Revert "Disable deployments for release env (#7033 )"

This reverts commit 8f0e99b875.
2026-10-23 09:48:09 +03:00 · 2026-04-12 16:57:48 +02:00
175 changed files with 26941 additions and 22360 deletions
@@ -1,7 +1,7 @@
-# Ignore everything
+// Ignore everything
 *

-# Allow what is needed
+// Allow what is needed
 !.git
 !docker/healthcheck.sh
 !docker/start.sh
@@ -50,11 +50,10 @@
 #########################

 ## Database URL
-## When using SQLite, this should use the sqlite:// scheme followed by the path
-## to the DB file. It defaults to sqlite://%DATA_FOLDER%/db.sqlite3.
-## Bare paths without the sqlite:// scheme are supported for backwards compatibility,
-## but only if the database file already exists.
-# DATABASE_URL=sqlite://data/db.sqlite3
+## When using SQLite, this is the path to the DB file, and it defaults to
+## %DATA_FOLDER%/db.sqlite3. If DATA_FOLDER is set to an external location, this
+## must be set to a local sqlite3 file path.
+# DATABASE_URL=data/db.sqlite3
 ## When using MySQL, specify an appropriate connection URI.
 ## Details: https://docs.diesel.rs/2.1.x/diesel/mysql/struct.MysqlConnection.html
 # DATABASE_URL=mysql://user:password@host[:port]/database_name
@@ -78,7 +77,7 @@
 # DB_CONNECTION_RETRIES=15

 ## Database timeout
-## Timeout in seconds when acquiring database connection
+## Timeout when acquiring database connection
 # DATABASE_TIMEOUT=30

 ## Database idle timeout
@@ -173,14 +172,14 @@
 ## Defaults to daily. Set blank to disable this job. Also without EVENTS_DAYS_RETAIN set, this job will not start.
 # EVENT_CLEANUP_SCHEDULE="0 10 0 * * *"
 ## Number of days to retain events stored in the database.
-## If unset (the default) or 0, events are kept indefinitely and the scheduled job is disabled!
+## If unset (the default), events are kept indefinitely and the scheduled job is disabled!
 # EVENTS_DAYS_RETAIN=
 ##
 ## Cron schedule of the job that cleans old auth requests from the auth request.
 ## Defaults to every minute. Set blank to disable this job.
 # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
 ##
-## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
+## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
 ## Defaults to every minute. Set blank to disable this job.
 # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
 #
@@ -233,7 +232,7 @@
 # USER_SEND_LIMIT=

 ## Number of days to wait before auto-deleting a trashed item.
-## If unset (the default) or 0, trashed items are not auto-deleted.
+## If unset (the default), trashed items are not auto-deleted.
 ## This setting applies globally, so make sure to inform all users of any changes to this setting.
 # TRASH_AUTO_DELETE_DAYS=

@@ -316,14 +315,6 @@
 ## unauthenticated access to potentially sensitive data.
 # SHOW_PASSWORD_HINT=false

-#########################
-### Client settings  ###
-#########################
-
-## Control whether clients onboarding interstitials are suppressed
-## (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals)
-# CLIENT_SUPPRESS_ONBOARDING=false
-
 #########################
 ### Advanced settings ###
 #########################
@@ -332,16 +323,6 @@
 ## Set to the string "none" (without quotes), to disable any headers and just use the remote IP
 # IP_HEADER=X-Real-IP

-## Which addresses the header above is accepted from, defaults to "local".
-## Anyone able to reach Vaultwarden can set the header, and the client IP is used for the login and
-## admin rate limits, so it is only trusted when the request comes from a proxy listed here.
-## "local" accepts it from any non global address, which covers a reverse proxy running on the same
-## host or container network. Use "all" to accept it from anywhere, or list the addresses of your
-## proxy as IPs and CIDR ranges if it connects from a public address.
-## For a list header like X-Forwarded-For, the client IP is the rightmost address that isn't one of
-## these proxies, so with several proxies in a row (a CDN in front of nginx, for example) list all of them.
-# IP_HEADER_TRUSTED_PROXIES=local
-
 ## Icon service
 ## The predefined icon services are: internal, bitwarden, duckduckgo, google.
 ## To specify a custom icon service, set a URL template with exactly one instance of `{}`,
@@ -392,17 +373,20 @@
 ##
 ## The following flags are available:
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
-## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
+## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
-## - "windows-desktop-autotype": Enable the autotype feature preview on Windows. (Desktop >= 2025.8.0)
-## - "windows-desktop-autotype-ga": Enable the new, still in development, autotype implementation on Windows. (Desktop >= 2026.9.1)
-##   Only enable one of the two autotype flags, the clients disable autotype completely when both are enabled.
+## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
+## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
+## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
+## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
+## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
+## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
+## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
 ## - "pm-30529-webauthn-related-origins":
-## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
-## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
-## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
-## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
-## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
+## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=

 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -463,7 +447,7 @@

 ## Allowed connect-src (Know the risks!)
 ## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
-## Allows other domains for URLs which can be loaded using script interfaces like the Forwarded email alias feature
+## Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
 ## This adds the configured value to the 'Content-Security-Policy' headers 'connect-src' value.
 ## Multiple values must be separated with a whitespace. And only HTTPS values are allowed.
 ## Example: "https://my-addy-io.domain.tld https://my-simplelogin.domain.tld"
@@ -475,13 +459,6 @@
 ## Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2.
 # LOGIN_RATELIMIT_MAX_BURST=10

-## Number of seconds, on average, between requests from the same IP address to one of the rate limited
-## unauthenticated endpoints, like the password hint, the account recovery mails or accessing a Send.
-# UNAUTHENTICATED_RATELIMIT_SECONDS=60
-## Allow a burst of requests of up to this size, while maintaining the average indicated by `UNAUTHENTICATED_RATELIMIT_SECONDS`.
-## This budget is shared between all of those endpoints, so it is more lenient than the login one.
-# UNAUTHENTICATED_RATELIMIT_MAX_BURST=50
-
 ## BETA FEATURE: Groups
 ## Controls whether group support is enabled for organizations
 ## This setting applies to organizations.
@@ -516,9 +493,6 @@
 ## Prevent users from logging in directly without going through SSO
 # SSO_ONLY=false

-## Allow SSO flow to create account. You probably want to disable it when using a public provider.
-# SSO_SIGNUPS_ALLOWED=true
-
 ## On SSO Signup if a user with a matching email already exists make the association
 # SSO_SIGNUPS_MATCH_EMAIL=true

@@ -581,6 +555,11 @@
 # DUO_HOST=<API Hostname>
 ## After that, you should be able to follow the rest of the guide linked above,
 ## ignoring the fields that ask for the values that you already configured beforehand.
+##
+## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'.
+## Duo no longer supports this, but it still works for some integrations.
+## If you aren't sure, leave this alone.
+# DUO_USE_IFRAME=false

 ## Email 2FA settings
 ## Email token size
@@ -1,2 +1,3 @@
 # Ignore vendored scripts in GitHub stats
 src/static/scripts/* linguist-vendored
+
@@ -62,7 +62,7 @@ jobs:

      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -113,7 +113,7 @@ jobs:

      # Enable Rust Caching
      - name: Rust Caching
-        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
          # Like changing the build host from Ubuntu 20.04 to 22.04 for example.
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # End Checkout the repo
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -30,25 +30,24 @@ jobs:
          driver-opts: |
            network=host

+      # Download hadolint - https://github.com/hadolint/hadolint/releases
+      - name: Download hadolint
+        run: |
+          sudo curl -L https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-$(uname -s)-$(uname -m) -o /usr/local/bin/hadolint && \
+          sudo chmod +x /usr/local/bin/hadolint
+        env:
+          HADOLINT_VERSION: 2.14.0
+      # End Download hadolint
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # End Checkout the repo

      # Test Dockerfiles with hadolint
-      # Uses the Docker-based action (hadolint pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian)
-      # so no binary is downloaded at runtime. Pinned by commit SHA for supply-chain safety.
-      - name: Run hadolint on Dockerfile.debian
-        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
-        with:
-          dockerfile: docker/Dockerfile.debian
-
-      - name: Run hadolint on Dockerfile.alpine
-        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
-        with:
-          dockerfile: docker/Dockerfile.alpine
+      - name: Run hadolint
+        run: hadolint docker/Dockerfile.{debian,alpine}
      # End Test Dockerfiles with hadolint

      # Test Dockerfiles with docker build checks
@@ -38,9 +38,7 @@ jobs:
  docker-build:
    name: Build Vaultwarden containers
    if: ${{ github.repository == 'dani-garcia/vaultwarden' }}
-    environment: 
-      name: release
-      deployment: false
+    environment: release
    permissions:
      packages: write # Needed to upload packages and artifacts
      contents: read
@@ -58,13 +56,13 @@ jobs:

    steps:
      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
        with:
          platforms: "arm64,arm"

      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -77,7 +75,7 @@ jobs:

      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        # We need fetch-depth of 0 so we also get all the tag metadata
        with:
          persist-credentials: false
@@ -106,7 +104,7 @@ jobs:

      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -121,7 +119,7 @@ jobs:

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -137,7 +135,7 @@ jobs:

      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -185,7 +183,7 @@ jobs:

      - name: Bake ${{ matrix.base_image }} containers
        id: bake_vw
-        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
        env:
          BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -222,7 +220,7 @@ jobs:
          touch "${RUNNER_TEMP}/digests/${digest#sha256:}"

      - name: Upload digest
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
          path: ${{ runner.temp }}/digests/*
@@ -237,23 +235,21 @@ jobs:

      # Upload artifacts to Github Actions and Attest the binaries
      - name: Attest binaries
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-path: vaultwarden-${{ env.NORMALIZED_ARCH }}

      - name: Upload binaries as artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
          path: vaultwarden-${{ env.NORMALIZED_ARCH }}

  merge-manifests:
    name: Merge manifests
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
    needs: docker-build
-    environment: 
-      name: release
-      deployment: false
+    environment: release
    permissions:
      packages: write # Needed to upload packages and artifacts
      attestations: write # Needed to generate an artifact attestation for a build
@@ -264,7 +260,7 @@ jobs:

    steps:
      - name: Download digests
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*-${{ matrix.base_image }}
@@ -272,7 +268,7 @@ jobs:

      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -287,7 +283,7 @@ jobs:

      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -303,7 +299,7 @@ jobs:

      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -365,7 +361,7 @@ jobs:
      # Attest container images
      - name: Attest - docker.io - ${{ matrix.base_image }}
        if: ${{ vars.DOCKERHUB_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-name: ${{ vars.DOCKERHUB_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -373,7 +369,7 @@ jobs:

      - name: Attest - ghcr.io - ${{ matrix.base_image }}
        if: ${{ vars.GHCR_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-name: ${{ vars.GHCR_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -381,7 +377,7 @@ jobs:

      - name: Attest - quay.io - ${{ matrix.base_image }}
        if: ${{ vars.QUAY_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-name: ${{ vars.QUAY_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -33,12 +33,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        env:
          TRIVY_DB_REPOSITORY: docker.io/aquasec/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2
          TRIVY_JAVA_DB_REPOSITORY: docker.io/aquasec/trivy-java-db:1,public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1
@@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          sarif_file: 'trivy-results.sarif'
@@ -16,11 +16,11 @@ jobs:
    steps:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # End Checkout the repo

      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+        uses: crate-ci/typos@02ea592e44b3a53c302f697cddca7641cd051c3d # v1.45.0
@@ -14,17 +14,17 @@ on:
 jobs:
  zizmor:
    name: Run zizmor
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
    permissions:
      security-events: write # To write the security report
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
@@ -15,14 +15,6 @@ repos:
    - id: detect-private-key
    - id: check-symlinks
    - id: forbid-submodules
-
-  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
-  - repo: https://github.com/crate-ci/typos
-    rev: 7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
-    hooks:
-      - id: typos
-        always_run: true
-
 -   repo: local
    hooks:
    - id: fmt
@@ -39,7 +31,8 @@ repos:
      entry: cargo test
      language: system
      args: ["--features", "sqlite,mysql,postgresql", "--"]
-        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
+      types_or: [rust, file]
+      files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
      pass_filenames: false
    - id: cargo-clippy
      name: cargo clippy
@@ -47,7 +40,8 @@ repos:
      entry: cargo clippy
      language: system
      args: ["--features", "sqlite,mysql,postgresql", "--", "-D", "warnings"]
-        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
+      types_or: [rust, file]
+      files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
      pass_filenames: false
    - id: check-docker-templates
      name: check docker templates
@@ -57,3 +51,8 @@ repos:
      args:
        - "-c"
        - "cd docker && make"
+# When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
+- repo: https://github.com/crate-ci/typos
+  rev: 02ea592e44b3a53c302f697cddca7641cd051c3d # v1.45.0
+  hooks:
+    - id: typos
@@ -23,6 +23,4 @@ extend-ignore-re = [
    # https://github.com/bitwarden/server/blob/dff9f1cf538198819911cf2c20f8cda3307701c5/src/Notifications/HubHelpers.cs#L86
    # https://github.com/bitwarden/clients/blob/9612a4ac45063e372a6fbe87eb253c7cb3c588fb/libs/common/src/auth/services/anonymous-hub.service.ts#L45
    "AuthRequestResponseRecieved",
-    # Ignore Punycode/IDN tests
-    "xn--.+"
 ]
@@ -1,6 +1,6 @@
 [workspace.package]
-edition = "2024"
-rust-version = "1.97.1"
+edition = "2021"
+rust-version = "1.92.0"
 license = "AGPL-3.0-only"
 repository = "https://github.com/dani-garcia/vaultwarden"
 publish = false
@@ -12,7 +12,9 @@ members = ["macros"]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
+readme = "README.md"
 build = "build.rs"
+resolver = "2"
 repository.workspace = true
 edition.workspace = true
 rust-version.workspace = true
@@ -22,32 +24,20 @@ publish.workspace = true
 [features]
 default = [
    # "sqlite",
-    # "sqlite_system",
    # "mysql",
    # "postgresql",
 ]
 # Empty to keep compatibility, prefer to set USE_SYSLOG=true
 enable_syslog = []
-# Please enable at least one of these DB backends.
 mysql = ["diesel/mysql", "diesel_migrations/mysql"]
 postgresql = ["diesel/postgres", "diesel_migrations/postgres"]
-sqlite_system = ["diesel/sqlite", "diesel_migrations/sqlite"] # Dynamically link SQLite
-sqlite = ["sqlite_system", "libsqlite3-sys/bundled"] # Statically link SQLite into the binary instead of dynamically.
+sqlite = ["diesel/sqlite", "diesel_migrations/sqlite", "dep:libsqlite3-sys"]
 # Enable to use a vendored and statically linked openssl
 vendored_openssl = ["openssl/vendored"]
 # Enable MiMalloc memory allocator to replace the default malloc
 # This can improve performance for Alpine builds
 enable_mimalloc = ["dep:mimalloc"]
-s3 = [
-    "opendal/services-s3",
-    "dep:opendal-http-transport-reqwest",
-    "dep:aws-config",
-    "dep:aws-credential-types",
-    "dep:aws-smithy-runtime-api",
-    "dep:http",
-    "dep:reqsign-aws-v4",
-    "dep:reqsign-core",
-]
+s3 = ["opendal/services-s3", "dep:aws-config", "dep:aws-credential-types", "dep:aws-smithy-runtime-api", "dep:anyhow", "dep:http", "dep:reqsign"]

 # OIDC specific features
 oidc-accept-rfc3339-timestamps = ["openidconnect/accept-rfc3339-timestamps"]
@@ -58,7 +48,6 @@ oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]
 unstable = []

 [target."cfg(unix)".dependencies]
-nix = { version = "0.31.3", features = ["fs"] }
 # Logging
 syslog = "7.0.0"

@@ -66,212 +55,154 @@ syslog = "7.0.0"
 macros = { path = "./macros" }

 # Logging
-log = "0.4.34"
+log = "0.4.29"
 fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
-# We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
-tracing = { version = "0.1.44", features = ["log"] }
+tracing = { version = "0.1.44", features = ["log"] } # Needed to have lettre and webauthn-rs trace logging to work

 # A `dotenv` implementation for Rust
 dotenvy = { version = "0.15.7", default-features = false }

 # Numerical libraries
 num-traits = "0.2.19"
-num-derive = "0.5.1"
-bigdecimal = "0.4.11"
+num-derive = "0.4.2"
+bigdecimal = "0.4.10"

 # Web framework
-rocket = { version = "0.5.1", default-features = false, features = ["json", "tls"] }
+rocket = { version = "0.5.1", features = ["tls", "json"], default-features = false }
 rocket_ws = { version ="0.1.1" }

 # WebSockets libraries
 rmpv = "1.3.1" # MessagePack library

 # Concurrent HashMap used for WebSocket messaging and favicons
-dashmap = "6.2.1"
+dashmap = "6.1.0"

 # Async futures
-futures = "0.3.34"
-tokio = { version = "1.54.1", features = [
-    "fs",
-    "io-util",
-    "net",
-    "parking_lot",
-    "rt-multi-thread",
-    "signal",
-    "time",
-] }
-tokio-util = { version = "0.7.20", features = ["compat"] }
+futures = "0.3.32"
+tokio = { version = "1.51.1", features = ["rt-multi-thread", "fs", "io-util", "parking_lot", "time", "signal", "net"] }
+tokio-util = { version = "0.7.18", features = ["compat"]}

 # A generic serialization/deserialization framework
-serde = { version = "1.0.229", features = ["derive"] }
-serde_json = "1.0.154"
+serde = { version = "1.0.228", features = ["derive"] }
+serde_json = "1.0.149"

 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric"] }
-diesel_migrations = "2.3.2"
+# Currently pinned diesel to v2.3.3 as newer version break MySQL/MariaDB compatibility
+diesel = { version = "2.3.7", features = ["chrono", "r2d2", "numeric"] }
+diesel_migrations = "2.3.1"

-derive_more = { version = "2.1.1", features = [
-    "as_ref",
-    "deref",
-    "display",
-    "from",
-    "into",
-] }
-diesel-derive-newtype = "2.1.3"
+derive_more = { version = "2.1.1", features = ["from", "into", "as_ref", "deref", "display"] }
+diesel-derive-newtype = "2.1.2"

-# SQLite, statically bundled unless the `sqlite_system` feature is enabled
-libsqlite3-sys = { version = "0.38.2", optional = true }
+# Bundled/Static SQLite
+libsqlite3-sys = { version = "0.36.0", features = ["bundled"], optional = true }

 # Crypto-related libraries
-rand = "0.10.3"
+rand = "0.10.1"
 ring = "0.17.14"
-rustls = { version = "0.23.46", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"

 # UUID generation
-uuid = { version = "1.28.0", features = ["v4"] }
+uuid = { version = "1.23.0", features = ["v4"] }

 # Date and time libraries
-chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
+chrono = { version = "0.4.44", features = ["clock", "serde"], default-features = false }
 chrono-tz = "0.10.4"
-time = "0.3.55"
+time = "0.3.47"

 # Job scheduler
-job_scheduler_ng = "2.5.0"
+job_scheduler_ng = "2.4.0"

 # Data encoding library Hex/Base32/Base64
-data-encoding = "2.11.1"
+data-encoding = "2.10.0"

 # JWT library
-jsonwebtoken = { version = "11.1.0", default-features = false, features = ["rust_crypto", "use_pem"] }
+jsonwebtoken = { version = "10.3.0", features = ["use_pem", "rust_crypto"], default-features = false }

 # TOTP library
 totp-lite = "2.0.1"

 # Yubico Library
-yubico_ng = { version = "1.0.0", default-features = false }
+yubico = { package = "yubico_ng", version = "0.14.1", features = ["online-tokio"], default-features = false }

 # WebAuthn libraries
 # danger-allow-state-serialisation is needed to save the state in the db
 # danger-credential-internals is needed to support U2F to Webauthn migration
-webauthn-rs = { version = "0.5.5", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
-webauthn-rs-proto = "0.5.5"
-webauthn-rs-core = "0.5.5"
+webauthn-rs = { version = "0.5.4", features = ["danger-allow-state-serialisation", "danger-credential-internals"] }
+webauthn-rs-proto = "0.5.4"
+webauthn-rs-core = "0.5.4"

 # Handling of URL's for WebAuthn and favicons
 url = "2.5.8"

 # Email libraries
-lettre = { version = "0.11.23", default-features = false, features = [
-    # Misc
-    "tracing",
-    "serde",
-    "builder",
-    "hostname",
-    # TLS/Security
-    "ring",
-    "rustls-native-certs",
-    "tokio1-rustls",
-    # Transport
-    "smtp-transport",
-    "sendmail-transport",
-] }
+lettre = { version = "0.11.21", features = ["smtp-transport", "sendmail-transport", "builder", "serde", "hostname", "tracing", "tokio1-rustls", "ring", "rustls-native-certs"], default-features = false }
 percent-encoding = "2.3.2" # URL encoding library used for URL's in the emails
 email_address = "0.2.9"

 # HTML Template library
-handlebars = { version = "6.4.4", features = ["dir_source"] }
+handlebars = { version = "6.4.0", features = ["dir_source"] }

 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.13.5", default-features = false, features = [
-    # Misc
-    "charset",
-    "cookies",
-    "http2",
-    "json",
-    "form",
-    "rustls-no-provider",
-    "stream",
-    # Compression
-    "brotli",
-    "deflate",
-    "gzip",
-    "zstd",
-    # Proxy
-    "socks",
-    "system-proxy",
-] }
-hickory-resolver = "0.26.3"
+reqwest = { version = "0.12.28", features = ["rustls-tls", "rustls-tls-native-roots", "stream", "json", "deflate", "gzip", "brotli", "zstd", "socks", "cookies", "charset", "http2", "system-proxy"], default-features = false}
+hickory-resolver = "0.25.2"

 # Favicon extraction libraries
-html5gum = "0.8.4"
-regex = { version = "1.13.1", default-features = false, features = [
-    "perf",
-    "std",
-    "unicode-perl",
-] }
+html5gum = "0.8.3"
+regex = { version = "1.12.3", features = ["std", "perf", "unicode-perl"], default-features = false }
 data-url = "0.3.2"
-bytes = "1.12.1"
-svg-hush = "0.9.7"
+bytes = "1.11.1"
+svg-hush = "0.9.6"

 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "4.0.3", features = ["async"] }
+cached = { version = "0.59.0", features = ["async"] }

 # Used for custom short lived cookie jar during favicon extraction
-cookie = "0.18.2"
+cookie = "0.18.1"
 cookie_store = "0.22.1"

 # Used by U2F, JWT and PostgreSQL
-openssl = "0.10.81"
+openssl = "0.10.76"

 # CLI argument parsing
 pico-args = "0.5.0"

 # Macro ident concatenation
-pastey = "0.2.3"
+pastey = "0.2.1"
 governor = "0.10.4"

-# CIDR parsing for the trusted proxies of the client IP header
-ipnet = "2.12.2"
-
 # OIDC for SSO
-openidconnect = { version = "4.0.1", default-features = false }
-moka = { version = "0.12.16", features = ["future"] }
+openidconnect = { version = "4.0.1", features = ["reqwest", "rustls-tls"] }
+moka = { version = "0.12.15", features = ["future"] }

 # Check client versions for specific features.
 semver = "1.0.28"

 # Allow overriding the default memory allocator
 # Mainly used for the musl builds, since the default musl malloc is very slow
-mimalloc = { version = "0.1.52", optional = true, default-features = false, features = ["secure"] }
+mimalloc = { version = "0.1.48", features = ["secure"], default-features = false, optional = true }

-which = "8.0.6"
+which = "8.0.2"

 # Argon2 library with support for the PHC format
-argon2 = "0.6.0"
+argon2 = "0.5.3"

 # Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
-rpassword = "7.5.4"
+rpassword = "7.4.0"

 # Loading a dynamic CSS Stylesheet
 grass_compiler = { version = "0.13.4", default-features = false }

 # File are accessed through Apache OpenDAL
-opendal = { version = "0.59.5", default-features = false, features = ["services-fs"] }
-opendal-http-transport-reqwest = { version = "0.59.5", default-features = false, features = ["rustls-no-provider"], optional = true }
+opendal = { version = "0.55.0", features = ["services-fs"], default-features = false }

 # For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.13.0", optional = true, default-features = false, features = [
-    "behavior-version-latest",
-    "credentials-process",
-    "rt-tokio",
-    "sso",
-] }
-aws-credential-types = { version = "1.3.1", optional = true }
-aws-smithy-runtime-api = { version = "1.19.1", optional = true }
-http = { version = "1.5.0", optional = true }
-reqsign-aws-v4 = { version = "3.3.1", optional = true }
-reqsign-core = { version = "3.3.2", optional = true }
+anyhow = { version = "1.0.102", optional = true }
+aws-config = { version = "1.8.15", features = ["behavior-version-latest", "rt-tokio", "credentials-process", "sso"], default-features = false, optional = true }
+aws-credential-types = { version = "1.2.14", optional = true }
+aws-smithy-runtime-api = { version = "1.11.6", optional = true }
+http = { version = "1.4.0", optional = true }
+reqsign = { version = "0.16.5", optional = true }

 # Strip debuginfo from the release builds
 # The debug symbols are to provide better panic traces
@@ -331,74 +262,75 @@ unsafe_code = "forbid"
 non_ascii_idents = "forbid"

