Fix get_groups_data when not using full_access

Fix get_groups_data
Trusted proxies, unauthenticated rate limits and various fixes
2026-11-08 04:48:37 +02:00 · 2026-07-24 16:20:34 +02:00 · 2026-07-24 15:47:51 +02:00 · 2026-07-20 01:24:46 +02:00
161 changed files with 26041 additions and 21462 deletions
@@ -1,7 +1,7 @@
-# Ignore everything
+// Ignore everything
 *
-# Allow what is needed
+// Allow what is needed
 !.git
 !docker/healthcheck.sh
 !docker/start.sh
@@ -78,7 +78,7 @@
 # DB_CONNECTION_RETRIES=15
 ## Database timeout
-## Timeout in seconds when acquiring database connection
+## Timeout when acquiring database connection
 # DATABASE_TIMEOUT=30
 ## Database idle timeout
@@ -173,14 +173,14 @@
 ## Defaults to daily. Set blank to disable this job. Also without EVENTS_DAYS_RETAIN set, this job will not start.
 # EVENT_CLEANUP_SCHEDULE="0 10 0 * * *"
 ## Number of days to retain events stored in the database.
-## If unset (the default) or 0, events are kept indefinitely and the scheduled job is disabled!
+## If unset (the default), events are kept indefinitely and the scheduled job is disabled!
 # EVENTS_DAYS_RETAIN=
 ##
 ## Cron schedule of the job that cleans old auth requests from the auth request.
 ## Defaults to every minute. Set blank to disable this job.
 # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
 ##
-## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
+## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
 ## Defaults to every minute. Set blank to disable this job.
 # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
 #
@@ -233,7 +233,7 @@
 # USER_SEND_LIMIT=
 ## Number of days to wait before auto-deleting a trashed item.
-## If unset (the default) or 0, trashed items are not auto-deleted.
+## If unset (the default), trashed items are not auto-deleted.
 ## This setting applies globally, so make sure to inform all users of any changes to this setting.
 # TRASH_AUTO_DELETE_DAYS=
@@ -316,14 +316,6 @@
 ## unauthenticated access to potentially sensitive data.
 # SHOW_PASSWORD_HINT=false
 #########################
 ### Client settings  ###
 #########################
 ## Control whether clients onboarding interstitials are suppressed
 ## (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals)
 # CLIENT_SUPPRESS_ONBOARDING=false
 #########################
 ### Advanced settings ###
 #########################
@@ -338,8 +330,6 @@
 ## "local" accepts it from any non global address, which covers a reverse proxy running on the same
 ## host or container network. Use "all" to accept it from anywhere, or list the addresses of your
 ## proxy as IPs and CIDR ranges if it connects from a public address.
 ## For a list header like X-Forwarded-For, the client IP is the rightmost address that isn't one of
 ## these proxies, so with several proxies in a row (a CDN in front of nginx, for example) list all of them.
 # IP_HEADER_TRUSTED_PROXIES=local
 ## Icon service
@@ -386,31 +376,27 @@
 # HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS=true
 ## Client Settings
 ## Server-wide Fill Assist rules feed base directory URL, not a JSON file.
 ## Defaults to https://fillassist.bitwarden.com.
 ## Must be a valid HTTPS URL without credentials, query parameters, fragments, or surrounding whitespace.
 # FILL_ASSIST_RULES_URL=https://fillassist.bitwarden.com
 ## Enable experimental feature flags for clients.
 ## This is a comma-separated list of flags, e.g. "flag1,flag2,flag3".
 ## Note that clients cache the /api/config endpoint for about 1 hour and it could take some time before they are enabled or disabled!
 ##
 ## The following flags are available:
 ## - "fill-assist-targeting-rules": Enable Fill Assist targeting rules in the browser extension. (Browser >= 2026.6.0)
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
-## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
+## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
-## - "windows-desktop-autotype": Enable the autotype feature preview on Windows. (Desktop >= 2025.8.0)
+## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
-## - "windows-desktop-autotype-ga": Enable the new, still in development, autotype implementation on Windows. (Desktop >= 2026.9.1)
+## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
-##   Only enable one of the two autotype flags, the clients disable autotype completely when both are enabled.
+## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0)
-## - "pm-30529-webauthn-related-origins": Allow passkeys stored in the vault to be used on related origins listed in a site's /.well-known/webauthn file (Browser >= 2026.2.0)
+## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
-## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
+## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
-## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
+## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
-## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
+## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
-## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
+## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
-## - "biometrics-sdk-ipc": Enable biometric unlock over the SDK IPC framework (Desktop >= 2026.9.0, Browser >= 2026.9.0)
+## - "pm-30529-webauthn-related-origins":
-## - "windows-native-credential-sync": Register the desktop app as a passkey provider in Windows, so passkeys in the vault can be used by other apps and browsers.
+## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-##   Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet.
+## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -471,7 +457,7 @@
 ## Allowed connect-src (Know the risks!)
 ## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
-## Allows other domains for URLs which can be loaded using script interfaces like the Forwarded email alias feature
+## Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature
 ## This adds the configured value to the 'Content-Security-Policy' headers 'connect-src' value.
 ## Multiple values must be separated with a whitespace. And only HTTPS values are allowed.
 ## Example: "https://my-addy-io.domain.tld https://my-simplelogin.domain.tld"
@@ -497,15 +483,6 @@
 ## KNOW WHAT YOU ARE DOING!
 # ORG_GROUPS_ENABLED=false
 ## EXPERIMENTAL FEATURE: Custom roles
 ## Enables the Custom member role with granular permissions for organizations.
 ## This is still being developed: only the permissions this version enforces can be granted.
 ## This is enforced by the server and is unrelated to EXPERIMENTAL_CLIENT_FEATURE_FLAGS.
 ## Disabling it again keeps the stored Custom roles and permissions, but they grant nothing until it is re-enabled.
 ## Disabled by default because this is an experimental feature!
 ## KNOW WHAT YOU ARE DOING!
 # EXPERIMENTAL_CUSTOM_ROLES=false
 ## Increase secure note size limit (Know the risks!)
 ## Sets the secure note size limit to 100_000 instead of the default 10_000.
 ## WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers!
@@ -533,9 +510,6 @@
 ## Prevent users from logging in directly without going through SSO
 # SSO_ONLY=false
 ## Allow SSO flow to create account. You probably want to disable it when using a public provider.
 # SSO_SIGNUPS_ALLOWED=true
 ## On SSO Signup if a user with a matching email already exists make the association
 # SSO_SIGNUPS_MATCH_EMAIL=true
@@ -598,6 +572,11 @@
 # DUO_HOST=<API Hostname>
 ## After that, you should be able to follow the rest of the guide linked above,
 ## ignoring the fields that ask for the values that you already configured beforehand.
 ##
 ## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'.
 ## Duo no longer supports this, but it still works for some integrations.
 ## If you aren't sure, leave this alone.
 # DUO_USE_IFRAME=false
 ## Email 2FA settings
 ## Email token size
@@ -623,9 +602,6 @@
 ## Note that the checkbox would still be present, but ignored.
 # DISABLE_2FA_REMEMBER=false
 ##
 ## Number of days before a remembered 2FA login expires (min: 1, max: 90).
 # TWO_FACTOR_REMEMBER_DAYS=30
 ##
 ## Authenticator Settings
 ## Disable authenticator time drifted codes to be valid.
 ## TOTP codes of the previous and next 30 seconds will be invalid
@@ -634,7 +610,7 @@
 ## we allow by default the TOTP code which was valid one step back and one in the future.
 ## This can however allow attackers to be a bit more lucky with their attempts because there are 3 valid codes.
 ## You can disable this, so that only the current TOTP Code is allowed.
-## Keep in mind that when a server drifts out of time, valid codes could be marked as invalid.
+## Keep in mind that when a sever drifts out of time, valid codes could be marked as invalid.
 ## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid.
 # AUTHENTICATOR_DISABLE_TIME_DRIFT=false
@@ -62,7 +62,7 @@ jobs:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -113,7 +113,7 @@ jobs:
      # Enable Rust Caching
      - name: Rust Caching
-        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          # Use a custom prefix-key to force a fresh start. This is sometimes needed with bigger changes.
