Move the v2 upgrade token migration to its own version

Diesel identifies a migration by the date in its folder name alone, and silently drops one of two folders that share it. The Custom Roles migration uses the same date.

.env.template

@@ -411,6 +411,9 @@
 ## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
 ## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers.
 ##   Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet.
+## - "pm-27278-v2-password-registration": Register new accounts with v2 encryption. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0, Android >= 2026.4.1, iOS >= 2026.5.1)
+## - "enable-account-encryption-v2-jit-password-registration": Give SSO users who set their master password on their first login v2 encryption. (Web >= 2026.1.1, Desktop/Browser/CLI >= 2026.1.0, Android >= 2026.4.1, iOS >= 2026.6.0)
+##   These two flags can't be undone: a v2 account stays v2, and it can only log in from clients that are 2025.11.0 or newer and send their version, which rules out some older and third-party clients.
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 
 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -497,6 +500,15 @@
 ## KNOW WHAT YOU ARE DOING!
 # ORG_GROUPS_ENABLED=false
 
+## EXPERIMENTAL FEATURE: Custom roles
+## Enables the Custom member role with granular permissions for organizations.
+## This is still being developed: only the permissions this version enforces can be granted.
+## This is enforced by the server and is unrelated to EXPERIMENTAL_CLIENT_FEATURE_FLAGS.
+## Disabling it again keeps the stored Custom roles and permissions, but they grant nothing until it is re-enabled.
+## Disabled by default because this is an experimental feature!
+## KNOW WHAT YOU ARE DOING!
+# EXPERIMENTAL_CUSTOM_ROLES=false
+
 ## Increase secure note size limit (Know the risks!)
 ## Sets the secure note size limit to 100_000 instead of the default 10_000.
 ## WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!

.github/CODEOWNERS

@@ -4,4 +4,3 @@
 /.github/ISSUE_TEMPLATE/** @dani-garcia @BlackDex
 /.github/workflows/** @dani-garcia @BlackDex
 /SECURITY.md @dani-garcia @BlackDex
-/THREAT_MODEL.md @dani-garcia @BlackDex

.typos.toml

@@ -14,9 +14,8 @@ extend-ignore-re = [
     # In SMTP it's called HELO, so ignore it
     "(?i)helo_name",
     "Server name sent during.+HELO",
-    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
+    # COSE Is short for CBOR Object Signing and Encryption
-    "COSEKey",
+    "(?i)cose",
-    "COSEAlgorithm",
     # Ignore this specific string as it's valid
     "Ensure they are valid OTPs",
     # This word is misspelled upstream

Cargo.toml

@@ -107,7 +107,7 @@ serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.154"
 
 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric"] }
+diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
 diesel_migrations = "2.3.2"
 
 derive_more = { version = "2.1.1", features = [

SECURITY.md

@@ -8,43 +8,30 @@ notify us. We welcome working with you to resolve the issue promptly. Thanks in
   effort to quickly resolve the issue.
 - Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a
   third-party. We may publicly disclose the issue before resolving it, if appropriate.
-- Vaultwarden has no hosted service. Test only on instances you run yourself, and make a good faith effort
+- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or
-  to avoid privacy violations, destruction of data, and interruption or degradation of other people's
+  degradation of our service. Only interact with accounts you own or with explicit permission of the
-  servers. Only interact with accounts you own or with explicit permission of the account holder.
+  account holder.
-
-# What happens after a report
-
-This is how we usually handle reports. We decide each one on its own.
-
-- **It affects a tagged release:** we publish an advisory, request a CVE and list it in the release notes. Advisories are published about 14 days after the release containing the fix, so users have time to update.
-- **It only ever existed on `main` / `testing`:** we publish an advisory and credit the reporter, but there is no CVE or release notes entry, because no released version was affected.
-- **Low-impact issues, including low-impact differences from upstream Bitwarden, and most denial of service or resource exhaustion:** we usually fix these as ordinary hardening in a public pull request, with no advisory.
-- **A bug in the web vault we bundle:** if it's in Bitwarden's code, the advisory and CVE belong to Bitwarden, so report it to them. Tell us as well, and we'll ship a security release that references theirs. If our own patches added it, report it to us.
-- **Credit** goes on the advisory and needs a GitHub account or email address. If several people report the same issue, we close the later reports and link them to the first advisory, and credit their reporters as finders on it as long as the fix isn't public yet. A fix is public from the moment its pull request is opened, so reports of the same issue after that point are normally not credited.
-- **Rewards:** Vaultwarden is an open source project and does not offer rewards.
 
 # In-scope
 
 - Security issues in any current release of Vaultwarden. Source code is available at https://github.com/dani-garcia/vaultwarden. This includes the current `latest` release and `main / testing` release.
 
-Our [threat model](THREAT_MODEL.md) describes who is trusted with what, how we rate severity, and behaviour we have already reviewed and consider intended. Please read it before reporting.
-
 # Exclusions
 
 The following bug classes are out-of scope:
 
 - Bugs that are already reported on Vaultwarden's issue tracker (https://github.com/dani-garcia/vaultwarden/issues)
-- Bugs that are not part of Vaultwarden, like in Bitwarden's web-vault code or the mobile and desktop clients. These issues need to be reported to Bitwarden through their [HackerOne program](https://hackerone.com/bitwarden/). We are not associated with Bitwarden. Bugs that our own web vault patches add are in scope
+- Bugs that are not part of Vaultwarden, like on the web-vault or mobile and desktop clients. These issues need to be reported in the respective project issue tracker at https://github.com/bitwarden to which we are not associated
-- Issues in an upstream software dependency (ex: Rust, or External Libraries) or base image that are not shown to be reachable through Vaultwarden
+- Issues in an upstream software dependency (ex: Rust, or External Libraries) which are already reported to the upstream maintainer
 - Attacks requiring physical access to a user's device
-- Issues related to software or protocols not under Vaultwarden's control, including things attached to it like log parsers (Fail2Ban and similar) and misconfigured reverse proxies, and attacks that need another component to violate its own specification
+- Issues related to software or protocols not under Vaultwarden's control
 - Vulnerabilities in outdated versions of Vaultwarden
 - Missing security best practices that do not directly lead to a vulnerability (You may still report them as a normal issue)
-- Actions of someone who already holds the admin token or has access to the host, which are trusted by design
+- Issues that do not have any impact on the general public
 
 While researching, we'd like to ask you to refrain from:
 
-- Denial of service against servers you do not run. Availability issues that still apply behind a reverse proxy can be reported, so reproduce them on your own instance
+- Denial of service
 - Spamming
 - Social engineering (including phishing) of Vaultwarden developers, contributors or users
 
@@ -52,7 +39,7 @@ Thank you for helping keep Vaultwarden and our users safe!
 
 # How to contact us
 
-- You can open a [private vulnerability report](https://github.com/dani-garcia/vaultwarden/security/advisories/new) on GitHub.
+- You can contact us on Matrix https://matrix.to/#/#vaultwarden:matrix.org (users: `@danig:matrix.org` and/or `@blackdex:matrix.org`)
 - You can send an ![security-contact](/.github/security-contact.gif) to report a security issue.<br>
   If you want to send an encrypted email you can use the following GPG key: 13BB3A34C9E380258CE43D595CB150B31F6426BC<br>
   It can be found on several public GPG key servers.<br>
@@ -60,6 +47,3 @@ Thank you for helping keep Vaultwarden and our users safe!
     * https://keys.mailvelope.com/pks/lookup?op=get&search=security%40vaultwarden.org
     * https://pgpkeys.eu/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
     * https://keyserver.ubuntu.com/pks/lookup?search=security%40vaultwarden.org&fingerprint=on&op=index
-- You can contact us on Matrix for questions, without vulnerability details: https://matrix.to/#/#vaultwarden:matrix.org (users: `@danig:matrix.org` and/or `@blackdex:matrix.org`)
-
-A good report states the version or commit you tested, the lowest privileges needed, any non-default settings, and the steps to reproduce it.

THREAT_MODEL.md

@@ -1,166 +0,0 @@
-# Vaultwarden threat model
-
-To report a security issue, see [SECURITY.md](SECURITY.md).
-
-## Overview
-
-Vaultwarden is an unofficial, self-hosted server for the Bitwarden clients, written in Rust. It stores encrypted vaults and handles login, two-factor authentication, organizations, file and text sharing through Send, emergency access, and an admin panel for the operator. It is not affiliated with Bitwarden. The browser, desktop, mobile and CLI clients come from Bitwarden. Our container images include a web vault built from Bitwarden's web client with our own patches.
-
-## Security expectations
-
-### Deployment
-
-We expect a TLS-terminating reverse proxy in front of the server, `DOMAIN` set to its public origin, and an operator who keeps the host secure. This model covers Vaultwarden itself. Third-party software that consumes its output or sits in front of it, such as log parsers and reverse proxies, is the operator's to configure and secure.
-
-### Encryption
-
-Clients encrypt vault contents end to end. The server stores and serves ciphertext it cannot decrypt, and it never sees the master password. The server enforces access to data and actions itself, without relying on a client to behave. A few settings rely on the client for part of their effect, such as `hide_passwords`, where the client still receives the password, and some organization policies.
-
-A member receives the organization key when they are confirmed. Invited and accepted members do not have it. A revoked member who was once confirmed may still have it. Every confirmed member holds the same key for the whole organization, so only the server separates collections.
-
-The server can read everything that is not end-to-end encrypted, such as email addresses, names, organization names, who owns what, item types and timestamps, attachment sizes, password hints, the stored master password hash and KDF settings, the TOTP and other 2FA secrets that protect login to the account, API keys, refresh tokens, security stamps, the JWT signing key, and SMTP and push credentials. TOTP secrets that users store in vault items are end-to-end encrypted with the rest of the item.
-
-### Trust
-
-Registration is open by default (`SIGNUPS_ALLOWED=true`), but many personal and small-team instances turn it off, so holding an account usually implies a minimal level of trust. Account holders are still never trusted with anyone else's data. Members of an organization have some trust in each other.
-
-| Actor | Can reach | Must not reach |
-|---|---|---|
-| Anonymous internet | Login, prelogin, registration, public Send access, icons, the anonymous notifications hub, static files | Any vault, Send, organization or member data; the admin panel; the internal network through outbound requests |
-| Registered user | Their own vault, Sends, devices and settings; organizations they belong to | Another user's data; any other organization; raising their own role or status |
-| Invited or accepted member | Accepting the invitation, enrolling in account recovery, and the organization's name, public key and policies | Items, collections, the member list, the organization key, any other privileged action before confirmation |
-| Revoked member | Nothing in that organization | Any organization data from the server, even data they could once read |
-| Organization User | Items in assigned collections, with `read_only` and `manage` enforced by the server | Other collections, write access to read-only collections, Admin-level metadata |
-| Organization Manager (shown as Custom in clients) | The above, plus managing collections where they have `manage`. With "manage all collections" (`access_all`), every collection and full member and group details | Without `access_all`: managing other collections, full member and group details. Always: changing policies, role changes |
-| Organization Admin | All data in that organization, members below Owner (some actions on Managers and Admins are limited to Owners), policies, events, account recovery for enrolled members below Owner | Owners, other organizations, the personal vault of a member who is not enrolled in recovery, the organization API key |
-| Organization Owner | The whole organization, including account recovery for enrolled members | Other organizations; the personal vault of a member who is not enrolled in recovery |
-| Organization API key holder (Owner-issued) | Directory import into its own organization | Other organizations, item content, Owners |
-| Send recipient | One Send, within its limits | Other Sends, access beyond the configured limits, the owner's vault |
-| Emergency access grantee | After approval or the wait time: the access the grantor configured, which can be full takeover by design | Anything before that |
-| Admin panel (`ADMIN_TOKEN`) | All users, organizations and settings. We expect the holder to also have admin access to the machine | No limit once authenticated |
-| Host operator, database and data folder access | Everything | No limit |
-| Configured SSO provider, SMTP server, push relay | What they need for their function | Vault contents |
-
-### Configuration
-
-Optional features that operators turn on carry the same expectations as the defaults: SSO, groups, organization events, anything needing SMTP (email 2FA, invitations), push, S3 storage, the admin panel, and the MySQL and PostgreSQL backends.
-
-Some settings remove a protection on purpose, and using them is the operator's choice: `DISABLE_ADMIN_TOKEN`, `IP_HEADER_TRUSTED_PROXIES=all` on a directly exposed instance, turning off `HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS`, and `SSO_DEBUG_TOKENS`.
-
-### Upstream Bitwarden
-
-Where this document does not cover a behaviour, we follow upstream Bitwarden by default.
-
-## Security issues
-
-A security issue is a bug in Vaultwarden that breaks these expectations. Examples:
-
-- someone reading, adding, changing or deleting data that the table above says they must not reach;
-- an organization member reaching collections they are not assigned to, or a revoked or unconfirmed member reaching organization items or collections;
-- someone gaining a role or permission they should not have;
-- getting past an organization policy the server enforces;
-- a login session or refresh token surviving a password change or security stamp rotation, or a remembered device still skipping 2FA after a 2FA method is removed;
-- getting past authentication, 2FA or login brute-force protection;
-- logging in as someone else through SSO;
-- reading a Send that is disabled or expired, or exceeding its limits;
-- reaching an emergency access outcome early or out of order;
-- reaching the admin panel without the token, or acting through an admin's session with script or a cross-site request;
-- outbound requests reaching the internal network;
-- attacker-controlled script or HTML served from the vault origin, where the web vault runs and holds decrypted keys;
-- code execution on the server, or exposure of keys or other server-held secrets, including in logs;
-- denial of service or resource exhaustion that still applies with a reverse proxy in front.
-
-## Not security issues
-
-These are intended behaviour or outside this model. Several match upstream Bitwarden.
-
-- What the admin panel or host operator can do once authenticated, including an admin token holder running code on the server. We expect them to have admin access to the machine.
-- Organization Owners and Admins reading all organization data, and account recovery of enrolled members. Both are by design.
-- Organization Managers listing basic member details, such as names and emails. Upstream allows this for all members.
-- `hide_passwords` ("except passwords"). It helps avoid accidental leaks and copy-pastes, but the client still holds the password.
-- Bugs in Bitwarden's client code, including that code in the web vault we bundle, such as CSV formula injection (exports are built in the browser) or a client failing on a malformed stored value. The advisory and CVE for those belong to Bitwarden. When the bundled web vault is affected, we ship a security release that references theirs. Bugs that our own web vault patches add are ours.
-- The server not decrypting or authenticating ciphertext. It holds no key.
-- `/identity/accounts/prelogin` returning KDF settings for any email, with deterministic fake settings for unknown ones.
-- Login timing not being equalized.
-- Download link replay: an attachment token or Send access token being reusable by its holder until it expires (1 and 2 minutes), and object storage presigned URLs that we cannot count or revoke. The holder already has the content.
-- Organization API tokens staying valid until they expire (1 hour) after the key is rotated.
-- The personal API key working after a password change until the user rotates it. It is a separate credential.
-- A revoked or removed member's login session staying valid. It belongs to their own account, and the server checks membership on every request.
-- A revoked or removed member keeping what their client already synced, and the organization key not being rotated when a member leaves.
-- The notifications WebSocket accepting a login token until it expires, and keeping open connections, after a password change. It carries change notifications and login requests, not vault data.
-- Anonymous `clear-token` on `/devices/identifier/<id>/clear-token`. The impact is delayed push delivery.
-- No server-side cleanup of attachments that were reserved but never uploaded.
-- The number of items a user can store. There is no limit, by design.
-- Log injection. Changing log lines has no effect on Vaultwarden and only matters to third-party software parsing them, such as Fail2Ban, including filters from our community wiki.
-- Reverse proxy misconfiguration, such as a proxy not sending `X-Forwarded-Proto`, which decides the admin cookie's `Secure` flag.
-- Attacks that need another component to break its own specification.
-- Outbound requests to the SSO provider, Yubico server or S3 endpoint the operator configures, which skip the outbound filter and can be on the internal network.
-- Weak KDF settings a user chooses for their own account.
-- File permissions in the data folder. Host security belongs to the operator.
-- The WebSocket `access_token` query parameter. Clients send it that way, and our hardening guide covers log redaction.
-- Dependency and base image CVEs without a path reachable through Vaultwarden.
-- Missing best practices with no demonstrated impact, such as headers, `style-src 'unsafe-inline'` (the web vault needs it) and version disclosure.
-- Outdated versions.
-
-## Severity
-
-We rate issues by what the attacker holds at the end (plaintext, ciphertext they have the key for, ciphertext they have no key for, or the power to write or delete, which needs no key) and by the access they needed first. An attack that needs no account usually rates higher than one that does. This applies to new issues. Older advisories may be rated differently.
-
-Denial of service and resource exhaustion only count if they still apply with a reverse proxy in front. We do not consider them a serious problem in practice, so they are never High and Medium should be rare.
-
-Secrets written to logs are rated by what the secret gives someone who reads the logs and how long it stays valid. Reading logs does not assume host access.
-
-### Critical
-
-Anything that lets someone read another account's data decrypted is Critical by default, whether or not they have an account of their own. That covers:
-
-- attacker-controlled script running on the vault origin for other users during normal use, caused by how Vaultwarden stores or serves content;
-- code execution on the server by anyone other than an admin token holder, because it can change the web vault the server serves;
-- exposing key material that lets someone else decrypt an account's data;
-- anyone other than the named grantee reaching an emergency access outcome.
-
-Forging login or admin tokens, reading the JWT signing key, reaching the admin panel without the token, and taking over arbitrary accounts with no action by the victim are also Critical when no account is needed.
-
-### High
-
-- Decrypted reads within the same organization, including a member reaching collections they are not assigned to, or a revoked member who kept the key. Members share one key and have some trust in each other, and the scope is limited to that organization.
-- Changing or deleting another user's or organization's existing data.
-- Reading another user's server-held secrets, such as their account's 2FA secrets or API keys.
-- Reading another user's stored master password hash or encrypted user key, which allow offline guessing of the master password.
-- SSRF that returns the response to the attacker.
-- Escalating within an organization with real effect on data or members.
-- Account takeover through SSO, unless it meets the Critical conditions above.
-- The named emergency access grantee reaching the outcome early. The grantor chose them and the scope is one account.
-- Script or a cross-site request acting through an admin's session without them noticing. This includes script that only runs in the admin panel. It is Critical if it reaches code execution or the files the server serves.
-- Attacker-controlled script on the vault origin that needs unusual victim interaction.
-
-### Medium
-
-- Ciphertext read by someone with no key.
-- Defeating login brute-force protection. The attacker still has to guess the password, and get past 2FA if the victim has it.
-- 2FA bypass that needs the password, and a login session or refresh token surviving a password change or security stamp rotation.
-- Getting past an organization policy the server enforces, such as required 2FA or single organization.
-- Adding data to another user's or organization's space without permission, such as a read-only member adding items.
-- Data loss for another user that the attacker cannot reliably trigger or aim.
-- SSRF where the response is filtered or blind.
-- Reading a Send that is disabled or expired.
-- Denial of service or resource exhaustion from one request with no account needed, in the default configuration, where the denial stays after the attacker stops until someone has to act, such as by restarting the server or repairing data.
-
-### Low
-
-These may be handled as ordinary hardening in some cases.
-
-- Behaviour that differs from upstream Bitwarden with low impact.
-- Bypassing a non-default limit (`USER_ATTACHMENT_LIMIT`, `ORG_ATTACHMENT_LIMIT`, `USER_SEND_LIMIT`).
-- Vaultwarden mishandling the headers of a correctly configured proxy (`IP_HEADER`, `IP_HEADER_TRUSTED_PROXIES`), even if that weakens rate limits.
-- Metadata across a boundary, such as who is assigned to which collection.
-- Exceeding a Send's access limits when the attacker already holds the link.
-- A missing rate limit outside login, with no other effect.
-- Forging organization audit events, as long as existing events cannot be modified.
-- Other ways to tell whether an email has an account, apart from the prelogin and login timing cases under "Not security issues".
-- Denial of service or resource exhaustion from one operation that needs an account or a non-default setting, where the denial stays after the attacker stops until someone has to act.
-- Denial of service or resource exhaustion that lasts only while the attacker keeps going, or that recovers by itself, such as a crash the container restarts from or a panic that yields a 500 with no lasting effect. We handle these as hardening.
-
-### CVSS
-
-Our ratings can differ from CVSS 3.1, because its scoring parameters don't translate well to an end-to-end encrypted system.

