else {
        error!("Failed to get DB connection while trying to cleanup the events table");
+        return;
+    };
+
+    if let Err(e) = Event::clean_events(&conn).await {
+        error!("Failed to cleanup the events table: {e}");
    }
 }
@@ -14,6 +14,8 @@ pub use ciphers::{CipherData, CipherSyncData, CipherSyncType, purge_trashed_ciph
 pub use emergency_access::{emergency_notification_reminder_job, emergency_request_timeout_job};
 pub use events::{event_cleanup_job, log_event, log_user_event};
 pub use sends::purge_sends;
+#[cfg(feature = "unsafe_test_mode")]
+pub use {ciphers::seed_cipher, sends::seed_send};

 use reqwest::Method;
 use rocket::{Catcher, Route, serde::json::Json, serde::json::Value};
@@ -247,6 +249,7 @@ fn config() -> Json<Value> {
          "notifications": format!("{domain}/notifications"),
          "sso": "",
          "cloudRegion": null,
+          "fillAssistRules": CONFIG.fill_assist_rules_url(),
        },
        // Bitwarden uses this for the self-hosted servers to indicate the default push technology
        "push": {
@@ -8,17 +8,21 @@ use crate::{
    CONFIG,
    api::admin::FAKE_ADMIN_UUID,
    api::{
-        EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
+        ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
        core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor},
    },
-    auth::{AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite},
+    auth::{
+        AdminHeaders, CollectionAction, CollectionDeleteHeaders, CollectionReadHeaders, Headers, ManagerHeaders,
+        ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, custom_member_may, decode_invite,
+    },
    db::{
        DbConn,
        models::{
-            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, Device,
-            EventType, Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus,
-            MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor,
-            TwoFactorType, User, UserId,
+            Cipher, CipherAccessScope, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId,
+            CollectionUser, CustomPermission, Device, EventType, FillAssistPolicyData, Group, GroupId, GroupUser,
+            Invitation, Membership, MembershipId, MembershipStatus, MembershipType, OrgPolicy, OrgPolicyType,
+            Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User, UserId,
+            custom_roles_enabled,
        },
    },
    mail,
@@ -47,6 +51,7 @@ pub fn routes() -> Vec<Route> {
        bulk_delete_organization_collections,
        post_bulk_collections,
        get_org_details,
+        get_assigned_org_details,
        get_org_domain_sso_verified,
        get_members,
        send_invite,
@@ -131,13 +136,16 @@ impl FullCollectionData {
        let org_groups = Group::find_by_organization(org_id, conn).await;
        let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|c| &c.uuid).collect();
        if let Some(e) = self.groups.iter().find(|g| !org_group_ids.contains(&g.id)) {
-            err!("Invalid group", format!("Group {} does not belong to organization {}!", e.id, org_id))
+            err!("Invalid group", format!("Group {} does not belong to organization {}!", e.id.escape_debug(), org_id))
        }

        let org_memberships = Membership::find_by_org(org_id, conn).await;
        let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
        if let Some(e) = self.users.iter().find(|m| !org_membership_ids.contains(&m.id)) {
-            err!("Invalid member", format!("Member {} does not belong to organization {}!", e.id, org_id))
+            err!(
+                "Invalid member",
+                format!("Member {} does not belong to organization {}!", e.id.escape_debug(), org_id)
+            )
        }

        Ok(())
@@ -360,12 +368,24 @@ async fn get_org_collections(org_id: OrganizationId, headers: ManagerHeadersLoos
        err!("Organization not found", "Organization id's do not match");
    }

-    if !headers.membership.has_full_access() {
+    let collections = if headers.membership.can_view_all_collections() {
+        get_org_collections_impl(&org_id, &conn).await
+    } else if headers.membership.has_type(MembershipType::Custom) {
+        // A Custom member gets the collections they may manage
+        let manageable =
+            Collection::find_explicitly_manageable_by_user(&org_id, &headers.membership.user_uuid, &conn).await;
+        Collection::find_by_organization(&org_id, &conn)
+            .await
+            .iter()
+            .filter(|collection| manageable.contains(&collection.uuid))
+            .map(Collection::to_json)
+            .collect::<Value>()
+    } else {
        err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
-    }
+    };

    Ok(Json(json!({
-        "data": get_org_collections_impl(&org_id, &conn).await,
+        "data": collections,
        "object": "list",
        "continuationToken": null,
    })))
@@ -392,6 +412,12 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea
    // check if current user has full access to the organization (either directly or via any group)
    let has_full_access_to_org = member.has_full_access()
        || (CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(&org_id, &member.uuid, &conn).await);
+    // A Custom member gets every collection when they may see all of them, else the ones they may manage
+    let custom_collections = if member.has_type(MembershipType::Custom) && !member.can_view_all_collections() {
+        Some(Collection::find_explicitly_manageable_by_user(&org_id, &member.user_uuid, &conn).await)
+    } else {
+        None
+    };

    // Get all admins, owners and managers who can manage/access all
    // Those are currently not listed in the col_users but need to be listed too.
@@ -417,7 +443,12 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea
                && GroupUser::has_access_to_collection_by_member(&col.uuid, &member.uuid, &conn).await);

        // If the user is a manager, and is not assigned to this collection, skip this and continue with the next collection
-        if !assigned {
+        let listed = if member.has_type(MembershipType::Custom) {
+            custom_collections.as_ref().is_none_or(|manageable| manageable.contains(&col.uuid))
+        } else {
+            assigned
+        };
+        if !listed {
            continue;
        }

@@ -477,7 +508,10 @@ async fn post_organization_collections(
    let data: FullCollectionData = data.into_inner();
    data.validate(&org_id, &conn).await?;

-    if headers.membership.atype == MembershipType::Manager && !headers.membership.access_all {
+    if (headers.membership.atype == MembershipType::Manager && !headers.membership.access_all)
+        || (headers.membership.has_type(MembershipType::Custom)
+            && !headers.membership.has_custom_permission(CustomPermission::CreateNewCollections))
+    {
        err!("You don't have permission to create collections")
    }

@@ -552,7 +586,7 @@ async fn post_bulk_access_collections(
    let org_groups = Group::find_by_organization(&org_id, &conn).await;
    let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|g| &g.uuid).collect();
    if let Some(g) = data.groups.iter().find(|g| !org_group_ids.contains(&g.id)) {
-        err!("Invalid group", format!("Group {} does not belong to organization {}!", g.id, org_id))
+        err!("Invalid group", format!("Group {} does not belong to organization {}!", g.id.escape_debug(), org_id))
    }

    for col_id in data.collection_ids {
@@ -560,7 +594,12 @@ async fn post_bulk_access_collections(
            err!("Collection not found")
        };

-        if !collection.is_manageable_by_user(&headers.membership.user_uuid, &conn).await {
+        let manageable = if headers.membership.has_type(MembershipType::Custom) {
+            custom_member_may(CollectionAction::Edit, &headers.membership, &collection.uuid, &conn).await
+        } else {
+            collection.is_manageable_by_user(&headers.membership.user_uuid, &conn).await
+        };
+        if !manageable {
            err!("Collection not found", "The current user isn't a manager for this collection")
        }

@@ -673,7 +712,7 @@ async fn put_organization_collection_update(
 async fn delete_organization_collection_impl(
    org_id: &OrganizationId,
    col_id: &CollectionId,
-    headers: &ManagerHeaders,
+    headers: &CollectionDeleteHeaders,
    conn: &DbConn,
 ) -> EmptyResult {
    if org_id != &headers.org_id {
@@ -699,7 +738,7 @@ async fn delete_organization_collection_impl(
 async fn delete_organization_collection(
    org_id: OrganizationId,
    col_id: CollectionId,
-    headers: ManagerHeaders,
+    headers: CollectionDeleteHeaders,
    conn: DbConn,
 ) -> EmptyResult {
    delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
@@ -725,7 +764,7 @@ async fn bulk_delete_organization_collections(

    let collections = data.ids;

-    let headers = ManagerHeaders::from_loose(headers, &collections, &conn).await?;
+    let headers = CollectionDeleteHeaders::from_loose(headers, &collections, &conn).await?;

    for col_id in collections {
        delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await?;
@@ -737,23 +776,28 @@ async fn bulk_delete_organization_collections(
 async fn get_org_collection_detail(
    org_id: OrganizationId,
    col_id: CollectionId,
-    headers: ManagerHeaders,
+    headers: CollectionReadHeaders,
    conn: DbConn,
 ) -> JsonResult {
    if org_id != headers.org_id {
        err!("Organization not found", "Organization id's do not match");
    }
-    match Collection::find_by_uuid_and_user(&col_id, headers.user.uuid.clone(), &conn).await {
+    let Some(member) = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await else {
+        err!("User is not part of organization")
+    };
+    // A Custom member may be allowed to read a collection they are not assigned to
+    let collection = if member.has_type(MembershipType::Custom) {
+        Collection::find_by_uuid_and_org(&col_id, &org_id, &conn).await
+    } else {
+        Collection::find_by_uuid_and_user(&col_id, headers.user.uuid.clone(), &conn).await
+    };
+    match collection {
        None => err!("Collection not found"),
        Some(collection) => {
            if collection.org_uuid != org_id {
                err!("Collection is not owned by organization")
            }

-            let Some(member) = Membership::find_by_user_and_org(&headers.user.uuid, &org_id, &conn).await else {
-                err!("User is not part of organization")
-            };
-
            let groups: Vec<Value> = if CONFIG.org_groups_enabled() {
                CollectionGroup::find_by_collection(&collection.uuid, &conn)
                    .await
@@ -802,7 +846,7 @@ async fn get_org_collection_detail(
 async fn get_collection_users(
    org_id: OrganizationId,
    col_id: CollectionId,
-    headers: ManagerHeaders,
+    headers: CollectionReadHeaders,
    conn: DbConn,
 ) -> JsonResult {
    if org_id != headers.org_id {
@@ -838,7 +882,7 @@ async fn get_org_details(data: OrgIdData, headers: ManagerHeadersLoose, conn: Db
        err_code!("Resource not found.", "Organization id's do not match", Status::NotFound.code);
    }

-    if !headers.membership.has_full_access() {
+    if !headers.membership.can_edit_any_collection() {
        err_code!("Resource not found.", "User does not have full access", Status::NotFound.code);
    }

@@ -856,7 +900,12 @@ async fn get_org_details_impl(
    conn: &DbConn,
 ) -> Result<Value, crate::Error> {
    let ciphers = Cipher::find_by_org(org_id, conn).await;
-    let cipher_sync_data = CipherSyncData::new(user_id, CipherSyncType::Organization, conn).await;
+    let mut cipher_sync_data = CipherSyncData::new(user_id, CipherSyncType::Organization, conn).await;
+    // Every cipher of the organization is listed, so list every collection of them too
+    cipher_sync_data.cipher_collections = HashMap::new();
+    for (cipher_id, collection_id) in Cipher::get_collections_with_cipher_by_organization(org_id, conn).await {
+        cipher_sync_data.cipher_collections.entry(cipher_id).or_default().push(collection_id);
+    }

    let mut ciphers_json = Vec::with_capacity(ciphers.len());
    for c in ciphers {
@@ -865,6 +914,39 @@ async fn get_org_details_impl(
    Ok(json!(ciphers_json))
 }

+// The Admin Console lists these instead of every cipher of the organization for a member who may not edit every
+// cipher, like a Custom member with Delete any collection only. As in Bitwarden, any confirmed member may list them.
+#[get("/ciphers/organization-details/assigned?<data..>")]
+async fn get_assigned_org_details(data: OrgIdData, headers: Headers, conn: DbConn) -> JsonResult {
+    let Some(member) =
+        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &data.organization_id, &conn).await
+    else {
+        err_code!("Resource not found.", "User is not a confirmed member of the organization", Status::NotFound.code);
+    };
+
+    let (assigned, unassigned) = Cipher::find_assigned_to_member(&member, &conn).await;
+    let mut ciphers_json = Vec::with_capacity(assigned.len() + unassigned.len());
+    // The ciphers of the member's own vault, as they are there
+    let cipher_sync_data = CipherSyncData::new(&headers.user.uuid, CipherSyncType::User, &conn).await;
+    for cipher in assigned {
+        ciphers_json.push(
+            cipher
+                .to_json(&headers.host, &headers.user.uuid, Some(&cipher_sync_data), CipherSyncType::User, &conn)
+                .await?,
+        );
+    }
+    // The ciphers in no collection, as the member may use them in the Admin Console
+    for cipher in unassigned {
+        ciphers_json.push(cipher.to_json_org_admin(&headers.host, &headers.user.uuid, &conn).await?);
+    }
+
+    Ok(Json(json!({
+        "data": ciphers_json,
+        "object": "list",
+        "continuationToken": null,
+    })))
+}
+
 // Returning a Domain/Organization here allow to prefill it and prevent prompting the user
 // So we return a dummy value, since we only support a single SSO integration, and do not use the response anywhere
 // In use since `v2025.6.0`, appears to use only the first `organizationIdentifier`
@@ -975,13 +1057,16 @@ impl InviteData {
        let org_collections = Collection::find_by_organization(org_id, conn).await;
        let org_collection_ids: HashSet<&CollectionId> = org_collections.iter().map(|c| &c.uuid).collect();
        if let Some(e) = self.collections.iter().flatten().find(|c| !org_collection_ids.contains(&c.id)) {
-            err!("Invalid collection", format!("Collection {} does not belong to organization {}!", e.id, org_id))
+            err!(
+                "Invalid collection",
+                format!("Collection {} does not belong to organization {}!", e.id.escape_debug(), org_id)
+            )
        }

        let org_groups = Group::find_by_organization(org_id, conn).await;
        let org_group_ids: HashSet<&GroupId> = org_groups.iter().map(|c| &c.uuid).collect();
        if let Some(e) = self.groups.iter().find(|g| !org_group_ids.contains(g)) {
-            err!("Invalid group", format!("Group {} does not belong to organization {}!", e, org_id))
+            err!("Invalid group", format!("Group {} does not belong to organization {}!", e.escape_debug(), org_id))
        }

        Ok(())
@@ -1002,14 +1087,18 @@ async fn send_invite(
    data.validate(&org_id, &conn).await?;

    // HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission
-    // The from_str() will convert the custom role type into a manager role type
+    // Unless Custom roles are enabled, a custom role (4) is converted to a manager role (3)
    let raw_type = &data.r#type.into_string();
-    // Membership::from_str will convert custom (4) to manager (3)
-    let new_type = if let Some(new_type) = MembershipType::from_str(raw_type) {
-        new_type as i32
-    } else {
+    let Some(requested_type) = MembershipType::from_str(raw_type) else {
        err!("Invalid type")
    };
+    // Checked before anything is created, so a rejected permission leaves nothing behind
+    let custom_permissions = if requested_type == MembershipType::Custom && custom_roles_enabled() {
+        Some(CustomPermission::requested(&data.permissions)?)
+    } else {
+        None
+    };
+    let new_type = MembershipType::requested(requested_type, None, custom_permissions.as_ref());

    if new_type != MembershipType::User && headers.membership_type != MembershipType::Owner {
        err!("Only Owners can invite Managers, Admins or Owners")
@@ -1019,7 +1108,8 @@ async fn send_invite(
    // Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes
    // If the box is not checked, the user will still be a manager, but not with the access_all permission
    let access_all = new_type >= MembershipType::Admin
-        || (raw_type.eq("4")
+        || (new_type == MembershipType::Manager
+            && raw_type.eq("4")
            && data.permissions.get("editAnyCollection") == Some(&json!(true))
            && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
            && data.permissions.get("createNewCollections") == Some(&json!(true)));
@@ -1065,8 +1155,11 @@ async fn send_invite(
        };

        let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(headers.user.email.clone()));
+        new_member.set_type(new_type);
        new_member.access_all = access_all;
-        new_member.atype = new_type;
+        if let Some(permissions) = &custom_permissions {
+            new_member.set_custom_permissions(permissions);
+        }
        new_member.status = member_status;
        new_member.save(&conn).await?;

@@ -1156,7 +1249,10 @@ async fn bulk_reinvite_members(
    for member_id in data.ids {
        let err_msg = match reinvite_member_impl(&org_id, &member_id, &headers.user.email, &conn).await {
            Ok(()) => String::new(),
-            Err(e) => format!("{e:?}"),
+            Err(e) => {
+                warn!("Unable to reinvite member {}: {e:?}", member_id.escape_debug());
+                e.message().to_owned()
+            }
        };

        bulk_response.push(json!(
@@ -1329,7 +1425,10 @@ async fn bulk_confirm_invite(
                let user_key = invite.key.unwrap_or_default();
                let err_msg = match confirm_invite_impl(&org_id, &member_id, &user_key, &headers, &conn, &nt).await {
                    Ok(()) => String::new(),
-                    Err(e) => format!("{e:?}"),
+                    Err(e) => {
+                        warn!("Unable to confirm member {}: {e:?}", member_id.escape_debug());
+                        e.message().to_owned()
+                    }
                };

                bulk_response.push(json!(
@@ -1437,6 +1536,11 @@ async fn get_org_user_mini_details(org_id: OrganizationId, headers: ManagerHeade
    if org_id != headers.membership.org_uuid {
        err!("Organization not found", "Organization id's do not match");
    }
+    if headers.membership.has_type(MembershipType::Custom)
+        && !may_assign_collection_access(&headers.membership, &conn).await
+    {
+        err_code!("Resource not found.", "User does not have access", Status::NotFound.code);
+    }
    let mut members_json = Vec::new();
    for m in Membership::find_by_org(&org_id, &conn).await {
        members_json.push(m.to_json_mini_details(&conn).await);
@@ -1496,26 +1600,40 @@ async fn edit_member(
    let data: EditUserData = data.into_inner();

    // HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission
-    // The from_str() will convert the custom role type into a manager role type
+    // Unless Custom roles are enabled, a custom role (4) is converted to a manager role (3)
    let raw_type = &data.r#type.into_string();
-    // MembershipType::from_str will convert custom (4) to manager (3)
-    let Some(new_type) = MembershipType::from_str(raw_type) else {
+    let Some(requested_type) = MembershipType::from_str(raw_type) else {
        err!("Invalid type")
    };

+    let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else {
+        err!("The specified user isn't member of the organization")
+    };
+    // While Custom roles are disabled, a Custom member keeps their stored permissions untouched
+    let custom_permissions = if requested_type == MembershipType::Custom && custom_roles_enabled() {
+        Some(CustomPermission::requested(&data.permissions)?)
+    } else {
+        None
+    };
+    let new_type = MembershipType::requested(requested_type, Some(&member_to_edit), custom_permissions.as_ref());
+    // A Manager whose permissions are changed only becomes a Custom member if that keeps what they may do
+    if new_type == MembershipType::Custom
+        && let Some(permissions) = &custom_permissions
+        && let Some(loss) = member_to_edit.custom_role_conversion_loss(permissions, &conn).await
+    {
+        err!(loss)
+    }
+
    // HACK: This converts the Custom role which has the `Manage all collections` box checked into an access_all flag
    // Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes
    // If the box is not checked, the user will still be a manager, but not with the access_all permission
    let access_all = new_type >= MembershipType::Admin
-        || (raw_type.eq("4")
+        || (new_type == MembershipType::Manager
+            && raw_type.eq("4")
            && data.permissions.get("editAnyCollection") == Some(&json!(true))
            && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
            && data.permissions.get("createNewCollections") == Some(&json!(true)));

-    let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else {
-        err!("The specified user isn't member of the organization")
-    };
-
    if new_type != member_to_edit.atype
        && (member_to_edit.atype >= MembershipType::Admin || new_type >= MembershipType::Admin)
        && headers.membership_type != MembershipType::Owner
@@ -1537,8 +1655,11 @@ async fn edit_member(
        }
    }

+    member_to_edit.set_type(new_type);
    member_to_edit.access_all = access_all;
-    member_to_edit.atype = new_type as i32;
+    if let Some(permissions) = custom_permissions.as_ref().filter(|_| new_type == MembershipType::Custom) {
+        member_to_edit.set_custom_permissions(permissions);
+    }

    // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type
    // We need to perform the check after changing the type since `admin` is exempt.
@@ -1610,7 +1731,10 @@ async fn bulk_delete_member(
    for member_id in data.ids {
        let err_msg = match delete_member_impl(&org_id, &member_id, &headers, &conn, &nt).await {
            Ok(()) => String::new(),
-            Err(e) => format!("{e:?}"),
+            Err(e) => {
+                warn!("Unable to delete member {}: {e:?}", member_id.escape_debug());
+                e.message().to_owned()
+            }
        };

        bulk_response.push(json!(
@@ -1764,6 +1888,46 @@ struct RelationsData {
    value: usize,
 }

+fn validate_org_import_relationships(data: &ImportData) -> ApiResult<Vec<(usize, usize)>> {
+    let mut relations = Vec::with_capacity(data.collection_relationships.len());
+    let mut seen = HashSet::new();
+    for relation in &data.collection_relationships {
+        if relation.key >= data.ciphers.len() || relation.value >= data.collections.len() {
+            err!(Compact, "Invalid collection relationship")
+        }
+        if seen.insert((relation.key, relation.value)) {
+            relations.push((relation.key, relation.value));
+        }
+    }
+    Ok(relations)
+}
+
+async fn validate_org_import_collections(
+    imported: &[ImportCollectionData],
+    org_id: &OrganizationId,
+    membership: &Membership,
+    conn: &DbConn,
+) -> ApiResult<HashMap<CollectionId, Collection>> {
+    let existing: HashMap<CollectionId, Collection> =
+        Collection::find_by_organization(org_id, conn).await.into_iter().map(|c| (c.uuid.clone(), c)).collect();
+    for col in imported {
+        if let Some(collection) = col.id.as_ref().and_then(|id| existing.get(id)) {
+            if membership.atype < MembershipType::Admin
+                && !membership.can_edit_any_collection()
+                && !collection.is_writable_by_user(&membership.user_uuid, conn).await
+            {
+                err!(Compact, "The current user isn't allowed to manage this collection")
+            }
+        } else if membership.atype <= MembershipType::Manager
+            && !membership.has_full_access()
+            && !membership.has_custom_permission(CustomPermission::CreateNewCollections)
+        {
+            err!(Compact, "The current user isn't allowed to create new collections")
+        }
+    }
+    Ok(existing)
+}
+
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/ImportCiphersController.cs#L62
 #[post("/ciphers/import-organization?<query..>", data = "<data>")]
 async fn post_org_import(
@@ -1789,73 +1953,171 @@ async fn post_org_import(
    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
    Cipher::validate_cipher_data(&data.ciphers)?;

-    let existing_collections: HashMap<CollectionId, Collection> =
-        Collection::find_by_organization(&org_id, &conn).await.into_iter().map(|c| (c.uuid.clone(), c)).collect();
-    let mut collections: Vec<CollectionId> = Vec::with_capacity(data.collections.len());
-    for col in data.collections {
-        let existing = col.id.as_ref().and_then(|col_id| existing_collections.get(col_id));
-        let collection_uuid = if let Some(collection) = existing {
-            // When not an Owner or Admin, check if the member is allowed to write to the collection.
-            if headers.membership.atype < MembershipType::Admin
-                && !collection.is_writable_by_user(&headers.membership.user_uuid, &conn).await
-            {
-                err!(Compact, "The current user isn't allowed to manage this collection")
+    let relations = validate_org_import_relationships(&data)?;
+    let ImportData {
+        ciphers: imported_ciphers,
+        collections: imported_collections,
+        ..
+    } = data;
+    let grant_new_collection_manage = headers.membership.has_type(MembershipType::Custom);
+    let importer_uuid = headers.membership.user_uuid.clone();
+    let OrgMemberHeaders {
+        host,
+        device,
+        user,
+        membership,
+        ip,
+    } = headers;
+    let headers = Headers {
+        host,
+        device,
+        user,
+        ip,
+    };
+
+    // Keep authorization and every write on the same connection. A failure at any later cipher or
+    // relationship must also roll back newly created collections and their Manage assignments.
+    conn.transaction(async || {
+        let existing = validate_org_import_collections(&imported_collections, &org_id, &membership, &conn).await?;
+        let mut collections: Vec<CollectionId> = Vec::with_capacity(imported_collections.len());
+        for col in imported_collections {
+            let collection_uuid = if let Some(collection) = col.id.as_ref().and_then(|id| existing.get(id)) {
+                collection.uuid.clone()
+            } else {
+                let new_collection = Collection::new(org_id.clone(), col.name, col.external_id);
+                new_collection.save(&conn).await?;
+                if grant_new_collection_manage {
+                    CollectionUser::save(&importer_uuid, &new_collection.uuid, false, false, true, &conn).await?;
+                }
+                new_collection.uuid
+            };
+            collections.push(collection_uuid);
+        }
+
+        let mut assigned = vec![Vec::<CollectionId>::new(); imported_ciphers.len()];
+        for (cipher_index, collection_index) in relations {
+            assigned[cipher_index].push(collections[collection_index].clone());
+        }
+        for (mut cipher_data, collection_ids) in imported_ciphers.into_iter().zip(assigned) {
+            cipher_data.folder_id = None;
+            // The authenticated membership, rather than the imported file, selects the organization.
+            cipher_data.organization_id = Some(org_id.clone());
+            let mut cipher = Cipher::new(cipher_data.r#type);
+            update_cipher_from_data(
+                &mut cipher,
+                cipher_data,
+                &headers,
+                Some(collection_ids.clone()),
+                &conn,
+                &nt,
+                UpdateType::None,
+                false,
+            )
+            .await?;
+            for collection_id in collection_ids {
+                CollectionCipher::save(&cipher.uuid, &collection_id, &conn).await?;
            }
-            collection.uuid.clone()
-        } else {
-            // We do not allow users or managers which can not manage all collections to create new collections
-            // If there is any collection other than an existing import collection, abort the import.
-            if headers.membership.atype <= MembershipType::Manager && !headers.membership.has_full_access() {
-                err!(Compact, "The current user isn't allowed to create new collections")
+        }
+
+        let mut user = headers.user;
+        user.update_revision(&conn).await
+    })
+    .await
+}
+
+#[cfg(all(test, feature = "sqlite"))]
+mod org_import_tests {
+    use super::*;
+    use crate::{
+        api::notifications::{WS_USERS, WebSocketUsers},
+        db::{models::test_flag, test_db},
+    };
+    use diesel::connection::SimpleConnection;
+    use std::sync::Arc;
+
+    #[test]
+    fn imports_preserve_authorization_atomicity_and_creator_access() {
+        test_db::run(async |db| {
+            let conn = db.conn();
+            for (case, role, permission) in [
+                ("owner", MembershipType::Owner, CustomPermission::CreateNewCollections),
+                ("admin", MembershipType::Admin, CustomPermission::CreateNewCollections),
+                ("cipher", MembershipType::Custom, CustomPermission::CreateNewCollections),
+                ("custom", MembershipType::Custom, CustomPermission::CreateNewCollections),
+                ("legacy", MembershipType::Manager, CustomPermission::CreateNewCollections),
+                ("authorization", MembershipType::Custom, CustomPermission::CreateNewCollections),
+                ("rollback", MembershipType::Custom, CustomPermission::CreateNewCollections),
+                ("index", MembershipType::Custom, CustomPermission::CreateNewCollections),
+                ("disabled", MembershipType::Custom, CustomPermission::CreateNewCollections),
+                ("export", MembershipType::Owner, CustomPermission::CreateNewCollections),
+            ] {
+                test_flag::CUSTOM_ROLES_ENABLED.set(Some(case != "disabled"));
+                let org = test_db::organization(&conn).await;
+                let permissions = if role == MembershipType::Custom {
+                    vec![permission]
+                } else {
+                    vec![]
+                };
+                let (user, mut membership) = test_db::member(&conn, &org.uuid, role, &permissions).await;
+                membership.access_all = role == MembershipType::Manager;
+                membership.save(&conn).await.unwrap();
+                let mut payload = json!({"ciphers":[{"name":"Cipher","type":2,"encryptedFor":user.uuid,"secureNote":{"type":0}}],
+                    "collections":[{"name":"New"}],"collectionRelationships":[{"key":0,"value":0}]});
+                match case {
+                    "authorization" => {
+                        let existing=test_db::collection(&conn,&org.uuid).await;
+                        payload["collections"].as_array_mut().unwrap().push(json!({"name":"Existing","id":existing.uuid}));
+                    }
+                    "cipher" => {
+                        payload["ciphers"].as_array_mut().unwrap().push(json!({"name":"Invalid","type":99,"encryptedFor":user.uuid,"secureNote":{"type":0}}));
+                        payload["collectionRelationships"].as_array_mut().unwrap().push(json!({"key":1,"value":0}));
+                    }
+                    "rollback" => conn.run(|c| c.batch_execute("CREATE TRIGGER reject_link BEFORE INSERT ON ciphers_collections BEGIN SELECT RAISE(ABORT,'test failure'); END")).await.unwrap(),
+                    "index" => payload["collectionRelationships"][0]["value"]=json!(1),
+                    "export" => payload["collectionRelationships"]=json!([]),
+                    _ => {}
+                }
+                let user_id = user.uuid.clone();
+                let headers = OrgMemberHeaders {
+                    host: "http://localhost".into(),
+                    device: Device::new("test".to_owned().into(), user_id.clone(), "test".into(), 1),
+                    user,
+                    membership,
+                    ip: crate::auth::ClientIp {
+                        ip: "127.0.0.1".parse().unwrap(),
+                    },
+                };
+                let rocket = rocket::build().manage(Arc::clone(&WS_USERS));
+                let notify = rocket.state::<Arc<WebSocketUsers>>().unwrap();
+                let result = post_org_import(
+                    OrgIdData {
+                        organization_id: org.uuid.clone(),
+                    },
+                    Json(serde_json::from_value(payload).unwrap()),
+                    headers,
+                    db.conn(),
+                    notify.into(),
+                )
+                .await;
+                conn.run(|c| c.batch_execute("DROP TRIGGER IF EXISTS reject_link")).await.unwrap();
+                let success = matches!(case, "owner" | "admin" | "custom" | "legacy" | "export");
+                assert_eq!(result.is_ok(), success, "{case}");
+                assert_eq!(
+                    Collection::find_by_organization(&org.uuid, &conn).await.len(),
+                    usize::from(success || case == "authorization")
+                );
+                assert_eq!(Cipher::find_by_org(&org.uuid, &conn).await.len(), usize::from(success));
+                assert_eq!(
+                    CollectionUser::find_by_user(&user_id, &conn).await.len(),
+                    usize::from(success && role == MembershipType::Custom)
+                );
+                assert_eq!(
+                    Cipher::get_collections_with_cipher_by_organization(&org.uuid, &conn).await.len(),
+                    usize::from(success && case != "export")
+                );
            }
-            let new_collection = Collection::new(org_id.clone(), col.name, col.external_id);
-            new_collection.save(&conn).await?;
-            new_collection.uuid
-        };
-
-        collections.push(collection_uuid);
+        });
    }
-
-    // Read the relations between collections and ciphers
-    // Ciphers can be in multiple collections at the same time
-    let mut relations = Vec::with_capacity(data.collection_relationships.len());
-    for relation in data.collection_relationships {
-        relations.push((relation.key, relation.value));
-    }
-
-    let headers: Headers = headers.into();
-
-    let mut ciphers: Vec<CipherId> = Vec::with_capacity(data.ciphers.len());
-    for mut cipher_data in data.ciphers {
-        // Always clear folder_id's via an organization import
-        cipher_data.folder_id = None;
-        // Replace the client-provided, unvalidated organizationId with the real target org
-        cipher_data.organization_id = Some(org_id.clone());
-        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
-        update_cipher_from_data(
-            &mut cipher,
-            cipher_data,
-            &headers,
-            Some(collections.clone()),
-            &conn,
-            &nt,
-            UpdateType::None,
-        )
-        .await
-        .ok();
-        ciphers.push(cipher.uuid);
-    }
-
-    // Assign the collections
-    for (cipher_index, col_index) in relations {
-        let (Some(cipher_id), Some(col_id)) = (ciphers.get(cipher_index), collections.get(col_index)) else {
-            err!(Compact, "Invalid collection relationship")
-        };
-        CollectionCipher::save(cipher_id, col_id, &conn).await?;
-    }
-
-    let mut user = headers.user;
-    user.update_revision(&conn).await
 }

 #[derive(Deserialize)]
@@ -1873,29 +2135,37 @@ struct BulkCollectionsData {
 async fn post_bulk_collections(data: Json<BulkCollectionsData>, headers: Headers, conn: DbConn) -> EmptyResult {
    let data: BulkCollectionsData = data.into_inner();

-    if Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &data.organization_id, &conn).await.is_none() {
+    let Some(member) =
+        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, &data.organization_id, &conn).await
+    else {
        err!("You need to be a Member of the Organization to call this endpoint")
-    }
+    };
+    // A member who may edit any collection may use every collection of the organization
+    let can_edit_any_collection = member.can_edit_any_collection();

    // Get all the collection available to the user in one query
    // Also filter based upon the provided collections
-    let user_collections: HashMap<CollectionId, Collection> =
-        Collection::find_by_organization_and_user_uuid(&data.organization_id, &headers.user.uuid, &conn)
-            .await
-            .into_iter()
-            .filter_map(|c| {
-                if data.collection_ids.contains(&c.uuid) {
-                    Some((c.uuid.clone(), c))
-                } else {
-                    None
-                }
-            })
-            .collect();
+    let collections = if can_edit_any_collection {
+        Collection::find_by_organization(&data.organization_id, &conn).await
+    } else {
+        Collection::find_by_organization_and_user_uuid(&data.organization_id, &headers.user.uuid, &conn).await
+    };
+    let user_collections: HashMap<CollectionId, Collection> = collections
+        .into_iter()
+        .filter_map(|c| {
+            if data.collection_ids.contains(&c.uuid) {
+                Some((c.uuid.clone(), c))
+            } else {
+                None
+            }
+        })
+        .collect();

    // Verify if all the collections requested exists and are writable for the user, else abort
    for collection_uuid in &data.collection_ids {
        match user_collections.get(collection_uuid) {
-            Some(collection) if collection.is_writable_by_user(&headers.user.uuid, &conn).await => (),
+            Some(collection)
+                if can_edit_any_collection || collection.is_writable_by_user(&headers.user.uuid, &conn).await => {}
            _ => err_code!("Resource not found", "User does not have access to a collection", 404),
        }
    }
@@ -1904,7 +2174,7 @@ async fn post_bulk_collections(data: Json<BulkCollectionsData>, headers: Headers
        // Only act on existing cipher uuid's
        // Do not abort the operation just ignore it, it could be a cipher was just deleted for example
        if let Some(cipher) = Cipher::find_by_uuid_and_org(cipher_id, &data.organization_id, &conn).await
-            && cipher.is_write_accessible_to_user(&headers.user.uuid, &conn).await
+            && cipher.is_write_accessible_to_user(&headers.user.uuid, CipherAccessScope::OrganizationAdmin, &conn).await
        {
            // When selecting a specific collection from the left filter list, and use the bulk option, you can remove an item from that collection
            // In these cases the client will call this endpoint twice, once for adding the new collections and a second for deleting.
@@ -2039,6 +2309,29 @@ async fn put_policy(
        err!("Invalid or unsupported policy type")
    };

+    let current_policy = OrgPolicy::find_by_org_and_type(&org_id, pol_type_enum, &conn).await;
+    let is_currently_enabled = current_policy.as_ref().is_some_and(|policy| policy.enabled);
+
+    // Fill Assist depends on Single Organization. Match Bitwarden's dependency checks by only checking when the
+    // policy changes state.
+    if pol_type_enum == OrgPolicyType::FillAssist && data.enabled && !is_currently_enabled {
+        let single_org_policy_enabled =
+            OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::SingleOrg, &conn).await.is_some_and(|p| p.enabled);
+
+        if !single_org_policy_enabled {
+            err!("Turn on the Single organization policy because it is required for the Activate fill assist policy.")
+        }
+    }
+
+    if pol_type_enum == OrgPolicyType::SingleOrg && !data.enabled && is_currently_enabled {
+        let fill_assist_policy_enabled =
+            OrgPolicy::find_by_org_and_type(&org_id, OrgPolicyType::FillAssist, &conn).await.is_some_and(|p| p.enabled);
+
+        if fill_assist_policy_enabled {
+            err!("Turn off the Activate fill assist policy because it requires the Single organization policy.")
+        }
+    }
+
    // Bitwarden only allows the Reset Password policy when Single Org policy is enabled
    // Vaultwarden encouraged to use multiple orgs instead of groups because groups were not available in the past
    // Now that groups are available we can enforce this option when wanted.
@@ -2071,6 +2364,37 @@ async fn put_policy(
        }
    }