          # Like changing the build host from Ubuntu 20.04 to 22.04 for example.
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Checkout the repo
      - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      # End Checkout the repo
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -32,7 +32,7 @@ jobs:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      # End Checkout the repo
@@ -41,12 +41,12 @@ jobs:
      # Uses the Docker-based action (hadolint pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian)
      # so no binary is downloaded at runtime. Pinned by commit SHA for supply-chain safety.
      - name: Run hadolint on Dockerfile.debian
-        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: docker/Dockerfile.debian
      - name: Run hadolint on Dockerfile.alpine
-        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: docker/Dockerfile.alpine
      # End Test Dockerfiles with hadolint
@@ -58,13 +58,13 @@ jobs:
    steps:
      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: "arm64,arm"
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -77,7 +77,7 @@ jobs:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        # We need fetch-depth of 0 so we also get all the tag metadata
        with:
          persist-credentials: false
@@ -106,7 +106,7 @@ jobs:
      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -121,7 +121,7 @@ jobs:
      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -137,7 +137,7 @@ jobs:
      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -185,7 +185,7 @@ jobs:
      - name: Bake ${{ matrix.base_image }} containers
        id: bake_vw
-        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        env:
          BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -222,7 +222,7 @@ jobs:
          touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
      - name: Upload digest
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
          path: ${{ runner.temp }}/digests/*
@@ -237,12 +237,12 @@ jobs:
      # Upload artifacts to Github Actions and Attest the binaries
      - name: Attest binaries
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-path: vaultwarden-${{ env.NORMALIZED_ARCH }}
      - name: Upload binaries as artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-${{ env.NORMALIZED_ARCH }}-${{ matrix.base_image }}
          path: vaultwarden-${{ env.NORMALIZED_ARCH }}
@@ -264,7 +264,7 @@ jobs:
    steps:
      - name: Download digests
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*-${{ matrix.base_image }}
@@ -272,7 +272,7 @@ jobs:
      # Login to Docker Hub
      - name: Login to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -287,7 +287,7 @@ jobs:
      # Login to GitHub Container Registry
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -303,7 +303,7 @@ jobs:
      # Login to Quay.io
      - name: Login to Quay.io
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
@@ -365,7 +365,7 @@ jobs:
      # Attest container images
      - name: Attest - docker.io - ${{ matrix.base_image }}
        if: ${{ vars.DOCKERHUB_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-name: ${{ vars.DOCKERHUB_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -373,7 +373,7 @@ jobs:
      - name: Attest - ghcr.io - ${{ matrix.base_image }}
        if: ${{ vars.GHCR_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-name: ${{ vars.GHCR_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -381,7 +381,7 @@ jobs:
      - name: Attest - quay.io - ${{ matrix.base_image }}
        if: ${{ vars.QUAY_REPO != '' && env.DIGEST_SHA != ''}}
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
        with:
          subject-name: ${{ vars.QUAY_REPO }}
          subject-digest: ${{ env.DIGEST_SHA }}
@@ -33,7 +33,7 @@ jobs:
    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
@@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH
      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          sarif_file: 'trivy-results.sarif'
@@ -16,11 +16,11 @@ jobs:
    steps:
      # Checkout the repo
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      # End Checkout the repo
      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
@@ -19,12 +19,12 @@ jobs:
      security-events: write # To write the security report
    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
@@ -18,10 +18,9 @@ repos:
  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
  - repo: https://github.com/crate-ci/typos
-    rev: 7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
+    rev: bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
    hooks:
      - id: typos
        always_run: true
  - repo: local
    hooks:
@@ -39,7 +38,8 @@ repos:
        entry: cargo test
        language: system
        args: [ "--features", "sqlite,mysql,postgresql", "--" ]
-        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
+        types_or: [ rust, file ]
        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
        pass_filenames: false
      - id: cargo-clippy
        name: cargo clippy
@@ -47,7 +47,8 @@ repos:
        entry: cargo clippy
        language: system
        args: [ "--features", "sqlite,mysql,postgresql", "--", "-D", "warnings" ]
-        types_or: [ rust, toml ] # Cargo.lock matches toml type which is intended
+        types_or: [ rust, file ]
        files: (Cargo.toml|Cargo.lock|rust-toolchain.toml|rustfmt.toml|.*\.rs$)
        pass_filenames: false
      - id: check-docker-templates
        name: check docker templates
@@ -14,8 +14,9 @@ extend-ignore-re = [
    # In SMTP it's called HELO, so ignore it
    "(?i)helo_name",
    "Server name sent during.+HELO",
-    # COSE Is short for CBOR Object Signing and Encryption
+    # COSE Is short for CBOR Object Signing and Encryption, ignore these specific items
-    "(?i)cose",
+    "COSEKey",
    "COSEAlgorithm",
    # Ignore this specific string as it's valid
    "Ensure they are valid OTPs",
    # This word is misspelled upstream
@@ -1,6 +1,6 @@
 [workspace.package]
 edition = "2024"
-rust-version = "1.97.1"
+rust-version = "1.94.1"
 license = "AGPL-3.0-only"
 repository = "https://github.com/dani-garcia/vaultwarden"
 publish = false
@@ -12,6 +12,7 @@ members = ["macros"]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
 readme = "README.md"
 build = "build.rs"
 repository.workspace = true
 edition.workspace = true
@@ -40,7 +41,6 @@ vendored_openssl = ["openssl/vendored"]
 enable_mimalloc = ["dep:mimalloc"]
 s3 = [
    "opendal/services-s3",
    "dep:opendal-http-transport-reqwest",
    "dep:aws-config",
    "dep:aws-credential-types",
    "dep:aws-smithy-runtime-api",
@@ -58,7 +58,6 @@ oidc-accept-string-booleans = ["openidconnect/accept-string-booleans"]
 unstable = []
 [target."cfg(unix)".dependencies]
 nix = { version = "0.31.3", features = ["fs"] }
 # Logging
 syslog = "7.0.0"
@@ -66,7 +65,7 @@ syslog = "7.0.0"
 macros = { path = "./macros" }
 # Logging
-log = "0.4.35"
+log = "0.4.33"
 fern = { version = "0.7.1", features = ["syslog-7", "reopen-1"] }
 # We need the `log` feature for `tracing` to enable logging for several crates to work, like lettre or webauthn-rs
 tracing = { version = "0.1.44", features = ["log"] }
@@ -76,11 +75,11 @@ dotenvy = { version = "0.15.7", default-features = false }
 # Numerical libraries
 num-traits = "0.2.19"
-num-derive = "0.5.1"
+num-derive = "0.4.2"
-bigdecimal = "0.4.11"
+bigdecimal = "0.4.10"
 # Web framework
-rocket = { version = "0.5.2", default-features = false, features = ["json", "tls"] }
+rocket = { version = "0.5.1", default-features = false, features = ["json", "tls"] }
 rocket_ws = { version = "0.1.1" }
 # WebSockets libraries
@@ -90,8 +89,8 @@ rmpv = "1.3.1" # MessagePack library
 dashmap = "6.2.1"
 # Async futures
-futures = "0.3.34"
+futures = "0.3.32"
-tokio = { version = "1.54.1", features = [
+tokio = { version = "1.52.3", features = [
    "fs",
    "io-util",
    "net",
@@ -100,14 +99,14 @@ tokio = { version = "1.54.1", features = [
    "signal",
    "time",
 ] }
-tokio-util = { version = "0.7.20", features = ["compat"] }
+tokio-util = { version = "0.7.18", features = ["compat"] }
 # A generic serialization/deserialization framework
-serde = { version = "1.0.229", features = ["derive"] }
+serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.154"
+serde_json = "1.0.150"
 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.14", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
+diesel = { version = "2.3.10", features = ["chrono", "r2d2", "numeric"] }
 diesel_migrations = "2.3.2"
 derive_more = { version = "2.1.1", features = [
@@ -120,36 +119,36 @@ derive_more = { version = "2.1.1", features = [
 diesel-derive-newtype = "2.1.3"
 # SQLite, statically bundled unless the `sqlite_system` feature is enabled
-libsqlite3-sys = { version = "0.38.2", optional = true }
+libsqlite3-sys = { version = "0.37.0", optional = true }
 # Crypto-related libraries
-rand = "0.10.3"
+rand = "0.10.2"
 ring = "0.17.14"
-rustls = { version = "0.23.46", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.41", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"
 # UUID generation
-uuid = { version = "1.29.0", features = ["v4"] }
+uuid = { version = "1.23.4", features = ["v4"] }
 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
 chrono-tz = "0.10.4"
-time = "0.3.55"
+time = "0.3.53"
 # Job scheduler
-job_scheduler_ng = "2.5.0"
+job_scheduler_ng = "2.4.0"
 # Data encoding library Hex/Base32/Base64
-data-encoding = "2.11.1"
+data-encoding = "2.11.0"
 # JWT library
-jsonwebtoken = { version = "11.1.0", default-features = false, features = ["rust_crypto", "use_pem"] }
+jsonwebtoken = { version = "10.4.0", default-features = false, features = ["rust_crypto", "use_pem"] }
 # TOTP library
 totp-lite = "2.0.1"
 # Yubico Library
-yubico_ng = { version = "1.0.0", default-features = false }
+yubico = { package = "yubico_ng", version = "0.15.0", default-features = false, features = ["online-tokio"] }
 # WebAuthn libraries
 # danger-allow-state-serialisation is needed to save the state in the db
@@ -162,7 +161,7 @@ webauthn-rs-core = "0.5.5"
 url = "2.5.8"
 # Email libraries
-lettre = { version = "0.11.23", default-features = false, features = [
+lettre = { version = "0.11.22", default-features = false, features = [
    # Misc
    "tracing",
    "serde",
@@ -180,10 +179,10 @@ percent-encoding = "2.3.2" # URL encoding library used for URL's in the emails
 email_address = "0.2.9"
 # HTML Template library
-handlebars = { version = "6.4.4", features = ["dir_source"] }
+handlebars = { version = "6.4.2", features = ["dir_source"] }
 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.13.5", default-features = false, features = [
+reqwest = { version = "0.13.4", default-features = false, features = [
    # Misc
    "charset",
    "cookies",
@@ -201,24 +200,24 @@ reqwest = { version = "0.13.5", default-features = false, features = [
    "socks",
    "system-proxy",
 ] }
-hickory-resolver = "0.26.3"
+hickory-resolver = "0.26.1"
 # Favicon extraction libraries
-html5gum = "0.9.0"
+html5gum = "0.8.4"
-regex = { version = "1.13.1", default-features = false, features = [
+regex = { version = "1.12.4", default-features = false, features = [
    "perf",
    "std",
    "unicode-perl",
 ] }
 data-url = "0.3.2"
 bytes = "1.12.1"
-svg-hush = "0.9.7"
+svg-hush = "0.9.6"
 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "4.1.0", features = ["async"] }
+cached = { version = "2.0.2", features = ["async"] }
 # Used for custom short lived cookie jar during favicon extraction
-cookie = "0.18.2"
+cookie = "0.18.1"
 cookie_store = "0.22.1"
 # Used by U2F, JWT and PostgreSQL
@@ -232,11 +231,11 @@ pastey = "0.2.3"
 governor = "0.10.4"
 # CIDR parsing for the trusted proxies of the client IP header
-ipnet = "2.12.2"
+ipnet = "2.12.0"