migrations/mysql/2026-10-08-120000_cipher_data_longtext/up.sql

@@ -0,0 +1,3 @@
+-- A blob-encrypted cipher keeps all of its content in `data`, up to 500,000 characters, so the
+-- 64 KiB of TEXT is too small. Like upstream, which uses LONGTEXT.
+ALTER TABLE ciphers MODIFY data LONGTEXT NOT NULL;

migrations/mysql/2026-10-09-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/mysql/2026-10-09-120000_user_crypto_v2/up.sql

@@ -0,0 +1,14 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          DATETIME NOT NULL,
+    updated_at          DATETIME NOT NULL,
+    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE
+);

migrations/mysql/2026-10-10-120000_add_custom_role_permissions/down.sql

@@ -0,0 +1,22 @@
+-- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
+-- versions before this one don't know. So while there are any, this fails on the duplicate key below, before anything
+-- is dropped: change their role first, or restore the backup taken before the upgrade.
+-- A failed attempt leaves the temporary table on this connection. Clear it before retrying.
+DROP TEMPORARY TABLE IF EXISTS custom_role_downgrade;
+CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
+INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
+INSERT INTO custom_role_downgrade
+    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
+    FROM users_organizations WHERE atype = 4 LIMIT 1;
+DROP TEMPORARY TABLE custom_role_downgrade;
+
+ALTER TABLE users_organizations
+    DROP COLUMN manage_users,
+    DROP COLUMN manage_groups,
+    DROP COLUMN manage_policies,
+    DROP COLUMN create_new_collections,
+    DROP COLUMN edit_any_collection,
+    DROP COLUMN delete_any_collection,
+    DROP COLUMN access_event_logs,
+    DROP COLUMN access_import_export,
+    DROP COLUMN access_reports;

migrations/mysql/2026-10-10-120000_add_custom_role_permissions/up.sql

@@ -0,0 +1,13 @@
+-- The granular permissions of the Custom member role. They only take effect on a Custom membership
+-- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
+-- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
+ALTER TABLE users_organizations
+    ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;

migrations/mysql/2026-11-02-120000_reset_user_key_id/up.sql

@@ -0,0 +1,4 @@
+-- Key rotations before this kept the id of the old user key, so every new
+-- cipher was refused from then on. Stale ids can't be told apart, so clear
+-- all of them; clients record their current key's id again when it's empty.
+UPDATE users SET key_id = NULL;

migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;

migrations/mysql/2026-11-04-120000_add_v2_upgrade_token/up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

migrations/postgresql/2026-10-08-120000_cipher_data_longtext/up.sql

@@ -0,0 +1,3 @@
+-- TEXT has no size limit here, only MySQL needed the change.
+-- PostgreSQL rejects a migration that is only comments ("Received an empty query"), hence the no-op.
+SELECT 1;

migrations/postgresql/2026-10-09-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/postgresql/2026-10-09-120000_user_crypto_v2/up.sql

@@ -0,0 +1,13 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          TIMESTAMP NOT NULL,
+    updated_at          TIMESTAMP NOT NULL
+);

migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/down.sql

@@ -0,0 +1,20 @@
+-- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
+-- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
+-- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
+CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
+INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
+INSERT INTO custom_role_downgrade
+    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
+    FROM users_organizations WHERE atype = 4 LIMIT 1;
+DROP TABLE custom_role_downgrade;
+
+ALTER TABLE users_organizations
+    DROP COLUMN manage_users,
+    DROP COLUMN manage_groups,
+    DROP COLUMN manage_policies,
+    DROP COLUMN create_new_collections,
+    DROP COLUMN edit_any_collection,
+    DROP COLUMN delete_any_collection,
+    DROP COLUMN access_event_logs,
+    DROP COLUMN access_import_export,
+    DROP COLUMN access_reports;

migrations/postgresql/2026-10-10-120000_add_custom_role_permissions/up.sql

@@ -0,0 +1,13 @@
+-- The granular permissions of the Custom member role. They only take effect on a Custom membership
+-- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
+-- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
+ALTER TABLE users_organizations
+    ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;

migrations/postgresql/2026-11-02-120000_reset_user_key_id/up.sql

@@ -0,0 +1,4 @@
+-- Key rotations before this kept the id of the old user key, so every new
+-- cipher was refused from then on. Stale ids can't be told apart, so clear
+-- all of them; clients record their current key's id again when it's empty.
+UPDATE users SET key_id = NULL;

migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;

migrations/postgresql/2026-11-04-120000_add_v2_upgrade_token/up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

migrations/sqlite/2026-10-08-120000_cipher_data_longtext/up.sql

@@ -0,0 +1 @@
+-- TEXT has no size limit here, only MySQL needed the change

migrations/sqlite/2026-10-09-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/sqlite/2026-10-09-120000_user_crypto_v2/up.sql

@@ -0,0 +1,13 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                TEXT     NOT NULL PRIMARY KEY,
+    user_uuid           TEXT     NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          DATETIME NOT NULL,
+    updated_at          DATETIME NOT NULL
+);

migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/down.sql

@@ -0,0 +1,19 @@
+-- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
+-- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
+-- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
+CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
+INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
+INSERT INTO custom_role_downgrade
+    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
+    FROM users_organizations WHERE atype = 4 LIMIT 1;
+DROP TABLE custom_role_downgrade;
+
+ALTER TABLE users_organizations DROP COLUMN manage_users;
+ALTER TABLE users_organizations DROP COLUMN manage_groups;
+ALTER TABLE users_organizations DROP COLUMN manage_policies;
+ALTER TABLE users_organizations DROP COLUMN create_new_collections;
+ALTER TABLE users_organizations DROP COLUMN edit_any_collection;
+ALTER TABLE users_organizations DROP COLUMN delete_any_collection;
+ALTER TABLE users_organizations DROP COLUMN access_event_logs;
+ALTER TABLE users_organizations DROP COLUMN access_import_export;
+ALTER TABLE users_organizations DROP COLUMN access_reports;

migrations/sqlite/2026-10-10-120000_add_custom_role_permissions/up.sql

@@ -0,0 +1,11 @@
+-- The granular permissions of the Custom member role. They only take effect on a Custom membership
+-- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
+ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT 0; -- FALSE
+ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT 0; -- FALSE

migrations/sqlite/2026-11-02-120000_reset_user_key_id/up.sql

@@ -0,0 +1,4 @@
+-- Key rotations before this kept the id of the old user key, so every new
+-- cipher was refused from then on. Stale ids can't be told apart, so clear
+-- all of them; clients record their current key's id again when it's empty.
+UPDATE users SET key_id = NULL;

migrations/sqlite/2026-11-04-120000_add_v2_upgrade_token/down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users DROP COLUMN v2_upgrade_token;
+ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;

migrations/sqlite/2026-11-04-120000_add_v2_upgrade_token/up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
+ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;

src/api/admin.rs

@@ -1,4 +1,4 @@
-use std::{env, sync::LazyLock};
+use std::{collections::HashMap, env, sync::LazyLock};
 
 use reqwest::Method;
 use rocket::{
@@ -26,6 +26,7 @@ use crate::{
         models::{
             Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
             MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
+            custom_roles_enabled,
         },
     },
     error::{Error, MapResult},
@@ -256,6 +257,7 @@ struct AdminTemplateData {
     logged_in: bool,
     urlpath: String,
     sso_enabled: bool,
+    custom_roles_enabled: bool,
 }
 
 impl AdminTemplateData {
@@ -266,6 +268,7 @@ impl AdminTemplateData {
             logged_in: true,
             urlpath: CONFIG.domain_path(),
             sso_enabled: CONFIG.sso_enabled(),
+            custom_roles_enabled: custom_roles_enabled(),
         }
     }
 
@@ -390,6 +393,18 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri
 
         usr["sso_identifier"] = json!(sso_u.map_or(String::new(), |u| u.identifier.to_string()));
 
+        // The clients are shown a Manager as a Custom member, but the admin panel tells the two roles apart
+        let roles: HashMap<String, i32> = Membership::find_confirmed_by_user(&u.uuid, &conn)
+            .await
+            .into_iter()
+            .map(|member| (member.org_uuid.to_string(), member.atype))
+            .collect();
+        for org in usr["organizations"].as_array_mut().into_iter().flatten() {
+            if let Some(atype) = org["id"].as_str().and_then(|org_id| roles.get(org_id)) {
+                org["type"] = json!(atype);
+            }
+        }
+
         users_json.push(usr);
     }
 
@@ -430,7 +445,7 @@ async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn, nt: Notif
     if res.is_ok() {
         nt.send_logout(&user, None, &conn).await;
         if has_push_device {
-            push_logout_to_relay(&user, None);
+            push_logout_to_relay(&user, None, None);
         }
     }
 
@@ -565,10 +580,14 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
         err!("The specified user isn't member of the organization")
     };
 
-    let new_type = if let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) {
+    let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
-        new_type as i32
+        // Unlike the clients, the admin panel tells the Custom and the legacy Manager role apart. Unless Custom roles
-    } else {
+        // are enabled, a Custom role is a Manager here as well, but an existing Custom member is kept as one.
-        err!("Invalid type")
+        Some(MembershipType::Custom) if !custom_roles_enabled() && !member_to_edit.has_type(MembershipType::Custom) => {
+            MembershipType::Manager
+        }
+        Some(new_type) => new_type,
+        None => err!("Invalid type"),
     };
 
     if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
@@ -578,7 +597,14 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
         }
     }
 
-    member_to_edit.atype = new_type;
+    // A Manager only becomes a Custom member if that changes nothing they may do
+    if new_type == MembershipType::Custom
+        && let Some(loss) = member_to_edit.custom_role_conversion_loss(&conn).await
+    {
+        err!(loss)
+    }
+
+    member_to_edit.set_type(new_type);
     // This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type
     OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
 

src/api/core/ciphers.rs

@@ -24,6 +24,7 @@ use crate::{
             Archive, Attachment, AttachmentId, Cipher, CipherId, Collection, CollectionCipher, CollectionGroup,
             CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, KeyId,
             Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, User, UserId,
+            is_data_blob_encrypted,
         },
     },
     util::{NumberOrString, deser_opt_nonempty_str, save_temp_file},
@@ -189,12 +190,22 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "masterKeyEncryptedUserKey": headers.user.akey,
             "masterKeyWrappedUserKey": headers.user.akey,
-            "salt": headers.user.email
+            "salt": headers.user.master_password_salt(),
+            "containedKeyId": headers.user.key_id,
         })
     } else {
         Value::Null
     };
 
+    // Upstream omits these when unset rather than sending null
+    let mut user_decryption = json!({ "masterPasswordUnlock": master_password_unlock });
+    if let Some(key_id) = &headers.user.key_id {
+        user_decryption["userKeyId"] = json!(key_id);
+    }
+    if let Some(v2_upgrade_token) = headers.user.v2_upgrade_token_json() {
+        user_decryption["v2UpgradeToken"] = v2_upgrade_token;
+    }
+
     Ok(Json(json!({
         "profile": user_json,
         "folders": folders_json,
@@ -204,10 +215,7 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
         "ciphers": ciphers_json,
         "domains": domains_json,
         "sends": sends_json,
-        "userDecryption": {
+        "userDecryption": user_decryption,
-            "masterPasswordUnlock": master_password_unlock,
-            "userKeyId": headers.user.key_id,
-        },
         "object": "sync"
     })))
 }
@@ -269,7 +277,8 @@ pub struct CipherData {
 
     key: Option<String>,
 
-    pub encrypted_for: UserId, // Added in web-v2025.6.0
+    // Added in web-v2025.6.0. Deprecated upstream for `encrypted_by_key_id`, but still checked when sent
+    pub encrypted_for: Option<UserId>,
     // Added in web-v2025.8.1, Optional for compat
     pub encrypted_by_key_id: Option<KeyId>,
 
@@ -284,7 +293,8 @@ pub struct CipherData {
     Passport = 8
     */
     pub r#type: i32,
-    pub name: String,
+    // Absent on a blob-encrypted cipher, whose name is sealed inside `data`
+    pub name: Option<String>,
     pub notes: Option<String>,
     fields: Option<Value>,
 
@@ -298,6 +308,9 @@ pub struct CipherData {
     drivers_license: Option<Value>,
     passport: Option<Value>,
 
+    // The sealed blob of a v2 account's cipher, which replaces all of the fields above
+    data: Option<String>,
+
     favorite: Option<bool>,
     reprompt: Option<i32>,
 
@@ -319,6 +332,98 @@ pub struct CipherData {
     archived_date: Option<String>,
 }
 