+    if pol_type_enum == OrgPolicyType::FillAssist {
+        let fill_assist_data = match data.data.as_ref() {
+            None | Some(Value::Null) => FillAssistPolicyData {
+                rules_url: None,
+            },
+            Some(data) => {
+                let Ok(data) = serde_json::from_value::<FillAssistPolicyData>(data.clone()) else {
+                    err!("Invalid data for FillAssist policy: rulesUrl has an invalid value.")
+                };
+                data
+            }
+        };
+
+        if data.enabled {
+            let Some(rules_url) = fill_assist_data.rules_url.filter(|url| !url.trim().is_empty()) else {
+                err!("The RulesUrl field is required.")
+            };
+            let Ok(rules_url) = url::Url::parse(&rules_url) else {
+                err!("The RulesUrl field is not a valid fully-qualified http, https, or ftp URL.")
+            };
+
+            if !rules_url.has_host() || !matches!(rules_url.scheme(), "http" | "https" | "ftp") {
+                err!("The RulesUrl field is not a valid fully-qualified http, https, or ftp URL.")
+            }
+
+            if rules_url.scheme() != "https" {
+                err!("RulesUrl must use HTTPS.")
+            }
+        }
+    }
+
    // When enabling the TwoFactorAuthentication policy, revoke all members that do not have 2FA
    if pol_type_enum == OrgPolicyType::TwoFactorAuthentication && data.enabled {
        two_factor::enforce_2fa_policy_for_org(
@@ -2102,7 +2426,7 @@ async fn put_policy(
                }

                log_event(
-                    EventType::OrganizationUserRemoved,
+                    EventType::OrganizationUserRevokedSingleOrganizationNonCompliance,
                    &member.uuid,
                    &org_id,
                    &headers.user.uuid,
@@ -2118,7 +2442,7 @@ async fn put_policy(
        }
    }

-    let mut policy = match OrgPolicy::find_by_org_and_type(&org_id, pol_type_enum, &conn).await {
+    let mut policy = match current_policy {
        Some(p) => p,
        None => OrgPolicy::new(org_id.clone(), pol_type_enum, false, "{}".to_owned()),
    };
@@ -2222,7 +2546,10 @@ async fn bulk_revoke_members(
            for member_id in members {
                let err_msg = match revoke_member_impl(&org_id, &member_id, &headers, &conn).await {
                    Ok(()) => String::new(),
-                    Err(e) => format!("{e:?}"),
+                    Err(e) => {
+                        warn!("Unable to revoke member {}: {e:?}", member_id.escape_debug());
+                        e.message().to_owned()
+                    }
                };

                bulk_response.push(json!(
@@ -2325,7 +2652,10 @@ async fn bulk_restore_members(
    for member_id in data.ids {
        let err_msg = match restore_member_impl(&org_id, &member_id, &headers, &conn).await {
            Ok(()) => String::new(),
-            Err(e) => format!("{e:?}"),
+            Err(e) => {
+                warn!("Unable to restore member {}: {e:?}", member_id.escape_debug());
+                e.message().to_owned()
+            }
        };

        bulk_response.push(json!(
@@ -2385,6 +2715,14 @@ async fn restore_member_impl(
    Ok(())
 }

+/// Whether a member may give others access to collections, and so needs to see the members and groups: by seeing
+/// or creating any collection, or by the manage option on a collection.
+async fn may_assign_collection_access(member: &Membership, conn: &DbConn) -> bool {
+    member.can_view_all_collections()
+        || member.has_custom_permission(CustomPermission::CreateNewCollections)
+        || Collection::has_manageable_collection_by_user(&member.org_uuid, &member.user_uuid, conn).await
+}
+
 async fn get_groups_data(
    details: bool,
    org_id: OrganizationId,
@@ -2398,14 +2736,15 @@ async fn get_groups_data(
    // The details view (group→collection/user mappings) needs full org access; the plain list only
    // needs manage access to a collection, so a manager of a collection (directly or via a group)
    // can load it to assign groups.
+    // A group with access to all collections gives a Custom member access to them, but not to the Admin Console.
    let has_full_access = headers.membership.has_full_access()
        || (CONFIG.org_groups_enabled()
+            && !headers.membership.has_type(MembershipType::Custom)
            && GroupUser::has_full_access_by_member(&org_id, &headers.membership.uuid, &conn).await);
    let allowed = if details {
        has_full_access
    } else {
-        has_full_access
-            || Collection::has_manageable_collection_by_user(&org_id, &headers.membership.user_uuid, &conn).await
+        has_full_access || may_assign_collection_access(&headers.membership, &conn).await
    };
    if !allowed {
        err_code!("Resource not found.", "User does not have access", Status::NotFound.code);
@@ -2478,13 +2817,16 @@ impl GroupRequest {
        let org_collections = Collection::find_by_organization(org_id, conn).await;
        let org_collection_ids: HashSet<&CollectionId> = org_collections.iter().map(|c| &c.uuid).collect();
        if let Some(e) = self.collections.iter().find(|c| !org_collection_ids.contains(&c.id)) {
-            err!("Invalid collection", format!("Collection {} does not belong to organization {}!", e.id, org_id))
+            err!(
+                "Invalid collection",
+                format!("Collection {} does not belong to organization {}!", e.id.escape_debug(), org_id)
+            )
        }

        let org_memberships = Membership::find_by_org(org_id, conn).await;
        let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
        if let Some(e) = self.users.iter().find(|m| !org_membership_ids.contains(m)) {
-            err!("Invalid member", format!("Member {} does not belong to organization {}!", e, org_id))
+            err!("Invalid member", format!("Member {} does not belong to organization {}!", e.escape_debug(), org_id))
        }

        Ok(())
@@ -2771,8 +3113,26 @@ struct OrganizationUserRecoverAccountRequest {
 // But the clients do not seem to use this at all
 // Just add it here in case they will
 #[get("/organizations/<org_id>/public-key")]
-async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
-    if org_id != headers.membership.org_uuid {
+async fn get_organization_public_key(
+    org_id: OrganizationId,
+    headers: Headers,
+    member: Result<OrgMemberHeaders, &'static str>,
+    conn: DbConn,
+) -> JsonResult {
+    // SSO users without an org get the fake one, whose key the v2 JIT password flow fetches anyway
+    if org_id.eq_ignore_ascii_case(FAKE_SSO_IDENTIFIER) && headers.user.private_key.is_none() {
+        return Ok(Json(json!({
+            "object": "organizationPublicKey",
+            "publicKey": fake_sso_org_public_key().await?,
+        })));
+    }
+    let member = match member {
+        Ok(member) => member,
+        // The guard already logged it
+        Err(e) => return Err(crate::error::Error::new_msg(e).with_code(Status::Unauthorized.code)),
+    };
+
+    if org_id != member.membership.org_uuid {
        err!("Organization not found", "Organization id's do not match");
    }
    let Some(org) = Organization::find_by_uuid(&org_id, &conn).await else {
@@ -2785,11 +3145,30 @@ async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberH
    })))
 }

+/// The SDK only uses this key to wrap an account recovery key that it never sends for the fake org,
+/// so it is made once and its private half dropped.
+async fn fake_sso_org_public_key() -> ApiResult<String> {
+    static PUBLIC_KEY: std::sync::LazyLock<Option<String>> = std::sync::LazyLock::new(|| {
+        let der = openssl::rsa::Rsa::generate(2048).and_then(|rsa| rsa.public_key_to_der()).ok()?;
+        Some(data_encoding::BASE64.encode(&der))
+    });
+
+    let Ok(Some(public_key)) = tokio::task::spawn_blocking(|| PUBLIC_KEY.clone()).await else {
+        err!("Failed to generate the organization key")
+    };
+    Ok(public_key)
+}
+
 // Obsolete - Renamed to public-key (2023.8), left for backwards compatibility with older clients
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/OrganizationsController.cs#L487-L492
 #[get("/organizations/<org_id>/keys")]
-async fn get_organization_keys(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
-    get_organization_public_key(org_id, headers, conn).await
+async fn get_organization_keys(
+    org_id: OrganizationId,
+    headers: Headers,
+    member: Result<OrgMemberHeaders, &'static str>,
+    conn: DbConn,
+) -> JsonResult {
+    get_organization_public_key(org_id, headers, member, conn).await
 }

 // Will allow to reset 2FA too
@@ -2838,12 +3217,11 @@ async fn recover_account(
        err!("Organization user must be confirmed for password reset functionality");
    }

-    let fallback_2fa_email =
-        if req.reset_two_factor && CONFIG.mail_enabled() && CONFIG.email_2fa_auto_fallback() && user.verified() {
-            TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await.is_none()
-        } else {
-            false
-        };
+    let fallback_2fa_email = req.reset_two_factor
+        && CONFIG.mail_enabled()
+        && CONFIG.email_2fa_auto_fallback()
+        && user.verified()
+        && TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await.is_none();

    // Check the new password before the email below, so that a rejected request doesn't tell the user
    // their password was reset
@@ -126,6 +126,23 @@ async fn enforce_disable_hide_email_policy(data: &SendData, headers: &Headers, c
    Ok(())
 }

+/// Stores a text Send that is already encrypted, as [`create_send`] does, for the test seeder (`unsafe_test_mode`).
+/// Its deletion date becomes a week from now: a recorded one can be years ahead, more than a Send may be.
+#[cfg(feature = "unsafe_test_mode")]
+pub async fn seed_send(mut encrypted: Value, user_id: &UserId, conn: &DbConn) -> ApiResult<SendId> {
+    let Some(fields) = encrypted.as_object_mut() else {
+        err!("A seeded Send has to be a JSON object")
+    };
+    fields.insert("deletionDate".to_owned(), serde_json::to_value(Utc::now() + TimeDelta::try_days(7).unwrap())?);
+    let data: SendData = serde_json::from_value(encrypted)?;
+    if data.r#type != SendType::Text as i32 {
+        err!("Only text Sends can be seeded: a file Send needs its file")
+    }
+    let mut send = create_send(data, user_id.clone())?;
+    send.save(conn).await?;
+    Ok(send.uuid)
+}
+
 fn create_send(data: SendData, user_id: UserId) -> ApiResult<Send> {
    let data_val = if data.r#type == SendType::Text as i32 {
        data.text
@@ -268,11 +285,12 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn)
    let file_id = crate::crypto::generate_send_file_id();

    let mut data_value: Value = serde_json::from_str(&send.data)?;
-    if let Some(o) = data_value.as_object_mut() {
-        o.insert(String::from("id"), Value::String(file_id.clone()));
-        o.insert(String::from("size"), Value::Number(file_length.into()));
-        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
-    }
+    let Some(o) = data_value.as_object_mut() else {
+        err!("Invalid Send file data")
+    };
+    o.insert(String::from("id"), Value::String(file_id.clone()));
+    o.insert(String::from("size"), Value::Number(file_length.into()));
+    o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
    send.data = serde_json::to_string(&data_value)?;
    send.save(&conn).await?;

@@ -84,18 +84,26 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
                )
            }
        } else if let Some(auth_request_id) = auth_request_id {
-            let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
-                err!("AuthRequest doesn't exist", "User not found")
-            };
            let Some(code) = &data.auth_request_access_code else {
                err!("no auth request access code")
            };
+            let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, &conn).await
+            else {
+                err!("AuthRequest doesn't exist", "Invalid auth request or does not belong to user")
+            };

-            if auth_request.device_type != client_headers.device_type
+            let request_expired = Utc::now().naive_utc() >= auth_request.creation_date + TimeDelta::minutes(5);
+            if !auth_request.approved.unwrap_or(false)
+                || auth_request.authentication_date.is_some()
+                || request_expired
+                || auth_request.device_type != client_headers.device_type
                || auth_request.request_ip != client_headers.ip.ip.to_string()
                || !auth_request.check_access_code(code)
            {
-                err!("AuthRequest doesn't exist", "Invalid device, IP or code")
+                err!(
+                    "AuthRequest doesn't exist",
+                    "Auth request not approved, already used or expired, or invalid device, IP or code"
+                )
            }
        } else if let Some(device_identifier) = &data.device_identifier {
            // iOS/Android SSO logins send the email and device id but no password hash,
@@ -294,7 +302,7 @@ pub async fn validate_email_code_str(

    if !crypto::ct_eq(issued_token, token) {
        email_data.add_attempt();
-        if email_data.attempts >= CONFIG.email_attempts_limit() {
+        if email_data.attempts >= u64::from(CONFIG.email_attempts_limit()) {
            email_data.reset_token();
        }
        twofactor.data = email_data.to_json();
@@ -313,7 +321,7 @@ pub async fn validate_email_code_str(
    twofactor.save(conn).await?;

    let dt = DateTime::from_timestamp(email_data.token_sent, 0).expect("Email token timestamp invalid.").naive_utc();
-    let max_time = CONFIG.email_expiration_time().cast_signed();
+    let max_time = i64::from(CONFIG.email_expiration_time());
    if dt + TimeDelta::try_seconds(max_time).unwrap() < Utc::now().naive_utc() {
        err!(
            "Token has expired",
@@ -151,7 +151,7 @@ pub async fn enforce_2fa_policy(
            member.save(conn).await?;

            log_event(
-                EventType::OrganizationUserRevoked,
+                EventType::OrganizationUserRevokedTwoFactorNonCompliance,
                &member.uuid,
                &member.org_uuid,
                act_user_id,
@@ -185,8 +185,16 @@ pub async fn enforce_2fa_policy_for_org(
            member.revoke();
            member.save(conn).await?;

-            log_event(EventType::OrganizationUserRevoked, &member.uuid, org_id, act_user_id, device_type, ip, conn)
-                .await;
+            log_event(
+                EventType::OrganizationUserRevokedTwoFactorNonCompliance,
+                &member.uuid,
+                org_id,
+                act_user_id,
+                device_type,
+                ip,
+                conn,
+            )
+            .await;
        }
    }

@@ -196,7 +204,7 @@ pub async fn enforce_2fa_policy_for_org(
 pub async fn send_incomplete_2fa_notifications(pool: DbPool) {
    debug!("Sending notifications for incomplete 2FA logins");

-    if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
+    if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
        return;
    }

@@ -206,11 +214,21 @@ pub async fn send_incomplete_2fa_notifications(pool: DbPool) {
    };

    let now = Utc::now().naive_utc();
-    let time_limit = TimeDelta::try_minutes(CONFIG.incomplete_2fa_time_limit()).unwrap();
-    let time_before = now - time_limit;
+    let Some(time_limit) = TimeDelta::try_minutes(i64::from(CONFIG.incomplete_2fa_time_limit())) else {
+        error!("Failed to calculate the time limit for sending incomplete 2fa attempts");
+        return;
+    };
+    let Some(time_before) = now.checked_sub_signed(time_limit) else {
+        error!("Failed to calculate the timestamp for sending incomplete 2fa attempts");
+        return;
+    };
+
    let incomplete_logins = TwoFactorIncomplete::find_logins_before(&time_before, &conn).await;
    for login in incomplete_logins {
-        let user = User::find_by_uuid(&login.user_uuid, &conn).await.expect("User not found");
+        let Some(user) = User::find_by_uuid(&login.user_uuid, &conn).await else {
+            error!("User '{}', not found!", login.user_uuid);
+            continue;
+        };
        info!(
            "User {} did not complete a 2FA login within the configured time limit. IP: {}",
            user.email, login.ip_address
@@ -128,23 +128,24 @@ pub async fn validate_protected_action_otp(
        .await
        .map_res("Protected action token not found, try sending the code again or restart the process")?;
    let mut pa_data = ProtectedActionData::from_json(&pa.data)?;
-    pa_data.add_attempt();
-    pa.data = pa_data.to_json();

    // Fail after x attempts if the token has been used too many times.
    // Don't delete it, as we use it to keep track of attempts.
-    if pa_data.attempts >= CONFIG.email_attempts_limit() {
+    if pa_data.attempts >= u64::from(CONFIG.email_attempts_limit()) {
        err!("Token has expired")
    }

    // Check if the token has expired (Using the email 2fa expiration time)
-    let max_time = CONFIG.email_expiration_time().cast_signed();
+    let max_time = i64::from(CONFIG.email_expiration_time());
    if pa_data.time_since_sent().num_seconds() > max_time {
        pa.delete(conn).await?;
        err!("Token has expired")
    }

    if !crypto::ct_eq(&pa_data.token, otp) {
+        pa_data.add_attempt();
+        pa.data = pa_data.to_json();
+
        pa.save(conn).await?;
        err!("Token is invalid")
    }
@@ -62,7 +62,7 @@ static CLIENT: LazyLock<Client> = LazyLock::new(|| {
    // Generate the cookie store
    let cookie_store = Arc::new(Jar::default());

-    let icon_download_timeout = Duration::from_secs(CONFIG.icon_download_timeout());
+    let icon_download_timeout = Duration::from_secs(u64::from(CONFIG.icon_download_timeout()));
    let pool_idle_timeout = Duration::from_secs(10);
    // Reuse the client between requests
    get_reqwest_client_builder(true)
@@ -193,14 +193,14 @@ async fn get_cached_icon(path: &str) -> Option<Vec<u8>> {
    None
 }

-async fn file_is_expired(path: &str, ttl: u64) -> Result<bool, Error> {
+async fn file_is_expired(path: &str, ttl: u32) -> Result<bool, Error> {
    let operator = CONFIG.opendal_operator_for_path_type(&PathType::IconCache)?;
    let meta = operator.stat(path).await?;
    let modified =
        meta.last_modified().ok_or_else(|| std::io::Error::other(format!("No last modified time for `{path}`")))?;
    let age = SystemTime::now().duration_since(modified.into())?;

-    Ok(ttl > 0 && ttl <= age.as_secs())
+    Ok(ttl > 0 && u64::from(ttl) <= age.as_secs())
 }

 async fn icon_is_negcached(path: &str) -> bool {
@@ -264,7 +264,7 @@ fn get_favicons_node(dom: Tokenizer<StringReader<'_>, FaviconEmitter>, icons: &m
            TAG_BASE => {
                base_url = if let Some(href) = token.tag.attributes.get(ATTR_HREF) {
                    let href = std::str::from_utf8(href).unwrap_or_default();
-                    debug!("Found base href: {href}");
+                    debug!("Found base href: {}", href.escape_debug());
                    match base_url.join(href) {
                        Ok(inner_url) => inner_url,
                        _ => continue,
@@ -663,6 +663,17 @@ impl reqwest::cookie::CookieStore for Jar {
        use time::Duration;

        let mut cookie_store = self.0.write().unwrap();
+
+        // The store only skips expired cookies when reading them, so remove them here or they are kept forever
+        let expired: Vec<_> = cookie_store
+            .iter_any()
+            .filter(|c| c.is_expired())
+            .map(|c| (String::from(&c.domain), String::from(&c.path), c.name().to_owned()))
+            .collect();
+        for (domain, path, name) in expired {
+            cookie_store.remove(&domain, &path, &name);
+        }
+
        let cookies = cookie_headers.filter_map(|val| {
            std::str::from_utf8(val.as_bytes())
                .map_err(RawCookieParseError::from)
@@ -29,7 +29,7 @@ use crate::{
    db::{
        DbConn,
        models::{
-            AuthRequest, AuthRequestId, Device, DeviceId, EventType, Invitation, OIDCCodeResponseError,
+            AuthRequest, AuthRequestId, Device, DeviceId, DeviceType, EventType, Invitation, OIDCCodeResponseError,
            OrganizationApiKey, OrganizationId, SendId, SsoAuth, SsoUser, TwoFactor, TwoFactorIncomplete,
            TwoFactorType, User, UserId,
        },
@@ -46,6 +46,7 @@ pub fn routes() -> Vec<Route> {
        post_prelogin,
        prelogin_password,
        register_verification_email,
+        register_verification_email_clicked,
        register_finish,
        prevalidate,
        authorize,
@@ -76,14 +77,14 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;

-            password_login(data, &mut user_id, &conn, &client_header.ip).await
+            password_login(data, &mut user_id, &conn, &client_header).await
        }
        "client_credentials" => {
            check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?;
            check_is_some(data.client_secret.as_ref(), "client_secret cannot be blank")?;
            check_is_some(data.scope.as_ref(), "scope cannot be blank")?;

-            api_key_login(data, &mut user_id, &conn, &client_header.ip).await
+            api_key_login(data, &mut user_id, &conn, &client_header).await
        }
        "authorization_code" if CONFIG.sso_enabled() => {
            check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?;
@@ -94,7 +95,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;

-            sso_login(data, &mut user_id, &conn, &client_header.ip).await
+            sso_login(data, &mut user_id, &conn, &client_header).await
        }
        "authorization_code" => err!("SSO sign-in is not available"),
        "send_access" => {
@@ -111,7 +112,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
            .await?;
            Ok(Json(tokens.to_json()))
        }
-        t => err!("Invalid type", t),
+        t => err!("Invalid type", t.escape_debug().to_string()),
    };

    if let Some(user_id) = user_id {
@@ -178,7 +179,13 @@ async fn refresh_login(data: ConnectData, conn: &DbConn, ip: &ClientIp) -> JsonR
 }

 // After exchanging the code we need to check first if 2FA is needed before continuing
-async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
+async fn sso_login(
+    data: ConnectData,
+    user_id: &mut Option<UserId>,
+    conn: &DbConn,
+    client_header: &ClientHeaders,
+) -> JsonResult {
+    let ip = &client_header.ip;
    AuthMethod::Sso.check_scope(data.scope.as_ref())?;

    // Ratelimit the login
@@ -316,6 +323,8 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
            }

            let mut user = User::new(&user_infos.email, user_infos.user_name.clone());
+            // Before saving, so that a client that can't log in doesn't create the account
+            check_client_version(&user, client_header)?;
            user.verified_at = Some(now);
            user.save(conn).await?;

@@ -324,6 +333,8 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
            (user, device, None, None)
        }
        Some((user, _)) if !user.enabled => {
+            // Set in both arms, not only after the match, so that their failed logins are logged
+            *user_id = Some(user.uuid.clone());
            err!(
                "This user has been disabled",
                format!("IP: {}. Username: {}.", ip.ip, user.email),
@@ -333,6 +344,9 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
            )
        }
        Some((mut user, sso_user)) => {
+            *user_id = Some(user.uuid.clone());
+            check_client_version(&user, client_header)?;
+
            let mut device = get_device(&data, conn, &user).await?;

            let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?;
@@ -367,7 +381,13 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
    authenticated_response(&user, &mut device, auth_tokens, twofactor_token, conn, ip).await
 }

-async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
+async fn password_login(
+    data: ConnectData,
+    user_id: &mut Option<UserId>,
+    conn: &DbConn,
+    client_header: &ClientHeaders,
+) -> JsonResult {
+    let ip = &client_header.ip;
    // Validate scope
    AuthMethod::Password.check_scope(data.scope.as_ref())?;

@@ -437,6 +457,8 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
        )
    }

+    check_client_version(&user, client_header)?;
+
    // Change the KDF Iterations (only when not logging in with an auth request)
    if data.auth_request.is_none() {
        kdf_upgrade(&mut user, password, conn).await?;
@@ -447,9 +469,9 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
    if user.verified_at.is_none() && CONFIG.mail_enabled() && CONFIG.signups_verify() {
        if user.last_verifying_at.is_none()
            || now.signed_duration_since(user.last_verifying_at.unwrap()).num_seconds()
-                > CONFIG.signups_verify_resend_time().cast_signed()
+                > i64::from(CONFIG.signups_verify_resend_time())
        {
-            let resend_limit = CONFIG.signups_verify_resend_limit().cast_signed();
+            let resend_limit = i32::from(CONFIG.signups_verify_resend_limit());
            if resend_limit == 0 || user.login_verify_count < resend_limit {
                // We want to send another email verification if we require signups to verify
                // their email address, and we haven't sent them a reminder in a while...
@@ -498,6 +520,66 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
    authenticated_response(&user, &mut device, auth_tokens, twofactor_token, conn, ip).await
 }

+/// Like upstream's `ClientVersionValidator`, every login needs the `Bitwarden-Client-Version` header, and a V2 account
+/// ([`User::has_v2_encryption`]) a client of at least 2026.10.1 (2026.10.2 for the desktop app). Called right after the
+/// credentials are checked, like upstream, so that it doesn't tell anyone else which accounts are V2.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/src/Identity/IdentityServer/RequestValidators/ClientVersionValidator.cs#L33-L79>
+/// Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/src/Core/KeyManagement/Constants.cs#L5-L6>
+fn check_client_version(user: &User, client_header: &ClientHeaders) -> EmptyResult {
+    let Some((error, description)) = client_version_error(
+        user.has_v2_encryption(),
+        client_header.client_version.as_ref(),
+        client_header.device_type,
+    ) else {
+        return Ok(());
+    };
+    Err(crate::error::Error::from((
+        // Escaped: on a first SSO login the email comes from the provider and isn't validated yet
+        format!("IP: {}. Username: {}. {error}", client_header.ip.ip, user.email.escape_debug()),
+        json!({
+            "error": error,
+            "error_description": description,
+            "ErrorModel": { "Message": description, "Object": "error" },
+        }),
+    ))
+    .with_event(crate::error::ErrorEvent {
+        event: EventType::UserFailedLogIn,
+    }))
+}
+
+/// The error id and message of [`check_client_version`], `None` when the client may log in.
+fn client_version_error(
+    is_v2: bool,
+    client_version: Option<&semver::Version>,
+    device_type: i32,
+) -> Option<(&'static str, &'static str)> {
+    const MIN_V2_CLIENT: semver::Version = semver::Version::new(2026, 10, 1);
+    const MIN_V2_DESKTOP_CLIENT: semver::Version = semver::Version::new(2026, 10, 2);
+
+    let Some(version) = client_version else {
+        return Some((
+            "version_header_missing",
+            "No client version header found, required to prevent encryption errors. Please confirm your client is supplying the header: \"Bitwarden-Client-Version\"",
+        ));
+    };
+    if !is_v2 {
+        return None;
+    }
+    // Upstream's desktop device types
+    // Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/src/Libraries/Clients/DeviceTypes.cs#L14-L20>
+    let is_desktop = matches!(
+        DeviceType::from_i32(device_type),
+        DeviceType::WindowsDesktop | DeviceType::MacOsDesktop | DeviceType::LinuxDesktop | DeviceType::Uwp
+    );
+    let min_version = if is_desktop {
+        &MIN_V2_DESKTOP_CLIENT
+    } else {
+        &MIN_V2_CLIENT
+    };
+    (version < min_version).then_some(("invalid_client_version", "Please update your app to continue using Bitwarden"))
+}
+
 async fn authenticated_response(
    user: &User,
    device: &mut Device,
@@ -545,24 +627,13 @@ async fn authenticated_response(
            // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
            "MasterKeyEncryptedUserKey": user.akey,
            "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.email
+            "Salt": user.master_password_salt()
        })
    } else {
        Value::Null
    };

-    let account_keys = if user.private_key.is_some() {
-        json!({
-            "publicKeyEncryptionKeyPair": {
-                "wrappedPrivateKey": user.private_key,
-                "publicKey": user.public_key,
-                "Object": "publicKeyEncryptionKeyPair"
-            },
-            "Object": "privateKeys"
-        })
-    } else {
-        Value::Null
-    };
+    let account_keys = user.account_keys_json(conn).await;

    let mut result = json!({
        "access_token": auth_tokens.access_token(),
@@ -597,7 +668,13 @@ async fn authenticated_response(
    Ok(Json(result))
 }

-async fn api_key_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
+async fn api_key_login(
+    data: ConnectData,
+    user_id: &mut Option<UserId>,
+    conn: &DbConn,
+    client_header: &ClientHeaders,
+) -> JsonResult {
+    let ip = &client_header.ip;
    // Ratelimit the login
    crate::ratelimit::check_limit_login(&ip.ip)?;

@@ -609,7 +686,7 @@ async fn api_key_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &D
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;

-            user_api_key_login(data, user_id, conn, ip).await
+            user_api_key_login(data, user_id, conn, client_header).await
        }
        Some(scope) if scope == &AuthMethod::OrgApiKey.scope() => organization_api_key_login(data, conn, ip).await,
        _ => err!("Scope not supported"),
@@ -620,8 +697,9 @@ async fn user_api_key_login(
    data: ConnectData,
    user_id: &mut Option<UserId>,
    conn: &DbConn,
-    ip: &ClientIp,
+    client_header: &ClientHeaders,
 ) -> JsonResult {
+    let ip = &client_header.ip;
    // Get the user via the client_id
    let client_id = data.client_id.as_ref().unwrap();
    let Some(client_user_id) = client_id.strip_prefix("user.") else {
@@ -658,6 +736,8 @@ async fn user_api_key_login(
        )
    }

+    check_client_version(&user, client_header)?;
+
    let mut device = get_device(&data, conn, &user).await?;

    if CONFIG.mail_enabled() && device.is_new() {
@@ -702,24 +782,13 @@ async fn user_api_key_login(
            // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
            "MasterKeyEncryptedUserKey": user.akey,
            "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.email
+            "Salt": user.master_password_salt()
        })
    } else {
        Value::Null
    };

-    let account_keys = if user.private_key.is_some() {
-        json!({
-            "publicKeyEncryptionKeyPair": {
-                "wrappedPrivateKey": user.private_key,
-                "publicKey": user.public_key,
-                "Object": "publicKeyEncryptionKeyPair"
-            },
-            "Object": "privateKeys"
-        })
-    } else {
-        Value::Null
-    };
+    let account_keys = user.account_keys_json(conn).await;

    // Note: No refresh_token is returned. The CLI just repeats the
    // client_credentials login flow when the existing token expires.
@@ -1034,6 +1103,13 @@ struct RegisterVerificationData {
    // receiveMarketingEmails: bool,
 }

+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RegisterVerificationEmailClickedData {
+    email: String,
+    email_verification_token: String,
+}
+
 #[derive(rocket::Responder)]
 enum RegisterVerificationResponse {
    #[response(status = 204)]
@@ -1096,6 +1172,25 @@ async fn register_verification_email(
    }
 }

+#[post("/accounts/register/verification-email-clicked", data = "<data>")]
+async fn register_verification_email_clicked(
+    data: Json<RegisterVerificationEmailClickedData>,
+    conn: DbConn,
+) -> EmptyResult {
+    let data = data.into_inner();
+    let token_valid = auth::decode_register_verify(&data.email_verification_token)
+        .is_ok_and(|claims| claims.verified && claims.sub.eq_ignore_ascii_case(&data.email));
+    let user_exists = User::find_by_mail(&data.email, &conn)
+        .await
+        .is_some_and(|user| !user.password_hash.is_empty() || user.private_key.is_some());
+
+    if !token_valid || user_exists {
+        err!("Expired link. Please restart registration or try logging in. You may already have an account")
+    }
+
+    Ok(())
+}
+
 #[post("/accounts/register/finish", data = "<data>")]
 async fn register_finish(data: Json<RegisterData>, ip: ClientIp, conn: DbConn) -> JsonResult {
    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
@@ -1324,3 +1419,33 @@ async fn authorize(data: AuthorizeData, cookies: &CookieJar<'_>, secure: Secure,

    Ok(Redirect::temporary(String::from(auth_url)))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_client_version_error() {
+        let version = |v| semver::Version::parse(v).unwrap();
+        let web = DeviceType::ChromeBrowser as i32;
+        let desktop = DeviceType::WindowsDesktop as i32;
+        // Every login needs the header
+        assert_eq!(client_version_error(false, None, web).map(|e| e.0), Some("version_header_missing"));
+        assert_eq!(client_version_error(true, None, desktop).map(|e| e.0), Some("version_header_missing"));
+        // V1 accounts log in from any version
+        assert_eq!(client_version_error(false, Some(&version("2024.1.0")), web), None);
+        assert_eq!(client_version_error(false, Some(&version("2024.1.0")), desktop), None);
+        // V2 accounts need 2026.10.1, and 2026.10.2 for the desktop app
+        assert_eq!(
+            client_version_error(true, Some(&version("2026.10.0")), web).map(|e| e.0),
+            Some("invalid_client_version")
+        );
+        assert_eq!(client_version_error(true, Some(&version("2026.10.1")), web), None);
+        assert_eq!(
+            client_version_error(true, Some(&version("2026.10.1")), desktop).map(|e| e.0),
+            Some("invalid_client_version")
+        );
+        assert_eq!(client_version_error(true, Some(&version("2026.10.2")), DeviceType::Uwp as i32), None);
+        assert_eq!(client_version_error(true, Some(&version("2026.11.0")), desktop), None);
+    }
+}
@@ -4,8 +4,13 @@ mod icons;
 mod identity;
 mod notifications;
 mod push;
+#[cfg(feature = "unsafe_test_mode")]
+mod test_seeder;
 mod web;

+#[cfg(feature = "unsafe_test_mode")]
+pub use test_seeder::routes as test_seeder_routes;
+
 use rocket::serde::json::Json;
 use serde_json::Value;

@@ -23,14 +28,14 @@ pub use crate::api::{
    icons::routes as icons_routes,
    identity::routes as identity_routes,
    notifications::routes as notifications_routes,
-    notifications::{AnonymousNotify, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
+    notifications::{AnonymousNotify, LogOutReason, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
    push::{
-        push_cipher_update, push_folder_update, push_logout, push_send_update, push_user_update, register_push_device,
-        unregister_push_device,
+        push_cipher_update, push_folder_update, push_logout, push_logout_to_relay, push_send_update, push_user_update,
+        register_push_device, unregister_push_device,
    },
    web::catchers as web_catchers,
    web::routes as web_routes,
-    web::{invalidate_css_cache, static_files},
+    web::{STATIC_FILES, invalidate_css_cache},
 };
 use crate::{
    CONFIG,
@@ -212,7 +212,7 @@ fn websockets_hub<'r>(
                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
                            break;
                        }
-                        yield Message::Ping(create_ping());
+                        yield Message::Ping(PING.to_vec());
                    }
                }
            }
@@ -295,7 +295,7 @@ fn anonymous_websockets_hub<'r>(ws: WebSocket, token: String, ip: ClientIp) -> R
                        if last_received.elapsed() > WS_CLIENT_TIMEOUT {
                            break;
                        }
-                        yield Message::Ping(create_ping());
+                        yield Message::Ping(PING.to_vec());
                    }
                }
            }
@@ -359,6 +359,7 @@ fn convert_option<T: Into<Value>>(option: Option<T>) -> Value {

 const RECORD_SEPARATOR: u8 = 0x1e;
 const INITIAL_RESPONSE: [u8; 3] = [0x7b, 0x7d, RECORD_SEPARATOR]; // {, }, <RS>
+const PING: [u8; 3] = [0x02, 0x91, 0x06];

 #[derive(Deserialize, Copy, Clone, Eq, PartialEq)]
 struct InitialMessage<'a> {
@@ -411,23 +412,35 @@ impl WebSocketUsers {
    }

    pub async fn send_logout(&self, user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+        self.send_logout_with_reason(user, acting_device, None, conn).await;
+    }
+
+    /// A logout that clients may handle differently depending on `reason`
+    pub async fn send_logout_with_reason(
+        &self,
+        user: &User,
+        acting_device: Option<&Device>,
+        reason: Option<LogOutReason>,
+        conn: &DbConn,
+    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
        let acting_device_id = acting_device.map(|d| d.uuid.clone());
-        let data = create_update(
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
-            UpdateType::LogOut,
-            acting_device_id,
-        );
+        let mut payload =
+            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))];
+        if let Some(reason) = reason {
+            payload.push(("Reason".into(), (reason as i32).into()));
+        }
+        let data = create_update(payload, UpdateType::LogOut, acting_device_id);

        if CONFIG.enable_websocket() {
            self.send_update(&user.uuid, &data).await;
        }

        if CONFIG.push_enabled() {
-            push_logout(user, acting_device, conn).await;
+            push_logout(user, acting_device, reason, conn).await;
        }
    }

@@ -691,8 +704,12 @@ fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id
    serialize(&value)
 }

-fn create_ping() -> Vec<u8> {
-    serialize(&Value::Array(vec![6.into()]))
+/// Why a logout was pushed, absent for a plain one. `KdfChange` isn't sent yet.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Enums/PushNotificationLogOutReason.cs#L3-L7>
+#[derive(Copy, Clone, Eq, PartialEq)]
+pub enum LogOutReason {
+    KeyRotation = 1,
 }

 // https://github.com/bitwarden/server/blob/375af7c43b10d9da03525d41452f95de3f921541/src/Core/Enums/PushType.cs
@@ -12,7 +12,7 @@ use tokio::sync::RwLock;

 use crate::{
    CONFIG,
-    api::{ApiResult, EmptyResult, UpdateType},
+    api::{ApiResult, EmptyResult, LogOutReason, UpdateType},
    db::{
        DbConn,
        models::{AuthRequestId, Cipher, Device, Folder, PushId, Send, User, UserId},
@@ -139,21 +139,25 @@ pub async fn unregister_push_device(push_id: Option<&PushId>) -> EmptyResult {
    if !CONFIG.push_enabled() || push_id.is_none() {
        return Ok(());
    }
-    let auth_api_token = get_auth_api_token().await?;
+    let data = json!({
+        "id": push_id.as_ref().unwrap(),
+    });

+    let auth_api_token = get_auth_api_token().await?;
    let auth_header = format!("Bearer {auth_api_token}");

-    match make_http_request(
-        Method::POST,
-        &format!("{}/push/delete/{}", CONFIG.push_relay_uri(), push_id.as_ref().unwrap()),
-    )?
-    .header(AUTHORIZATION, auth_header)
-    .send()
-    .await
+    if let Err(e) = make_http_request(Method::POST, &(CONFIG.push_relay_uri() + "/push/delete"))?
+        .header(CONTENT_TYPE, "application/json")
+        .header(ACCEPT, "application/json")
+        .header(AUTHORIZATION, auth_header)
+        .json(&data)
+        .send()
+        .await?
+        .error_for_status()
    {
-        Ok(r) => r,
-        Err(e) => err!(format!("An error occurred during device unregistration: {e}")),
-    };
+        err!(format!("An error occurred during device unregistration: {e}"));
+    }
+
    Ok(())
 }

@@ -188,24 +192,31 @@ pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device
    }
 }

-pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+pub async fn push_logout(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>, conn: &DbConn) {
    if Device::check_user_has_push_device(&user.uuid, conn).await {
-        tokio::task::spawn(send_to_push_relay(json!({
-            "userId": user.uuid,
-            "organizationId": (),
-            "deviceId": acting_device.and_then(|d| d.push_uuid.as_ref()),
-            "identifier": acting_device.map(|d| &d.uuid),
-            "type": UpdateType::LogOut as i32,
-            "payload": {
-                "userId": user.uuid,
-                "date": format_date(&user.updated_at)
-            },
-            "clientType": null,
-            "installationId": null
-        })));
+        push_logout_to_relay(user, acting_device, reason);
    }
 }

+// Sends the logout without checking for push devices first.
+// Needed after deleting a user, when the devices are already gone from the database.
+pub fn push_logout_to_relay(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>) {
+    tokio::task::spawn(send_to_push_relay(json!({
+        "userId": user.uuid,
+        "organizationId": (),
+        "deviceId": acting_device.and_then(|d| d.push_uuid.as_ref()),
+        "identifier": acting_device.map(|d| &d.uuid),
+        "type": UpdateType::LogOut as i32,
+        "payload": {
+            "userId": user.uuid,
+            "date": format_date(&user.updated_at),
+            "reason": reason.map(|r| r as i32),
+        },
+        "clientType": null,
+        "installationId": null
+    })));
+}
+
 pub async fn push_user_update(ut: UpdateType, user: &User, push_uuid: Option<&PushId>, conn: &DbConn) {
    if Device::check_user_has_push_device(&user.uuid, conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
@@ -0,0 +1,511 @@
+//! A seeder API for the end-to-end tests, only in builds with the `unsafe_test_mode` feature: it creates accounts with
+//! no checks at all, so it must never be in a release or a deployment.
+//!
+//! It answers the calls the SDK's live tests make to upstream's `util/SeederApi` (`POST /seed` with a scene,
+//! `DELETE /seed/{playId}`), under `/test/seeder`. Each request needs HTTP basic auth with `TEST_SEEDER_USERNAME` and
+//! `TEST_SEEDER_PASSWORD` from the environment; without both, every route answers 404. Seeding needs an `X-Play-Id`
+//! header, and destroying a play deletes the accounts seeded under it. Plays are kept in memory, which is enough for a
+//! test server that starts on an empty database.
+//!
+//! Scenes:
+//! - `SingleUserScene`: a V1 account for an email and password, under a mangled address like upstream's, with
+//!   PBKDF2 at upstream's default of 5000 iterations.
+//! - `TestVectorUserScene`: one of the SDK's user test vectors (`test-vectors/users/*.json`), stored as it is: the
+//!   account and its vault are already encrypted. Unlike upstream, the address isn't mangled, since our master
+//!   password salt is the email, so a vector can be seeded once at a time. Text Sends are stored too.
+//!
+//! Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/util/SeederApi/Controllers/SeedController.cs#L11-L107>
+//! Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/util/Seeder/Scenes/SingleUserScene.cs#L38-L154>
+
+use std::{
+    collections::HashMap,
+    num::NonZeroU32,
+    sync::{LazyLock, Mutex},
+};
+
+use chrono::Utc;
+use data_encoding::{BASE64, HEXLOWER};
+use openssl::{
+    pkey::PKey,
+    rsa::Rsa,
+    symm::{Cipher, encrypt},
+};
+use ring::{hkdf, hmac, pbkdf2};
+use rocket::{
+    Request, Route,
+    http::Status,
+    request::{FromRequest, Outcome},
+    serde::json::Json,
+};
+use serde_json::{Value, json};
+
+use crate::{
+    api::{
+        ApiResult, JsonResult,
+        core::{seed_cipher, seed_send},
+    },
+    crypto,
+    db::{
+        DbConn,
+        models::{Folder, FolderId, KeyId, SignatureAlgorithm, User, UserId, UserKdfType, UserSignatureKeyPair},
+    },
+};
+
+pub fn routes() -> Vec<Route> {
+    routes![seed, destroy_play]
+}
+
+/// The accounts seeded under each play id.
+static PLAYS: LazyLock<Mutex<HashMap<String, Vec<UserId>>>> = LazyLock::new(Mutex::default);
+
+/// HTTP basic auth with `TEST_SEEDER_USERNAME` and `TEST_SEEDER_PASSWORD`.
+struct SeederAuth;
+
+#[rocket::async_trait]
+impl<'r> FromRequest<'r> for SeederAuth {
+    type Error = &'static str;
+
+    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
+        let (Ok(username), Ok(password)) =
+            (std::env::var("TEST_SEEDER_USERNAME"), std::env::var("TEST_SEEDER_PASSWORD"))
+        else {
+            return Outcome::Error((Status::NotFound, "The test seeder is off"));
+        };
+        if username.is_empty() || password.is_empty() {
+            return Outcome::Error((Status::NotFound, "The test seeder is off"));
+        }
+        let expected = format!("Basic {}", BASE64.encode(format!("{username}:{password}").as_bytes()));
+        match request.headers().get_one("Authorization") {
+            Some(given) if crypto::ct_eq(given, expected) => Outcome::Success(Self),
+            _ => Outcome::Error((Status::Unauthorized, "Invalid test seeder credentials")),
+        }
+    }
+}
+
+/// The `X-Play-Id` header, which names the play a seeding belongs to.
+struct PlayId(String);
+
+#[rocket::async_trait]
+impl<'r> FromRequest<'r> for PlayId {
+    type Error = &'static str;
+
+    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
+        match request.headers().get_one("X-Play-Id").map(str::trim) {
+            Some(play_id) if !play_id.is_empty() => Outcome::Success(Self(play_id.to_owned())),
+            _ => Outcome::Error((Status::BadRequest, "Seeding needs an X-Play-Id header")),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SeedRequest {
+    template: String,
+    arguments: Option<Value>,
+}
+
+#[post("/seed", data = "<data>")]
+async fn seed(data: Json<SeedRequest>, _auth: SeederAuth, play: PlayId, conn: DbConn) -> JsonResult {
+    let data = data.into_inner();
+    let arguments = data.arguments.unwrap_or(Value::Null);
+    let response = match data.template.as_str() {
+        "SingleUserScene" => single_user_scene(serde_json::from_value(arguments)?, &play.0, &conn).await?,
+        "TestVectorUserScene" => test_vector_user_scene(serde_json::from_value(arguments)?, &play.0, &conn).await?,
+        other => err_code!(format!("Unknown scene {}", other.escape_debug()), Status::NotFound.code),
+    };
+    Ok(Json(response))
+}
+
+/// Records an account in its play as soon as it's saved, so that destroying the play removes it even when the rest of
+/// the seeding fails.
+fn track(play: &str, user_id: &UserId) {
+    PLAYS.lock().unwrap().entry(play.to_owned()).or_default().push(user_id.clone());
+}
+
+/// Deletes the accounts seeded under `play_id`; an unknown play is a no-op, like upstream.
+#[delete("/seed/<play_id>")]
+async fn destroy_play(play_id: &str, _auth: SeederAuth, conn: DbConn) -> JsonResult {
+    let user_ids = PLAYS.lock().unwrap().remove(play_id).unwrap_or_default();
+    let mut remaining = Vec::new();
+    let mut error = None;
+    for user_id in &user_ids {
+        let Some(user) = User::find_by_uuid(user_id, &conn).await else {
+            continue;
+        };
+        if let Err(e) = user.delete(&conn).await {
+            remaining.push(user_id.clone());
+            error.get_or_insert(e);
+        }
+    }
+    if let Some(error) = error {
+        // Kept in the play, so that destroying it again retries them
+        PLAYS.lock().unwrap().entry(play_id.to_owned()).or_default().extend(remaining);
+        return Err(error);
+    }
+    Ok(Json(json!({ "userIds": user_ids })))
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SingleUserRequest {
+    email: String,
+    password: String,
+    #[serde(default)]
+    email_verified: bool,
+    kdf_iterations: Option<u32>,
+    #[serde(default)]
+    enroll_in_email2_fa: bool,
+    #[serde(default)]
+    corrupt_private_key: bool,
+}
+
+/// Ref: <https://github.com/bitwarden/server/blob/15c94ac58bf361a162381749c146d254a21b2098/util/Seeder/Models/UserSeed.cs#L55>
+const DEFAULT_KDF_ITERATIONS: u32 = 5_000;
+
+async fn single_user_scene(request: SingleUserRequest, play: &str, conn: &DbConn) -> ApiResult<Value> {
+    if request.enroll_in_email2_fa || request.corrupt_private_key {
+        err!("enrollInEmail2Fa and corruptPrivateKey aren't supported")
+    }
+    let iterations = request.kdf_iterations.unwrap_or(DEFAULT_KDF_ITERATIONS);
+    if !(5_000..=2_000_000).contains(&iterations) {
+        err!("kdfIterations must be between 5000 and 2000000")
+    }
+    let Some((local, domain)) = request.email.split_once('@') else {
+        err!("The email has no @")
+    };
+    // Like upstream's ManglerService: unique addresses for every seeding
+    let mangled = format!("{}+{local}@{domain}", HEXLOWER.encode(&crypto::get_random_bytes::<4>()));
+
+    let mut user = User::new(&mangled, None);
+    let keys = V1Keys::new(&request.password, &user.master_password_salt(), iterations)?;
+    user.client_kdf_type = UserKdfType::Pbkdf2 as i32;
+    user.client_kdf_iter = iterations.cast_signed();
+    user.client_kdf_memory = None;
+    user.client_kdf_parallelism = None;
+    user.private_key = Some(keys.private_key.clone());
+    user.public_key = Some(keys.public_key.clone());
+    if request.email_verified {
+        user.verified_at = Some(Utc::now().naive_utc());
+    }
+    user.set_password(&keys.master_password_hash, Some(keys.wrapped_user_key.clone()), false, None, conn).await?;
+    user.save(conn).await?;
+    track(play, &user.uuid);
+
+    let response = json!({
+        "mangleMap": mangle_map(&request.email, &user.email),
+        "result": {
+            "userId": user.uuid,
+            "kdf": "PBKDF2_SHA256",
+            "kdfIterations": iterations,
+            "key": keys.wrapped_user_key,
+            "publicKey": keys.public_key,
+            "privateKey": keys.private_key,
+        },
+    });
+    Ok(response)
+}
+
+/// What a V1 client makes when it registers, from the master password.
+struct V1Keys {
+    /// The master password authentication hash, which the client logs in with.
+    master_password_hash: String,
+    /// The user key, wrapped by the stretched master key.
+    wrapped_user_key: String,
+    /// The PKCS#8 RSA private key, wrapped by the user key.
+    private_key: String,
+    /// The SPKI RSA public key.
+    public_key: String,
+}
+
+impl V1Keys {
+    fn new(password: &str, salt: &str, iterations: u32) -> ApiResult<Self> {
+        let master_key = pbkdf2_sha256(password.as_bytes(), salt.as_bytes(), iterations);
+        let master_password_hash = BASE64.encode(&pbkdf2_sha256(&master_key, password.as_bytes(), 1));
+        let stretched_enc = hkdf_expand(&master_key, b"enc");
+        let stretched_mac = hkdf_expand(&master_key, b"mac");
+
+        let user_key = crypto::get_random_bytes::<64>();
+        let wrapped_user_key = enc_string(&user_key, &stretched_enc, &stretched_mac)?;
+
+        let key_pair = PKey::from_rsa(Rsa::generate(2048)?)?;
+        let private_key = enc_string(&key_pair.private_key_to_pkcs8()?, &user_key[..32], &user_key[32..])?;
+        let public_key = BASE64.encode(&key_pair.public_key_to_der()?);
+
+        Ok(Self {
+            master_password_hash,
+            wrapped_user_key,
+            private_key,
+            public_key,
+        })
+    }
+}
+
+fn pbkdf2_sha256(secret: &[u8], salt: &[u8], iterations: u32) -> [u8; 32] {
+    let mut out = [0u8; 32];
+    let iterations = NonZeroU32::new(iterations).expect("iterations aren't zero");
+    pbkdf2::derive(pbkdf2::PBKDF2_HMAC_SHA256, iterations, salt, secret, &mut out);
+    out
+}
+
+/// HKDF-Expand with `key` as the pseudorandom key, as clients stretch the master key.
+fn hkdf_expand(key: &[u8; 32], info: &[u8]) -> [u8; 32] {
+    let mut out = [0u8; 32];
+    hkdf::Prk::new_less_safe(hkdf::HKDF_SHA256, key)
+        .expand(&[info], hkdf::HKDF_SHA256)
+        .and_then(|okm| okm.fill(&mut out))
+        .expect("32 bytes is a valid HKDF-SHA256 length");
+    out
+}
+
+/// An `AesCbc256_HmacSha256_B64` (type 2) EncString.
+fn enc_string(plaintext: &[u8], enc_key: &[u8], mac_key: &[u8]) -> ApiResult<String> {
+    let iv = crypto::get_random_bytes::<16>();
+    let ciphertext = encrypt(Cipher::aes_256_cbc(), enc_key, Some(&iv), plaintext)?;
+    let mac = hmac::sign(&hmac::Key::new(hmac::HMAC_SHA256, mac_key), &[iv.as_slice(), &ciphertext].concat());
+    Ok(format!("2.{}|{}|{}", BASE64.encode(&iv), BASE64.encode(&ciphertext), BASE64.encode(mac.as_ref())))
+}
+
+/// A user test vector; only what a server holds is read from it.
+///
+/// Ref: <https://github.com/bitwarden/sdk-internal/blob/ee307a55d5604e96b983595c6379cc9f76ca2f87/e2e/wasm/vectors/load.ts>
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct TestVector {
+    name: String,
+    account: VectorAccount,
+    unlock_methods: Vec<Value>,
+    master_password_authentication_hash: Option<String>,
+    raw_cryptographic_state: VectorRawCryptographicState,
+    #[serde(default)]
+    vault: VectorVault,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct VectorAccount {
+    email: String,
+    security_version: Option<i32>,
+    account_cryptographic_state: Value,
+}
+
+/// The public halves the vector records; its private halves are never read.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct VectorRawCryptographicState {
+    public_key: String,
+    verifying_key: Option<String>,
+    user_key_id: Option<String>,
+}
+
+#[derive(Default, Deserialize)]
+struct VectorVault {
+    #[serde(default)]
+    ciphers: Vec<VectorItem>,
+    #[serde(default)]
+    folders: Vec<VectorItem>,
+    #[serde(default)]
+    sends: Vec<VectorItem>,
+}
+
+#[derive(Deserialize)]
+struct VectorItem {
+    id: String,
+    encrypted: Value,
+}
+
+/// Upstream's scene, not merged there yet:
+/// <https://github.com/bitwarden/server/blob/9614f3f54f78ad57090a1fd5228f9c2fac5cbfe2/util/Seeder/Scenes/TestVectorUserScene.cs#L43-L361>
+async fn test_vector_user_scene(vector: TestVector, play: &str, conn: &DbConn) -> ApiResult<Value> {
+    let Some(unlock) =
+        vector.unlock_methods.iter().find_map(|m| m.pointer("/masterPasswordUnlock/master_password_unlock"))
+    else {
+        err!(format!("Vector {} has no master password unlock method", vector.name.escape_debug()))
+    };
+    let Some(hash) = vector.master_password_authentication_hash.as_deref() else {
+        err!(format!("Vector {} records no master password authentication hash", vector.name.escape_debug()))
+    };
+    let (Some(wrapped_user_key), Some(salt)) = (unlock["masterKeyWrappedUserKey"].as_str(), unlock["salt"].as_str())
+    else {
+        err!("The master password unlock method has no wrapped user key or salt")
+    };
+
+    let mut user = User::new(&vector.account.email, Some(vector.name.clone()));
+    if user.master_password_salt() != salt {
+        err!("The vector's master password salt isn't its email, which is the only salt Vaultwarden supports")
+    }
+    if User::find_by_mail(&user.email, conn).await.is_some() {
+        err!("This vector is already seeded: destroy its play first, its address can't be mangled")
+    }
+
+    apply_kdf(&mut user, &unlock["kdf"])?;
+    let state = &vector.account.account_cryptographic_state;
+    let (v2, private_key) = match (state.get("V1"), state.get("V2")) {
+        (Some(v1), None) => (None, &v1["private_key"]),
+        (None, Some(v2)) => (Some(v2), &v2["private_key"]),
+        _ => err!("The account cryptographic state is neither V1 nor V2"),
+    };
+    user.private_key = Some(json_str(private_key, "private_key")?);
+    user.public_key = Some(vector.raw_cryptographic_state.public_key.clone());
+    let key_id = vector.raw_cryptographic_state.user_key_id.as_deref().or_else(|| unlock["containedKeyId"].as_str());
+    user.key_id = key_id.map(|id| serde_json::from_value::<KeyId>(json!(id))).transpose()?;
+    let signature_key_pair = match v2 {
+        Some(v2) => {
+            user.signed_public_key = Some(json_str(&v2["signed_public_key"], "signed_public_key")?);
+            user.security_state = Some(json_str(&v2["security_state"], "security_state")?);
+            user.security_version = Some(vector.account.security_version.unwrap_or(2));
+            let Some(verifying_key) = vector.raw_cryptographic_state.verifying_key.clone() else {
+                err!("A V2 vector needs its verifying key")
+            };
+            let algorithm = cose_signature_algorithm(&verifying_key)?;
+            Some((algorithm, json_str(&v2["signing_key"], "signing_key")?, verifying_key))
+        }
+        None => None,
+    };
+    user.verified_at = Some(Utc::now().naive_utc());
+    user.set_password(hash, Some(wrapped_user_key.to_owned()), false, None, conn).await?;
+    user.save(conn).await?;
+    track(play, &user.uuid);
+    if let Some((algorithm, signing_key, verifying_key)) = signature_key_pair {
+        UserSignatureKeyPair::new(user.uuid.clone(), algorithm, signing_key, verifying_key).save(conn).await?;
+    }
+
+    // The vault, already encrypted, under fresh ids
+    let mut folder_ids = HashMap::new();
+    let mut folder_ids_by_vector_id = serde_json::Map::new();
+    for folder in &vector.vault.folders {
+        let mut saved = Folder::new(user.uuid.clone(), json_str(&folder.encrypted["name"], "name")?);
+        saved.save(conn).await?;
+        folder_ids.insert(serde_json::from_value::<FolderId>(json!(folder.id))?, saved.uuid.clone());
+        folder_ids_by_vector_id.insert(folder.id.clone(), json!(saved.uuid));
+    }
+    let mut cipher_ids = serde_json::Map::new();
+    for cipher in vector.vault.ciphers {
+        let cipher_id = seed_cipher(cipher.encrypted, &user.uuid, &folder_ids, conn).await?;
+        cipher_ids.insert(cipher.id, json!(cipher_id));
+    }
+    for send in vector.vault.sends {
+        seed_send(send.encrypted, &user.uuid, conn).await?;
+    }
+
+    let response = json!({
+        "mangleMap": mangle_map(&vector.account.email, &user.email),
+        "result": {
+            "userId": user.uuid,
+            "email": user.email,
+            "cipherIds": cipher_ids,
+            "folderIds": folder_ids_by_vector_id,
+        },
+    });
+    Ok(response)
+}
+
+/// The vector's KDF: `{"pBKDF2": {"iterations"}}` or `{"argon2id": {"iterations", "memory", "parallelism"}}`.
+fn apply_kdf(user: &mut User, kdf: &Value) -> ApiResult<()> {
+    let int = |value: &Value| value.as_i64().and_then(|v| i32::try_from(v).ok());
+    if let Some(iterations) = kdf.pointer("/pBKDF2/iterations").and_then(int) {
+        user.client_kdf_type = UserKdfType::Pbkdf2 as i32;
+        user.client_kdf_iter = iterations;
+        user.client_kdf_memory = None;
+        user.client_kdf_parallelism = None;
+    } else if let Some(argon2) = kdf.get("argon2id") {
+        let Some(iterations) = int(&argon2["iterations"]) else {
+            err!("The Argon2id KDF has no iterations")
+        };
+        user.client_kdf_type = UserKdfType::Argon2id as i32;
+        user.client_kdf_iter = iterations;
+        user.client_kdf_memory = int(&argon2["memory"]);
+        user.client_kdf_parallelism = int(&argon2["parallelism"]);
+    } else {
+        err!("Unknown KDF")
+    }
+    Ok(())
+}
+
+/// The signature algorithm a COSE verifying key names in its `alg` (label 3) entry.
+fn cose_signature_algorithm(verifying_key: &str) -> ApiResult<SignatureAlgorithm> {
+    const ALG: i128 = 3;
+    const EDDSA: i128 = -8;
+    const ML_DSA_44: i128 = -48;
+
+    let Ok(bytes) = BASE64.decode(verifying_key.as_bytes()) else {
+        err!("The verifying key isn't base64")
+    };
+    let Ok(serde_cbor_2::Value::Map(entries)) = serde_cbor_2::from_slice::<serde_cbor_2::Value>(&bytes) else {
+        err!("The verifying key isn't a COSE key")
+    };
+    match entries.get(&serde_cbor_2::Value::Integer(ALG)) {
+        Some(serde_cbor_2::Value::Integer(EDDSA)) => Ok(SignatureAlgorithm::Ed25519),
+        Some(serde_cbor_2::Value::Integer(ML_DSA_44)) => Ok(SignatureAlgorithm::MlDsa44),
+        _ => err!("The verifying key's algorithm isn't Ed25519 or ML-DSA-44"),
+    }
+}
+
+/// Upstream's map from the address a scene was asked for to the one it stored.
+fn mangle_map(requested: &str, stored: &str) -> Value {
+    let mut map = serde_json::Map::new();
+    map.insert(requested.to_owned(), json!(stored));
+    Value::Object(map)
+}
+
+fn json_str(value: &Value, field: &str) -> ApiResult<String> {
+    let Some(value) = value.as_str() else {
+        err!(format!("The vector's {field} is missing"))
+    };
+    Ok(value.to_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use openssl::symm::decrypt;
+
+    use super::*;
+
+    // From sdk-internal's `test-vectors/users/v1-pbkdf2-min-iterations.json` (d9119f7af)
+    const EMAIL: &str = "v1-pbkdf2-min-iterations@test.bitwarden.com";
+    const PASSWORD: &str = "password-v1-pbkdf2-min-iterations";
+    const ITERATIONS: u32 = 5_000;
+    const AUTHENTICATION_HASH: &str = "4HcwTg4bQKEbuINCJGMqrij1yipl63Ugu/RazH2y7Qw=";
+    const WRAPPED_USER_KEY: &str = "2.tl+DrZdn+fVyBVu+0c/Gvg==|9ivOLNtKbvirNaUnkGsEtysp9de53ibTSu88HLkDOGLig3t8nhvK5JIqxSY1/ukcr2Y/Ly9OJ12tXUGjIlJ/PtIEIdYj3gZDwhAflPUwtW8=|FD5WuIvviib3yWYcI3slmqBSqMf38Z0CMwttPG1w5DY=";
+    const USER_KEY: &str = "49LghK4AVIybWSZFikb4nAn/BofxxBIoXv83EJWOP4taVMbR5XCfrbF2m/eUmfZdeFW7VybPYSGT/bmv5eeMBg==";
+
+    /// Decrypts a type 2 EncString, checking its MAC.
+    fn dec_string(enc_string: &str, enc_key: &[u8], mac_key: &[u8]) -> Vec<u8> {
+        let parts: Vec<Vec<u8>> = enc_string
+            .strip_prefix("2.")
+            .unwrap()
+            .split('|')
+            .map(|part| BASE64.decode(part.as_bytes()).unwrap())
+            .collect();
+        let [iv, ciphertext, mac] = parts.as_slice() else {
+            panic!("not three parts")
+        };
+        let key = hmac::Key::new(hmac::HMAC_SHA256, mac_key);
+        hmac::verify(&key, &[iv.as_slice(), ciphertext].concat(), mac).unwrap();
+        decrypt(Cipher::aes_256_cbc(), enc_key, Some(iv), ciphertext).unwrap()
+    }
+
+    #[test]
+    fn derives_the_vectors_keys() {
+        let master_key = pbkdf2_sha256(PASSWORD.as_bytes(), EMAIL.as_bytes(), ITERATIONS);
+        assert_eq!(BASE64.encode(&pbkdf2_sha256(&master_key, PASSWORD.as_bytes(), 1)), AUTHENTICATION_HASH);
+
+        let user_key =
+            dec_string(WRAPPED_USER_KEY, &hkdf_expand(&master_key, b"enc"), &hkdf_expand(&master_key, b"mac"));
+        assert_eq!(BASE64.encode(&user_key), USER_KEY);
+    }
+
+    #[test]
+    fn makes_keys_a_client_can_open() {
+        let keys = V1Keys::new(PASSWORD, EMAIL, ITERATIONS).unwrap();
+        assert_eq!(keys.master_password_hash, AUTHENTICATION_HASH);
+
+        let master_key = pbkdf2_sha256(PASSWORD.as_bytes(), EMAIL.as_bytes(), ITERATIONS);
+        let user_key =
+            dec_string(&keys.wrapped_user_key, &hkdf_expand(&master_key, b"enc"), &hkdf_expand(&master_key, b"mac"));
+        assert_eq!(user_key.len(), 64);
+
+        let pkcs8 = dec_string(&keys.private_key, &user_key[..32], &user_key[32..]);
+        let private_key = PKey::private_key_from_pkcs8(&pkcs8).unwrap();
+        assert_eq!(BASE64.encode(&private_key.public_key_to_der().unwrap()), keys.public_key);
+    }
+}
@@ -1,13 +1,14 @@
 use std::{
+    collections::HashMap,
    path::{Path, PathBuf},
-    sync::{Arc, RwLock},
+    sync::{Arc, LazyLock, RwLock},
 };

 use rocket::{
    Catcher, Route,
    fs::NamedFile,
    http::ContentType,
-    response::{Redirect, content::RawCss as Css, content::RawHtml as Html},
+    response::{Redirect, content::RawHtml as Html},
    serde::json::Json,
 };
 use serde_json::Value;
@@ -19,7 +20,7 @@ use crate::{
    crypto::sha256_hex,
    db::{
        DbConn,
-        models::{AttachmentId, CipherId},
+        models::{AttachmentId, CipherId, custom_roles_enabled},
    },
    error::Error,
    util::{Cached, EtagCached},
@@ -79,16 +80,17 @@ pub fn invalidate_css_cache() {
 }

 #[get("/css/vaultwarden.css")]
-fn vaultwarden_css() -> EtagCached<Css<String>> {
+fn vaultwarden_css() -> EtagCached<String> {
    // If reload_templates is false, and we already have the CSS Cached, return this
    if !CONFIG.reload_templates()
        && let Some(cached) = CSS_CACHE.read().unwrap().as_ref()
    {
-        return EtagCached::new(Css(cached.css.clone()), &cached.etag);
+        return EtagCached::new(cached.css.clone(), ContentType::CSS, &cached.etag);
    }

    // Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS
    let css_options = json!({
+        "custom_roles_enabled": custom_roles_enabled(),
        "email_change_allowed": CONFIG.email_change_allowed(),
        "emergency_access_allowed": CONFIG.emergency_access_allowed(),
        "load_user_scss": true,
@@ -147,7 +149,7 @@ fn vaultwarden_css() -> EtagCached<Css<String>> {
    }

    // Etag Caching will let the browser send us an etag to verify and send new content if needed
-    EtagCached::new(Css(cached.css.clone()), &cached.etag)
+    EtagCached::new(cached.css.clone(), ContentType::CSS, &cached.etag)
 }

 #[get("/")]
@@ -256,7 +258,7 @@ fn alive_head(_conn: DbConn) -> EmptyResult {
 // This endpoint/function is used during development and development only.
 // It allows to easily develop the admin interface by always loading the files from disk instead from a slice of bytes
 // This will only be active during a debug build and only when `RELOAD_TEMPLATES` is set to `true`
-// NOTE: Do not forget to add any new files added to the `static_files` function below!
+// NOTE: Do not forget to add any new files added to the `STATIC_FILES` HashMap below!
 #[cfg(debug_assertions)]
 #[get("/vw_static/<filename>", rank = 1)]
 pub async fn static_files_dev(filename: PathBuf) -> Option<NamedFile> {
@@ -276,32 +278,61 @@ pub async fn static_files_dev(filename: PathBuf) -> Option<NamedFile> {
    None
 }

+pub struct StaticFile {
+    pub content_type: ContentType,
+    pub bytes: &'static [u8],
+    pub etag: String,
+}
+
+pub static STATIC_FILES: LazyLock<HashMap<&'static str, StaticFile>> = LazyLock::new(|| {
+    [
+        ("404.png", ContentType::PNG, &include_bytes!("../static/images/404.png")[..]),
+        ("mail-github.png", ContentType::PNG, &include_bytes!("../static/images/mail-github.png")[..]),
+        ("logo-gray.png", ContentType::PNG, &include_bytes!("../static/images/logo-gray.png")[..]),
+        ("error-x.svg", ContentType::SVG, &include_bytes!("../static/images/error-x.svg")[..]),
+        ("hibp.png", ContentType::PNG, &include_bytes!("../static/images/hibp.png")[..]),
+        ("vaultwarden-icon.png", ContentType::PNG, &include_bytes!("../static/images/vaultwarden-icon.png")[..]),
+        ("vaultwarden-favicon.png", ContentType::PNG, &include_bytes!("../static/images/vaultwarden-favicon.png")[..]),
+        ("404.css", ContentType::CSS, &include_bytes!("../static/scripts/404.css")[..]),
+        ("admin.css", ContentType::CSS, &include_bytes!("../static/scripts/admin.css")[..]),
+        ("admin.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin.js")[..]),
+        ("admin_settings.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin_settings.js")[..]),
+        ("admin_users.js", ContentType::JavaScript, &include_bytes!("../static/scripts/admin_users.js")[..]),
+        (
+            "admin_organizations.js",
+            ContentType::JavaScript,
+            &include_bytes!("../static/scripts/admin_organizations.js")[..],
+        ),
+        (
+            "admin_diagnostics.js",
+            ContentType::JavaScript,
+            &include_bytes!("../static/scripts/admin_diagnostics.js")[..],
+        ),
+        ("bootstrap.css", ContentType::CSS, &include_bytes!("../static/scripts/bootstrap.css")[..]),
+        ("bootstrap.bundle.js", ContentType::JavaScript, &include_bytes!("../static/scripts/bootstrap.bundle.js")[..]),
+        ("jdenticon-3.3.0.js", ContentType::JavaScript, &include_bytes!("../static/scripts/jdenticon-3.3.0.js")[..]),
+        ("datatables.js", ContentType::JavaScript, &include_bytes!("../static/scripts/datatables.js")[..]),
+        ("datatables.css", ContentType::CSS, &include_bytes!("../static/scripts/datatables.css")[..]),
+    ]
+    .into_iter()
+    .map(|(name, content_type, bytes)| {
+        (
+            name,
+            StaticFile {
+                content_type,
+                bytes,
+                etag: sha256_hex(bytes),
+            },
+        )
+    })
+    .collect()
+});
+
 #[get("/vw_static/<filename>", rank = 2)]
-pub fn static_files(filename: &str) -> Result<(ContentType, &'static [u8]), Error> {
-    match filename {
-        "404.png" => Ok((ContentType::PNG, include_bytes!("../static/images/404.png"))),
-        "mail-github.png" => Ok((ContentType::PNG, include_bytes!("../static/images/mail-github.png"))),
-        "logo-gray.png" => Ok((ContentType::PNG, include_bytes!("../static/images/logo-gray.png"))),
-        "error-x.svg" => Ok((ContentType::SVG, include_bytes!("../static/images/error-x.svg"))),
-        "hibp.png" => Ok((ContentType::PNG, include_bytes!("../static/images/hibp.png"))),
-        "vaultwarden-icon.png" => Ok((ContentType::PNG, include_bytes!("../static/images/vaultwarden-icon.png"))),
-        "vaultwarden-favicon.png" => Ok((ContentType::PNG, include_bytes!("../static/images/vaultwarden-favicon.png"))),
-        "404.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/404.css"))),
-        "admin.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/admin.css"))),
-        "admin.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin.js"))),
-        "admin_settings.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_settings.js"))),
-        "admin_users.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_users.js"))),
-        "admin_organizations.js" => {
-            Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_organizations.js")))
-        }
-        "admin_diagnostics.js" => {
-            Ok((ContentType::JavaScript, include_bytes!("../static/scripts/admin_diagnostics.js")))
-        }
-        "bootstrap.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/bootstrap.css"))),
-        "bootstrap.bundle.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/bootstrap.bundle.js"))),
-        "jdenticon-3.3.0.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/jdenticon-3.3.0.js"))),
-        "datatables.js" => Ok((ContentType::JavaScript, include_bytes!("../static/scripts/datatables.js"))),
-        "datatables.css" => Ok((ContentType::CSS, include_bytes!("../static/scripts/datatables.css"))),
-        _ => err!(format!("Static file not found: {filename}")),
+pub fn static_files(filename: &str) -> Result<EtagCached<&'static [u8]>, Error> {
+    if let Some(file) = STATIC_FILES.get(filename) {
+        Ok(EtagCached::new(file.bytes, file.content_type.clone(), &file.etag))
+    } else {
+        err!(format!("Static file not found: {}", filename.escape_debug()))
    }
 }
@@ -32,9 +32,9 @@ use crate::{
    db::{
        DbConn,
        models::{
-            AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
-            EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
-            SendFileId, SendId, User, UserId, UserStampException,
+            AttachmentId, CipherId, Collection, CollectionId, CustomPermission, Device, DeviceId, DeviceType,
+            EmergencyAccessId, EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId,
+            OrganizationId, SendFileId, SendId, User, UserId, custom_roles_enabled,
        },
    },
    error::Error,
@@ -314,6 +314,17 @@ impl LoginJwtClaims {
    }
 }

+fn calculate_invite_expire_hours(now: &DateTime<Utc>) -> Result<DateTime<Utc>, Error> {
+    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
+    let Some(hours_delta) = TimeDelta::try_hours(expire_hours) else {
+        err!("Unable to calculate time delta for invite expire hours. Check `INVITATION_EXPIRATION_HOURS`.");
+    };
+    let Some(exp) = now.checked_add_signed(hours_delta) else {
+        err!("Unable to calculate invitation expire date. Check `INVITATION_EXPIRATION_HOURS`.");
+    };
+    Ok(exp)
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct InviteJwtClaims {
    // Not before
@@ -337,19 +348,19 @@ pub fn generate_invite_claims(
    org_id: OrganizationId,
    member_id: MembershipId,
    invited_by_email: Option<String>,
-) -> InviteJwtClaims {
+) -> Result<InviteJwtClaims, Error> {
    let time_now = Utc::now();
-    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
-    InviteJwtClaims {
+    let exp = calculate_invite_expire_hours(&time_now)?;
+    Ok(InviteJwtClaims {
        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
+        exp: exp.timestamp(),
        iss: JWT_INVITE_ISSUER.to_string(),
        sub: user_id,
        email,
        org_id,
        member_id,
        invited_by_email,
-    }
+    })
 }

 #[derive(Debug, Serialize, Deserialize)]
@@ -375,19 +386,19 @@ pub fn generate_emergency_access_invite_claims(
    emer_id: EmergencyAccessId,
    grantor_name: String,
    grantor_email: String,
-) -> EmergencyAccessInviteJwtClaims {
+) -> Result<EmergencyAccessInviteJwtClaims, Error> {
    let time_now = Utc::now();
-    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
-    EmergencyAccessInviteJwtClaims {
+    let exp = calculate_invite_expire_hours(&time_now)?;
+    Ok(EmergencyAccessInviteJwtClaims {
        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
+        exp: exp.timestamp(),
        iss: JWT_EMERGENCY_ACCESS_INVITE_ISSUER.to_string(),
        sub: user_id,
        email,
        emer_id,
        grantor_name,
        grantor_email,
-    }
+    })
 }

 #[derive(Debug, Serialize, Deserialize)]
@@ -492,13 +503,17 @@ pub fn generate_2fa_remember_claims(device_uuid: DeviceId, user_uuid: UserId) ->
    let time_now = Utc::now();
    TwoFactorRememberClaims {
        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_days(30).unwrap()).timestamp(),
+        exp: two_factor_remember_expiration(time_now, CONFIG.two_factor_remember_days()),
        iss: JWT_2FA_REMEMBER_ISSUER.to_string(),
        sub: device_uuid,
        user_uuid,
    }
 }

+fn two_factor_remember_expiration(time_now: DateTime<Utc>, remember_days: i64) -> i64 {
+    (time_now + TimeDelta::try_days(remember_days).expect("TWO_FACTOR_REMEMBER_DAYS is validated")).timestamp()
+}
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct BasicJwtClaims {
    // Not before
@@ -521,36 +536,43 @@ impl BasicJwtClaims {
    }
 }

-pub fn generate_delete_claims(uuid: String) -> BasicJwtClaims {
+pub fn generate_delete_claims(uuid: String) -> Result<BasicJwtClaims, Error> {
    let time_now = Utc::now();
-    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
-    BasicJwtClaims {
+    let exp = calculate_invite_expire_hours(&time_now)?;
+    Ok(BasicJwtClaims {
        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
+        exp: exp.timestamp(),
        iss: JWT_DELETE_ISSUER.to_string(),
        sub: uuid,
-    }
+    })
 }

-pub fn generate_verify_email_claims(user_id: &UserId) -> BasicJwtClaims {
+pub fn generate_verify_email_claims(user_id: &UserId) -> Result<BasicJwtClaims, Error> {
    let time_now = Utc::now();
-    let expire_hours = i64::from(CONFIG.invitation_expiration_hours());
-    BasicJwtClaims {
+    let exp = calculate_invite_expire_hours(&time_now)?;
+    Ok(BasicJwtClaims {
        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_hours(expire_hours).unwrap()).timestamp(),
+        exp: exp.timestamp(),
        iss: JWT_VERIFYEMAIL_ISSUER.to_string(),
        sub: user_id.to_string(),
-    }
+    })
 }