 # Deny
-warnings = "deny" # Explicitly deny all warnings since we deny all warnings in the end
-
-# Deny lint groups
+deprecated_in_future = "deny"
 deprecated_safe = { level = "deny", priority = -1 }
 future_incompatible = { level = "deny", priority = -1 }
 keyword_idents = { level = "deny", priority = -1 }
 let_underscore = { level = "deny", priority = -1 }
 nonstandard_style = { level = "deny", priority = -1 }
+noop_method_call = "deny"
 refining_impl_trait = { level = "deny", priority = -1 }
 rust_2018_idioms = { level = "deny", priority = -1 }
 rust_2021_compatibility = { level = "deny", priority = -1 }
 rust_2024_compatibility = { level = "deny", priority = -1 }
-unused = { level = "deny", priority = -1 }
-
-# Deny individual lints
-closure_returning_async_block = "deny"
-deprecated_in_future = "deny"
 single_use_lifetimes = "deny"
 trivial_casts = "deny"
 trivial_numeric_casts = "deny"
+unused = { level = "deny", priority = -1 }
 unused_import_braces = "deny"
 unused_lifetimes = "deny"
 unused_qualifications = "deny"
 variant_size_differences = "deny"
+# Allow the following lints since these cause issues with Rust v1.84.0 or newer
+# Building Vaultwarden with Rust v1.85.0 with edition 2024 also works without issues
+edition_2024_expr_fragment_specifier = "allow" # Once changed to Rust 2024 this should be removed and macro's should be validated again
+if_let_rescope = "allow"
+tail_expr_drop_order = "allow"

 # https://rust-lang.github.io/rust-clippy/stable/index.html
 [workspace.lints.clippy]
-# Warn only so you can still use these during development, but not in the final code
+# Warn
 dbg_macro = "warn"
 todo = "warn"

 # Ignore/Allow
 result_large_err = "allow"

-# Warn on these lint group (Some might be warn by default already though)
-# Will be denied during CI!
-complexity = { level = "warn", priority = -1 }
-pedantic = { level = "warn", priority = -1 }
-perf = { level = "warn", priority = -1 }
-style = { level = "warn", priority = -1 }
-suspicious = { level = "warn", priority = -1 }
-
-# Deny individual lints
+# Deny
 branches_sharing_code = "deny"
+case_sensitive_file_extension_comparisons = "deny"
+cast_lossless = "deny"
 clone_on_ref_ptr = "deny"
 equatable_if_let = "deny"
+excessive_precision = "deny"
+filter_map_next = "deny"
 float_cmp_const = "deny"
+implicit_clone = "deny"
+inefficient_to_string = "deny"
 iter_on_empty_collections = "deny"
 iter_on_single_items = "deny"
+linkedlist = "deny"
+macro_use_imports = "deny"
+manual_assert = "deny"
+manual_instant_elapsed = "deny"
+manual_string_new = "deny"
+match_wildcard_for_single_variants = "deny"
 mem_forget = "deny"
+needless_borrow = "deny"
 needless_collect = "deny"
+needless_continue = "deny"
+needless_lifetimes = "deny"
+option_option = "deny"
 redundant_clone = "deny"
+string_add_assign = "deny"
+unnecessary_join = "deny"
 unnecessary_self_imports = "deny"
+unnested_or_patterns = "deny"
+unused_async = "deny"
+unused_self = "deny"
 useless_let_if_seq = "deny"
 verbose_file_reads = "deny"
-str_to_string = "deny"
-
-# Pedantic Opt-Outs
-inline_always = "allow" # We use this sparsely
-struct_field_names = "allow" # Noisy and some items are Bitwarden controlled
-large_futures = "allow" # Causes a fail in some Rocket macro's, since we experience no issues, allow it
-too_many_lines = "allow" # For now, allow this, good to enable in the future and see if we can refactor
-unnecessary_wraps = "allow" # Too much false positives because of Rocket integrations
-# We do not use these doc items
-doc_link_with_quotes = "allow"
-doc_markdown = "allow"
-missing_errors_doc = "allow"
-missing_panics_doc = "allow"
+zero_sized_map_values = "deny"

 [lints]
 workspace = true
@@ -59,9 +59,8 @@ A nearly complete implementation of the Bitwarden Client API is provided, includ
 ## Usage

 > [!IMPORTANT]
-> The web-vault requires the use of HTTPS and a secure context for the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API). <br>
-> That means it will only work if you [enable HTTPS](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS). <br>
-> We also suggest to use a [reverse proxy](https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples).
+> The web-vault requires the use a secure context for the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API).
+> That means it will only work via `http://localhost:8000` (using the port from the example below) or if you [enable HTTPS](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS).

 The recommended way to install and use Vaultwarden is via our container images which are published to [ghcr.io](https://github.com/dani-garcia/vaultwarden/pkgs/container/vaultwarden), [docker.io](https://hub.docker.com/r/vaultwarden/server) and [quay.io](https://quay.io/repository/vaultwarden/server).
 See [which container image to use](https://github.com/dani-garcia/vaultwarden/wiki/Which-container-image-to-use) for an explanation of the provided tags.
@@ -1,21 +1,22 @@
-use std::{env, io::Error, process::Command};
+use std::env;
+use std::process::Command;

 fn main() {
-    // These allow using e.g. #[cfg(mysql)] instead of #[cfg(feature = "mysql")], which helps when trying to add them through macros
-    #[cfg(feature = "sqlite_system")] // The `sqlite` feature implies this one.
+    // This allow using #[cfg(sqlite)] instead of #[cfg(feature = "sqlite")], which helps when trying to add them through macros
+    #[cfg(feature = "sqlite")]
    println!("cargo:rustc-cfg=sqlite");
    #[cfg(feature = "mysql")]
    println!("cargo:rustc-cfg=mysql");
    #[cfg(feature = "postgresql")]
    println!("cargo:rustc-cfg=postgresql");
-    #[cfg(not(any(feature = "sqlite_system", feature = "mysql", feature = "postgresql")))]
+    #[cfg(feature = "s3")]
+    println!("cargo:rustc-cfg=s3");
+
+    #[cfg(not(any(feature = "sqlite", feature = "mysql", feature = "postgresql")))]
    compile_error!(
        "You need to enable one DB backend. To build with previous defaults do: cargo build --features sqlite"
    );

-    #[cfg(feature = "s3")]
-    println!("cargo:rustc-cfg=s3");
-
    // Use check-cfg to let cargo know which cfg's we define,
    // and avoid warnings when they are used in the code.
    println!("cargo::rustc-check-cfg=cfg(sqlite)");
@@ -41,12 +42,13 @@ fn main() {
    }
 }

-fn run(args: &[&str]) -> Result<String, Error> {
+fn run(args: &[&str]) -> Result<String, std::io::Error> {
    let out = Command::new(args[0]).args(&args[1..]).output()?;
    if !out.status.success() {
+        use std::io::Error;
        return Err(Error::other("Command not successful"));
    }
-    Ok(String::from_utf8(out.stdout).unwrap().trim().to_owned())
+    Ok(String::from_utf8(out.stdout).unwrap().trim().to_string())
 }

 /// This method reads info from Git, namely tags, branch, and revision
@@ -56,7 +58,7 @@ fn run(args: &[&str]) -> Result<String, Error> {
 ///    - `env!("GIT_BRANCH")`
 ///    - `env!("GIT_REV")`
 ///    - `env!("VW_VERSION")`
-fn version_from_git_info() -> Result<String, Error> {
+fn version_from_git_info() -> Result<String, std::io::Error> {
    // The exact tag for the current commit, can be empty when
    // the current commit doesn't have an associated tag
    let exact_tag = run(&["git", "describe", "--abbrev=0", "--tags", "--exact-match"]).ok();
@@ -1,14 +1,13 @@
 ---
-vault_version: "v2026.8.0"
-vault_image_digest: "sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a"
-# Cross Compile Docker Helper Scripts v1.10.0
+vault_version: "v2026.2.0"
+vault_image_digest: "sha256:37c8661fa59dcdfbd3baa8366b6e950ef292b15adfeff1f57812b075c1fd3447"
+# Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
-xx_image_digest: "sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6"
-# The `rust_version` variable is extracted from `rust-toolchain.toml`
-# rust_version: x.yy.z # Rust version to be used
+xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
+rust_version: 1.94.1 # Rust version to be used
 debian_version: trixie # Debian release name to be used
-alpine_version: "3.24" # Alpine version to be used
+alpine_version: "3.23" # Alpine version to be used
 # For which platforms/architectures will we try to build images
 platforms: ["linux/amd64", "linux/arm64", "linux/arm/v7", "linux/arm/v6"]
 # Determine the build images per OS/Arch
@@ -19,23 +19,23 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
-#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.2.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.2.0
+#     [docker.io/vaultwarden/web-vault@sha256:37c8661fa59dcdfbd3baa8366b6e950ef292b15adfeff1f57812b075c1fd3447]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
-#     [docker.io/vaultwarden/web-vault:v2026.8.0]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:37c8661fa59dcdfbd3baa8366b6e950ef292b15adfeff1f57812b075c1fd3447
+#     [docker.io/vaultwarden/web-vault:v2026.2.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:37c8661fa59dcdfbd3baa8366b6e950ef292b15adfeff1f57812b075c1fd3447 AS vault

 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.99.1 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.99.1 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.99.1 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.99.1 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.94.1 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.94.1 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.94.1 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.94.1 AS build_armv6

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -57,6 +57,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
    # Debian Trixie uses libpq v17
    PQ_LIB_DIR="/usr/local/musl/pq17/lib"

+
 # Create CARGO_HOME folder and don't download rust docs
 RUN mkdir -pv "${CARGO_HOME}" && \
    rustup set profile minimal
@@ -66,11 +67,11 @@ RUN USER=root cargo new --bin /app
 WORKDIR /app

 # Environment variables for Cargo on Alpine based builds
-RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
+RUN echo "export CARGO_TARGET=${RUST_MUSL_CROSS_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo

-RUN . /env-cargo && \
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"

 # Copies over *only* your manifests and build files
@@ -86,7 +87,7 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
    find . -not -path "./target*" -delete

@@ -97,13 +98,13 @@ COPY . .
 ARG VW_VERSION

 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -126,8 +127,7 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
-# hadolint ignore=DL3065
-FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.24
+FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.23

 ENV ROCKET_PROFILE="release" \
    ROCKET_ADDRESS=0.0.0.0 \
@@ -19,25 +19,24 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.8.0
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.8.0
-#     [docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a]
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.2.0
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.2.0
+#     [docker.io/vaultwarden/web-vault@sha256:37c8661fa59dcdfbd3baa8366b6e950ef292b15adfeff1f57812b075c1fd3447]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a
-#     [docker.io/vaultwarden/web-vault:v2026.8.0]
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:37c8661fa59dcdfbd3baa8366b6e950ef292b15adfeff1f57812b075c1fd3447
+#     [docker.io/vaultwarden/web-vault:v2026.2.0]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:632375471c7c06a799335cd74dfeaef63f92f45f9cd322c337ae7ad70081e48a AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:37c8661fa59dcdfbd3baa8366b6e950ef292b15adfeff1f57812b075c1fd3447 AS vault

 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
 ## And these bash scripts do not have any significant difference if at all
-FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6 AS xx
+FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.99.1-slim-trixie AS build
-# hadolint ignore=DL3067
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.94.1-slim-trixie AS build
 COPY --from=xx / /
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -52,7 +51,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
    TERM=xterm-256color \
    CARGO_HOME="/root/.cargo" \
    USER="root"
-# Install clang && xx-c-essentials to get `xx-cargo` working
+# Install clang to get `xx-cargo` working
 # Install pkg-config to allow amd64 builds to find all libraries
 # Install git so build.rs can determine the correct version
 # Install the libc cross packages based upon the debian-arch
@@ -60,16 +59,19 @@ RUN apt-get update && \
    apt-get install -y \
        --no-install-recommends \
        clang \
-        git && \
+        pkg-config \
+        git \
+        "libc6-$(xx-info debian-arch)-cross" \
+        "libc6-dev-$(xx-info debian-arch)-cross" \
+        "linux-libc-dev-$(xx-info debian-arch)-cross" && \
    xx-apt-get install -y \
        --no-install-recommends \
+        gcc \
        libpq-dev \
        libpq5 \
        libssl-dev \
        libmariadb-dev \
-        pkg-config \
-        zlib1g-dev \
-        xx-c-essentials && \
+        zlib1g-dev && \
    # Run xx-cargo early, since it sometimes seems to break when run at a later stage
    echo "export CARGO_TARGET=$(xx-cargo --print-target-triple)" >> /env-cargo

@@ -81,7 +83,30 @@ RUN mkdir -pv "${CARGO_HOME}" && \
 RUN USER=root cargo new --bin /app
 WORKDIR /app

-RUN . /env-cargo && \
+# Environment variables for Cargo on Debian based builds
+ARG TARGET_PKG_CONFIG_PATH
+
+RUN source /env-cargo && \
+    if xx-info is-cross ; then \
+        # We can't use xx-cargo since that uses clang, which doesn't work for our libraries.
+        # Because of this we generate the needed environment variables here which we can load in the needed steps.
+        echo "export CC_$(echo "${CARGO_TARGET}" | tr '[:upper:]' '[:lower:]' | tr - _)=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
+        echo "export CARGO_TARGET_$(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_LINKER=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
+        echo "export CROSS_COMPILE=1" >> /env-cargo && \
+        echo "export PKG_CONFIG_ALLOW_CROSS=1" >> /env-cargo && \
+        # For some architectures `xx-info` returns a triple which doesn't matches the path on disk
+        # In those cases you can override this by setting the `TARGET_PKG_CONFIG_PATH` build-arg
+        if [[ -n "${TARGET_PKG_CONFIG_PATH}" ]]; then \
+            echo "export TARGET_PKG_CONFIG_PATH=${TARGET_PKG_CONFIG_PATH}" >> /env-cargo ; \
+        else \
+            echo "export PKG_CONFIG_PATH=/usr/lib/$(xx-info)/pkgconfig" >> /env-cargo ; \
+        fi && \
+        echo "# End of env-cargo" >> /env-cargo ; \
+    fi && \
+    # Output the current contents of the file
+    cat /env-cargo
+
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"

 # Copies over *only* your manifests and build files
@@ -96,23 +121,8 @@ ARG DB=sqlite,mysql,postgresql
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
-    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
-    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
-    # https://github.com/dani-garcia/vaultwarden/discussions/7522
-    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
-    fi && \
-    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
-    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
-    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
-    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
-    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
-    if [ "$(xx-info arch)" = "arm64" ]; then \
-        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
-    fi && \
-    export XX_RUSTFLAGS && \
-    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
+RUN source /env-cargo && \
+    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
    find . -not -path "./target*" -delete

 # Copies the complete project
@@ -122,28 +132,13 @@ COPY . .
 ARG VW_VERSION

 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
-    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
-    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
-    # https://github.com/dani-garcia/vaultwarden/discussions/7522
-    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
-    fi && \
-    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
-    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
-    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
-    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
-    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
-    if [ "$(xx-info arch)" = "arm64" ]; then \
-        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
-    fi && \
-    export XX_RUSTFLAGS && \
-    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -166,7 +161,6 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
-# hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim

 ENV ROCKET_PROFILE="release" \
@@ -27,24 +27,6 @@
 #     $ docker image inspect --format "{{ '{{' }}.RepoTags}}" docker.io/vaultwarden/web-vault@{{ vault_image_digest }}
 #     [docker.io/vaultwarden/web-vault:{{ vault_version | replace('+', '_') }}]
 #
-{% macro xx_cargo_config() -%}
-# Configure xx-cargo for target pkg-config and Debian transitive library lookup
-    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
-    # https://github.com/dani-garcia/vaultwarden/discussions/7522
-    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
-    fi && \
-    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
-    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
-    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
-    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
-    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
-    if [ "$(xx-info arch)" = "arm64" ]; then \
-        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
-    fi && \
-    export XX_RUSTFLAGS && \
-    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}"
-{%- endmacro %}
 FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault

 {% if base == "debian" %}
@@ -65,7 +47,6 @@ FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].arch_image[arch] }} AS
 # hadolint ignore=DL3006
 FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].image }} AS build
 {% if base == "debian" %}
-# hadolint ignore=DL3067
 COPY --from=xx / /
 {% endif %}
 ARG TARGETARCH
@@ -85,10 +66,10 @@ ENV DEBIAN_FRONTEND=noninteractive \
    # Use PostgreSQL v17 during Alpine/MUSL builds instead of the default v16
    # Debian Trixie uses libpq v17
    PQ_LIB_DIR="/usr/local/musl/pq17/lib"
-{%- endif %}
+{% endif %}

 {% if base == "debian" %}
-# Install clang && xx-c-essentials to get `xx-cargo` working
+# Install clang to get `xx-cargo` working
 # Install pkg-config to allow amd64 builds to find all libraries
 # Install git so build.rs can determine the correct version
 # Install the libc cross packages based upon the debian-arch
@@ -96,16 +77,19 @@ RUN apt-get update && \
    apt-get install -y \
        --no-install-recommends \
        clang \
-        git && \
+        pkg-config \
+        git \
+        "libc6-$(xx-info debian-arch)-cross" \
+        "libc6-dev-$(xx-info debian-arch)-cross" \
+        "linux-libc-dev-$(xx-info debian-arch)-cross" && \
    xx-apt-get install -y \
        --no-install-recommends \
+        gcc \
        libpq-dev \
        libpq5 \
        libssl-dev \
        libmariadb-dev \
-        pkg-config \
-        zlib1g-dev \
-        xx-c-essentials && \
+        zlib1g-dev && \
    # Run xx-cargo early, since it sometimes seems to break when run at a later stage
    echo "export CARGO_TARGET=$(xx-cargo --print-target-triple)" >> /env-cargo
 {% endif %}
@@ -118,14 +102,38 @@ RUN mkdir -pv "${CARGO_HOME}" && \
 RUN USER=root cargo new --bin /app
 WORKDIR /app

-{% if base == "alpine" %}
+{% if base == "debian" %}
+# Environment variables for Cargo on Debian based builds
+ARG TARGET_PKG_CONFIG_PATH
+
+RUN source /env-cargo && \
+    if xx-info is-cross ; then \
+        # We can't use xx-cargo since that uses clang, which doesn't work for our libraries.
+        # Because of this we generate the needed environment variables here which we can load in the needed steps.
+        echo "export CC_$(echo "${CARGO_TARGET}" | tr '[:upper:]' '[:lower:]' | tr - _)=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
+        echo "export CARGO_TARGET_$(echo "${CARGO_TARGET}" | tr '[:lower:]' '[:upper:]' | tr - _)_LINKER=/usr/bin/$(xx-info)-gcc" >> /env-cargo && \
+        echo "export CROSS_COMPILE=1" >> /env-cargo && \
+        echo "export PKG_CONFIG_ALLOW_CROSS=1" >> /env-cargo && \
+        # For some architectures `xx-info` returns a triple which doesn't matches the path on disk
+        # In those cases you can override this by setting the `TARGET_PKG_CONFIG_PATH` build-arg
+        if [[ -n "${TARGET_PKG_CONFIG_PATH}" ]]; then \
+            echo "export TARGET_PKG_CONFIG_PATH=${TARGET_PKG_CONFIG_PATH}" >> /env-cargo ; \
+        else \
+            echo "export PKG_CONFIG_PATH=/usr/lib/$(xx-info)/pkgconfig" >> /env-cargo ; \
+        fi && \
+        echo "# End of env-cargo" >> /env-cargo ; \
+    fi && \
+    # Output the current contents of the file
+    cat /env-cargo
+
+{% elif base == "alpine" %}
 # Environment variables for Cargo on Alpine based builds
-RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
+RUN echo "export CARGO_TARGET=${RUST_MUSL_CROSS_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo

 {% endif %}
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"

 # Copies over *only* your manifests and build files
@@ -145,12 +153,8 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
-{% if base == "debian" %}
-    {{ xx_cargo_config() }} && \
-{% elif base == "alpine" %}
+RUN source /env-cargo && \
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
-{% endif %}
    find . -not -path "./target*" -delete

 # Copies the complete project
@@ -160,17 +164,13 @@ COPY . .
 ARG VW_VERSION

 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
-{% if base == "debian" %}
-    {{ xx_cargo_config() }} && \
-{% elif base == "alpine" %}
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
-{% endif %}
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -193,7 +193,6 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
-# hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM {{ runtime_stage_image[base] }}

 ENV ROCKET_PROFILE="release" \
@@ -15,7 +15,6 @@ Some unsupported platforms for Debian based images. These are not built and test
 - 386     (linux/386)
 - ppc64le (linux/ppc64le)
 - s390x   (linux/s390x)
- riscv64 (linux/riscv64)

 To build these containers you need to enable QEMU binfmt support to be able to run/emulate architectures which are different then your host.<br>
 This ensures the container build process can run binaries from other architectures.<br>
@@ -148,12 +148,6 @@ target "debian-s390x" {
  platforms = ["linux/s390x"]
  tags = generate_tags("", "-s390x")
 }
-
-target "debian-riscv64" {
-  inherits = ["debian"]
-  platforms = ["linux/riscv64"]
-  tags = generate_tags("", "-riscv64")
-}
 // ==== End of unsupported Debian architecture targets ===

 // A Group to build all platforms individually for local testing
@@ -3,23 +3,17 @@
 import os
 import argparse
 import json
-import tomllib
 import yaml
 import jinja2

 # Load settings file
-with open('DockerSettings.yaml', 'r', encoding='utf-8') as yaml_file:
+with open("DockerSettings.yaml", 'r') as yaml_file:
 	yaml_data = yaml.safe_load(yaml_file)

-# Extract the rust_version from the rust-toolchain.toml file
-script_dir = os.path.dirname(os.path.abspath(__file__))
-with open(os.path.join(script_dir, '..', 'rust-toolchain.toml'), 'rb') as toolchain_file:
-    yaml_data["rust_version"] = tomllib.load(toolchain_file)["toolchain"]["channel"]
-
 settings_env = jinja2.Environment(
 	loader=jinja2.FileSystemLoader(os.getcwd()),
 )
-settings_yaml = yaml.safe_load(settings_env.get_template('DockerSettings.yaml').render(yaml_data))
+settings_yaml = yaml.safe_load(settings_env.get_template("DockerSettings.yaml").render(yaml_data))

 args_parser = argparse.ArgumentParser()
 args_parser.add_argument('template_file', help='Jinja2 template file to render.')
@@ -13,8 +13,8 @@ path = "src/lib.rs"
 proc-macro = true

 [dependencies]
-quote = "1.0.47"
-syn = "3.0.9"
+quote = "1.0.45"
+syn = "2.0.117"

 [lints]
 workspace = true
@@ -1,15 +1,14 @@
 use proc_macro::TokenStream;
 use quote::quote;
-use syn::{DeriveInput, parse_macro_input};

 #[proc_macro_derive(UuidFromParam)]
 pub fn derive_uuid_from_param(input: TokenStream) -> TokenStream {
-    let ast = parse_macro_input!(input as DeriveInput);
+    let ast = syn::parse(input).unwrap();

    impl_derive_uuid_macro(&ast)
 }

-fn impl_derive_uuid_macro(ast: &DeriveInput) -> TokenStream {
+fn impl_derive_uuid_macro(ast: &syn::DeriveInput) -> TokenStream {
    let name = &ast.ident;
    let gen_derive = quote! {
        #[automatically_derived]
@@ -31,12 +30,12 @@ fn impl_derive_uuid_macro(ast: &DeriveInput) -> TokenStream {

 #[proc_macro_derive(IdFromParam)]
 pub fn derive_id_from_param(input: TokenStream) -> TokenStream {
-    let ast = parse_macro_input!(input as DeriveInput);
+    let ast = syn::parse(input).unwrap();

    impl_derive_safestring_macro(&ast)
 }

-fn impl_derive_safestring_macro(ast: &DeriveInput) -> TokenStream {
+fn impl_derive_safestring_macro(ast: &syn::DeriveInput) -> TokenStream {
    let name = &ast.ident;
    let gen_derive = quote! {
        #[automatically_derived]
@@ -1 +0,0 @@
-ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1,31 +1,15 @@
-SELECT if (
-    EXISTS(
-        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
-            WHERE TABLE_SCHEMA = DATABASE()
-                AND TABLE_NAME = 'sso_users'
-                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
-                AND CONSTRAINT_NAME = 'sso_users_ibfk_1'
-    )
-    ,'ALTER TABLE sso_users DROP FOREIGN KEY `sso_users_ibfk_1`'
-    ,'SELECT "info: FK sso_users_ibfk_1 does not exist."'
-) INTO @drop_stmt;
-PREPARE drop_stmt FROM @drop_stmt;
-EXECUTE drop_stmt;
-
-SELECT if (
-    EXISTS(
-        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
-            WHERE TABLE_SCHEMA = DATABASE()
-                AND TABLE_NAME = 'sso_users'
-                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
-                AND CONSTRAINT_NAME = '1'
-    )
-    ,'ALTER TABLE sso_users DROP FOREIGN KEY `1`'
-    ,'SELECT "info: FK sso_users 1 does not exist."'
-) INTO @drop_stmt;
-PREPARE drop_stmt FROM @drop_stmt;
-EXECUTE drop_stmt;
-
-DEALLOCATE PREPARE drop_stmt;
+-- Dynamically create DROP FOREIGN KEY
+-- Some versions of MySQL or MariaDB might fail if the key doesn't exists
+-- This checks if the key exists, and if so, will drop it.
+SET @drop_sso_fk = IF((SELECT true FROM information_schema.TABLE_CONSTRAINTS WHERE
+    CONSTRAINT_SCHEMA = DATABASE() AND
+    TABLE_NAME = 'sso_users' AND
+    CONSTRAINT_NAME = 'sso_users_ibfk_1' AND
+    CONSTRAINT_TYPE = 'FOREIGN KEY') = true,
+    'ALTER TABLE sso_users DROP FOREIGN KEY sso_users_ibfk_1',
+    'SELECT 1');
+PREPARE stmt FROM @drop_sso_fk;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;