 # OIDC for SSO
-openidconnect = { version = "4.1.0", default-features = false }
+openidconnect = { version = "4.0.1", default-features = false }
-moka = { version = "0.12.16", features = ["future"] }
+moka = { version = "0.12.15", features = ["future"] }
 # Check client versions for specific features.
 semver = "1.0.28"
@@ -245,10 +244,10 @@ semver = "1.0.28"
 # Mainly used for the musl builds, since the default musl malloc is very slow
 mimalloc = { version = "0.1.52", optional = true, default-features = false, features = ["secure"] }
-which = "8.0.6"
+which = "8.0.4"
 # Argon2 library with support for the PHC format
-argon2 = "0.6.0"
+argon2 = "0.5.3"
 # Reading a password from the cli for generating the Argon2id ADMIN_TOKEN
 rpassword = "7.5.4"
@@ -257,21 +256,20 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }
 # File are accessed through Apache OpenDAL
-opendal = { version = "0.59.5", default-features = false, features = ["services-fs"] }
+opendal = { version = "0.57.0", default-features = false, features = ["services-fs"] }
 opendal-http-transport-reqwest = { version = "0.59.5", default-features = false, features = ["rustls-no-provider"], optional = true }
 # For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.13.0", optional = true, default-features = false, features = [
+aws-config = { version = "1.8.18", optional = true, default-features = false, features = [
    "behavior-version-latest",
    "credentials-process",
    "rt-tokio",
    "sso",
 ] }
-aws-credential-types = { version = "1.3.1", optional = true }
+aws-credential-types = { version = "1.2.14", optional = true }
-aws-smithy-runtime-api = { version = "1.19.2", optional = true }
+aws-smithy-runtime-api = { version = "1.13.0", optional = true }
-http = { version = "1.5.0", optional = true }
+http = { version = "1.4.2", optional = true }
-reqsign-aws-v4 = { version = "3.3.1", optional = true }
+reqsign-aws-v4 = { version = "3.0.1", optional = true }
-reqsign-core = { version = "3.3.2", optional = true }
+reqsign-core = { version = "3.0.1", optional = true }
 # Strip debuginfo from the release builds
 # The debug symbols are to provide better panic traces
@@ -1,12 +1,11 @@
 ---
-vault_version: "v2026.10.1"
+vault_version: "v2026.6.2"
-vault_image_digest: "sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52"
+vault_image_digest: "sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a"
-# Cross Compile Docker Helper Scripts v1.10.0
+# Cross Compile Docker Helper Scripts v1.9.0
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
-xx_image_digest: "sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6"
+xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
-# The `rust_version` variable is extracted from `rust-toolchain.toml`
+rust_version: 1.96.1 # Rust version to be used
 # rust_version: x.yy.z # Rust version to be used
 debian_version: trixie # Debian release name to be used
 alpine_version: "3.24" # Alpine version to be used
 # For which platforms/architectures will we try to build images
@@ -19,23 +19,23 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.10.1
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.6.2
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.10.1
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.6.2
-#     [docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52]
+#     [docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a
-#     [docker.io/vaultwarden/web-vault:v2026.10.1]
+#     [docker.io/vaultwarden/web-vault:v2026.6.2]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a AS vault
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.99.1 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.96.1 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.99.1 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.96.1 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.99.1 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.96.1 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.99.1 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.96.1 AS build_armv6
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -66,11 +66,11 @@ RUN USER=root cargo new --bin /app
 WORKDIR /app
 # Environment variables for Cargo on Alpine based builds
-RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
+RUN echo "export CARGO_TARGET=${RUST_MUSL_CROSS_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -86,7 +86,7 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
    find . -not -path "./target*" -delete
@@ -97,13 +97,13 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -126,7 +126,6 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/alpine:3.24
 ENV ROCKET_PROFILE="release" \
@@ -19,25 +19,24 @@
 # - From https://hub.docker.com/r/vaultwarden/web-vault/tags,
 #   click the tag name to view the digest of the image it currently points to.
 # - From the command line:
-#     $ docker pull docker.io/vaultwarden/web-vault:v2026.10.1
+#     $ docker pull docker.io/vaultwarden/web-vault:v2026.6.2
-#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.10.1
+#     $ docker image inspect --format "{{.RepoDigests}}" docker.io/vaultwarden/web-vault:v2026.6.2
-#     [docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52]
+#     [docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a]
 #
 # - Conversely, to get the tag name from the digest:
-#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52
+#     $ docker image inspect --format "{{.RepoTags}}" docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a
-#     [docker.io/vaultwarden/web-vault:v2026.10.1]
+#     [docker.io/vaultwarden/web-vault:v2026.6.2]
 #
-FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:7baaa7d5349742548b6c44e557c1512157b22010cdf314ccc399ffdcacb5eb52 AS vault
+FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:f004f72a5d357b87483839500a517da3d1b4ea0a57b9731989d298cccea7d02a AS vault
 ########################## Cross Compile Docker Helper Scripts ##########################
 ## We use the linux/amd64 no matter which Build Platform, since these are all bash scripts
 ## And these bash scripts do not have any significant difference if at all
-FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:40fe21f44bb8cddf1eb1226db190d0a984118f62ee02a91b77d99448d28264a6 AS xx
+FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.99.1-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.96.1-slim-trixie AS build
 # hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -81,7 +80,7 @@ RUN mkdir -pv "${CARGO_HOME}" && \
 RUN USER=root cargo new --bin /app
 WORKDIR /app
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -96,22 +95,9 @@ ARG DB=sqlite,mysql,postgresql
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
+RUN source /env-cargo && \
-    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
+    # Workaround for xx related build issues
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
    find . -not -path "./target*" -delete
@@ -122,28 +108,15 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
    # Create a symlink to the binary target folder to easy copy the binary in the final stage
-    # Configure xx-cargo for target pkg-config and Debian transitive library lookup
+    # Workaround for xx related build issues
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -166,7 +139,6 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim
 ENV ROCKET_PROFILE="release" \
@@ -28,21 +28,8 @@
 #     [docker.io/vaultwarden/web-vault:{{ vault_version | replace('+', '_') }}]
 #
 {% macro xx_cargo_config() -%}
-# Configure xx-cargo for target pkg-config and Debian transitive library lookup
+# Workaround for xx related build issues
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
    if [ "$(xx-info arch)" = "arm64" ]; then \
        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
    fi && \
    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}"
 {%- endmacro %}
 FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault
@@ -65,7 +52,6 @@ FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].arch_image[arch] }} AS
 # hadolint ignore=DL3006
 FROM --platform=$BUILDPLATFORM {{ build_stage_image[base].image }} AS build
 {% if base == "debian" %}
 # hadolint ignore=DL3067
 COPY --from=xx / /
 {% endif %}
 ARG TARGETARCH
@@ -120,12 +106,12 @@ WORKDIR /app
 {% if base == "alpine" %}
 # Environment variables for Cargo on Alpine based builds
-RUN echo "export CARGO_TARGET=${CARGO_BUILD_TARGET}" >> /env-cargo && \
+RUN echo "export CARGO_TARGET=${RUST_MUSL_CROSS_TARGET}" >> /env-cargo && \
    # Output the current contents of the file
    cat /env-cargo
 {% endif %}
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    rustup target add "${CARGO_TARGET}"
 # Copies over *only* your manifests and build files
@@ -145,7 +131,7 @@ ARG DB=sqlite,mysql,postgresql,enable_mimalloc
 # Builds your dependencies and removes the
 # dummy project, except the target folder
 # This folder contains the compiled dependencies
-RUN . /env-cargo && \
+RUN source /env-cargo && \
 {% if base == "debian" %}
    {{ xx_cargo_config() }} && \
 {% elif base == "alpine" %}
@@ -160,7 +146,7 @@ COPY . .