-pub fn generate_admin_claims() -> BasicJwtClaims {
+pub fn generate_admin_claims() -> Result<BasicJwtClaims, Error> {
    let time_now = Utc::now();
-    BasicJwtClaims {
+    let lifetime_minutes = i64::from(CONFIG.admin_session_lifetime());
+    let Some(minutes_delta) = TimeDelta::try_minutes(lifetime_minutes) else {
+        err!("Unable to calculate time delta for admin session lifetime. Check `ADMIN_SESSION_LIFETIME`.");
+    };
+    let Some(exp) = time_now.checked_add_signed(minutes_delta) else {
+        err!("Unable to calculate admin session lifetime. Check `ADMIN_SESSION_LIFETIME`.");
+    };
+    Ok(BasicJwtClaims {
        nbf: time_now.timestamp(),
-        exp: (time_now + TimeDelta::try_minutes(CONFIG.admin_session_lifetime()).unwrap()).timestamp(),
+        exp: exp.timestamp(),
        iss: JWT_ADMIN_ISSUER.to_string(),
        sub: "admin_panel".to_owned(),
-    }
+    })
 }

 pub fn generate_send_claims(send_id: &SendId, file_id: &SendFileId) -> BasicJwtClaims {
@@ -610,6 +632,9 @@ impl<'r> FromRequest<'r> for Host {
 pub struct ClientHeaders {
    pub device_type: i32,
    pub ip: ClientIp,
+    /// `Bitwarden-Client-Version`, `None` when missing or not a version. Unlike the [`ClientVersion`] guard, this
+    /// doesn't log an error, as not every client sends it.
+    pub client_version: Option<semver::Version>,
 }

 #[rocket::async_trait]
@@ -626,10 +651,13 @@ impl<'r> FromRequest<'r> for ClientHeaders {
            .get_one("device-type")
            .and_then(|d| d.parse().ok())
            .unwrap_or(DeviceType::UnknownBrowser as i32);
+        let client_version =
+            request.headers().get_one("Bitwarden-Client-Version").and_then(|v| semver::Version::parse(v).ok());

        Outcome::Success(ClientHeaders {
            device_type,
            ip,
+            client_version,
        })
    }
 }
@@ -685,31 +713,12 @@ impl<'r> FromRequest<'r> for Headers {
        };

        if user.security_stamp != claims.sstamp {
-            if let Some(stamp_exception) =
-                user.stamp_exception.as_deref().and_then(|s| serde_json::from_str::<UserStampException>(s).ok())
-            {
-                let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                    err_handler!("Error getting current route for stamp exception")
-                };
+            let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
+                err_handler!("Error getting current route for stamp exception")
+            };

-                // Check if the stamp exception has expired first.
-                // Then, check if the current route matches any of the allowed routes.
-                // After that check the stamp in exception matches the one in the claims.
-                if Utc::now().timestamp() > stamp_exception.expire {
-                    // If the stamp exception has been expired remove it from the database.
-                    // This prevents checking this stamp exception for new requests.
-                    let mut user = user;
-                    user.reset_stamp_exception();
-                    if let Err(e) = user.save(&conn).await {
-                        error!("Error updating user: {e:#?}");
-                    }
-                    err_handler!("Stamp exception is expired")
-                } else if !stamp_exception.routes.contains(&current_route.to_owned()) {
-                    err_handler!("Invalid security stamp: Current route and exception route do not match")
-                } else if stamp_exception.security_stamp != claims.sstamp {
-                    err_handler!("Invalid security stamp for matched stamp exception")
-                }
-            } else {
+            // Expired exceptions are only dropped on reset; writing them back here could undo a newer reset
+            if !user.stamp_exceptions().iter().any(|e| e.allows(&claims.sstamp, current_route)) {
                err_handler!("Invalid security stamp")
            }
        }
@@ -748,6 +757,12 @@ impl OrgHeaders {
    fn is_confirmed_and_owner(&self) -> bool {
        self.membership_status == MembershipStatus::Confirmed && self.membership_type == MembershipType::Owner
    }
+    // A Custom member, while Custom roles are enabled. What they may do depends on their permissions.
+    fn is_confirmed_and_custom(&self) -> bool {
+        self.membership_status == MembershipStatus::Confirmed
+            && self.membership_type == MembershipType::Custom
+            && custom_roles_enabled()
+    }
 }

 // org_id is usually the second path param ("/organizations/<org_id>"),
@@ -886,62 +901,134 @@ fn get_col_id(request: &Request<'_>) -> Option<CollectionId> {
    None
 }

-/// The ManagerHeaders are used to check if you are at least a Manager
-/// and have access to the specific collection provided via the <col_id>/collections/collectionId.
-/// This does strict checking on the collection_id, ManagerHeadersLoose does not.
-pub struct ManagerHeaders {
-    pub host: String,
-    pub device: Device,
-    pub user: User,
-    pub ip: ClientIp,
-    pub org_id: OrganizationId,
+/// What a collection route does with its collection, which decides what a Custom member needs for it.
+#[derive(Clone, Copy)]
+pub enum CollectionAction {
+    Edit,
+    Read,
+    Delete,
 }

-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for ManagerHeaders {
-    type Error = &'static str;
+/// Whether `member`, a confirmed Custom member, may `action` the collection `col_id` of their organization.
+///
+/// Deleting needs Delete any collection: the clients are told collection deletion is limited, so the manage option
+/// on a collection is no permission to delete it. Editing is open with Edit any collection, reading also with Delete
+/// any collection, and otherwise both need the manage option on the collection itself. Neither the role nor any
+/// `access_all` counts as that.
+pub async fn custom_member_may(
+    action: CollectionAction,
+    member: &Membership,
+    col_id: &CollectionId,
+    conn: &DbConn,
+) -> bool {
+    if !(member.has_type(MembershipType::Custom)
+        && member.has_status(MembershipStatus::Confirmed)
+        && custom_roles_enabled())
+    {
+        return false;
+    }
+    match action {
+        CollectionAction::Delete => member.has_custom_permission(CustomPermission::DeleteAnyCollection),
+        CollectionAction::Edit if member.can_edit_any_collection() => true,
+        CollectionAction::Read if member.can_view_all_collections() => true,
+        CollectionAction::Edit | CollectionAction::Read => {
+            Collection::find_explicitly_manageable_by_user(&member.org_uuid, &member.user_uuid, conn)
+                .await
+                .contains(col_id)
+        }
+    }
+}

-    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.is_confirmed_and_manager() {
-            if let Some(col_id) = get_col_id(request) {
-                let Outcome::Success(conn) = DbConn::from_request(request).await else {
-                    err_handler!("Error getting DB")
-                };
+/// Checks a collection route for the collection provided via the <col_id>/collections/collectionId: a Manager, Admin
+/// or Owner needs to be able to manage the collection, a Custom member is checked for the `action`.
+async fn collection_headers(request: &Request<'_>, action: CollectionAction) -> Outcome<OrgHeaders, &'static str> {
+    let headers = try_outcome!(OrgHeaders::from_request(request).await);
+    let is_custom = headers.is_confirmed_and_custom();
+    if !headers.is_confirmed_and_manager() && !is_custom {
+        err_handler!("You need to be a Manager, Admin or Owner to call this endpoint")
+    }

-                if !Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await {
-                    err_handler!("The current user isn't a manager for this collection")
-                }
-            } else {
-                err_handler!("Error getting the collection id")
+    let Some(col_id) = get_col_id(request) else {
+        err_handler!("Error getting the collection id")
+    };
+    let Outcome::Success(conn) = DbConn::from_request(request).await else {
+        err_handler!("Error getting DB")
+    };
+
+    let allowed = if is_custom {
+        custom_member_may(action, &headers.membership, &col_id, &conn).await
+    } else {
+        Collection::is_coll_manageable_by_user(&col_id, &headers.membership.user_uuid, &conn).await
+    };
+    if !allowed {
+        // NotFound as in Bitwarden, the web vault logs the user out on a 401
+        error!(target: "auth", "Collection not found. The current user isn't a manager for this collection");
+        return Outcome::Error((rocket::http::Status::NotFound, "Collection not found"));
+    }
+    Outcome::Success(headers)
+}
+
+macro_rules! collection_headers {
+    ($(#[$doc:meta])* $name:ident, $action:expr) => {
+        $(#[$doc])*
+        pub struct $name {
+            pub host: String,
+            pub device: Device,
+            pub user: User,
+            pub ip: ClientIp,
+            pub org_id: OrganizationId,
+        }
+
+        #[rocket::async_trait]
+        impl<'r> FromRequest<'r> for $name {
+            type Error = &'static str;
+
+            async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
+                let headers = try_outcome!(collection_headers(request, $action).await);
+                Outcome::Success(Self {
+                    host: headers.host,
+                    device: headers.device,
+                    user: headers.user,
+                    ip: headers.ip,
+                    org_id: headers.membership.org_uuid,
+                })
            }
-
-            Outcome::Success(Self {
-                host: headers.host,
-                device: headers.device,
-                user: headers.user,
-                ip: headers.ip,
-                org_id: headers.membership.org_uuid,
-            })
-        } else {
-            err_handler!("You need to be a Manager, Admin or Owner to call this endpoint")
        }
-    }
+
+        impl From<$name> for Headers {
+            fn from(h: $name) -> Headers {
+                Headers {
+                    host: h.host,
+                    device: h.device,
+                    user: h.user,
+                    ip: h.ip,
+                }
+            }
+        }
+    };
 }

-impl From<ManagerHeaders> for Headers {
-    fn from(h: ManagerHeaders) -> Headers {
-        Headers {
-            host: h.host,
-            device: h.device,
-            user: h.user,
-            ip: h.ip,
-        }
-    }
-}
+collection_headers!(
+    /// The ManagerHeaders are used to check if you are at least a Manager
+    /// and have access to the specific collection provided via the <col_id>/collections/collectionId.
+    /// This does strict checking on the collection_id, ManagerHeadersLoose does not.
+    ManagerHeaders,
+    CollectionAction::Edit
+);
+collection_headers!(
+    /// The same as ManagerHeaders, for the routes which only read the collection and its access.
+    CollectionReadHeaders,
+    CollectionAction::Read
+);
+collection_headers!(
+    /// The same as ManagerHeaders, for the routes which delete the collection.
+    CollectionDeleteHeaders,
+    CollectionAction::Delete
+);

 /// The ManagerHeadersLoose is used when you at least need to be a Manager,
 /// but there is no collection_id sent with the request (either in the path or as form data).
+/// A Custom member is let through as well, the routes check what their permissions allow.
 pub struct ManagerHeadersLoose {
    pub host: String,
    pub device: Device,
@@ -956,7 +1043,7 @@ impl<'r> FromRequest<'r> for ManagerHeadersLoose {

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
        let headers = try_outcome!(OrgHeaders::from_request(request).await);
-        if headers.is_confirmed_and_manager() {
+        if headers.is_confirmed_and_manager() || headers.is_confirmed_and_custom() {
            Outcome::Success(Self {
                host: headers.host,
                device: headers.device,
@@ -981,22 +1068,29 @@ impl From<ManagerHeadersLoose> for Headers {
    }
 }

-impl ManagerHeaders {
+impl CollectionDeleteHeaders {
    pub async fn from_loose(
        h: ManagerHeadersLoose,
        collections: &Vec<CollectionId>,
        conn: &DbConn,
-    ) -> Result<ManagerHeaders, Error> {
+    ) -> Result<CollectionDeleteHeaders, Error> {
+        let is_custom = h.membership.has_type(MembershipType::Custom) && custom_roles_enabled();
        for col_id in collections {
            if uuid::Uuid::parse_str(col_id.as_ref()).is_err() {
                err!("Collection Id is malformed!");
            }
-            if !Collection::is_coll_manageable_by_user(col_id, &h.membership.user_uuid, conn).await {
+            let allowed = if is_custom {
+                Collection::find_by_uuid_and_org(col_id, &h.membership.org_uuid, conn).await.is_some()
+                    && custom_member_may(CollectionAction::Delete, &h.membership, col_id, conn).await
+            } else {
+                Collection::is_coll_manageable_by_user(col_id, &h.membership.user_uuid, conn).await
+            };
+            if !allowed {
                err!("Collection not found", "The current user isn't a manager for this collection")
            }
        }

-        Ok(ManagerHeaders {
+        Ok(CollectionDeleteHeaders {
            host: h.host,
            device: h.device,
            user: h.user,
@@ -72,7 +72,11 @@ impl SendTokens {
        conn: &DbConn,
    ) -> ApiResult<SendTokens> {
        let Some(send_id) = Self::as_send_id(access_id) else {
-            return Self::invalid_error(&format!("Can't convert {access_id}"), "send_id_invalid", false);
+            return Self::invalid_error(
+                &format!("Can't convert {}", access_id.escape_debug()),
+                "send_id_invalid",
+                false,
+            );
        };

        let Some(send) = Send::find_by_uuid(&send_id, conn).await else {
@@ -111,6 +111,7 @@ macro_rules! make_config {
            _usr: ConfigBuilder,

            _overrides: Vec<&'static str>,
+            _config_file_status: ConfigFileStatus,
        }

        // Custom Deserialize for ConfigBuilder, mainly based upon https://serde.rs/deserialize-struct.html
@@ -259,11 +260,22 @@ macro_rules! make_config {
                builder
            }

-            async fn from_file() -> Result<Self, Error> {
+            async fn from_file() -> Result<Option<Self>, Error> {
+                // The Fs operator would create the folder if it doesn't exist, which we never want
+                if !CONFIG_FILE_PARENT_DIR.starts_with("s3://") && !std::path::Path::new(&*CONFIG_FILE_PARENT_DIR).is_dir() {
+                    return Ok(None);
+                }
                let operator = storage::operator_for_path(&CONFIG_FILE_PARENT_DIR)?;
-                let config_bytes = operator.read(&CONFIG_FILENAME).await?;
+                let config_bytes = match operator.read(&CONFIG_FILENAME).await {
+                    Ok(bytes) => bytes,
+                    // No config file is fine, should not return any error
+                    Err(e) if e.kind() == opendal::ErrorKind::NotFound => return Ok(None),
+                    // Any other error might be an issue and should be passed back to the caller
+                    Err(e) => return Err(e.into()),
+                };
+                let builder = serde_json::from_slice(&config_bytes.to_vec())?;
                println!("[INFO] Using saved config from `{}` for configuration.\n", *CONFIG_FILE);
-                serde_json::from_slice(&config_bytes.to_vec()).map_err(Into::into)
+                Ok(Some(builder))
            }

            fn clear_non_editable(&mut self) {
@@ -440,6 +452,8 @@ macro_rules! make_config {
                    "domain_origin",
                    "domain_path",
                    "domain",
+                    "duo_ikey",
+                    "duo_host",
                    "helo_name",
                    "org_creation_users",
                    "signups_domains_whitelist",
@@ -451,6 +465,8 @@ macro_rules! make_config {
                    "sso_authority",
                    "sso_callback_path",
                    "sso_client_id",
+                    "yubico_client_id",
+                    "yubico_server",
                ];

                let cfg = {
@@ -483,6 +499,10 @@ macro_rules! make_config {
                };
                overrides
            }
+
+            pub fn get_config_file_status(&self) -> ConfigFileStatus {
+                self.inner.read().unwrap()._config_file_status
+            }
        }
    };
 }
@@ -539,7 +559,7 @@ make_config! {
    jobs {
        /// Job scheduler poll interval |> How often the job scheduler thread checks for jobs to run.
        /// Set to 0 to globally disable scheduled jobs.
-        job_poll_interval_ms:   u64,    false,  def,    30_000;
+        job_poll_interval_ms:   u32,    false,  def,    30_000;
        /// Send purge schedule |> Cron schedule of the job that checks for Sends past their deletion date.
        /// Defaults to hourly. Set blank to disable this job.
        send_purge_schedule:    String, false,  def,    "0 5 * * * *".to_owned();
@@ -587,6 +607,9 @@ make_config! {
        /// This setting applies globally to all users. To control this on a per-org basis instead, use the "Disable Send" org policy.
        sends_allowed:          bool,   true,   def,    true;

+        /// Fill Assist Rules URL |> HTTPS URL for the server-wide Fill Assist rules feed base directory.
+        fill_assist_rules_url: String, true, def, "https://fillassist.bitwarden.com".to_owned();
+
        /// HIBP Api Key |> HaveIBeenPwned API Key, request it here: https://haveibeenpwned.com/API/Key
        hibp_api_key:           Pass,   true,   option;

@@ -595,19 +618,19 @@ make_config! {
        /// Per-organization attachment storage limit (KB) |> Max kilobytes of attachment storage allowed per org. When this limit is reached, org members will not be allowed to upload further attachments for ciphers owned by that org.
        org_attachment_limit:   i64,    true,   option;
        /// Per-user send storage limit (KB) |> Max kilobytes of sends storage allowed per user. When this limit is reached, the user will not be allowed to upload further sends.
-        user_send_limit:   i64,    true,   option;
+        user_send_limit:        i64,    true,   option;

        /// Trash auto-delete days |> Number of days to wait before auto-deleting a trashed item.
-        /// If unset, trashed items are not auto-deleted. This setting applies globally, so make
+        /// If unset or 0, trashed items are not auto-deleted. This setting applies globally, so make
        /// sure to inform all users of any changes to this setting.
-        trash_auto_delete_days: i64,    true,   option;
+        trash_auto_delete_days: u16,    true,   option;

        /// Incomplete 2FA time limit |> Number of minutes to wait before a 2FA-enabled login is
        /// considered incomplete, resulting in an email notification. An incomplete 2FA login is one
        /// where the correct master password was provided but the required 2FA step was not completed,
        /// which potentially indicates a master password compromise. Set to 0 to disable this check.
        /// This setting applies globally to all users.
-        incomplete_2fa_time_limit: i64, true,   def,    3;
+        incomplete_2fa_time_limit: u16, true,   def,    3;

        /// Disable icon downloads |> Set to true to disable icon downloading in the internal icon service.
        /// This still serves existing icons from $ICON_CACHE_FOLDER, without generating any external
@@ -620,9 +643,9 @@ make_config! {
        /// this will prevent logins from succeeding until the address has been verified
        signups_verify:         bool,   true,   def,    false;
        /// If signups require email verification, automatically re-send verification email if it hasn't been sent for a while (in seconds)
-        signups_verify_resend_time: u64, true,  def,    3_600;
+        signups_verify_resend_time: u32, true,  def,    3_600;
        /// If signups require email verification, limit how many emails are automatically sent when login is attempted (0 means no limit)
-        signups_verify_resend_limit: u32, true, def,    6;
+        signups_verify_resend_limit: u16, true, def,    6;
        /// Email domain whitelist |> Allow signups only from this list of comma-separated domains, even when signups are otherwise disabled
        signups_domains_whitelist: String, true, def,   String::new();
        /// Enable event logging |> Enables event logging for organizations.
@@ -634,7 +657,7 @@ make_config! {
        invitations_allowed:    bool,   true,   def,    true;
        /// Invitation token expiration time (in hours) |> The number of hours after which an organization invite token, emergency access invite token,
        /// email verification token and deletion request token will expire (must be at least 1)
-        invitation_expiration_hours: u32, false, def, 120;
+        invitation_expiration_hours: u16, false, def, 120;
        /// Enable emergency access |> Controls whether users can enable emergency access to their accounts. This setting applies globally to all users.
        emergency_access_allowed:    bool,   true,   def,    true;
        /// Allow email change |> Controls whether users can change their email. This setting applies globally to all users.
@@ -655,8 +678,8 @@ make_config! {
        /// Invitation organization name |> Name shown in the invitation emails that don't come from a specific organization
        invitation_org_name:    String, true,   def,    "Vaultwarden".to_owned();

-        /// Events days retain |> Number of days to retain events stored in the database. If unset, events are kept indefinitely.
-        events_days_retain:     i64,    false,   option;
+        /// Events days retain |> Number of days to retain events stored in the database. If unset or 0, events are kept indefinitely.
+        events_days_retain:     u16,    false,   option;
    },

    client {
@@ -694,13 +717,13 @@ make_config! {
        /// Temporary redirects are useful while testing different icon services, but once a service
        /// has been decided on, consider using permanent redirects for cacheability. The legacy codes
        /// are currently better supported by the Bitwarden clients.
-        icon_redirect_code:     u32,    true,   def,    302;
+        icon_redirect_code:     u16,    true,   def,    302;
        /// Positive icon cache expiry |> Number of seconds to consider that an already cached icon is fresh. After this period, the icon will be refreshed
-        icon_cache_ttl:         u64,    true,   def,    2_592_000;
+        icon_cache_ttl:         u32,    true,   def,    2_592_000;
        /// Negative icon cache expiry |> Number of seconds before trying to download an icon that failed again.
-        icon_cache_negttl:      u64,    true,   def,    259_200;
+        icon_cache_negttl:      u32,    true,   def,    259_200;
        /// Icon download timeout |> Number of seconds when to stop attempting to download an icon.
-        icon_download_timeout:  u64,    true,   def,    10;
+        icon_download_timeout:  u16,    true,   def,    10;

        /// [Deprecated] Icon blacklist Regex |> Use `http_request_block_regex` instead
        icon_blacklist_regex:   String, false,   option;
@@ -717,6 +740,8 @@ make_config! {
        /// Disable Two-Factor remember |> Enabling this would force the users to use a second factor to login every time.
        /// Note that the checkbox would still be present, but ignored.
        disable_2fa_remember:   bool,   true,   def,    false;
+        /// Two-Factor remember duration |> Number of days before a remembered Two-Factor login expires (min: 1, max: 90).
+        two_factor_remember_days: i64,  true,   def,    30;

        /// Disable authenticator time drifted codes to be valid |> Enabling this only allows the current TOTP code to be valid
        /// TOTP codes of the previous and next 30 seconds will be invalid.
@@ -751,11 +776,11 @@ make_config! {
        /// Max database connection retries |> Number of times to retry the database connection during startup, with 1 second between each retry, set to 0 to retry indefinitely
        db_connection_retries:  u32,    false,  def,    15;

-        /// Timeout when acquiring database connection
-        database_timeout:       u64,    false,  def,    30;
+        /// Timeout in seconds when acquiring database connection
+        database_timeout:       u32,    false,  def,    30;

        /// Timeout in seconds before idle connections to the database are closed
-        database_idle_timeout:  u64,    false, def,     600;
+        database_idle_timeout:  u32,    false, def,     600;

        /// Database connection max pool size
        database_max_conns:     u32,    false,  def,    10;
@@ -776,26 +801,30 @@ make_config! {
        allowed_connect_src:      String, true, def,    String::new();

        /// Seconds between login requests |> Number of seconds, on average, between login and 2FA requests from the same IP address before rate limiting kicks in
-        login_ratelimit_seconds:       u64, false, def, 60;
+        login_ratelimit_seconds:       u16, false, def, 60;
        /// Max burst size for login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `login_ratelimit_seconds`. Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2
-        login_ratelimit_max_burst:     u32, false, def, 10;
+        login_ratelimit_max_burst:     u16, false, def, 10;

        /// Seconds between unauthenticated requests |> Number of seconds, on average, between requests from the same IP address to any of the rate limited unauthenticated endpoints
-        unauthenticated_ratelimit_seconds:   u64, false, def, 60;
+        unauthenticated_ratelimit_seconds:   u16, false, def, 60;
        /// Max burst size for unauthenticated requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `unauthenticated_ratelimit_seconds`. This is shared between several endpoints, so it needs to be more lenient than the login one
-        unauthenticated_ratelimit_max_burst: u32, false, def, 50;
+        unauthenticated_ratelimit_max_burst: u16, false, def, 50;

        /// Seconds between admin login requests |> Number of seconds, on average, between admin requests from the same IP address before rate limiting kicks in
-        admin_ratelimit_seconds:       u64, false, def, 300;
+        admin_ratelimit_seconds:       u16, false, def, 300;
        /// Max burst size for admin login requests |> Allow a burst of requests of up to this size, while maintaining the average indicated by `admin_ratelimit_seconds`
-        admin_ratelimit_max_burst:     u32, false, def, 3;
+        admin_ratelimit_max_burst:     u16, false, def, 3;

        /// Admin session lifetime |> Set the lifetime of admin sessions to this value (in minutes).
-        admin_session_lifetime:        i64, true,  def, 20;
+        admin_session_lifetime:        u32, true,  def, 20;

        /// Enable groups (BETA!) (Know the risks!) |> Enables groups support for organizations (Currently contains known issues!).
        org_groups_enabled:            bool, false, def, false;

+        /// Enable Custom roles (EXPERIMENTAL!) (Know the risks!) |> Enables the in-development Custom member role with granular permissions for organizations.
+        /// Only the permissions this version enforces can be granted. Disabling it again keeps the stored Custom roles, but they grant nothing until it is re-enabled.
+        experimental_custom_roles:     bool, false, def, false;
+
        /// Increase note size limit (Know the risks!) |> Sets the secure note size limit to 100_000 instead of the default 10_000.
        /// WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
        increase_note_size_limit:      bool,  true,  def, false;
@@ -844,8 +873,8 @@ make_config! {
        sso_master_password_policy:     String, true,  option;
        /// Use SSO only for auth not the session lifecycle |> Use default Vaultwarden session lifecycle (Idle refresh token valid for 30days)
        sso_auth_only_not_session:      bool,   true,   def,    false;
-        /// Client cache for discovery endpoint. |> Duration in seconds (0 or less to disable). More details: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect#client-cache
-        sso_client_cache_expiration:    u64,    true,   def,    0;
+        /// Client cache for discovery endpoint. |> Duration in seconds (0 to disable). More details: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect#client-cache
+        sso_client_cache_expiration:    u32,    true,   def,    0;
        /// Log all tokens |> `LOG_LEVEL=debug` or `LOG_LEVEL=info,vaultwarden::sso=debug` is required
        sso_debug_tokens:               bool,   true,   def,    false;
    },
@@ -903,11 +932,11 @@ make_config! {
        /// SMTP Auth mechanism |> Defaults for SSL is "Plain" and "Login" and nothing for Non-SSL connections. Possible values: ["Plain", "Login", "Xoauth2"]. Multiple options need to be separated by a comma ','.
        smtp_auth_mechanism:           String, true,   option;
        /// SMTP connection timeout |> Number of seconds when to stop trying to connect to the SMTP server
-        smtp_timeout:                  u64,    true,   def,     15;
+        smtp_timeout:                  u16,    true,   def,     15;
        /// Server name sent during HELO |> By default this value should be the machine's hostname, but might need to be changed in case it trips some anti-spam filters
        helo_name:                     String, true,   option;
        /// Embed images as email attachments.
-        smtp_embed_images:             bool, true, def, true;
+        smtp_embed_images:             bool,   true,   def,     true;
        /// _smtp_img_src
        _smtp_img_src:                 String, false, generated, |c| generate_smtp_img_src(c.smtp_embed_images, &c.domain);
        /// Enable SMTP debugging (Know the risks!) |> DANGEROUS: Enabling this will output very detailed SMTP messages. This could contain sensitive information like passwords and usernames! Only enable this during troubleshooting!
@@ -925,9 +954,9 @@ make_config! {
        /// Email token size |> Number of digits in an email 2FA token (min: 6, max: 255). Note that the Bitwarden clients are hardcoded to mention 6 digit codes regardless of this setting.
        email_token_size:       u8,     true,   def,      6;
        /// Token expiration time |> Maximum time in seconds a token is valid. The time the user has to open email client and copy token.
-        email_expiration_time:  u64,    true,   def,      600;
+        email_expiration_time:  u32,    true,   def,      600;
        /// Maximum attempts |> Maximum attempts before an email token is reset and a new email will need to be sent
-        email_attempts_limit:   u64,    true,   def,      3;
+        email_attempts_limit:   u8,     true,   def,      3;
        /// Setup email 2FA at signup |> Setup email 2FA provider on registration regardless of any organization policy
        email_2fa_enforce_on_verified_invite: bool,   true,   def,      false;
        /// Auto-enable 2FA (Know the risks!) |> Automatically setup email 2FA as fallback provider when needed
@@ -983,7 +1012,15 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
    }

    if cfg.database_min_conns > cfg.database_max_conns {
-        err!("`DATABASE_MIN_CONNS` must be smaller than or equal to `DATABASE_MAX_CONNS`.");
+        err!("`DATABASE_MIN_CONNS` must be less than or equal to `DATABASE_MAX_CONNS`.");
+    }
+
+    if cfg.database_timeout < 1 {
+        err!("`DATABASE_TIMEOUT` must be at least 1 second");
+    }
+
+    if cfg.database_idle_timeout < 1 {
+        err!("`DATABASE_IDLE_TIMEOUT` must be at least 1 second");
    }

    if let Some(log_file) = &cfg.log_file
@@ -999,6 +1036,21 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
        );
    }

+    let valid_fill_assist_rules_url = Url::parse(&cfg.fill_assist_rules_url).is_ok_and(|url| {
+        url.scheme() == "https"
+            && url.has_host()
+            && url.username().is_empty()
+            && url.password().is_none()
+            && url.query().is_none()
+            && url.fragment().is_none()
+            && cfg.fill_assist_rules_url.trim() == cfg.fill_assist_rules_url
+    });
+    if !valid_fill_assist_rules_url {
+        err!(
+            "`FILL_ASSIST_RULES_URL` must be a valid HTTPS URL without credentials, query parameters, fragments, or surrounding whitespace."
+        );
+    }
+
    let connect_src = cfg.allowed_connect_src.to_lowercase();
    for url in connect_src.split_whitespace() {
        if !url.starts_with("https://") || Url::parse(url).is_err() {
@@ -1233,6 +1285,10 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
        err!("`INVITATION_EXPIRATION_HOURS` has a minimum duration of 1 hour")
    }

+    if !(1..=90).contains(&cfg.two_factor_remember_days) {
+        err!("`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 90 days")
+    }
+
    // Validate schedule crontab format
    if !cfg.send_purge_schedule.is_empty() && cfg.send_purge_schedule.parse::<Schedule>().is_err() {
        err!("`SEND_PURGE_SCHEDULE` is not a valid cron expression")
@@ -1274,6 +1330,30 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
        err!("`PURGE_INCOMPLETE_SSO_AUTH` is not a valid cron expression")
    }

+    if cfg.login_ratelimit_seconds < 1 {
+        err!("`LOGIN_RATELIMIT_SECONDS` must be at least 1 second");
+    }
+
+    if cfg.login_ratelimit_max_burst < 1 {
+        err!("`LOGIN_RATELIMIT_MAX_BURST` must be at least 1");
+    }
+
+    if cfg.admin_ratelimit_seconds < 1 {
+        err!("`ADMIN_RATELIMIT_SECONDS` must be at least 1 second");
+    }
+
+    if cfg.admin_ratelimit_max_burst < 1 {
+        err!("`ADMIN_RATELIMIT_MAX_BURST` must be at least 1");
+    }
+
+    if cfg.unauthenticated_ratelimit_seconds < 1 {
+        err!("`UNAUTHENTICATED_RATELIMIT_SECONDS` must be at least 1 second");
+    }
+
+    if cfg.unauthenticated_ratelimit_max_burst < 1 {
+        err!("`UNAUTHENTICATED_RATELIMIT_MAX_BURST` must be at least 1");
+    }
+
    if !cfg.disable_admin_token {
        match cfg.admin_token.as_ref() {
            Some(t) if t.starts_with("$argon2") => {
@@ -1429,12 +1509,16 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
    // Autofill Team
    "undetermined-cipher-scenario-logic",
    "enable-basic-auth-response",
+    "fill-assist-targeting-rules",
    "ssh-agent-v2",
    "windows-desktop-autotype",
    "windows-desktop-autotype-ga",
    // Key Management Team
    "biometrics-sdk-ipc",
    "windows-native-credential-sync",
+    "macos-native-credential-sync",
+    "enable-account-encryption-v2-jit-password-registration",
+    "pm-27278-v2-password-registration",
    // Mobile Team
    "pm-34171-card-scanner",
    // Platform Team
@@ -1443,11 +1527,34 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
    "pm-32009-new-item-types",
 ];

+#[derive(Clone, Copy, Serialize)]
+pub enum ConfigFileStatus {
+    NotFound,
+    Loaded,
+    Error,
+}
+
 impl Config {
    pub async fn load() -> Result<Self, Error> {
        // Loading from env and file
        let env = ConfigBuilder::from_env();
-        let usr = ConfigBuilder::from_file().await.unwrap_or_default();
+        let (usr, config_file_status) = match ConfigBuilder::from_file().await {
+            Ok(Some(usr)) => (usr, ConfigFileStatus::Loaded),
+            Ok(None) => (ConfigBuilder::default(), ConfigFileStatus::NotFound),
+            Err(e) => {
+                println!(
+                    "[ERROR] Failed to load configuration from `{}`\n\
+                    #####################################################################################\n\
+                    # The file seems to exist but might contain invalid JSON or invalid values.         #\n\
+                    # Check the syntax and make sure every value is valid and within its allowed range. #\n\
+                    # This file is not used until those errors are resolved.                            #\n\
+                    #####################################################################################\n\
+                {e:?}\n",
+                    *CONFIG_FILE
+                );
+                (ConfigBuilder::default(), ConfigFileStatus::Error)
+            }
+        };

        // Create merged config, config file overwrites env
        let mut overrides = Vec::new();
@@ -1467,6 +1574,7 @@ impl Config {
                _env: env,
                _usr: usr,
                _overrides: overrides,
+                _config_file_status: config_file_status,
            }),
        })
    }
@@ -1500,6 +1608,7 @@ impl Config {
            writer.config = config;
            writer._usr = builder;
            writer._overrides = overrides;
+            writer._config_file_status = ConfigFileStatus::Loaded;
        }

        //Save to file
@@ -1518,7 +1627,7 @@ impl Config {
    pub fn is_email_domain_allowed(&self, email: &str) -> bool {
        let e: Vec<&str> = email.rsplitn(2, '@').collect();
        if e.len() != 2 || e[0].is_empty() || e[1].is_empty() {
-            warn!("Failed to parse email address '{email}'");
+            warn!("Failed to parse email address '{}'", email.escape_debug());
            return false;
        }
        let email_domain = e[0].to_lowercase();
@@ -1591,6 +1700,7 @@ impl Config {
            writer.config = config;
            writer._usr = usr;
            writer._overrides = Vec::new();
+            writer._config_file_status = ConfigFileStatus::NotFound;
        }

        // Invalidate CSS Cache because several config items might have impact on the rendered CSS
@@ -1,7 +1,11 @@
 mod query_logger;

 use std::{
-    sync::{Arc, OnceLock},
+    future::Future,
+    sync::{
+        Arc, OnceLock,
+        atomic::{AtomicBool, Ordering},
+    },
    time::Duration,
 };

@@ -123,6 +127,7 @@ pub static ACTIVE_DB_TYPE: OnceLock<DbConnType> = OnceLock::new();
 pub struct DbConn {
    conn: Arc<Mutex<Option<PooledConnection<DbConnManager>>>>,
    permit: Option<OwnedSemaphorePermit>,
+    transaction_open: AtomicBool,
 }

 #[derive(Debug)]
@@ -150,6 +155,7 @@ impl Drop for DbConn {
    fn drop(&mut self) {
        let conn = Arc::clone(&self.conn);
        let permit = self.permit.take();
+        let transaction_open = self.transaction_open.load(Ordering::Acquire);

        // Since connection can't be on the stack in an async fn during an
        // await, we have to spawn a new blocking-safe thread...
@@ -157,7 +163,13 @@ impl Drop for DbConn {
            // And then re-enter the runtime to wait on the async mutex, but in a blocking fashion.
            let mut conn = tokio::runtime::Handle::current().block_on(conn.lock_owned());

-            if let Some(conn) = conn.take() {
+            if let Some(mut conn) = conn.take() {
+                if transaction_open {
+                    // A cancelled request must not return an open transaction to the pool.
+                    if let Err(error) = conn.batch_execute("ROLLBACK") {
+                        error!("Failed to roll back a cancelled database transaction: {error}");
+                    }
+                }
                drop(conn);
            }

@@ -212,8 +224,8 @@ impl DbPool {
        let pool = Pool::builder()
            .max_size(max_conns)
            .min_idle(Some(CONFIG.database_min_conns()))
-            .idle_timeout(Some(Duration::from_secs(CONFIG.database_idle_timeout())))
-            .connection_timeout(Duration::from_secs(CONFIG.database_timeout()))
+            .idle_timeout(Some(Duration::from_secs(u64::from(CONFIG.database_idle_timeout()))))
+            .connection_timeout(Duration::from_secs(u64::from(CONFIG.database_timeout())))
            .connection_customizer(Box::new(DbConnOptions {
                init_stmts: conn_type.get_init_stmts(),
            }))
@@ -233,7 +245,7 @@ impl DbPool {