 ALTER TABLE sso_users ADD FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE;
@@ -1 +0,0 @@
-DROP TABLE IF EXISTS archives;
@@ -1,10 +0,0 @@
-DROP TABLE IF EXISTS archives;
-
-CREATE TABLE archives (
-    user_uuid   CHAR(36) NOT NULL,
-    cipher_uuid CHAR(36) NOT NULL,
-    archived_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    PRIMARY KEY (user_uuid, cipher_uuid),
-    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE,
-    FOREIGN KEY (cipher_uuid) REFERENCES ciphers (uuid) ON DELETE CASCADE
-);
@@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN binding_hash;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN code_response_error;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN code_response_error TEXT;
@@ -1 +0,0 @@
-ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1 +0,0 @@
-ALTER TABLE org_policies DROP COLUMN revision_date;
@@ -1,7 +0,0 @@
-- DATETIME (not TIMESTAMP) to match this repo's convention for revision_date
-- columns elsewhere, and to avoid MySQL's implicit session-timezone
-- conversion and 2038 range limit on TIMESTAMP.
-ALTER TABLE org_policies
-ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = UTC_TIMESTAMP();
@@ -1 +0,0 @@
-DROP TABLE IF EXISTS archives;
@@ -1,8 +0,0 @@
-DROP TABLE IF EXISTS archives;
-
-CREATE TABLE archives (
-    user_uuid   CHAR(36) NOT NULL REFERENCES users (uuid) ON DELETE CASCADE,
-    cipher_uuid CHAR(36) NOT NULL REFERENCES ciphers (uuid) ON DELETE CASCADE,
-    archived_at TIMESTAMP NOT NULL DEFAULT now(),
-    PRIMARY KEY (user_uuid, cipher_uuid)
-);
@@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN binding_hash;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN IF EXISTS code_response_error;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN IF NOT EXISTS code_response_error TEXT;
@@ -1 +0,0 @@
-ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1 +0,0 @@
-ALTER TABLE org_policies DROP COLUMN revision_date;
@@ -1,9 +0,0 @@
-- Backfill via `now() AT TIME ZONE 'utc'` rather than a DEFAULT of now():
-- assigning timestamptz now() into a naive TIMESTAMP column casts through
-- the server's TimeZone GUC, so a DEFAULT now() would store local wall-clock
-- instead of UTC on non-UTC servers, unlike every other naive-UTC timestamp
-- column in this schema.
-ALTER TABLE org_policies
-ADD COLUMN revision_date TIMESTAMP NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = (now() AT TIME ZONE 'utc');
@@ -1 +0,0 @@
-DROP TABLE IF EXISTS archives;
@@ -1,8 +0,0 @@
-DROP TABLE IF EXISTS archives;
-
-CREATE TABLE archives (
-    user_uuid   CHAR(36) NOT NULL REFERENCES users (uuid) ON DELETE CASCADE,
-    cipher_uuid CHAR(36) NOT NULL REFERENCES ciphers (uuid) ON DELETE CASCADE,
-    archived_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    PRIMARY KEY (user_uuid, cipher_uuid)
-);
@@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN binding_hash;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth DROP COLUMN code_response_error;
@@ -1 +0,0 @@
-ALTER TABLE sso_auth ADD COLUMN code_response_error TEXT;
@@ -1 +0,0 @@
-ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1,6 +0,0 @@
-- SQLite forbids non-constant defaults in ALTER TABLE ... ADD COLUMN, so add
-- the column with a constant placeholder and backfill separately.
-ALTER TABLE org_policies
-ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
-
-UPDATE org_policies SET revision_date = CURRENT_TIMESTAMP;
@@ -21,19 +21,11 @@ TEST_USER3=test3
 TEST_USER3_PASSWORD=${TEST_USER3}
 TEST_USER3_MAIL=${TEST_USER3}@yopmail.com

-TEST_USER4=test4
-TEST_USER4_PASSWORD=${TEST_USER4}
-TEST_USER4_MAIL=${TEST_USER4}@yopmail.com
-
-TEST_USER5=test5
-TEST_USER5_PASSWORD=${TEST_USER5}
-TEST_USER5_MAIL=${TEST_USER5}@yopmail.com
-
 ###################
 # Keycloak Config #
 ###################
-KC_BOOTSTRAP_ADMIN_USERNAME=admin
-KC_BOOTSTRAP_ADMIN_PASSWORD=${KC_BOOTSTRAP_ADMIN_USERNAME}
+KEYCLOAK_ADMIN=admin
+KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
 KC_HTTP_HOST=127.0.0.1
 KC_HTTP_PORT=8080

@@ -47,10 +39,8 @@ DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
 ######################
 ROCKET_ADDRESS=0.0.0.0
 ROCKET_PORT=8000
-ROCKET_TLS={certs="/data/ssl/localhost.crt",key="/data/ssl/localhost.key"}
-DOMAIN=https://127.0.0.1:${ROCKET_PORT}
+DOMAIN=http://localhost:${ROCKET_PORT}
 LOG_LEVEL=info,oidcwarden::sso=debug
-SSO_DEBUG_TOKENS=true
 I_REALLY_WANT_VOLATILE_STORAGE=true

 SSO_ENABLED=true
@@ -1,8 +1,8 @@
 # Integration tests

 This allows running integration tests using [Playwright](https://playwright.dev/).
-\
-It uses its own [test.env](./test.env) with different ports to not collide with a running dev instance.
+
+It uses its own `test.env` with different ports to not collide with a running dev instance.

 ## Install

@@ -11,11 +11,11 @@ Databases (`Mariadb`, `Mysql` and `Postgres`) and `Playwright` will run in conta

 ### Running Playwright outside docker

-It's possible to run `Playwright` outside of the container, this remove the need to rebuild the image for each change.
-You'll additionally need `nodejs` then run:
+It is possible to run `Playwright` outside of the container, this removes the need to rebuild the image for each change.
+You will additionally need `nodejs` then run:

 ```bash
-npm ci --ignore-scripts --allow-git=none --allow-remote=none
+npm ci --ignore-scripts
 npx playwright install-deps
 npx playwright install firefox
 ```
@@ -62,10 +62,10 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl

 ### Keep services running

-If you want you can keep the DB and Keycloak running (states are not impacted by the tests):
+If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):

 ```bash
-PW_KEEP_SERVICE_RUNNING=true npx playwright test
+PW_KEEP_SERVICE_RUNNNING=true npx playwright test
 ```

 ### Running specific tests
@@ -77,7 +77,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite login
 ```

-To run only a specific test (It might fail if it has dependency):
+To run only a specifc test (It might fail if it has dependency):

 ```bash
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite -g "Account creation"
@@ -92,7 +92,7 @@ This does not start the server, you will need to start it manually.

 ```bash
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
-npx playwright codegen "https://127.0.0.1:8000" --ignore-https-errors
+npx playwright codegen "http://127.0.0.1:8003"
 ```