 ARG VW_VERSION
 # Builds again, this time it will be the actual source files being build
-RUN . /env-cargo && \
+RUN source /env-cargo && \
    # Make sure that we actually build the project by updating the src/main.rs timestamp
    # Also do this for build.rs to ensure the version is rechecked
    touch build.rs src/main.rs && \
@@ -170,7 +156,7 @@ RUN . /env-cargo && \
 {% elif base == "alpine" %}
    cargo build --features ${DB} --profile "${CARGO_PROFILE}" --target="${CARGO_TARGET}" && \
 {% endif %}
-    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
+    if [[ "${CARGO_PROFILE}" == "dev" ]] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
    else \
        ln -vfsr "/app/target/${CARGO_TARGET}/${CARGO_PROFILE}" /app/target/final ; \
@@ -193,7 +179,6 @@ RUN . /env-cargo && \
 # To uninstall: docker run --privileged --rm tonistiigi/binfmt --uninstall 'qemu-*'
 #
 # We need to add `--platform` here, because of a podman bug: https://github.com/containers/buildah/issues/4742
 # hadolint ignore=DL3065
 FROM --platform=$TARGETPLATFORM {{ runtime_stage_image[base] }}
 ENV ROCKET_PROFILE="release" \
@@ -15,7 +15,6 @@ Some unsupported platforms for Debian based images. These are not built and test
 - 386     (linux/386)
 - ppc64le (linux/ppc64le)
 - s390x   (linux/s390x)
 - riscv64 (linux/riscv64)
 To build these containers you need to enable QEMU binfmt support to be able to run/emulate architectures which are different then your host.<br>
 This ensures the container build process can run binaries from other architectures.<br>
@@ -148,12 +148,6 @@ target "debian-s390x" {
  platforms = ["linux/s390x"]
  tags = generate_tags("", "-s390x")
 }
 target "debian-riscv64" {
  inherits = ["debian"]
  platforms = ["linux/riscv64"]
  tags = generate_tags("", "-riscv64")
 }
 // ==== End of unsupported Debian architecture targets ===
 // A Group to build all platforms individually for local testing
@@ -3,23 +3,17 @@
 import os
 import argparse
 import json
 import tomllib
 import yaml
 import jinja2
 # Load settings file
-with open('DockerSettings.yaml', 'r', encoding='utf-8') as yaml_file:
+with open("DockerSettings.yaml", 'r') as yaml_file:
 	yaml_data = yaml.safe_load(yaml_file)
 # Extract the rust_version from the rust-toolchain.toml file
 script_dir = os.path.dirname(os.path.abspath(__file__))
 with open(os.path.join(script_dir, '..', 'rust-toolchain.toml'), 'rb') as toolchain_file:
    yaml_data["rust_version"] = tomllib.load(toolchain_file)["toolchain"]["channel"]
 settings_env = jinja2.Environment(
 	loader=jinja2.FileSystemLoader(os.getcwd()),
 )
-settings_yaml = yaml.safe_load(settings_env.get_template('DockerSettings.yaml').render(yaml_data))
+settings_yaml = yaml.safe_load(settings_env.get_template("DockerSettings.yaml").render(yaml_data))
 args_parser = argparse.ArgumentParser()
 args_parser.add_argument('template_file', help='Jinja2 template file to render.')
@@ -13,8 +13,8 @@ path = "src/lib.rs"
 proc-macro = true
 [dependencies]
-quote = "1.0.47"
+quote = "1.0.46"
-syn = "3.0.9"
+syn = "2.0.118"
 [lints]
 workspace = true
@@ -1 +0,0 @@
 ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1,31 +1,15 @@
-SELECT if (
+-- Dynamically create DROP FOREIGN KEY
-    EXISTS(
+-- Some versions of MySQL or MariaDB might fail if the key doesn't exists
-        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
+-- This checks if the key exists, and if so, will drop it.
-            WHERE TABLE_SCHEMA = DATABASE()
+SET @drop_sso_fk = IF((SELECT true FROM information_schema.TABLE_CONSTRAINTS WHERE
-                AND TABLE_NAME = 'sso_users'
+    CONSTRAINT_SCHEMA = DATABASE() AND
-                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
+    TABLE_NAME = 'sso_users' AND
-                AND CONSTRAINT_NAME = 'sso_users_ibfk_1'
+    CONSTRAINT_NAME = 'sso_users_ibfk_1' AND
-    )
+    CONSTRAINT_TYPE = 'FOREIGN KEY') = true,
-    ,'ALTER TABLE sso_users DROP FOREIGN KEY `sso_users_ibfk_1`'
+    'ALTER TABLE sso_users DROP FOREIGN KEY sso_users_ibfk_1',
-    ,'SELECT "info: FK sso_users_ibfk_1 does not exist."'
+    'SELECT 1');
-) INTO @drop_stmt;
+PREPARE stmt FROM @drop_sso_fk;
-PREPARE drop_stmt FROM @drop_stmt;
+EXECUTE stmt;
-EXECUTE drop_stmt;
+DEALLOCATE PREPARE stmt;
 SELECT if (
    EXISTS(
        SELECT CONSTRAINT_NAME FROM information_schema.table_constraints
            WHERE TABLE_SCHEMA = DATABASE()
                AND TABLE_NAME = 'sso_users'
                AND CONSTRAINT_TYPE = 'FOREIGN KEY'
                AND CONSTRAINT_NAME = '1'
    )
    ,'ALTER TABLE sso_users DROP FOREIGN KEY `1`'
    ,'SELECT "info: FK sso_users 1 does not exist."'
 ) INTO @drop_stmt;
 PREPARE drop_stmt FROM @drop_stmt;
 EXECUTE drop_stmt;
 DEALLOCATE PREPARE drop_stmt;
 ALTER TABLE sso_users ADD FOREIGN KEY(user_uuid) REFERENCES users(uuid) ON UPDATE CASCADE ON DELETE CASCADE;
@@ -1 +0,0 @@
 ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1 +0,0 @@
 ALTER TABLE org_policies DROP COLUMN revision_date;
@@ -1,7 +0,0 @@
 -- DATETIME (not TIMESTAMP) to match this repo's convention for revision_date
 -- columns elsewhere, and to avoid MySQL's implicit session-timezone
 -- conversion and 2038 range limit on TIMESTAMP.
 ALTER TABLE org_policies
 ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
 UPDATE org_policies SET revision_date = UTC_TIMESTAMP();
@@ -1,3 +0,0 @@
 -- A blob-encrypted cipher keeps all of its content in `data`, up to 500,000 characters, so the
 -- 64 KiB of TEXT is too small. Like upstream, which uses LONGTEXT.
 ALTER TABLE ciphers MODIFY data LONGTEXT NOT NULL;
@@ -1,5 +0,0 @@
 DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
@@ -1,14 +0,0 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 CREATE TABLE user_signature_key_pairs (
    uuid                CHAR(36) NOT NULL PRIMARY KEY,
    user_uuid           CHAR(36) NOT NULL UNIQUE,
    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
    signing_key         TEXT     NOT NULL,
    verifying_key       TEXT     NOT NULL,
    created_at          DATETIME NOT NULL,
    updated_at          DATETIME NOT NULL,
    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE
 );
@@ -1,22 +0,0 @@
 -- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
 -- versions before this one don't know. So while there are any, this fails on the duplicate key below, before anything
 -- is dropped: change their role first, or restore the backup taken before the upgrade.
 -- A failed attempt leaves the temporary table on this connection. Clear it before retrying.
 DROP TEMPORARY TABLE IF EXISTS custom_role_downgrade;
 CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
 INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
 INSERT INTO custom_role_downgrade
    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
    FROM users_organizations WHERE atype = 4 LIMIT 1;
 DROP TEMPORARY TABLE custom_role_downgrade;
 ALTER TABLE users_organizations
    DROP COLUMN manage_users,
    DROP COLUMN manage_groups,
    DROP COLUMN manage_policies,
    DROP COLUMN create_new_collections,
    DROP COLUMN edit_any_collection,
    DROP COLUMN delete_any_collection,
    DROP COLUMN access_event_logs,
    DROP COLUMN access_import_export,
    DROP COLUMN access_reports;
@@ -1,13 +0,0 @@
 -- The granular permissions of the Custom member role. They only take effect on a Custom membership
 -- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
 -- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
 ALTER TABLE users_organizations
    ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;
@@ -1 +0,0 @@
 ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1 +0,0 @@
 ALTER TABLE org_policies DROP COLUMN revision_date;
@@ -1,9 +0,0 @@
 -- Backfill via `now() AT TIME ZONE 'utc'` rather than a DEFAULT of now():
 -- assigning timestamptz now() into a naive TIMESTAMP column casts through
 -- the server's TimeZone GUC, so a DEFAULT now() would store local wall-clock
 -- instead of UTC on non-UTC servers, unlike every other naive-UTC timestamp
 -- column in this schema.
 ALTER TABLE org_policies
 ADD COLUMN revision_date TIMESTAMP NOT NULL DEFAULT '1970-01-01 00:00:00';
 UPDATE org_policies SET revision_date = (now() AT TIME ZONE 'utc');
@@ -1,3 +0,0 @@
 -- TEXT has no size limit here, only MySQL needed the change.
 -- PostgreSQL rejects a migration that is only comments ("Received an empty query"), hence the no-op.