    // Get a connection from the pool
    pub async fn get(&self) -> Result<DbConn, Error> {
-        let duration = Duration::from_secs(CONFIG.database_timeout());
+        let duration = Duration::from_secs(u64::from(CONFIG.database_timeout()));
        let permit = match timeout(duration, Arc::clone(&self.semaphore).acquire_owned()).await {
            Ok(p) => p.expect("Semaphore should be open"),
            Err(_) => {
@@ -248,6 +260,7 @@ impl DbPool {
        Ok(DbConn {
            conn: Arc::new(Mutex::new(Some(c))),
            permit: Some(permit),
+            transaction_open: AtomicBool::new(false),
        })
    }
 }
@@ -320,6 +333,29 @@ impl DbConnType {
 }

 impl DbConn {
+    /// Run asynchronous model calls on this request's pooled connection in one transaction.
+    /// Send external notifications only after this returns successfully.
+    pub async fn transaction<F, Fut, T>(&self, operation: F) -> Result<T, Error>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = Result<T, Error>>,
+    {
+        self.run(|conn| conn.batch_execute("BEGIN")).await.map_res("Error starting database transaction")?;
+        self.transaction_open.store(true, Ordering::Release);
+        let result = operation().await;
+        if result.is_ok() {
+            let committed = self.run(|conn| conn.batch_execute("COMMIT")).await;
+            let closed = committed.is_ok() || self.run(|conn| conn.batch_execute("ROLLBACK")).await.is_ok();
+            if closed {
+                self.transaction_open.store(false, Ordering::Release);
+            }
+            committed.map_res("Error committing database transaction")?;
+        } else if self.run(|conn| conn.batch_execute("ROLLBACK")).await.is_ok() {
+            self.transaction_open.store(false, Ordering::Release);
+        }
+        result
+    }
+
    pub async fn run<F, R>(&self, f: F) -> R
    where
        F: FnOnce(&mut DbConnInner) -> R + Send,
@@ -534,3 +570,257 @@ mod postgresql_migrations {
        Ok(())
    }
 }
+
+/// A throwaway SQLite database with the real schema, for tests that need to run queries.
+#[cfg(all(test, sqlite))]
+pub mod test_db {
+    use super::{DbConn, DbConnManager, sqlite_migrations::MIGRATIONS};
+    use diesel::{Connection, connection::SimpleConnection, r2d2::Pool, sqlite::SqliteConnection};
+    use diesel_migrations::MigrationHarness;
+    use std::sync::{Arc, atomic::AtomicBool};
+    use tokio::sync::Mutex;
+
+    pub struct TestDb {
+        pool: Pool<DbConnManager>,
+        // Keep the named in-memory database alive across pooled connections.
+        _keeper: SqliteConnection,
+    }
+
+    impl TestDb {
+        fn new() -> Self {
+            let url = format!("sqlite://{}?mode=memory&cache=shared", crate::util::get_uuid());
+            let mut keeper = SqliteConnection::establish(&url).unwrap();
+            keeper.run_pending_migrations(MIGRATIONS).unwrap();
+            let pool = Pool::builder().max_size(2).build(DbConnManager::new(&url)).unwrap();
+            Self {
+                pool,
+                _keeper: keeper,
+            }
+        }
+
+        pub fn conn(&self) -> DbConn {
+            DbConn {
+                conn: Arc::new(Mutex::new(Some(self.pool.get().unwrap()))),
+                permit: None,
+                transaction_open: AtomicBool::new(false),
+            }
+        }
+    }
+
+    // CONFIG must initialize in a child process: the DNS bootstrap test needs it uninitialized.
+    pub fn run(test: impl AsyncFnOnce(&TestDb)) {
+        if std::env::var_os("VAULTWARDEN_ISOLATED_CONFIG_TEST").is_none() {
+            let output = std::process::Command::new(std::env::current_exe().unwrap())
+                .args(["--exact", std::thread::current().name().unwrap(), "--nocapture"])
+                .env("VAULTWARDEN_ISOLATED_CONFIG_TEST", "1")
+                .env("DATABASE_URL", "sqlite://:memory:")
+                .output()
+                .unwrap();
+            assert!(
+                output.status.success() && String::from_utf8_lossy(&output.stdout).contains("1 passed; 0 failed"),
+                "{}\n{}",
+                String::from_utf8_lossy(&output.stdout),
+                String::from_utf8_lossy(&output.stderr)
+            );
+            return;
+        }
+        // DbConn::run uses block_in_place, requiring a multi-threaded runtime.
+        tokio::runtime::Builder::new_multi_thread().enable_all().build().unwrap().block_on(async {
+            super::models::test_flag::CUSTOM_ROLES_ENABLED.set(Some(true));
+            test(&TestDb::new()).await;
+        });
+    }
+
+    #[test]
+    fn custom_role_migration_preserves_memberships_and_guards_downgrade() {
+        use super::schema::users_organizations::dsl::*;
+        use diesel::{migration::MigrationSource, prelude::*};
+        let mut conn = SqliteConnection::establish(":memory:").unwrap();
+        for migration in conn.pending_migrations(MIGRATIONS).unwrap() {
+            if migration.name().version().to_string() == "20261010120000" {
+                break;
+            }
+            conn.run_migration(&migration).unwrap();
+        }
+        conn.batch_execute(
+            "PRAGMA foreign_keys=OFF;
+            INSERT INTO organizations (uuid,name,billing_email) VALUES ('org','Org','a@b');
+            INSERT INTO users_organizations (uuid,user_uuid,org_uuid,access_all,akey,status,atype) VALUES
+            ('0','0','org',TRUE,'key',2,0), ('1','1','org',TRUE,'key',2,1),
+            ('2','2','org',FALSE,'key',1,2), ('3','3','org',FALSE,'key',2,3), ('4','4','org',TRUE,'key',2,3);",
+        )
+        .unwrap();
+        let rows = |conn: &mut SqliteConnection| {
+            users_organizations
+                .select((uuid, user_uuid, org_uuid, access_all, akey, status, atype))
+                .order(uuid)
+                .load::<(String, String, String, bool, String, i32, i32)>(conn)
+                .unwrap()
+        };
+        let before = rows(&mut conn);
+        conn.run_pending_migrations(MIGRATIONS).unwrap();
+        assert_eq!(rows(&mut conn), before);
+        let grants = |conn: &mut SqliteConnection| {
+            diesel::select(diesel::dsl::sql::<diesel::sql_types::BigInt>(
+                "(SELECT COUNT(*) FROM users_organizations WHERE manage_users OR manage_groups OR manage_policies
+                OR create_new_collections OR edit_any_collection OR delete_any_collection
+                OR access_event_logs OR access_import_export OR access_reports)",
+            ))
+            .get_result::<i64>(conn)
+            .unwrap()
+        };
+        assert_eq!(grants(&mut conn), 0);
+        let migration = MigrationSource::<diesel::sqlite::Sqlite>::migrations(&MIGRATIONS)
+            .unwrap()
+            .into_iter()
+            .find(|m| m.name().version().to_string() == "20261010120000")
+            .unwrap();
+        for member_status in [1, 2] {
+            conn.batch_execute(&format!(
+                "UPDATE users_organizations SET atype=4,manage_users=TRUE,status={member_status} WHERE uuid='2'"
+            ))
+            .unwrap();
+            let custom = rows(&mut conn);
+            assert!(conn.revert_migration(&*migration).is_err());
+            assert_eq!(rows(&mut conn), custom);
+            assert!(users_organizations.filter(uuid.eq("2")).select(manage_users).first::<bool>(&mut conn).unwrap());
+        }
+        conn.batch_execute("UPDATE users_organizations SET atype=2,manage_users=FALSE,status=1 WHERE uuid='2'")
+            .unwrap();
+        conn.revert_migration(&*migration).unwrap();
+        assert!(diesel::sql_query("SELECT manage_users FROM users_organizations").execute(&mut conn).is_err());
+        conn.run_pending_migrations(MIGRATIONS).unwrap();
+        assert_eq!(grants(&mut conn), 0);
+        assert_eq!(rows(&mut conn), before);
+    }
+
+    use super::models::{Collection, CustomPermission, Membership, MembershipType, Organization, OrganizationId, User};
+
+    pub async fn organization(conn: &DbConn) -> Organization {
+        let org = Organization::new("Org".into(), "billing@example.com", None, None);
+        org.save(conn).await.unwrap();
+        org
+    }
+
+    pub async fn member(
+        conn: &DbConn,
+        org: &OrganizationId,
+        role: MembershipType,
+        permissions: &[CustomPermission],
+    ) -> (User, Membership) {
+        let mut user = User::new(&format!("{}@example.com", crate::util::get_uuid()), None);
+        user.password_hash = b"existing-account".to_vec();
+        user.save(conn).await.unwrap();
+        let mut member = Membership::new(user.uuid.clone(), org.clone(), None);
+        member.set_type(role);
+        member.status = 2;
+        member.set_custom_permissions(&permissions.iter().copied().collect());
+        member.save(conn).await.unwrap();
+        (user, member)
+    }
+
+    pub async fn custom_member(conn: &DbConn, permission: CustomPermission) -> (Organization, User, Membership) {
+        let org = organization(conn).await;
+        let (user, member) = member(conn, &org.uuid, MembershipType::Custom, &[permission]).await;
+        (org, user, member)
+    }
+
+    pub async fn collection(conn: &DbConn, org: &OrganizationId) -> Collection {
+        let collection = Collection::new(org.clone(), "Collection".into(), None);
+        collection.save(conn).await.unwrap();
+        collection
+    }
+
+    #[test]
+    fn transactions_rollback_before_connection_reuse_and_commit_success() {
+        use crate::error::MapResult;
+        use diesel::RunQueryDsl;
+        run(async |db| {
+            let conn = db.conn();
+            conn.run(|c| c.batch_execute("CREATE TABLE probe (id INTEGER PRIMARY KEY)")).await.unwrap();
+            for (sql, expected) in [
+                ("INSERT INTO probe VALUES (1); INSERT INTO probe VALUES (1)", 0_i64),
+                ("INSERT INTO probe VALUES (1)", 1),
+            ] {
+                let result: Result<(), super::Error> = conn
+                    .transaction(async || conn.run(move |c| c.batch_execute(sql)).await.map_res("Insert failed"))
+                    .await;
+                assert_eq!(result.is_ok(), expected == 1);
+                let count: i64 = conn
+                    .run(|c| {
+                        diesel::select(diesel::dsl::sql::<diesel::sql_types::BigInt>("(SELECT COUNT(*) FROM probe)"))
+                            .get_result(c)
+                    })
+                    .await
+                    .unwrap();
+                assert_eq!(count, expected);
+                // The same live connection must accept another transaction, before DbConn::drop can help.
+                conn.run(|c| c.batch_execute("BEGIN; ROLLBACK")).await.unwrap();
+            }
+        });
+    }
+
+    #[test]
+    fn collection_and_cipher_access_requires_active_membership_and_enabled_groups() {
+        use super::models::{Cipher, CipherAccessScope, CollectionCipher, CollectionUser, test_flag};
+        use crate::{
+            api::core::{CipherSyncData, CipherSyncType},
+            auth::{CollectionAction, custom_member_may},
+        };
+        run(async |db| {
+            let conn = db.conn();
+            let (org, user, mut member) = custom_member(&conn, CustomPermission::EditAnyCollection).await;
+            let collection = collection(&conn, &org.uuid).await;
+            let mut cipher = Cipher::new(2);
+            cipher.name = "Cipher".into();
+            cipher.organization_uuid = Some(org.uuid.clone());
+            cipher.save(&conn).await.unwrap();
+            CollectionCipher::save(&cipher.uuid, &collection.uuid, &conn).await.unwrap();
+            for (enabled, status, allowed) in [(true, 2, true), (false, 2, false), (true, 1, false)] {
+                test_flag::CUSTOM_ROLES_ENABLED.set(Some(enabled));
+                member.status = status;
+                member.save(&conn).await.unwrap();
+                assert!(!cipher.is_accessible_to_user(&user.uuid, CipherAccessScope::User, &conn).await);
+                assert_eq!(
+                    cipher.is_write_accessible_to_user(&user.uuid, CipherAccessScope::OrganizationAdmin, &conn).await,
+                    allowed
+                );
+            }
+            test_flag::CUSTOM_ROLES_ENABLED.set(Some(true));
+            member.status = 2;
+            member.save(&conn).await.unwrap();
+            let foreign = organization(&conn).await;
+            cipher.organization_uuid = Some(foreign.uuid);
+            assert!(!cipher.is_accessible_to_user(&user.uuid, CipherAccessScope::OrganizationAdmin, &conn).await);
+            cipher.organization_uuid = Some(org.uuid.clone());
+            member.set_custom_permissions(&std::collections::HashSet::new());
+            member.save(&conn).await.unwrap();
+            let sql=format!("INSERT INTO groups (uuid,organizations_uuid,name,access_all,creation_date,revision_date)
+                VALUES ('g','{}','Group',FALSE,CURRENT_TIMESTAMP,CURRENT_TIMESTAMP);
+                INSERT INTO groups_users (groups_uuid,users_organizations_uuid) VALUES ('g','{}');
+                INSERT INTO collections_groups (collections_uuid,groups_uuid,read_only,hide_passwords,manage) VALUES ('{}','g',FALSE,FALSE,TRUE);",
+                org.uuid,member.uuid,collection.uuid);
+            conn.run(move |c| c.batch_execute(&sql)).await.unwrap();
+            for status in [2, 1, -3, -126] {
+                member.status = status;
+                member.save(&conn).await.unwrap();
+                let allowed = status == 2 && crate::CONFIG.org_groups_enabled();
+                assert_eq!(custom_member_may(CollectionAction::Edit, &member, &collection.uuid, &conn).await, allowed);
+                let sync = CipherSyncData::new(&user.uuid, CipherSyncType::User, &conn).await;
+                for cached in [None, Some(&sync)] {
+                    assert_eq!(
+                        cipher
+                            .get_access_restrictions(&user.uuid, CipherAccessScope::User, cached, &conn)
+                            .await
+                            .is_some(),
+                        allowed
+                    );
+                }
+            }
+            member.status = 2;
+            member.save(&conn).await.unwrap();
+            CollectionUser::save(&user.uuid, &collection.uuid, false, false, true, &conn).await.unwrap();
+            assert!(custom_member_may(CollectionAction::Edit, &member, &collection.uuid, &conn).await);
+        });
+    }
+}
@@ -197,7 +197,7 @@ impl AuthRequest {
    pub async fn purge_expired_auth_requests(conn: &DbConn) {
        // delete auth requests older than 15 minutes which is functionally equivalent to upstream:
        // https://github.com/bitwarden/server/blob/f8ee2270409f7a13125cd414c450740af605a175/src/Sql/dbo/Auth/Stored%20Procedures/AuthRequest_DeleteIfExpired.sql
-        let expiry_time = Utc::now().naive_utc() - chrono::TimeDelta::try_minutes(15).unwrap();
+        let expiry_time = Utc::now().naive_utc() - chrono::TimeDelta::minutes(15);
        for auth_request in Self::find_created_before(&expiry_time, conn).await {
            auth_request.delete(conn).await.ok();
        }
@@ -1,4 +1,4 @@
-use std::borrow::Cow;
+use std::{borrow::Cow, collections::HashSet};

 use chrono::{NaiveDateTime, TimeDelta, Utc};
 use derive_more::{AsRef, Deref, Display, From};
@@ -19,13 +19,14 @@ use crate::{
        },
    },
    error::MapResult,
-    util::LowerCase,
+    util::{LowerCase, convert_json_key_lcase_first},
 };
 use macros::UuidFromParam;

 use super::{
    Archive, Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership,
-    MembershipStatus, MembershipType, OrganizationId, User, UserId,
+    MembershipStatus, OrganizationId, User, UserId,
+    organization::{ORG_ADMIN_ATYPES, custom_edit_any_collection},
 };

 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -63,14 +64,68 @@ pub struct Cipher {
    pub reprompt: Option<i32>,
 }

+/// Whether `data` is a v2 cipher blob, recognized like upstream by a top-level `format_version` key.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Vault/Entities/Cipher.cs#L36-L41>
+pub fn is_data_blob_encrypted(data: &str) -> bool {
+    serde_json::from_str::<Value>(data).is_ok_and(|d| is_blob_value(&d))
+}
+
+/// [`is_data_blob_encrypted`] for `data` that was already parsed.
+fn is_blob_value(data: &Value) -> bool {
+    data.get("format_version").is_some()
+}
+
 pub enum RepromptType {
    None = 0,
    Password = 1,
 }

+/// Which access a cipher operation is authorized with.
+///
+/// The administrative cipher routes (`/ciphers/<id>/admin` and friends) are served by the same handlers as the
+/// regular vault routes, so the handlers state which one applies. They only differ for a Custom member with Edit
+/// any collection, who reaches every cipher of the organization on the administrative routes, but keeps their
+/// own vault limited to the collections they are assigned to.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum CipherAccessScope {
+    User,
+    OrganizationAdmin,
+}
+
+impl CipherAccessScope {
+    /// Whether `member` reaches every cipher of their organization with this access.
+    fn reaches_all_ciphers(self, member: &Membership) -> bool {
+        match self {
+            CipherAccessScope::User => member.has_full_access(),
+            CipherAccessScope::OrganizationAdmin => member.can_edit_any_collection(),
+        }
+    }
+
+    /// The access the v2 attachment upload asks for with `adminRequest`. It only picks which check runs, the
+    /// administrative one still needs a member who may edit any collection.
+    pub fn requested(admin_request: Option<bool>) -> Self {
+        if admin_request == Some(true) {
+            CipherAccessScope::OrganizationAdmin
+        } else {
+            CipherAccessScope::User
+        }
+    }
+
+    /// The access for a route that does not tell which one it is, from the member's own membership.
+    pub fn for_member(member: Option<&Membership>) -> Self {
+        if member.is_some_and(Membership::can_edit_any_collection) {
+            CipherAccessScope::OrganizationAdmin
+        } else {
+            CipherAccessScope::User
+        }
+    }
+}
+
 /// Local methods
 impl Cipher {
-    pub fn new(atype: i32, name: String) -> Self {
+    /// The name is set when the data is saved, since a blob-encrypted cipher has it inside `data`
+    pub fn new(atype: i32) -> Self {
        let now = Utc::now().naive_utc();

        Self {
@@ -84,7 +139,7 @@ impl Cipher {
            key: None,

            atype,
-            name,
+            name: String::new(),

            notes: None,
            fields: None,
@@ -110,6 +165,16 @@ impl Cipher {
                    .insert(format!("Ciphers[{index}].Notes"), serde_json::to_value([&max_note_size_msg]).unwrap());
            }

+            let is_blob = cipher.is_blob();
+            if let Err(e) = cipher.validate_content(is_blob) {
+                validation_errors
+                    .insert(format!("Ciphers[{index}].{}", e.field), serde_json::to_value([e.message]).unwrap());
+            }
+            if let Err(e) = cipher.validate_type_data(is_blob) {
+                validation_errors
+                    .insert(format!("Ciphers[{index}].Type"), serde_json::to_value([e.message()]).unwrap());
+            }
+
            // Validate the password history if it contains `null` values and if so, return a warning
            if let Some(Value::Array(password_history)) = &cipher.password_history {
                for pwh in password_history {
@@ -151,9 +216,53 @@ impl Cipher {
        cipher_sync_data: Option<&CipherSyncData>,
        sync_type: CipherSyncType,
        conn: &DbConn,
+    ) -> Result<Value, crate::Error> {
+        self.to_json_scoped(host, user_uuid, cipher_sync_data, sync_type, CipherAccessScope::User, conn).await
+    }
+
+    /// [`Cipher::to_json`] for an administrative route, telling what the member may do with the cipher there.
+    pub async fn to_json_org_admin(
+        &self,
+        host: &str,
+        user_uuid: &UserId,
+        conn: &DbConn,
+    ) -> Result<Value, crate::Error> {
+        self.to_json_scoped(host, user_uuid, None, CipherSyncType::User, CipherAccessScope::OrganizationAdmin, conn)
+            .await
+    }
+
+    pub async fn to_json_org_admin_collections(
+        &self,
+        host: &str,
+        user_uuid: &UserId,
+        conn: &DbConn,
+    ) -> Result<Value, crate::Error> {
+        self.to_json_scoped(
+            host,
+            user_uuid,
+            None,
+            CipherSyncType::Organization,
+            CipherAccessScope::OrganizationAdmin,
+            conn,
+        )
+        .await
+    }
+
+    async fn to_json_scoped(
+        &self,
+        host: &str,
+        user_uuid: &UserId,
+        cipher_sync_data: Option<&CipherSyncData>,
+        sync_type: CipherSyncType,
+        scope: CipherAccessScope,
+        conn: &DbConn,
    ) -> Result<Value, crate::Error> {
        use crate::util::{format_date, validate_and_format_date};

+        // Parsed once, since `data` can be large and this runs for every cipher in a sync
+        let type_data = serde_json::from_str::<Value>(&self.data);
+        let is_blob_encrypted = type_data.as_ref().is_ok_and(is_blob_value);
+
        let mut attachments_json: Value = Value::Null;
        if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(attachments) = cipher_sync_data.cipher_attachments.get(&self.uuid)
@@ -179,7 +288,7 @@ impl Cipher {
        // We don't need these values at all for Organizational syncs
        // Skip any other database calls if this is the case and just return false.
        let (read_only, hide_passwords, _) = if sync_type == CipherSyncType::User {
-            if let Some((ro, hp, mn)) = self.get_access_restrictions(user_uuid, cipher_sync_data, conn).await {
+            if let Some((ro, hp, mn)) = self.get_access_restrictions(user_uuid, scope, cipher_sync_data, conn).await {
                (ro, hp, mn)
            } else {
                error!("Cipher ownership assertion failure");
@@ -250,63 +359,9 @@ impl Cipher {
            })
            .unwrap_or_default();

-        // Get the type_data or a default to an empty json object '{}'.
-        // If not passing an empty object, mobile clients will crash.
-        let mut type_data_json = serde_json::from_str::<LowerCase<Value>>(&self.data)
-            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
-            .map_or_else(|_| Value::Object(serde_json::Map::new()), |d| d.data);
-
-        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
-        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
-        if self.atype == 1 {
-            // Upstream always has an `uri` key/value
-            type_data_json["uri"] = Value::Null;
-            if let Some(uris) = type_data_json["uris"].as_array_mut()
-                && !uris.is_empty()
-            {
-                // Fix uri match values first, they are only allowed to be a number or null
-                // If it is a string, convert it to an int or null if that fails
-                for uri in &mut *uris {
-                    if uri["match"].is_string() {
-                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
-                            Ok(n) => json!(n),
-                            _ => Value::Null,
-                        };
-                        uri["match"] = match_value;
-                    }
-                }
-                type_data_json["uri"] = uris[0]["uri"].clone();
-            }
-
-            // Check if `passwordRevisionDate` is a valid date, else convert it
-            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
-                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
-            }
-        }
-
-        // Fix secure note issues when data is invalid
-        // This breaks at least the native mobile clients
-        if self.atype == 2 {
-            match type_data_json {
-                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
-                _ => {
-                    type_data_json = json!({"type": 0});
-                }
-            }
-        }
-
-        // Fix invalid SSH Entries
-        // This breaks at least the native mobile client if invalid
-        // The only way to fix this is by setting type_data_json to `null`
-        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
-        if self.atype == 5
-            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
-                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
-                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
-        {
-            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
-            type_data_json = Value::Null;
-        }
+        // Like upstream, fields and password history stored as NULL are sent as null, not `[]`
+        let fields_json = self.fields.is_some().then_some(fields_json);
+        let password_history_json = self.password_history.is_some().then_some(password_history_json);

        let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
@@ -315,7 +370,7 @@ impl Cipher {
                Cow::from(Vec::new())
            }
        } else {
-            Cow::from(self.get_admin_collections(user_uuid.clone(), conn).await)
+            Cow::from(self.get_admin_collections(user_uuid.clone(), scope, conn).await)
        };

        // There are three types of cipher response models in upstream
@@ -403,10 +458,84 @@ impl Cipher {
            _ => err!(format!("Cipher {} has an invalid type {}", self.uuid, self.atype)),
        };

-        json_object[key] = type_data_json;
+        if is_blob_encrypted {
+            // Like upstream, sent as-is with the structured fields null
+            json_object["data"] = json!(self.data);
+            json_object["name"] = Value::Null;
+        } else {
+            json_object[key] = self.legacy_type_data_json(type_data);
+        }
        Ok(json_object)
    }

+    /// The per-type data of a legacy cipher, with fixups for values known to break clients.
+    fn legacy_type_data_json(&self, type_data: Result<Value, serde_json::Error>) -> Value {
+        use crate::util::validate_and_format_date;
+
+        // Get the type_data or a default to an empty json object '{}'.
+        // If not passing an empty object, mobile clients will crash.
+        let mut type_data_json = if let Ok(data @ Value::Object(_)) = type_data {
+            convert_json_key_lcase_first(data)
+        } else {
+            warn!("Error parsing data field for {}", self.uuid);
+            Value::Object(serde_json::Map::new())
+        };
+
+        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
+        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
+        if self.atype == 1 {
+            // Upstream always has an `uri` key/value
+            type_data_json["uri"] = Value::Null;
+            if let Some(uris) = type_data_json["uris"].as_array_mut()
+                && !uris.is_empty()
+            {
+                // Fix uri match values first, they are only allowed to be a number or null
+                // If it is a string, convert it to an int or null if that fails
+                for uri in &mut *uris {
+                    if uri["match"].is_string() {
+                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
+                            Ok(n) => json!(n),
+                            _ => Value::Null,
+                        };
+                        uri["match"] = match_value;
+                    }
+                }
+                type_data_json["uri"] = uris[0]["uri"].clone();
+            }
+
+            // Check if `passwordRevisionDate` is a valid date, else convert it
+            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
+                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
+            }
+        }
+
+        // Fix secure note issues when data is invalid
+        // This breaks at least the native mobile clients
+        if self.atype == 2 {
+            match type_data_json {
+                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
+                _ => {
+                    type_data_json = json!({"type": 0});
+                }
+            }
+        }
+
+        // Fix invalid SSH Entries
+        // This breaks at least the native mobile client if invalid
+        // The only way to fix this is by setting type_data_json to `null`
+        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
+        if self.atype == 5
+            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
+                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
+                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
+        {
+            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
+            type_data_json = Value::Null;
+        }
+
+        type_data_json
+    }
+
    pub async fn update_users_revision(&self, conn: &DbConn) -> Vec<UserId> {
        let mut user_uuids = Vec::new();
        match self.user_uuid {
@@ -494,12 +623,22 @@ impl Cipher {

    /// Purge all ciphers that are old enough to be auto-deleted.
    pub async fn purge_trash(conn: &DbConn) {
-        if let Some(auto_delete_days) = CONFIG.trash_auto_delete_days() {
-            let now = Utc::now().naive_utc();
-            let dt = now - TimeDelta::try_days(auto_delete_days).unwrap();
-            for cipher in Self::find_deleted_before(&dt, conn).await {
-                cipher.delete(conn).await.ok();
-            }
+        let Some(auto_delete_days) = CONFIG.trash_auto_delete_days().filter(|&d| d != 0) else {
+            debug!("trash_auto_delete_days is not configured or set to 0, skipping");
+            return;
+        };
+
+        let Some(days) = TimeDelta::try_days(i64::from(auto_delete_days)) else {
+            error!("Unable to calculate auto delete days!");
+            return;
+        };
+        let now = Utc::now().naive_utc();
+        let Some(dt) = now.checked_sub_signed(days) else {
+            error!("Unable to calculate trash purge date!");
+            return;
+        };
+        for cipher in Self::find_deleted_before(&dt, conn).await {
+            cipher.delete(conn).await.ok();
        }
    }

@@ -510,7 +649,16 @@ impl Cipher {
        conn: &DbConn,
    ) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;
+        self.move_to_folder_without_revision_update(folder_uuid, user_uuid, conn).await
+    }

+    /// Same as `move_to_folder`, but the caller is responsible for updating the user's revision.
+    pub async fn move_to_folder_without_revision_update(
+        &self,
+        folder_uuid: Option<FolderId>,
+        user_uuid: &UserId,
+        conn: &DbConn,
+    ) -> EmptyResult {
        match (self.get_folder_uuid(user_uuid, conn).await, folder_uuid) {
            // No changes
            (None, None) => Ok(()),
@@ -543,20 +691,21 @@ impl Cipher {
        self.user_uuid.is_some() && self.user_uuid.as_ref().unwrap() == user_uuid
    }

-    /// Returns whether this cipher is owned by an org in which the user has full access.
+    /// Returns whether this cipher is owned by an org in which the user reaches every cipher with `scope`.
    async fn is_in_full_access_org(
        &self,
        user_uuid: &UserId,
+        scope: CipherAccessScope,
        cipher_sync_data: Option<&CipherSyncData>,
        conn: &DbConn,
    ) -> bool {
        if let Some(ref org_uuid) = self.organization_uuid {
            if let Some(cipher_sync_data) = cipher_sync_data {
                if let Some(cached_member) = cipher_sync_data.members.get(org_uuid) {
-                    return cached_member.has_full_access();
+                    return scope.reaches_all_ciphers(cached_member);
                }
            } else if let Some(member) = Membership::find_confirmed_by_user_and_org(user_uuid, org_uuid, conn).await {
-                return member.has_full_access();
+                return scope.reaches_all_ciphers(&member);
            }
        }
        false
@@ -589,6 +738,7 @@ impl Cipher {
    pub async fn get_access_restrictions(
        &self,
        user_uuid: &UserId,
+        scope: CipherAccessScope,
        cipher_sync_data: Option<&CipherSyncData>,
        conn: &DbConn,
    ) -> Option<(bool, bool, bool)> {
@@ -596,7 +746,7 @@ impl Cipher {
        // a collection that the user has full access to. If so, there are no
        // access restrictions.
        if self.is_owned_by_user(user_uuid)
-            || self.is_in_full_access_org(user_uuid, cipher_sync_data, conn).await
+            || self.is_in_full_access_org(user_uuid, scope, cipher_sync_data, conn).await
            || self.is_in_full_access_group(user_uuid, cipher_sync_data, conn).await
        {
            return Some((false, false, true));
@@ -719,8 +869,13 @@ impl Cipher {
        .await
    }

-    pub async fn is_write_accessible_to_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
-        match self.get_access_restrictions(user_uuid, None, conn).await {
+    pub async fn is_write_accessible_to_user(
+        &self,
+        user_uuid: &UserId,
+        scope: CipherAccessScope,
+        conn: &DbConn,
+    ) -> bool {
+        match self.get_access_restrictions(user_uuid, scope, None, conn).await {
            Some((read_only, _hide_passwords, manage)) => !read_only || manage,
            None => false,
        }
@@ -728,15 +883,20 @@ impl Cipher {

    // used for checking if collection can be edited (only if user has access to a collection they
    // can write to and also passwords are not hidden to prevent privilege escalation)
-    pub async fn is_in_editable_collection_by_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
-        match self.get_access_restrictions(user_uuid, None, conn).await {
+    pub async fn is_in_editable_collection_by_user(
+        &self,
+        user_uuid: &UserId,
+        scope: CipherAccessScope,
+        conn: &DbConn,
+    ) -> bool {
+        match self.get_access_restrictions(user_uuid, scope, None, conn).await {
            Some((read_only, hide_passwords, manage)) => (!read_only && !hide_passwords) || manage,
            None => false,
        }
    }

-    pub async fn is_accessible_to_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
-        self.get_access_restrictions(user_uuid, None, conn).await.is_some()
+    pub async fn is_accessible_to_user(&self, user_uuid: &UserId, scope: CipherAccessScope, conn: &DbConn) -> bool {
+        self.get_access_restrictions(user_uuid, scope, None, conn).await.is_some()
    }

    // Returns whether this cipher is a favorite of the specified user.
@@ -853,7 +1013,7 @@ impl Cipher {

                if !visible_only {
                    query = query.or_filter(
-                        users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner
+                        users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner
                    );
                }

@@ -888,7 +1048,7 @@ impl Cipher {

                if !visible_only {
                    query = query.or_filter(
-                        users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner
+                        users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner
                    );
                }

@@ -1052,7 +1212,12 @@ impl Cipher {
        }
    }

-    pub async fn get_admin_collections(&self, user_uuid: UserId, conn: &DbConn) -> Vec<CollectionId> {
+    pub async fn get_admin_collections(
+        &self,
+        user_uuid: UserId,
+        scope: CipherAccessScope,
+        conn: &DbConn,
+    ) -> Vec<CollectionId> {
        if CONFIG.org_groups_enabled() {
            conn.run(move |conn| {
                ciphers_collections::table
@@ -1092,7 +1257,9 @@ impl Cipher {
                            .or(collections_groups::collections_uuid
                                .is_not_null() // Access via groups
                                .and(collections_groups::read_only.eq(false)))
-                            .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner
+                            .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner
+                            .or(custom_edit_any_collection()
+                                .and::<_, diesel::sql_types::Bool>(scope == CipherAccessScope::OrganizationAdmin)),
                    )
                    .select(ciphers_collections::collection_uuid)
                    .load::<CollectionId>(conn)
@@ -1121,7 +1288,9 @@ impl Cipher {
                            .or(users_collections::user_uuid
                                .eq(user_uuid) // User has access to collection
                                .and(users_collections::read_only.eq(false)))
-                            .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner
+                            .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner
+                            .or(custom_edit_any_collection()
+                                .and::<_, diesel::sql_types::Bool>(scope == CipherAccessScope::OrganizationAdmin)),
                    )
                    .select(ciphers_collections::collection_uuid)
                    .load::<CollectionId>(conn)
@@ -1163,7 +1332,7 @@ impl Cipher {
                )
                .or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection
                .or_filter(users_organizations::access_all.eq(true)) // User has access all
-                .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
+                .or_filter(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner
                .or_filter(groups::access_all.eq(true)) //Access via group
                .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
@@ -1174,6 +1343,50 @@ impl Cipher {
        })
        .await
    }
+
+    /// Every collection of every cipher of the organization, for the members who may see all of them.
+    pub async fn get_collections_with_cipher_by_organization(
+        org_uuid: &OrganizationId,
+        conn: &DbConn,
+    ) -> Vec<(CipherId, CollectionId)> {
+        conn.run(move |conn| {
+            ciphers_collections::table
+                .inner_join(collections::table.on(collections::uuid.eq(ciphers_collections::collection_uuid)))
+                .filter(collections::org_uuid.eq(org_uuid))
+                .select(ciphers_collections::all_columns)
+                .load::<(CipherId, CollectionId)>(conn)
+                .unwrap_or_default()
+        })
+        .await
+    }
+
+    /// The ciphers of the organization of `member` the Admin Console lists when they may not edit every cipher, like
+    /// Bitwarden does: the ones in the member's own vault, then, for a member who may edit any collection, the ones in
+    /// no collection at all.
+    pub async fn find_assigned_to_member(member: &Membership, conn: &DbConn) -> (Vec<Self>, Vec<Self>) {
+        let assigned: Vec<Self> = Self::find_by_user_visible(&member.user_uuid, conn)
+            .await
+            .into_iter()
+            .filter(|cipher| cipher.organization_uuid.as_ref() == Some(&member.org_uuid))
+            .collect();
+        if !member.can_edit_any_collection() {
+            return (assigned, Vec::new());
+        }
+
+        let listed: HashSet<CipherId> = assigned.iter().map(|cipher| cipher.uuid.clone()).collect();
+        let in_collections: HashSet<CipherId> =
+            Self::get_collections_with_cipher_by_organization(&member.org_uuid, conn)
+                .await
+                .into_iter()
+                .map(|(cipher, _)| cipher)
+                .collect();
+        let unassigned = Self::find_by_org(&member.org_uuid, conn)
+            .await
+            .into_iter()
+            .filter(|cipher| !in_collections.contains(&cipher.uuid) && !listed.contains(&cipher.uuid))
+            .collect();
+        (assigned, unassigned)
+    }
 }

 #[derive(
@@ -18,7 +18,7 @@ use macros::UuidFromParam;

 use super::{
    CipherId, CollectionGroup, GroupUser, Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId,
-    User, UserId,
+    User, UserId, custom_roles_enabled, organization::ORG_ADMIN_ATYPES,
 };