 ## Override web-vault
@@ -112,11 +112,12 @@ You can check the result running:
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
 ```

-Then check `https://127.0.0.1:8003/admin/diagnostics` with `admin`.
+Then check `http://127.0.0.1:8003/admin/diagnostics` with `admin`.

 # OpenID Connect test setup

-Additionally this `docker-compose` template allow to run locally `Vaultwarden`, [Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.
+Additionally this `docker-compose` template allows to run locally Vaultwarden,
+[Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.

 ## Setup

@@ -130,17 +131,18 @@ Then start the stack (the `profile` is required to run `Vaultwarden`) :
 ```bash
 > docker compose --profile vaultwarden --env-file .env up
 ....
-keycloakSetup_1  | Logging into https://127.0.0.1:8080 as user admin of realm master
+keycloakSetup_1  | Logging into http://127.0.0.1:8080 as user admin of realm master
 keycloakSetup_1  | Created new realm with id 'test'
 keycloakSetup_1  | 74af4933-e386-4e64-ba15-a7b61212c45e
 oidc_keycloakSetup_1 exited with code 0
 ```

-Wait until `oidc_keycloakSetup_1 exited with code 0` which indicate the correct setup of the Keycloak realm, client and user (It's normal for this container to stop once the configuration is done).
+Wait until `oidc_keycloakSetup_1 exited with code 0` which indicates the correct setup of the Keycloak realm, client and user
+(It is normal for this container to stop once the configuration is done).

 Then you can access :

- `Vaultwarden` on https://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
+- `Vaultwarden` on http://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
 - `Keycloak` on http://0.0.0.0:8080/admin/master/console/ with the default user `admin/admin`
 - `Maildev` on http://0.0.0.0:1080

@@ -169,7 +171,7 @@ docker compose --profile vaultwarden --env-file .env build VaultwardenPrebuild V
 All configuration for `keycloak` / `Vaultwarden` / `keycloak_setup.sh` can be found in [.env](.env.template).
 The content of the file will be loaded as environment variables in all containers.

- `keycloak` [configuration](https://www.keycloak.org/server/all-config) include `KC_BOOTSTRAP_ADMIN_USERNAME` / `KC_BOOTSTRAP_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
+- `keycloak` [configuration](https://www.keycloak.org/server/all-config) includes `KEYCLOAK_ADMIN` / `KEYCLOAK_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
 - All `Vaultwarden` configuration can be set (EX: `SMTP_*`)

 ## Cleanup
@@ -17,7 +17,7 @@ done

 set -e

-kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KC_BOOTSTRAP_ADMIN_USERNAME" --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" --client admin-cli
+kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli

 kcadm.sh create realms -s realm="$TEST_REALM" -s enabled=true -s "accessTokenLifespan=600"
 kcadm.sh create clients -r test -s "clientId=$SSO_CLIENT_ID" -s "secret=$SSO_CLIENT_SECRET" -s "redirectUris=[\"$DOMAIN/*\"]" -i
@@ -39,6 +39,6 @@ kcadm.sh create realms -s realm="$DUMMY_REALM" -s enabled=true -s "accessTokenLi
 # THEN in another terminal:
 # docker exec -it keycloakSetup-dev /bin/bash
 # export PATH=$PATH:/opt/keycloak/bin
-# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KC_BOOTSTRAP_ADMIN_USERNAME" --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" --client admin-cli
+# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
 # ENJOY
 # Doc: https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/admin-cli.html
@@ -28,7 +28,7 @@ RUN mkdir /playwright
 WORKDIR /playwright

 COPY package.json package-lock.json .
-RUN npm ci --ignore-scripts --allow-git=none --allow-remote=none && npx playwright install-deps && npx playwright install firefox
+RUN npm ci --ignore-scripts && npx playwright install-deps && npx playwright install firefox

 COPY docker-compose.yml test.env ./
 COPY compose ./compose
@@ -35,7 +35,6 @@ WORKDIR /

 COPY --from=prebuilt /start.sh .
 COPY --from=prebuilt /vaultwarden .
-COPY --from=build /data ./data
 COPY --from=build /web-vault ./web-vault

 ENTRYPOINT ["/start.sh"]
@@ -22,14 +22,3 @@ if [[ ! -z "$REPO_URL" ]] && [[ ! -z "$COMMIT_HASH" ]] ; then

    mv build /web-vault
 fi
-
-# Lower the KDF iterations default for faster tests.
-sed -i 's/(6e5,2e6,6e5)/(1e5,2e6,1e5)/' /web-vault/app/main.*.js
-
-# Generate a self signed cert
-mkdir -p /data/ssl; cd /data/ssl
-
-openssl req -x509 -out localhost.crt -keyout localhost.key \
-  -newkey rsa:2048 -nodes -sha256 \
-  -subj '/CN=localhost' -extensions EXT -config <( \
-   printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
@@ -24,15 +24,12 @@ services:
    environment:
      - ADMIN_TOKEN
      - DATABASE_URL
-      - CLIENT_SUPPRESS_ONBOARDING
-      - EMAIL_2FA_AUTO_FALLBACK
      - I_REALLY_WANT_VOLATILE_STORAGE
      - LOG_LEVEL
      - LOGIN_RATELIMIT_MAX_BURST
      - SMTP_HOST
      - SMTP_FROM
      - SMTP_DEBUG
-      - SSO_AUTH_ONLY_NOT_SESSION
      - SSO_DEBUG_TOKENS
      - SSO_ENABLED
      - SSO_FRONTEND
@@ -61,7 +58,7 @@ services:
  Mariadb:
    profiles: ["playwright"]
    container_name: playwright_mariadb
-    image: mariadb:12.2.2
+    image: mariadb:11.2.4
    env_file: test.env
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
@@ -73,7 +70,7 @@ services:
  Mysql:
    profiles: ["playwright"]
    container_name: playwright_mysql
-    image: mysql:9.7.0
+    image: mysql:8.4.1
    env_file: test.env
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
@@ -85,7 +82,7 @@ services:
  Postgres:
    profiles: ["playwright"]
    container_name: playwright_postgres
-    image: postgres:18.4
+    image: postgres:16.3
    env_file: test.env
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
@@ -97,7 +94,7 @@ services:
  Maildev:
    profiles: ["vaultwarden", "maildev"]
    container_name: maildev
-    image: timshel/maildev:3.2.19
+    image: timshel/maildev:3.0.4
    ports:
      - ${SMTP_PORT}:1025
      - 1080:1080
@@ -105,7 +102,7 @@ services:
  Keycloak:
    profiles: ["keycloak", "vaultwarden"]
    container_name: keycloak-${ENV:-dev}
-    image: quay.io/keycloak/keycloak:26.6.2
+    image: quay.io/keycloak/keycloak:26.3.4
    network_mode: "host"
    command:
      - start-dev
@@ -115,12 +112,12 @@ services:
    profiles: ["keycloak", "vaultwarden"]
    container_name: keycloakSetup-${ENV:-dev}
    image: keycloak_setup-${ENV:-dev}
-    network_mode: "host"
    build:
      context: compose/keycloak
      dockerfile: Dockerfile
      args:
-        KEYCLOAK_VERSION: 26.6.2
+        KEYCLOAK_VERSION: 26.3.4
+    network_mode: "host"
    depends_on:
      - Keycloak
    restart: "no"
@@ -1,4 +1,4 @@
-import { type FullConfig } from '@playwright/test';
+import { firefox, type FullConfig } from '@playwright/test';
 import { execSync } from 'node:child_process';
 import fs from 'fs';

@@ -207,7 +207,7 @@ export async function startVault(browser: Browser, testInfo: TestInfo, env = {},
 }

 export async function stopVault(force: boolean = false) {
-    if( force === false && process.env.PW_KEEP_SERVICE_RUNNING === "true" ) {
+    if( force === false && process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
        console.log(`Keep vaultwarden running on: ${process.env.DOMAIN}`);
    } else {
        console.log(`Vaultwarden stopping`);
@@ -231,7 +231,6 @@ export async function checkNotification(page: Page, hasText: string) {
 }

 export async function cleanLanding(page: Page) {
-    await page.context().clearCookies();
    await page.goto('/', { waitUntil: 'domcontentloaded' });
    await expect(page.getByRole('button').nth(0)).toBeVisible();

@@ -249,3 +248,15 @@ export async function logout(test: Test, page: Page, user: { name: string }) {
        await expect(page.getByRole('heading', { name: 'Log in' })).toBeVisible();
    });
 }
+
+export async function ignoreExtension(page: Page) {
+    await page.waitForLoadState('domcontentloaded');
+
+    try {
+        await page.getByRole('button', { name: 'Add it later' }).click({timeout: 5_000});
+        await page.getByRole('link', { name: 'Skip to web app' }).click();
+    } catch (error) {
+        console.log('Extension setup not visible. Continuing');
+    }
+
+}
@@ -8,14 +8,14 @@
    "author": "",
    "license": "ISC",
    "devDependencies": {
-        "@playwright/test": "1.60.0",
-        "dotenv": "17.4.2",
-        "dotenv-expand": "13.0.0",
-        "maildev": "npm:@timshel_npm/maildev@3.2.19"
+        "@playwright/test": "1.56.1",
+        "dotenv": "17.2.3",
+        "dotenv-expand": "12.0.3",
+        "maildev": "npm:@timshel_npm/maildev@3.2.5"
    },
    "dependencies": {
-        "mysql2": "3.22.3",
-        "otpauth": "9.5.1",
-        "pg": "8.21.0"
+        "mysql2": "3.15.3",
+        "otpauth": "9.4.1",
+        "pg": "8.16.3"
    }
 }
@@ -25,12 +25,10 @@ export default defineConfig({
    /* Long global timeout for complex tests
     * But short action/nav/expect timeouts to fail on specific step (raise locally if not enough).
     */
-    timeout: 240 * 1000,
-    actionTimeout: 40 * 1000,
-    navigationTimeout: 40 * 1000,
-    expect: { timeout: 40 * 1000 },
-
-    "permissions": ["clipboard-read"],
+    timeout: 120 * 1000,
+    actionTimeout: 20 * 1000,
+    navigationTimeout: 20 * 1000,
+    expect: { timeout: 20 * 1000 },

    /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
    use: {
@@ -39,10 +37,6 @@ export default defineConfig({
        browserName: 'firefox',
        locale: 'en-GB',
        timezoneId: 'Europe/London',
-        ignoreHTTPSErrors: true,
-        launchOptions: {
-            args: ['--ignore-certificate-errors']
-        },

        /* Always collect trace (other values add random test failures) See https://playwright.dev/docs/trace-viewer */
        trace: 'on',
@@ -10,7 +10,7 @@ DOCKER_BUILDKIT=1
 #####################
 # Playwright Config #
 #####################
-PW_KEEP_SERVICE_RUNNING=${PW_KEEP_SERVICE_RUNNING:-false}
+PW_KEEP_SERVICE_RUNNNING=${PW_KEEP_SERVICE_RUNNNING:-false}
 PW_SMTP_FROM=vaultwarden@playwright.test

 #####################
@@ -38,8 +38,8 @@ TEST_USER3_MAIL=${TEST_USER3}@example.com
 ###################
 # Keycloak Config #
 ###################
-KC_BOOTSTRAP_ADMIN_USERNAME=admin
-KC_BOOTSTRAP_ADMIN_PASSWORD=${KC_BOOTSTRAP_ADMIN_USERNAME}
+KEYCLOAK_ADMIN=admin
+KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
 KC_HTTP_HOST=127.0.0.1
 KC_HTTP_PORT=8081

@@ -52,12 +52,10 @@ DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
 # Vaultwarden Config #
 ######################
 ROCKET_PORT=8003
-ROCKET_TLS={certs="/data/ssl/localhost.crt",key="/data/ssl/localhost.key"}
-DOMAIN=https://127.0.0.1:${ROCKET_PORT}
+DOMAIN=http://localhost:${ROCKET_PORT}
 LOG_LEVEL=info,oidcwarden::sso=debug
 LOGIN_RATELIMIT_MAX_BURST=100
 ADMIN_TOKEN=admin
-CLIENT_SUPPRESS_ONBOARDING=true

 SMTP_SECURITY=off
 SMTP_PORT=${MAILDEV_SMTP_PORT}
@@ -1,8 +1,6 @@
 import { test, expect, type TestInfo } from '@playwright/test';

 import * as utils from "../global-utils";
-
-import * as orgs from './setups/orgs';
 import { createAccount } from './setups/user';

 let users = utils.loadEnv();
@@ -18,12 +16,20 @@ test.afterAll('Teardown', async ({}) => {
 test('Create', async ({ page }) => {
    await createAccount(test, page, users.user1);

-    await orgs.create(test, page, 'New organisation');
+    await test.step('Create Org', async () => {
+        await page.getByRole('link', { name: 'New organisation' }).click();
+        await page.getByLabel('Organisation name (required)').fill('Test');
+        await page.getByRole('button', { name: 'Submit' }).click();
+        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
+
+        await utils.checkNotification(page, 'Organisation created');
+    });

    await test.step('Create Collection', async () => {
-        await page.getByRole('button', { name: 'New', exact: true }).click();
+        await page.getByRole('link', { name: 'Collections' }).click();
+        await page.getByRole('button', { name: 'New' }).click();
        await page.getByRole('menuitem', { name: 'Collection' }).click();
-        await page.getByRole('textbox', { name: 'Name * (required)', exact: true }).fill('RandomCollec');
+        await page.getByLabel('Name (required)').fill('RandomCollec');
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Created collection RandomCollec');
        await expect(page.getByRole('button', { name: 'RandomCollec' })).toBeVisible();
@@ -1,56 +0,0 @@
-import { test, expect, type Page, type TestInfo } from '@playwright/test';
-import * as OTPAuth from "otpauth";
-
-import * as utils from "../global-utils";
-import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP } from './setups/2fa';
-
-let users = utils.loadEnv();
-let totp;
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    await utils.startVault(browser, testInfo, {});
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-});
-
-test('Change Key settings', async ({ page }) => {
-    await createAccount(test, page, users.user1);
-
-    await test.step('Change SHA-256 Iterations', async () => {
-        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
-        await page.getByRole('link', { name: 'Security' }).click();
-        await page.getByRole('link', { name: 'Keys' }).click();
-
-        await page.getByRole('spinbutton', { name: 'KDF iterations * (required)'}).fill('700000');
-
-        await page.getByRole('button', { name: 'Update encryption settings' }).click();
-        await page.getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
-        await page.getByRole('button', { name: 'Update settings' }).click();
-        await page.getByRole('heading', { name: 'Log in' }).click();
-    });
-
-    await logUser(test, page, users.user1);
-
-    await test.step('Switch to Argon2', async () => {
-        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
-        await page.getByRole('link', { name: 'Security' }).click();
-        await page.getByRole('link', { name: 'Keys' }).click();
-
-        await page.locator('.ng-arrow-wrapper').click();
-        await page.getByText('Argon2id').click();
-
-        await page.getByRole('spinbutton', { name: 'KDF memory (MB) * (required)'}).fill('16');
-        await page.getByRole('spinbutton', { name: 'KDF iterations * (required)'}).fill('2');
-        await page.getByRole('spinbutton', { name: 'KDF parallelism * (required)'}).fill('1');
-
-        await page.getByRole('button', { name: 'Update encryption settings' }).click();
-        await page.getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
-        await page.getByRole('button', { name: 'Update settings' }).click();
-        await page.getByRole('heading', { name: 'Log in' }).click();
-    });
-
-    await logUser(test, page, users.user1);
-});
@@ -1,131 +0,0 @@
-import { test, expect, type Page, type TestInfo, Test } from '@playwright/test';
-import { MailDev } from 'maildev';
-
-import * as utils from "../global-utils";
-import { createAccount, logUser } from './setups/user';
-import { activateTOTP } from './setups/2fa';
-
-let users = utils.loadEnv();
-let mailserver;
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    mailserver = new MailDev({
-        port: process.env.MAILDEV_SMTP_PORT,
-        web: { port: process.env.MAILDEV_HTTP_PORT },
-    })
-
-    await mailserver.listen();
-
-    await utils.startVault(browser, testInfo, {
-        SMTP_HOST: process.env.MAILDEV_HOST,
-        SMTP_FROM: process.env.PW_SMTP_FROM,
-    });
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-    if( mailserver ){
-        await mailserver.close();
-    }
-});
-
-async function emergencyAccess(test: Test, page: Page, user: { name: string }) {
-    await test.step('Navigate', async () => {
-        await page.getByRole('button', { name: user.name }).click();
-        await page.getByRole('menuitem', { name: 'Account settings' }).click();
-        await page.getByRole('link', { name: 'Emergency access' }).click();
-        await expect(page.locator('#main-content').getByText('Emergency access', { exact: true })).toBeVisible();
-    });
-}
-
-test('Emergency access', async ({ browser, page }) => {
-    const context2 = await browser.newContext();
-    const page2 = await context2.newPage();
-
-    const mailBuffer = mailserver.buffer(users.user1.email);
-    const mailBuffer2 = mailserver.buffer(users.user2.email);
-
-    await createAccount(test, page, users.user1);
-    await createAccount(test, page2, users.user2);
-
-    await test.step('Add test2', async () => {
-        await emergencyAccess(test, page, users.user1);
-        await page.getByRole('button', { name: 'Add emergency contact' }).click();
-        await page.getByRole('textbox', { name: 'Email * (required)' }).fill(users.user2.email);
-        await page.getByRole('radio', { name: 'Takeover Can reset your' }).check();
-        await page.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page, 'User(s) invited');
-    });
-
-    await test.step('Accept', async () => {
-        const email = await mailBuffer2.expect((m) => m.subject === "Emergency access for " + users.user1.name);
-        const pageE = await context2.newPage();
-        await pageE.setContent(email.html);
-        const link = await pageE.getByTestId("emergency").getAttribute("href");
-        await pageE.close();
-
-        await page2.goto(link);
-        await utils.checkNotification(page2, 'Invitation accepted');
-    });
-
-    await test.step('Confirm', async () => {
-        await emergencyAccess(test, page, users.user1);
-        await expect(page.locator('#main-content').getByText('Needs confirmation')).toBeVisible();
-        await page.getByRole('button', { name: 'Options' }).click();
-        await page.getByRole('menuitem', { name: 'Confirm' }).click();
-        await page.getByRole('button', { name: 'Confirm' }).click();
-        await utils.checkNotification(page, users.user2.name + ' confirmed');
-        await mailBuffer2.expect((m) => m.subject === "Emergency access contact for " + users.user1.name + " confirmed");
-    });
-
-    await test.step('Request', async () => {
-        await emergencyAccess(test, page2, users.user2);
-        await page2.getByRole('button', { name: 'Options' }).click();
-        await page2.getByRole('menuitem', { name: 'Request Access' }).click();
-        await page2.getByRole('button', { name: 'Request Access' }).click();
-        await utils.checkNotification(page2, 'Emergency access requested');
-        await mailBuffer.expect((m) => m.subject === "Emergency access request by " + users.user2.name + " initiated");
-    });
-
-    await test.step('Approved', async () => {
-        await emergencyAccess(test, page, users.user1);
-        await page.getByRole('button', { name: 'Options' }).click();
-        await page.getByRole('menuitem', { name: 'Approve' }).click();
-        await page.getByRole('button', { name: 'Approve' }).click();
-        await utils.checkNotification(page, 'Emergency access approved');
-        await mailBuffer2.expect((m) => m.subject === "Emergency access request for " + users.user1.name + " approved");
-    });
-    await activateTOTP(test, page, users.user1);
-
-    let newPassword = "TotoNewPassword";
-    await test.step('Access', async () => {
-        await emergencyAccess(test, page2, users.user2);
-        await page2.getByRole('button', { name: 'Options' }).click();
-        await page2.getByRole('menuitem', { name: 'Takeover' }).click();
-        await page2.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
-        await page2.getByRole('textbox', { name: 'Confirm new master password' }).fill(newPassword);
-        await page2.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page2, 'Password reset for ' + users.user1.name);
-    });
-
-    await test.step('Changed no 2fa', async () => {
-        users.user1.password = newPassword;
-        await logUser(test, page, users.user1);
-    });
-
-    await test.step('Reject', async () => {
-        await emergencyAccess(test, page, users.user1);
-        await page.getByRole('button', { name: 'Options' }).click();
-        await page.getByRole('menuitem', { name: 'Reject' }).click();
-        await utils.checkNotification(page, 'Emergency access rejected');
-        await mailBuffer2.expect((m) => m.subject === "Emergency access request to " + users.user1.name + " rejected");
-    });
-
-    await test.step('Remove', async () => {
-        await page.getByRole('button', { name: 'Options' }).click();
-        await page.getByRole('menuitem', { name: 'Remove' }).click();
-        await page.getByRole('button', { name: 'Yes' }).click();
-        await utils.checkNotification(page, 'Removed user ' + users.user2.name);
-        await expect(page.getByText('You have not added any emergency contacts')).toBeVisible();
-    });
-});
@@ -41,10 +41,13 @@ test('Account creation', async ({ page }) => {
 test('Login', async ({ context, page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);

-    await logUser(test, page, users.user1, { mailBuffer });
+    await logUser(test, page, users.user1, mailBuffer);

    await test.step('verify email', async () => {
-        await page.getByRole('button', { name: "Send email" }).click();
+        await page.getByText('Verify your account\'s email').click();
+        await expect(page.getByText('Verify your account\'s email')).toBeVisible();
+        await page.getByRole('button', { name: 'Send email' }).click();
+
        await utils.checkNotification(page, 'Check your email inbox for a verification link');

        const verify = await mailBuffer.expect((m) => m.subject === "Verify Your Email");
@@ -75,10 +78,26 @@ test('Activate 2fa', async ({ page }) => {
 test('2fa', async ({ page }) => {
    const emails = mailserver.buffer(users.user1.email);

-    await logUser(test, page, users.user1, {
-        mailBuffer: emails,
-        mail2fa: true,
-    });
+    await test.step('login', async () => {
+        await page.goto('/');
+
+        await page.getByLabel(/Email address/).fill(users.user1.email);
+        await page.getByRole('button', { name: 'Continue' }).click();
+        await page.getByLabel('Master password').fill(users.user1.password);
+        await page.getByRole('button', { name: 'Log in with master password' }).click();
+
+        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
+        const code = await retrieveEmailCode(test, page, emails);
+        await page.getByLabel(/Verification code/).fill(code);
+        await page.getByRole('button', { name: 'Continue' }).click();
+
+        await page.getByRole('button', { name: 'Add it later' }).click();
+        await page.getByRole('link', { name: 'Skip to web app' }).click();
+
+        await expect(page).toHaveTitle(/Vaults/);
+    })
+
+    await disableEmail(test, page, users.user1);

    emails.close();
 });
@@ -3,7 +3,7 @@ import * as OTPAuth from "otpauth";

 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP, recoveryCodes } from './setups/2fa';
+import { activateTOTP, disableTOTP } from './setups/2fa';

 let users = utils.loadEnv();
 let totp;
@@ -31,42 +31,21 @@ test('Authenticator 2fa', async ({ page }) => {

    await utils.logout(test, page, users.user1);

-    await logUser(test, page, users.user1, { totp });
+    await test.step('login', async () => {
+        let timestamp = Date.now(); // Needed to use the next token
+        timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
+
+        await page.getByLabel(/Email address/).fill(users.user1.email);
+        await page.getByRole('button', { name: 'Continue' }).click();
+        await page.getByLabel('Master password').fill(users.user1.password);
+        await page.getByRole('button', { name: 'Log in with master password' }).click();
+
+        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
+        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
+        await page.getByRole('button', { name: 'Continue' }).click();
+
+        await expect(page).toHaveTitle(/Vaultwarden Web/);
+    });

    await disableTOTP(test, page, users.user1);
 });
-
-test('Recovery codes', async ({ context, page }) => {
-    await logUser(test, page, users.user1);
-
-    await activateTOTP(test, page, users.user1);
-    let recovery = await recoveryCodes(test, page, users.user1);
-
-    await utils.logout(test, page, users.user1);
-
-    await test.step('login', async () => {
-        await page.getByLabel(/Email address/).fill(users.user1.email);
-        await page.getByRole('button', { name: 'Continue' }).click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
-        await page.getByRole('button', { name: 'Log in', exact: true }).click();
-
-        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-
-        await expect(page).toHaveTitle(/Vaultwarden Web/);
-
-        const newPagePromise = context.waitForEvent('page');
-        await page.getByRole('button', { name: 'Use your recovery code' }).click();
-        const newPage = await newPagePromise;
-
-        const tabs = context.pages();
-        await tabs[1].bringToFront();
-        await expect(tabs[1].getByRole('heading', { name: 'Recover account two-step login' })).toBeVisible();
-        await tabs[1].getByRole('textbox', { name: 'Email address * (required)' }).fill(users.user1.email);
-        await tabs[1].getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
-        await tabs[1].getByRole('textbox', { name: 'Recovery code * (required)' }).fill(recovery);
-        await tabs[1].getByRole('button', { name: 'Submit' }).click();
-
-        await expect(tabs[1]).toHaveTitle(/Two-step login/);
-    });
-});
-
@@ -4,7 +4,6 @@ import { MailDev } from 'maildev';
 import * as utils from '../global-utils';
 import * as orgs from './setups/orgs';
 import { createAccount, logUser } from './setups/user';
-import { activateTOTP } from './setups/2fa';

 let users = utils.loadEnv();

@@ -21,7 +20,6 @@ test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
-        EMAIL_2FA_AUTO_FALLBACK: "true",
    });

    mail1Buffer = mailServer.buffer(users.user1.email);
@@ -42,16 +40,6 @@ test('Invite users', async ({ page }) => {
    await createAccount(test, page, users.user1, mail1Buffer);

    await orgs.create(test, page, 'Test');
-
-    await test.step(`Set account recovery`, async () => {
-        await orgs.policies(test, page, 'Test');
-        await page.getByRole('button', { name: 'Account recovery' }).click();
-        await page.getByRole('checkbox', { name: 'Turn on' }).check();
-        await page.getByRole('checkbox', { name: 'Automatically enroll new' }).check();
-        await page.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page, 'Edited policy Account recovery');
-    });
-
    await orgs.members(test, page, 'Test');
    await orgs.invite(test, page, 'Test', users.user2.email);
    await orgs.invite(test, page, 'Test', users.user3.email, {
@@ -69,15 +57,17 @@ test('invited with new account', async ({ page }) => {
        await expect(page).toHaveTitle(/Create account | Vaultwarden Web/);

        //await page.getByLabel('Name').fill(users.user2.name);
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
+        await page.getByLabel('Confirm master password (').fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Your new account has been created');

+        await utils.checkNotification(page, 'Invitation accepted');
+        await utils.ignoreExtension(page);
+
        // Redirected to the vault
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
        // await utils.checkNotification(page, 'You have been logged in!');
-        await utils.checkNotification(page, 'Successfully accepted your invitation');
    });

    await test.step('Check mails', async () => {
@@ -100,19 +90,21 @@ test('invited with existing account', async ({ page }) => {
    await page.getByRole('button', { name: 'Continue' }).click();

    // Unlock page
-    await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user3.password);
-    await page.getByRole('button', { name: 'Log in', exact: true }).click();
+    await page.getByLabel('Master password').fill(users.user3.password);
+    await page.getByRole('button', { name: 'Log in with master password' }).click();
+
+    await utils.checkNotification(page, 'Invitation accepted');
+    await utils.ignoreExtension(page);

    // We are now in the default vault page
    await expect(page).toHaveTitle(/Vaultwarden Web/);
-    await utils.checkNotification(page, 'Successfully accepted your invitation');

    await mail3Buffer.expect((m) => m.subject === 'New Device Logged In From Firefox');
    await mail1Buffer.expect((m) => m.subject.includes('Invitation to Test accepted'));
 });

 test('Confirm invited user', async ({ page }) => {
-    await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
+    await logUser(test, page, users.user1, mail1Buffer);

    await orgs.members(test, page, 'Test');
    await orgs.confirm(test, page, 'Test', users.user2.email);
@@ -121,40 +113,7 @@ test('Confirm invited user', async ({ page }) => {
 });

 test('Organization is visible', async ({ page }) => {
-    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
+    await logUser(test, page, users.user2, mail2Buffer);
    await page.getByRole('button', { name: 'vault: Test', exact: true }).click();
    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
 });
-
-test('Recover user password', async ({ page }) => {
-    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
-    await activateTOTP(test, page, users.user2);
-
-    await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
-
-    let newPassword = "TotoNewPassword";
-
-    await orgs.members(test, page, 'Test');
-    await test.step(`Recover ${users.user2.email}`, async () => {
-        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
-        await page.getByRole('row').filter({hasText: users.user2.email}).getByLabel('Options').click();
-        await page.getByRole('menuitem', { name: 'Recover account' }).click();
-        await page.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
-        await page.getByRole('textbox', { name: 'Confirm new master password * (' }).fill(newPassword);
-        await page.getByRole('checkbox', { name: 'Reset two-step login' }).check();
-        await page.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page, 'Account recovery success');
-        await mail2Buffer.expect((m) => m.subject.includes('Admin account recovery from Test organization'));
-    });
-
-    let user2 = {
-        email: users.user2.email,
-        name: users.user2.name,
-        password: newPassword,
-    };
-    await logUser(test, page, user2, {
-        mailBuffer: mail2Buffer,
-        mail2fa: true,
-        notNewDevice: true,
-    });
-});
@@ -1,110 +0,0 @@
-import { test, expect, type Page, type TestInfo } from '@playwright/test';
-import * as OTPAuth from "otpauth";
-
-import * as utils from "../global-utils";
-import { createAccount, logUser } from './setups/user';
-
-let users = utils.loadEnv();
-let totp;
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    await utils.startVault(browser, testInfo, {});
-
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    await createAccount(test, page, users.user1);
-    await context.close();
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-});
-
-test('Password', async ({ context, page }, testInfo: TestInfo) => {
-    const label = 'Test Password';
-
-    await logUser(test, page, users.user1);
-
-    await test.step('Create password entry', async () => {
-        await page.getByRole('button', { name: 'New item' }).click();
-        await page.getByRole('textbox', { name: 'Item name * (required)' }).fill(label);
-        await page.getByRole('textbox', { name: 'Username' }).fill(users.user1.name);
-        await page.getByRole('textbox', { name: 'Password' }).fill(users.user1.password);
-        await page.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page, 'Item added');
-        await page.getByRole('button', { name: 'Close' }).click();
-    });
-
-    // Log again
-    await logUser(test, page, users.user1);
-
-    await test.step('Check', async () => {
-        await page.getByRole('row').filter({ hasText: label }).getByRole('button', { name: label }).click();
-        await page.getByTestId('copy-username').click();