 SELECT 1;
@@ -1,5 +0,0 @@
 DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
@@ -1,13 +0,0 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 CREATE TABLE user_signature_key_pairs (
    uuid                CHAR(36) NOT NULL PRIMARY KEY,
    user_uuid           CHAR(36) NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
    signing_key         TEXT     NOT NULL,
    verifying_key       TEXT     NOT NULL,
    created_at          TIMESTAMP NOT NULL,
    updated_at          TIMESTAMP NOT NULL
 );
@@ -1,20 +0,0 @@
 -- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
 -- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
 -- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
 CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
 INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
 INSERT INTO custom_role_downgrade
    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
    FROM users_organizations WHERE atype = 4 LIMIT 1;
 DROP TABLE custom_role_downgrade;
 ALTER TABLE users_organizations
    DROP COLUMN manage_users,
    DROP COLUMN manage_groups,
    DROP COLUMN manage_policies,
    DROP COLUMN create_new_collections,
    DROP COLUMN edit_any_collection,
    DROP COLUMN delete_any_collection,
    DROP COLUMN access_event_logs,
    DROP COLUMN access_import_export,
    DROP COLUMN access_reports;
@@ -1,13 +0,0 @@
 -- The granular permissions of the Custom member role. They only take effect on a Custom membership
 -- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
 -- A single statement, so an interrupted upgrade cannot leave only some of the columns behind.
 ALTER TABLE users_organizations
    ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT FALSE,
    ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT FALSE;
@@ -1 +0,0 @@
 ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1,6 +0,0 @@
 -- SQLite forbids non-constant defaults in ALTER TABLE ... ADD COLUMN, so add
 -- the column with a constant placeholder and backfill separately.
 ALTER TABLE org_policies
 ADD COLUMN revision_date DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00';
 UPDATE org_policies SET revision_date = CURRENT_TIMESTAMP;
@@ -1 +0,0 @@
 -- TEXT has no size limit here, only MySQL needed the change
@@ -1,5 +0,0 @@
 DROP TABLE IF EXISTS user_signature_key_pairs;
 ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
@@ -1,13 +0,0 @@
 ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 CREATE TABLE user_signature_key_pairs (
    uuid                TEXT     NOT NULL PRIMARY KEY,
    user_uuid           TEXT     NOT NULL UNIQUE REFERENCES users (uuid) ON DELETE CASCADE,
    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
    signing_key         TEXT     NOT NULL,
    verifying_key       TEXT     NOT NULL,
    created_at          DATETIME NOT NULL,
    updated_at          DATETIME NOT NULL
 );
@@ -1,19 +0,0 @@
 -- Dropping the permissions would silently take them away from the Custom members, who would also keep a role (4) the
 -- versions before this one don't know. So while there are any, this fails on the duplicate key below: change their
 -- role first, or restore the backup taken before the upgrade. It needs to run in one transaction, as Diesel does.
 CREATE TEMPORARY TABLE custom_role_downgrade (blocked_by VARCHAR(255) NOT NULL PRIMARY KEY);
 INSERT INTO custom_role_downgrade VALUES ('Custom members: change their role first, or restore the backup taken before the upgrade');
 INSERT INTO custom_role_downgrade
    SELECT 'Custom members: change their role first, or restore the backup taken before the upgrade'
    FROM users_organizations WHERE atype = 4 LIMIT 1;
 DROP TABLE custom_role_downgrade;
 ALTER TABLE users_organizations DROP COLUMN manage_users;
 ALTER TABLE users_organizations DROP COLUMN manage_groups;
 ALTER TABLE users_organizations DROP COLUMN manage_policies;
 ALTER TABLE users_organizations DROP COLUMN create_new_collections;
 ALTER TABLE users_organizations DROP COLUMN edit_any_collection;
 ALTER TABLE users_organizations DROP COLUMN delete_any_collection;
 ALTER TABLE users_organizations DROP COLUMN access_event_logs;
 ALTER TABLE users_organizations DROP COLUMN access_import_export;
 ALTER TABLE users_organizations DROP COLUMN access_reports;
@@ -1,11 +0,0 @@
 -- The granular permissions of the Custom member role. They only take effect on a Custom membership
 -- (atype 4) while EXPERIMENTAL_CUSTOM_ROLES is enabled, and every existing membership starts without any.
 ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT 0; -- FALSE
 ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT 0; -- FALSE
 ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT 0; -- FALSE
 ALTER TABLE users_organizations ADD COLUMN create_new_collections BOOLEAN NOT NULL DEFAULT 0; -- FALSE
 ALTER TABLE users_organizations ADD COLUMN edit_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
 ALTER TABLE users_organizations ADD COLUMN delete_any_collection BOOLEAN NOT NULL DEFAULT 0; -- FALSE
 ALTER TABLE users_organizations ADD COLUMN access_event_logs BOOLEAN NOT NULL DEFAULT 0; -- FALSE
 ALTER TABLE users_organizations ADD COLUMN access_import_export BOOLEAN NOT NULL DEFAULT 0; -- FALSE
 ALTER TABLE users_organizations ADD COLUMN access_reports BOOLEAN NOT NULL DEFAULT 0; -- FALSE
@@ -21,19 +21,11 @@ TEST_USER3=test3
 TEST_USER3_PASSWORD=${TEST_USER3}
 TEST_USER3_MAIL=${TEST_USER3}@yopmail.com
 TEST_USER4=test4
 TEST_USER4_PASSWORD=${TEST_USER4}
 TEST_USER4_MAIL=${TEST_USER4}@yopmail.com
 TEST_USER5=test5
 TEST_USER5_PASSWORD=${TEST_USER5}
 TEST_USER5_MAIL=${TEST_USER5}@yopmail.com
 ###################
 # Keycloak Config #
 ###################
-KC_BOOTSTRAP_ADMIN_USERNAME=admin
+KEYCLOAK_ADMIN=admin
-KC_BOOTSTRAP_ADMIN_PASSWORD=${KC_BOOTSTRAP_ADMIN_USERNAME}
+KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
 KC_HTTP_HOST=127.0.0.1
 KC_HTTP_PORT=8080
@@ -47,10 +39,8 @@ DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
 ######################
 ROCKET_ADDRESS=0.0.0.0
 ROCKET_PORT=8000
-ROCKET_TLS={certs="/data/ssl/localhost.crt",key="/data/ssl/localhost.key"}
+DOMAIN=http://localhost:${ROCKET_PORT}
 DOMAIN=https://127.0.0.1:${ROCKET_PORT}
 LOG_LEVEL=info,oidcwarden::sso=debug
 SSO_DEBUG_TOKENS=true
 I_REALLY_WANT_VOLATILE_STORAGE=true
 SSO_ENABLED=true
@@ -1,8 +1,8 @@
 # Integration tests
 This allows running integration tests using [Playwright](https://playwright.dev/).
-\
+
-It uses its own [test.env](./test.env) with different ports to not collide with a running dev instance.
+It uses its own `test.env` with different ports to not collide with a running dev instance.
 ## Install
@@ -11,11 +11,11 @@ Databases (`Mariadb`, `Mysql` and `Postgres`) and `Playwright` will run in conta
 ### Running Playwright outside docker
-It's possible to run `Playwright` outside of the container, this remove the need to rebuild the image for each change.
+It is possible to run `Playwright` outside of the container, this removes the need to rebuild the image for each change.
-You'll additionally need `nodejs` then run:
+You will additionally need `nodejs` then run:
 ```bash
-npm ci --ignore-scripts --allow-git=none --allow-remote=none
+npm ci --ignore-scripts
 npx playwright install-deps
 npx playwright install firefox
 ```
@@ -62,10 +62,10 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 ### Keep services running
-If you want you can keep the DB and Keycloak running (states are not impacted by the tests):
+If you want you can keep the DB and Keycloak runnning (states are not impacted by the tests):
 ```bash
-PW_KEEP_SERVICE_RUNNING=true npx playwright test
+PW_KEEP_SERVICE_RUNNNING=true npx playwright test
 ```
 ### Running specific tests
@@ -77,7 +77,7 @@ DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Pl
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite login
 ```
-To run only a specific test (It might fail if it has dependency):
+To run only a specifc test (It might fail if it has dependency):
 ```bash
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env run Playwright test --project=sqlite -g "Account creation"
@@ -92,7 +92,7 @@ This does not start the server, you will need to start it manually.
 ```bash
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
-npx playwright codegen "https://127.0.0.1:8000" --ignore-https-errors
+npx playwright codegen "http://127.0.0.1:8003"
 ```
 ## Override web-vault
@@ -112,11 +112,12 @@ You can check the result running:
 DOCKER_BUILDKIT=1 docker compose --profile playwright --env-file test.env up Vaultwarden
 ```
-Then check `https://127.0.0.1:8003/admin/diagnostics` with `admin`.
+Then check `http://127.0.0.1:8003/admin/diagnostics` with `admin`.
 # OpenID Connect test setup
-Additionally this `docker-compose` template allow to run locally `Vaultwarden`, [Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.
+Additionally this `docker-compose` template allows to run locally Vaultwarden,
 [Keycloak](https://www.keycloak.org/) and [Maildev](https://github.com/timshel/maildev) to test OIDC.
 ## Setup
@@ -130,17 +131,18 @@ Then start the stack (the `profile` is required to run `Vaultwarden`) :
 ```bash
 > docker compose --profile vaultwarden --env-file .env up
 ....