 // See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/AdminConsole/Entities/Collection.cs
@@ -109,18 +109,22 @@ impl Collection {
                Some(m) if m.has_full_access() => (false, false, m.atype >= MembershipType::Manager),
                Some(m) => {
                    // Only let a manager manage collections when the have full read/write access
+                    // A Custom member only manages a collection with the manage option
                    let is_manager = m.atype == MembershipType::Manager;
+                    let is_custom = m.has_type(MembershipType::Custom) && custom_roles_enabled();
                    if let Some(cu) = cipher_sync_data.user_collections.get(&self.uuid) {
                        (
                            cu.read_only,
                            cu.hide_passwords,
-                            is_manager && (cu.manage || (!cu.read_only && !cu.hide_passwords)),
+                            (is_manager && (cu.manage || (!cu.read_only && !cu.hide_passwords)))
+                                || (is_custom && cu.manage),
                        )
                    } else if let Some(cg) = cipher_sync_data.user_collections_groups.get(&self.uuid) {
                        (
                            cg.read_only,
                            cg.hide_passwords,
-                            is_manager && (cg.manage || (!cg.read_only && !cg.hide_passwords)),
+                            (is_manager && (cg.manage || (!cg.read_only && !cg.hide_passwords)))
+                                || (is_custom && cg.manage),
                        )
                    } else {
                        (false, false, false)
@@ -134,6 +138,17 @@ impl Collection {
                Some(m) if m.atype == MembershipType::Manager && self.is_manageable_by_user(user_uuid, conn).await => {
                    (false, false, true)
                }
+                // A Custom member reads and writes every collection with Edit any collection in the Admin Console, but
+                // only manages a collection with the manage option on it
+                Some(m) if m.has_type(MembershipType::Custom) && custom_roles_enabled() => {
+                    let manage = self.is_explicitly_manageable_by_user(user_uuid, conn).await;
+                    if manage || m.can_edit_any_collection() {
+                        (false, false, manage)
+                    } else {
+                        let read_only = !self.is_writable_by_user(user_uuid, conn).await;
+                        (read_only, self.hide_passwords_for_user(user_uuid, conn).await, false)
+                    }
+                }
                Some(m) => {
                    let is_manager = m.atype == MembershipType::Manager;
                    let read_only = !self.is_writable_by_user(user_uuid, conn).await;
@@ -375,7 +390,7 @@ impl Collection {
                                // Directly accessed collection
                                users_organizations::access_all.eq(true).or(
                                    // access_all in Organization
-                                    users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
+                                    users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
                                ),
                            )
                            .or(
@@ -412,7 +427,7 @@ impl Collection {
                        // Directly accessed collection
                        users_organizations::access_all.eq(true).or(
                            // access_all in Organization
-                            users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
+                            users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
                        ),
                    ))
                    .select(collections::all_columns)
@@ -455,7 +470,7 @@ impl Collection {
                    )
                    .filter(
                        users_organizations::atype
-                            .le(MembershipType::Admin as i32) // Org admin or owner
+                            .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner
                            .or(users_organizations::access_all.eq(true)) // access_all via membership
                            .or(users_collections::collection_uuid
                                .eq(&self.uuid) // write access given to collection
@@ -489,7 +504,7 @@ impl Collection {
                    )
                    .filter(
                        users_organizations::atype
-                            .le(MembershipType::Admin as i32) // Org admin or owner
+                            .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner
                            .or(users_organizations::access_all.eq(true)) // access_all via membership
                            .or(users_collections::collection_uuid
                                .eq(&self.uuid) // write access given to collection
@@ -540,7 +555,7 @@ impl Collection {
                            // Directly accessed collection
                            users_organizations::access_all.eq(true).or(
                                // access_all in Organization
-                                users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
+                                users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
                            ),
                        )
                        .or(
@@ -600,7 +615,7 @@ impl Collection {
                            // Directly accessed collection
                            users_organizations::access_all.eq(true).or(
                                // access_all in Organization
-                                users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
+                                users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
                            ),
                        )
                        .or(
@@ -635,8 +650,23 @@ impl Collection {
        user_uuid: &UserId,
        conn: &DbConn,
    ) -> bool {
+        !Self::find_explicitly_manageable_by_user(org_uuid, user_uuid, conn).await.is_empty()
+    }
+
+    pub async fn is_explicitly_manageable_by_user(&self, user_uuid: &UserId, conn: &DbConn) -> bool {
+        Self::find_explicitly_manageable_by_user(&self.org_uuid, user_uuid, conn).await.contains(&self.uuid)
+    }
+
+    // The collections of the org the user has manage access to by the manage option, directly or via a group.
+    // Unlike is_coll_manageable_by_user, neither the role nor any access_all counts.
+    pub async fn find_explicitly_manageable_by_user(
+        org_uuid: &OrganizationId,
+        user_uuid: &UserId,
+        conn: &DbConn,
+    ) -> Vec<CollectionId> {
        let org_uuid = org_uuid.to_string();
        let user_uuid = user_uuid.to_string();
+        let groups_enabled = CONFIG.org_groups_enabled();
        conn.run(move |conn| {
            collections::table
                .left_join(
@@ -658,14 +688,16 @@ impl Collection {
                .filter(collections::org_uuid.eq(&org_uuid))
                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
-                    // Manage permission on a collection assigned directly or via a group.
-                    users_collections::manage.eq(true).or(collections_groups::manage.eq(true)),
+                    users_collections::manage.eq(true).or(users_collections::user_uuid
+                        .is_null()
+                        .or(users_organizations::atype.eq(MembershipType::Manager as i32))
+                        .and(collections_groups::manage.eq(true))
+                        .and::<_, diesel::sql_types::Bool>(groups_enabled)),
                )
-                .count()
-                .first::<i64>(conn)
-                .ok()
-                .unwrap_or(0)
-                != 0
+                .select(collections::uuid)
+                .distinct()
+                .load::<CollectionId>(conn)
+                .unwrap_or_default()
        })
        .await
    }
@@ -1,4 +1,4 @@
-use chrono::{NaiveDateTime, Utc};
+use chrono::{NaiveDateTime, TimeDelta, Utc};
 use derive_more::{AsRef, Deref, Display, From};
 use diesel::prelude::*;
 use serde_json::Value;
@@ -112,8 +112,26 @@ impl EmergencyAccess {
            "object": "emergencyAccessGranteeDetails",
        }))
    }
+
+    pub fn deadline_at(&self) -> Result<NaiveDateTime, crate::Error> {
+        if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&self.wait_time_days) {
+            err!("Emergency access wait time is out-of-bounds!")
+        }
+
+        let initiated_at = self.recovery_initiated_at.map_res("Emergency access initiation date missing!")?;
+
+        TimeDelta::try_days(i64::from(self.wait_time_days))
+            .and_then(|w| initiated_at.checked_add_signed(w))
+            .map_res("Emergency access deadline is invalid")
+    }
+
+    pub fn is_recovery_allowed(&self, now: &NaiveDateTime) -> Result<bool, crate::Error> {
+        Ok(self.deadline_at()?.le(now))
+    }
 }

+pub const EMERGENCY_ACCESS_TIMEOUT_RANGE: std::ops::RangeInclusive<i32> = 1..=90;
+
 #[derive(Copy, Clone)]
 pub enum EmergencyAccessType {
    View = 0,
@@ -169,27 +187,42 @@ impl EmergencyAccess {

    pub async fn update_access_status_and_save(
        &mut self,
-        status: i32,
+        from_status: i32,
+        to_status: i32,
        date: &NaiveDateTime,
        conn: &DbConn,
    ) -> EmptyResult {
+        let uuid = self.uuid.clone();
+        let updated_at = *date;
+        let res = conn
+            .run(move |conn| {
+                crate::util::retry(
+                    || {
+                        diesel::update(
+                            emergency_access::table
+                                .filter(emergency_access::uuid.eq(&uuid))
+                                .filter(emergency_access::status.eq(from_status)),
+                        )
+                        .set((emergency_access::status.eq(to_status), emergency_access::updated_at.eq(updated_at)))
+                        .execute(conn)
+                    },
+                    10,
+                )
+            })
+            .await;
+
+        match res {
+            Ok(1) => {} // One record updated, which is valid
+            Ok(_) => err!("Emergency access status was changed already"),
+            Err(e) => err!("Error updating emergency access status", format!("{e}")),
+        }
+
+        self.status = to_status;
+        self.updated_at = updated_at;
+
        // Update the grantee so that it will refresh it's status.
        User::update_uuid_revision(self.grantee_uuid.as_ref().expect("Error getting grantee"), conn).await;
-        self.status = status;
-        date.clone_into(&mut self.updated_at);
-
-        conn.run(move |conn| {
-            crate::util::retry(
-                || {
-                    diesel::update(emergency_access::table.filter(emergency_access::uuid.eq(&self.uuid)))
-                        .set((emergency_access::status.eq(status), emergency_access::updated_at.eq(date)))
-                        .execute(conn)
-                },
-                10,
-            )
-            .map_res("Error updating emergency access status")
-        })
-        .await
+        Ok(())
    }

    pub async fn update_last_notification_date_and_save(&mut self, date: &NaiveDateTime, conn: &DbConn) -> EmptyResult {
@@ -79,6 +79,7 @@ pub enum EventType {
    CipherSoftDeleted = 1115,
    CipherRestored = 1116,
    CipherClientToggledCardNumberVisible = 1117,
+    CipherClientHttpAuthReleased = 1133,

    // Collection
    CollectionCreated = 1300,
@@ -111,8 +112,8 @@ pub enum EventType {
    // OrganizationUserAutomaticallyConfirmed = 1517,
    // OrganizationUserSelfRevoked = 1518, // User self-revoked due to declining organization data ownership policy
    OrganizationUserAdminResetTwoFactor = 1519,
-    // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
-    // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
+    OrganizationUserRevokedTwoFactorNonCompliance = 1520,
+    OrganizationUserRevokedSingleOrganizationNonCompliance = 1521,
    OrganizationUserNotificationBannerActionClicked = 1522,

    // Organization
@@ -347,17 +348,23 @@ impl Event {
    }

    pub async fn clean_events(conn: &DbConn) -> EmptyResult {
-        if let Some(days_to_retain) = CONFIG.events_days_retain() {
-            let dt = Utc::now().naive_utc() - TimeDelta::try_days(days_to_retain).unwrap();
-            conn.run(move |conn| {
-                diesel::delete(event::table.filter(event::event_date.lt(dt)))
-                    .execute(conn)
-                    .map_res("Error cleaning old events")
-            })
-            .await
-        } else {
-            Ok(())
-        }
+        let Some(days_to_retain) = CONFIG.events_days_retain().filter(|&d| d != 0) else {
+            return Ok(());
+        };
+
+        let Some(days_to_retain) = TimeDelta::try_days(i64::from(days_to_retain)) else {
+            err!("Unable to calculate the event retention date, check 'EVENTS_DAYS_RETAIN'")
+        };
+
+        let Some(dt) = Utc::now().naive_utc().checked_sub_signed(days_to_retain) else {
+            err!("Unable to calculate the event retention date, check 'EVENTS_DAYS_RETAIN'")
+        };
+        conn.run(move |conn| {
+            diesel::delete(event::table.filter(event::event_date.lt(dt)))
+                .execute(conn)
+                .map_res("Error cleaning old events")
+        })
+        .await
    }
 }

@@ -137,15 +137,15 @@ impl CollectionGroup {
    }

    pub fn to_json_details_for_group(&self) -> Value {
-        // If both read_only and hide_passwords are false, then manage should be true
-        // You can't have an entry with read_only and manage, or hide_passwords and manage
-        // Or an entry with everything to false
-        // For backwards compatibility and migration proposes we keep checking read_only and hide_password
+        // Return the stored manage flag. Deriving it from !read_only && !hide_passwords turned the group
+        // permission "Can edit items" (readOnly=false, hidePasswords=false, manage=false) into "Can manage"
+        // in GET /organizations/<org>/collections/details, while GET /groups/<id>/details reported the stored
+        // value. Saving the collection access dialog then persisted manage=true.
        json!({
            "id": self.groups_uuid,
            "readOnly": self.read_only,
            "hidePasswords": self.hide_passwords,
-            "manage": self.manage || (!self.read_only && !self.hide_passwords),
+            "manage": self.manage,
        })
    }
 }
@@ -17,26 +17,32 @@ mod two_factor;
 mod two_factor_duo_context;
 mod two_factor_incomplete;
 mod user;
+mod user_signature_key_pair;

 pub use self::archive::Archive;
 pub use self::attachment::{Attachment, AttachmentId};
 pub use self::auth_request::{AuthRequest, AuthRequestId};
-pub use self::cipher::{Cipher, CipherId, RepromptType};
+pub use self::cipher::{Cipher, CipherAccessScope, CipherId, RepromptType, is_data_blob_encrypted};
 pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
 pub use self::device::{Device, DeviceId, DeviceType, DeviceWithAuthRequest, PushId};
-pub use self::emergency_access::{EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType};
+pub use self::emergency_access::{
+    EMERGENCY_ACCESS_TIMEOUT_RANGE, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType,
+};
 pub use self::event::{Event, EventType};
 pub use self::favorite::Favorite;
 pub use self::folder::{Folder, FolderCipher, FolderId};
 pub use self::group::{CollectionGroup, Group, GroupId, GroupUser};
-pub use self::org_policy::{OrgPolicy, OrgPolicyId, OrgPolicyType};
+pub use self::org_policy::{FillAssistPolicyData, OrgPolicy, OrgPolicyId, OrgPolicyType};
+#[cfg(all(test, sqlite))]
+pub(crate) use self::organization::test_flag;
 pub use self::organization::{
-    Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization, OrganizationApiKey,
-    OrganizationId,
+    CustomPermission, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization,
+    OrganizationApiKey, OrganizationId, custom_roles_enabled,
 };
 pub use self::send::{Send, SendFileId, SendId, SendType};
 pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType, UserStampException};
+pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType};
+pub use self::user_signature_key_pair::{SignatureAlgorithm, UserSignatureKeyPair};
@@ -53,6 +53,8 @@ pub enum OrgPolicyType {
    // AutoConfirm = 18, // Not supported (not implemented yet)
    // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
    OrganizationUserNotification = 20,
+    // SendControls = 21, // Not supported yet
+    FillAssist = 22,
 }

 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs#L5
@@ -71,6 +73,14 @@ pub struct ResetPasswordDataModel {
    pub auto_enroll_enabled: bool,
 }

+// https://github.com/bitwarden/server/blob/13bc813de8e715a71d3410f1e584e87ccdf76025/src/Core/AdminConsole/Models/Data/Organizations/Policies/FillAssistPolicyData.cs
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FillAssistPolicyData {
+    #[serde(alias = "RulesUrl")]
+    pub rules_url: Option<String>,
+}
+
 /// Local methods
 impl OrgPolicy {
    pub fn new(org_uuid: OrganizationId, atype: OrgPolicyType, enabled: bool, data: String) -> Self {
@@ -1,4 +1,7 @@
-use std::cmp::Ordering;
+use std::{
+    cmp::Ordering,
+    collections::{HashMap, HashSet},
+};

 use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, Deref, Display, From};
@@ -41,6 +44,7 @@ pub struct Organization {
 #[diesel(table_name = users_organizations)]
 #[diesel(treat_none_as_null = true)]
 #[diesel(primary_key(uuid))]
+#[expect(clippy::struct_excessive_bools, reason = "Each Custom role permission is a column of its own")]
 pub struct Membership {
    pub uuid: MembershipId,
    pub user_uuid: UserId,
@@ -54,6 +58,20 @@ pub struct Membership {
    pub atype: i32,
    pub reset_password_key: Option<String>,
    pub external_id: Option<String>,
+
+    // The permissions of a Custom role, only accessed through `CustomPermission`.
+    manage_users: bool,
+    manage_groups: bool,
+    manage_policies: bool,
+    create_new_collections: bool,
+    edit_any_collection: bool,
+    delete_any_collection: bool,
+    access_event_logs: bool,
+    access_import_export: bool,
+    access_reports: bool,
+
+    /// The user's v2 upgrade token, for the org to unwrap the v2 user key after an upgrade. Opaque to us.
+    pub v2_upgrade_token: Option<String>,
 }

 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -89,42 +107,74 @@ impl MembershipStatus {
    }
 }

-#[derive(Copy, Clone, PartialEq, Eq, num_derive::FromPrimitive)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, num_derive::FromPrimitive)]
 pub enum MembershipType {
    Owner = 0,
    Admin = 1,
    User = 2,
+    // The legacy Manager role. The Bitwarden clients no longer know it and are shown a Custom role instead.
    Manager = 3,
+    // Only granted while EXPERIMENTAL_CUSTOM_ROLES is enabled.
+    Custom = 4,
 }

 impl MembershipType {
    pub fn from_str(s: &str) -> Option<Self> {
-        #[expect(
-            clippy::match_same_arms,
-            reason = "Specifically define `4|Custom` since this is a hack, not a default"
-        )]
        match s {
            "0" | "Owner" => Some(MembershipType::Owner),
            "1" | "Admin" => Some(MembershipType::Admin),
            "2" | "User" => Some(MembershipType::User),
            "3" | "Manager" => Some(MembershipType::Manager),
-            // HACK: We convert the custom role to a manager role
-            "4" | "Custom" => Some(MembershipType::Manager),
+            "4" | "Custom" => Some(MembershipType::Custom),
            _ => None,
        }
    }
+
+    /// The role a member invite or edit from the Bitwarden clients asks for, given the member's current
+    /// role (`None` for an invite).
+    ///
+    /// The clients no longer know the legacy Manager role and are shown a Custom role in its place, so a
+    /// requested Custom role is the legacy Manager unless EXPERIMENTAL_CUSTOM_ROLES is enabled, in which case
+    /// `custom_permissions` are the permissions requested along with it. An existing Manager or Custom member
+    /// keeps their role when the request repeats it, so an unrelated edit never turns one into the other. A
+    /// Manager only becomes a Custom member when the permissions they are shown with are changed.
+    pub fn requested(
+        requested: MembershipType,
+        current: Option<&Membership>,
+        custom_permissions: Option<&HashSet<CustomPermission>>,
+    ) -> MembershipType {
+        if requested != MembershipType::Custom {
+            return requested;
+        }
+        match (current, custom_permissions) {
+            (Some(member), _) if member.has_type(MembershipType::Custom) => MembershipType::Custom,
+            (Some(member), Some(permissions))
+                if member.has_type(MembershipType::Manager) && *permissions != member.legacy_manager_permissions() =>
+            {
+                MembershipType::Custom
+            }
+            (Some(member), _) if member.has_type(MembershipType::Manager) => MembershipType::Manager,
+            (_, Some(_)) => MembershipType::Custom,
+            (_, None) => MembershipType::Manager,
+        }
+    }
+
+    /// The authority of a role, which is what roles are compared by. A Custom member gets its authority from
+    /// its permissions, never from its role, so the role itself ranks right above User and below Manager.
+    const fn rank(self) -> u8 {
+        match self {
+            MembershipType::User => 0,
+            MembershipType::Custom => 1,
+            MembershipType::Manager => 2,
+            MembershipType::Admin => 3,
+            MembershipType::Owner => 4,
+        }
+    }
 }

 impl Ord for MembershipType {
    fn cmp(&self, other: &MembershipType) -> Ordering {
-        // For easy comparison, map each variant to an access level (where 0 is lowest).
-        const ACCESS_LEVEL: [i32; 4] = [
-            3, // Owner
-            2, // Admin
-            0, // User
-            1, // Manager && Custom
-        ];
-        ACCESS_LEVEL[*self as usize].cmp(&ACCESS_LEVEL[*other as usize])
+        self.rank().cmp(&other.rank())
    }
 }

@@ -180,6 +230,124 @@ impl PartialOrd<MembershipType> for i32 {
    }
 }

+/// The granular permissions of the Custom role.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum CustomPermission {
+    ManageUsers,
+    ManageGroups,
+    ManagePolicies,
+    CreateNewCollections,
+    EditAnyCollection,
+    DeleteAnyCollection,
+    AccessEventLogs,
+    AccessImportExport,
+    AccessReports,
+}
+
+/// The permissions this version enforces on every endpoint they open. Only these can be granted, a stored
+/// grant of any other one grants nothing. They are implemented one at a time, so this grows with them.
+const SUPPORTED_CUSTOM_PERMISSIONS: &[CustomPermission] = &[
+    CustomPermission::CreateNewCollections,
+    CustomPermission::EditAnyCollection,
+    CustomPermission::DeleteAnyCollection,
+];
+
+impl CustomPermission {
+    pub const ALL: [CustomPermission; 9] = [
+        CustomPermission::ManageUsers,
+        CustomPermission::ManageGroups,
+        CustomPermission::ManagePolicies,
+        CustomPermission::CreateNewCollections,
+        CustomPermission::EditAnyCollection,
+        CustomPermission::DeleteAnyCollection,
+        CustomPermission::AccessEventLogs,
+        CustomPermission::AccessImportExport,
+        CustomPermission::AccessReports,
+    ];
+
+    /// The key of the permission in the `permissions` object of the Bitwarden clients.
+    pub const fn json_key(self) -> &'static str {
+        match self {
+            CustomPermission::ManageUsers => "manageUsers",
+            CustomPermission::ManageGroups => "manageGroups",
+            CustomPermission::ManagePolicies => "managePolicies",
+            CustomPermission::CreateNewCollections => "createNewCollections",
+            CustomPermission::EditAnyCollection => "editAnyCollection",
+            CustomPermission::DeleteAnyCollection => "deleteAnyCollection",
+            CustomPermission::AccessEventLogs => "accessEventLogs",
+            CustomPermission::AccessImportExport => "accessImportExport",
+            CustomPermission::AccessReports => "accessReports",
+        }
+    }
+
+    pub fn is_supported(self) -> bool {
+        SUPPORTED_CUSTOM_PERMISSIONS.contains(&self)
+    }
+
+    /// The permissions a member invite or edit grants a Custom role.
+    ///
+    /// A permission is only granted when it is set to `true`, and anything but a boolean is rejected: this
+    /// replaces the member's permissions, so a malformed value must not silently remove one. Granting a
+    /// permission this version does not enforce is rejected as well. The clients also send permissions
+    /// Vaultwarden does not know at all, like `manageSso`, those are ignored.
+    pub fn requested(permissions: &HashMap<String, Value>) -> Result<HashSet<CustomPermission>, crate::Error> {
+        let mut granted = HashSet::new();
+        for permission in CustomPermission::ALL {
+            match permissions.get(permission.json_key()) {
+                None | Some(Value::Bool(false)) => {}
+                Some(Value::Bool(true)) if permission.is_supported() => {
+                    granted.insert(permission);
+                }
+                Some(Value::Bool(true)) => {
+                    err!(format!("The Custom role permission '{}' is not supported yet", permission.json_key()))
+                }
+                Some(_) => {
+                    err!(format!("The Custom role permission '{}' must be true or false", permission.json_key()))
+                }
+            }
+        }
+        Ok(granted)
+    }
+}
+
+/// The stored roles with authority over the whole organization. Queries match them by value, comparing
+/// `atype <= Admin` would also match any unknown value below it.
+pub(super) const ORG_ADMIN_ATYPES: [i32; 2] = [MembershipType::Owner as i32, MembershipType::Admin as i32];
+
+/// Whether the experimental Custom role is enabled. Nothing is ever granted through a Custom role otherwise.
+pub fn custom_roles_enabled() -> bool {
+    #[cfg(test)]
+    if let Some(enabled) = test_flag::CUSTOM_ROLES_ENABLED.get() {
+        return enabled;
+    }
+    CONFIG.experimental_custom_roles()
+}
+
+type CustomEditAnyCollection = diesel::dsl::And<
+    diesel::dsl::And<
+        diesel::dsl::Eq<users_organizations::atype, i32>,
+        diesel::dsl::Eq<users_organizations::edit_any_collection, bool>,
+    >,
+    bool,
+    diesel::sql_types::Bool,
+>;
+
+/// SQL: a Custom member with Edit any collection, while Custom roles are enabled.
+pub(super) fn custom_edit_any_collection() -> CustomEditAnyCollection {
+    users_organizations::atype
+        .eq(MembershipType::Custom as i32)
+        .and(users_organizations::edit_any_collection.eq(true))
+        .and::<_, diesel::sql_types::Bool>(custom_roles_enabled())
+}
+
+#[cfg(test)]
+pub(crate) mod test_flag {
+    thread_local! {
+        /// Overrides EXPERIMENTAL_CUSTOM_ROLES for the tests running on this thread.
+        pub static CUSTOM_ROLES_ENABLED: std::cell::Cell<Option<bool>> = const { std::cell::Cell::new(None) };
+    }
+}
+
 /// Local methods
 impl Organization {
    pub fn new(name: String, billing_email: &str, private_key: Option<String>, public_key: Option<String>) -> Self {
@@ -271,9 +439,154 @@ impl Membership {
            atype: MembershipType::User as i32,
            reset_password_key: None,
            external_id: None,
+
+            manage_users: false,
+            manage_groups: false,
+            manage_policies: false,
+            create_new_collections: false,
+            edit_any_collection: false,
+            delete_any_collection: false,
+            access_event_logs: false,
+            access_import_export: false,
+            access_reports: false,
+
+            v2_upgrade_token: None,
        }
    }

+    fn custom_permission_mut(&mut self, permission: CustomPermission) -> &mut bool {
+        match permission {
+            CustomPermission::ManageUsers => &mut self.manage_users,
+            CustomPermission::ManageGroups => &mut self.manage_groups,
+            CustomPermission::ManagePolicies => &mut self.manage_policies,
+            CustomPermission::CreateNewCollections => &mut self.create_new_collections,
+            CustomPermission::EditAnyCollection => &mut self.edit_any_collection,
+            CustomPermission::DeleteAnyCollection => &mut self.delete_any_collection,
+            CustomPermission::AccessEventLogs => &mut self.access_event_logs,
+            CustomPermission::AccessImportExport => &mut self.access_import_export,
+            CustomPermission::AccessReports => &mut self.access_reports,
+        }
+    }
+
+    /// Change the role. Nothing the old role carried survives a role change: the Custom role permissions are
+    /// dropped, so changing the role back later starts from none. A Custom role never keeps the legacy
+    /// `access_all` flag, its reach only comes from its permissions.
+    pub fn set_type(&mut self, new_type: MembershipType) {
+        if self.atype != new_type as i32 {
+            for permission in CustomPermission::ALL {
+                *self.custom_permission_mut(permission) = false;
+            }
+        }
+        if new_type == MembershipType::Custom {
+            self.access_all = false;
+        }
+        self.atype = new_type as i32;
+    }
+
+    /// Grant this Custom member exactly `permissions` out of those this version enforces. A stored grant of a
+    /// permission this version does not enforce is kept as it is: it grants nothing here.
+    pub fn set_custom_permissions(&mut self, permissions: &HashSet<CustomPermission>) {
+        for permission in CustomPermission::ALL.into_iter().filter(|p| p.is_supported()) {
+            *self.custom_permission_mut(permission) = permissions.contains(&permission);
+        }
+    }
+
+    /// Why this legacy Manager can't become a Custom member with `permissions` without losing what they may do now, if
+    /// they can't. A conversion must not silently change their access. A Custom role can't keep access to all
+    /// collections, which also puts every collection in the Manager's own vault, unless the permissions it is shown as
+    /// are given up too. And it only manages every collection with Edit any collection, not through a group with access
+    /// to all collections, which stays dynamic. The collections they manage with the manage permission stay managed.
+    pub async fn custom_role_conversion_loss(
+        &self,
+        permissions: &HashSet<CustomPermission>,
+        conn: &DbConn,
+    ) -> Option<&'static str> {
+        if !self.has_type(MembershipType::Manager) {
+            return None;
+        }
+        if self.access_all && permissions.is_superset(&self.legacy_manager_permissions()) {
+            return Some(
+                "This Manager has access to all collections, which a Custom member can't have: the collections they \
+                 aren't assigned to would disappear from their vault. Uncheck Manage all collections for them to give \
+                 that access up, or keep the Manager role.",
+            );
+        }
+        if !permissions.contains(&CustomPermission::EditAnyCollection)
+            && GroupUser::has_full_access_by_member(&self.org_uuid, &self.uuid, conn).await
+        {
+            return Some(
+                "This Manager manages every collection through a group with access to all collections, which a Custom \
+                 member only does with Edit any collection. Grant that permission, or remove them from the group \
+                 first.",
+            );
+        }
+        None
+    }
+
+    fn custom_permission(&self, permission: CustomPermission) -> bool {
+        match permission {
+            CustomPermission::ManageUsers => self.manage_users,
+            CustomPermission::ManageGroups => self.manage_groups,
+            CustomPermission::ManagePolicies => self.manage_policies,
+            CustomPermission::CreateNewCollections => self.create_new_collections,
+            CustomPermission::EditAnyCollection => self.edit_any_collection,
+            CustomPermission::DeleteAnyCollection => self.delete_any_collection,
+            CustomPermission::AccessEventLogs => self.access_event_logs,
+            CustomPermission::AccessImportExport => self.access_import_export,
+            CustomPermission::AccessReports => self.access_reports,
+        }
+    }
+
+    /// Whether the role of this member grants `permission`. Only a Custom role grants any, only while Custom roles
+    /// are enabled, and only the permissions this version enforces.
+    fn grants_custom_permission(&self, permission: CustomPermission) -> bool {
+        custom_roles_enabled()
+            && permission.is_supported()
+            && self.has_type(MembershipType::Custom)
+            && self.custom_permission(permission)
+    }
+
+    /// Whether this member may act with `permission`, granted by their Custom role. Like the authority of any
+    /// other role, it needs a confirmed membership.
+    pub fn has_custom_permission(&self, permission: CustomPermission) -> bool {
+        self.has_status(MembershipStatus::Confirmed) && self.grants_custom_permission(permission)
+    }
+
+    /// The permissions the "Manage all collections" a legacy Manager is shown with stands for: their `access_all`.
+    pub fn legacy_manager_permissions(&self) -> HashSet<CustomPermission> {
+        if self.has_type(MembershipType::Manager) && self.access_all {
+            HashSet::from([
+                CustomPermission::CreateNewCollections,
+                CustomPermission::EditAnyCollection,
+                CustomPermission::DeleteAnyCollection,
+            ])
+        } else {
+            HashSet::new()
+        }
+    }
+
+    /// The permissions the clients are shown, which a legacy Manager is shown as a Custom member with.
+    pub fn shown_custom_permissions(&self) -> HashSet<CustomPermission> {
+        if self.has_type(MembershipType::Manager) {
+            self.legacy_manager_permissions()
+        } else {
+            CustomPermission::ALL.into_iter().filter(|p| self.grants_custom_permission(*p)).collect()
+        }
+    }
+
+    fn custom_permissions_json(&self) -> Value {
+        let shown = self.shown_custom_permissions();
+        let mut permissions = json!({
+            "manageSso": false, // Not supported
+            "manageResetPassword": false,
+            "manageScim": false, // Not supported (Not AGPLv3 Licensed)
+        });
+        for permission in CustomPermission::ALL {
+            permissions[permission.json_key()] = json!(shown.contains(&permission));
+        }
+        permissions
+    }
+
    pub fn restore(&mut self) -> bool {
        if self.status < MembershipStatus::Invited as i32 {
            self.status += ACTIVATE_REVOKE_DIFF;
@@ -442,24 +755,8 @@ impl Membership {
        // It will be converted back on other locations
        let membership_type = self.type_manager_as_custom();

-        let permissions = json!({
-                // TODO: Add full support for Custom User Roles
-                // See: https://bitwarden.com/help/article/user-types-access-control/#custom-role
-                // Currently we use the custom role as a manager role and link the 3 Collection roles to mimic the access_all permission
-                "accessEventLogs": false,
-                "accessImportExport": false,
-                "accessReports": false,
-                // If the following 3 Collection roles are set to true a custom user has access all permission
-                "createNewCollections": membership_type == 4 && self.access_all,
-                "editAnyCollection": membership_type == 4 && self.access_all,
-                "deleteAnyCollection": membership_type == 4 && self.access_all,
-                "manageGroups": false,
-                "managePolicies": false,
-                "manageSso": false, // Not supported
-                "manageUsers": false,
-                "manageResetPassword": false,
-                "manageScim": false // Not supported (Not AGPLv3 Licensed)
-        });
+        // A Manager is shown with the 3 Collection permissions set, when they have the access_all permission
+        let permissions = self.custom_permissions_json();

        // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs
        json!({
@@ -523,7 +820,8 @@ impl Membership {

            // These are per user
            "userId": self.user_uuid,
-            "key": self.akey,
+            // Accepted (not yet confirmed) members have no key yet; send null like upstream, not ""
+            "key": (!self.akey.is_empty()).then_some(&self.akey),
            "status": self.status,
            "type": membership_type,
            "enabled": true,
@@ -588,29 +886,11 @@ impl Membership {
        // It will be converted back on other locations
        let membership_type = self.type_manager_as_custom();

-        // HACK: Only return permissions if the user is of type custom and has access_all
-        // Else Bitwarden will assume the defaults of all false
-        let permissions = if membership_type == 4 && self.access_all {
-            json!({
-                // TODO: Add full support for Custom User Roles
-                // See: https://bitwarden.com/help/article/user-types-access-control/#custom-role
-                // Currently we use the custom role as a manager role and link the 3 Collection roles to mimic the access_all permission
-                "accessEventLogs": false,
-                "accessImportExport": false,
-                "accessReports": false,
-                // If the following 3 Collection roles are set to true a custom user has access all permission
-                "createNewCollections": true,
-                "editAnyCollection": true,
-                "deleteAnyCollection": true,
-                "manageGroups": false,
-                "managePolicies": false,
-                "manageSso": false, // Not supported
-                "manageUsers": false,
-                "manageResetPassword": false,
-                "manageScim": false // Not supported (Not AGPLv3 Licensed)
-            })
-        } else {
+        // Only return permissions if there are any, else Bitwarden will assume the defaults of all false
+        let permissions = if self.shown_custom_permissions().is_empty() {
            json!(null)
+        } else {
+            self.custom_permissions_json()
        };

        json!({
@@ -711,6 +991,12 @@ impl Membership {
    }

    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
+        // The legacy `access_all` flag reaches every collection, which a Custom role may only do through its
+        // permissions, so it must never be stored on one. `set_type` takes care of this.
+        if self.has_type(MembershipType::Custom) && self.access_all {
+            err!("A Custom role membership can't have access to all collections")
+        }
+
        User::update_uuid_revision(&self.user_uuid, conn).await;

        db_run! { conn:
@@ -785,6 +1071,19 @@ impl Membership {
        (self.access_all || self.atype >= MembershipType::Admin) && self.has_status(MembershipStatus::Confirmed)
    }

+    /// Whether this member may edit every collection and the items in them in the Admin Console: every member with
+    /// full access, and a Custom member with Edit any collection. Unlike full access, the permission does not add
+    /// anything to the member's own vault.
+    pub fn can_edit_any_collection(&self) -> bool {
+        self.has_full_access() || self.has_custom_permission(CustomPermission::EditAnyCollection)
+    }
+
+    /// Whether this member may see every collection and who has access to them in the Admin Console. Deleting any
+    /// collection needs that, but not the items in them.
+    pub fn can_view_all_collections(&self) -> bool {
+        self.can_edit_any_collection() || self.has_custom_permission(CustomPermission::DeleteAnyCollection)
+    }
+
    pub async fn find_by_uuid(uuid: &MembershipId, conn: &DbConn) -> Option<Self> {
        conn.run(move |conn| {
            users_organizations::table.filter(users_organizations::uuid.eq(uuid)).first::<Self>(conn).ok()
@@ -907,6 +1206,8 @@ impl Membership {
    }

    // Get all users which are either owner or admin, or a manager which can manage/access all
+    // A Custom member with Edit any collection is not listed: the Admin Console sends this list back when a collection
+    // is saved, which would assign them to it for good, while the others are skipped there for their access_all.
    pub async fn find_confirmed_and_manage_all_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            users_organizations::table
@@ -1227,13 +1528,163 @@ pub struct OrgApiKeyId(String);
 #[cfg(test)]
 mod tests {
    use super::*;
+    use CustomPermission::*;
+    use MembershipType::{Admin, Custom, Manager, Owner, User};
+
+    fn member(role: MembershipType) -> Membership {
+        let mut member = Membership::new("user".into(), "org".into(), None);
+        member.atype = role as i32;
+        member.status = MembershipStatus::Confirmed as i32;
+        member
+    }