-        await utils.checkNotification(page, 'Username copied');
-        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(users.user1.name)
-        await page.getByTestId('copy-password').click();
-        await utils.checkNotification(page, 'Password copied');
-        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(users.user1.password)
-        await page.getByRole('button', { name: 'Close' }).click();
-    });
-
-    await test.step('Delete', async () => {
-        await page.getByRole('row').filter({ hasText: label }).getByLabel('Options').click();
-        await page.getByRole('menuitem', { name: 'Delete' }).click();
-        await page.getByRole('button', { name: 'Yes' }).click();
-        await utils.checkNotification(page, 'Item sent to bin');
-    });
-
-    // Log again
-    await logUser(test, page, users.user1);
-
-    await test.step('Deleted', async () => {
-        await expect(page.getByRole('row').filter({ hasText: label })).toHaveCount(0)
-    });
-});
-
-
-test('SSH Key', async ({ context, page }, testInfo: TestInfo) => {
-    const label = 'Test SSH key';
-
-    await logUser(test, page, users.user1);
-
-    const privateKey = await test.step('Create key entry', async () => {
-        await page.getByRole('button', { name: 'New', exact: true }).click();
-        await page.getByRole('menuitem', { name: 'SSH key' }).click();
-        await page.getByRole('textbox', { name: 'Item name * (required)' }).fill('Test SSH key');
-        await page.getByRole('button', { name: 'Save' }).click();
-        await utils.checkNotification(page, 'Item added');
-
-        await page.getByRole('button', { name: 'Copy private key' }).click();
-        await utils.checkNotification(page, 'Private key copied');
-        return await page.evaluate(() => navigator.clipboard.readText());
-    });
-
-    // Log again
-    await logUser(test, page, users.user1);
-
-    await test.step('Check', async () => {
-        await page.getByRole('row').filter({ hasText: label }).getByRole('button', { name: label }).click();
-
-        await page.getByRole('button', { name: 'Copy private key' }).click();
-        await utils.checkNotification(page, 'Private key copied');
-        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(privateKey)
-        await page.getByRole('button', { name: 'Close' }).click();
-    });
-
-    await test.step('Delete', async () => {
-        await page.getByRole('row').filter({ hasText: label }).getByLabel('Options').click();
-        await page.getByRole('menuitem', { name: 'Delete' }).click();
-        await page.getByRole('button', { name: 'Yes' }).click();
-        await utils.checkNotification(page, 'Item sent to bin');
-    });
-
-    // Log again
-    await logUser(test, page, users.user1);
-
-    await test.step('Deleted', async () => {
-        await expect(page.getByRole('row').filter({ hasText: label })).toHaveCount(0)
-    })
-});
@@ -1,72 +0,0 @@
-import { test, expect, type Page, type TestInfo } from '@playwright/test';
-import * as OTPAuth from "otpauth";
-
-import * as utils from "../global-utils";
-import { createAccount } from './setups/user';
-
-let users = utils.loadEnv();
-
-test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
-    await utils.startVault(browser, testInfo, {});
-});
-
-test.afterAll('Teardown', async ({}) => {
-    utils.stopVault();
-});
-
-test('Send', async ({ browser, page }) => {
-    await createAccount(test, page, users.user1);
-
-    const send_url = await test.step('Create', async () => {
-        await page.getByRole('link', { name: 'Send' }).click();
-        await expect(page.locator('#main-content').getByText('Send', { exact: true })).toBeVisible();
-
-        await page.getByRole('button', { name: 'New Send', exact: true }).click();
-        await page.getByRole('menuitem', { name: 'Text' }).click();
-
-        await page.getByRole('textbox', { name: 'Send name * (required)' }).fill('Test');
-        await page.getByRole('textbox', { name: 'Text to share * (required)' }).fill('test');
-        await page.getByRole('button', { name: 'Save' }).click();
-
-        await page.locator('footer').getByRole('button', { name: 'Copy link' }).click();
-
-        return await page.evaluate(() => navigator.clipboard.readText());
-    });
-
-    const context2 = await browser.newContext();
-    const page2 = await context2.newPage();
-
-    await test.step('View', async () => {
-        await page2.goto(send_url, { waitUntil: 'domcontentloaded' });
-        await expect(page2.getByRole('heading', { name: 'View Send' })).toBeVisible();
-        await expect(await page2.getByRole('paragraph').filter({ hasText: 'Test' })).toBeVisible();
-    });
-
-    const pwd_url = await test.step('Create with password', async () => {
-        await page.getByRole('link', { name: 'Send' }).click();
-        await expect(page.locator('#main-content').getByText('Send', { exact: true })).toBeVisible();
-
-        await page.getByRole('button', { name: 'New' }).click();
-        await page.getByRole('menuitem', { name: 'Text' }).click();
-
-        await page.getByRole('textbox', { name: 'Send name * (required)' }).fill('Password');
-        await page.getByRole('textbox', { name: 'Text to share * (required)' }).fill('password');
-        await page.getByRole('combobox', { name: 'Who can view' }).click();
-        await page.getByText('Anyone with a password set by you').click();
-        await page.getByRole('textbox', { name: 'Password * (required)', exact: true }).fill('password');
-
-        await page.getByRole('button', { name: 'Save' }).click();
-        await page.locator('footer').getByRole('button', { name: 'Copy link' }).click();
-
-        return await page.evaluate(() => navigator.clipboard.readText());
-    });
-
-    await test.step('View with password', async () => {
-        await page2.goto(pwd_url, { waitUntil: 'domcontentloaded' });
-        await expect(page2.getByRole('heading', { name: 'Enter the password to view' })).toBeVisible();
-        await page2.getByRole('textbox', { name: 'Password * (required)' }).fill('password');
-        await page2.getByRole('button', { name: 'Continue' }).click();
-        await expect(page2.getByRole('heading', { name: 'View Send' })).toBeVisible();
-        await expect(await page2.getByRole('paragraph').filter({ hasText: 'Password' })).toBeVisible();
-    });
-});
@@ -4,24 +4,6 @@ import * as OTPAuth from "otpauth";

 import * as utils from '../../global-utils';

-export async function recoveryCodes(test: Test, page: Page, user: { name: string, password: string }): string {
-    return await test.step('Recovery code', async () => {
-        await page.getByRole('button', { name: user.name }).click();
-        await page.getByRole('menuitem', { name: 'Account settings' }).click();
-        await page.getByRole('link', { name: 'Security' }).click();
-        await page.getByRole('link', { name: 'Two-step login' }).click();
-
-        await page.getByRole('button', { name: 'View recovery code' }).click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
-        await page.getByRole('button', { name: 'Continue' }).click();
-
-        const recovery = await page.getByRole('code').innerText();
-        await page.getByLabel('Close').click();
-
-        return recovery;
-    })
-}
-
 export async function activateTOTP(test: Test, page: Page, user: { name: string, password: string }): OTPAuth.TOTP {
    return await test.step('Activate TOTP 2FA', async () => {
        await page.getByRole('button', { name: user.name }).click();
@@ -29,16 +11,16 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();

-        const secret = await page.getByLabel('Key', { exact: true }).innerText();
-
+        const secret = await page.getByLabel('Key').innerText();
        let totp = new OTPAuth.TOTP({ secret, period: 30 });

        await page.getByLabel(/Verification code/).fill(totp.generate());
        await page.getByRole('button', { name: 'Turn on' }).click();
        await page.getByRole('heading', { name: 'Turned on', exact: true });
+        await page.getByLabel('Close').click();

        return totp;
    })
@@ -51,8 +33,8 @@ export async function disableTOTP(test: Test, page: Page, user: { password: stri
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).click()
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').click();
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Turn off' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
@@ -67,7 +49,7 @@ export async function activateEmail(test: Test, page: Page, user: { name: string
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: 'Enter a code sent to your email' }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Send email' }).click();
    });
@@ -99,8 +81,8 @@ export async function disableEmail(test: Test, page: Page, user: { password: str
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: 'Email' }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).click()
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').click();
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Turn off' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
@@ -1,21 +0,0 @@
-import { expect, type Browser, Page } from '@playwright/test';
-import * as utils from '../../global-utils';
-
-utils.loadEnv();
-
-export async function login(test, page: Page) {
-    await test.step(`Admin login`, async () => {
-        await page.goto('/admin');
-        await page.getByRole('textbox', { name: 'Enter admin token' }).fill(process.env.ADMIN_TOKEN);
-        await page.getByRole('button', { name: 'Enter' }).click();
-    });
-}
-
-export async function invite(test, page: Page, email: string) {
-    await test.step(`Invite user with ${email}`, async () => {
-        await page.getByRole('link', { name: 'Users' }).click();
-        await page.getByRole('textbox', { name: 'Enter email' }).fill(email);
-        await page.getByRole('button', { name: 'Invite' }).click();
-        await expect(page.getByRole('row', { name: email })).toHaveText(/Invited/);
-    });
-}
@@ -5,7 +5,7 @@ const utils = require('../../global-utils');
 utils.loadEnv();

 test('DB teardown ?', async ({ serviceName }) => {
-    if( process.env.PW_KEEP_SERVICE_RUNNING !== "true" ) {
+    if( process.env.PW_KEEP_SERVICE_RUNNNING !== "true" ) {
        utils.stopComposeService(serviceName);
    }
 });
@@ -3,14 +3,11 @@ import { expect, type Browser,Page } from '@playwright/test';
 import * as utils from '../../global-utils';

 export async function create(test, page: Page, name: string) {
-    await test.step(`Create Org ${name}`, async () => {
-        let pm_locator = page.locator('a').filter({ hasText: 'Password Manager' });
-        if( await pm_locator.count() > 0 ){
-            pm_locator.first().click();
-        }
+    await test.step('Create Org', async () => {
+        await page.locator('a').filter({ hasText: 'Password Manager' }).first().click();
        await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        await page.getByRole('link', { name: 'New organisation' }).click();
-        await page.getByRole('textbox', { name: 'Organisation name * (required)', exact: true }).fill(name);
+        await page.getByLabel('Organisation name (required)').fill(name);
        await page.getByRole('button', { name: 'Submit' }).click();

        await utils.checkNotification(page, 'Organisation created');
@@ -21,7 +18,7 @@ export async function policies(test, page: Page, name: string) {
    await test.step(`Navigate to ${name} policies`, async () => {
        await page.locator('a').filter({ hasText: 'Admin Console' }).first().click();
        await page.locator('org-switcher').getByLabel(/Toggle collapse/).click();
-        await page.locator('org-switcher > bit-nav-group > div > bit-nav-item').filter({ hasText: `${name}` }).first().click();
+        await page.locator('org-switcher').getByRole('link', { name: `${name}` }).first().click();
        await expect(page.getByRole('heading', { name: `${name} collections` })).toBeVisible();
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Policies' }).click();
@@ -33,11 +30,11 @@ export async function members(test, page: Page, name: string) {
    await test.step(`Navigate to ${name} members`, async () => {
        await page.locator('a').filter({ hasText: 'Admin Console' }).first().click();
        await page.locator('org-switcher').getByLabel(/Toggle collapse/).click();
-        await page.locator('org-switcher > bit-nav-group > div > bit-nav-item').filter({ hasText: `${name}` }).first().click();
+        await page.locator('org-switcher').getByRole('link', { name: `${name}` }).first().click();
        await expect(page.getByRole('heading', { name: `${name} collections` })).toBeVisible();
-        await page.getByRole('link', { name: 'Members' }).click();
+        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
-        await expect(page.getByRole('columnheader', { name: 'Select all' })).toBeVisible();
+        await expect(page.getByRole('cell', { name: 'All' })).toBeVisible();
    });
 }

@@ -45,13 +42,13 @@ export async function invite(test, page: Page, name: string, email: string) {
    await test.step(`Invite ${email}`, async () => {
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
        await page.getByRole('button', { name: 'Invite member' }).click();
-        await page.getByRole('textbox', { name: 'Email * (required)', exact: true }).fill(email);
+        await page.getByLabel('Email (required)').fill(email);
        await page.getByRole('tab', { name: 'Collections' }).click();
        await page.getByRole('combobox', { name: 'Permission' }).click();
        await page.getByText('Edit items', { exact: true }).click();
-        await page.getByRole('combobox', { name: 'Select collections' }).click();
-        await page.getByLabel('Options List').getByText('Default collection').click();
-        await page.getByRole('columnheader', { name: 'Collection', exact: true }).click();
+        await page.getByLabel('Select collections').click();
+        await page.getByText('Default collection').click();
+        await page.getByRole('cell', { name: 'Collection', exact: true }).click();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'User(s) invited');
    });
@@ -6,7 +6,7 @@ const utils = require('../../global-utils');
 utils.loadEnv();

 test('Keycloak teardown', async () => {
-    if( process.env.PW_KEEP_SERVICE_RUNNING === "true" ) {
+    if( process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
        console.log("Keep Keycloak running");
    } else {
        console.log("Keycloak stopping");
@@ -15,8 +15,11 @@ export async function logNewUser(
    options: { mailBuffer?: MailBuffer } = {}
 ) {
    await test.step(`Create user ${user.name}`, async () => {
+        await page.context().clearCookies();
+
        await test.step('Landing page', async () => {
            await utils.cleanLanding(page);
+
            await page.locator("input[type=email].vw-email-sso").fill(user.email);
            await page.getByRole('button', { name: /Use single sign-on/ }).click();
        });
@@ -30,24 +33,26 @@ export async function logNewUser(

        await test.step('Create Vault account', async () => {
            await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-            await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
-            await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(user.password);
+            await page.getByLabel('Master password (required)', { exact: true }).fill(user.password);
+            await page.getByLabel('Confirm master password (').fill(user.password);
            await page.getByRole('button', { name: 'Create account' }).click();
        });

+        await utils.checkNotification(page, 'Account successfully created!');
+        await utils.checkNotification(page, 'Invitation accepted');
+
+        await utils.ignoreExtension(page);
+
        await test.step('Default vault page', async () => {
            await expect(page).toHaveTitle(/Vaultwarden Web/);
            await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        });

-        await utils.checkNotification(page, 'Account successfully created!');
-        await utils.checkNotification(page, 'Invitation accepted');
-
        if( options.mailBuffer ){
            let mailBuffer = options.mailBuffer;
            await test.step('Check emails', async () => {
-                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
                await mailBuffer.expect((m) => m.subject === "Welcome");
+                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
            });
        }
    });
@@ -64,14 +69,16 @@ export async function logUser(
        mailBuffer ?: MailBuffer,
        totp?: OTPAuth.TOTP,
        mail2fa?: boolean,
-        notNewDevice?: boolean,
    } = {}
 ) {
    let mailBuffer = options.mailBuffer;

    await test.step(`Log user ${user.email}`, async () => {
+        await page.context().clearCookies();
+
        await test.step('Landing page', async () => {
            await utils.cleanLanding(page);
+
            await page.locator("input[type=email].vw-email-sso").fill(user.email);
            await page.getByRole('button', { name: /Use single sign-on/ }).click();
        });
@@ -110,12 +117,14 @@ export async function logUser(
            await page.getByRole('button', { name: 'Unlock' }).click();
        });

+        await utils.ignoreExtension(page);
+
        await test.step('Default vault page', async () => {
            await expect(page).toHaveTitle(/Vaultwarden Web/);
            await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        });

-        if( mailBuffer && !options.notNewDevice ){
+        if( mailBuffer ){
            await test.step('Check email', async () => {
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
            });
@@ -2,9 +2,7 @@ import { expect, type Browser, Page } from '@playwright/test';

 import { type MailBuffer } from 'maildev';

-import * as OTPAuth from "otpauth";
 import * as utils from '../../global-utils';
-import { retrieveEmailCode } from './2fa';

 export async function createAccount(test, page: Page, user: { email: string, name: string, password: string }, mailBuffer?: MailBuffer) {
    await test.step(`Create user ${user.name}`, async () => {
@@ -19,11 +17,12 @@ export async function createAccount(test, page: Page, user: { email: string, nam
        await page.getByRole('button', { name: 'Continue' }).click();

        // Vault finish Creation
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(user.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(user.password);
+        await page.getByLabel('Confirm master password (').fill(user.password);
        await page.getByRole('button', { name: 'Create account' }).click();

        await utils.checkNotification(page, 'Your new account has been created')
+        await utils.ignoreExtension(page);

        // We are now in the default vault page
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
@@ -36,17 +35,7 @@ export async function createAccount(test, page: Page, user: { email: string, nam
    });
 }

-export async function logUser(
-    test,
-    page: Page,
-    user: { email: string, password: string },
-    options: {
-        mailBuffer ?: MailBuffer,
-        mail2fa?: boolean,
-        notNewDevice?: boolean,
-        totp?: OTPAuth.TOTP,
-    } = {}
-) {
+export async function logUser(test, page: Page, user: { email: string, password: string }, mailBuffer?: MailBuffer) {
    await test.step(`Log user ${user.email}`, async () => {
        await utils.cleanLanding(page);

@@ -54,35 +43,16 @@ export async function logUser(
        await page.getByRole('button', { name: 'Continue' }).click();

        // Unlock page
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
-        await page.getByRole('button', { name: 'Log in', exact: true }).click();
+        await page.getByLabel('Master password').fill(user.password);
+        await page.getByRole('button', { name: 'Log in with master password' }).click();

-        if( options.mail2fa || options.totp ){
-            let code;
-
-            await test.step('2FA check', async () => {
-                await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
-
-                if( options.totp ) {
-                    const totp = options.totp;
-                    let timestamp = Date.now(); // Needed to use the next token
-                    timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
-                    code = totp.generate({timestamp});
-                } else if( options.mail2fa ){
-                    code = await retrieveEmailCode(test, page, options.mailBuffer);
-                }
-
-                await page.getByLabel(/Verification code/).fill(code);
-
-                await page.getByRole('button', { name: 'Continue' }).click();
-            });
-        }
+        await utils.ignoreExtension(page);

        // We are now in the default vault page
        await expect(page).toHaveTitle(/Vaultwarden Web/);

-        if( options.mailBuffer && !options.notNewDevice ){
-            await options.mailBuffer.expect((m) => m.subject === "New Device Logged In From Firefox");
+        if( mailBuffer ){
+            await mailBuffer.expect((m) => m.subject === "New Device Logged In From Firefox");
        }
    });
 }
@@ -1,7 +1,6 @@
 import { test, expect, type TestInfo } from '@playwright/test';
 import { MailDev } from 'maildev';

-import * as admin from "./setups/admin";
 import { logNewUser, logUser } from './setups/sso';
 import { activateEmail, disableEmail } from './setups/2fa';
 import * as utils from "../global-utils";
@@ -20,7 +19,7 @@ test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {

    await utils.startVault(browser, testInfo, {
        SSO_ENABLED: true,
-        SSO_ONLY: true,
+        SSO_ONLY: false,
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
    });
@@ -33,64 +32,22 @@ test.afterAll('Teardown', async ({}) => {
    }
 });

-test('2FA email', async ({ page }) => {
-
+test('Create and activate 2FA', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);

    await logNewUser(test, page, users.user1, {mailBuffer: mailBuffer});

    await activateEmail(test, page, users.user1, mailBuffer);

-    await logUser(test, page, users.user1, {mailBuffer: mailBuffer, mail2fa: true, notNewDevice: true});
+    mailBuffer.close();
+});
+
+test('Log and disable', async ({ page }) => {
+    const mailBuffer = mailserver.buffer(users.user1.email);
+
+    await logUser(test, page, users.user1, {mailBuffer: mailBuffer, mail2fa: true});

    await disableEmail(test, page, users.user1);

    mailBuffer.close();
 });
-
-
-test('Admin invite', async ({ page }) => {
-    const mailBuffer = mailserver.buffer(users.user2.email);
-
-    await admin.login(test, page);
-    await admin.invite(test, page, users.user2.email);
-
-
-    const link = await test.step('Extract email link', async () => {
-        const invited = await mailBuffer.expect((m) => m.subject === "Join Vaultwarden");
-        await page.setContent(invited.html);
-        return await page.getByTestId("invite").getAttribute("href");
-    });
-
-    await test.step('Redirect to Keycloak', async () => {
-        await page.goto(link);
-    });
-
-    await test.step('Keycloak login', async () => {
-        await expect(page.getByRole('heading', { name: 'Sign in to your account' })).toBeVisible();
-        await page.getByLabel(/Username/).fill(users.user2.name);
-        await page.getByLabel('Password', { exact: true }).fill(users.user2.password);
-        await page.getByRole('button', { name: 'Sign In' }).click();
-    });
-
-    await test.step('Create Vault account', async () => {
-        await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
-        await page.getByRole('button', { name: 'Create account' }).click();
-    });
-
-    await test.step('Default vault page', async () => {
-        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
-
-        await utils.checkNotification(page, 'Account successfully created!');
-        await utils.checkNotification(page, 'Invitation accepted');
-    });
-
-    await test.step('Check mails', async () => {
-        await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
-        await mailBuffer.expect((m) => m.subject === "Welcome");
-    });
-
-    mailBuffer.close();
-});
@@ -33,8 +33,8 @@ test('Non SSO login', async ({ page }) => {
    await page.getByRole('button', { name: 'Other' }).click();

    // Unlock page
-    await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
-    await page.getByRole('button', { name: 'Log in', exact: true }).click();
+    await page.getByLabel('Master password').fill(users.user1.password);
+    await page.getByRole('button', { name: 'Log in with master password' }).click();

    // We are now in the default vault page
    await expect(page).toHaveTitle(/Vaultwarden Web/);
@@ -58,7 +58,6 @@ test('Non SSO login impossible', async ({ page, browser }, testInfo: TestInfo) =

    // Landing page
    await page.goto('/');
-    await page.locator("input[type=email].vw-email-sso").fill(users.user1.email);

    // Check that SSO login is available
    await expect(page.getByRole('button', { name: /Use single sign-on/ })).toHaveCount(1);
@@ -67,6 +66,7 @@ test('Non SSO login impossible', async ({ page, browser }, testInfo: TestInfo) =
    await expect(page.getByRole('button', { name: 'Other' })).toHaveCount(0);
 });

+
 test('No SSO login', async ({ page }, testInfo: TestInfo) => {
    await utils.restartVault(page, testInfo, {
        SSO_ENABLED: false
@@ -74,14 +74,12 @@ test('No SSO login', async ({ page }, testInfo: TestInfo) => {

    // Landing page
    await page.goto('/');
-    await page.getByLabel(/Email address/).fill(users.user1.email);

    // No SSO button (rely on a correct selector checked in previous test)
-    await page.getByLabel('Master password');
    await expect(page.getByRole('button', { name: /Use single sign-on/ })).toHaveCount(0);

    // Can continue to Master password
    await page.getByLabel(/Email address/).fill(users.user1.email);
    await page.getByRole('button', { name: 'Continue' }).click();
-    await expect(page.getByRole('button', { name: 'Log in' })).toHaveCount(1);
+    await expect(page.getByRole('button', { name: 'Log in with master password' })).toHaveCount(1);
 });
@@ -67,16 +67,17 @@ test('invited with new account', async ({ page }) => {

    await test.step('Create Vault account', async () => {
        await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
+        await page.getByLabel('Confirm master password (').fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
+
+        await utils.checkNotification(page, 'Account successfully created!');
+        await utils.checkNotification(page, 'Invitation accepted');
+        await utils.ignoreExtension(page);
    });

    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle(/Vaultwarden Web/);
-
-        await utils.checkNotification(page, 'Account successfully created!');
-        await utils.checkNotification(page, 'Invitation accepted');
    });

    await test.step('Check mails', async () => {
@@ -94,7 +95,6 @@ test('invited with existing account', async ({ page }) => {

    await test.step('Redirect to Keycloak', async () => {
        await page.goto(link);
-        await page.getByRole('button', { name: /Use single sign-on/ }).click();
    });

    await test.step('Keycloak login', async () => {
@@ -108,11 +108,13 @@ test('invited with existing account', async ({ page }) => {
        await expect(page).toHaveTitle('Vaultwarden Web');
        await page.getByLabel('Master password').fill(users.user3.password);
        await page.getByRole('button', { name: 'Unlock' }).click();
+
+        await utils.checkNotification(page, 'Invitation accepted');
+        await utils.ignoreExtension(page);
    });

    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle(/Vaultwarden Web/);
-        await utils.checkNotification(page, 'Successfully accepted your invitation');
    });

    await test.step('Check mails', async () => {
@@ -49,7 +49,7 @@ test('Organization is visible', async ({ page }) => {
    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
 });

-test('Activate password policy', async ({ page }) => {
+test('Enforce password policy', async ({ page }) => {
    await logUser(test, page, users.user1);
    await orgs.policies(test, page, '/Test');

@@ -61,27 +61,16 @@ test('Activate password policy', async ({ page }) => {
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Edited policy Master password requirements.');
    });
-});

-test('Unlock trigger policyy', async ({ page }) => {
-    await page.goto('/', { waitUntil: 'domcontentloaded' });
+    await utils.logout(test, page, users.user1);

-    await page.locator("input[type=email].vw-email-sso").fill(users.user2.email);
-    await page.getByRole('button', { name: /Use single sign-on/ }).click();
+    await test.step(`Unlock trigger policy`, async () => {
+        await page.locator("input[type=email].vw-email-sso").fill(users.user1.email);
+        await page.getByRole('button', { name: 'Use single sign-on' }).click();

-    await test.step('Keycloak login', async () => {
-        await expect(page.getByRole('heading', { name: 'Sign in to your account' })).toBeVisible();
-        await page.getByLabel(/Username/).fill(users.user2.name);
-        await page.getByLabel('Password', { exact: true }).fill(users.user2.password);
-        await page.getByRole('button', { name: 'Sign In' }).click();
-    });
-
-    await test.step('Unlock vault', async () => {
-        await expect(page).toHaveTitle('Vaultwarden Web');
-        await expect(page.getByRole('heading', { name: 'Your vault is locked' })).toBeVisible();
-        await page.getByLabel('Master password').fill(users.user2.password);
+        await page.getByRole('textbox', { name: 'Master password (required)' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Unlock' }).click();
-    });

        await expect(page.getByRole('heading', { name: 'Update master password' })).toBeVisible();
    });
+});
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.99.1"
+channel = "1.94.1"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
@@ -1,4 +1,4 @@
-edition = "2024"
+edition = "2021"
 max_width = 120
 newline_style = "Unix"
 use_small_heuristics = "Off"
@@ -2,40 +2,39 @@ use std::{env, sync::LazyLock};

 use reqwest::Method;
 use rocket::{
-    Catcher, Route,
    form::Form,
    http::{Cookie, CookieJar, MediaType, SameSite, Status},
    request::{FromRequest, Outcome, Request},
-    response::{Redirect, content::RawHtml as Html},
+    response::{content::RawHtml as Html, Redirect},
    serde::json::Json,
+    Catcher, Route,
 };
 use serde::de::DeserializeOwned;
 use serde_json::Value;

 use crate::{
-    CONFIG, VERSION,
    api::{
-        ApiResult, EmptyResult, JsonResult, Notify,
        core::{log_event, two_factor},
-        unregister_push_device,
+        unregister_push_device, ApiResult, EmptyResult, JsonResult, Notify,
    },
-    auth::{ClientIp, Secure, decode_admin, encode_jwt, generate_admin_claims},
+    auth::{decode_admin, encode_jwt, generate_admin_claims, ClientIp, Secure},
    config::ConfigBuilder,
    db::{
-        ACTIVE_DB_TYPE, DbConn, DbConnType, backup_sqlite, get_sql_server_version,
+        backup_sqlite, get_sql_server_version,
        models::{
            Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
            MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
        },
+        DbConn, DbConnType, ACTIVE_DB_TYPE,
    },
    error::{Error, MapResult},
    http_client::make_http_request,
    mail,
-    sso::FAKE_SSO_IDENTIFIER,
    util::{
-        FeatureFlagFilter, NumberOrString, container_base_image, format_naive_datetime_local, get_active_web_release,
-        get_display_size, is_running_in_container, parse_experimental_client_feature_flags,
+        container_base_image, format_naive_datetime_local, get_active_web_release, get_display_size,
+        is_running_in_container, parse_experimental_client_feature_flags, FeatureFlagFilter, NumberOrString,
    },
+    CONFIG, VERSION,