-keycloakSetup_1  | Logging into https://127.0.0.1:8080 as user admin of realm master
+keycloakSetup_1  | Logging into http://127.0.0.1:8080 as user admin of realm master
 keycloakSetup_1  | Created new realm with id 'test'
 keycloakSetup_1  | 74af4933-e386-4e64-ba15-a7b61212c45e
 oidc_keycloakSetup_1 exited with code 0
 ```
-Wait until `oidc_keycloakSetup_1 exited with code 0` which indicate the correct setup of the Keycloak realm, client and user (It's normal for this container to stop once the configuration is done).
+Wait until `oidc_keycloakSetup_1 exited with code 0` which indicates the correct setup of the Keycloak realm, client and user
 (It is normal for this container to stop once the configuration is done).
 Then you can access :
- `Vaultwarden` on https://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
+- `Vaultwarden` on http://0.0.0.0:8000 with the default user `test@yopmail.com/test`.
 - `Keycloak` on http://0.0.0.0:8080/admin/master/console/ with the default user `admin/admin`
 - `Maildev` on http://0.0.0.0:1080
@@ -169,7 +171,7 @@ docker compose --profile vaultwarden --env-file .env build VaultwardenPrebuild V
 All configuration for `keycloak` / `Vaultwarden` / `keycloak_setup.sh` can be found in [.env](.env.template).
 The content of the file will be loaded as environment variables in all containers.
- `keycloak` [configuration](https://www.keycloak.org/server/all-config) include `KC_BOOTSTRAP_ADMIN_USERNAME` / `KC_BOOTSTRAP_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
+- `keycloak` [configuration](https://www.keycloak.org/server/all-config) includes `KEYCLOAK_ADMIN` / `KEYCLOAK_ADMIN_PASSWORD` and any variable prefixed `KC_` ([more information](https://www.keycloak.org/server/configuration#_example_configuring_the_db_url_host_parameter)).
 - All `Vaultwarden` configuration can be set (EX: `SMTP_*`)
 ## Cleanup
@@ -17,7 +17,7 @@ done
 set -e
-kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KC_BOOTSTRAP_ADMIN_USERNAME" --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" --client admin-cli
+kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
 kcadm.sh create realms -s realm="$TEST_REALM" -s enabled=true -s "accessTokenLifespan=600"
 kcadm.sh create clients -r test -s "clientId=$SSO_CLIENT_ID" -s "secret=$SSO_CLIENT_SECRET" -s "redirectUris=[\"$DOMAIN/*\"]" -i
@@ -39,6 +39,6 @@ kcadm.sh create realms -s realm="$DUMMY_REALM" -s enabled=true -s "accessTokenLi
 # THEN in another terminal:
 # docker exec -it keycloakSetup-dev /bin/bash
 # export PATH=$PATH:/opt/keycloak/bin
-# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KC_BOOTSTRAP_ADMIN_USERNAME" --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" --client admin-cli
+# kcadm.sh config credentials --server "http://${KC_HTTP_HOST}:${KC_HTTP_PORT}" --realm master --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" --client admin-cli
 # ENJOY
 # Doc: https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/admin-cli.html
@@ -28,7 +28,7 @@ RUN mkdir /playwright
 WORKDIR /playwright
 COPY package.json package-lock.json .
-RUN npm ci --ignore-scripts --allow-git=none --allow-remote=none && npx playwright install-deps && npx playwright install firefox
+RUN npm ci --ignore-scripts && npx playwright install-deps && npx playwright install firefox
 COPY docker-compose.yml test.env ./
 COPY compose ./compose
@@ -35,7 +35,6 @@ WORKDIR /
 COPY --from=prebuilt /start.sh .
 COPY --from=prebuilt /vaultwarden .
 COPY --from=build /data ./data
 COPY --from=build /web-vault ./web-vault
 ENTRYPOINT ["/start.sh"]
@@ -22,14 +22,3 @@ if [[ ! -z "$REPO_URL" ]] && [[ ! -z "$COMMIT_HASH" ]] ; then
    mv build /web-vault
 fi
 # Lower the KDF iterations default for faster tests.
 sed -i 's/(6e5,2e6,6e5)/(1e5,2e6,1e5)/' /web-vault/app/main.*.js
 # Generate a self signed cert
 mkdir -p /data/ssl; cd /data/ssl
 openssl req -x509 -out localhost.crt -keyout localhost.key \
  -newkey rsa:2048 -nodes -sha256 \
  -subj '/CN=localhost' -extensions EXT -config <( \
   printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
@@ -24,15 +24,12 @@ services:
    environment:
      - ADMIN_TOKEN
      - DATABASE_URL
      - CLIENT_SUPPRESS_ONBOARDING
      - EMAIL_2FA_AUTO_FALLBACK
      - I_REALLY_WANT_VOLATILE_STORAGE
      - LOG_LEVEL
      - LOGIN_RATELIMIT_MAX_BURST
      - SMTP_HOST
      - SMTP_FROM
      - SMTP_DEBUG
      - SSO_AUTH_ONLY_NOT_SESSION
      - SSO_DEBUG_TOKENS
      - SSO_ENABLED
      - SSO_FRONTEND
@@ -61,7 +58,7 @@ services:
  Mariadb:
    profiles: ["playwright"]
    container_name: playwright_mariadb
-    image: mariadb:12.2.2
+    image: mariadb:11.2.4
    env_file: test.env
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
@@ -73,7 +70,7 @@ services:
  Mysql:
    profiles: ["playwright"]
    container_name: playwright_mysql
-    image: mysql:9.7.0
+    image: mysql:8.4.1
    env_file: test.env
    healthcheck:
      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
@@ -85,7 +82,7 @@ services:
  Postgres:
    profiles: ["playwright"]
    container_name: playwright_postgres
-    image: postgres:18.4
+    image: postgres:16.3
    env_file: test.env
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
@@ -97,7 +94,7 @@ services:
  Maildev:
    profiles: ["vaultwarden", "maildev"]
    container_name: maildev
-    image: timshel/maildev:3.2.19
+    image: timshel/maildev:3.0.4
    ports:
      - ${SMTP_PORT}:1025
      - 1080:1080
@@ -105,7 +102,7 @@ services:
  Keycloak:
    profiles: ["keycloak", "vaultwarden"]
    container_name: keycloak-${ENV:-dev}
-    image: quay.io/keycloak/keycloak:26.6.2
+    image: quay.io/keycloak/keycloak:26.3.4
    network_mode: "host"
    command:
      - start-dev
@@ -115,12 +112,12 @@ services:
    profiles: ["keycloak", "vaultwarden"]
    container_name: keycloakSetup-${ENV:-dev}
    image: keycloak_setup-${ENV:-dev}
    network_mode: "host"
    build:
      context: compose/keycloak
      dockerfile: Dockerfile
      args:
-        KEYCLOAK_VERSION: 26.6.2
+        KEYCLOAK_VERSION: 26.3.4
    network_mode: "host"
    depends_on:
      - Keycloak
    restart: "no"
@@ -1,4 +1,4 @@
-import { type FullConfig } from '@playwright/test';
+import { firefox, type FullConfig } from '@playwright/test';
 import { execSync } from 'node:child_process';
 import fs from 'fs';
@@ -207,7 +207,7 @@ export async function startVault(browser: Browser, testInfo: TestInfo, env = {},
 }
 export async function stopVault(force: boolean = false) {
-    if( force === false && process.env.PW_KEEP_SERVICE_RUNNING === "true" ) {
+    if( force === false && process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
        console.log(`Keep vaultwarden running on: ${process.env.DOMAIN}`);
    } else {
        console.log(`Vaultwarden stopping`);
@@ -231,7 +231,6 @@ export async function checkNotification(page: Page, hasText: string) {
 }
 export async function cleanLanding(page: Page) {
    await page.context().clearCookies();
    await page.goto('/', { waitUntil: 'domcontentloaded' });
    await expect(page.getByRole('button').nth(0)).toBeVisible();
@@ -249,3 +248,15 @@ export async function logout(test: Test, page: Page, user: { name: string }) {
        await expect(page.getByRole('heading', { name: 'Log in' })).toBeVisible();
    });
 }
 export async function ignoreExtension(page: Page) {
    await page.waitForLoadState('domcontentloaded');
    try {
        await page.getByRole('button', { name: 'Add it later' }).click({timeout: 5_000});
        await page.getByRole('link', { name: 'Skip to web app' }).click();
    } catch (error) {
        console.log('Extension setup not visible. Continuing');
    }
 }
@@ -8,14 +8,14 @@
    "author": "",
    "license": "ISC",
    "devDependencies": {
-        "@playwright/test": "1.60.0",
+        "@playwright/test": "1.56.1",
-        "dotenv": "17.4.2",
+        "dotenv": "17.2.3",
-        "dotenv-expand": "13.0.0",
+        "dotenv-expand": "12.0.3",
-        "maildev": "npm:@timshel_npm/maildev@3.2.19"
+        "maildev": "npm:@timshel_npm/maildev@3.2.5"
    },
    "dependencies": {
-        "mysql2": "3.22.3",
+        "mysql2": "3.15.3",
-        "otpauth": "9.5.1",
+        "otpauth": "9.4.1",
-        "pg": "8.21.0"
+        "pg": "8.16.3"
    }
 }
@@ -25,12 +25,10 @@ export default defineConfig({
    /* Long global timeout for complex tests
     * But short action/nav/expect timeouts to fail on specific step (raise locally if not enough).