+/// A field of a [`CipherData`] that fails upstream's model validation.
+#[derive(Debug)]
+pub struct CipherValidationError {
+    pub field: &'static str,
+    pub message: String,
+}
+
+impl From<CipherValidationError> for crate::Error {
+    fn from(e: CipherValidationError) -> Self {
+        Self::new_msg(e.message)
+    }
+}
+
+/// The cipher must have been encrypted for the acting user. Only checked when the client sends the field.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1857-L1870>
+fn validate_encrypted_for_user(data: &CipherData, user_id: &UserId) -> EmptyResult {
+    if data.encrypted_for.as_ref().is_some_and(|encrypted_for| encrypted_for != user_id) {
+        err!("Cipher was not encrypted for the current user. Please try again.")
+    }
+    Ok(())
+}
+
+/// [`validate_encrypted_for_user`], plus the key id of a user-owned cipher, when both ids are known.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1886-L1911>
+fn validate_encrypted_by_user(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
+    validate_encrypted_for_user(data, &user.uuid)?;
+
+    if !is_org_cipher
+        && let (Some(cipher_key_id), Some(user_key_id)) = (&data.encrypted_by_key_id, &user.key_id)
+        && cipher_key_id != user_key_id
+    {
+        err!("Cipher was not encrypted with the current user key. Please try again.")
+    }
+    Ok(())
+}
+
+/// Upstream's `[StringLength(500000)]` on `CipherRequestModel.Data`
+const MAX_CIPHER_DATA_LENGTH: usize = 500_000;
+
+impl CipherData {
+    /// Whether `data` is a blob rather than the per-type fields. Parses `data`, so keep the result.
+    pub fn is_blob(&self) -> bool {
+        self.data.as_deref().is_some_and(is_data_blob_encrypted)
+    }
+
+    /// Saving's last checks: a known type, and its data unless it's a blob.
+    pub fn validate_type_data(&self, is_blob: bool) -> EmptyResult {
+        let type_data = match self.r#type {
+            1 => &self.login,
+            2 => &self.secure_note,
+            3 => &self.card,
+            4 => &self.identity,
+            5 => &self.ssh_key,
+            6 => &self.bank_account,
+            7 => &self.drivers_license,
+            8 => &self.passport,
+            _ => err!("Invalid type"),
+        };
+        if !is_blob && type_data.is_none() {
+            err!("Data missing")
+        }
+        Ok(())
+    }
+
+    /// Upstream's model checks that depend on the format: the size of `data`, and a name unless it's a blob.
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L76-L77>
+    /// and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L91-L99>
+    pub fn validate_content(&self, is_blob: bool) -> Result<(), CipherValidationError> {
+        if let Some(data) = &self.data
+            && data.len() > MAX_CIPHER_DATA_LENGTH
+        {
+            return Err(CipherValidationError {
+                field: "Data",
+                message: format!("The field Data must be a string with a maximum length of {MAX_CIPHER_DATA_LENGTH}."),
+            });
+        }
+
+        // A blob carries the name inside it, so only the other formats need one
+        if !is_blob && self.name.as_deref().is_none_or(|n| n.trim().is_empty()) {
+            return Err(CipherValidationError {
+                field: "Name",
+                message: String::from("The Name field is required."),
+            });
+        }
+
+        Ok(())
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PartialCipherData {
@@ -352,16 +457,14 @@ async fn post_ciphers_create(
 ) -> JsonResult {
     let mut data: ShareCipherData = data.into_inner();
 
-    if data.cipher.encrypted_for != headers.user.uuid {
+    validate_encrypted_by_user(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
-        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
-    }
 
     // This check is usually only needed in update_cipher_from_data(), but we
     // need it here as well to avoid creating an empty cipher in the call to
     // cipher.save() below.
     enforce_personal_ownership_policy(Some(&data.cipher), &headers, &conn).await?;
 
-    let mut cipher = Cipher::new(data.cipher.r#type, data.cipher.name.clone());
+    let mut cipher = Cipher::new(data.cipher.r#type);
     cipher.user_uuid = Some(headers.user.uuid.clone());
     cipher.save(&conn).await?;
 
@@ -385,16 +488,7 @@ async fn post_ciphers_create(
 async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
     let mut data: CipherData = data.into_inner();
 
-    if data.encrypted_for != headers.user.uuid {
+    validate_encrypted_by_user(&data, &headers.user, data.organization_id.is_some())?;
-        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
-    }
-
-    if let Some(cipher_key_id) = &data.encrypted_by_key_id
-        && let Some(user_key_id) = &headers.user.key_id
-        && cipher_key_id != user_key_id
-    {
-        err_code!("Invalid key cipher", Status::UnprocessableEntity.code);
-    }
 
     // The web/browser clients set this field to null as expected, but the
     // mobile clients seem to set the invalid value `0001-01-01T00:00:00`,
@@ -402,7 +496,7 @@ async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt
     // needed when creating a new cipher, so just ignore it unconditionally.
     data.last_known_revision_date = None;
 
-    let mut cipher = Cipher::new(data.r#type, data.name.clone());
+    let mut cipher = Cipher::new(data.r#type);
     update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherCreate).await?;
 
     Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -426,6 +520,44 @@ async fn enforce_personal_ownership_policy(data: Option<&CipherData>, headers: &
     Ok(())
 }
 
+/// The checks of saving a cipher, for callers that run them before writing anything else
+async fn validate_cipher_update(
+    cipher: &Cipher,
+    data: &CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+    ut: UpdateType,
+) -> EmptyResult {
+    // Check that the client isn't updating an existing cipher with stale data.
+    // And only perform this check when not importing ciphers, else the date/time check will fail.
+    if ut != UpdateType::None
+        && let Some(dt) = &data.last_known_revision_date
+    {
+        match NaiveDateTime::parse_from_str(dt, "%+") {
+            // ISO 8601 format
+            Err(err) => warn!("Error parsing LastKnownRevisionDate '{}': {err}", dt.escape_debug()),
+            Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => {
+                err!("The client copy of this cipher is out of date. Resync the client and try again.")
+            }
+            Ok(_) => (),
+        }
+    }
+
+    if let Some(note) = &data.notes {
+        let max_note_size = CONFIG._max_note_size();
+        if note.len() > max_note_size {
+            err!(format!("The field Notes exceeds the maximum encrypted value length of {max_note_size} characters."))
+        }
+    }
+
+    if let Some(folder_id) = &data.folder_id
+        && Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, conn).await.is_none()
+    {
+        err!("Invalid folder", "Folder does not exist or belongs to another user");
+    }
+    Ok(())
+}
+
 pub async fn update_cipher_from_data(
     cipher: &mut Cipher,
     data: CipherData,
@@ -434,6 +566,40 @@ pub async fn update_cipher_from_data(
     conn: &DbConn,
     nt: &Notify<'_>,
     ut: UpdateType,
+) -> EmptyResult {
+    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
+    save_cipher_data(cipher, data, headers, shared_to_collections, conn, nt, ut).await
+}
+
+/// [`update_cipher_from_data`] for a rotation: like upstream, the personal ownership policy doesn't apply.
+pub async fn rotate_cipher_data(
+    cipher: &mut Cipher,
+    data: CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+    nt: &Notify<'_>,
+) -> EmptyResult {
+    save_cipher_data(cipher, data, headers, None, conn, nt, UpdateType::None).await
+}
+
+/// The checks of [`rotate_cipher_data`] that need the database, to run on every cipher before the first is saved
+pub async fn validate_rotated_cipher(
+    cipher: &Cipher,
+    data: &CipherData,
+    headers: &Headers,
+    conn: &DbConn,
+) -> EmptyResult {
+    validate_cipher_update(cipher, data, headers, conn, UpdateType::None).await
+}
+
+async fn save_cipher_data(
+    cipher: &mut Cipher,
+    data: CipherData,
+    headers: &Headers,
+    shared_to_collections: Option<Vec<CollectionId>>,
+    conn: &DbConn,
+    nt: &Notify<'_>,
+    ut: UpdateType,
 ) -> EmptyResult {
     // Cleanup cipher data, like removing the 'Response' key.
     // This key is somewhere generated during Javascript so no way for us this fix this.
@@ -449,34 +615,15 @@ pub async fn update_cipher_from_data(
         json_data
     }
 
-    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;
+    let is_blob = data.is_blob();
-
+    data.validate_content(is_blob)?;
-    // Check that the client isn't updating an existing cipher with stale data.
+    data.validate_type_data(is_blob)?;
-    // And only perform this check when not importing ciphers, else the date/time check will fail.
+    validate_cipher_update(cipher, &data, headers, conn, ut).await?;
-    if ut != UpdateType::None
-        && let Some(dt) = data.last_known_revision_date
-    {
-        match NaiveDateTime::parse_from_str(&dt, "%+") {
-            // ISO 8601 format
-            Err(err) => warn!("Error parsing LastKnownRevisionDate '{}': {err}", dt.escape_debug()),
-            Ok(dt) if cipher.updated_at.signed_duration_since(dt).num_seconds() > 1 => {
-                err!("The client copy of this cipher is out of date. Resync the client and try again.")
-            }
-            Ok(_) => (),
-        }
-    }
 
     if cipher.organization_uuid.is_some() && cipher.organization_uuid != data.organization_id {
         err!("Organization mismatch. Please resync the client before updating the cipher")
     }
 
-    if let Some(note) = &data.notes {
-        let max_note_size = CONFIG._max_note_size();
-        if note.len() > max_note_size {
-            err!(format!("The field Notes exceeds the maximum encrypted value length of {max_note_size} characters."))
-        }
-    }
-
     // Check if this cipher is being transferred from a personal to an organization vault
     let transfer_cipher = cipher.organization_uuid.is_none() && data.organization_id.is_some();
 
@@ -507,12 +654,6 @@ pub async fn update_cipher_from_data(
         cipher.user_uuid = Some(headers.user.uuid.clone());
     }
 
-    if let Some(ref folder_id) = data.folder_id
-        && Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, conn).await.is_none()
-    {
-        err!("Invalid folder", "Folder does not exist or belongs to another user");
-    }
-
     // Modify attachments name and keys when rotating
     if let Some(attachments) = data.attachments2 {
         for (id, attachment) in attachments {
@@ -551,26 +692,36 @@ pub async fn update_cipher_from_data(
         _ => err!("Invalid type"),
     };
 
-    let type_data = if let Some(mut data) = type_data_opt {
+    if let Some(blob) = data.data.filter(|_| is_blob) {
+        // A blob holds everything, the name included; the column can't be null, so it's left empty
+        // TODO: Make `ciphers.name` nullable and store `None` here instead.
+        cipher.name = String::new();
+        cipher.notes = None;
+        cipher.fields = None;
+        cipher.password_history = None;
+        cipher.data = blob;
+    } else {
+        let Some(mut type_data) = type_data_opt else {
+            err!("Data missing")
+        };
         // Remove the 'Response' key from the base object.
-        if let Some(data_obj) = data.as_object_mut() {
+        if let Some(data_obj) = type_data.as_object_mut() {
             data_obj.remove("response");
         }
         // Remove the 'Response' key from every Uri.
-        if data["uris"].is_array() {
+        if type_data["uris"].is_array() {
-            data["uris"] = clean_cipher_data(data["uris"].clone());
+            type_data["uris"] = clean_cipher_data(type_data["uris"].clone());
         }
-        data
+
-    } else {
+        // `validate_content` made sure there is a name
-        err!("Data missing")
+        cipher.name = data.name.unwrap_or_default();
-    };
+        cipher.notes = data.notes;
+        cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
+        cipher.password_history = data.password_history.map(|f| f.to_string());
+        cipher.data = type_data.to_string();
+    }
 
     cipher.key = data.key;
-    cipher.name = data.name;
-    cipher.notes = data.notes;
-    cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
-    cipher.data = type_data.to_string();
-    cipher.password_history = data.password_history.map(|f| f.to_string());
     cipher.reprompt = data.reprompt.filter(|r| *r == RepromptType::None as i32 || *r == RepromptType::Password as i32);
 
     cipher.save(conn).await?;
@@ -670,7 +821,7 @@ async fn post_ciphers_import(data: Json<ImportData>, headers: Headers, conn: DbC
         // Upstream: https://github.com/bitwarden/server/blob/b06b81c1fb33ce9c9872b96397ba2b4d879b66af/src/Api/Tools/Controllers/ImportCiphersController.cs#L58
         cipher_data.organization_id = None;
 
-        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
+        let mut cipher = Cipher::new(cipher_data.r#type);
         update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
     }
 
@@ -743,6 +894,9 @@ async fn put_cipher(
         err!("Cipher is not write accessible")
     }
 
+    // Against the cipher we hold rather than the organization the client claims, like upstream
+    validate_encrypted_by_user(&data, &headers.user, cipher.organization_uuid.is_some())?;
+
     // Moving a cipher into an organization is only possible through the share endpoints
     if cipher.organization_uuid != data.organization_id {
         err!("Organization mismatch. Please resync the client before updating the cipher")
@@ -1019,13 +1173,20 @@ async fn put_cipher_share(
 ) -> JsonResult {
     let data: ShareCipherData = data.into_inner();
 
+    // Upstream's `PutShare` checks, before anything is written.
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L899-L912>
+    // and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L498-L519>
     if data.cipher.organization_id.is_none() {
         err!("Cipher OrganizationId is required.")
     }
-
     if data.collection_ids.is_empty() {
         err!("You must select at least one collection.")
     }
+    if !Cipher::find_by_uuid(&cipher_id, &conn).await.is_some_and(|c| c.user_uuid.as_ref() == Some(&headers.user.uuid))
+    {
+        err_code!("Cipher doesn't exist", Status::NotFound.code)
+    }
+    validate_encrypted_for_user(&data.cipher, &headers.user.uuid)?;
 
     share_cipher_by_uuid(&cipher_id, data, &headers, &conn, &nt, None).await
 }
@@ -1085,21 +1246,35 @@ async fn put_cipher_share_selected(
 ) -> JsonResult {
     let data: ShareSelectedCipherData = data.into_inner();
 
+    // Upstream's `PutShareMany` checks, before anything is written.
+    // Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Controllers/CiphersController.cs#L1395-L1421>
+    // and <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Api/Vault/Models/Request/CipherRequestModel.cs#L560-L604>
     if data.ciphers.is_empty() {
         err!("You must select at least one cipher.")
     }
-
+    if data.ciphers.iter().any(|c| c.id.is_none() || c.organization_id.is_none()) {
+        err!("All Ciphers must have an Id and OrganizationId.")
+    }
+    if data.ciphers.iter().map(|c| &c.organization_id).collect::<HashSet<_>>().len() != 1 {
+        err!("All ciphers must be for the same organization.")
+    }
     if data.collection_ids.is_empty() {
         err!("You must select at least one collection.")
     }
-
     for cipher in &data.ciphers {
-        if cipher.id.is_none() {
+        let is_blob = cipher.is_blob();
-            err!("Request missing ids field")
+        cipher.validate_content(is_blob)?;
-        }
+        cipher.validate_type_data(is_blob)?;
-        if cipher.organization_id.is_none() {
+    }
-            err!("Cipher OrganizationId is required.")
+    for cipher in &data.ciphers {
-        }
+        validate_encrypted_for_user(cipher, &headers.user.uuid)?;
+    }
+    let owned_ciphers = Cipher::find_owned_by_user(&headers.user.uuid, &conn).await;
+    for cipher_data in &data.ciphers {
+        let Some(cipher) = owned_ciphers.iter().find(|c| cipher_data.id.as_ref() == Some(&c.uuid)) else {
+            err!("Trying to share ciphers that you do not own.")
+        };
+        validate_cipher_update(cipher, cipher_data, &headers, &conn, UpdateType::None).await?;
     }
 
     let mut responses = Vec::with_capacity(data.ciphers.len());
@@ -1161,6 +1336,22 @@ async fn share_cipher_by_uuid(
         err!("Organization mismatch. Please resync the client before updating the cipher")
     }
 
+    // When LastKnownRevisionDate is None, it is a new cipher, so send CipherCreate.
+    // If there is an override, like when handling multiple items, we want to prevent a push notification for every single item
+    let ut = if let Some(ut) = override_ut {
+        ut
+    } else if data.cipher.last_known_revision_date.is_some() {
+        UpdateType::SyncCipherUpdate
+    } else {
+        UpdateType::SyncCipherCreate
+    };
+
+    // For the same reason, the other checks of saving
+    let is_blob = data.cipher.is_blob();
+    data.cipher.validate_content(is_blob)?;
+    data.cipher.validate_type_data(is_blob)?;
+    validate_cipher_update(&cipher, &data.cipher, headers, conn, ut).await?;
+
     let mut shared_to_collections = vec![];
 
     if let Some(organization_id) = &data.cipher.organization_id {
@@ -1179,16 +1370,6 @@ async fn share_cipher_by_uuid(
         }
     }
 
-    // When LastKnownRevisionDate is None, it is a new cipher, so send CipherCreate.
-    // If there is an override, like when handling multiple items, we want to prevent a push notification for every single item
-    let ut = if let Some(ut) = override_ut {
-        ut
-    } else if data.cipher.last_known_revision_date.is_some() {
-        UpdateType::SyncCipherUpdate
-    } else {
-        UpdateType::SyncCipherCreate
-    };
-
     update_cipher_from_data(&mut cipher, data.cipher, headers, Some(shared_to_collections), conn, nt, ut).await?;
 
     Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, conn).await?))

src/api/core/organizations.rs

@@ -8,17 +8,17 @@ use crate::{
     CONFIG,
     api::admin::FAKE_ADMIN_UUID,
     api::{
-        EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
+        ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
         core::{CipherSyncData, CipherSyncType, accept_org_invite, log_event, two_factor},
     },
     auth::{AdminHeaders, Headers, ManagerHeaders, ManagerHeadersLoose, OrgMemberHeaders, OwnerHeaders, decode_invite},
     db::{
         DbConn,
         models::{
-            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, Device,
+            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser,
-            EventType, FillAssistPolicyData, Group, GroupId, GroupUser, Invitation, Membership, MembershipId,
+            CustomPermission, Device, EventType, FillAssistPolicyData, Group, GroupId, GroupUser, Invitation,
-            MembershipStatus, MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey,
+            Membership, MembershipId, MembershipStatus, MembershipType, OrgPolicy, OrgPolicyType, Organization,
-            OrganizationId, TwoFactor, TwoFactorType, User, UserId,
+            OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User, UserId, custom_roles_enabled,
         },
     },
     mail,
@@ -1008,14 +1008,12 @@ async fn send_invite(
     data.validate(&org_id, &conn).await?;
 
     // HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission
-    // The from_str() will convert the custom role type into a manager role type
+    // Unless Custom roles are enabled, a custom role (4) is converted to a manager role (3)
     let raw_type = &data.r#type.into_string();
-    // Membership::from_str will convert custom (4) to manager (3)
+    let Some(requested_type) = MembershipType::from_str(raw_type) else {
-    let new_type = if let Some(new_type) = MembershipType::from_str(raw_type) {
-        new_type as i32
-    } else {
         err!("Invalid type")
     };
+    let new_type = MembershipType::requested(requested_type, None, custom_roles_enabled());
 
     if new_type != MembershipType::User && headers.membership_type != MembershipType::Owner {
         err!("Only Owners can invite Managers, Admins or Owners")
@@ -1025,11 +1023,19 @@ async fn send_invite(
     // Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes
     // If the box is not checked, the user will still be a manager, but not with the access_all permission
     let access_all = new_type >= MembershipType::Admin
-        || (raw_type.eq("4")
+        || (new_type == MembershipType::Manager
+            && raw_type.eq("4")
             && data.permissions.get("editAnyCollection") == Some(&json!(true))
             && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
             && data.permissions.get("createNewCollections") == Some(&json!(true)));
 
+    // Checked before anything is created, so a rejected permission leaves nothing behind
+    let custom_permissions = if new_type == MembershipType::Custom {
+        Some(CustomPermission::requested(&data.permissions)?)
+    } else {
+        None
+    };
+
     let mut user_created: bool;
     for email in &data.emails {
         let mut member_status = MembershipStatus::Invited as i32;
@@ -1071,8 +1077,11 @@ async fn send_invite(
         };
 
         let mut new_member = Membership::new(user.uuid.clone(), org_id.clone(), Some(headers.user.email.clone()));
+        new_member.set_type(new_type);
         new_member.access_all = access_all;
-        new_member.atype = new_type;
+        if let Some(permissions) = &custom_permissions {
+            new_member.set_custom_permissions(permissions);
+        }
         new_member.status = member_status;
         new_member.save(&conn).await?;
 
@@ -1508,24 +1517,32 @@ async fn edit_member(
     let data: EditUserData = data.into_inner();
 
     // HACK: We need the raw user-type to be sure custom role is selected to determine the access_all permission
-    // The from_str() will convert the custom role type into a manager role type
+    // Unless Custom roles are enabled, a custom role (4) is converted to a manager role (3)
     let raw_type = &data.r#type.into_string();
-    // MembershipType::from_str will convert custom (4) to manager (3)
+    let Some(requested_type) = MembershipType::from_str(raw_type) else {
-    let Some(new_type) = MembershipType::from_str(raw_type) else {
         err!("Invalid type")
     };
 
+    let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else {
+        err!("The specified user isn't member of the organization")
+    };
+    let new_type = MembershipType::requested(requested_type, Some(&member_to_edit), custom_roles_enabled());
+
     // HACK: This converts the Custom role which has the `Manage all collections` box checked into an access_all flag
     // Since the parent checkbox is not sent to the server we need to check and verify the child checkboxes
     // If the box is not checked, the user will still be a manager, but not with the access_all permission
     let access_all = new_type >= MembershipType::Admin
-        || (raw_type.eq("4")
+        || (new_type == MembershipType::Manager
+            && raw_type.eq("4")
             && data.permissions.get("editAnyCollection") == Some(&json!(true))
             && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
             && data.permissions.get("createNewCollections") == Some(&json!(true)));
 
-    let Some(mut member_to_edit) = Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await else {
+    // While Custom roles are disabled, a Custom member keeps their stored permissions untouched
-        err!("The specified user isn't member of the organization")
+    let custom_permissions = if new_type == MembershipType::Custom && custom_roles_enabled() {
+        Some(CustomPermission::requested(&data.permissions)?)
+    } else {
+        None
     };
 
     if new_type != member_to_edit.atype
@@ -1549,8 +1566,11 @@ async fn edit_member(
         }
     }
 
+    member_to_edit.set_type(new_type);
     member_to_edit.access_all = access_all;
-    member_to_edit.atype = new_type as i32;
+    if let Some(permissions) = &custom_permissions {
+        member_to_edit.set_custom_permissions(permissions);
+    }
 
     // This check is also done at accept_invite, _confirm_invite, _activate_member, edit_member, admin::update_membership_type
     // We need to perform the check after changing the type since `admin` is exempt.
@@ -1846,7 +1866,7 @@ async fn post_org_import(
         cipher_data.folder_id = None;
         // Replace the client-provided, unvalidated organizationId with the real target org
         cipher_data.organization_id = Some(org_id.clone());
-        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
+        let mut cipher = Cipher::new(cipher_data.r#type);
         update_cipher_from_data(
             &mut cipher,
             cipher_data,
@@ -2849,8 +2869,26 @@ struct OrganizationUserRecoverAccountRequest {
 // But the clients do not seem to use this at all
 // Just add it here in case they will
 #[get("/organizations/<org_id>/public-key")]
-async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
+async fn get_organization_public_key(
-    if org_id != headers.membership.org_uuid {
+    org_id: OrganizationId,
+    headers: Headers,
+    member: Result<OrgMemberHeaders, &'static str>,
+    conn: DbConn,
+) -> JsonResult {
+    // SSO users without an org get the fake one, whose key the v2 JIT password flow fetches anyway
+    if org_id.eq_ignore_ascii_case(FAKE_SSO_IDENTIFIER) && headers.user.private_key.is_none() {
+        return Ok(Json(json!({
+            "object": "organizationPublicKey",
+            "publicKey": fake_sso_org_public_key().await?,
+        })));
+    }
+    let member = match member {
+        Ok(member) => member,
+        // The guard already logged it
+        Err(e) => return Err(crate::error::Error::new_msg(e).with_code(Status::Unauthorized.code)),
+    };
+
+    if org_id != member.membership.org_uuid {
         err!("Organization not found", "Organization id's do not match");
     }
     let Some(org) = Organization::find_by_uuid(&org_id, &conn).await else {
@@ -2863,11 +2901,30 @@ async fn get_organization_public_key(org_id: OrganizationId, headers: OrgMemberH
     })))
 }
 
+/// The SDK only uses this key to wrap an account recovery key that it never sends for the fake org,
+/// so it is made once and its private half dropped.
+async fn fake_sso_org_public_key() -> ApiResult<String> {
+    static PUBLIC_KEY: std::sync::LazyLock<Option<String>> = std::sync::LazyLock::new(|| {
+        let der = openssl::rsa::Rsa::generate(2048).and_then(|rsa| rsa.public_key_to_der()).ok()?;
+        Some(data_encoding::BASE64.encode(&der))
+    });
+
+    let Ok(Some(public_key)) = tokio::task::spawn_blocking(|| PUBLIC_KEY.clone()).await else {
+        err!("Failed to generate the organization key")
+    };
+    Ok(public_key)
+}
+
 // Obsolete - Renamed to public-key (2023.8), left for backwards compatibility with older clients
 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/OrganizationsController.cs#L487-L492
 #[get("/organizations/<org_id>/keys")]
-async fn get_organization_keys(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> JsonResult {
+async fn get_organization_keys(
-    get_organization_public_key(org_id, headers, conn).await
+    org_id: OrganizationId,
+    headers: Headers,
+    member: Result<OrgMemberHeaders, &'static str>,
+    conn: DbConn,
+) -> JsonResult {
+    get_organization_public_key(org_id, headers, member, conn).await
 }
 
 // Will allow to reset 2FA too

src/api/identity.rs

@@ -77,14 +77,14 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
             check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
             check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
 
-            password_login(data, &mut user_id, &conn, &client_header.ip).await
+            password_login(data, &mut user_id, &conn, &client_header.ip, client_header.client_version.as_ref()).await
         }
         "client_credentials" => {
             check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?;
             check_is_some(data.client_secret.as_ref(), "client_secret cannot be blank")?;
             check_is_some(data.scope.as_ref(), "scope cannot be blank")?;
 
-            api_key_login(data, &mut user_id, &conn, &client_header.ip).await
+            api_key_login(data, &mut user_id, &conn, &client_header.ip, client_header.client_version.as_ref()).await
         }
         "authorization_code" if CONFIG.sso_enabled() => {
             check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?;
@@ -95,7 +95,7 @@ async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbCo
             check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
             check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
 
-            sso_login(data, &mut user_id, &conn, &client_header.ip).await
+            sso_login(data, &mut user_id, &conn, &client_header.ip, client_header.client_version.as_ref()).await
         }
         "authorization_code" => err!("SSO sign-in is not available"),
         "send_access" => {
@@ -179,7 +179,13 @@ async fn refresh_login(data: ConnectData, conn: &DbConn, ip: &ClientIp) -> JsonR
 }
 
 // After exchanging the code we need to check first if 2FA is needed before continuing
-async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
+async fn sso_login(
+    data: ConnectData,
+    user_id: &mut Option<UserId>,
+    conn: &DbConn,
+    ip: &ClientIp,
+    client_version: Option<&semver::Version>,
+) -> JsonResult {
     AuthMethod::Sso.check_scope(data.scope.as_ref())?;
 
     // Ratelimit the login
@@ -325,6 +331,8 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
             (user, device, None, None)
         }
         Some((user, _)) if !user.enabled => {
+            // Set in both arms, not only after the match, so that their failed logins are logged
+            *user_id = Some(user.uuid.clone());
             err!(
                 "This user has been disabled",
                 format!("IP: {}. Username: {}.", ip.ip, user.email),
@@ -334,6 +342,9 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
             )
         }
         Some((mut user, sso_user)) => {
+            *user_id = Some(user.uuid.clone());
+            check_client_version(&user, client_version, ip)?;
+
             let mut device = get_device(&data, conn, &user).await?;
 
             let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?;
@@ -368,7 +379,13 @@ async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbCon
     authenticated_response(&user, &mut device, auth_tokens, twofactor_token, conn, ip).await
 }
 
-async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
+async fn password_login(
+    data: ConnectData,
+    user_id: &mut Option<UserId>,
+    conn: &DbConn,
+    ip: &ClientIp,
+    client_version: Option<&semver::Version>,
+) -> JsonResult {
     // Validate scope
     AuthMethod::Password.check_scope(data.scope.as_ref())?;
 
@@ -438,6 +455,8 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
         )
     }
 
+    check_client_version(&user, client_version, ip)?;
+
     // Change the KDF Iterations (only when not logging in with an auth request)
     if data.auth_request.is_none() {
         kdf_upgrade(&mut user, password, conn).await?;
@@ -499,6 +518,47 @@ async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
     authenticated_response(&user, &mut device, auth_tokens, twofactor_token, conn, ip).await
 }
 
+/// Like upstream's `ClientVersionValidator`, a V2 account ([`User::has_v2_encryption`]) logs in only from a client that
+/// sends its version and is at least 2025.11.0 (upstream also refuses a missing header for V1 accounts). Called right
+/// after the credentials are checked, like upstream, so that it doesn't tell anyone else which accounts are V2.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/8da186ad73f80d37157fe6fd42323e4284e83ec1/src/Identity/IdentityServer/RequestValidators/ClientVersionValidator.cs#L31-L72>
+fn check_client_version(user: &User, client_version: Option<&semver::Version>, ip: &ClientIp) -> EmptyResult {
+    let Some((error, description)) = client_version_error(user.has_v2_encryption(), client_version) else {
+        return Ok(());
+    };
+    Err(crate::error::Error::from((
+        format!("IP: {}. Username: {}. {error}", ip.ip, user.email),
+        json!({
+            "error": error,
+            "error_description": description,
+            "ErrorModel": { "Message": description, "Object": "error" },
+        }),
+    ))
+    .with_event(crate::error::ErrorEvent {
+        event: EventType::UserFailedLogIn,
+    }))
+}
+
+/// The error id and message of [`check_client_version`], `None` when the client may log in.
+fn client_version_error(is_v2: bool, client_version: Option<&semver::Version>) -> Option<(&'static str, &'static str)> {
+    const MIN_V2_CLIENT: semver::Version = semver::Version::new(2025, 11, 0);
+
+    if !is_v2 {
+        return None;
+    }
+    match client_version {
+        None => Some((
+            "version_header_missing",
+            "No client version header found, required to prevent encryption errors. Please confirm your client is supplying the header: \"Bitwarden-Client-Version\"",
+        )),
+        Some(version) if *version < MIN_V2_CLIENT => {
+            Some(("invalid_client_version", "Please update your app to continue using Bitwarden"))
+        }
+        Some(_) => None,
+    }
+}
+
 async fn authenticated_response(
     user: &User,
     device: &mut Device,
@@ -546,24 +606,13 @@ async fn authenticated_response(
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "MasterKeyEncryptedUserKey": user.akey,
             "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.email
+            "Salt": user.master_password_salt()
         })
     } else {
         Value::Null
     };
 
-    let account_keys = if user.private_key.is_some() {
+    let account_keys = user.account_keys_json(conn).await;
-        json!({
-            "publicKeyEncryptionKeyPair": {
-                "wrappedPrivateKey": user.private_key,
-                "publicKey": user.public_key,
-                "Object": "publicKeyEncryptionKeyPair"
-            },
-            "Object": "privateKeys"
-        })
-    } else {
-        Value::Null
-    };
 
     let mut result = json!({
         "access_token": auth_tokens.access_token(),
@@ -598,7 +647,13 @@ async fn authenticated_response(
     Ok(Json(result))
 }
 
-async fn api_key_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
+async fn api_key_login(
+    data: ConnectData,
+    user_id: &mut Option<UserId>,
+    conn: &DbConn,
+    ip: &ClientIp,
+    client_version: Option<&semver::Version>,
+) -> JsonResult {
     // Ratelimit the login
     crate::ratelimit::check_limit_login(&ip.ip)?;
 
@@ -610,7 +665,7 @@ async fn api_key_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &D
             check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
             check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;
 
-            user_api_key_login(data, user_id, conn, ip).await
+            user_api_key_login(data, user_id, conn, ip, client_version).await
         }
         Some(scope) if scope == &AuthMethod::OrgApiKey.scope() => organization_api_key_login(data, conn, ip).await,
         _ => err!("Scope not supported"),
@@ -622,6 +677,7 @@ async fn user_api_key_login(
     user_id: &mut Option<UserId>,
     conn: &DbConn,
     ip: &ClientIp,
+    client_version: Option<&semver::Version>,
 ) -> JsonResult {
     // Get the user via the client_id
     let client_id = data.client_id.as_ref().unwrap();
@@ -659,6 +715,8 @@ async fn user_api_key_login(
         )
     }
 
+    check_client_version(&user, client_version, ip)?;
+
     let mut device = get_device(&data, conn, &user).await?;
 
     if CONFIG.mail_enabled() && device.is_new() {
@@ -703,24 +761,13 @@ async fn user_api_key_login(
             // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
             "MasterKeyEncryptedUserKey": user.akey,
             "MasterKeyWrappedUserKey": user.akey,
-            "Salt": user.email
+            "Salt": user.master_password_salt()
         })
     } else {
         Value::Null
     };
 
-    let account_keys = if user.private_key.is_some() {
+    let account_keys = user.account_keys_json(conn).await;
-        json!({
-            "publicKeyEncryptionKeyPair": {
-                "wrappedPrivateKey": user.private_key,
-                "publicKey": user.public_key,
-                "Object": "publicKeyEncryptionKeyPair"
-            },
-            "Object": "privateKeys"
-        })
-    } else {
-        Value::Null
-    };
 
     // Note: No refresh_token is returned. The CLI just repeats the
     // client_credentials login flow when the existing token expires.
@@ -1351,3 +1398,24 @@ async fn authorize(data: AuthorizeData, cookies: &CookieJar<'_>, secure: Secure,
 