 };

 pub fn routes() -> Vec<Route> {
@@ -93,7 +92,8 @@ static DB_TYPE: LazyLock<&str> = LazyLock::new(|| match ACTIVE_DB_TYPE.get() {
 });

 #[cfg(sqlite)]
-static CAN_BACKUP: LazyLock<bool> = LazyLock::new(|| ACTIVE_DB_TYPE.get().is_some_and(|t| *t == DbConnType::Sqlite));
+static CAN_BACKUP: LazyLock<bool> =
+    LazyLock::new(|| ACTIVE_DB_TYPE.get().map(|t| *t == DbConnType::Sqlite).unwrap_or(false));
 #[cfg(not(sqlite))]
 static CAN_BACKUP: LazyLock<bool> = LazyLock::new(|| false);

@@ -199,17 +199,20 @@ fn post_admin_login(
    }

    // If the token is invalid, redirect to login page
-    if validate_token(&data.token) {
+    if !_validate_token(&data.token) {
+        error!("Invalid admin token. IP: {}", ip.ip);
+        Err(AdminResponse::Unauthorized(render_admin_login(
+            Some("Invalid admin token, please try again."),
+            redirect.as_deref(),
+        )))
+    } else {
        // If the token received is valid, generate JWT and save it as a cookie
-        let claims = match generate_admin_claims() {
-            Ok(claims) => claims,
-            Err(e) => return Err(AdminResponse::Ok(render_admin_login(Some(e.message()), redirect.as_deref()))),
-        };
+        let claims = generate_admin_claims();
        let jwt = encode_jwt(&claims);

        let cookie = Cookie::build((COOKIE_NAME, jwt))
            .path(admin_path())
-            .max_age(time::Duration::minutes(i64::from(CONFIG.admin_session_lifetime())))
+            .max_age(time::Duration::minutes(CONFIG.admin_session_lifetime()))
            .same_site(SameSite::Strict)
            .http_only(true)
            .secure(secure.https);
@@ -220,21 +223,15 @@ fn post_admin_login(
        } else {
            Err(AdminResponse::Ok(render_admin_page()))
        }
-    } else {
-        error!("Invalid admin token. IP: {}", ip.ip);
-        Err(AdminResponse::Unauthorized(render_admin_login(
-            Some("Invalid admin token, please try again."),
-            redirect.as_deref(),
-        )))
    }
 }

-fn validate_token(token: &str) -> bool {
+fn _validate_token(token: &str) -> bool {
    match CONFIG.admin_token().as_ref() {
        None => false,
        Some(t) if t.starts_with("$argon2") => {
            use argon2::password_hash::PasswordVerifier;
-            match argon2::password_hash::phc::PasswordHash::new(t) {
+            match argon2::password_hash::PasswordHash::new(t) {
                Ok(h) => {
                    // NOTE: hash params from `ADMIN_TOKEN` are used instead of what is configured in the `Argon2` instance.
                    argon2::Argon2::default().verify_password(token.trim().as_ref(), &h).is_ok()
@@ -309,21 +306,6 @@ async fn get_user_or_404(user_id: &UserId, conn: &DbConn) -> ApiResult<User> {

 #[post("/invite", format = "application/json", data = "<data>")]
 async fn invite_user(data: Json<InviteData>, _token: AdminToken, conn: DbConn) -> JsonResult {
-    async fn generate_invite(user: &User, conn: &DbConn) -> EmptyResult {
-        if CONFIG.mail_enabled() {
-            let org_id: OrganizationId = if CONFIG.sso_enabled() {
-                FAKE_SSO_IDENTIFIER.into()
-            } else {
-                FAKE_ADMIN_UUID.into()
-            };
-            let member_id: MembershipId = FAKE_ADMIN_UUID.to_owned().into();
-            mail::send_invite(user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
-        } else {
-            let invitation = Invitation::new(&user.email);
-            invitation.save(conn).await
-        }
-    }
-
    let data: InviteData = data.into_inner();
    if User::find_by_mail(&data.email, &conn).await.is_some() {
        err_code!("User already exists", Status::Conflict.code)
@@ -331,7 +313,18 @@ async fn invite_user(data: Json<InviteData>, _token: AdminToken, conn: DbConn) -

    let mut user = User::new(&data.email, None);

-    generate_invite(&user, &conn).await.map_err(|e| e.with_code(Status::InternalServerError.code))?;
+    async fn _generate_invite(user: &User, conn: &DbConn) -> EmptyResult {
+        if CONFIG.mail_enabled() {
+            let org_id: OrganizationId = FAKE_ADMIN_UUID.to_string().into();
+            let member_id: MembershipId = FAKE_ADMIN_UUID.to_string().into();
+            mail::send_invite(user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
+        } else {
+            let invitation = Invitation::new(&user.email);
+            invitation.save(conn).await
+        }
+    }
+
+    _generate_invite(&user, &conn).await.map_err(|e| e.with_code(Status::InternalServerError.code))?;
    user.save(&conn).await.map_err(|e| e.with_code(Status::InternalServerError.code))?;

    Ok(Json(user.to_json(&conn).await))
@@ -388,7 +381,7 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri
            None => json!("Never"),
        };

-        usr["sso_identifier"] = json!(sso_u.map_or(String::new(), |u| u.identifier.to_string()));
+        usr["sso_identifier"] = json!(sso_u.map(|u| u.identifier.to_string()).unwrap_or(String::new()));

        users_json.push(usr);
    }
@@ -428,7 +421,7 @@ async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyR

    for membership in memberships {
        log_event(
-            EventType::OrganizationUserDeleted,
+            EventType::OrganizationUserDeleted as i32,
            &membership.uuid,
            &membership.org_uuid,
            &ACTING_ADMIN_USER.into(),
@@ -449,7 +442,7 @@ async fn delete_sso_user(user_id: UserId, token: AdminToken, conn: DbConn) -> Em

    for membership in memberships {
        log_event(
-            EventType::OrganizationUserUnlinkedSso,
+            EventType::OrganizationUserUnlinkedSso as i32,
            &membership.uuid,
            &membership.org_uuid,
            &ACTING_ADMIN_USER.into(),
@@ -471,10 +464,10 @@ async fn deauth_user(user_id: UserId, _token: AdminToken, conn: DbConn, nt: Noti

    if CONFIG.push_enabled() {
        for device in Device::find_push_devices_by_user(&user.uuid, &conn).await {
-            match unregister_push_device(device.push_uuid.as_ref()).await {
+            match unregister_push_device(&device.push_uuid).await {
                Ok(r) => r,
                Err(e) => error!("Unable to unregister devices from Bitwarden server: {e}"),
-            }
+            };
        }
    }

@@ -511,7 +504,6 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty
 async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
    let mut user = get_user_or_404(&user_id, &conn).await?;
    TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
-    Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
    two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?;
    user.totp_recover = None;
    user.save(&conn).await
@@ -526,12 +518,8 @@ async fn resend_user_invite(user_id: UserId, _token: AdminToken, conn: DbConn) -
        }

        if CONFIG.mail_enabled() {
-            let org_id: OrganizationId = if CONFIG.sso_enabled() {
-                FAKE_SSO_IDENTIFIER.into()
-            } else {
-                FAKE_ADMIN_UUID.into()
-            };
-            let member_id: MembershipId = FAKE_ADMIN_UUID.to_owned().into();
+            let org_id: OrganizationId = FAKE_ADMIN_UUID.to_string().into();
+            let member_id: MembershipId = FAKE_ADMIN_UUID.to_string().into();
            mail::send_invite(&user, org_id, member_id, &CONFIG.invitation_org_name(), None).await
        } else {
            Ok(())
@@ -557,10 +545,9 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
        err!("The specified user isn't member of the organization")
    };

-    let new_type = if let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) {
-        new_type as i32
-    } else {
-        err!("Invalid type")
+    let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
+        Some(new_type) => new_type as i32,
+        None => err!("Invalid type"),
    };

    if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
@@ -575,7 +562,7 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
    OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;

    log_event(
-        EventType::OrganizationUserUpdated,
+        EventType::OrganizationUserUpdated as i32,
        &member_to_edit.uuid,
        &data.org_uuid,
        &ACTING_ADMIN_USER.into(),
@@ -647,11 +634,11 @@ async fn has_http_access() -> bool {
    }
 }

-use cached::macros::cached;
+use cached::proc_macro::cached;
 /// Cache this function to prevent API call rate limit. Github only allows 60 requests per hour, and we use 3 here already
 /// It will cache this function for 600 seconds (10 minutes) which should prevent the exhaustion of the rate limit
 /// Any cache will be lost if Vaultwarden is restarted
-#[cached(ttl_secs = 600, sync_writes = "default")]
+#[cached(time = 600, sync_writes = "default")]
 async fn get_release_info(has_http_access: bool) -> (String, String, String) {
    // If the HTTP Check failed, do not even attempt to check for new versions since we were not able to connect with github.com anyway.
    if has_http_access {
@@ -660,35 +647,35 @@ async fn get_release_info(has_http_access: bool) -> (String, String, String) {
                .await
            {
                Ok(r) => r.tag_name,
-                _ => "-".to_owned(),
+                _ => "-".to_string(),
            },
            match get_json_api::<GitCommit>("https://api.github.com/repos/dani-garcia/vaultwarden/commits/main").await {
                Ok(mut c) => {
                    c.sha.truncate(8);
                    c.sha
                }
-                _ => "-".to_owned(),
+                _ => "-".to_string(),
            },
            // Do not fetch the web-vault version when running within a container
            // The web-vault version is embedded within the container it self, and should not be updated manually
            match get_json_api::<GitRelease>("https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest")
                .await
            {
-                Ok(r) => r.tag_name.trim_start_matches('v').to_owned(),
-                _ => "-".to_owned(),
+                Ok(r) => r.tag_name.trim_start_matches('v').to_string(),
+                _ => "-".to_string(),
            },
        )
    } else {
-        ("-".to_owned(), "-".to_owned(), "-".to_owned())
+        ("-".to_string(), "-".to_string(), "-".to_string())
    }
 }

 async fn get_ntp_time(has_http_access: bool) -> String {
-    if has_http_access && let Ok(cf_trace) = get_text_api("https://cloudflare.com/cdn-cgi/trace").await {
+    if has_http_access {
+        if let Ok(cf_trace) = get_text_api("https://cloudflare.com/cdn-cgi/trace").await {
            for line in cf_trace.lines() {
-            if let Some((key, value)) = line.split_once('=')
-                && key == "ts"
-            {
+                if let Some((key, value)) = line.split_once('=') {
+                    if key == "ts" {
                        let ts = value.split_once('.').map_or(value, |(s, _)| s);
                        if let Ok(dt) = chrono::DateTime::parse_from_str(ts, "%s") {
                            return dt.format("%Y-%m-%d %H:%M:%S UTC").to_string();
@@ -697,6 +684,8 @@ async fn get_ntp_time(has_http_access: bool) -> String {
                    }
                }
            }
+        }
+    }
    String::from("Unable to fetch NTP time.")
 }

@@ -720,36 +709,6 @@ fn web_vault_compare(active: &str, latest: &str) -> i8 {
    }
 }

-fn check_template_overrides() -> Vec<&'static str> {
-    let template_folder = std::path::PathBuf::from(CONFIG.templates_folder());
-    let mut overrides = Vec::new();
-    for folder in ["admin", "email", "scss"] {
-        if folder_has_hbs_files(&template_folder.join(folder)) {
-            overrides.push(folder);
-        }
-    }
-
-    if folder_has_hbs_files(&template_folder) {
-        overrides.push("other");
-    }
-
-    overrides
-}
-
-fn folder_has_hbs_files(dir: &std::path::Path) -> bool {
-    let Ok(files) = std::fs::read_dir(dir) else {
-        // No files in this directory at all, so we can return false
-        return false;
-    };
-
-    files.flatten().any(|f| {
-        // Validate if it is a file and if it has the `.hbs` extension and starts with a-z or 0-9
-        f.file_type().is_ok_and(|t| t.is_file())
-            && f.path().extension().is_some_and(|e| e.eq_ignore_ascii_case("hbs"))
-            && f.file_name().to_str().is_some_and(|n| n.starts_with(|c: char| c.is_ascii_alphanumeric()))
-    })
-}
-
 #[get("/diagnostics")]
 async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> ApiResult<Html<String>> {
    use chrono::prelude::*;
@@ -766,7 +725,7 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
    // Check if we are able to resolve DNS entries
    let dns_resolved = match ("github.com", 0).to_socket_addrs().map(|mut i| i.next()) {
        Ok(Some(a)) => a.ip().to_string(),
-        _ => "Unable to resolve domain name.".to_owned(),
+        _ => "Unable to resolve domain name.".to_string(),
    };

    let (latest_vw_release, latest_vw_commit, latest_web_release) = get_release_info(has_http_access).await;
@@ -777,13 +736,11 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A

    let invalid_feature_flags: Vec<String> = parse_experimental_client_feature_flags(
        &CONFIG.experimental_client_feature_flags(),
-        &FeatureFlagFilter::InvalidOnly,
+        FeatureFlagFilter::InvalidOnly,
    )
    .into_keys()
    .collect();

-    let invalid_env_vars = crate::util::INVALID_ENV_VARS.lock().unwrap().join(", ");
-
    let diagnostics_json = json!({
        "dns_resolved": dns_resolved,
        "current_release": VERSION,
@@ -806,9 +763,6 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
        "db_version": get_sql_server_version(&conn).await,
        "admin_url": format!("{}/diagnostics", admin_url()),
        "overrides": &CONFIG.get_overrides().join(", "),
-        "config_file_status": &CONFIG.get_config_file_status(),
-        "template_overrides": check_template_overrides().join(", "),
-        "invalid_env_vars": invalid_env_vars,
        "invalid_feature_flags": invalid_feature_flags,
        "host_arch": env::consts::ARCH,
        "host_os":  env::consts::OS,
@@ -871,30 +825,33 @@ impl<'r> FromRequest<'r> for AdminToken {
    type Error = &'static str;

    async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
-        let Outcome::Success(ip) = ClientIp::from_request(request).await else {
-            err_handler!("Error getting Client IP")
+        let ip = match ClientIp::from_request(request).await {
+            Outcome::Success(ip) => ip,
+            _ => err_handler!("Error getting Client IP"),
        };

        if !CONFIG.disable_admin_token() {
            let cookies = request.cookies();

-            let access_token = if let Some(cookie) = cookies.get(COOKIE_NAME) {
-                cookie.value()
-            } else {
+            let access_token = match cookies.get(COOKIE_NAME) {
+                Some(cookie) => cookie.value(),
+                None => {
                    let requested_page =
                        request.segments::<std::path::PathBuf>(0..).unwrap_or_default().display().to_string();
                    // When the requested page is empty, it is `/admin`, in that case, Forward, so it will render the login page
                    // Else, return a 401 failure, which will be caught
                    if requested_page.is_empty() {
                        return Outcome::Forward(Status::Unauthorized);
-                }
+                    } else {
                        return Outcome::Error((Status::Unauthorized, "Unauthorized"));
+                    }
+                }
            };

            if decode_admin(access_token).is_err() {
                // Remove admin cookie
                cookies.remove(Cookie::build(COOKIE_NAME).path(admin_path()));
-                error!("Invalid or expired admin JWT. IP: {}.", ip.ip);
+                error!("Invalid or expired admin JWT. IP: {}.", &ip.ip);
                return Outcome::Error((Status::Unauthorized, "Session expired"));
            }
        }
@@ -913,23 +870,23 @@ mod tests {
    fn validate_web_vault_compare() {
        // web_vault_compare(active, latest)
        // Test normal versions
-        assert_eq!(web_vault_compare("2025.12.0", "2025.12.1"), -1);
-        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1"), 0);
-        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1"), 1);
+        assert!(web_vault_compare("2025.12.0", "2025.12.1") == -1);
+        assert!(web_vault_compare("2025.12.1", "2025.12.1") == 0);
+        assert!(web_vault_compare("2025.12.2", "2025.12.1") == 1);

        // Test patched/+build.n versions
        // Newer latest version
-        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1"), -1);
-        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1+build.1"), -1);
-        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1"), -1);
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2"), -1);
+        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1") == -1);
+        assert!(web_vault_compare("2025.12.1", "2025.12.1+build.1") == -1);
+        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1") == -1);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2") == -1);
        // Equal versions
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1"), 0);
-        assert_eq!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2"), 0);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1") == 0);
+        assert!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2") == 0);
        // Newer active version
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1"), 1);
-        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1+build.1"), 1);
-        assert_eq!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1"), 1);
-        assert_eq!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2"), 1);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1") == 1);
+        assert!(web_vault_compare("2025.12.2", "2025.12.1+build.1") == 1);
+        assert!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1") == 1);
+        assert!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2") == 1);
    }
 }
@@ -1,38 +1,34 @@
 use std::collections::HashSet;

+use crate::db::DbPool;
 use chrono::Utc;
-use rocket::{
-    http::Status,
-    request::{FromRequest, Outcome, Request},
-    serde::json::Json,
-};
+use rocket::serde::json::Json;
 use serde_json::Value;

 use crate::{
-    CONFIG,
    api::{
-        AnonymousNotify, ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
        core::{accept_org_invite, log_user_event, two_factor::email},
-        master_password_policy, register_push_device, unregister_push_device,
+        master_password_policy, register_push_device, unregister_push_device, AnonymousNotify, ApiResult, EmptyResult,
+        JsonResult, Notify, PasswordOrOtpData, UpdateType,
    },
-    auth::{ClientHeaders, ClientIp, Headers, decode_delete, decode_invite, decode_verify_email},
+    auth::{decode_delete, decode_invite, decode_verify_email, ClientHeaders, Headers},
    crypto,
    db::{
-        DbConn, DbPool,
        models::{
-            AuthRequest, AuthRequestId, Cipher, CipherId, Device, DeviceId, DeviceType, DeviceWithAuthRequest,
-            EmergencyAccess, EmergencyAccessId, EventType, Folder, FolderId, Invitation, KeyId, Membership,
-            MembershipId, OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, User, UserId,
-            UserKdfType,
+            AuthRequest, AuthRequestId, Cipher, CipherId, Device, DeviceId, DeviceType, EmergencyAccess,
+            EmergencyAccessId, EventType, Folder, FolderId, Invitation, Membership, MembershipId, OrgPolicy,
+            OrgPolicyType, Organization, OrganizationId, Send, SendId, User, UserId, UserKdfType,
        },
+        DbConn,
    },
    mail,
-    util::{NumberOrString, deser_opt_nonempty_str, format_date},
+    util::{deser_opt_nonempty_str, format_date, NumberOrString},
+    CONFIG,
 };

-use super::{
-    ciphers::{CipherData, update_cipher_from_data},
-    sends::SendData,
+use rocket::{
+    http::Status,
+    request::{FromRequest, Outcome, Request},
 };

 pub fn routes() -> Vec<rocket::Route> {
@@ -42,13 +38,11 @@ pub fn routes() -> Vec<rocket::Route> {
        post_profile,
        put_avatar,
        get_public_keys,
-        get_keys,
        post_keys,
        post_password,
        post_set_password,
        post_kdf,
        post_rotatekey,
-        post_user_key,
        post_sstamp,
        post_email_token,
        post_email,
@@ -60,8 +54,9 @@ pub fn routes() -> Vec<rocket::Route> {
        delete_account,
        revision_date,
        password_hint,
+        prelogin,
        verify_password,
-        post_api_key,
+        api_key,
        rotate_api_key,
        get_known_device,
        get_all_devices,
@@ -93,30 +88,27 @@ pub struct KDFData {
    kdf_parallelism: Option<i32>,
 }

-impl KDFData {
-    pub(super) fn matches_user(&self, user: &User) -> bool {
-        self.kdf == user.client_kdf_type
-            && self.kdf_iterations == user.client_kdf_iter
-            && self.kdf_memory == user.client_kdf_memory
-            && self.kdf_parallelism == user.client_kdf_parallelism
-    }
-}
-
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RegisterData {
    email: String,

    #[serde(flatten)]
-    compat: RegisterDataCompat,
+    kdf: KDFData,

+    #[serde(alias = "userSymmetricKey")]
+    key: String,
    #[serde(alias = "userAsymmetricKeys")]
    keys: Option<KeysData>,

+    master_password_hash: String,
    master_password_hint: Option<String>,

+    name: Option<String>,
+
    organization_user_id: Option<MembershipId>,

+    // Used only from the register/finish endpoint
    email_verification_token: Option<String>,
    accept_emergency_access_id: Option<EmergencyAccessId>,
    accept_emergency_access_invite_token: Option<String>,
@@ -124,106 +116,6 @@ pub struct RegisterData {
    org_invite_token: Option<String>,
 }

-impl RegisterData {
-    fn hash(&self) -> String {
-        self.compat.fold(|rdc| &rdc.master_password_hash, |rdcu| &rdcu.master_password_authentication.hash).to_owned()
-    }
-
-    fn kdf(&self) -> &KDFData {
-        self.compat.fold(|rdc| &rdc.kdf, |rdcu| &rdcu.master_password_authentication.kdf)
-    }
-
-    fn key(&self) -> String {
-        self.compat.fold(|rdc| &rdc.key, |rdcu| &rdcu.master_password_unlock.key).to_owned()
-    }
-
-    // When comparing with salt, email need to be normalized:
-    //  - https://github.com/bitwarden/clients/blob/web-v2026.5.0/libs/common/src/key-management/master-password/services/master-password.service.ts#L171
-    fn unprocessable(&self) -> bool {
-        let mut unprocessable = false;
-        *self.compat.fold(
-            |_| &false,
-            |rdcu| {
-                let email = self.email.trim().to_lowercase();
-                unprocessable = rdcu.master_password_authentication.kdf != rdcu.master_password_unlock.kdf
-                    || rdcu.master_password_authentication.salt != email
-                    || rdcu.master_password_unlock.salt != email;
-                &unprocessable
-            },
-        )
-    }
-}
-
-#[derive(Debug, Deserialize)]
-struct RegisterDataOld {
-    #[serde(flatten)]
-    kdf: KDFData,
-
-    #[serde(alias = "userSymmetricKey")]
-    key: String,
-
-    #[serde(alias = "masterPasswordHash")]
-    master_password_hash: String,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct RegisterDataCur {
-    #[serde(alias = "MasterPasswordAuthentication")]
-    master_password_authentication: MasterPasswordAuthentication,
-    #[serde(alias = "MasterPasswordUnlock")]
-    master_password_unlock: MasterPasswordUnlock,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(untagged)]
-enum RegisterDataCompat {
-    RegisterDataOld(RegisterDataOld),
-    RegisterDataCur(RegisterDataCur),
-}
-
-impl RegisterDataCompat {
-    fn fold<'a, T>(
-        &'a self,
-        fct: impl FnOnce(&'a RegisterDataOld) -> &'a T,
-        fcu: impl FnOnce(&'a RegisterDataCur) -> &'a T,
-    ) -> &'a T {
-        match self {
-            RegisterDataCompat::RegisterDataOld(rdc) => fct(rdc),
-            RegisterDataCompat::RegisterDataCur(rdcu) => fcu(rdcu),
-        }
-    }
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct KeysData {
-    encrypted_private_key: String,
-    public_key: String,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MasterPasswordAuthentication {
-    #[serde(alias = "Kdf")]
-    kdf: KDFData,
-    #[serde(alias = "Salt")]
-    salt: String,
-
-    #[serde(alias = "masterPasswordAuthenticationHash", alias = "MasterPasswordAuthenticationHash")]
-    hash: String,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MasterPasswordUnlock {
-    kdf: KDFData,
-    salt: String,
-
-    #[serde(alias = "masterKeyWrappedUserKey")]
-    key: String,
-}
-
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SetPasswordData {
@@ -237,18 +129,25 @@ pub struct SetPasswordData {
    org_identifier: Option<String>,
 }

+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct KeysData {
+    encrypted_private_key: String,
+    public_key: String,
+}
+
 /// Trims whitespace from password hints, and converts blank password hints to `None`.
-fn clean_password_hint(password_hint: Option<&String>) -> Option<String> {
+fn clean_password_hint(password_hint: &Option<String>) -> Option<String> {
    match password_hint {
        None => None,
        Some(h) => match h.trim() {
            "" => None,
-            ht => Some(ht.to_owned()),
+            ht => Some(ht.to_string()),
        },
    }
 }

-fn enforce_password_hint_setting(password_hint: Option<&String>) -> EmptyResult {
+fn enforce_password_hint_setting(password_hint: &Option<String>) -> EmptyResult {
    if password_hint.is_some() && !CONFIG.password_hints_allowed() {
        err!("Password hints have been disabled by the administrator. Remove the hint and try again.");
    }
@@ -267,19 +166,17 @@ async fn is_email_2fa_required(member_id: Option<MembershipId>, conn: &DbConn) -
    false
 }

-pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
-    let data: RegisterData = data.into_inner();
+pub async fn _register(data: Json<RegisterData>, email_verification: bool, conn: DbConn) -> JsonResult {
+    let mut data: RegisterData = data.into_inner();
    let email = data.email.to_lowercase();

-    let mut name = None;
+    let mut email_verified = false;
+
    let mut pending_emergency_access = None;

-    if data.unprocessable() {
-        err_code!("Unexpected RegisterData format", Status::UnprocessableEntity.code);
-    }
-
    // First, validate the provided verification tokens
-    let mut email_verified = match (
+    if email_verification {
+        match (
            &data.email_verification_token,
            &data.accept_emergency_access_id,
            &data.accept_emergency_access_invite_token,
@@ -294,8 +191,10 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
                }

                // During this call we don't get the name, so extract it from the claims
-            name = claims.name;
-            claims.verified
+                if claims.name.is_some() {
+                    data.name = claims.name;
+                }
+                email_verified = claims.verified;
            }
            // Emergency access registration
            (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => {
@@ -313,7 +212,7 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
                }

                pending_emergency_access = Some((accept_emergency_access_id, claims));
-            true
+                email_verified = true;
            }
            // Org invite
            (None, None, None, Some(organization_user_id), Some(org_invite_token)) => {
@@ -327,26 +226,27 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
                    err!("Claim org_user_id does not match organization_user_id")
                }

-            true
+                email_verified = true;
            }

            _ => {
                err!("Registration is missing required parameters")
            }
-    };
+        }
+    }

    // Check if the length of the username exceeds 50 characters (Same is Upstream Bitwarden)
    // This also prevents issues with very long usernames causing to large JWT's. See #2419
-    if let Some(ref name) = name
-        && name.len() > 50
-    {
+    if let Some(ref name) = data.name {
+        if name.len() > 50 {
            err!("The field Name must be a string with a maximum length of 50.");
        }
+    }

    // Check against the password hint setting here so if it fails, the user
    // can retry without losing their invitation below.
-    let password_hint = clean_password_hint(data.master_password_hint.as_ref());
-    enforce_password_hint_setting(password_hint.as_ref())?;
+    let password_hint = clean_password_hint(&data.master_password_hint);
+    enforce_password_hint_setting(&password_hint)?;

    let mut user = match User::find_by_mail(&email, &conn).await {
        Some(user) => {
@@ -354,8 +254,8 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
                err!("Registration not allowed or user already exists")
            }

-            if let Some(token) = data.org_invite_token.as_ref() {
-                let claims = decode_invite(token)?;
+            if let Some(token) = data.org_invite_token {
+                let claims = decode_invite(&token)?;
                if claims.email == email {
                    // Verify the email address when signing up via a valid invite token
                    email_verified = true;
@@ -393,13 +293,13 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
    // Make sure we don't leave a lingering invitation.
    Invitation::take(&email, &conn).await;

-    set_kdf_data(&mut user, data.kdf())?;
+    set_kdf_data(&mut user, &data.kdf)?;

-    user.set_password(&data.hash(), Some(data.key()), true, None, &conn).await?;
+    user.set_password(&data.master_password_hash, Some(data.key), true, None, &conn).await?;
    user.password_hint = password_hint;

    // Add extra fields if present
-    if let Some(name) = name {
+    if let Some(name) = data.name {
        user.name = name;
    }

@@ -437,7 +337,8 @@ pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
    }

    Ok(Json(json!({
-      "object": "registerFinish",
+      "object": "register",
+      "captchaBypassToken": "",
    })))
 }

@@ -446,14 +347,14 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
    let data: SetPasswordData = data.into_inner();
    let mut user = headers.user;

-    if user.private_key.is_some() || !user.password_hash.is_empty() {
+    if user.private_key.is_some() {
        err!("Account already initialized, cannot set password")
    }

    // Check against the password hint setting here so if it fails,
    // the user can retry without losing their invitation below.
-    let password_hint = clean_password_hint(data.master_password_hint.as_ref());
-    enforce_password_hint_setting(password_hint.as_ref())?;
+    let password_hint = clean_password_hint(&data.master_password_hint);
+    enforce_password_hint_setting(&password_hint)?;

    set_kdf_data(&mut user, &data.kdf)?;

@@ -472,10 +373,8 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
        user.public_key = Some(keys.public_key);
    }

-    if let Some(identifier) = data.org_identifier
-        && identifier != crate::sso::FAKE_SSO_IDENTIFIER
-        && identifier != crate::api::admin::FAKE_ADMIN_UUID
-    {
+    if let Some(identifier) = data.org_identifier {
+        if identifier != crate::sso::FAKE_IDENTIFIER && identifier != crate::api::admin::FAKE_ADMIN_UUID {
            let Some(org) = Organization::find_by_uuid(&identifier.into(), &conn).await else {
                err!("Failed to retrieve the associated organization")
            };
@@ -486,6 +385,7 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:

            accept_org_invite(&user, membership, None, &conn).await?;
        }
+    }

    if CONFIG.mail_enabled() {
        mail::send_welcome(&user.email.to_lowercase()).await?;