     */
-    timeout: 240 * 1000,
+    timeout: 120 * 1000,
-    actionTimeout: 40 * 1000,
+    actionTimeout: 20 * 1000,
-    navigationTimeout: 40 * 1000,
+    navigationTimeout: 20 * 1000,
-    expect: { timeout: 40 * 1000 },
+    expect: { timeout: 20 * 1000 },
    "permissions": ["clipboard-read"],
    /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
    use: {
@@ -39,10 +37,6 @@ export default defineConfig({
        browserName: 'firefox',
        locale: 'en-GB',
        timezoneId: 'Europe/London',
        ignoreHTTPSErrors: true,
        launchOptions: {
            args: ['--ignore-certificate-errors']
        },
        /* Always collect trace (other values add random test failures) See https://playwright.dev/docs/trace-viewer */
        trace: 'on',
@@ -10,7 +10,7 @@ DOCKER_BUILDKIT=1
 #####################
 # Playwright Config #
 #####################
-PW_KEEP_SERVICE_RUNNING=${PW_KEEP_SERVICE_RUNNING:-false}
+PW_KEEP_SERVICE_RUNNNING=${PW_KEEP_SERVICE_RUNNNING:-false}
 PW_SMTP_FROM=vaultwarden@playwright.test
 #####################
@@ -38,8 +38,8 @@ TEST_USER3_MAIL=${TEST_USER3}@example.com
 ###################
 # Keycloak Config #
 ###################
-KC_BOOTSTRAP_ADMIN_USERNAME=admin
+KEYCLOAK_ADMIN=admin
-KC_BOOTSTRAP_ADMIN_PASSWORD=${KC_BOOTSTRAP_ADMIN_USERNAME}
+KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN}
 KC_HTTP_HOST=127.0.0.1
 KC_HTTP_PORT=8081
@@ -52,12 +52,10 @@ DUMMY_AUTHORITY=http://${KC_HTTP_HOST}:${KC_HTTP_PORT}/realms/${DUMMY_REALM}
 # Vaultwarden Config #
 ######################
 ROCKET_PORT=8003
-ROCKET_TLS={certs="/data/ssl/localhost.crt",key="/data/ssl/localhost.key"}
+DOMAIN=http://localhost:${ROCKET_PORT}
 DOMAIN=https://127.0.0.1:${ROCKET_PORT}
 LOG_LEVEL=info,oidcwarden::sso=debug
 LOGIN_RATELIMIT_MAX_BURST=100
 ADMIN_TOKEN=admin
 CLIENT_SUPPRESS_ONBOARDING=true
 SMTP_SECURITY=off
 SMTP_PORT=${MAILDEV_SMTP_PORT}
@@ -1,8 +1,6 @@
 import { test, expect, type TestInfo } from '@playwright/test';
 import * as utils from "../global-utils";
 import * as orgs from './setups/orgs';
 import { createAccount } from './setups/user';
 let users = utils.loadEnv();
@@ -18,12 +16,20 @@ test.afterAll('Teardown', async ({}) => {
 test('Create', async ({ page }) => {
    await createAccount(test, page, users.user1);
-    await orgs.create(test, page, 'New organisation');
+    await test.step('Create Org', async () => {
        await page.getByRole('link', { name: 'New organisation' }).click();
        await page.getByLabel('Organisation name (required)').fill('Test');
        await page.getByRole('button', { name: 'Submit' }).click();
        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
        await utils.checkNotification(page, 'Organisation created');
    });
    await test.step('Create Collection', async () => {
-        await page.getByRole('button', { name: 'New', exact: true }).click();
+        await page.getByRole('link', { name: 'Collections' }).click();
        await page.getByRole('button', { name: 'New' }).click();
        await page.getByRole('menuitem', { name: 'Collection' }).click();
-        await page.getByRole('textbox', { name: 'Name * (required)', exact: true }).fill('RandomCollec');
+        await page.getByLabel('Name (required)').fill('RandomCollec');
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Created collection RandomCollec');
        await expect(page.getByRole('button', { name: 'RandomCollec' })).toBeVisible();
@@ -1,56 +0,0 @@
 import { test, expect, type Page, type TestInfo } from '@playwright/test';
 import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
 import { activateTOTP, disableTOTP } from './setups/2fa';
 let users = utils.loadEnv();
 let totp;
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {});
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
 });
 test('Change Key settings', async ({ page }) => {
    await createAccount(test, page, users.user1);
    await test.step('Change SHA-256 Iterations', async () => {
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Keys' }).click();
        await page.getByRole('spinbutton', { name: 'KDF iterations * (required)'}).fill('700000');
        await page.getByRole('button', { name: 'Update encryption settings' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Update settings' }).click();
        await page.getByRole('heading', { name: 'Log in' }).click();
    });
    await logUser(test, page, users.user1);
    await test.step('Switch to Argon2', async () => {
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Keys' }).click();
        await page.locator('.ng-arrow-wrapper').click();
        await page.getByText('Argon2id').click();
        await page.getByRole('spinbutton', { name: 'KDF memory (MB) * (required)'}).fill('16');
        await page.getByRole('spinbutton', { name: 'KDF iterations * (required)'}).fill('2');
        await page.getByRole('spinbutton', { name: 'KDF parallelism * (required)'}).fill('1');
        await page.getByRole('button', { name: 'Update encryption settings' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Update settings' }).click();
        await page.getByRole('heading', { name: 'Log in' }).click();
    });
    await logUser(test, page, users.user1);
 });
@@ -1,131 +0,0 @@
 import { test, expect, type Page, type TestInfo, Test } from '@playwright/test';
 import { MailDev } from 'maildev';
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
 import { activateTOTP } from './setups/2fa';
 let users = utils.loadEnv();
 let mailserver;
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    mailserver = new MailDev({
        port: process.env.MAILDEV_SMTP_PORT,
        web: { port: process.env.MAILDEV_HTTP_PORT },
    })
    await mailserver.listen();
    await utils.startVault(browser, testInfo, {
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
    });
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
    if( mailserver ){
        await mailserver.close();
    }
 });
 async function emergencyAccess(test: Test, page: Page, user: { name: string }) {
    await test.step('Navigate', async () => {
        await page.getByRole('button', { name: user.name }).click();
        await page.getByRole('menuitem', { name: 'Account settings' }).click();
        await page.getByRole('link', { name: 'Emergency access' }).click();
        await expect(page.locator('#main-content').getByText('Emergency access', { exact: true })).toBeVisible();
    });
 }
 test('Emergency access', async ({ browser, page }) => {
    const context2 = await browser.newContext();
    const page2 = await context2.newPage();
    const mailBuffer = mailserver.buffer(users.user1.email);
    const mailBuffer2 = mailserver.buffer(users.user2.email);
    await createAccount(test, page, users.user1);
    await createAccount(test, page2, users.user2);
    await test.step('Add test2', async () => {
        await emergencyAccess(test, page, users.user1);
        await page.getByRole('button', { name: 'Add emergency contact' }).click();
        await page.getByRole('textbox', { name: 'Email * (required)' }).fill(users.user2.email);
        await page.getByRole('radio', { name: 'Takeover Can reset your' }).check();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'User(s) invited');
    });
    await test.step('Accept', async () => {
        const email = await mailBuffer2.expect((m) => m.subject === "Emergency access for " + users.user1.name);
        const pageE = await context2.newPage();
        await pageE.setContent(email.html);
        const link = await pageE.getByTestId("emergency").getAttribute("href");
        await pageE.close();
        await page2.goto(link);
        await utils.checkNotification(page2, 'Invitation accepted');
    });
    await test.step('Confirm', async () => {
        await emergencyAccess(test, page, users.user1);
        await expect(page.locator('#main-content').getByText('Needs confirmation')).toBeVisible();
        await page.getByRole('button', { name: 'Options' }).click();
        await page.getByRole('menuitem', { name: 'Confirm' }).click();
        await page.getByRole('button', { name: 'Confirm' }).click();
        await utils.checkNotification(page, users.user2.name + ' confirmed');
        await mailBuffer2.expect((m) => m.subject === "Emergency access contact for " + users.user1.name + " confirmed");
    });
    await test.step('Request', async () => {
        await emergencyAccess(test, page2, users.user2);
        await page2.getByRole('button', { name: 'Options' }).click();
        await page2.getByRole('menuitem', { name: 'Request Access' }).click();
        await page2.getByRole('button', { name: 'Request Access' }).click();
        await utils.checkNotification(page2, 'Emergency access requested');
        await mailBuffer.expect((m) => m.subject === "Emergency access request by " + users.user2.name + " initiated");
    });
    await test.step('Approved', async () => {
        await emergencyAccess(test, page, users.user1);
        await page.getByRole('button', { name: 'Options' }).click();
        await page.getByRole('menuitem', { name: 'Approve' }).click();
        await page.getByRole('button', { name: 'Approve' }).click();
        await utils.checkNotification(page, 'Emergency access approved');
        await mailBuffer2.expect((m) => m.subject === "Emergency access request for " + users.user1.name + " approved");
    });
    await activateTOTP(test, page, users.user1);
    let newPassword = "TotoNewPassword";
    await test.step('Access', async () => {
        await emergencyAccess(test, page2, users.user2);
        await page2.getByRole('button', { name: 'Options' }).click();
        await page2.getByRole('menuitem', { name: 'Takeover' }).click();
        await page2.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
        await page2.getByRole('textbox', { name: 'Confirm new master password' }).fill(newPassword);
        await page2.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page2, 'Password reset for ' + users.user1.name);
    });
    await test.step('Changed no 2fa', async () => {
        users.user1.password = newPassword;