     Ok(Redirect::temporary(String::from(auth_url)))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_client_version_error() {
+        let version = |v| semver::Version::parse(v).unwrap();
+        // V1 accounts aren't checked, with or without a version
+        assert_eq!(client_version_error(false, None), None);
+        assert_eq!(client_version_error(false, Some(&version("2024.1.0"))), None);
+        // V2 accounts need the header and 2025.11.0 or newer
+        assert_eq!(client_version_error(true, None).map(|e| e.0), Some("version_header_missing"));
+        assert_eq!(
+            client_version_error(true, Some(&version("2025.10.3"))).map(|e| e.0),
+            Some("invalid_client_version")
+        );
+        assert_eq!(client_version_error(true, Some(&version("2025.11.0"))), None);
+        assert_eq!(client_version_error(true, Some(&version("2026.10.1"))), None);
+    }
+}

src/api/mod.rs

@@ -23,7 +23,7 @@ pub use crate::api::{
     icons::routes as icons_routes,
     identity::routes as identity_routes,
     notifications::routes as notifications_routes,
-    notifications::{AnonymousNotify, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
+    notifications::{AnonymousNotify, LogOutReason, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
     push::{
         push_cipher_update, push_folder_update, push_logout, push_logout_to_relay, push_send_update, push_user_update,
         register_push_device, unregister_push_device,

src/api/notifications.rs

@@ -412,23 +412,35 @@ impl WebSocketUsers {
     }
 
     pub async fn send_logout(&self, user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+        self.send_logout_with_reason(user, acting_device, None, conn).await;
+    }
+
+    /// A logout that clients may handle differently depending on `reason`
+    pub async fn send_logout_with_reason(
+        &self,
+        user: &User,
+        acting_device: Option<&Device>,
+        reason: Option<LogOutReason>,
+        conn: &DbConn,
+    ) {
         // Skip any processing if both WebSockets and Push are not active
         if *NOTIFICATIONS_DISABLED {
             return;
         }
         let acting_device_id = acting_device.map(|d| d.uuid.clone());
-        let data = create_update(
+        let mut payload =
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
+            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))];
-            UpdateType::LogOut,
+        if let Some(reason) = reason {
-            acting_device_id,
+            payload.push(("Reason".into(), (reason as i32).into()));
-        );
+        }
+        let data = create_update(payload, UpdateType::LogOut, acting_device_id);
 
         if CONFIG.enable_websocket() {
             self.send_update(&user.uuid, &data).await;
         }
 
         if CONFIG.push_enabled() {
-            push_logout(user, acting_device, conn).await;
+            push_logout(user, acting_device, reason, conn).await;
         }
     }
 
@@ -692,6 +704,14 @@ fn create_anonymous_update(payload: Vec<(Value, Value)>, ut: UpdateType, user_id
     serialize(&value)
 }
 
+/// Why a logout was pushed, absent for a plain one. `KdfChange` isn't sent yet.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Enums/PushNotificationLogOutReason.cs#L3-L7>
+#[derive(Copy, Clone, Eq, PartialEq)]
+pub enum LogOutReason {
+    KeyRotation = 1,
+}
+
 // https://github.com/bitwarden/server/blob/375af7c43b10d9da03525d41452f95de3f921541/src/Core/Enums/PushType.cs
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum UpdateType {

src/api/push.rs

@@ -12,7 +12,7 @@ use tokio::sync::RwLock;
 
 use crate::{
     CONFIG,
-    api::{ApiResult, EmptyResult, UpdateType},
+    api::{ApiResult, EmptyResult, LogOutReason, UpdateType},
     db::{
         DbConn,
         models::{AuthRequestId, Cipher, Device, Folder, PushId, Send, User, UserId},
@@ -192,15 +192,15 @@ pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device
     }
 }
 
-pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbConn) {
+pub async fn push_logout(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>, conn: &DbConn) {
     if Device::check_user_has_push_device(&user.uuid, conn).await {
-        push_logout_to_relay(user, acting_device);
+        push_logout_to_relay(user, acting_device, reason);
     }
 }
 
 // Sends the logout without checking for push devices first.
 // Needed after deleting a user, when the devices are already gone from the database.
-pub fn push_logout_to_relay(user: &User, acting_device: Option<&Device>) {
+pub fn push_logout_to_relay(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>) {
     tokio::task::spawn(send_to_push_relay(json!({
         "userId": user.uuid,
         "organizationId": (),
@@ -209,7 +209,8 @@ pub fn push_logout_to_relay(user: &User, acting_device: Option<&Device>) {
         "type": UpdateType::LogOut as i32,
         "payload": {
             "userId": user.uuid,
-            "date": format_date(&user.updated_at)
+            "date": format_date(&user.updated_at),
+            "reason": reason.map(|r| r as i32),
         },
         "clientType": null,
         "installationId": null

src/api/web.rs

@@ -20,7 +20,7 @@ use crate::{
     crypto::sha256_hex,
     db::{
         DbConn,
-        models::{AttachmentId, CipherId},
+        models::{AttachmentId, CipherId, custom_roles_enabled},
     },
     error::Error,
     util::{Cached, EtagCached},
@@ -90,6 +90,7 @@ fn vaultwarden_css() -> EtagCached<String> {
 
     // Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS
     let css_options = json!({
+        "custom_roles_enabled": custom_roles_enabled(),
         "email_change_allowed": CONFIG.email_change_allowed(),
         "emergency_access_allowed": CONFIG.emergency_access_allowed(),
         "load_user_scss": true,

src/auth.rs

@@ -34,7 +34,7 @@ use crate::{
         models::{
             AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
             EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
-            SendFileId, SendId, User, UserId, UserStampException,
+            SendFileId, SendId, User, UserId,
         },
     },
     error::Error,
@@ -632,6 +632,9 @@ impl<'r> FromRequest<'r> for Host {
 pub struct ClientHeaders {
     pub device_type: i32,
     pub ip: ClientIp,
+    /// `Bitwarden-Client-Version`, `None` when missing or not a version. Unlike the [`ClientVersion`] guard, this
+    /// doesn't log an error, as not every client sends it.
+    pub client_version: Option<semver::Version>,
 }
 
 #[rocket::async_trait]
@@ -648,10 +651,13 @@ impl<'r> FromRequest<'r> for ClientHeaders {
             .get_one("device-type")
             .and_then(|d| d.parse().ok())
             .unwrap_or(DeviceType::UnknownBrowser as i32);
+        let client_version =
+            request.headers().get_one("Bitwarden-Client-Version").and_then(|v| semver::Version::parse(v).ok());
 
         Outcome::Success(ClientHeaders {
             device_type,
             ip,
+            client_version,
         })
     }
 }
@@ -707,31 +713,12 @@ impl<'r> FromRequest<'r> for Headers {
         };
 
         if user.security_stamp != claims.sstamp {
-            if let Some(stamp_exception) =
+            let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                user.stamp_exception.as_deref().and_then(|s| serde_json::from_str::<UserStampException>(s).ok())
+                err_handler!("Error getting current route for stamp exception")
-            {
+            };
-                let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                    err_handler!("Error getting current route for stamp exception")
-                };
 
-                // Check if the stamp exception has expired first.
+            // Expired exceptions are only dropped on reset; writing them back here could undo a newer reset
-                // Then, check if the current route matches any of the allowed routes.
+            if !user.stamp_exceptions().iter().any(|e| e.allows(&claims.sstamp, current_route)) {
-                // After that check the stamp in exception matches the one in the claims.
-                if Utc::now().timestamp() > stamp_exception.expire {
-                    // If the stamp exception has been expired remove it from the database.
-                    // This prevents checking this stamp exception for new requests.
-                    let mut user = user;
-                    user.reset_stamp_exception();
-                    if let Err(e) = user.save(&conn).await {
-                        error!("Error updating user: {e:#?}");
-                    }
-                    err_handler!("Stamp exception is expired")
-                } else if !stamp_exception.routes.contains(&current_route.to_owned()) {
-                    err_handler!("Invalid security stamp: Current route and exception route do not match")
-                } else if stamp_exception.security_stamp != claims.sstamp {
-                    err_handler!("Invalid security stamp for matched stamp exception")
-                }
-            } else {
                 err_handler!("Invalid security stamp")
             }
         }

src/config.rs

@@ -817,6 +817,10 @@ make_config! {
         /// Enable groups (BETA!) (Know the risks!) |> Enables groups support for organizations (Currently contains known issues!).
         org_groups_enabled:            bool, false, def, false;
 
+        /// Enable Custom roles (EXPERIMENTAL!) (Know the risks!) |> Enables the in-development Custom member role with granular permissions for organizations.
+        /// Only the permissions this version enforces can be granted. Disabling it again keeps the stored Custom roles, but they grant nothing until it is re-enabled.
+        experimental_custom_roles:     bool, false, def, false;
+
         /// Increase note size limit (Know the risks!) |> Sets the secure note size limit to 100_000 instead of the default 10_000.
         /// WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
         increase_note_size_limit:      bool,  true,  def, false;
@@ -1508,6 +1512,8 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     // Key Management Team
     "biometrics-sdk-ipc",
     "windows-native-credential-sync",
+    "enable-account-encryption-v2-jit-password-registration",
+    "pm-27278-v2-password-registration",
     // Mobile Team
     "pm-34171-card-scanner",
     // Platform Team

src/db/mod.rs

@@ -534,3 +534,74 @@ mod postgresql_migrations {
         Ok(())
     }
 }
+
+/// A throwaway SQLite database with the real schema, for tests that need to run queries.
+#[cfg(all(test, sqlite))]
+pub mod test_db {
+    use super::sqlite_migrations::MIGRATIONS;
+    use diesel::connection::SimpleConnection;
+    use diesel_migrations::MigrationHarness;
+
+    #[test]
+    fn custom_role_migration_preserves_memberships_and_guards_downgrade() {
+        use super::schema::users_organizations::dsl::*;
+        use diesel::{migration::MigrationSource, prelude::*};
+        let mut conn = SqliteConnection::establish(":memory:").unwrap();
+        for migration in conn.pending_migrations(MIGRATIONS).unwrap() {
+            if migration.name().version().to_string() == "20261010120000" {
+                break;
+            }
+            conn.run_migration(&migration).unwrap();
+        }
+        conn.batch_execute(
+            "PRAGMA foreign_keys=OFF;
+            INSERT INTO organizations (uuid,name,billing_email) VALUES ('org','Org','a@b');
+            INSERT INTO users_organizations (uuid,user_uuid,org_uuid,access_all,akey,status,atype) VALUES
+            ('0','0','org',TRUE,'key',2,0), ('1','1','org',TRUE,'key',2,1),
+            ('2','2','org',FALSE,'key',1,2), ('3','3','org',FALSE,'key',2,3), ('4','4','org',TRUE,'key',2,3);",
+        )
+        .unwrap();
+        let rows = |conn: &mut SqliteConnection| {
+            users_organizations
+                .select((uuid, user_uuid, org_uuid, access_all, akey, status, atype))
+                .order(uuid)
+                .load::<(String, String, String, bool, String, i32, i32)>(conn)
+                .unwrap()
+        };
+        let before = rows(&mut conn);
+        conn.run_pending_migrations(MIGRATIONS).unwrap();
+        assert_eq!(rows(&mut conn), before);
+        let grants = |conn: &mut SqliteConnection| {
+            diesel::select(diesel::dsl::sql::<diesel::sql_types::BigInt>(
+                "(SELECT COUNT(*) FROM users_organizations WHERE manage_users OR manage_groups OR manage_policies
+                OR create_new_collections OR edit_any_collection OR delete_any_collection
+                OR access_event_logs OR access_import_export OR access_reports)",
+            ))
+            .get_result::<i64>(conn)
+            .unwrap()
+        };
+        assert_eq!(grants(&mut conn), 0);
+        let migration = MigrationSource::<diesel::sqlite::Sqlite>::migrations(&MIGRATIONS)
+            .unwrap()
+            .into_iter()
+            .find(|m| m.name().version().to_string() == "20261010120000")
+            .unwrap();
+        for member_status in [1, 2] {
+            conn.batch_execute(&format!(
+                "UPDATE users_organizations SET atype=4,manage_users=TRUE,status={member_status} WHERE uuid='2'"
+            ))
+            .unwrap();
+            let custom = rows(&mut conn);
+            assert!(conn.revert_migration(&*migration).is_err());
+            assert_eq!(rows(&mut conn), custom);
+            assert!(users_organizations.filter(uuid.eq("2")).select(manage_users).first::<bool>(&mut conn).unwrap());
+        }
+        conn.batch_execute("UPDATE users_organizations SET atype=2,manage_users=FALSE,status=1 WHERE uuid='2'")
+            .unwrap();
+        conn.revert_migration(&*migration).unwrap();
+        assert!(diesel::sql_query("SELECT manage_users FROM users_organizations").execute(&mut conn).is_err());
+        conn.run_pending_migrations(MIGRATIONS).unwrap();
+        assert_eq!(grants(&mut conn), 0);
+        assert_eq!(rows(&mut conn), before);
+    }
+}

src/db/models/cipher.rs

@@ -19,13 +19,13 @@ use crate::{
         },
     },
     error::MapResult,
-    util::LowerCase,
+    util::{LowerCase, convert_json_key_lcase_first},
 };
 use macros::UuidFromParam;
 
 use super::{
     Archive, Attachment, CollectionCipher, CollectionId, Favorite, FolderCipher, FolderId, Group, Membership,
-    MembershipStatus, MembershipType, OrganizationId, User, UserId,
+    MembershipStatus, OrganizationId, User, UserId, organization::ORG_ADMIN_ATYPES,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -63,6 +63,18 @@ pub struct Cipher {
     pub reprompt: Option<i32>,
 }
 
+/// Whether `data` is a v2 cipher blob, recognized like upstream by a top-level `format_version` key.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/Vault/Entities/Cipher.cs#L36-L41>
+pub fn is_data_blob_encrypted(data: &str) -> bool {
+    serde_json::from_str::<Value>(data).is_ok_and(|d| is_blob_value(&d))
+}
+
+/// [`is_data_blob_encrypted`] for `data` that was already parsed.
+fn is_blob_value(data: &Value) -> bool {
+    data.get("format_version").is_some()
+}
+
 pub enum RepromptType {
     None = 0,
     Password = 1,
@@ -70,7 +82,8 @@ pub enum RepromptType {
 
 /// Local methods
 impl Cipher {
-    pub fn new(atype: i32, name: String) -> Self {
+    /// The name is set when the data is saved, since a blob-encrypted cipher has it inside `data`
+    pub fn new(atype: i32) -> Self {
         let now = Utc::now().naive_utc();
 
         Self {
@@ -84,7 +97,7 @@ impl Cipher {
             key: None,
 
             atype,
-            name,
+            name: String::new(),
 
             notes: None,
             fields: None,
@@ -110,6 +123,16 @@ impl Cipher {
                     .insert(format!("Ciphers[{index}].Notes"), serde_json::to_value([&max_note_size_msg]).unwrap());
             }
 
+            let is_blob = cipher.is_blob();
+            if let Err(e) = cipher.validate_content(is_blob) {
+                validation_errors
+                    .insert(format!("Ciphers[{index}].{}", e.field), serde_json::to_value([e.message]).unwrap());
+            }
+            if let Err(e) = cipher.validate_type_data(is_blob) {
+                validation_errors
+                    .insert(format!("Ciphers[{index}].Type"), serde_json::to_value([e.message()]).unwrap());
+            }
+
             // Validate the password history if it contains `null` values and if so, return a warning
             if let Some(Value::Array(password_history)) = &cipher.password_history {
                 for pwh in password_history {
@@ -154,6 +177,10 @@ impl Cipher {
     ) -> Result<Value, crate::Error> {
         use crate::util::{format_date, validate_and_format_date};
 
+        // Parsed once, since `data` can be large and this runs for every cipher in a sync
+        let type_data = serde_json::from_str::<Value>(&self.data);
+        let is_blob_encrypted = type_data.as_ref().is_ok_and(is_blob_value);
+
         let mut attachments_json: Value = Value::Null;
         if let Some(cipher_sync_data) = cipher_sync_data {
             if let Some(attachments) = cipher_sync_data.cipher_attachments.get(&self.uuid)
@@ -250,63 +277,9 @@ impl Cipher {
             })
             .unwrap_or_default();
 
-        // Get the type_data or a default to an empty json object '{}'.
+        // Like upstream, fields and password history stored as NULL are sent as null, not `[]`
-        // If not passing an empty object, mobile clients will crash.
+        let fields_json = self.fields.is_some().then_some(fields_json);
-        let mut type_data_json = serde_json::from_str::<LowerCase<Value>>(&self.data)
+        let password_history_json = self.password_history.is_some().then_some(password_history_json);
-            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
-            .map_or_else(|_| Value::Object(serde_json::Map::new()), |d| d.data);
-
-        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
-        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
-        if self.atype == 1 {
-            // Upstream always has an `uri` key/value
-            type_data_json["uri"] = Value::Null;
-            if let Some(uris) = type_data_json["uris"].as_array_mut()
-                && !uris.is_empty()
-            {
-                // Fix uri match values first, they are only allowed to be a number or null
-                // If it is a string, convert it to an int or null if that fails
-                for uri in &mut *uris {
-                    if uri["match"].is_string() {
-                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
-                            Ok(n) => json!(n),
-                            _ => Value::Null,
-                        };
-                        uri["match"] = match_value;
-                    }
-                }
-                type_data_json["uri"] = uris[0]["uri"].clone();
-            }
-
-            // Check if `passwordRevisionDate` is a valid date, else convert it
-            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
-                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
-            }
-        }
-
-        // Fix secure note issues when data is invalid
-        // This breaks at least the native mobile clients
-        if self.atype == 2 {
-            match type_data_json {
-                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
-                _ => {
-                    type_data_json = json!({"type": 0});
-                }
-            }
-        }
-
-        // Fix invalid SSH Entries
-        // This breaks at least the native mobile client if invalid
-        // The only way to fix this is by setting type_data_json to `null`
-        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
-        if self.atype == 5
-            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
-                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
-                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
-        {
-            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
-            type_data_json = Value::Null;
-        }
 
         let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
             if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
@@ -403,10 +376,84 @@ impl Cipher {
             _ => err!(format!("Cipher {} has an invalid type {}", self.uuid, self.atype)),
         };
 