@@ -493,12 +393,14 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
        Membership::accept_user_invitations(&user.uuid, &conn).await?;
    }

-    log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+        .await;

    user.save(&conn).await?;

    Ok(Json(json!({
      "object": "set-password",
+      "captchaBypassToken": "",
    })))
 }

@@ -549,11 +451,11 @@ async fn put_avatar(data: Json<AvatarData>, headers: Headers, conn: DbConn) -> J
    // It looks like it only supports the 6 hex color format.
    // If you try to add the short value it will not show that color.
    // Check and force 7 chars, including the #.
-    if let Some(color) = &data.avatar_color
-        && color.len() != 7
-    {
+    if let Some(color) = &data.avatar_color {
+        if color.len() != 7 {
            err!("The field AvatarColor must be a HTML/Hex color code with a length of 7 characters")
        }
+    }

    let mut user = headers.user;
    user.avatar_color = data.avatar_color;
@@ -577,34 +479,12 @@ async fn get_public_keys(user_id: UserId, _headers: Headers, conn: DbConn) -> Js
    })))
 }

-#[get("/accounts/keys")]
-fn get_keys(headers: Headers) -> JsonResult {
-    let user = headers.user;
-
-    // The SDK reads a 404 as the user having no key pair yet
-    if user.private_key.is_none() || user.public_key.is_none() {
-        err_code!("User has no key pair", Status::NotFound.code)
-    }
-
-    Ok(Json(json!({
-        "key": (!user.akey.is_empty()).then_some(&user.akey),
-        "publicKey": user.public_key,
-        "privateKey": user.private_key,
-        "accountKeys": user.account_keys_json(),
-        "object": "keys",
-    })))
-}
-
 #[post("/accounts/keys", data = "<data>")]
 async fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> JsonResult {
    let data: KeysData = data.into_inner();

    let mut user = headers.user;

-    if user.private_key.is_some() || user.public_key.is_some() {
-        err!("User has existing keypair")
-    }
-
    user.private_key = Some(data.encrypted_private_key);
    user.public_key = Some(data.public_key);

@@ -621,51 +501,29 @@ async fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> Json
 #[serde(rename_all = "camelCase")]
 struct ChangePassData {
    master_password_hash: String,
+    new_master_password_hash: String,
    master_password_hint: Option<String>,
-    authentication_data: Option<AuthenticationData>,
-    unlock_data: Option<UnlockData>,
-
-    // Outdated values, might still be used by older clients
-    new_master_password_hash: Option<String>,
-    key: Option<String>,
+    key: String,
 }

 #[post("/accounts/password", data = "<data>")]
 async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
    let data: ChangePassData = data.into_inner();
-    let user = headers.user;
+    let mut user = headers.user;

    if !user.check_valid_password(&data.master_password_hash) {
        err!("Invalid password")
    }

-    log_user_event(EventType::UserChangedPassword, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    user.password_hint = clean_password_hint(&data.master_password_hint);
+    enforce_password_hint_setting(&user.password_hint)?;

-    let (new_master_password_hash, new_key) =
-        if let (Some(unlock_data), Some(authentication_data)) = (data.unlock_data, data.authentication_data) {
-            if authentication_data.kdf != unlock_data.kdf {
-                err!("KDF settings must be equal for authentication and unlock")
-            }
-
-            if user.email != authentication_data.salt || user.email != unlock_data.salt {
-                err!("Invalid master password salt")
-            }
-
-            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
-        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
-            (new_master_password_hash, new_key)
-        } else {
-            err!("Invalid request!")
-        };
-
-    let mut user = user;
-
-    user.password_hint = clean_password_hint(data.master_password_hint.as_ref());
-    enforce_password_hint_setting(user.password_hint.as_ref())?;
+    log_user_event(EventType::UserChangedPassword as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
+        .await;

    user.set_password(
-        &new_master_password_hash,
-        Some(new_key),
+        &data.new_master_password_hash,
+        Some(data.key),
        true,
        Some(vec![
            String::from("post_rotatekey"),
@@ -724,40 +582,27 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult {

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(super) struct AuthenticationData {
-    #[serde(alias = "Salt")]
+struct AuthenticationData {
    salt: String,
-    #[serde(alias = "Kdf")]
-    pub(super) kdf: KDFData,
-    #[serde(alias = "MasterPasswordAuthenticationHash")]
-    pub(super) master_password_authentication_hash: String,
-}
-
-impl AuthenticationData {
-    pub(super) fn check(&self, user: &User, unlock: &UnlockData) -> EmptyResult {
-        if self.kdf != unlock.kdf {
-            err!("KDF settings must be equal for authentication and unlock")
-        }
-
-        if self.salt != user.master_password_salt() || self.salt != unlock.salt {
-            err!("Invalid master password salt")
-        }
-
-        Ok(())
-    }
+    kdf: KDFData,
+    master_password_authentication_hash: String,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(super) struct UnlockData {
+struct UnlockData {
    salt: String,
    kdf: KDFData,
-    pub(super) master_key_wrapped_user_key: String,
+    master_key_wrapped_user_key: String,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct ChangeKdfData {
+    #[allow(dead_code)]
+    new_master_password_hash: String,
+    #[allow(dead_code)]
+    key: String,
    authentication_data: AuthenticationData,
    unlock_data: UnlockData,
    master_password_hash: String,
@@ -771,7 +616,13 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, conn: DbConn, nt:
        err!("Invalid password")
    }

-    data.authentication_data.check(&headers.user, &data.unlock_data)?;
+    if data.authentication_data.kdf != data.unlock_data.kdf {
+        err!("KDF settings must be equal for authentication and unlock")
+    }
+
+    if headers.user.email != data.authentication_data.salt || headers.user.email != data.unlock_data.salt {
+        err!("Invalid master password salt")
+    }

    let mut user = headers.user;

@@ -817,6 +668,9 @@ struct UpdateResetPasswordData {
    reset_password_key: String,
 }

+use super::ciphers::CipherData;
+use super::sends::{update_send_from_data, SendData};
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct KeyData {
@@ -986,7 +840,7 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
            };

            saved_folder.name = folder_data.name;
-            saved_folder.save(&conn).await?;
+            saved_folder.save(&conn).await?
        }
    }

@@ -999,7 +853,7 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
        };

        saved_emergency_access.key_encrypted = Some(emergency_access_data.key_encrypted);
-        saved_emergency_access.save(&conn).await?;
+        saved_emergency_access.save(&conn).await?
    }

    // Update reset password data
@@ -1011,25 +865,24 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
        };

        membership.reset_password_key = Some(reset_password_data.reset_password_key);
-        membership.save(&conn).await?;
+        membership.save(&conn).await?
    }

    // Update send data
    for send_data in data.account_data.sends {
-        let Some(send) = send_data.id.as_ref().and_then(|id| existing_sends.iter_mut().find(|s| &s.uuid == id)) else {
+        let Some(send) = existing_sends.iter_mut().find(|s| &s.uuid == send_data.id.as_ref().unwrap()) else {
            err!("Send doesn't exist")
        };

-        // Like upstream, only the key changes on rotation
-        send.akey = send_data.key;
-        send.save(&conn).await?;
+        update_send_from_data(send, send_data, &headers, &conn, &nt, UpdateType::None).await?;
    }

    // Update cipher data
+    use super::ciphers::update_cipher_from_data;
+
    for cipher_data in data.account_data.ciphers {
        if cipher_data.organization_id.is_none() {
-            let Some(saved_cipher) =
-                cipher_data.id.as_ref().and_then(|id| existing_ciphers.iter_mut().find(|c| &c.uuid == id))
+            let Some(saved_cipher) = existing_ciphers.iter_mut().find(|c| &c.uuid == cipher_data.id.as_ref().unwrap())
            else {
                err!("Cipher doesn't exist")
            };
@@ -1037,7 +890,7 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
            // Prevent triggering cipher updates via WebSockets by settings UpdateType::None
            // The user sessions are invalidated because all the ciphers were re-encrypted and thus triggering an update could cause issues.
            // We force the users to logout after the user has been saved to try and prevent these issues.
-            update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
+            update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?
        }
    }

@@ -1064,23 +917,6 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
    save_result
 }

-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct KeyIdData {
-    user_key_id: KeyId,
-}
-
-#[post("/accounts/key-management/user-key-id", data = "<data>")]
-async fn post_user_key(data: Json<KeyIdData>, headers: Headers, conn: DbConn) -> EmptyResult {
-    let mut user = headers.user;
-    if user.key_id.is_some() {
-        err_code!("Unexpected data", Status::UnprocessableEntity.code);
-    }
-
-    user.key_id = Some(data.into_inner().user_key_id);
-    user.save(&conn).await
-}
-
 #[post("/accounts/security-stamp", data = "<data>")]
 async fn post_sstamp(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
    let data: PasswordOrOtpData = data.into_inner();
@@ -1184,22 +1020,24 @@ async fn post_email(data: Json<ChangeEmailData>, headers: Headers, conn: DbConn,
        err!("Email already in use");
    }

-    if let Some(ref val) = user.email_new {
+    match user.email_new {
+        Some(ref val) => {
            if val != &data.new_email {
                err!("Email change mismatch");
            }
-    } else {
-        err!("No email change pending")
+        }
+        None => err!("No email change pending"),
    }

    if CONFIG.mail_enabled() {
        // Only check the token if we sent out an email...
-        if let Some(ref val) = user.email_new_token {
+        match user.email_new_token {
+            Some(ref val) => {
                if *val != data.token.into_string() {
                    err!("Token mismatch");
                }
-        } else {
-            err!("No email change pending")
+            }
+            None => err!("No email change pending"),
        }
        user.verified_at = Some(Utc::now().naive_utc());
    } else {
@@ -1272,17 +1110,15 @@ struct DeleteRecoverData {
 }

 #[post("/accounts/delete-recover", data = "<data>")]
-async fn post_delete_recover(data: Json<DeleteRecoverData>, ip: ClientIp, conn: DbConn) -> EmptyResult {
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
-
+async fn post_delete_recover(data: Json<DeleteRecoverData>, conn: DbConn) -> EmptyResult {
    let data: DeleteRecoverData = data.into_inner();

    if CONFIG.mail_enabled() {
-        if let Some(user) = User::find_by_mail(&data.email, &conn).await
-            && let Err(e) = mail::send_delete_account(&user.email, &user.uuid).await
-        {
+        if let Some(user) = User::find_by_mail(&data.email, &conn).await {
+            if let Err(e) = mail::send_delete_account(&user.email, &user.uuid).await {
                error!("Error sending delete account email: {e:#?}");
            }
+        }
        Ok(())
    } else {
        // We don't support sending emails, but we shouldn't allow anybody
@@ -1333,7 +1169,6 @@ async fn delete_account(data: Json<PasswordOrOtpData>, headers: Headers, conn: D
    user.delete(&conn).await
 }

-#[expect(clippy::needless_pass_by_value, reason = "Not beneficial for Headers")]
 #[get("/accounts/revision-date")]
 fn revision_date(headers: Headers) -> JsonResult {
    let revision_date = headers.user.updated_at.and_utc().timestamp_millis();
@@ -1347,15 +1182,13 @@ struct PasswordHintData {
 }

 #[post("/accounts/password-hint", data = "<data>")]
-async fn password_hint(data: Json<PasswordHintData>, ip: ClientIp, conn: DbConn) -> EmptyResult {
-    const NO_HINT: &str = "Sorry, you have no password hint...";
-
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
-
+async fn password_hint(data: Json<PasswordHintData>, conn: DbConn) -> EmptyResult {
    if !CONFIG.password_hints_allowed() || (!CONFIG.mail_enabled() && !CONFIG.show_password_hint()) {
        err!("This server is not configured to provide password hints.");
    }

+    const NO_HINT: &str = "Sorry, you have no password hint...";
+
    let data: PasswordHintData = data.into_inner();
    let email = &data.email;

@@ -1366,9 +1199,9 @@ async fn password_hint(data: Json<PasswordHintData>, ip: ClientIp, conn: DbConn)
                // There is still a timing side channel here in that the code
                // paths that send mail take noticeably longer than ones that
                // don't. Add a randomized sleep to mitigate this somewhat.
-                use rand::{RngExt, rngs::SmallRng};
+                use rand::{rngs::SmallRng, RngExt};
                let mut rng: SmallRng = rand::make_rng();
-                let sleep_ms: u64 = rng.random_range(900..=1100);
+                let sleep_ms = rng.random_range(900..=1100) as u64;
                tokio::time::sleep(tokio::time::Duration::from_millis(sleep_ms)).await;
                Ok(())
            } else {
@@ -1395,48 +1228,25 @@ pub struct PreloginData {
    email: String,
 }

-/// Like upstream, an unknown email gets KDF settings picked from a list of common ones by a keyed hash of the email,
-/// so they stay the same between requests. The salt stays null, as for existing users.
-fn unknown_email_kdf(email: &str) -> (i32, i32, Option<i32>, Option<i32>) {
-    const PBKDF2: i32 = UserKdfType::Pbkdf2 as i32;
-    const ARGON2ID: i32 = UserKdfType::Argon2id as i32;
-    // Same list as upstream, the default is in it twice to give it more weight
-    const KDF_SETTINGS: [(i32, i32, Option<i32>, Option<i32>); 6] = [
-        (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
-        (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
-        (PBKDF2, 100_000, None, None),
-        (PBKDF2, 5_000, None, None),
-        (ARGON2ID, 3, Some(64), Some(4)),
-        (ARGON2ID, 6, Some(32), Some(4)),
-    ];
-    KDF_SETTINGS[crate::auth::prelogin_kdf_index(email, KDF_SETTINGS.len())]
+#[post("/accounts/prelogin", data = "<data>")]
+async fn prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
+    _prelogin(data, conn).await
 }

-pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
-
+pub async fn _prelogin(data: Json<PreloginData>, conn: DbConn) -> Json<Value> {
    let data: PreloginData = data.into_inner();
-    // Normalized once, so the lookup and the settings for an unknown email use the same value
-    let email = data.email.trim().to_lowercase();

-    let (kdf_type, kdf_iter, kdf_mem, kdf_para) = match User::find_by_mail(&email, &conn).await {
+    let (kdf_type, kdf_iter, kdf_mem, kdf_para) = match User::find_by_mail(&data.email, &conn).await {
        Some(user) => (user.client_kdf_type, user.client_kdf_iter, user.client_kdf_memory, user.client_kdf_parallelism),
-        None => unknown_email_kdf(&email),
+        None => (User::CLIENT_KDF_TYPE_DEFAULT, User::CLIENT_KDF_ITER_DEFAULT, None, None),
    };

-    Ok(Json(json!({
+    Json(json!({
        "kdf": kdf_type,
        "kdfIterations": kdf_iter,
        "kdfMemory": kdf_mem,
        "kdfParallelism": kdf_para,
-        "kdfSettings": {
-            "iterations": kdf_iter,
-            "kdfType": kdf_type,
-            "memory": kdf_mem,
-            "parallelism": kdf_para
-        },
-        "salt": null,
-    })))
+    }))
 }

 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Models/Request/Accounts/SecretVerificationRequestModel.cs
@@ -1473,7 +1283,9 @@ async fn verify_password(data: Json<SecretVerificationRequest>, headers: Headers
    Ok(Json(master_password_policy(&user, &conn).await))
 }

-async fn update_api_key(data: Json<PasswordOrOtpData>, rotate: bool, headers: Headers, conn: DbConn) -> JsonResult {
+async fn _api_key(data: Json<PasswordOrOtpData>, rotate: bool, headers: Headers, conn: DbConn) -> JsonResult {
+    use crate::util::format_date;
+
    let data: PasswordOrOtpData = data.into_inner();
    let mut user = headers.user;

@@ -1492,13 +1304,13 @@ async fn update_api_key(data: Json<PasswordOrOtpData>, rotate: bool, headers: He
 }

 #[post("/accounts/api-key", data = "<data>")]
-async fn post_api_key(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
-    update_api_key(data, false, headers, conn).await
+async fn api_key(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
+    _api_key(data, false, headers, conn).await
 }

 #[post("/accounts/rotate-api-key", data = "<data>")]
 async fn rotate_api_key(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
-    update_api_key(data, true, headers, conn).await
+    _api_key(data, true, headers, conn).await
 }

 #[get("/devices/knowndevice")]
@@ -1541,7 +1353,7 @@ impl<'r> FromRequest<'r> for KnownDevice {
        };

        let uuid = if let Some(uuid) = req.headers().get_one("X-Device-Identifier") {
-            uuid.to_owned().into()
+            uuid.to_string().into()
        } else {
            return Outcome::Error((Status::BadRequest, "X-Device-Identifier value is required"));
        };
@@ -1556,7 +1368,7 @@ impl<'r> FromRequest<'r> for KnownDevice {
 #[get("/devices")]
 async fn get_all_devices(headers: Headers, conn: DbConn) -> JsonResult {
    let devices = Device::find_with_auth_request_by_user(&headers.user.uuid, &conn).await;
-    let devices = devices.iter().map(DeviceWithAuthRequest::to_json).collect::<Vec<Value>>();
+    let devices = devices.iter().map(|device| device.to_json()).collect::<Vec<Value>>();

    Ok(Json(json!({
        "data": devices,
@@ -1612,9 +1424,7 @@ async fn put_device_token(device_id: DeviceId, data: Json<PushToken>, headers: H
 }

 #[put("/devices/identifier/<device_id>/clear-token")]
-async fn put_clear_device_token(device_id: DeviceId, ip: ClientIp, conn: DbConn) -> EmptyResult {
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
-
+async fn put_clear_device_token(device_id: DeviceId, conn: DbConn) -> EmptyResult {
    // This only clears push token
    // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Controllers/DevicesController.cs#L215
    // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/Services/Implementations/DeviceService.cs#L37
@@ -1628,7 +1438,7 @@ async fn put_clear_device_token(device_id: DeviceId, ip: ClientIp, conn: DbConn)

    if let Some(device) = Device::find_by_uuid(&device_id, &conn).await {
        Device::clear_push_token_by_uuid(&device_id, &conn).await?;
-        unregister_push_device(device.push_uuid.as_ref()).await?;
+        unregister_push_device(&device.push_uuid).await?;
    }

    Ok(())
@@ -1636,8 +1446,8 @@ async fn put_clear_device_token(device_id: DeviceId, ip: ClientIp, conn: DbConn)

 // On upstream server, both PUT and POST are declared. Implementing the POST method in case it would be useful somewhere
 #[post("/devices/identifier/<device_id>/clear-token")]
-async fn post_clear_device_token(device_id: DeviceId, ip: ClientIp, conn: DbConn) -> EmptyResult {
-    put_clear_device_token(device_id, ip, conn).await
+async fn post_clear_device_token(device_id: DeviceId, conn: DbConn) -> EmptyResult {
+    put_clear_device_token(device_id, conn).await
 }

 #[get("/tasks")]
@@ -1667,8 +1477,6 @@ async fn post_auth_request(
    conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&client_headers.ip.ip)?;
-
    let data = data.into_inner();

    let Some(user) = User::find_by_mail(&data.email, &conn).await else {
@@ -1681,7 +1489,7 @@ async fn post_auth_request(
        _ => err!("AuthRequest doesn't exist", "Device verification failed"),
    };

-    let auth_request = AuthRequest::new(
+    let mut auth_request = AuthRequest::new(
        user.uuid.clone(),
        data.device_identifier.clone(),
        client_headers.device_type,
@@ -1694,7 +1502,7 @@ async fn post_auth_request(
    nt.send_auth_request(&user.uuid, &auth_request.uuid, &device, &conn).await;

    log_user_event(
-        EventType::UserRequestedDeviceApproval,
+        EventType::UserRequestedDeviceApproval as i32,
        &user.uuid,
        client_headers.device_type,
        &client_headers.ip.ip,
@@ -1788,7 +1596,7 @@ async fn put_auth_request(
        nt.send_auth_response(&auth_request.user_uuid, &auth_request.uuid, &headers.device, &conn).await;

        log_user_event(
-            EventType::OrganizationUserApprovedAuthRequest,
+            EventType::OrganizationUserApprovedAuthRequest as i32,
            &headers.user.uuid,
            headers.device.atype,
            &headers.ip.ip,
@@ -1799,7 +1607,7 @@ async fn put_auth_request(
        // If denied, there's no reason to keep the request
        auth_request.delete(&conn).await?;
        log_user_event(
-            EventType::OrganizationUserRejectedAuthRequest,
+            EventType::OrganizationUserRejectedAuthRequest as i32,
            &headers.user.uuid,
            headers.device.atype,
            &headers.ip.ip,
@@ -1830,8 +1638,6 @@ async fn get_auth_request_response(
    client_headers: ClientHeaders,
    conn: DbConn,
 ) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&client_headers.ip.ip)?;
-
    let Some(auth_request) = AuthRequest::find_by_uuid(&auth_request_id, &conn).await else {
        err!("AuthRequest doesn't exist", "User not found")
    };
@@ -1902,65 +1708,6 @@ pub async fn purge_auth_requests(pool: DbPool) {
    if let Ok(conn) = pool.get().await {
        AuthRequest::purge_expired_auth_requests(&conn).await;
    } else {
-        error!("Failed to get DB connection while purging auth requests");
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_register_data_current_format() {
-        // Web and iOS since the master password authentication/unlock split
-        let data: RegisterData = serde_json::from_str(
-            r#"{
-                "email": "user@example.com",
-                "emailVerificationToken": "token",
-                "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"},
-                "masterPasswordAuthentication": {
-                    "kdf": {"kdfType": 0, "iterations": 600000},
-                    "salt": "user@example.com",
-                    "masterPasswordAuthenticationHash": "hash"
-                },
-                "masterPasswordUnlock": {
-                    "kdf": {"kdfType": 0, "iterations": 600000},
-                    "salt": "user@example.com",
-                    "masterKeyWrappedUserKey": "key"
-                }
-            }"#,
-        )
-        .unwrap();
-
-        assert!(!data.unprocessable());
-        assert_eq!(data.hash(), "hash");
-        assert_eq!(data.key(), "key");
-        assert_eq!(data.kdf().kdf_iterations, 600_000);
-        assert!(data.keys.is_some());
-        assert_eq!(data.email_verification_token.as_deref(), Some("token"));
-    }
-
-    #[test]
-    fn test_register_data_flat_format() {
-        // Android before 2026.9.0
-        let data: RegisterData = serde_json::from_str(
-            r#"{
-                "email": "user@example.com",
-                "emailVerificationToken": "token",
-                "masterPasswordHash": "hash",
-                "masterPasswordHint": null,
-                "userSymmetricKey": "key",
-                "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"},
-                "kdf": 0,
-                "kdfIterations": 600000
-            }"#,
-        )
-        .unwrap();
-
-        assert!(!data.unprocessable());
-        assert_eq!(data.hash(), "hash");
-        assert_eq!(data.key(), "key");
-        assert_eq!(data.kdf().kdf_iterations, 600_000);
-        assert!(data.keys.is_some());
+        error!("Failed to get DB connection while purging auth requests")
    }
 }
@@ -1,26 +1,23 @@
-use chrono::Utc;
-use rocket::{Route, serde::json::Json};
+use chrono::{TimeDelta, Utc};
+use rocket::{serde::json::Json, Route};
 use serde_json::Value;

 use crate::{
-    CONFIG,
    api::{
+        core::{CipherSyncData, CipherSyncType},
        EmptyResult, JsonResult,
-        core::{
-            CipherSyncData, CipherSyncType,
-            accounts::{AuthenticationData, UnlockData},
    },
-    },
-    auth::{Headers, decode_emergency_access_invite},
+    auth::{decode_emergency_access_invite, Headers},
    db::{
-        DbConn, DbPool,
        models::{
-            Cipher, EMERGENCY_ACCESS_TIMEOUT_RANGE, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus,
-            EmergencyAccessType, Invitation, Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
+            Cipher, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType, Invitation,
+            Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
        },
+        DbConn, DbPool,
    },
    mail,
    util::NumberOrString,
+    CONFIG,
 };

 pub fn routes() -> Vec<Route> {
@@ -58,7 +55,7 @@ async fn get_contacts(headers: Headers, conn: DbConn) -> Json<Value> {
    let mut emergency_access_list_json = Vec::with_capacity(emergency_access_list.len());
    for ea in emergency_access_list {
        if let Some(grantee) = ea.to_json_grantee_details(&conn).await {
-            emergency_access_list_json.push(grantee);
+            emergency_access_list_json.push(grantee)
        }
    }

@@ -92,14 +89,11 @@ async fn get_grantees(headers: Headers, conn: DbConn) -> Json<Value> {
 async fn get_emergency_access(emer_id: EmergencyAccessId, headers: Headers, conn: DbConn) -> JsonResult {
    check_emergency_access_enabled()?;

-    if let Some(emergency_access) =
-        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
-    {
-        Ok(Json(
+    match EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await {
+        Some(emergency_access) => Ok(Json(
            emergency_access.to_json_grantee_details(&conn).await.expect("Grantee user should exist but does not!"),
-        ))
-    } else {
-        err!("Emergency access not valid.")
+        )),
+        None => err!("Emergency access not valid."),
    }
 }

@@ -136,21 +130,18 @@ async fn post_emergency_access(

    let data: EmergencyAccessUpdateData = data.into_inner();

-    let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
-        err!("Invalid emergency access type.")
-    };
-
-    if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&data.wait_time_days) {
-        err!("Emergency access wait time is out-of-bounds!")
-    }
-
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
    else {
        err!("Emergency access not valid.")
    };

-    emergency_access.atype = new_type as i32;
+    let new_type = match EmergencyAccessType::from_str(&data.r#type.into_string()) {
+        Some(new_type) => new_type as i32,
+        None => err!("Invalid emergency access type."),
+    };
+
+    emergency_access.atype = new_type;
    emergency_access.wait_time_days = data.wait_time_days;
    if data.key_encrypted.is_some() {
        emergency_access.key_encrypted = data.key_encrypted;
@@ -212,12 +203,11 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
    let email = data.email.to_lowercase();
    let wait_time_days = data.wait_time_days;

-    if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&wait_time_days) {
-        err!("Emergency access wait time is out-of-bounds!")
-    }
+    let emergency_access_status = EmergencyAccessStatus::Invited as i32;

-    let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
-        err!("Invalid emergency access type.")
+    let new_type = match EmergencyAccessType::from_str(&data.r#type.into_string()) {
+        Some(new_type) => new_type as i32,
+        None => err!("Invalid emergency access type."),
    };

    let grantor_user = headers.user;
@@ -230,7 +220,7 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
    let (grantee_user, new_user) = match User::find_by_mail(&email, &conn).await {
        None => {
            if !CONFIG.invitations_allowed() {
-                err!(format!("Grantee user does not exist: {}", email.escape_debug()))
+                err!(format!("Grantee user does not exist: {email}"))
            }

            if !CONFIG.is_email_domain_allowed(&email) {
@@ -262,8 +252,6 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
        err!(format!("Grantee user already invited: {}", &grantee_user.email))
    }

-    let new_type = new_type as i32;
-    let emergency_access_status = EmergencyAccessStatus::Invited as i32;
    let mut new_emergency_access =
        EmergencyAccess::new(grantor_user.uuid, grantee_user.email, emergency_access_status, new_type, wait_time_days);
    new_emergency_access.save(&conn).await?;
@@ -296,7 +284,7 @@ async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, conn: DbCon
    };

    if emergency_access.status != EmergencyAccessStatus::Invited as i32 {
-        err!("The grantee user is already accepted or confirmed for emergency access");
+        err!("The grantee user is already accepted or confirmed to the organization");
    }

    let Some(email) = emergency_access.email.clone() else {
@@ -354,11 +342,12 @@ async fn accept_invite(
        err!("Claim email does not match current users email")
    }

-    let grantee_user = if let Some(user) = User::find_by_mail(&claims.email, &conn).await {
+    let grantee_user = match User::find_by_mail(&claims.email, &conn).await {
+        Some(user) => {
            Invitation::take(&claims.email, &conn).await;
            user
-    } else {
-        err!("Invited user not found")
+        }
+        None => err!("Invited user not found"),
    };

    // We need to search for the uuid in combination with the email, since we do not yet store the uuid of the grantee in the database.
@@ -457,24 +446,11 @@ async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &initiating_user.uuid, &conn).await
    else {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}', not found for user '{}'.", initiating_user.email)
-        )
+        err!("Emergency access not valid.")
    };

    if emergency_access.status != EmergencyAccessStatus::Confirmed as i32 {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}', not confirmed for user '{}'.", initiating_user.email)
-        )
-    }
-
-    if !EMERGENCY_ACCESS_TIMEOUT_RANGE.contains(&emergency_access.wait_time_days) {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}' timeout range '{}' is invalid", emergency_access.wait_time_days)
-        )
+        err!("Emergency access not valid.")
    }

    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &conn).await else {
@@ -507,17 +483,11 @@ async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
    else {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}', not found for user '{}'.", headers.user.email)
-        )
+        err!("Emergency access not valid.")
    };

    if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32 {
-        err!(
-            "Emergency access not valid.",
-            format!("Emergency access '{emer_id}', not initiated for user '{}'.", headers.user.email)
-        )
+        err!("Emergency access not valid.")
    }

    let Some(grantor_user) = User::find_by_uuid(&headers.user.uuid, &conn).await else {
@@ -641,7 +611,6 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
        "kdfMemory": grantor_user.client_kdf_memory,
        "kdfParallelism": grantor_user.client_kdf_parallelism,
        "keyEncrypted": &emergency_access.key_encrypted,
-        "salt": grantor_user.master_password_salt(),
        "object": "emergencyAccessTakeover",
    });

@@ -651,13 +620,8 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EmergencyAccessPasswordData {
-    // Legacy payload
-    new_master_password_hash: Option<String>,
-    key: Option<String>,
-
-    // Current payload
-    authentication_data: Option<AuthenticationData>,