    #[test]
-    #[allow(non_snake_case)]
-    fn partial_cmp_MembershipType() {
-        assert!(MembershipType::Owner > MembershipType::Admin);
-        assert!(MembershipType::Admin > MembershipType::Manager);
-        assert!(MembershipType::Manager > MembershipType::User);
-        assert!(MembershipType::Manager == MembershipType::from_str("4").unwrap());
+    fn membership_type_authority() {
+        assert!(Owner > Admin && Admin > Manager && Manager > Custom && Custom > User);
+        assert!((Custom as i32) >= User && (Custom as i32) < Manager && (Custom as i32) < Admin);
+        for raw in [99, -1] {
+            assert_eq!((raw >= User, raw >= Manager, raw >= Admin, raw < Admin), (false, false, false, true));
+        }
+        for (value, expected) in [
+            ("3", Some(Manager)),
+            ("Manager", Some(Manager)),
+            ("4", Some(Custom)),
+            ("Custom", Some(Custom)),
+            ("5", None),
+        ] {
+            assert_eq!(MembershipType::from_str(value), expected);
+        }
+    }
+
+    #[test]
+    fn requested_membership_type() {
+        let none = HashSet::new();
+        let edit = HashSet::from([EditAnyCollection]);
+        let legacy = HashSet::from([CreateNewCollections, EditAnyCollection, DeleteAnyCollection]);
+        for (current, all, permissions, disabled, enabled) in [
+            (None, false, &none, Manager, Custom),
+            (Some(User), false, &edit, Manager, Custom),
+            (Some(Owner), false, &none, Manager, Custom),
+            (Some(Manager), false, &none, Manager, Manager),
+            (Some(Manager), true, &legacy, Manager, Manager),
+            (Some(Manager), false, &edit, Manager, Custom),
+            (Some(Manager), true, &none, Manager, Custom),
+            (Some(Manager), true, &edit, Manager, Custom),
+            (Some(Custom), false, &none, Custom, Custom),
+        ] {
+            let current = current.map(|role| {
+                let mut m = member(role);
+                m.access_all = all;
+                m
+            });
+            for (permissions, expected) in [(None, disabled), (Some(permissions), enabled)] {
+                assert_eq!(MembershipType::requested(Custom, current.as_ref(), permissions), expected);
+            }
+        }
+        assert_eq!(MembershipType::requested(User, Some(&member(Custom)), None), User);
+        assert_eq!(MembershipType::requested(User, Some(&member(Manager)), None), User);
+        for requested in [Owner, Admin, Manager] {
+            assert_eq!(MembershipType::requested(requested, Some(&member(Custom)), None), requested);
+        }
+    }
+
+    #[test]
+    fn custom_permission_requests() {
+        let ignored = serde_json::from_value(json!({"manageUsers":false,"manageSso":true})).unwrap();
+        assert!(CustomPermission::requested(&ignored).unwrap().is_empty());
+        for permission in CustomPermission::ALL {
+            for value in [json!(true), json!(null), json!("true"), json!(1), json!([true])] {
+                let request = HashMap::from([(permission.json_key().to_owned(), value.clone())]);
+                let result = CustomPermission::requested(&request);
+                if value == json!(true) && SUPPORTED_CUSTOM_PERMISSIONS.contains(&permission) {
+                    assert_eq!(result.unwrap(), HashSet::from([permission]));
+                } else {
+                    assert!(result.is_err(), "{permission:?}: {value}");
+                }
+            }
+        }
+        assert_eq!(SUPPORTED_CUSTOM_PERMISSIONS, [CreateNewCollections, EditAnyCollection, DeleteAnyCollection]);
+    }
+
+    #[test]
+    fn role_changes_drop_custom_permissions() {
+        for (from, to) in [
+            (Custom, Owner),
+            (Custom, Admin),
+            (Custom, Manager),
+            (Custom, User),
+            (User, Custom),
+            (Manager, Custom),
+            (Custom, Custom),
+            (Admin, User),
+        ] {
+            let mut member = member(from);
+            member.access_all = true;
+            for permission in CustomPermission::ALL {
+                *member.custom_permission_mut(permission) = true;
+            }
+            member.set_type(to);
+            for permission in CustomPermission::ALL {
+                assert_eq!(*member.custom_permission_mut(permission), from == to, "{from:?} -> {to:?}");
+            }
+            assert_eq!(member.access_all, to != Custom);
+        }
+    }
+    #[test]
+    fn permission_matrix_preserves_role_status_flag_and_collection_boundaries() {
+        let legacy = HashSet::from([CreateNewCollections, EditAnyCollection, DeleteAnyCollection]);
+        for (role, all) in
+            [(Owner, false), (Admin, false), (Manager, false), (Manager, true), (Custom, false), (User, false)]
+        {
+            for permission in CustomPermission::ALL {
+                let mut member = member(role);
+                member.access_all = all;
+                *member.custom_permission_mut(permission) = true;
+                for enabled in [false, true] {
+                    test_flag::CUSTOM_ROLES_ENABLED.set(Some(enabled));
+                    let shown = if role == Manager && all {
+                        legacy.clone()
+                    } else if role == Custom && enabled && permission.is_supported() {
+                        HashSet::from([permission])
+                    } else {
+                        HashSet::new()
+                    };
+                    assert_eq!(member.shown_custom_permissions(), shown);
+                    for status in [-128, -127, -126, -3, -2, -1, 0, 1, 2] {
+                        member.status = status;
+                        let allowed = enabled && role == Custom && status == 2 && permission.is_supported();
+                        let full = status == 2 && (role == Owner || role == Admin || all);
+                        let edit = full || (allowed && permission == EditAnyCollection);
+                        let view = full || (allowed && matches!(permission, EditAnyCollection | DeleteAnyCollection));
+                        assert_eq!(
+                            (
+                                member.has_custom_permission(permission),
+                                member.can_edit_any_collection(),
+                                member.can_view_all_collections()
+                            ),
+                            (allowed, edit, view),
+                            "{role:?} {all} {enabled} {status} {permission:?}"
+                        );
+                    }
+                }
+            }
+        }
+        for raw in [99, -1] {
+            let mut member = member(Custom);
+            member.atype = raw;
+            for p in CustomPermission::ALL {
+                *member.custom_permission_mut(p) = true;
+            }
+            for enabled in [false, true] {
+                test_flag::CUSTOM_ROLES_ENABLED.set(Some(enabled));
+                assert!(CustomPermission::ALL.into_iter().all(|p| !member.has_custom_permission(p)));
+                assert!(!member.can_edit_any_collection() && !member.can_view_all_collections());
+            }
+        }
+        let empty = member(Custom);
+        assert!(!empty.can_edit_any_collection() && !empty.can_view_all_collections());
+        assert!(empty.shown_custom_permissions().is_empty());
+
+        test_flag::CUSTOM_ROLES_ENABLED.set(None);
    }
 }
@@ -334,7 +334,6 @@ impl Send {
    pub async fn size_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<i64> {
        #[derive(serde::Deserialize)]
        struct FileData {
-            #[serde(rename = "size", alias = "Size")]
            size: NumberOrString,
        }

@@ -37,7 +37,7 @@ impl TwoFactorIncomplete {
        ip: &ClientIp,
        conn: &DbConn,
    ) -> EmptyResult {
-        if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
+        if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
            return Ok(());
        }

@@ -66,7 +66,7 @@ impl TwoFactorIncomplete {
    }

    pub async fn mark_complete(user_uuid: &UserId, device_uuid: &DeviceId, conn: &DbConn) -> EmptyResult {
-        if CONFIG.incomplete_2fa_time_limit() <= 0 || !CONFIG.mail_enabled() {
+        if CONFIG.incomplete_2fa_time_limit() == 0 || !CONFIG.mail_enabled() {
            return Ok(());
        }

@@ -6,6 +6,7 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::EmptyResult,
+    auth::DEFAULT_ACCESS_VALIDITY,
    crypto,
    db::{
        DbConn,
@@ -20,7 +21,7 @@ use macros::UuidFromParam;

 use super::{
    AuthRequest, Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor,
-    TwoFactorIncomplete,
+    TwoFactorIncomplete, UserSignatureKeyPair,
 };

 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
@@ -72,6 +73,13 @@ pub struct User {
    pub external_id: Option<String>, // Todo: Needs to be removed in the future, this is not used anymore.

    pub key_id: Option<KeyId>,
+
+    // The v2 state: all set, with a `user_signature_key_pairs` row, or none, see `User::is_v2`
+    pub signed_public_key: Option<String>,
+    pub security_state: Option<String>,
+    pub security_version: Option<i32>,
+    /// JSON `{"wrappedUserKey1", "wrappedUserKey2"}` for sessions that still hold the v1 user key. Opaque to us.
+    pub v2_upgrade_token: Option<String>,
 }

 #[derive(Identifiable, Queryable, Insertable)]
@@ -100,13 +108,28 @@ enum UserStatus {
    _Disabled = 2,
 }

+/// A previous security stamp that is still accepted, until `expire`.
 #[derive(Serialize, Deserialize)]
 pub struct UserStampException {
-    pub routes: Vec<String>,
+    /// The routes the stamp is still accepted on, or `None` for any route.
+    pub routes: Option<Vec<String>>,
    pub security_stamp: String,
    pub expire: i64,
 }

+impl UserStampException {
+    pub fn is_expired(&self) -> bool {
+        Utc::now().timestamp() > self.expire
+    }
+
+    /// Whether this exception lets a token carrying `security_stamp` through on `route`.
+    pub fn allows(&self, security_stamp: &str, route: &str) -> bool {
+        !self.is_expired()
+            && self.security_stamp == security_stamp
+            && self.routes.as_ref().is_none_or(|routes| routes.iter().any(|r| r == route))
+    }
+}
+
 /// Local methods
 impl User {
    pub const CLIENT_KDF_TYPE_DEFAULT: i32 = UserKdfType::Pbkdf2 as i32;
@@ -159,9 +182,31 @@ impl User {
            external_id: None, // Todo: Needs to be removed in the future, this is not used anymore.

            key_id: None,
+
+            signed_public_key: None,
+            security_state: None,
+            security_version: None,
+            v2_upgrade_token: None,
        }
    }

+    pub fn is_v2(&self) -> bool {
+        self.signed_public_key.is_some() && self.security_state.is_some() && self.security_version.is_some()
+    }
+
+    /// Upstream's `HasV2Encryption`: a private key wrapped as `CoseEncrypt0B64` (type 7) and security version 2.
+    /// Upstream only uses it to decide which accounts need a v2-capable client.
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/8da186ad73f80d37157fe6fd42323e4284e83ec1/src/Core/Entities/User.cs#L245-L278>
+    pub fn has_v2_encryption(&self) -> bool {
+        self.security_version == Some(2)
+            && self
+                .private_key
+                .as_deref()
+                .and_then(|private_key| private_key.split_once('.'))
+                .is_some_and(|(enc_type, _)| enc_type.parse::<u8>() == Ok(7))
+    }
+
    pub fn check_valid_password(&self, password: &str) -> bool {
        crypto::verify_password_hash(
            password.as_bytes(),
@@ -171,6 +216,7 @@ impl User {
        )
    }

+    /// Upstream's `GetMasterPasswordSalt`: there is no separate salt, so the normalized email
    pub fn master_password_salt(&self) -> String {
        self.email.trim().to_lowercase()
    }
@@ -225,10 +271,33 @@ impl User {

    pub async fn reset_security_stamp(&mut self, conn: &DbConn) -> EmptyResult {
        self.security_stamp = get_uuid();
+        // Keeps the unexpired route exceptions, set for the stamp being replaced, and drops a rotation's grace
+        let mut exceptions = self.stamp_exceptions();
+        exceptions.retain(|e| e.routes.is_some() && !e.is_expired());
+        self.set_stamp_exceptions(&exceptions);
        Device::rotate_refresh_tokens_by_user(&self.uuid, conn).await?;
        Ok(())
    }

+    /// Resets the stamp but lets issued access tokens run out, as upstream only checks it on refresh.
+    pub async fn reset_security_stamp_after_key_rotation(&mut self, conn: &DbConn) -> EmptyResult {
+        let previous_stamp = self.security_stamp.clone();
+        let mut grace: Vec<UserStampException> =
+            self.stamp_exceptions().into_iter().filter(|e| e.routes.is_none() && !e.is_expired()).collect();
+
+        self.reset_security_stamp(conn).await?;
+
+        grace.push(UserStampException {
+            routes: None,
+            security_stamp: previous_stamp,
+            expire: (Utc::now() + *DEFAULT_ACCESS_VALIDITY).timestamp(),
+        });
+        let mut exceptions = self.stamp_exceptions();
+        exceptions.extend(grace);
+        self.set_stamp_exceptions(&exceptions);
+        Ok(())
+    }
+
    /// Set the stamp_exception to only allow a subsequent request matching a specific route using the current security-stamp.
    ///
    /// # Arguments
@@ -237,17 +306,30 @@ impl User {
    ///   After these 2 minutes this stamp will expire.
    ///
    pub fn set_stamp_exception(&mut self, route_exception: Vec<String>) {
-        let stamp_exception = UserStampException {
-            routes: route_exception,
+        self.set_stamp_exceptions(&[UserStampException {
+            routes: Some(route_exception),
            security_stamp: self.security_stamp.clone(),
            expire: (Utc::now() + TimeDelta::try_minutes(2).unwrap()).timestamp(),
-        };
-        self.stamp_exception = Some(serde_json::to_string(&stamp_exception).unwrap_or_default());
+        }]);
    }

-    /// Resets the stamp_exception to prevent re-use of the previous security-stamp
-    pub fn reset_stamp_exception(&mut self) {
-        self.stamp_exception = None;
+    /// The previous security stamps that are still accepted, expired ones included.
+    pub fn stamp_exceptions(&self) -> Vec<UserStampException> {
+        let Some(stored) = self.stamp_exception.as_deref() else {
+            return Vec::new();
+        };
+        // Before key rotations kept sessions alive, only a single route exception was stored.
+        serde_json::from_str::<Vec<UserStampException>>(stored)
+            .or_else(|_| serde_json::from_str::<UserStampException>(stored).map(|e| vec![e]))
+            .unwrap_or_default()
+    }
+
+    fn set_stamp_exceptions(&mut self, exceptions: &[UserStampException]) {
+        self.stamp_exception = if exceptions.is_empty() {
+            None
+        } else {
+            Some(serde_json::to_string(&exceptions).unwrap_or_default())
+        };
    }

    pub fn display_name(&self) -> &str {
@@ -266,18 +348,37 @@ impl User {
        !CONFIG.mail_enabled() || self.verified_at.is_some()
    }

+    async fn v2_signature_key_pair(&self, conn: &DbConn) -> Option<UserSignatureKeyPair> {
+        if !self.is_v2() {
+            return None;
+        }
+        UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
+    }
+
    /// The `accountKeys` object (upstream's `PrivateKeysResponseModel`), null without a key pair
-    pub fn account_keys_json(&self) -> Value {
+    pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
        if self.private_key.is_some() {
+            let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
+                Some(key_pair) => (
+                    json!(self.signed_public_key),
+                    key_pair.to_json(),
+                    json!({
+                        "securityState": self.security_state,
+                        "securityVersion": self.security_version,
+                    }),
+                ),
+                None => (Value::Null, Value::Null, Value::Null),
+            };
+
            json!({
                "publicKeyEncryptionKeyPair": {
                    "wrappedPrivateKey": self.private_key,
                    "publicKey": self.public_key,
-                    "signedPublicKey": null,
+                    "signedPublicKey": signed_public_key,
                    "object": "publicKeyEncryptionKeyPair",
                },
-                "securityState": null,
-                "signatureKeyPair": null,
+                "securityState": security_state,
+                "signatureKeyPair": signature_key_pair,
                "object": "privateKeys"
            })
        } else {
@@ -285,6 +386,24 @@ impl User {
        }
    }

+    pub async fn public_keys_json(&self, conn: &DbConn) -> Value {
+        let (signed_public_key, verifying_key) = match self.v2_signature_key_pair(conn).await {
+            Some(key_pair) => (json!(self.signed_public_key), json!(key_pair.verifying_key)),
+            None => (Value::Null, Value::Null),
+        };
+
+        json!({
+            "publicKey": self.public_key,
+            "signedPublicKey": signed_public_key,
+            "verifyingKey": verifying_key,
+            "object": "publicKeys"
+        })
+    }
+
+    pub fn v2_upgrade_token_json(&self) -> Option<Value> {
+        self.v2_upgrade_token.as_ref().and_then(|token| serde_json::from_str(token).ok())
+    }
+
    pub async fn to_json(&self, conn: &DbConn) -> Value {
        let mut orgs_json = Vec::new();
        for c in Membership::find_confirmed_by_user(&self.uuid, conn).await {
@@ -305,7 +424,7 @@ impl User {
            UserStatus::Enabled
        };

-        let account_keys = self.account_keys_json();
+        let account_keys = self.account_keys_json(conn).await;

        json!({
            "_status": status as i32,
@@ -362,7 +481,7 @@ impl User {
        }
    }

-    pub async fn delete(self, conn: &DbConn) -> EmptyResult {
+    pub async fn delete(&self, conn: &DbConn) -> EmptyResult {
        for member in Membership::find_confirmed_by_user(&self.uuid, conn).await {
            if member.atype == MembershipType::Owner
                && Membership::count_confirmed_by_org_and_type(&member.org_uuid, MembershipType::Owner, conn).await <= 1
@@ -382,10 +501,11 @@ impl User {
        Device::delete_all_by_user(&self.uuid, conn).await?;
        TwoFactor::delete_all_by_user(&self.uuid, conn).await?;
        TwoFactorIncomplete::delete_all_by_user(&self.uuid, conn).await?;
+        UserSignatureKeyPair::delete_all_by_user(&self.uuid, conn).await?;
        Invitation::take(&self.email, conn).await; // Delete invitation if any

        conn.run(move |conn| {
-            diesel::delete(users::table.filter(users::uuid.eq(self.uuid))).execute(conn).map_res("Error deleting user")
+            diesel::delete(users::table.filter(users::uuid.eq(&self.uuid))).execute(conn).map_res("Error deleting user")
        })
        .await
    }
@@ -553,25 +673,26 @@ impl Invitation {
 pub struct UserId(String);

 #[derive(
-    Clone,
-    Debug,
-    DieselNewType,
-    FromForm,
-    PartialEq,
-    Eq,
-    Hash,
-    Serialize,
-    Deserialize,
-    AsRef,
-    Deref,
-    Display,
-    From,
-    UuidFromParam,
+    Clone, Debug, DieselNewType, FromForm, PartialEq, Eq, Hash, Serialize, AsRef, Deref, Display, From, UuidFromParam,
 )]
 #[deref(forward)]
 #[from(forward)]
 pub struct KeyId(String);

+/// Like upstream, a key id is 32 lowercase hex characters. Key ids are compared as strings, so one in any other
+/// format would never match the id the clients send.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/8da186ad73f80d37157fe6fd42323e4284e83ec1/src/Core/KeyManagement/Models/Data/KeyId.cs#L20-L42>
+impl<'de> serde::Deserialize<'de> for KeyId {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let key_id = String::deserialize(deserializer)?;
+        if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
+            return Err(serde::de::Error::custom("Key id must be 32 lowercase hex characters"));
+        }
+        Ok(Self(key_id))
+    }
+}
+
 impl SsoUser {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
@@ -625,3 +746,56 @@ impl SsoUser {
        .await
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_key_id_format() {
+        let key_id: KeyId = serde_json::from_str(r#""0123456789abcdef0123456789abcdef""#).unwrap();
+        assert_eq!(key_id.as_ref(), "0123456789abcdef0123456789abcdef");
+
+        for invalid in ["", "0123456789ABCDEF0123456789ABCDEF", "0123456789abcdef", "0123456789abcdef0123456789abcdeg"]
+        {
+            assert!(serde_json::from_str::<KeyId>(&format!("\"{invalid}\"")).is_err(), "{invalid:?}");
+        }
+
+        // An absent key id stays optional
+        assert_eq!(serde_json::from_str::<Option<KeyId>>("null").unwrap(), None);
+    }
+
+    #[test]
+    fn test_has_v2_encryption() {
+        // User::new loads CONFIG; isolate it from the DNS bootstrap test and filesystem configuration.
+        if std::env::var_os("VAULTWARDEN_ISOLATED_CONFIG_TEST").is_none() {
+            let output = std::process::Command::new(std::env::current_exe().unwrap())
+                .args(["--exact", std::thread::current().name().unwrap(), "--nocapture"])
+                .env("VAULTWARDEN_ISOLATED_CONFIG_TEST", "1")
+                .env("DATABASE_URL", "sqlite://:memory:")
+                .output()
+                .unwrap();
+            assert!(
+                output.status.success() && String::from_utf8_lossy(&output.stdout).contains("1 passed; 0 failed"),
+                "{}\n{}",
+                String::from_utf8_lossy(&output.stdout),
+                String::from_utf8_lossy(&output.stderr)
+            );
+            return;
+        }
+
+        let user = |private_key: Option<&str>, security_version: Option<i32>| {
+            let mut user = User::new("user@example.com", None);
+            user.private_key = private_key.map(String::from);
+            user.security_version = security_version;
+            user
+        };
+
+        assert!(user(Some("7.cose"), Some(2)).has_v2_encryption());
+        assert!(!user(Some("7.cose"), Some(1)).has_v2_encryption());
+        assert!(!user(Some("7.cose"), None).has_v2_encryption());
+        assert!(!user(Some("2.iv|data|mac"), Some(2)).has_v2_encryption());
+        assert!(!user(Some("7"), Some(2)).has_v2_encryption());
+        assert!(!user(None, Some(2)).has_v2_encryption());
+    }
+}
@@ -0,0 +1,132 @@
+use chrono::{NaiveDateTime, Utc};
+use derive_more::{AsRef, Deref, Display, From};
+use diesel::prelude::*;
+use serde_json::Value;
+
+use crate::{
+    api::EmptyResult,
+    db::{DbConn, schema::user_signature_key_pairs},
+    error::MapResult,
+    util::get_uuid,
+};
+
+use super::UserId;
+
+/// A user's signature key pair, part of the v2 state, in its own table like upstream.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql#L1-L15>
+#[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
+#[diesel(table_name = user_signature_key_pairs)]
+#[diesel(treat_none_as_null = true)]
+#[diesel(primary_key(uuid))]
+pub struct UserSignatureKeyPair {
+    pub uuid: UserSignatureKeyPairId,
+    pub user_uuid: UserId,
+
+    pub signature_algorithm: i32,
+    /// The signing (private) key, wrapped by the user key.
+    pub signing_key: String,
+    /// The COSE-encoded public verifying key.
+    pub verifying_key: String,
+
+    pub created_at: NaiveDateTime,
+    pub updated_at: NaiveDateTime,
+}
+
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs#L6-L10>
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SignatureAlgorithm {
+    Ed25519 = 0,
+    MlDsa44 = 1,
+}
+
+impl SignatureAlgorithm {
+    pub fn parse(algorithm: &str) -> Option<Self> {
+        match algorithm {
+            "ed25519" => Some(Self::Ed25519),
+            "mldsa44" => Some(Self::MlDsa44),
+            _ => None,
+        }
+    }
+}
+
+/// Local methods
+impl UserSignatureKeyPair {
+    pub fn new(
+        user_uuid: UserId,
+        signature_algorithm: SignatureAlgorithm,
+        signing_key: String,
+        verifying_key: String,
+    ) -> Self {
+        let now = Utc::now().naive_utc();
+
+        Self {
+            uuid: UserSignatureKeyPairId(get_uuid()),
+            user_uuid,
+            signature_algorithm: signature_algorithm as i32,
+            signing_key,
+            verifying_key,
+            created_at: now,
+            updated_at: now,
+        }
+    }
+
+    pub fn to_json(&self) -> Value {
+        json!({
+            "wrappedSigningKey": self.signing_key,
+            "verifyingKey": self.verifying_key,
+            "object": "signatureKeyPair",
+        })
+    }
+}
+
+/// Database methods
+impl UserSignatureKeyPair {
+    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
+        self.updated_at = Utc::now().naive_utc();
+
+        db_run! { conn:
+            mysql {
+                diesel::insert_into(user_signature_key_pairs::table)
+                    .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
+                    .execute(conn)
+                    .map_res("Error saving user signature key pair")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(user_signature_key_pairs::table)
+                    .values(&*self)
+                    .on_conflict(user_signature_key_pairs::user_uuid)
+                    .do_update()
+                    .set(&*self)
+                    .execute(conn)
+                    .map_res("Error saving user signature key pair")
+            }
+        }
+    }
+
+    /// The user's key pair. There is at most one, enforced by a unique index on `user_uuid`.
+    pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<Self> {
+        conn.run(move |conn| {
+            user_signature_key_pairs::table
+                .filter(user_signature_key_pairs::user_uuid.eq(user_uuid))
+                .first::<Self>(conn)
+                .ok()
+        })
+        .await
+    }
+
+    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
+        conn.run(move |conn| {
+            diesel::delete(user_signature_key_pairs::table.filter(user_signature_key_pairs::user_uuid.eq(user_uuid)))
+                .execute(conn)
+                .map_res("Error deleting user signature key pairs")
+        })
+        .await
+    }
+}
+
+#[derive(Clone, Debug, AsRef, Deref, DieselNewType, Display, From, Hash, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UserSignatureKeyPairId(String);
@@ -219,6 +219,22 @@ table! {
        avatar_color -> Nullable<Text>,
        external_id -> Nullable<Text>,
        key_id -> Nullable<Text>,
+        signed_public_key -> Nullable<Text>,
+        security_state -> Nullable<Text>,
+        security_version -> Nullable<Integer>,
+        v2_upgrade_token -> Nullable<Text>,
+    }
+}
+
+table! {
+    user_signature_key_pairs (uuid) {
+        uuid -> Text,
+        user_uuid -> Text,
+        signature_algorithm -> Integer,
+        signing_key -> Text,
+        verifying_key -> Text,
+        created_at -> Timestamp,
+        updated_at -> Timestamp,
    }
 }

@@ -244,6 +260,16 @@ table! {
        atype -> Integer,
        reset_password_key -> Nullable<Text>,
        external_id -> Nullable<Text>,
+        manage_users -> Bool,
+        manage_groups -> Bool,
+        manage_policies -> Bool,
+        create_new_collections -> Bool,
+        edit_any_collection -> Bool,
+        delete_any_collection -> Bool,
+        access_event_logs -> Bool,
+        access_import_export -> Bool,
+        access_reports -> Bool,
+        v2_upgrade_token -> Nullable<Text>,
    }
 }

@@ -384,6 +410,7 @@ joinable!(collections_groups -> groups (groups_uuid));
 joinable!(event -> users_organizations (uuid));
 joinable!(auth_requests -> users (user_uuid));
 joinable!(sso_users -> users (user_uuid));
+joinable!(user_signature_key_pairs -> users (user_uuid));

 allow_tables_to_appear_in_same_query!(
    archives,
@@ -410,4 +437,5 @@ allow_tables_to_appear_in_same_query!(
    collections_groups,
    event,
    auth_requests,
+    user_signature_key_pairs,
 );
@@ -425,12 +425,12 @@ macro_rules! err_json {
 macro_rules! err_handler {
    ($expr:expr) => {{
        error!(target: "auth", "Unauthorized Error: {}", $expr);
-        return ::rocket::request::Outcome::Error((rocket::http::Status::Unauthorized, $expr));
+        return ::rocket::request::Outcome::Error((::rocket::http::Status::Unauthorized, $expr));
    }};
    ($usr_msg:expr, $log_value:expr) => {{
        let usr_msg = $usr_msg;
        let log_value = $log_value;
        error!(target: "auth", "Unauthorized Error: {usr_msg}. {log_value}");
-        return ::rocket::request::Outcome::Error((rocket::http::Status::Unauthorized, usr_msg));
+        return ::rocket::request::Outcome::Error((::rocket::http::Status::Unauthorized, usr_msg));
    }};
 }
@@ -36,7 +36,7 @@ fn smtp_transport() -> AsyncSmtpTransport<Tokio1Executor> {

    let smtp_client = AsyncSmtpTransport::<Tokio1Executor>::builder_dangerous(host.as_str())
        .port(CONFIG.smtp_port())
-        .timeout(Some(Duration::from_secs(CONFIG.smtp_timeout())));
+        .timeout(Some(Duration::from_secs(u64::from(CONFIG.smtp_timeout()))));

    // Determine security
    let smtp_client = if CONFIG.smtp_security() == *"off" {
@@ -169,7 +169,7 @@ pub async fn send_password_hint(address: &str, hint: Option<String>) -> EmptyRes
 }

 pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_delete_claims(user_id.to_string());
+    let claims = generate_delete_claims(user_id.to_string())?;
    let delete_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -187,7 +187,7 @@ pub async fn send_delete_account(address: &str, user_id: &UserId) -> EmptyResult
 }

 pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_verify_email_claims(user_id);
+    let claims = generate_verify_email_claims(user_id)?;
    let verify_email_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -206,7 +206,7 @@ pub async fn send_verify_email(address: &str, user_id: &UserId) -> EmptyResult {

 pub async fn send_register_verify_email(email: &str, token: &str) -> EmptyResult {
    let mut query = url::Url::parse("https://query.builder").unwrap();
-    query.query_pairs_mut().append_pair("email", email).append_pair("token", token);
+    query.query_pairs_mut().append_pair("email", email).append_pair("token", token).append_pair("fromEmail", "true");
    let Some(query_string) = query.query() else {
        err!("Failed to build verify URL query parameters")
    };
@@ -237,7 +237,7 @@ pub async fn send_welcome(address: &str) -> EmptyResult {
 }

 pub async fn send_welcome_must_verify(address: &str, user_id: &UserId) -> EmptyResult {
-    let claims = generate_verify_email_claims(user_id);
+    let claims = generate_verify_email_claims(user_id)?;
    let verify_email_token = encode_jwt(&claims);

    let (subject, body_html, body_text) = get_text(
@@ -292,7 +292,7 @@ pub async fn send_invite(
        org_id.clone(),
        member_id.clone(),
        invited_by_email,
-    );
+    )?;
    let invite_token = encode_jwt(&claims);
    let mut query = url::Url::parse("https://query.builder").unwrap();
    {
@@ -351,7 +351,7 @@ pub async fn send_emergency_access_invite(
        emer_id.clone(),
        String::from(grantor_name),
        String::from(grantor_email),
-    );
+    )?;

    // Build the query here to ensure proper escaping
    let mut query = url::Url::parse("https://query.builder").unwrap();
@@ -738,8 +738,8 @@ async fn send_email(address: &str, subject: &str, body_html: String, body_text:
    let smtp_from = Address::from_str(&CONFIG.smtp_from())?;

    let body = if CONFIG.smtp_embed_images() {
-        let logo_gray_body = Body::new(crate::api::static_files("logo-gray.png").unwrap().1.to_vec());
-        let mail_github_body = Body::new(crate::api::static_files("mail-github.png").unwrap().1.to_vec());
+        let logo_gray_body = Body::new(crate::api::STATIC_FILES["logo-gray.png"].bytes.to_vec());
+        let mail_github_body = Body::new(crate::api::STATIC_FILES["mail-github.png"].bytes.to_vec());
        MultiPart::alternative().singlepart(SinglePart::plain(body_text)).multipart(
            MultiPart::related()
                .singlepart(SinglePart::html(body_html))
@@ -577,9 +577,19 @@ async fn launch_rocket(pool: db::DbPool, extra_debug: bool) -> Result<(), Error>
        .limit("data-form", 525.megabytes()) // This needs to match the maximum allowed file size for Send
        .limit("file", 525.megabytes()); // This needs to match the maximum allowed file size for attachments

+    let rocket = rocket::custom(config);
+    #[cfg(feature = "unsafe_test_mode")]
+    let rocket = {
+        warn!(
+            "This build has `unsafe_test_mode`: its test seeder at /test/seeder creates accounts without any checks. \
+            Never use it outside of tests!"
+        );
+        rocket.mount([basepath, "/test/seeder"].concat(), api::test_seeder_routes())
+    };
+
    // If adding more paths here, consider also adding them to
    // crate::utils::LOGGED_ROUTES to make sure they appear in the log
-    let instance = rocket::custom(config)
+    let instance = rocket
        .mount([basepath, "/"].concat(), api::web_routes())
        .mount([basepath, "/api"].concat(), api::core_routes())
        .mount([basepath, "/admin"].concat(), api::admin_routes())
@@ -595,7 +605,7 @@ async fn launch_rocket(pool: db::DbPool, extra_debug: bool) -> Result<(), Error>
        .manage(Arc::clone(&WS_ANONYMOUS_SUBSCRIPTIONS))
        .attach(util::AppHeaders())
        .attach(util::Cors())
-        .attach(util::BetterLogging(extra_debug))
+        .attach(util::BetterLogging::new(extra_debug, basepath))
        .ignite()
        .await?;

@@ -729,7 +739,7 @@ fn schedule_jobs(pool: db::DbPool) {
            // Cleanup the event table of records x days old.
            if CONFIG.org_events_enabled()
                && !CONFIG.event_cleanup_schedule().is_empty()
-                && CONFIG.events_days_retain().is_some()
+                && CONFIG.events_days_retain().is_some_and(|d| d != 0)
            {
                sched.add(Job::new(CONFIG.event_cleanup_schedule().parse().unwrap(), || {
                    runtime.spawn(api::event_cleanup_job(pool.clone()));
@@ -754,7 +764,9 @@ fn schedule_jobs(pool: db::DbPool) {
            // tick, the one that was added earlier will run first.
            loop {
                sched.tick();
-                runtime.block_on(tokio::time::sleep(tokio::time::Duration::from_millis(CONFIG.job_poll_interval_ms())));
+                runtime.block_on(tokio::time::sleep(tokio::time::Duration::from_millis(u64::from(
+                    CONFIG.job_poll_interval_ms(),
+                ))));
            }
        })
        .expect("Error spawning job scheduler thread");
@@ -7,20 +7,20 @@ use crate::{CONFIG, Error};
 type Limiter<T = IpAddr> = RateLimiter<T, DashMapStateStore<T>, DefaultClock>;

 static LIMITER_LOGIN: LazyLock<Limiter> = LazyLock::new(|| {
-    let seconds = Duration::from_secs(CONFIG.login_ratelimit_seconds());
-    let burst = NonZeroU32::new(CONFIG.login_ratelimit_max_burst()).expect("Non-zero login ratelimit burst");
+    let seconds = Duration::from_secs(u64::from(CONFIG.login_ratelimit_seconds()));
+    let burst = NonZeroU32::new(u32::from(CONFIG.login_ratelimit_max_burst())).expect("Non-zero login ratelimit burst");
    RateLimiter::keyed(Quota::with_period(seconds).expect("Non-zero login ratelimit seconds").allow_burst(burst))
 });

 static LIMITER_ADMIN: LazyLock<Limiter> = LazyLock::new(|| {
-    let seconds = Duration::from_secs(CONFIG.admin_ratelimit_seconds());
-    let burst = NonZeroU32::new(CONFIG.admin_ratelimit_max_burst()).expect("Non-zero admin ratelimit burst");
+    let seconds = Duration::from_secs(u64::from(CONFIG.admin_ratelimit_seconds()));
+    let burst = NonZeroU32::new(u32::from(CONFIG.admin_ratelimit_max_burst())).expect("Non-zero admin ratelimit burst");
    RateLimiter::keyed(Quota::with_period(seconds).expect("Non-zero admin ratelimit seconds").allow_burst(burst))
 });

 static LIMITER_UNAUTHENTICATED: LazyLock<Limiter> = LazyLock::new(|| {
-    let seconds = Duration::from_secs(CONFIG.unauthenticated_ratelimit_seconds());
-    let burst = NonZeroU32::new(CONFIG.unauthenticated_ratelimit_max_burst())
+    let seconds = Duration::from_secs(u64::from(CONFIG.unauthenticated_ratelimit_seconds()));
+    let burst = NonZeroU32::new(u32::from(CONFIG.unauthenticated_ratelimit_max_burst()))
        .expect("Non-zero unauthenticated ratelimit burst");
    RateLimiter::keyed(
        Quota::with_period(seconds).expect("Non-zero unauthenticated ratelimit seconds").allow_burst(burst),
@@ -266,8 +266,8 @@ pub async fn exchange_code(
        (_, Some(re)) => {
            let error_msg = format!(
                "SSO authorization failed: {}, {}",
-                re.error,
-                re.error_description.as_ref().unwrap_or(&String::new())
+                re.error.escape_debug(),
+                re.error_description.as_deref().unwrap_or_default().escape_debug()
            );
            sso_auth.delete(conn).await?;
            err!(error_msg);
@@ -309,7 +309,11 @@ pub async fn exchange_code(
        user_name: user_name.clone(),
    };

-    debug!("Authenticated user {authenticated_user:?}");
+    if CONFIG.sso_debug_tokens() {
+        debug!("Authenticated user {authenticated_user:?}");
+    } else {
+        debug!("Authenticated user {identifier}");
+    }
    sso_auth.auth_response = Some(authenticated_user.clone());
    sso_auth.updated_at = Utc::now().naive_utc();
    sso_auth.save(conn).await?;
@@ -29,7 +29,7 @@ static CLIENT_CACHE_KEY: LazyLock<String> = LazyLock::new(|| "sso-client".to_own
 static CLIENT_CACHE: LazyLock<moka::sync::Cache<String, Client>> = LazyLock::new(|| {
    moka::sync::Cache::builder()
        .max_capacity(1)
-        .time_to_live(Duration::from_secs(CONFIG.sso_client_cache_expiration()))
+        .time_to_live(Duration::from_secs(u64::from(CONFIG.sso_client_cache_expiration())))
        .build()
 });
 static REFRESH_CACHE: LazyLock<moka::future::Cache<String, Result<RefreshTokenResponse, String>>> =
@@ -260,7 +260,7 @@ impl Client {
                };

                if CONFIG.sso_debug_tokens() {
-                    debug!("Id token: {}", id_token.to_string());
+                    debug!("Id token: {id_token}");
                    debug!("Access token: {}", token_response.access_token().secret());
                    debug!("Refresh token: {:?}", token_response.refresh_token().map(RefreshToken::secret));
                    debug!("Expiration time: {:?}", token_response.expires_in());
@@ -93,7 +93,9 @@ async function generateSupportString(event, dj) {
    supportString += `* Running within a container: ${yn(dj.running_within_container)} (Base: ${dj.container_base_image})\n`;
    supportString += `* Database type: ${dj.db_type}\n`;
    supportString += `* Database version: ${dj.db_version}\n`;
-    supportString += `* Uses config.json: ${yn(dj.overrides !== "")}\n`;
+    supportString += `* Uses config.json: ${yn(dj.config_file_status !== "NotFound")}`;
+    supportString += dj.config_file_status !== "NotFound" ? ` (Valid: ${chk(dj.config_file_status === "Loaded")})\n` : "\n";
+    supportString += `* Environment variables are valid: ${chk(dj.invalid_env_vars == "")}\n`;
    supportString += `* Uses custom templates: ${yn(dj.template_overrides !== "")}${template_overrides}\n`;
    supportString += `* Uses a reverse proxy: ${yn(dj.ip_header_exists)}\n`;
    if (dj.ip_header_exists) {
@@ -116,7 +118,7 @@ async function generateSupportString(event, dj) {
    }
    supportString += `* HTTP Response Checks: ${chk(httpResponseCheck)}\n`;
    if (dj.invalid_feature_flags != "") {
-        supportString += "* Invalid feature flags: true\n";
+        supportString += "* Invalid feature flags: true :x:\n";
    }

    const jsonResponse = await fetch(`${BASE_URL}/admin/diagnostics/config`, {
@@ -132,6 +134,11 @@ async function generateSupportString(event, dj) {
    supportString += "\n### Config & Details (Generated via diagnostics page)\n\n";
    supportString += "<details><summary>Show Config & Details</summary>\n";