-        json_object[key] = type_data_json;
+        if is_blob_encrypted {
+            // Like upstream, sent as-is with the structured fields null
+            json_object["data"] = json!(self.data);
+            json_object["name"] = Value::Null;
+        } else {
+            json_object[key] = self.legacy_type_data_json(type_data);
+        }
         Ok(json_object)
     }
 
+    /// The per-type data of a legacy cipher, with fixups for values known to break clients.
+    fn legacy_type_data_json(&self, type_data: Result<Value, serde_json::Error>) -> Value {
+        use crate::util::validate_and_format_date;
+
+        // Get the type_data or a default to an empty json object '{}'.
+        // If not passing an empty object, mobile clients will crash.
+        let mut type_data_json = if let Ok(data @ Value::Object(_)) = type_data {
+            convert_json_key_lcase_first(data)
+        } else {
+            warn!("Error parsing data field for {}", self.uuid);
+            Value::Object(serde_json::Map::new())
+        };
+
+        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
+        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
+        if self.atype == 1 {
+            // Upstream always has an `uri` key/value
+            type_data_json["uri"] = Value::Null;
+            if let Some(uris) = type_data_json["uris"].as_array_mut()
+                && !uris.is_empty()
+            {
+                // Fix uri match values first, they are only allowed to be a number or null
+                // If it is a string, convert it to an int or null if that fails
+                for uri in &mut *uris {
+                    if uri["match"].is_string() {
+                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
+                            Ok(n) => json!(n),
+                            _ => Value::Null,
+                        };
+                        uri["match"] = match_value;
+                    }
+                }
+                type_data_json["uri"] = uris[0]["uri"].clone();
+            }
+
+            // Check if `passwordRevisionDate` is a valid date, else convert it
+            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
+                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
+            }
+        }
+
+        // Fix secure note issues when data is invalid
+        // This breaks at least the native mobile clients
+        if self.atype == 2 {
+            match type_data_json {
+                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
+                _ => {
+                    type_data_json = json!({"type": 0});
+                }
+            }
+        }
+
+        // Fix invalid SSH Entries
+        // This breaks at least the native mobile client if invalid
+        // The only way to fix this is by setting type_data_json to `null`
+        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
+        if self.atype == 5
+            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
+                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
+                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
+        {
+            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
+            type_data_json = Value::Null;
+        }
+
+        type_data_json
+    }
+
     pub async fn update_users_revision(&self, conn: &DbConn) -> Vec<UserId> {
         let mut user_uuids = Vec::new();
         match self.user_uuid {
@@ -872,7 +919,7 @@ impl Cipher {
 
                 if !visible_only {
                     query = query.or_filter(
-                        users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner
+                        users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner
                     );
                 }
 
@@ -907,7 +954,7 @@ impl Cipher {
 
                 if !visible_only {
                     query = query.or_filter(
-                        users_organizations::atype.le(MembershipType::Admin as i32), // Org admin/owner
+                        users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin/owner
                     );
                 }
 
@@ -1111,7 +1158,7 @@ impl Cipher {
                             .or(collections_groups::collections_uuid
                                 .is_not_null() // Access via groups
                                 .and(collections_groups::read_only.eq(false)))
-                            .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner
+                            .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), // User is admin or owner
                     )
                     .select(ciphers_collections::collection_uuid)
                     .load::<CollectionId>(conn)
@@ -1140,7 +1187,7 @@ impl Cipher {
                             .or(users_collections::user_uuid
                                 .eq(user_uuid) // User has access to collection
                                 .and(users_collections::read_only.eq(false)))
-                            .or(users_organizations::atype.le(MembershipType::Admin as i32)), // User is admin or owner
+                            .or(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)), // User is admin or owner
                     )
                     .select(ciphers_collections::collection_uuid)
                     .load::<CollectionId>(conn)
@@ -1182,7 +1229,7 @@ impl Cipher {
                 )
                 .or_filter(users_collections::user_uuid.eq(user_uuid)) // User has access to collection
                 .or_filter(users_organizations::access_all.eq(true)) // User has access all
-                .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
+                .or_filter(users_organizations::atype.eq_any(ORG_ADMIN_ATYPES)) // User is admin or owner
                 .or_filter(groups::access_all.eq(true)) //Access via group
                 .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group
                 .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))

src/db/models/collection.rs

@@ -18,7 +18,7 @@ use macros::UuidFromParam;
 
 use super::{
     CipherId, CollectionGroup, GroupUser, Membership, MembershipId, MembershipStatus, MembershipType, OrganizationId,
-    User, UserId,
+    User, UserId, organization::ORG_ADMIN_ATYPES,
 };
 
 // See (v2026.7.0): https://github.com/bitwarden/server/blob/5d4461aa42cadbacfef8fe2166c5453a5c52773a/src/Core/AdminConsole/Entities/Collection.cs
@@ -375,7 +375,7 @@ impl Collection {
                                 // Directly accessed collection
                                 users_organizations::access_all.eq(true).or(
                                     // access_all in Organization
-                                    users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
+                                    users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
                                 ),
                             )
                             .or(
@@ -412,7 +412,7 @@ impl Collection {
                         // Directly accessed collection
                         users_organizations::access_all.eq(true).or(
                             // access_all in Organization
-                            users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
+                            users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
                         ),
                     ))
                     .select(collections::all_columns)
@@ -455,7 +455,7 @@ impl Collection {
                     )
                     .filter(
                         users_organizations::atype
-                            .le(MembershipType::Admin as i32) // Org admin or owner
+                            .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner
                             .or(users_organizations::access_all.eq(true)) // access_all via membership
                             .or(users_collections::collection_uuid
                                 .eq(&self.uuid) // write access given to collection
@@ -489,7 +489,7 @@ impl Collection {
                     )
                     .filter(
                         users_organizations::atype
-                            .le(MembershipType::Admin as i32) // Org admin or owner
+                            .eq_any(ORG_ADMIN_ATYPES) // Org admin or owner
                             .or(users_organizations::access_all.eq(true)) // access_all via membership
                             .or(users_collections::collection_uuid
                                 .eq(&self.uuid) // write access given to collection
@@ -540,7 +540,7 @@ impl Collection {
                             // Directly accessed collection
                             users_organizations::access_all.eq(true).or(
                                 // access_all in Organization
-                                users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
+                                users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
                             ),
                         )
                         .or(
@@ -600,7 +600,7 @@ impl Collection {
                             // Directly accessed collection
                             users_organizations::access_all.eq(true).or(
                                 // access_all in Organization
-                                users_organizations::atype.le(MembershipType::Admin as i32), // Org admin or owner
+                                users_organizations::atype.eq_any(ORG_ADMIN_ATYPES), // Org admin or owner
                             ),
                         )
                         .or(

src/db/models/mod.rs

@@ -17,11 +17,12 @@ mod two_factor;
 mod two_factor_duo_context;
 mod two_factor_incomplete;
 mod user;
+mod user_signature_key_pair;
 
 pub use self::archive::Archive;
 pub use self::attachment::{Attachment, AttachmentId};
 pub use self::auth_request::{AuthRequest, AuthRequestId};
-pub use self::cipher::{Cipher, CipherId, RepromptType};
+pub use self::cipher::{Cipher, CipherId, RepromptType, is_data_blob_encrypted};
 pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
 pub use self::device::{Device, DeviceId, DeviceType, DeviceWithAuthRequest, PushId};
 pub use self::emergency_access::{
@@ -33,12 +34,13 @@ pub use self::folder::{Folder, FolderCipher, FolderId};
 pub use self::group::{CollectionGroup, Group, GroupId, GroupUser};
 pub use self::org_policy::{FillAssistPolicyData, OrgPolicy, OrgPolicyId, OrgPolicyType};
 pub use self::organization::{
-    Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization, OrganizationApiKey,
+    CustomPermission, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, Organization,
-    OrganizationId,
+    OrganizationApiKey, OrganizationId, custom_roles_enabled,
 };
 pub use self::send::{Send, SendFileId, SendId, SendType};
 pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType, UserStampException};
+pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType};
+pub use self::user_signature_key_pair::{SignatureAlgorithm, UserSignatureKeyPair};

src/db/models/organization.rs

@@ -1,4 +1,7 @@
-use std::cmp::Ordering;
+use std::{
+    cmp::Ordering,
+    collections::{HashMap, HashSet},
+};
 
 use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, Deref, Display, From};
@@ -21,8 +24,8 @@ use crate::{
 use macros::UuidFromParam;
 
 use super::{
-    Cipher, CipherId, Collection, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, OrgPolicyType,
+    Cipher, CipherId, Collection, CollectionGroup, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy,
-    TwoFactor, User, UserId,
+    OrgPolicyType, TwoFactor, User, UserId,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -41,6 +44,7 @@ pub struct Organization {
 #[diesel(table_name = users_organizations)]
 #[diesel(treat_none_as_null = true)]
 #[diesel(primary_key(uuid))]
+#[expect(clippy::struct_excessive_bools, reason = "Each Custom role permission is a column of its own")]
 pub struct Membership {
     pub uuid: MembershipId,
     pub user_uuid: UserId,
@@ -54,6 +58,20 @@ pub struct Membership {
     pub atype: i32,
     pub reset_password_key: Option<String>,
     pub external_id: Option<String>,
+
+    // The permissions of a Custom role, only accessed through `CustomPermission`.
+    manage_users: bool,
+    manage_groups: bool,
+    manage_policies: bool,
+    create_new_collections: bool,
+    edit_any_collection: bool,
+    delete_any_collection: bool,
+    access_event_logs: bool,
+    access_import_export: bool,
+    access_reports: bool,
+
+    /// The user's v2 upgrade token, for the org to unwrap the v2 user key after an upgrade. Opaque to us.
+    pub v2_upgrade_token: Option<String>,
 }
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -89,42 +107,68 @@ impl MembershipStatus {
     }
 }
 
-#[derive(Copy, Clone, PartialEq, Eq, num_derive::FromPrimitive)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, num_derive::FromPrimitive)]
 pub enum MembershipType {
     Owner = 0,
     Admin = 1,
     User = 2,
+    // The legacy Manager role. The Bitwarden clients no longer know it and are shown a Custom role instead.
     Manager = 3,
+    // Only granted while EXPERIMENTAL_CUSTOM_ROLES is enabled.
+    Custom = 4,
 }
 
 impl MembershipType {
     pub fn from_str(s: &str) -> Option<Self> {
-        #[expect(
-            clippy::match_same_arms,
-            reason = "Specifically define `4|Custom` since this is a hack, not a default"
-        )]
         match s {
             "0" | "Owner" => Some(MembershipType::Owner),
             "1" | "Admin" => Some(MembershipType::Admin),
             "2" | "User" => Some(MembershipType::User),
             "3" | "Manager" => Some(MembershipType::Manager),
-            // HACK: We convert the custom role to a manager role
+            "4" | "Custom" => Some(MembershipType::Custom),
-            "4" | "Custom" => Some(MembershipType::Manager),
             _ => None,
         }
     }
+
+    /// The role a member invite or edit from the Bitwarden clients asks for, given the member's current
+    /// role (`None` for an invite).
+    ///
+    /// The clients no longer know the legacy Manager role and are shown a Custom role in its place, so a
+    /// requested Custom role is the legacy Manager unless EXPERIMENTAL_CUSTOM_ROLES is enabled. An existing
+    /// Manager or Custom member keeps their role when the request repeats it, so an unrelated edit never
+    /// turns one into the other.
+    pub fn requested(
+        requested: MembershipType,
+        current: Option<&Membership>,
+        custom_roles_enabled: bool,
+    ) -> MembershipType {
+        if requested != MembershipType::Custom {
+            return requested;
+        }
+        match current {
+            Some(member) if member.has_type(MembershipType::Custom) => MembershipType::Custom,
+            Some(member) if member.has_type(MembershipType::Manager) => MembershipType::Manager,
+            _ if custom_roles_enabled => MembershipType::Custom,
+            _ => MembershipType::Manager,
+        }
+    }
+
+    /// The authority of a role, which is what roles are compared by. A Custom member gets its authority from
+    /// its permissions, never from its role, so the role itself ranks right above User and below Manager.
+    const fn rank(self) -> u8 {
+        match self {
+            MembershipType::User => 0,
+            MembershipType::Custom => 1,
+            MembershipType::Manager => 2,
+            MembershipType::Admin => 3,
+            MembershipType::Owner => 4,
+        }
+    }
 }
 
 impl Ord for MembershipType {
     fn cmp(&self, other: &MembershipType) -> Ordering {
-        // For easy comparison, map each variant to an access level (where 0 is lowest).
+        self.rank().cmp(&other.rank())
-        const ACCESS_LEVEL: [i32; 4] = [
-            3, // Owner
-            2, // Admin
-            0, // User
-            1, // Manager && Custom
-        ];
-        ACCESS_LEVEL[*self as usize].cmp(&ACCESS_LEVEL[*other as usize])
     }
 }
 
@@ -180,6 +224,91 @@ impl PartialOrd<MembershipType> for i32 {
     }
 }
 
+/// The granular permissions of the Custom role.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum CustomPermission {
+    ManageUsers,
+    ManageGroups,
+    ManagePolicies,
+    CreateNewCollections,
+    EditAnyCollection,
+    DeleteAnyCollection,
+    AccessEventLogs,
+    AccessImportExport,
+    AccessReports,
+}
+
+/// The permissions this version enforces on every endpoint they open. Only these can be granted, a stored
+/// grant of any other one grants nothing. They are implemented one at a time, so this grows with them.
+const SUPPORTED_CUSTOM_PERMISSIONS: &[CustomPermission] = &[];
+
+impl CustomPermission {
+    pub const ALL: [CustomPermission; 9] = [
+        CustomPermission::ManageUsers,
+        CustomPermission::ManageGroups,
+        CustomPermission::ManagePolicies,
+        CustomPermission::CreateNewCollections,
+        CustomPermission::EditAnyCollection,
+        CustomPermission::DeleteAnyCollection,
+        CustomPermission::AccessEventLogs,
+        CustomPermission::AccessImportExport,
+        CustomPermission::AccessReports,
+    ];
+
+    /// The key of the permission in the `permissions` object of the Bitwarden clients.
+    pub const fn json_key(self) -> &'static str {
+        match self {
+            CustomPermission::ManageUsers => "manageUsers",
+            CustomPermission::ManageGroups => "manageGroups",
+            CustomPermission::ManagePolicies => "managePolicies",
+            CustomPermission::CreateNewCollections => "createNewCollections",
+            CustomPermission::EditAnyCollection => "editAnyCollection",
+            CustomPermission::DeleteAnyCollection => "deleteAnyCollection",
+            CustomPermission::AccessEventLogs => "accessEventLogs",
+            CustomPermission::AccessImportExport => "accessImportExport",
+            CustomPermission::AccessReports => "accessReports",
+        }
+    }
+
+    pub fn is_supported(self) -> bool {
+        SUPPORTED_CUSTOM_PERMISSIONS.contains(&self)
+    }
+
+    /// The permissions a member invite or edit grants a Custom role.
+    ///
+    /// A permission is only granted when it is set to `true`, and anything but a boolean is rejected: this
+    /// replaces the member's permissions, so a malformed value must not silently remove one. Granting a
+    /// permission this version does not enforce is rejected as well. The clients also send permissions
+    /// Vaultwarden does not know at all, like `manageSso`, those are ignored.
+    pub fn requested(permissions: &HashMap<String, Value>) -> Result<HashSet<CustomPermission>, crate::Error> {
+        let mut granted = HashSet::new();
+        for permission in CustomPermission::ALL {
+            match permissions.get(permission.json_key()) {
+                None | Some(Value::Bool(false)) => {}
+                Some(Value::Bool(true)) if permission.is_supported() => {
+                    granted.insert(permission);
+                }
+                Some(Value::Bool(true)) => {
+                    err!(format!("The Custom role permission '{}' is not supported yet", permission.json_key()))
+                }
+                Some(_) => {
+                    err!(format!("The Custom role permission '{}' must be true or false", permission.json_key()))
+                }
+            }
+        }
+        Ok(granted)
+    }
+}
+
+/// The stored roles with authority over the whole organization. Queries match them by value, comparing
+/// `atype <= Admin` would also match any unknown value below it.
+pub(super) const ORG_ADMIN_ATYPES: [i32; 2] = [MembershipType::Owner as i32, MembershipType::Admin as i32];
+
+/// Whether the experimental Custom role is enabled. Nothing is ever granted through a Custom role otherwise.
+pub fn custom_roles_enabled() -> bool {
+    CONFIG.experimental_custom_roles()
+}
+
 /// Local methods
 impl Organization {
     pub fn new(name: String, billing_email: &str, private_key: Option<String>, public_key: Option<String>) -> Self {
@@ -271,9 +400,94 @@ impl Membership {
             atype: MembershipType::User as i32,
             reset_password_key: None,
             external_id: None,
+
+            manage_users: false,
+            manage_groups: false,
+            manage_policies: false,
+            create_new_collections: false,
+            edit_any_collection: false,
+            delete_any_collection: false,
+            access_event_logs: false,
+            access_import_export: false,
+            access_reports: false,
+
+            v2_upgrade_token: None,
         }
     }
 