-    unlock_data: Option<UnlockData>,
+    new_master_password_hash: String,
+    key: String,
 }

 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
@@ -670,6 +634,8 @@ async fn password_emergency_access(
    check_emergency_access_enabled()?;

    let data: EmergencyAccessPasswordData = data.into_inner();
+    let new_master_password_hash = &data.new_master_password_hash;
+    //let key = &data.Key;

    let requesting_user = headers.user;
    let Some(emergency_access) =
@@ -686,23 +652,8 @@ async fn password_emergency_access(
        err!("Grantor user not found.")
    };

-    let (new_master_password_hash, new_key) =
-        if let (Some(authentication_data), Some(unlock_data)) = (data.authentication_data, data.unlock_data) {
-            authentication_data.check(&grantor_user, &unlock_data)?;
-
-            if !authentication_data.kdf.matches_user(&grantor_user) {
-                err!("KDF settings do not match the grantor account")
-            }
-
-            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
-        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
-            (new_master_password_hash, new_key)
-        } else {
-            err!("Invalid request!")
-        };
-
    // change grantor_user password
-    grantor_user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
+    grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
    grantor_user.save(&conn).await?;

    // Disable TwoFactor providers since they will otherwise block logins
@@ -770,72 +721,53 @@ pub async fn emergency_request_timeout_job(pool: DbPool) {
        return;
    }

-    let Ok(conn) = pool.get().await else {
-        error!("Failed to get DB connection for emergency time-outs!");
-        return;
-    };
-
+    if let Ok(conn) = pool.get().await {
        let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;

        if emergency_access_list.is_empty() {
            debug!("No emergency request timeout to approve");
-        return;
        }

        let now = Utc::now().naive_utc();
        for mut emer in emergency_access_list {
-        match emer.is_recovery_allowed(&now) {
-            Ok(true) => {} // Recovery is allowed
-            Ok(false) => continue,
-            Err(e) => {
-                error!("Failed to check if recovery is allowed for '{}': {e}", emer.uuid);
-                continue;
-            }
-        }
-
-        // Get grantor user to send Accepted email
-        let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
-            error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
-            continue;
-        };
-
-        let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
-            error!("Missing grantee for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
-        // Get grantee user to send Accepted email
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
-            error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
+            // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
+            let recovery_allowed_at =
+                emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days)).unwrap();
+            if recovery_allowed_at.le(&now) {
                // Only update the access status
                // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
-        let status_initiated = EmergencyAccessStatus::RecoveryInitiated as i32;
-        let status_approved = EmergencyAccessStatus::RecoveryApproved as i32;
-        if let Err(e) = emer.update_access_status_and_save(status_initiated, status_approved, &now, &conn).await {
-            error!("Unable to update emergency access status for '{}': {e}", emer.uuid);
-            continue;
-        }
+                emer.update_access_status_and_save(EmergencyAccessStatus::RecoveryApproved as i32, &now, &conn)
+                    .await
+                    .expect("Unable to update emergency access status");

                if CONFIG.mail_enabled() {
-            if let Err(e) = mail::send_emergency_access_recovery_timed_out(
+                    // get grantor user to send Accepted email
+                    let grantor_user =
+                        User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
+
+                    // get grantee user to send Accepted email
+                    let grantee_user =
+                        User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
+                            .await
+                            .expect("Grantee user not found");
+
+                    mail::send_emergency_access_recovery_timed_out(
                        &grantor_user.email,
                        &grantee_user.name,
                        emer.get_type_as_str(),
                    )
                    .await
-            {
-                error!("Failed to send emergency access recovery time-out email for '{}': {e}", emer.uuid);
-            }
+                    .expect("Error on sending email");

-            if let Err(e) = mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name).await
-            {
-                error!("Failed to send emergency access recovery approved email for '{}': {e}", emer.uuid);
+                    mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name)
+                        .await
+                        .expect("Error on sending email");
                }
            }
        }
+    } else {
+        error!("Failed to get DB connection while searching emergency request timed out")
+    }
 }

 pub async fn emergency_notification_reminder_job(pool: DbPool) {
@@ -844,85 +776,55 @@ pub async fn emergency_notification_reminder_job(pool: DbPool) {
        return;
    }

-    let Ok(conn) = pool.get().await else {
-        error!("Failed to get DB connection for emergency reminders!");
-        return;
-    };
-
+    if let Ok(conn) = pool.get().await {
        let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;

        if emergency_access_list.is_empty() {
            debug!("No emergency request reminder notification to send");
-        return;
        }

        let now = Utc::now().naive_utc();
        for mut emer in emergency_access_list {
-        let Ok(deadline_at) = emer.deadline_at() else {
-            error!("Invalid deadline for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
-        let Some(final_reminder_at) = deadline_at.checked_sub_days(chrono::Days::new(1)) else {
-            error!("Cannot calculate reminder date for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
-        // Only send reminders during the last 24 hours, else continue
-        if now < final_reminder_at || now >= deadline_at {
-            continue;
-        }
-
-        // Check if we did not sent a recovery mail in the past 24h already, else skip it.
-        // In case something goes wrong with the date calculation or `last_notification_at` is None we use now.
-        // This is to prevent possible missed reminders, this might cause an extra reminder,
-        // but that is better then no reminder at all.
-        let next_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
-            last_notification_at.checked_add_days(chrono::Days::new(1)).unwrap_or(now)
+            // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
+            // Calculate the day before the recovery will become active
+            let final_recovery_reminder_at =
+                emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days - 1)).unwrap();
+            // Calculate if a day has passed since the previous notification, else no notification has been sent before
+            let next_recovery_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
+                last_notification_at + TimeDelta::try_days(1).unwrap()
            } else {
                now
            };
-
-        // Only send a reminder if the `next_reminder_at` is less then or equal to `now`
-        // Else we can skip the current emergency access this run.
-        if next_reminder_at.gt(&now) {
-            continue;
-        }
-
-        // Get grantor user to send Reminder email
-        let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
-            error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
-            continue;
-        };
-
-        let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
-            error!("Missing grantee for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
-        // Get grantee user to send Reminder email
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
-            error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
-            continue;
-        };
-
+            if final_recovery_reminder_at.le(&now) && next_recovery_reminder_at.le(&now) {
                // Only update the last notification date
                // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
-        if let Err(e) = emer.update_last_notification_date_and_save(&now, &conn).await {
-            error!("Unable to update emergency access reminder date for '{}': {e}", emer.uuid);
-            continue;
-        }
+                emer.update_last_notification_date_and_save(&now, &conn)
+                    .await
+                    .expect("Unable to update emergency access notification date");

-        if CONFIG.mail_enabled()
-            && let Err(e) = mail::send_emergency_access_recovery_reminder(
+                if CONFIG.mail_enabled() {
+                    // get grantor user to send Accepted email
+                    let grantor_user =
+                        User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
+
+                    // get grantee user to send Accepted email
+                    let grantee_user =
+                        User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
+                            .await
+                            .expect("Grantee user not found");
+
+                    mail::send_emergency_access_recovery_reminder(
                        &grantor_user.email,
                        &grantee_user.name,
                        emer.get_type_as_str(),
                        "1", // This notification is only triggered one day before the activation
                    )
                    .await
-        {
-            error!("Failed to send emergency access reminder email for '{}': {e}", emer.uuid);
+                    .expect("Error on sending email");
                }
            }
        }
+    } else {
+        error!("Failed to get DB connection while searching emergency notification reminder")
+    }
+}
@@ -1,19 +1,18 @@
 use std::net::IpAddr;

 use chrono::NaiveDateTime;
-use rocket::{Route, form::FromForm, serde::json::Json};
+use rocket::{form::FromForm, serde::json::Json, Route};
 use serde_json::Value;

 use crate::{
-    CONFIG,
-    api::{ApiResult, EmptyResult, JsonResult},
+    api::{EmptyResult, JsonResult},
    auth::{AdminHeaders, Headers},
    db::{
+        models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId},
        DbConn, DbPool,
-        models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
    },
-    error::MapResult,
    util::parse_date,
+    CONFIG,
 };

 /// ###############################################################################################################
@@ -30,14 +29,6 @@ struct EventRange {
    continuation_token: Option<String>,
 }

-impl EventRange {
-    fn date_range(&self) -> ApiResult<(NaiveDateTime, NaiveDateTime)> {
-        let start_date = parse_date(&self.start).map_res("Invalid start date")?;
-        let end_date = parse_date(self.continuation_token.as_ref().unwrap_or(&self.end)).map_res("Invalid end date")?;
-        Ok((start_date, end_date))
-    }
-}
-
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/EventsController.cs#L87
 #[get("/organizations/<org_id>/events?<data..>")]
 async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: AdminHeaders, conn: DbConn) -> JsonResult {
@@ -47,16 +38,21 @@ async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: Admin

    // Return an empty vec when we org events are disabled.
    // This prevents client errors
-    let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        let (start_date, end_date) = data.date_range()?;
+    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
+        Vec::with_capacity(0)
+    } else {
+        let start_date = parse_date(&data.start);
+        let end_date = if let Some(before_date) = &data.continuation_token {
+            parse_date(before_date)
+        } else {
+            parse_date(&data.end)
+        };

        Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &conn)
            .await
            .iter()
-            .map(Event::to_json)
+            .map(|e| e.to_json())
            .collect()
-    } else {
-        Vec::new()
    };

    Ok(Json(json!({
@@ -68,16 +64,27 @@ async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: Admin

 #[get("/ciphers/<cipher_id>/events?<data..>")]
 async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Headers, conn: DbConn) -> JsonResult {
-    // Return an empty vec when org events are disabled.
+    // Return an empty vec when we org events are disabled.
    // This prevents client errors
-    let events_json: Vec<Value> = if CONFIG.org_events_enabled()
-        && Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await
-    {
-        let (start_date, end_date) = data.date_range()?;
-
-        Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn).await.iter().map(Event::to_json).collect()
+    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
+        Vec::with_capacity(0)
    } else {
-        Vec::new()
+        let mut events_json = Vec::with_capacity(0);
+        if Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await {
+            let start_date = parse_date(&data.start);
+            let end_date = if let Some(before_date) = &data.continuation_token {
+                parse_date(before_date)
+            } else {
+                parse_date(&data.end)
+            };
+
+            events_json = Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn)
+                .await
+                .iter()
+                .map(|e| e.to_json())
+                .collect()
+        }
+        events_json
    };

    Ok(Json(json!({
@@ -100,16 +107,21 @@ async fn get_user_events(
    }
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
-    let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        let (start_date, end_date) = data.date_range()?;
+    let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
+        Vec::with_capacity(0)
+    } else {
+        let start_date = parse_date(&data.start);
+        let end_date = if let Some(before_date) = &data.continuation_token {
+            parse_date(before_date)
+        } else {
+            parse_date(&data.end)
+        };

        Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &conn)
            .await
            .iter()
-            .map(Event::to_json)
+            .map(|e| e.to_json())
            .collect()
-    } else {
-        Vec::new()
    };

    Ok(Json(json!({
@@ -122,8 +134,7 @@ async fn get_user_events(
 fn get_continuation_token(events_json: &[Value]) -> Option<&str> {
    // When the length of the vec equals the max page_size there probably is more data
    // When it is less, then all events are loaded.
-    #[expect(clippy::cast_possible_truncation, reason = "PAGE_SIZE fits within usize")]
-    if events_json.len() == Event::PAGE_SIZE as usize {
+    if events_json.len() as i64 == Event::PAGE_SIZE {
        if let Some(last_event) = events_json.last() {
            last_event["date"].as_str()
        } else {
@@ -162,11 +173,10 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
    }

    for event in data.iter() {
-        let event_date = parse_date(&event.date).map_res("Invalid event date")?;
-        // Only the event types upstream accepts from clients, the rest are written server-side.
+        let event_date = parse_date(&event.date);
        match event.r#type {
-            t if t == EventType::UserClientExportedVault as i32 => {
-                log_user_event_impl(
+            1000..=1099 => {
+                _log_user_event(
                    event.r#type,
                    &headers.user.uuid,
                    headers.device.atype,
@@ -176,12 +186,9 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                )
                .await;
            }
-            t if t == EventType::OrganizationClientExportedVault as i32 => {
-                // Only allow logging events for an organization the user is actually a member of.
-                if let Some(org_id) = &event.organization_id
-                    && Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await.is_some()
-                {
-                    log_event_impl(
+            1600..=1699 => {
+                if let Some(org_id) = &event.organization_id {
+                    _log_event(
                        event.r#type,
                        org_id,
                        org_id,
@@ -194,36 +201,11 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
-            // Only the vault notification banner click is accepted from clients. The rest of
-            // the 1500..=1599 range is written server-side and must not be forgeable by a client.
-            t if t == EventType::OrganizationUserNotificationBannerActionClicked as i32 => {
-                if let Some(org_id) = &event.organization_id
-                    && let Some(membership) =
-                        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await
-                {
-                    log_event_impl(
-                        event.r#type,
-                        &membership.uuid,
-                        org_id,
-                        &headers.user.uuid,
-                        headers.device.atype,
-                        Some(event_date),
-                        &headers.ip.ip,
-                        &conn,
-                    )
-                    .await;
-                }
-            }
-            // Client-side cipher events (viewed, copied, toggled, autofilled).
-            1107..=1114 | 1117 | 1119..=1132 => {
-                // The cipher determines the organization the event is logged to, so make sure the
-                // user can actually access it instead of trusting the provided cipher uuid.
-                if let Some(cipher_uuid) = &event.cipher_id
-                    && let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &conn).await
-                    && cipher.is_accessible_to_user(&headers.user.uuid, &conn).await
-                    && let Some(org_id) = cipher.organization_uuid
-                {
-                    log_event_impl(
+            _ => {
+                if let Some(cipher_uuid) = &event.cipher_id {
+                    if let Some(cipher) = Cipher::find_by_uuid(cipher_uuid, &conn).await {
+                        if let Some(org_id) = cipher.organization_uuid {
+                            _log_event(
                                event.r#type,
                                cipher_uuid,
                                &org_id,
@@ -236,20 +218,21 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                            .await;
                        }
                    }
-            _ => {}
+                }
+            }
        }
    }
    Ok(())
 }

-pub async fn log_user_event(event_type: EventType, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
+pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
    if !CONFIG.org_events_enabled() {
        return;
    }
-    log_user_event_impl(event_type as i32, user_id, device_type, None, ip, conn).await;
+    _log_user_event(event_type, user_id, device_type, None, ip, conn).await;
 }

-async fn log_user_event_impl(
+async fn _log_user_event(
    event_type: i32,
    user_id: &UserId,
    device_type: i32,
@@ -284,7 +267,7 @@ async fn log_user_event_impl(
 }

 pub async fn log_event(
-    event_type: EventType,
+    event_type: i32,
    source_uuid: &str,
    org_id: &OrganizationId,
    act_user_id: &UserId,
@@ -295,11 +278,11 @@ pub async fn log_event(
    if !CONFIG.org_events_enabled() {
        return;
    }
-    log_event_impl(event_type as i32, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
+    _log_event(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
 }

-#[expect(clippy::too_many_arguments)]
-async fn log_event_impl(
+#[allow(clippy::too_many_arguments)]
+async fn _log_event(
    event_type: i32,
    source_uuid: &str,
    org_id: &OrganizationId,
@@ -315,24 +298,24 @@ async fn log_event_impl(
        // 1000..=1099 Are user events, they need to be logged via log_user_event()
        // Cipher Events
        1100..=1199 => {
-            event.cipher_uuid = Some(source_uuid.to_owned().into());
+            event.cipher_uuid = Some(source_uuid.to_string().into());
        }
        // Collection Events
        1300..=1399 => {
-            event.collection_uuid = Some(source_uuid.to_owned().into());
+            event.collection_uuid = Some(source_uuid.to_string().into());
        }
        // Group Events
        1400..=1499 => {
-            event.group_uuid = Some(source_uuid.to_owned().into());
+            event.group_uuid = Some(source_uuid.to_string().into());
        }
        // Org User Events
        1500..=1599 => {
-            event.org_user_uuid = Some(source_uuid.to_owned().into());
+            event.org_user_uuid = Some(source_uuid.to_string().into());
        }
        // 1600..=1699 Are organizational events, and they do not need the source_uuid
        // Policy Events
        1700..=1799 => {
-            event.policy_uuid = Some(source_uuid.to_owned().into());
+            event.policy_uuid = Some(source_uuid.to_string().into());
        }
        // Ignore others
        _ => {}
@@ -347,17 +330,14 @@ async fn log_event_impl(

 pub async fn event_cleanup_job(pool: DbPool) {
    debug!("Start events cleanup job");
-    if CONFIG.events_days_retain().is_none_or(|d| d == 0) {
-        debug!("events_days_retain is not configured or set to 0, skipping");
+    if CONFIG.events_days_retain().is_none() {
+        debug!("events_days_retain is not configured, abort");
        return;
    }

-    let Ok(conn) = pool.get().await else {
-        error!("Failed to get DB connection while trying to cleanup the events table");
-        return;
-    };
-
-    if let Err(e) = Event::clean_events(&conn).await {
-        error!("Failed to cleanup the events table: {e}");
+    if let Ok(conn) = pool.get().await {
+        Event::clean_events(&conn).await.ok();
+    } else {
+        error!("Failed to get DB connection while trying to cleanup the events table")
    }
 }
@@ -5,8 +5,8 @@ use crate::{
    api::{EmptyResult, JsonResult, Notify, UpdateType},
    auth::Headers,
    db::{
-        DbConn,
        models::{Folder, FolderId},
+        DbConn,
    },
    util::deser_opt_nonempty_str,
 };
@@ -29,10 +29,9 @@ async fn get_folders(headers: Headers, conn: DbConn) -> Json<Value> {

 #[get("/folders/<folder_id>")]
 async fn get_folder(folder_id: FolderId, headers: Headers, conn: DbConn) -> JsonResult {
-    if let Some(folder) = Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &conn).await {
-        Ok(Json(folder.to_json()))
-    } else {
-        err!("Invalid folder", "Folder does not exist or belongs to another user")
+    match Folder::find_by_uuid_and_user(&folder_id, &headers.user.uuid, &conn).await {
+        Some(folder) => Ok(Json(folder.to_json())),
+        _ => err!("Invalid folder", "Folder does not exist or belongs to another user"),
    }
 }

@@ -1,6 +1,4 @@
 pub mod accounts;
-pub mod two_factor;
-
 mod ciphers;
 mod emergency_access;
 mod events;
@@ -8,32 +6,17 @@ mod folders;
 mod organizations;
 mod public;
 mod sends;
+pub mod two_factor;

 pub use accounts::purge_auth_requests;
-pub use ciphers::{CipherData, CipherSyncData, CipherSyncType, purge_trashed_ciphers};
+pub use ciphers::{purge_trashed_ciphers, CipherData, CipherSyncData, CipherSyncType};
 pub use emergency_access::{emergency_notification_reminder_job, emergency_request_timeout_job};
 pub use events::{event_cleanup_job, log_event, log_user_event};
+use reqwest::Method;
 pub use sends::purge_sends;

-use reqwest::Method;
-use rocket::{Catcher, Route, serde::json::Json, serde::json::Value};
-
-use crate::{
-    CONFIG,
-    api::{EmptyResult, JsonResult, Notify, UpdateType},
-    auth::Headers,
-    db::{
-        DbConn,
-        models::{Membership, MembershipStatus, OrgPolicy, Organization, User},
-    },
-    error::Error,
-    http_client::make_http_request,
-    mail,
-    util::{FeatureFlagFilter, parse_experimental_client_feature_flags},
-};
-
 pub fn routes() -> Vec<Route> {
-    let mut eq_domains_routes = routes![get_settings_domains, post_settings_domains, put_settings_domains];
+    let mut eq_domains_routes = routes![get_eq_domains, post_eq_domains, put_eq_domains];
    let mut hibp_routes = routes![hibp_breach];
    let mut meta_routes = routes![alive, now, version, config, get_api_webauthn];

@@ -61,6 +44,25 @@ pub fn events_routes() -> Vec<Route> {
    routes
 }

+//
+// Move this somewhere else
+//
+use rocket::{serde::json::Json, serde::json::Value, Catcher, Route};
+
+use crate::{
+    api::{EmptyResult, JsonResult, Notify, UpdateType},
+    auth::Headers,
+    db::{
+        models::{Membership, MembershipStatus, OrgPolicy, Organization, User},
+        DbConn,
+    },
+    error::Error,
+    http_client::make_http_request,
+    mail,
+    util::{parse_experimental_client_feature_flags, FeatureFlagFilter},
+    CONFIG,
+};
+
 #[derive(Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct GlobalDomain {
@@ -71,16 +73,14 @@ struct GlobalDomain {

 const GLOBAL_DOMAINS: &str = include_str!("../../static/global_domains.json");

-#[expect(clippy::needless_pass_by_value, reason = "Not beneficial for Headers")]
 #[get("/settings/domains")]
-fn get_settings_domains(headers: Headers) -> Json<Value> {
-    get_eq_domains(&headers, false)
+fn get_eq_domains(headers: Headers) -> Json<Value> {
+    _get_eq_domains(&headers, false)
 }

-fn get_eq_domains(headers: &Headers, no_excluded: bool) -> Json<Value> {
-    use serde_json::from_str;
-
+fn _get_eq_domains(headers: &Headers, no_excluded: bool) -> Json<Value> {
    let user = &headers.user;
+    use serde_json::from_str;

    let equivalent_domains: Vec<Vec<String>> = from_str(&user.equivalent_domains).unwrap();
    let excluded_globals: Vec<i32> = from_str(&user.excluded_globals).unwrap();
@@ -110,39 +110,28 @@ struct EquivDomainData {
 }

 #[post("/settings/domains", data = "<data>")]
-async fn post_settings_domains(
-    data: Json<EquivDomainData>,
-    headers: Headers,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> JsonResult {
-    use serde_json::to_string;
-
+async fn post_eq_domains(data: Json<EquivDomainData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    let data: EquivDomainData = data.into_inner();

    let excluded_globals = data.excluded_global_equivalent_domains.unwrap_or_default();
    let equivalent_domains = data.equivalent_domains.unwrap_or_default();

    let mut user = headers.user;
+    use serde_json::to_string;

-    user.excluded_globals = to_string(&excluded_globals).unwrap_or_else(|_| "[]".to_owned());
-    user.equivalent_domains = to_string(&equivalent_domains).unwrap_or_else(|_| "[]".to_owned());
+    user.excluded_globals = to_string(&excluded_globals).unwrap_or_else(|_| "[]".to_string());
+    user.equivalent_domains = to_string(&equivalent_domains).unwrap_or_else(|_| "[]".to_string());

    user.save(&conn).await?;

-    nt.send_user_update(UpdateType::SyncSettings, &user, headers.device.push_uuid.as_ref(), &conn).await;
+    nt.send_user_update(UpdateType::SyncSettings, &user, &headers.device.push_uuid, &conn).await;

    Ok(Json(json!({})))
 }

 #[put("/settings/domains", data = "<data>")]
-async fn put_settings_domains(
-    data: Json<EquivDomainData>,
-    headers: Headers,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> JsonResult {
-    post_settings_domains(data, headers, conn, nt).await
+async fn put_eq_domains(data: Json<EquivDomainData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
+    post_eq_domains(data, headers, conn, nt).await
 }

 #[get("/hibp/breach?<username>")]
@@ -215,11 +204,11 @@ fn config() -> Json<Value> {
    // Client (v2026.2.1): https://github.com/bitwarden/clients/blob/f96380c3138291a028bdd2c7a5fee540d5c98ba5/libs/common/src/enums/feature-flag.enum.ts#L12
    // Android (v2026.2.1): https://github.com/bitwarden/android/blob/6902c19c0093fa476bbf74ccaa70c9f14afbb82f/core/src/main/kotlin/com/bitwarden/core/data/manager/model/FlagKey.kt#L31
    // iOS (v2026.2.1): https://github.com/bitwarden/ios/blob/cdd9ba1770ca2ffc098d02d12cc3208e3a830454/BitwardenShared/Core/Platform/Models/Enum/FeatureFlag.swift#L7
-    let mut feature_states = parse_experimental_client_feature_flags(
+    let feature_states = parse_experimental_client_feature_flags(
        &CONFIG.experimental_client_feature_flags(),
-        &FeatureFlagFilter::ValidOnly,
+        FeatureFlagFilter::ValidOnly,
    );
-    feature_states.insert("pm-19148-innovation-archive".to_owned(), true);
+    // Add default feature_states here if needed, currently no features are needed by default.

    Json(json!({
        // Note: The clients use this version to handle backwards compatibility concerns
@@ -228,17 +217,14 @@ fn config() -> Json<Value> {
        // Version history:
        // - Individual cipher key encryption: 2024.2.0
        // - Mobile app support for MasterPasswordUnlockData: 2025.8.0
-        "version": "2026.6.0",
+        "version": "2025.12.0",
        "gitHash": option_env!("GIT_REV"),
        "server": {
          "name": "Vaultwarden",
          "url": "https://github.com/dani-garcia/vaultwarden"
        },
        "settings": {
-            "disableUserRegistration": CONFIG.is_signup_disabled(),
-            // When enabled, this setting signals to clients that onboarding interstitials
-            // (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals) should be suppressed
-            "suppressOnboardingInterstitials": CONFIG.client_suppress_onboarding(),
+            "disableUserRegistration": CONFIG.is_signup_disabled()
        },
        "environment": {
          "vault": domain,
@@ -254,10 +240,6 @@ fn config() -> Json<Value> {
          "vapidPublicKey": null
        },
        "featureStates": feature_states,
-        // Not supported right now
-        // Used for by clients to learn if the server requires extra work to establish a connection.
-        // See: https://github.com/bitwarden/server/pull/6892 | https://github.com/bitwarden/server/commit/52955d1860b4dfb905f67bbe39d9b10bbd61ded0
-        "communication": null,
        "object": "config",
    }))
 }
@@ -296,8 +278,9 @@ async fn accept_org_invite(
    member.save(conn).await?;

    if CONFIG.mail_enabled() {
-        let Some(org) = Organization::find_by_uuid(&member.org_uuid, conn).await else {
-            err!("Organization not found.")
+        let org = match Organization::find_by_uuid(&member.org_uuid, conn).await {
+            Some(org) => org,
+            None => err!("Organization not found."),
        };
        // User was invited to an organization, so they must be confirmed manually after acceptance
        mail::send_invite_accepted(&user.email, &member.invited_by_email.unwrap_or(org.billing_email), &org.name)
				`@@ -1 +0,0 @@`
				`ALTER TABLE sso_auth DROP COLUMN binding_hash;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE sso_auth ADD COLUMN binding_hash TEXT;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE sso_auth DROP COLUMN code_response_error;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE sso_auth ADD COLUMN code_response_error TEXT;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE org_policies DROP COLUMN revision_date;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE sso_auth DROP COLUMN IF EXISTS code_response_error;`
				`@@ -1 +0,0 @@`
				`ALTER TABLE sso_auth ADD COLUMN IF NOT EXISTS code_response_error TEXT;`