+    // Show invalid environment variables if they exists
+    if (dj.invalid_env_vars != "") {
+        supportString += `\n**Invalid environment variables:** ${dj.invalid_env_vars}\n`;
+    }
+
    // Add overrides if they exists
    if (dj.overrides != "") {
        supportString += `\n**Environment settings which are overridden:** ${dj.overrides}\n`;
@@ -173,10 +173,14 @@ const ORG_TYPES = {
        "name": "User",
        "bg": "blue"
    },
-    "4": {
+    "3": {
        "name": "Manager",
        "bg": "green"
    },
+    "4": {
+        "name": "Custom",
+        "bg": "teal"
+    },
 };

 const userOrgTypeDialog = document.getElementById("userOrgTypeDialog");
@@ -187,15 +191,19 @@ userOrgTypeDialog.addEventListener("show.bs.modal", function (event) {
    const userUuid = event.relatedTarget.parentNode.dataset.vwUserUuid;
    // Get org specific values
    const userOrgType = event.relatedTarget.dataset.vwOrgType;
-    const userOrgTypeName = ORG_TYPES[userOrgType]["name"];
    const orgName = event.relatedTarget.dataset.vwOrgName;
    const orgUuid = event.relatedTarget.dataset.vwOrgUuid;

+    document.getElementById("userOrgTypeForm").reset();
    document.getElementById("userOrgTypeDialogOrgName").textContent = orgName;
    document.getElementById("userOrgTypeDialogUserEmail").textContent = userEmail;
    document.getElementById("userOrgTypeUserUuid").value = userUuid;
    document.getElementById("userOrgTypeOrgUuid").value = orgUuid;
-    document.getElementById(`userOrgType${userOrgTypeName}`).checked = true;
+    // The Custom role can only be selected while it is enabled
+    const userOrgTypeRadio = document.getElementById(`userOrgType${ORG_TYPES[userOrgType]?.name}`);
+    if (userOrgTypeRadio) {
+        userOrgTypeRadio.checked = true;
+    }
 }, false);

 // Prevent accidental submission of the form with valid elements after the modal has been hidden.
@@ -222,7 +230,7 @@ function updateUserOrgType(event) {
 function initUserTable() {
    // Color all the org buttons per type
    document.querySelectorAll("button[data-vw-org-type]").forEach(function (e) {
-        const orgType = ORG_TYPES[e.dataset.vwOrgType];
+        const orgType = ORG_TYPES[e.dataset.vwOrgType] ?? { "name": "Unknown", "bg": "gray" };
        e.style.backgroundColor = orgType.bg;
        if (orgType.font !== undefined) {
            e.style.color = orgType.font;
@@ -69,12 +69,26 @@
                    </dd>
                    <dt class="col-sm-5">Uses config.json</dt>
                    <dd class="col-sm-7">
-                    {{#if page_data.overrides}}
+                    {{#if (eq page_data.config_file_status "Loaded")}}
                        <span class="d-inline"><b>Yes</b></span>
+                        {{#if page_data.overrides}}
                        <span class="badge bg-info text-dark abbr-badge" title="Environment variables are overwritten by a config.json.&#013;&#010;{{page_data.overrides}}">Details</span>
+                        {{/if}}
+                    {{~else if (eq page_data.config_file_status "Error")}}
+                        <span class="d-inline"><b>Errors</b></span>
+                        <span class="badge bg-danger abbr-badge" title="Config file could not be loaded and was ignored. Check server logs for details.">Details</span>
+                    {{~else}}
+                        <span class="d-inline"><b>No</b></span>
                    {{/if}}
-                    {{#unless page_data.overrides}}
-                        <span class="d-block"><b>No</b></span>
+                    </dd>
+                    <dt class="col-sm-5">Environment variables are valid</dt>
+                    <dd class="col-sm-7">
+                    {{#if page_data.invalid_env_vars}}
+                        <span class="d-inline"><b>No</b></span>
+                        <span class="badge bg-danger abbr-badge" title="Invalid environment variables are found and defaults are used instead.&#013;&#010;{{page_data.invalid_env_vars}}">Details</span>
+                    {{/if}}
+                    {{#unless page_data.invalid_env_vars}}
+                        <span class="d-block"><b>Yes</b></span>
                    {{/unless}}
                    </dd>
                    <dt class="col-sm-5">Uses custom templates</dt>
@@ -135,6 +135,11 @@
                        <div class="radio">
                            <label><input type="radio" value="3" class="form-radio-input" name="user_type" id="userOrgTypeManager">&nbsp;Manager</label>
                        </div>
+                        {{#if custom_roles_enabled}}
+                        <div class="radio">
+                            <label><input type="radio" value="4" class="form-radio-input" name="user_type" id="userOrgTypeCustom">&nbsp;Custom</label>
+                        </div>
+                        {{/if}}
                        <div class="radio">
                            <label><input type="radio" value="1" class="form-radio-input" name="user_type" id="userOrgTypeAdmin">&nbsp;Admin</label>
                        </div>
@@ -98,10 +98,17 @@ app-security > app-two-factor-setup > form {
 }

 /* Hide unsupported Custom Role options */
+{{#if custom_roles_enabled}}
+/* Only the collection permissions can be granted yet */
+:is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) {
+  @extend %vw-hide;
+}
+{{else}}
 :is(bit-dialog, [bit-dialog]) div.tw-ml-4:has(bit-form-control input),
 :is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) {
  @extend %vw-hide;
 }
+{{/if}}

 /* Change collapsed menu icon to Vaultwarden */
 bit-nav-logo bit-nav-item a:before {
@@ -210,7 +210,7 @@ impl Fairing for Cors {
 pub struct Cached<R> {
    response: R,
    is_immutable: bool,
-    ttl: u64,
+    ttl: u32,
 }

 impl<R> Cached<R> {
@@ -230,7 +230,7 @@ impl<R> Cached<R> {
        }
    }

-    pub fn ttl(response: R, ttl: u64, is_immutable: bool) -> Cached<R> {
+    pub fn ttl(response: R, ttl: u32, is_immutable: bool) -> Cached<R> {
        Self {
            response,
            is_immutable,
@@ -251,7 +251,7 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for Cache
        res.set_raw_header("Cache-Control", cache_control_header);

        let time_now = Local::now();
-        let expiry_time = time_now + chrono::TimeDelta::try_seconds(self.ttl.try_into().unwrap()).unwrap();
+        let expiry_time = time_now + chrono::TimeDelta::try_seconds(self.ttl.into()).unwrap();
        res.set_raw_header("Expires", format_datetime_http(&expiry_time));
        Ok(res)
    }
@@ -259,14 +259,16 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for Cache

 pub struct EtagCached<R> {
    response: R,
+    content_type: ContentType,
    etag: String,
 }

 impl<R> EtagCached<R> {
    /// An `etag` response should always be quoted
-    pub fn new(response: R, etag: &str) -> Self {
+    pub fn new(response: R, content_type: ContentType, etag: &str) -> Self {
        Self {
            response,
+            content_type,
            etag: format!("\"{etag}\""),
        }
    }
@@ -288,7 +290,8 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for EtagC
            self.response.respond_to(request)?
        };

-        // Both 200 (OK) and 304 (Not Modified) need to return the etag and cache-control
+        // Both 200 (OK) and 304 (Not Modified) need to return the Content-Type Etag and Cache-Control
+        res.set_header(self.content_type);
        res.set_raw_header("Etag", self.etag);
        res.set_raw_header("Cache-Control", "public, no-cache");
        Ok(res)
@@ -299,19 +302,69 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for EtagC
 // Effectively ignores, any static file route, and the alive endpoint
 const LOGGED_ROUTES: [&str; 7] = ["/api", "/admin", "/identity", "/icons", "/attachments", "/events", "/notifications"];

-// Boolean is extra debug, when true, we ignore the whitelist above and also print the mounts
-pub struct BetterLogging(pub bool);
+const MAX_LOGGED_QUERY_BYTES: usize = 100;
+
+// Query values can hold secrets, like the access code of a login request, so we don't log them
+fn redact_query_values(query: &str) -> String {
+    query
+        .split('&')
+        .map(|param| match param.split_once('=') {
+            Some((name, _)) => format!("{name}=…"),
+            None => param.to_owned(),
+        })
+        .collect::<Vec<_>>()
+        .join("&")
+}
+
+// When extra is true, we ignore the whitelist above and also print the mounts
+pub struct BetterLogging {
+    extra: bool,
+    log_requests: bool,
+    log_response: bool,
+    domain_path: String,
+}
+
+impl BetterLogging {
+    pub fn new(extra: bool, domain_path: &str) -> Self {
+        Self {
+            extra,
+            log_requests: log_enabled!(target: "request", log::Level::Info),
+            log_response: log_enabled!(target: "response", log::Level::Info),
+            domain_path: rocket::http::RawStr::new(&domain_path).percent_decode_lossy().into_owned(),
+        }
+    }
+
+    fn log_path<'p>(&self, method: Method, path: &'p rocket::http::RawStr) -> Option<std::borrow::Cow<'p, str>> {
+        if !self.extra && method == Method::Options {
+            return None;
+        }
+        let path = path.percent_decode_lossy();
+        if self.extra {
+            return Some(path);
+        }
+        let subpath = path.strip_prefix(&self.domain_path).unwrap_or(&path);
+        LOGGED_ROUTES.iter().any(|r| subpath.starts_with(r)).then_some(path)
+    }
+}
+
 #[rocket::async_trait]
 impl Fairing for BetterLogging {
    fn info(&self) -> Info {
+        let mut kind = Kind::Liftoff;
+        if self.log_requests {
+            kind = kind | Kind::Request;
+        }
+        if self.log_response {
+            kind = kind | Kind::Response;
+        }
        Info {
            name: "Better Logging",
-            kind: Kind::Liftoff | Kind::Request | Kind::Response,
+            kind,
        }
    }

    async fn on_liftoff(&self, rocket: &Rocket<Orbit>) {
-        if self.0 {
+        if self.extra {
            info!(target: "routes", "Routes loaded:");
            let mut routes: Vec<_> = rocket.routes().collect();
            routes.sort_by_key(|r| r.uri.path());
@@ -335,36 +388,29 @@ impl Fairing for BetterLogging {
    }

    async fn on_request(&self, request: &mut Request<'_>, _data: &mut Data<'_>) {
-        let method = request.method();
-        if !self.0 && method == Method::Options {
-            return;
-        }
        let uri = request.uri();
-        let uri_path = uri.path();
-        let uri_path_str = uri_path.url_decode_lossy();
-        let uri_subpath = uri_path_str.strip_prefix(&CONFIG.domain_path()).unwrap_or(&uri_path_str);
-        if self.0 || LOGGED_ROUTES.iter().any(|r| uri_subpath.starts_with(r)) {
-            match uri.query() {
-                Some(q) => info!(target: "request", "{method} {uri_path_str}?{}", &q[..q.len().min(30)]),
-                None => info!(target: "request", "{method} {uri_path_str}"),
+        let method = request.method();
+        let Some(path) = self.log_path(method, uri.path().raw()) else {
+            return;
+        };
+        match uri.query() {
+            Some(q) => {
+                let query = redact_query_values(q.as_str());
+                let query = &query[..query.floor_char_boundary(MAX_LOGGED_QUERY_BYTES)];
+                info!(target: "request", "{method} {}?{}", path.escape_debug(), query.escape_debug());
            }
+            None => info!(target: "request", "{method} {}", path.escape_debug()),
        }
    }

    async fn on_response<'r>(&self, request: &'r Request<'_>, response: &mut Response<'r>) {
-        if !self.0 && request.method() == Method::Options {
+        if self.log_path(request.method(), request.uri().path().raw()).is_none() {
            return;
        }
-        let uri_path = request.uri().path();
-        let uri_path_str = uri_path.url_decode_lossy();
-        let uri_subpath = uri_path_str.strip_prefix(&CONFIG.domain_path()).unwrap_or(&uri_path_str);
-        if self.0 || LOGGED_ROUTES.iter().any(|r| uri_subpath.starts_with(r)) {
-            let status = response.status();
-            if let Some(route) = request.route() {
-                info!(target: "response", "{route} => {status}");
-            } else {
-                info!(target: "response", "{status}");
-            }
+        let status = response.status();
+        match request.route() {
+            Some(r) => info!(target: "response", "{r} => {status}"),
+            None => info!(target: "response", "{status}"),
        }
    }
 }
@@ -447,20 +493,34 @@ pub fn get_env_str_value(key: &str) -> Option<String> {
    }
 }

-pub fn get_env<V>(key: &str) -> Option<V>
+pub static INVALID_ENV_VARS: std::sync::Mutex<Vec<&'static str>> = std::sync::Mutex::new(Vec::new());
+
+pub fn get_env<V>(key: &'static str) -> Option<V>
 where
    V: FromStr,
 {
-    try_parse_string(get_env_str_value(key))
+    let value = get_env_str_value(key);
+    let value_is_some = value.is_some();
+    let parsed: Option<V> = try_parse_string(value);
+    if parsed.is_none() && value_is_some {
+        println!("[ERROR] `{key}` contains an invalid value for its type and is ignored, the default is used instead.");
+        INVALID_ENV_VARS.lock().unwrap().push(key);
+    }
+    parsed
 }

-pub fn get_env_bool(key: &str) -> Option<bool> {
+pub fn get_env_bool(key: &'static str) -> Option<bool> {
    const TRUE_VALUES: &[&str] = &["true", "t", "yes", "y", "1"];
    const FALSE_VALUES: &[&str] = &["false", "f", "no", "n", "0"];

    match get_env_str_value(key) {
        Some(val) if TRUE_VALUES.contains(&val.to_lowercase().as_ref()) => Some(true),
        Some(val) if FALSE_VALUES.contains(&val.to_lowercase().as_ref()) => Some(false),
+        Some(_) => {
+            println!("[ERROR] `{key}` contains an invalid boolean value and is ignored, the default is used instead.");
+            INVALID_ENV_VARS.lock().unwrap().push(key);
+            None
+        }
        _ => None,
    }
 }
@@ -839,6 +899,12 @@ pub fn parse_experimental_client_feature_flags(
        .collect()
 }

+/// Whether the admin enabled this supported client feature flag
+pub fn is_client_feature_flag_enabled(flag: &str) -> bool {
+    parse_experimental_client_feature_flags(&CONFIG.experimental_client_feature_flags(), &FeatureFlagFilter::ValidOnly)
+        .contains_key(flag)
+}
+
 /// TODO: This is extracted from IpAddr::is_global, which is unstable:
 /// https://doc.rust-lang.org/nightly/std/net/enum.IpAddr.html#method.is_global
 /// Remove once https://github.com/rust-lang/rust/issues/27709 is merged
@@ -982,3 +1048,28 @@ mod tests {
        });
    }
 }
+
+#[cfg(test)]
+mod query_log_tests {
+    use super::{MAX_LOGGED_QUERY_BYTES, redact_query_values};
+
+    #[test]
+    fn test_redact_query_values() {
+        assert_eq!(redact_query_values("code=SECRET"), "code=…");
+        assert_eq!(redact_query_values("code=SECRET&other=SECRET"), "code=…&other=…");
+        assert_eq!(redact_query_values("a=1&b=2&flag"), "a=…&b=…&flag");
+        assert_eq!(redact_query_values("a=b=SECRET"), "a=…");
+        assert_eq!(redact_query_values("a=1&&=SECRET"), "a=…&&=…");
+        assert_eq!(redact_query_values("a=x%26b%3DSECRET"), "a=…");
+        assert_eq!(redact_query_values("a=1;b=SECRET"), "a=…");
+        assert_eq!(redact_query_values("a=1&a=SECRET"), "a=…&a=…");
+        assert_eq!(redact_query_values(""), "");
+    }
+
+    #[test]
+    fn test_redacted_query_truncates_on_a_char_boundary() {
+        let name = "a".repeat(MAX_LOGGED_QUERY_BYTES - 1);
+        let query = redact_query_values(&format!("{name}=SECRET"));
+        assert_eq!(&query[..query.floor_char_boundary(MAX_LOGGED_QUERY_BYTES)], format!("{name}="));
+    }
+}
@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Runs the live-server end-to-end tests of bitwarden/sdk-internal (e2e/wasm) against vaultwarden.
+#
+# Usage: tools/sdk-live-tests/run.sh --sdk-dir <path> [--skip-sdk-build] [--mode vectors|seeder] [-- <vitest args>]
+#
+# --skip-sdk-build uses the package already in the SDK's crates/bitwarden-wasm-internal/npm: an earlier build, or a
+# published @bitwarden/sdk-internal unpacked there.
+#
+# The server is built with `unsafe_test_mode`, whose test seeder (src/api/test_seeder.rs) creates the test accounts.
+# - vectors: for SDK versions whose live tests log in to one given account. Every user test vector with a master
+#   password gets a fresh server, is seeded there with its vault, and the tests run on it (they rotate its keys).
+# - seeder: for SDK versions whose tests seed their own accounts through BW_LIVE_SEEDER_URL. One server, one run.
+# The mode follows what the SDK's e2e/wasm/live/config.ts reads, unless --mode says otherwise. Arguments after `--` go
+# to vitest, e.g. `-- tests/user-crypto-management/rotate-user-keys.live.test.ts` to run one file.
+#
+# Every vector runs even after a failure; a summary follows, and the exit code is 1 if any failed. The server logs are
+# in <target dir>/sdk-live-tests/. BW_LIVE_CLIENT_VERSION defaults to 2026.10.1, the minimum for V2 accounts.
+#
+# Needs: Node.js >= 22.12, curl, python3, and to build the SDK its Rust toolchain with the wasm32-unknown-unknown target
+# and rust-src.
+set -euo pipefail
+
+VW_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+TARGET_DIR="${CARGO_TARGET_DIR:-${VW_DIR}/target}"
+OUT_DIR="${TARGET_DIR}/sdk-live-tests"
+PORT=8099
+URL="http://127.0.0.1:${PORT}"
+SEEDER_URL="${URL}/test/seeder"
+SEEDER_USERNAME="sdk-live-tests"
+SEEDER_PASSWORD="$(python3 -c 'import secrets; print(secrets.token_urlsafe(24))')"
+SKIP=3 # seed_vector.py's exit code for a vector the tests can't use
+export BW_LIVE_CLIENT_VERSION="${BW_LIVE_CLIENT_VERSION:-2026.10.1}"
+
+SDK_DIR=""
+BUILD_SDK=1
+MODE=""
+VITEST_ARGS=()
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --sdk-dir) SDK_DIR="$(cd "$2" && pwd)"; shift 2 ;;
+    --skip-sdk-build) BUILD_SDK=0; shift ;;
+    --mode) MODE="$2"; shift 2 ;;
+    --) shift; VITEST_ARGS=("$@"); break ;;
+    *) echo "Unknown argument: $1" >&2; exit 2 ;;
+  esac
+done
+[[ -n "${SDK_DIR}" ]] || { echo "--sdk-dir is required" >&2; exit 2; }
+TESTS_DIR="${SDK_DIR}/e2e/wasm"
+[[ -f "${TESTS_DIR}/live/config.ts" ]] || { echo "${TESTS_DIR}/live/config.ts not found: no live tests in this SDK" >&2; exit 2; }
+if [[ -z "${MODE}" ]]; then
+  if grep -q BW_LIVE_SEEDER_URL "${TESTS_DIR}/live/config.ts"; then MODE=seeder; else MODE=vectors; fi
+fi
+[[ "${MODE}" == vectors || "${MODE}" == seeder ]] || { echo "--mode must be vectors or seeder" >&2; exit 2; }
+echo "Mode: ${MODE}, client version ${BW_LIVE_CLIENT_VERSION}"
+
+(cd "${VW_DIR}" && cargo build --features sqlite,unsafe_test_mode)
+if [[ ${BUILD_SDK} -eq 1 ]]; then
+  bash "${SDK_DIR}/crates/bitwarden-wasm-internal/build.sh"
+fi
+(cd "${TESTS_DIR}" && npm ci)
+
+server=""
+trap 'if [[ -n "${server}" ]]; then kill "${server}" 2>/dev/null || true; fi' EXIT
+
+# Starts a server on an empty database in $OUT_DIR/$1
+start_server() {
+  local data_dir="${OUT_DIR}/$1"
+  rm -rf "${data_dir}" && mkdir -p "${data_dir}"
+  if curl -s -o /dev/null "${URL}/alive"; then
+    echo "Something already answers on port ${PORT}" >&2
+    return 1
+  fi
+  ENV_FILE=/dev/null DATA_FOLDER="${data_dir}" DATABASE_URL="sqlite://${data_dir}/db.sqlite3" \
+    ROCKET_ADDRESS=127.0.0.1 ROCKET_PORT="${PORT}" DOMAIN="${URL}" WEB_VAULT_ENABLED=false \
+    SIGNUPS_ALLOWED=true SIGNUPS_VERIFY=false LOGIN_RATELIMIT_MAX_BURST=1000 \
+    TEST_SEEDER_USERNAME="${SEEDER_USERNAME}" TEST_SEEDER_PASSWORD="${SEEDER_PASSWORD}" \
+    "${TARGET_DIR}/debug/vaultwarden" > "${data_dir}/vaultwarden.log" 2>&1 &
+  server=$!
+  local i
+  for i in $(seq 1 60); do
+    if ! kill -0 "${server}" 2>/dev/null; then break; fi
+    if curl -sf -o /dev/null "${URL}/alive"; then return 0; fi
+    sleep 1
+  done
+  echo "The server didn't start; the end of ${data_dir}/vaultwarden.log:" >&2
+  tail -50 "${data_dir}/vaultwarden.log" >&2
+  stop_server
+  return 1
+}
+
+stop_server() {
+  if [[ -n "${server}" ]]; then
+    kill "${server}" 2>/dev/null || true
+    wait "${server}" 2>/dev/null || true
+    server=""
+  fi
+}
+
+run_tests() {
+  (cd "${TESTS_DIR}" && BW_LIVE_SERVER_URL="${URL}" "$@" npm run test:live -- "${VITEST_ARGS[@]}")
+}
+
+results=()
+failed=0
+if [[ "${MODE}" == seeder ]]; then
+  if start_server seeder && run_tests env BW_LIVE_SEEDER_URL="${SEEDER_URL}" \
+    BW_LIVE_SEEDER_USERNAME="${SEEDER_USERNAME}" BW_LIVE_SEEDER_PASSWORD="${SEEDER_PASSWORD}"; then
+    results+=("seeder: pass")
+  else
+    results+=("seeder: FAIL")
+    failed=1
+  fi
+  stop_server
+else
+  for vector_file in "${SDK_DIR}"/test-vectors/users/*.json; do
+    vector="$(basename "${vector_file}" .json)"
+    echo "=== ${vector}"
+    if ! start_server "${vector}"; then
+      results+=("${vector}: FAIL (server didn't start)")
+      failed=1
+      continue
+    fi
+    status=0
+    credentials="$(python3 -I "${VW_DIR}/tools/sdk-live-tests/seed_vector.py" "${vector_file}" "${SEEDER_URL}" \
+      "${SEEDER_USERNAME}" "${SEEDER_PASSWORD}")" || status=$?
+    if [[ ${status} -eq ${SKIP} ]]; then
+      results+=("${vector}: skip (${credentials})")
+    elif [[ ${status} -ne 0 ]]; then
+      results+=("${vector}: FAIL (seeding)")
+      failed=1
+    elif run_tests env BW_LIVE_EMAIL="$(sed -n 1p <<< "${credentials}")" \
+      BW_LIVE_PASSWORD="$(sed -n 2p <<< "${credentials}")"; then
+      results+=("${vector}: pass")
+    else
+      results+=("${vector}: FAIL")
+      failed=1
+    fi
+    stop_server
+  done
+fi
+
+echo
+echo "=== Summary (logs in ${OUT_DIR})"
+printf '%s\n' "${results[@]}"
+exit "${failed}"
@@ -0,0 +1,59 @@
+"""Seeds one of the SDK's user test vectors, vault included, through vaultwarden's test seeder.
+
+Usage: seed_vector.py <vector.json> <seeder url> <seeder username> <seeder password>
+
+Prints the account's email and password, one per line. Exits 3, printing why, for a vector the tests can't log in
+with (no master password), and 1 if the seeder refuses it.
+"""
+
+import base64
+import json
+import sys
+import urllib.error
+import urllib.request
+import uuid
+
+SKIP = 3
+
+
+def main() -> int:
+    vector_file, seeder_url, username, password = sys.argv[1:5]
+    with open(vector_file, encoding="utf-8") as f:
+        vector = json.load(f)
+
+    has_master_password = any("masterPasswordUnlock" in method for method in vector.get("unlockMethods", []))
+    if not has_master_password or "password" not in vector.get("account", {}):
+        print("no master password")
+        return SKIP
+
+    # Without attachments: the rotation test compares the vault before and after, and our sync gives each attachment
+    # a link with a fresh download token every time (upstream's is the same on every sync). A vector's legacy
+    # attachments, without a key of their own, would also make the SDK refuse to rotate at all.
+    for cipher in vector.get("vault", {}).get("ciphers", []):
+        cipher.get("encrypted", {}).pop("attachments", None)
+
+    credentials = base64.b64encode(f"{username}:{password}".encode()).decode()
+    request = urllib.request.Request(
+        f"{seeder_url}/seed",
+        data=json.dumps({"template": "TestVectorUserScene", "arguments": vector}).encode(),
+        method="POST",
+        headers={
+            "Authorization": f"Basic {credentials}",
+            "Content-Type": "application/json",
+            "X-Play-Id": f"sdk-live-tests-{uuid.uuid4()}",
+        },
+    )
+    try:
+        with urllib.request.urlopen(request) as response:
+            result = json.load(response)["result"]
+    except urllib.error.HTTPError as e:
+        print(f"The seeder refused {vector_file}: {e.code} {e.read().decode(errors='replace')}", file=sys.stderr)
+        return 1
+
+    print(result["email"])
+    print(vector["account"]["password"])
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
Author	SHA1	Message	Date
Daniel García	b66777b330	Speed up the Build workflow - Pass the MariaDB client library to mysqlclient-sys through its environment variables, so a cached build no longer recompiles mysqlclient-sys, diesel and diesel_migrations in every MySQL build. The cache prefix changes once, because the old caches would keep rebuilding it. - Drop the sqlite,mysql,postgresql,enable_mimalloc test: enable_mimalloc is still tested on and off. - Only save caches on main, so pull requests and branches no longer push main's caches out of the 10 GB limit.	2026-11-13 22:08:57 +01:00
StarHzjandDaniel García	258b7f0254	Add macOS native credential sync to supported feature flags (#7942 ) * Add macOS native credential sync to supported feature flags * Document the macOS native credential sync flag in .env.template * Align the macOS passkey provider description with Windows --------- Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>	2026-11-13 20:38:00 +01:00
Tom	a8de8c7820	[PR 3] Add collection permissions for Custom Roles (#7951 ) * Add Custom Roles collection permissions * Return NotFound for denied collection access * Grant Manage on imported collections to every Custom member	2026-11-13 20:24:59 +01:00
Daniel García	d2d1294098	Run the Bitwarden SDK's live end-to-end tests against Vaultwarden (#7953 ) * Add a test seeder behind the unsafe_test_mode feature For the end-to-end tests: with the feature, /test/seeder answers the calls the SDK's live tests make to a seeder API (POST /seed with SingleUserScene or TestVectorUserScene, DELETE /seed/<playId>), behind HTTP basic auth from TEST_SEEDER_USERNAME and TEST_SEEDER_PASSWORD, and 404 without them. It creates accounts without any checks, so no release build has the feature. CI builds and tests it with sqlite. * Run the SDK live tests against the test seeder tools/sdk-live-tests/run.sh builds the server with unsafe_test_mode and runs the live tests of the SDK's e2e/wasm suite. For SDK versions whose tests log in to one given account, each user test vector with a master password is seeded with its vault on a fresh server; for versions that seed their own accounts, the tests get the seeder's address. Every vector runs, then a summary. The workflow runs it by hand, and on changes to the seeder or the runner. * Run the SDK live tests daily * Test the published SDK package by default in the SDK live tests	2026-11-13 19:48:10 +01:00
Daniel García	730048e3c6	Move the cipher content mapping into its own function (#7952 ) save_cipher_data copies the request's type data or blob, name, notes, fields, password history, key and reprompt onto the cipher through set_cipher_content now, so code that stores a cipher without going through a request can reuse it. No behaviour change.	2026-11-13 18:59:10 +01:00
Tom	1430a64547	[PR 2] Add administrative cipher access for Custom Roles (#7938 ) * Separate administrative cipher access * Return NotFound for admin attachments and ungate assigned ciphers	2026-11-13 14:31:57 +01:00
Daniel García	7c82fbed0c	Implement V2 key rotation support (#7766 ) * Implement V2 key rotation support * Clear user key ids left stale by key rotations * Refuse key ids that aren't 32 lowercase hex characters, like upstream * Save the signature key pair before the v2 account state * Gate v2 logins on upstream's v2 encryption check * Document the v2 encryption feature flags * Remove the v2 upgrade feature flags With force-upgrade-v2-encryption on, the clients loop on any v1 account that stays v1 on a vault route: the migration check runs fullSync(false), which writes lastSync, which triggers the scheduler again. No server response stops it, so don't serve the flag until the clients fix it. pm-30144-sdk-key-rotation and pm-31050-no-logout-key-upgrade-rotation only serve that upgrade, so they go too. * Move the v2 upgrade token migration to its own version Diesel identifies a migration by the date in its folder name alone, and silently drops one of two folders that share it. The Custom Roles migration uses the same date. * Refuse rotations from a replaced user key, like upstream Both rotation endpoints accept the optional oldUserKeyId. When it and the stored key id are both set and differ, the rotation is refused with a 409 asking the client to sync, before the account keys are checked or anything is written. Also correct the comment on saving the signature key pair first: by then the vault data is already re-encrypted, so a failure there doesn't keep the account usable. * Update the v2 client minimum in .env.template and the key pair comments V2 accounts need 2026.10.1, or 2026.10.2 for the desktop app, so the per-flag versions are only enough to create one. The comments on saving the signature key pair now cover the rotation of an account that is already v2.	2026-11-12 22:30:39 +01:00
Daniel García	d28c8339fb	Implement V2 registration support (#7765 ) * Implement V2 registration support * Require the client version header on every login, like upstream Every user login (password, user API key, SSO, including a first SSO login) now needs the Bitwarden-Client-Version header, for V1 accounts too. V2 accounts need 2026.10.1, or 2026.10.2 for the desktop app, upstream's current minimum. * Escape the email in the client version log line On a first SSO login the email comes from the identity provider and isn't validated yet, so a newline in it could add a line to the log.	2026-11-12 22:30:20 +01:00
Daniel García	5ad0c6d41a	Support blob-encrypted ciphers and match upstream's key id checks (#7764 )	2026-11-12 22:30:00 +01:00
miquno	17b159beff	Don't let OpenDAL create a missing config folder (#7935 ) The Fs operator creates its root folder if it doesn't exist, so loading the config created the data folder (or failed with a misleading invalid config.json error when it couldn't). Skip building the operator if the local config folder doesn't exist, so a missing data folder is reported again like before.	2026-11-04 22:17:54 +01:00
Tom	904b80115d	[PR 1] Add experimental Custom Roles foundation (#7847 )	2026-11-04 22:11:52 +01:00
Daniel García	82fc47e83e	Redact query values in request logs (#7929 )	2026-11-03 00:12:56 +01:00
Tom	286499781a	Add Fill Assist feature flag in .env.template (#7928 )	2026-11-02 20:28:51 +01:00
Daniel García	6ed6921cc2	Escape request values in log messages (#7921 )	2026-11-01 22:38:18 +01:00
Mathijs van Veluw	5d870b796f	Clippy fixes, crate and web-vault updates (#7920 )	2026-11-01 18:59:00 +01:00
Tom	79ee29d501	Add HTTP auth and policy revocation audit events (#7919 )	2026-11-01 17:09:56 +01:00
Daniel García	acb574b768	Two small fixes for upstream parity (#7918 )	2026-11-01 16:30:35 +01:00
Cassian433	e056359a42	Send logout notification when deleting a user (#7839 )	2026-10-29 23:16:14 +01:00
Michael Mu	f1c7eccd4a	Bump user revision once for bulk cipher move (#7840 )	2026-10-29 22:38:39 +01:00
Tom	0dbc92f2b7	Make 2FA remember duration configurable (#7421 )	2026-10-29 22:33:26 +01:00
Tom	42660af757	Add registration email verification clicked endpoint (#7790 )	2026-10-29 22:32:37 +01:00
Tom	863395f5e2	Add configurable Fill Assist rules URL (#7791 )	2026-10-29 22:25:23 +01:00
Tauan BF	be5d3ad907	Don't return internal error details in bulk member responses; gate SSO token logging (#7777 )	2026-10-29 22:22:12 +01:00
lede	80d1859452	Fix push device unregistration endpoint (#7891 )	2026-10-29 22:18:00 +01:00
Michael Mu	b723afe08a	Document two feature flags in .env.template (#7841 )	2026-10-29 22:15:26 +01:00
Daniel García	64ae55ceb2	Align cipher org checks & attachment notification with upstream (#7906 )	2026-10-28 23:14:28 +01:00
Luca BeckerandDaniel García	a96912bf21	fix(attachments): enforce quota at v2 metadata reservation (#7450 ) * fix(attachments): enforce quota at v2 metadata reservation POST /ciphers/<id>/attachment/v2 persisted client-declared fileSize without checking USER_ATTACHMENT_LIMIT or ORG_ATTACHMENT_LIMIT, allowing a writer to exhaust org/user quota via metadata-only reservations before uploading bytes. Extract shared quota arithmetic into attachment_quota_remaining and use it from post_attachment_v2 (size_adjust=0) and save_attachment so both paths stay consistent. Add unit tests covering limit, size_adjust, and the v2 over-quota rejection case. * Remove unneeded tests and simplify --------- Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>	2026-10-28 21:54:06 +01:00
Daniel García	e2d63cfca3	Remove expired cookies from the icon cookie jar (#7905 )	2026-10-28 21:28:02 +01:00
Arthurmeade12	0f44744ef8	Fix typo (#7864 ) sever -> server	2026-10-25 20:42:35 +01:00
Mathijs van Veluw	44c4853d37	Upgrade to Rocket v0.5.2 (#7890 ) Upgrade Rocket to v0.5.2 which has updated all the crate dependencies. Also adjusted some code which I changed with Rkt and during that found some small bugs and fixed those too. Adjusted the ETag Caching a bit. Also updated other crates and GHA. Signed-off-by: BlackDex <black.dex@gmail.com>	2026-10-25 17:08:08 +01:00
Tom	e5a90968f2	Fix bulk cipher share response for SDK clients (#7831 ) * Fix bulk cipher share response for SDK clients * Simplify cipher sharing code	2026-10-25 16:49:20 +01:00
Alexander WidakandAlexander Widak	7ce705be56	Return stored manage flag for groups in collections/details (#7795 ) CollectionGroup::to_json_details_for_group derived manage from !read_only && !hide_passwords, so the group permission "Can edit items" was reported as "Can manage collection" by collections/details, while groups/<id>/details reported the stored value. Saving the collection access dialog in the web vault then persisted manage=true. Fixes #7794 Co-authored-by: Alexander Widak <deltatree.widak@gmail.com>	2026-10-25 16:49:12 +01:00
MinchinWebandClaude Opus 5.5	c925c04de0	Send null org key for unconfirmed members in sync (#7850 ) Since #7666 the sync profile's `organizationsNew` also lists Accepted (not yet confirmed) memberships. Their `akey` is still empty, so the response contained `"key": ""`, whereas upstream sends `null` until the member is confirmed. Bitwarden Android 2026.9 prefers `organizationsNew` and only skips organizations whose key is null. The empty string is handed to the SDK, which rejects it ("Invalid asymmetric type, got type 0 with 1 parts"), so the whole `initializeOrgCrypto` call fails: none of the user's organization keys are loaded and every organization item and collection fails to decrypt on that device. Send null for an empty key, matching upstream and the existing handling of the user key in `GET /api/accounts/keys`. Claude-Session: https://claude.ai/code/session_011UHYQWTz2PkXSCfucaRMZB Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 16:49:02 +01:00
Mathijs van Veluw	b71cb7a832	Misc fixes regarding jobs and config (#7858 ) * Fix several scheduled job issues Several jobs could cause a panic, or stop without running through all items because of this panic. This could cause missed items until that panic somehow resolved it self, and probably would never work fully again. This could cause emergency access for example to never work again. Besides this, emergency access was also able to be panic if the wait-time was out-of-bounds and date/time calculation might fail. This is also fixed now by using `checked` functions and continue upon those issues so all awaiting items will be handled. Signed-off-by: BlackDex <black.dex@gmail.com> * Fix several possible panics and overflows Adjust several integer types to be a lower or unsigned type. Most types were too large, only because the function which used this value needed that specific type. But, this allowed too large values which either caused panics or might cause a DoS. This does however might possible cause configurations which have larger values, which are probably way too large anyway to be not loaded or use their defaults. During the config loading, either via env or json, it will show error logs regarding these items. Also fixed an issue with protected actions via OTP, it increased the attempt before it validated if the attempt limit was reached. This could cause an issue when set to `1`, that way it was never allowed, and `3` times would actually be `2`. Also added several config validation checks which otherwise would have prevent Vaultwarden to start, or login, so these will probably not cause issues, else users would already have issues. Signed-off-by: BlackDex <black.dex@gmail.com> * Show config errors on diagnostics page With the previous commits it is now possible to add a warning if their rare issues with loading of the config, either environment variables which we were not able to parse correctly, or if loading the `config.json` failed instead of just showing it wasn't used, while it does exists, which might be confusing. Signed-off-by: BlackDex <black.dex@gmail.com> --------- Signed-off-by: BlackDex <black.dex@gmail.com>	2026-10-22 14:20:03 +02:00
				`@@ -0,0 +1 @@`
				`-- TEXT has no size limit here, only MySQL needed the change`