+    fn custom_permission_mut(&mut self, permission: CustomPermission) -> &mut bool {
+        match permission {
+            CustomPermission::ManageUsers => &mut self.manage_users,
+            CustomPermission::ManageGroups => &mut self.manage_groups,
+            CustomPermission::ManagePolicies => &mut self.manage_policies,
+            CustomPermission::CreateNewCollections => &mut self.create_new_collections,
+            CustomPermission::EditAnyCollection => &mut self.edit_any_collection,
+            CustomPermission::DeleteAnyCollection => &mut self.delete_any_collection,
+            CustomPermission::AccessEventLogs => &mut self.access_event_logs,
+            CustomPermission::AccessImportExport => &mut self.access_import_export,
+            CustomPermission::AccessReports => &mut self.access_reports,
+        }
+    }
+
+    /// Change the role. Nothing the old role carried survives a role change: the Custom role permissions are
+    /// dropped, so changing the role back later starts from none. A Custom role never keeps the legacy
+    /// `access_all` flag, its reach only comes from its permissions.
+    pub fn set_type(&mut self, new_type: MembershipType) {
+        if self.atype != new_type as i32 {
+            for permission in CustomPermission::ALL {
+                *self.custom_permission_mut(permission) = false;
+            }
+        }
+        if new_type == MembershipType::Custom {
+            self.access_all = false;
+        }
+        self.atype = new_type as i32;
+    }
+
+    /// Grant this Custom member exactly `permissions` out of those this version enforces. A stored grant of a
+    /// permission this version does not enforce is kept as it is: it grants nothing here.
+    pub fn set_custom_permissions(&mut self, permissions: &HashSet<CustomPermission>) {
+        for permission in CustomPermission::ALL.into_iter().filter(|p| p.is_supported()) {
+            *self.custom_permission_mut(permission) = permissions.contains(&permission);
+        }
+    }
+
+    /// Why this legacy Manager can't become a Custom member without losing what they may do now, if they can't. A
+    /// conversion must not silently change their access, and a Custom role can't keep access to all collections
+    /// (which also puts every collection in the Manager's own vault), nor manage any collection yet.
+    pub async fn custom_role_conversion_loss(&self, conn: &DbConn) -> Option<&'static str> {
+        if !self.has_type(MembershipType::Manager) {
+            return None;
+        }
+        if self.access_all {
+            return Some(
+                "This Manager has access to all collections, which a Custom member can't have: the collections they \
+                 aren't assigned to would disappear from their vault. Uncheck Manage all collections for them first, \
+                 or keep the Manager role.",
+            );
+        }
+        // Whatever their status, the collections they manage directly, through a group or through a group with
+        // access to all collections
+        let mut manages = GroupUser::has_full_access_by_member(&self.org_uuid, &self.uuid, conn).await
+            || CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
+                .await
+                .iter()
+                .any(|assignment| assignment.manage);
+        for group_user in GroupUser::find_by_member(&self.uuid, conn).await {
+            if manages {
+                break;
+            }
+            manages = CollectionGroup::find_by_group(&group_user.groups_uuid, &self.org_uuid, conn)
+                .await
+                .iter()
+                .any(|assignment| assignment.manage);
+        }
+        manages.then_some(
+            "This Manager manages collections, with the manage permission or through a group with access to all \
+             collections, which a Custom member can't do yet. Remove that first, or keep the Manager role.",
+        )
+    }
+
     pub fn restore(&mut self) -> bool {
         if self.status < MembershipStatus::Invited as i32 {
             self.status += ACTIVATE_REVOKE_DIFF;
@@ -712,6 +926,12 @@ impl Membership {
     }
 
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
+        // The legacy `access_all` flag reaches every collection, which a Custom role may only do through its
+        // permissions, so it must never be stored on one. `set_type` takes care of this.
+        if self.has_type(MembershipType::Custom) && self.access_all {
+            err!("A Custom role membership can't have access to all collections")
+        }
+
         User::update_uuid_revision(&self.user_uuid, conn).await;
 
         db_run! { conn:
@@ -1228,13 +1448,93 @@ pub struct OrgApiKeyId(String);
 #[cfg(test)]
 mod tests {
     use super::*;
+    use MembershipType::{Admin, Custom, Manager, Owner, User};
+
+    fn member(role: MembershipType) -> Membership {
+        let mut member = Membership::new("user".into(), "org".into(), None);
+        member.atype = role as i32;
+        member.status = MembershipStatus::Confirmed as i32;
+        member
+    }
 
     #[test]
-    #[allow(non_snake_case)]
+    fn membership_type_authority() {
-    fn partial_cmp_MembershipType() {
+        assert!(Owner > Admin && Admin > Manager && Manager > Custom && Custom > User);
-        assert!(MembershipType::Owner > MembershipType::Admin);
+        assert!((Custom as i32) >= User && (Custom as i32) < Manager && (Custom as i32) < Admin);
-        assert!(MembershipType::Admin > MembershipType::Manager);
+        for raw in [99, -1] {
-        assert!(MembershipType::Manager > MembershipType::User);
+            assert_eq!((raw >= User, raw >= Manager, raw >= Admin, raw < Admin), (false, false, false, true));
-        assert!(MembershipType::Manager == MembershipType::from_str("4").unwrap());
+        }
+        for (value, expected) in [
+            ("3", Some(Manager)),
+            ("Manager", Some(Manager)),
+            ("4", Some(Custom)),
+            ("Custom", Some(Custom)),
+            ("5", None),
+        ] {
+            assert_eq!(MembershipType::from_str(value), expected);
+        }
+    }
+
+    #[test]
+    fn requested_membership_type() {
+        for (current, disabled, enabled) in [
+            (None, Manager, Custom),
+            (Some(User), Manager, Custom),
+            (Some(Manager), Manager, Manager),
+            (Some(Custom), Custom, Custom),
+        ] {
+            let current = current.map(member);
+            for (flag, expected) in [(false, disabled), (true, enabled)] {
+                assert_eq!(MembershipType::requested(Custom, current.as_ref(), flag), expected);
+            }
+        }
+        assert_eq!(MembershipType::requested(User, Some(&member(Custom)), true), User);
+        assert_eq!(MembershipType::requested(User, Some(&member(Manager)), true), User);
+        for requested in [Owner, Admin, Manager] {
+            assert_eq!(MembershipType::requested(requested, Some(&member(Custom)), true), requested);
+        }
+    }
+
+    #[test]
+    fn custom_permission_requests() {
+        let ignored = serde_json::from_value(json!({"manageUsers":false,"manageSso":true})).unwrap();
+        assert!(CustomPermission::requested(&ignored).unwrap().is_empty());
+        for permission in CustomPermission::ALL {
+            for value in [json!(true), json!(null), json!("true"), json!(1), json!([true])] {
+                let request = HashMap::from([(permission.json_key().to_owned(), value.clone())]);
+                let result = CustomPermission::requested(&request);
+                if value == json!(true) && SUPPORTED_CUSTOM_PERMISSIONS.contains(&permission) {
+                    assert_eq!(result.unwrap(), HashSet::from([permission]));
+                } else {
+                    assert!(result.is_err(), "{permission:?}: {value}");
+                }
+            }
+        }
+        assert_eq!(SUPPORTED_CUSTOM_PERMISSIONS, []);
+    }
+
+    #[test]
+    fn role_changes_drop_custom_permissions() {
+        for (from, to) in [
+            (Custom, Owner),
+            (Custom, Admin),
+            (Custom, Manager),
+            (Custom, User),
+            (User, Custom),
+            (Manager, Custom),
+            (Custom, Custom),
+            (Admin, User),
+        ] {
+            let mut member = member(from);
+            member.access_all = true;
+            for permission in CustomPermission::ALL {
+                *member.custom_permission_mut(permission) = true;
+            }
+            member.set_type(to);
+            for permission in CustomPermission::ALL {
+                assert_eq!(*member.custom_permission_mut(permission), from == to, "{from:?} -> {to:?}");
+            }
+            assert_eq!(member.access_all, to != Custom);
+        }
     }
 }

src/db/models/user.rs

@@ -6,6 +6,7 @@ use serde_json::Value;
 use crate::{
     CONFIG,
     api::EmptyResult,
+    auth::DEFAULT_ACCESS_VALIDITY,
     crypto,
     db::{
         DbConn,
@@ -20,7 +21,7 @@ use macros::UuidFromParam;
 
 use super::{
     AuthRequest, Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor,
-    TwoFactorIncomplete,
+    TwoFactorIncomplete, UserSignatureKeyPair,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
@@ -72,6 +73,13 @@ pub struct User {
     pub external_id: Option<String>, // Todo: Needs to be removed in the future, this is not used anymore.
 
     pub key_id: Option<KeyId>,
+
+    // The v2 state: all set, with a `user_signature_key_pairs` row, or none, see `User::is_v2`
+    pub signed_public_key: Option<String>,
+    pub security_state: Option<String>,
+    pub security_version: Option<i32>,
+    /// JSON `{"wrappedUserKey1", "wrappedUserKey2"}` for sessions that still hold the v1 user key. Opaque to us.
+    pub v2_upgrade_token: Option<String>,
 }
 
 #[derive(Identifiable, Queryable, Insertable)]
@@ -100,13 +108,28 @@ enum UserStatus {
     _Disabled = 2,
 }
 
+/// A previous security stamp that is still accepted, until `expire`.
 #[derive(Serialize, Deserialize)]
 pub struct UserStampException {
-    pub routes: Vec<String>,
+    /// The routes the stamp is still accepted on, or `None` for any route.
+    pub routes: Option<Vec<String>>,
     pub security_stamp: String,
     pub expire: i64,
 }
 
+impl UserStampException {
+    pub fn is_expired(&self) -> bool {
+        Utc::now().timestamp() > self.expire
+    }
+
+    /// Whether this exception lets a token carrying `security_stamp` through on `route`.
+    pub fn allows(&self, security_stamp: &str, route: &str) -> bool {
+        !self.is_expired()
+            && self.security_stamp == security_stamp
+            && self.routes.as_ref().is_none_or(|routes| routes.iter().any(|r| r == route))
+    }
+}
+
 /// Local methods
 impl User {
     pub const CLIENT_KDF_TYPE_DEFAULT: i32 = UserKdfType::Pbkdf2 as i32;
@@ -159,9 +182,31 @@ impl User {
             external_id: None, // Todo: Needs to be removed in the future, this is not used anymore.
 
             key_id: None,
+
+            signed_public_key: None,
+            security_state: None,
+            security_version: None,
+            v2_upgrade_token: None,
         }
     }
 
+    pub fn is_v2(&self) -> bool {
+        self.signed_public_key.is_some() && self.security_state.is_some() && self.security_version.is_some()
+    }
+
+    /// Upstream's `HasV2Encryption`: a private key wrapped as `CoseEncrypt0B64` (type 7) and security version 2.
+    /// Upstream only uses it to decide which accounts need a v2-capable client.
+    ///
+    /// Ref: <https://github.com/bitwarden/server/blob/8da186ad73f80d37157fe6fd42323e4284e83ec1/src/Core/Entities/User.cs#L245-L278>
+    pub fn has_v2_encryption(&self) -> bool {
+        self.security_version == Some(2)
+            && self
+                .private_key
+                .as_deref()
+                .and_then(|private_key| private_key.split_once('.'))
+                .is_some_and(|(enc_type, _)| enc_type.parse::<u8>() == Ok(7))
+    }
+
     pub fn check_valid_password(&self, password: &str) -> bool {
         crypto::verify_password_hash(
             password.as_bytes(),
@@ -171,6 +216,7 @@ impl User {
         )
     }
 
+    /// Upstream's `GetMasterPasswordSalt`: there is no separate salt, so the normalized email
     pub fn master_password_salt(&self) -> String {
         self.email.trim().to_lowercase()
     }
@@ -225,10 +271,33 @@ impl User {
 
     pub async fn reset_security_stamp(&mut self, conn: &DbConn) -> EmptyResult {
         self.security_stamp = get_uuid();
+        // Keeps the unexpired route exceptions, set for the stamp being replaced, and drops a rotation's grace
+        let mut exceptions = self.stamp_exceptions();
+        exceptions.retain(|e| e.routes.is_some() && !e.is_expired());
+        self.set_stamp_exceptions(&exceptions);
         Device::rotate_refresh_tokens_by_user(&self.uuid, conn).await?;
         Ok(())
     }
 
+    /// Resets the stamp but lets issued access tokens run out, as upstream only checks it on refresh.
+    pub async fn reset_security_stamp_after_key_rotation(&mut self, conn: &DbConn) -> EmptyResult {
+        let previous_stamp = self.security_stamp.clone();
+        let mut grace: Vec<UserStampException> =
+            self.stamp_exceptions().into_iter().filter(|e| e.routes.is_none() && !e.is_expired()).collect();
+
+        self.reset_security_stamp(conn).await?;
+
+        grace.push(UserStampException {
+            routes: None,
+            security_stamp: previous_stamp,
+            expire: (Utc::now() + *DEFAULT_ACCESS_VALIDITY).timestamp(),
+        });
+        let mut exceptions = self.stamp_exceptions();
+        exceptions.extend(grace);
+        self.set_stamp_exceptions(&exceptions);
+        Ok(())
+    }
+
     /// Set the stamp_exception to only allow a subsequent request matching a specific route using the current security-stamp.
     ///
     /// # Arguments
@@ -237,17 +306,30 @@ impl User {
     ///   After these 2 minutes this stamp will expire.
     ///
     pub fn set_stamp_exception(&mut self, route_exception: Vec<String>) {
-        let stamp_exception = UserStampException {
+        self.set_stamp_exceptions(&[UserStampException {
-            routes: route_exception,
+            routes: Some(route_exception),
             security_stamp: self.security_stamp.clone(),
             expire: (Utc::now() + TimeDelta::try_minutes(2).unwrap()).timestamp(),
-        };
+        }]);
-        self.stamp_exception = Some(serde_json::to_string(&stamp_exception).unwrap_or_default());
     }
 
-    /// Resets the stamp_exception to prevent re-use of the previous security-stamp
+    /// The previous security stamps that are still accepted, expired ones included.
-    pub fn reset_stamp_exception(&mut self) {
+    pub fn stamp_exceptions(&self) -> Vec<UserStampException> {
-        self.stamp_exception = None;
+        let Some(stored) = self.stamp_exception.as_deref() else {
+            return Vec::new();
+        };
+        // Before key rotations kept sessions alive, only a single route exception was stored.
+        serde_json::from_str::<Vec<UserStampException>>(stored)
+            .or_else(|_| serde_json::from_str::<UserStampException>(stored).map(|e| vec![e]))
+            .unwrap_or_default()
+    }
+
+    fn set_stamp_exceptions(&mut self, exceptions: &[UserStampException]) {
+        self.stamp_exception = if exceptions.is_empty() {
+            None
+        } else {
+            Some(serde_json::to_string(&exceptions).unwrap_or_default())
+        };
     }
 
     pub fn display_name(&self) -> &str {
@@ -266,18 +348,37 @@ impl User {
         !CONFIG.mail_enabled() || self.verified_at.is_some()
     }
 
+    async fn v2_signature_key_pair(&self, conn: &DbConn) -> Option<UserSignatureKeyPair> {
+        if !self.is_v2() {
+            return None;
+        }
+        UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
+    }
+
     /// The `accountKeys` object (upstream's `PrivateKeysResponseModel`), null without a key pair
-    pub fn account_keys_json(&self) -> Value {
+    pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
         if self.private_key.is_some() {
+            let (signed_public_key, signature_key_pair, security_state) = match self.v2_signature_key_pair(conn).await {
+                Some(key_pair) => (
+                    json!(self.signed_public_key),
+                    key_pair.to_json(),
+                    json!({
+                        "securityState": self.security_state,
+                        "securityVersion": self.security_version,
+                    }),
+                ),
+                None => (Value::Null, Value::Null, Value::Null),
+            };
+
             json!({
                 "publicKeyEncryptionKeyPair": {
                     "wrappedPrivateKey": self.private_key,
                     "publicKey": self.public_key,
-                    "signedPublicKey": null,
+                    "signedPublicKey": signed_public_key,
                     "object": "publicKeyEncryptionKeyPair",
                 },
-                "securityState": null,
+                "securityState": security_state,
-                "signatureKeyPair": null,
+                "signatureKeyPair": signature_key_pair,
                 "object": "privateKeys"
             })
         } else {
@@ -285,6 +386,24 @@ impl User {
         }
     }
 
+    pub async fn public_keys_json(&self, conn: &DbConn) -> Value {
+        let (signed_public_key, verifying_key) = match self.v2_signature_key_pair(conn).await {
+            Some(key_pair) => (json!(self.signed_public_key), json!(key_pair.verifying_key)),
+            None => (Value::Null, Value::Null),
+        };
+
+        json!({
+            "publicKey": self.public_key,
+            "signedPublicKey": signed_public_key,
+            "verifyingKey": verifying_key,
+            "object": "publicKeys"
+        })
+    }
+
+    pub fn v2_upgrade_token_json(&self) -> Option<Value> {
+        self.v2_upgrade_token.as_ref().and_then(|token| serde_json::from_str(token).ok())
+    }
+
     pub async fn to_json(&self, conn: &DbConn) -> Value {
         let mut orgs_json = Vec::new();
         for c in Membership::find_confirmed_by_user(&self.uuid, conn).await {
@@ -305,7 +424,7 @@ impl User {
             UserStatus::Enabled
         };
 
-        let account_keys = self.account_keys_json();
+        let account_keys = self.account_keys_json(conn).await;
 
         json!({
             "_status": status as i32,
@@ -382,6 +501,7 @@ impl User {
         Device::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactor::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactorIncomplete::delete_all_by_user(&self.uuid, conn).await?;
+        UserSignatureKeyPair::delete_all_by_user(&self.uuid, conn).await?;
         Invitation::take(&self.email, conn).await; // Delete invitation if any
 
         conn.run(move |conn| {
@@ -553,25 +673,26 @@ impl Invitation {
 pub struct UserId(String);
 
 #[derive(
-    Clone,
+    Clone, Debug, DieselNewType, FromForm, PartialEq, Eq, Hash, Serialize, AsRef, Deref, Display, From, UuidFromParam,
-    Debug,
-    DieselNewType,
-    FromForm,
-    PartialEq,
-    Eq,
-    Hash,
-    Serialize,
-    Deserialize,
-    AsRef,
-    Deref,
-    Display,
-    From,
-    UuidFromParam,
 )]
 #[deref(forward)]
 #[from(forward)]
 pub struct KeyId(String);
 
+/// Like upstream, a key id is 32 lowercase hex characters. Key ids are compared as strings, so one in any other
+/// format would never match the id the clients send.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/8da186ad73f80d37157fe6fd42323e4284e83ec1/src/Core/KeyManagement/Models/Data/KeyId.cs#L20-L42>
+impl<'de> serde::Deserialize<'de> for KeyId {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let key_id = String::deserialize(deserializer)?;
+        if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
+            return Err(serde::de::Error::custom("Key id must be 32 lowercase hex characters"));
+        }
+        Ok(Self(key_id))
+    }
+}
+
 impl SsoUser {
     pub async fn save(&self, conn: &DbConn) -> EmptyResult {
         db_run! { conn:
@@ -625,3 +746,39 @@ impl SsoUser {
         .await
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_key_id_format() {
+        let key_id: KeyId = serde_json::from_str(r#""0123456789abcdef0123456789abcdef""#).unwrap();
+        assert_eq!(key_id.as_ref(), "0123456789abcdef0123456789abcdef");
+
+        for invalid in ["", "0123456789ABCDEF0123456789ABCDEF", "0123456789abcdef", "0123456789abcdef0123456789abcdeg"]
+        {
+            assert!(serde_json::from_str::<KeyId>(&format!("\"{invalid}\"")).is_err(), "{invalid:?}");
+        }
+
+        // An absent key id stays optional
+        assert_eq!(serde_json::from_str::<Option<KeyId>>("null").unwrap(), None);
+    }
+
+    #[test]
+    fn test_has_v2_encryption() {
+        let user = |private_key: Option<&str>, security_version: Option<i32>| {
+            let mut user = User::new("user@example.com", None);
+            user.private_key = private_key.map(String::from);
+            user.security_version = security_version;
+            user
+        };
+
+        assert!(user(Some("7.cose"), Some(2)).has_v2_encryption());
+        assert!(!user(Some("7.cose"), Some(1)).has_v2_encryption());
+        assert!(!user(Some("7.cose"), None).has_v2_encryption());
+        assert!(!user(Some("2.iv|data|mac"), Some(2)).has_v2_encryption());
+        assert!(!user(Some("7"), Some(2)).has_v2_encryption());
+        assert!(!user(None, Some(2)).has_v2_encryption());
+    }
+}

src/db/models/user_signature_key_pair.rs

@@ -0,0 +1,132 @@
+use chrono::{NaiveDateTime, Utc};
+use derive_more::{AsRef, Deref, Display, From};
+use diesel::prelude::*;
+use serde_json::Value;
+
+use crate::{
+    api::EmptyResult,
+    db::{DbConn, schema::user_signature_key_pairs},
+    error::MapResult,
+    util::get_uuid,
+};
+
+use super::UserId;
+
+/// A user's signature key pair, part of the v2 state, in its own table like upstream.
+///
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Sql/dbo/KeyManagement/Tables/UserSignatureKeyPair.sql#L1-L15>
+#[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
+#[diesel(table_name = user_signature_key_pairs)]
+#[diesel(treat_none_as_null = true)]
+#[diesel(primary_key(uuid))]
+pub struct UserSignatureKeyPair {
+    pub uuid: UserSignatureKeyPairId,
+    pub user_uuid: UserId,
+
+    pub signature_algorithm: i32,
+    /// The signing (private) key, wrapped by the user key.
+    pub signing_key: String,
+    /// The COSE-encoded public verifying key.
+    pub verifying_key: String,
+
+    pub created_at: NaiveDateTime,
+    pub updated_at: NaiveDateTime,
+}
+
+/// Ref: <https://github.com/bitwarden/server/blob/9030c42bf7d8f9ac2ff9fee85c39588d5eb81499/src/Core/KeyManagement/Enums/SignatureAlgorithm.cs#L6-L10>
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SignatureAlgorithm {
+    Ed25519 = 0,
+    MlDsa44 = 1,
+}
+
+impl SignatureAlgorithm {
+    pub fn parse(algorithm: &str) -> Option<Self> {
+        match algorithm {
+            "ed25519" => Some(Self::Ed25519),
+            "mldsa44" => Some(Self::MlDsa44),
+            _ => None,
+        }
+    }
+}
+
+/// Local methods
+impl UserSignatureKeyPair {
+    pub fn new(
+        user_uuid: UserId,
+        signature_algorithm: SignatureAlgorithm,
+        signing_key: String,
+        verifying_key: String,
+    ) -> Self {
+        let now = Utc::now().naive_utc();
+
+        Self {
+            uuid: UserSignatureKeyPairId(get_uuid()),
+            user_uuid,
+            signature_algorithm: signature_algorithm as i32,
+            signing_key,
+            verifying_key,
+            created_at: now,
+            updated_at: now,
+        }
+    }
+
+    pub fn to_json(&self) -> Value {
+        json!({
+            "wrappedSigningKey": self.signing_key,
+            "verifyingKey": self.verifying_key,
+            "object": "signatureKeyPair",
+        })
+    }
+}
+
+/// Database methods
+impl UserSignatureKeyPair {
+    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
+        self.updated_at = Utc::now().naive_utc();
+
+        db_run! { conn:
+            mysql {
+                diesel::insert_into(user_signature_key_pairs::table)
+                    .values(&*self)
+                    .on_conflict(diesel::dsl::DuplicatedKeys)
+                    .do_update()
+                    .set(&*self)
+                    .execute(conn)
+                    .map_res("Error saving user signature key pair")
+            }
+            postgresql, sqlite {
+                diesel::insert_into(user_signature_key_pairs::table)
+                    .values(&*self)
+                    .on_conflict(user_signature_key_pairs::user_uuid)
+                    .do_update()
+                    .set(&*self)
+                    .execute(conn)
+                    .map_res("Error saving user signature key pair")
+            }
+        }
+    }
+
+    /// The user's key pair. There is at most one, enforced by a unique index on `user_uuid`.
+    pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<Self> {
+        conn.run(move |conn| {
+            user_signature_key_pairs::table
+                .filter(user_signature_key_pairs::user_uuid.eq(user_uuid))
+                .first::<Self>(conn)
+                .ok()
+        })
+        .await
+    }
+
+    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
+        conn.run(move |conn| {
+            diesel::delete(user_signature_key_pairs::table.filter(user_signature_key_pairs::user_uuid.eq(user_uuid)))
+                .execute(conn)
+                .map_res("Error deleting user signature key pairs")
+        })
+        .await
+    }
+}
+
+#[derive(Clone, Debug, AsRef, Deref, DieselNewType, Display, From, Hash, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UserSignatureKeyPairId(String);

src/db/schema.rs

@@ -219,6 +219,22 @@ table! {
         avatar_color -> Nullable<Text>,
         external_id -> Nullable<Text>,
         key_id -> Nullable<Text>,
+        signed_public_key -> Nullable<Text>,
+        security_state -> Nullable<Text>,
+        security_version -> Nullable<Integer>,
+        v2_upgrade_token -> Nullable<Text>,
+    }
+}
+
+table! {
+    user_signature_key_pairs (uuid) {
+        uuid -> Text,
+        user_uuid -> Text,
+        signature_algorithm -> Integer,
+        signing_key -> Text,
+        verifying_key -> Text,
+        created_at -> Timestamp,
+        updated_at -> Timestamp,
     }
 }
 
@@ -244,6 +260,16 @@ table! {
         atype -> Integer,
         reset_password_key -> Nullable<Text>,
         external_id -> Nullable<Text>,
+        manage_users -> Bool,
+        manage_groups -> Bool,
+        manage_policies -> Bool,
+        create_new_collections -> Bool,
+        edit_any_collection -> Bool,
+        delete_any_collection -> Bool,
+        access_event_logs -> Bool,
+        access_import_export -> Bool,
+        access_reports -> Bool,
+        v2_upgrade_token -> Nullable<Text>,
     }
 }
 
@@ -384,6 +410,7 @@ joinable!(collections_groups -> groups (groups_uuid));
 joinable!(event -> users_organizations (uuid));
 joinable!(auth_requests -> users (user_uuid));
 joinable!(sso_users -> users (user_uuid));
+joinable!(user_signature_key_pairs -> users (user_uuid));
 
 allow_tables_to_appear_in_same_query!(
     archives,
@@ -410,4 +437,5 @@ allow_tables_to_appear_in_same_query!(
     collections_groups,
     event,
     auth_requests,
+    user_signature_key_pairs,
 );

src/static/scripts/admin_users.js

@@ -173,10 +173,14 @@ const ORG_TYPES = {
         "name": "User",
         "bg": "blue"
     },
-    "4": {
+    "3": {
         "name": "Manager",
         "bg": "green"
     },
+    "4": {
+        "name": "Custom",
+        "bg": "teal"
+    },
 };
 
 const userOrgTypeDialog = document.getElementById("userOrgTypeDialog");
@@ -187,15 +191,19 @@ userOrgTypeDialog.addEventListener("show.bs.modal", function (event) {
     const userUuid = event.relatedTarget.parentNode.dataset.vwUserUuid;
     // Get org specific values
     const userOrgType = event.relatedTarget.dataset.vwOrgType;
-    const userOrgTypeName = ORG_TYPES[userOrgType]["name"];
     const orgName = event.relatedTarget.dataset.vwOrgName;
     const orgUuid = event.relatedTarget.dataset.vwOrgUuid;
 
+    document.getElementById("userOrgTypeForm").reset();
     document.getElementById("userOrgTypeDialogOrgName").textContent = orgName;
     document.getElementById("userOrgTypeDialogUserEmail").textContent = userEmail;
     document.getElementById("userOrgTypeUserUuid").value = userUuid;
     document.getElementById("userOrgTypeOrgUuid").value = orgUuid;
-    document.getElementById(`userOrgType${userOrgTypeName}`).checked = true;
+    // The Custom role can only be selected while it is enabled
+    const userOrgTypeRadio = document.getElementById(`userOrgType${ORG_TYPES[userOrgType]?.name}`);
+    if (userOrgTypeRadio) {
+        userOrgTypeRadio.checked = true;
+    }
 }, false);
 
 // Prevent accidental submission of the form with valid elements after the modal has been hidden.
@@ -222,7 +230,7 @@ function updateUserOrgType(event) {
 function initUserTable() {
     // Color all the org buttons per type
     document.querySelectorAll("button[data-vw-org-type]").forEach(function (e) {
-        const orgType = ORG_TYPES[e.dataset.vwOrgType];
+        const orgType = ORG_TYPES[e.dataset.vwOrgType] ?? { "name": "Unknown", "bg": "gray" };
         e.style.backgroundColor = orgType.bg;
         if (orgType.font !== undefined) {
             e.style.color = orgType.font;

src/static/templates/admin/users.hbs

@@ -135,6 +135,11 @@
                         <div class="radio">
                             <label><input type="radio" value="3" class="form-radio-input" name="user_type" id="userOrgTypeManager">&nbsp;Manager</label>
                         </div>
+                        {{#if custom_roles_enabled}}
+                        <div class="radio">
+                            <label><input type="radio" value="4" class="form-radio-input" name="user_type" id="userOrgTypeCustom">&nbsp;Custom</label>
+                        </div>
+                        {{/if}}
                         <div class="radio">
                             <label><input type="radio" value="1" class="form-radio-input" name="user_type" id="userOrgTypeAdmin">&nbsp;Admin</label>
                         </div>

src/static/templates/scss/vaultwarden.scss.hbs

@@ -98,10 +98,17 @@ app-security > app-two-factor-setup > form {
 }
 
 /* Hide unsupported Custom Role options */
+{{#if custom_roles_enabled}}
 :is(bit-dialog, [bit-dialog]) div.tw-ml-4:has(bit-form-control input),
 :is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) {
   @extend %vw-hide;
 }
+{{else}}
+:is(bit-dialog, [bit-dialog]) div.tw-ml-4:has(bit-form-control input),
+:is(bit-dialog, [bit-dialog]) div.tw-col-span-4:has(input[formcontrolname*="access"], input[formcontrolname*="manage"]) {
+  @extend %vw-hide;
+}
+{{/if}}
 
 /* Change collapsed menu icon to Vaultwarden */
 bit-nav-logo bit-nav-item a:before {

src/util.rs

@@ -302,6 +302,20 @@ impl<'r, R: 'r + Responder<'r, 'static> + Send> Responder<'r, 'static> for EtagC
 // Effectively ignores, any static file route, and the alive endpoint
 const LOGGED_ROUTES: [&str; 7] = ["/api", "/admin", "/identity", "/icons", "/attachments", "/events", "/notifications"];
 
+const MAX_LOGGED_QUERY_BYTES: usize = 100;
+
+// Query values can hold secrets, like the access code of a login request, so we don't log them
+fn redact_query_values(query: &str) -> String {
+    query
+        .split('&')
+        .map(|param| match param.split_once('=') {
+            Some((name, _)) => format!("{name}=…"),
+            None => param.to_owned(),
+        })
+        .collect::<Vec<_>>()
+        .join("&")
+}
+
 // When extra is true, we ignore the whitelist above and also print the mounts
 pub struct BetterLogging {
     extra: bool,
@@ -381,8 +395,9 @@ impl Fairing for BetterLogging {
         };
         match uri.query() {
             Some(q) => {
-                let q = q.as_str();
+                let query = redact_query_values(q.as_str());
-                info!(target: "request", "{method} {}?{}", path.escape_debug(), q[..q.floor_char_boundary(30)].escape_debug());
+                let query = &query[..query.floor_char_boundary(MAX_LOGGED_QUERY_BYTES)];
+                info!(target: "request", "{method} {}?{}", path.escape_debug(), query.escape_debug());
             }
             None => info!(target: "request", "{method} {}", path.escape_debug()),
         }
@@ -884,6 +899,12 @@ pub fn parse_experimental_client_feature_flags(
         .collect()
 }
 
+/// Whether the admin enabled this supported client feature flag
+pub fn is_client_feature_flag_enabled(flag: &str) -> bool {
+    parse_experimental_client_feature_flags(&CONFIG.experimental_client_feature_flags(), &FeatureFlagFilter::ValidOnly)
+        .contains_key(flag)
+}
+
 /// TODO: This is extracted from IpAddr::is_global, which is unstable:
 /// https://doc.rust-lang.org/nightly/std/net/enum.IpAddr.html#method.is_global
 /// Remove once https://github.com/rust-lang/rust/issues/27709 is merged
@@ -1027,3 +1048,28 @@ mod tests {
         });
     }
 }
+
+#[cfg(test)]
+mod query_log_tests {
+    use super::{MAX_LOGGED_QUERY_BYTES, redact_query_values};
+
+    #[test]
+    fn test_redact_query_values() {
+        assert_eq!(redact_query_values("code=SECRET"), "code=…");
+        assert_eq!(redact_query_values("code=SECRET&other=SECRET"), "code=…&other=…");
+        assert_eq!(redact_query_values("a=1&b=2&flag"), "a=…&b=…&flag");
+        assert_eq!(redact_query_values("a=b=SECRET"), "a=…");
+        assert_eq!(redact_query_values("a=1&&=SECRET"), "a=…&&=…");
+        assert_eq!(redact_query_values("a=x%26b%3DSECRET"), "a=…");
+        assert_eq!(redact_query_values("a=1;b=SECRET"), "a=…");
+        assert_eq!(redact_query_values("a=1&a=SECRET"), "a=…&a=…");
+        assert_eq!(redact_query_values(""), "");
+    }
+
+    #[test]
+    fn test_redacted_query_truncates_on_a_char_boundary() {
+        let name = "a".repeat(MAX_LOGGED_QUERY_BYTES - 1);
+        let query = redact_query_values(&format!("{name}=SECRET"));
+        assert_eq!(&query[..query.floor_char_boundary(MAX_LOGGED_QUERY_BYTES)], format!("{name}="));
+    }
+}