        await logUser(test, page, users.user1);
    });
    await test.step('Reject', async () => {
        await emergencyAccess(test, page, users.user1);
        await page.getByRole('button', { name: 'Options' }).click();
        await page.getByRole('menuitem', { name: 'Reject' }).click();
        await utils.checkNotification(page, 'Emergency access rejected');
        await mailBuffer2.expect((m) => m.subject === "Emergency access request to " + users.user1.name + " rejected");
    });
    await test.step('Remove', async () => {
        await page.getByRole('button', { name: 'Options' }).click();
        await page.getByRole('menuitem', { name: 'Remove' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
        await utils.checkNotification(page, 'Removed user ' + users.user2.name);
        await expect(page.getByText('You have not added any emergency contacts')).toBeVisible();
    });
 });
@@ -41,10 +41,13 @@ test('Account creation', async ({ page }) => {
 test('Login', async ({ context, page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
-    await logUser(test, page, users.user1, { mailBuffer });
+    await logUser(test, page, users.user1, mailBuffer);
    await test.step('verify email', async () => {
-        await page.getByRole('button', { name: "Send email" }).click();
+        await page.getByText('Verify your account\'s email').click();
        await expect(page.getByText('Verify your account\'s email')).toBeVisible();
        await page.getByRole('button', { name: 'Send email' }).click();
        await utils.checkNotification(page, 'Check your email inbox for a verification link');
        const verify = await mailBuffer.expect((m) => m.subject === "Verify Your Email");
@@ -75,10 +78,26 @@ test('Activate 2fa', async ({ page }) => {
 test('2fa', async ({ page }) => {
    const emails = mailserver.buffer(users.user1.email);
-    await logUser(test, page, users.user1, {
+    await test.step('login', async () => {
-        mailBuffer: emails,
+        await page.goto('/');
-        mail2fa: true,
+
-    });
+        await page.getByLabel(/Email address/).fill(users.user1.email);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByLabel('Master password').fill(users.user1.password);
        await page.getByRole('button', { name: 'Log in with master password' }).click();
        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
        const code = await retrieveEmailCode(test, page, emails);
        await page.getByLabel(/Verification code/).fill(code);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Add it later' }).click();
        await page.getByRole('link', { name: 'Skip to web app' }).click();
        await expect(page).toHaveTitle(/Vaults/);
    })
    await disableEmail(test, page, users.user1);
    emails.close();
 });
@@ -3,7 +3,7 @@ import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
-import { activateTOTP, disableTOTP, recoveryCodes } from './setups/2fa';
+import { activateTOTP, disableTOTP } from './setups/2fa';
 let users = utils.loadEnv();
 let totp;
@@ -31,42 +31,21 @@ test('Authenticator 2fa', async ({ page }) => {
    await utils.logout(test, page, users.user1);
-    await logUser(test, page, users.user1, { totp });
+    await test.step('login', async () => {
        let timestamp = Date.now(); // Needed to use the next token
        timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
        await page.getByLabel(/Email address/).fill(users.user1.email);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByLabel('Master password').fill(users.user1.password);
        await page.getByRole('button', { name: 'Log in with master password' }).click();
        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
        await page.getByLabel(/Verification code/).fill(totp.generate({timestamp}));
        await page.getByRole('button', { name: 'Continue' }).click();
        await expect(page).toHaveTitle(/Vaultwarden Web/);
    });
    await disableTOTP(test, page, users.user1);
 });
 test('Recovery codes', async ({ context, page }) => {
    await logUser(test, page, users.user1);
    await activateTOTP(test, page, users.user1);
    let recovery = await recoveryCodes(test, page, users.user1);
    await utils.logout(test, page, users.user1);
    await test.step('login', async () => {
        await page.getByLabel(/Email address/).fill(users.user1.email);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Log in', exact: true }).click();
        await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
        await expect(page).toHaveTitle(/Vaultwarden Web/);
        const newPagePromise = context.waitForEvent('page');
        await page.getByRole('button', { name: 'Use your recovery code' }).click();
        const newPage = await newPagePromise;
        const tabs = context.pages();
        await tabs[1].bringToFront();
        await expect(tabs[1].getByRole('heading', { name: 'Recover account two-step login' })).toBeVisible();
        await tabs[1].getByRole('textbox', { name: 'Email address * (required)' }).fill(users.user1.email);
        await tabs[1].getByRole('textbox', { name: 'Master password * (required)' }).fill(users.user1.password);
        await tabs[1].getByRole('textbox', { name: 'Recovery code * (required)' }).fill(recovery);
        await tabs[1].getByRole('button', { name: 'Submit' }).click();
        await expect(tabs[1]).toHaveTitle(/Two-step login/);
    });
 });
@@ -4,7 +4,6 @@ import { MailDev } from 'maildev';
 import * as utils from '../global-utils';
 import * as orgs from './setups/orgs';
 import { createAccount, logUser } from './setups/user';
 import { activateTOTP } from './setups/2fa';
 let users = utils.loadEnv();
@@ -21,7 +20,6 @@ test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
        EMAIL_2FA_AUTO_FALLBACK: "true",
    });
    mail1Buffer = mailServer.buffer(users.user1.email);
@@ -47,7 +45,7 @@ test('Invite users', async ({ page }) => {
        await orgs.policies(test, page, 'Test');
        await page.getByRole('button', { name: 'Account recovery' }).click();
        await page.getByRole('checkbox', { name: 'Turn on' }).check();
-        await page.getByRole('checkbox', { name: 'Automatically enroll new' }).check();
+        await page.getByRole('checkbox', { name: 'Require new members' }).check();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Edited policy Account recovery');
    });
@@ -68,16 +66,18 @@ test('invited with new account', async ({ page }) => {
        await page.goto(link);
        await expect(page).toHaveTitle(/Create account | Vaultwarden Web/);
-        // await page.getByLabel('Name').fill(users.user2.name);
+        //await page.getByLabel('Name').fill(users.user2.name);
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
+        await page.getByLabel('Confirm master password (').fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Your new account has been created');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
        // Redirected to the vault
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
        // await utils.checkNotification(page, 'You have been logged in!');
        await utils.checkNotification(page, 'Successfully accepted your invitation');
    });
    await test.step('Check mails', async () => {
@@ -100,19 +100,21 @@ test('invited with existing account', async ({ page }) => {
    await page.getByRole('button', { name: 'Continue' }).click();
    // Unlock page
-    await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user3.password);
+    await page.getByLabel('Master password').fill(users.user3.password);
-    await page.getByRole('button', { name: 'Log in', exact: true }).click();
+    await page.getByRole('button', { name: 'Log in with master password' }).click();
    await utils.checkNotification(page, 'Invitation accepted');
    await utils.ignoreExtension(page);
    // We are now in the default vault page
    await expect(page).toHaveTitle(/Vaultwarden Web/);
    await utils.checkNotification(page, 'Successfully accepted your invitation');
    await mail3Buffer.expect((m) => m.subject === 'New Device Logged In From Firefox');
    await mail1Buffer.expect((m) => m.subject.includes('Invitation to Test accepted'));
 });
 test('Confirm invited user', async ({ page }) => {
-    await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
+    await logUser(test, page, users.user1, mail1Buffer);
    await orgs.members(test, page, 'Test');
    await orgs.confirm(test, page, 'Test', users.user2.email);
@@ -121,30 +123,25 @@ test('Confirm invited user', async ({ page }) => {
 });
 test('Organization is visible', async ({ page }) => {
-    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
+    await logUser(test, page, users.user2, mail2Buffer);
    await page.getByRole('button', { name: 'vault: Test', exact: true }).click();
    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
 });
 test('Recover user password', async ({ page }) => {
-    await logUser(test, page, users.user2, { mailBuffer: mail2Buffer });
+    await logUser(test, page, users.user1, mail1Buffer);
    await activateTOTP(test, page, users.user2);
    await logUser(test, page, users.user1, { mailBuffer: mail1Buffer });
    let newPassword = "TotoNewPassword";
    await orgs.members(test, page, 'Test');
-    await test.step(`Recover ${users.user2.email}`, async () => {
+    await test.step(`Rrcover ${users.user2.email}`, async () => {
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
        await page.getByRole('row').filter({hasText: users.user2.email}).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Recover account' }).click();
-        await page.getByRole('textbox', { name: 'New master password * (required)', exact: true }).fill(newPassword);
+        await page.getByRole('textbox', { name: 'New master password (required)', exact: true }).fill(newPassword);
-        await page.getByRole('textbox', { name: 'Confirm new master password * (' }).fill(newPassword);
+        await page.getByRole('textbox', { name: 'Confirm new master password (' }).fill(newPassword);
-        await page.getByRole('checkbox', { name: 'Reset two-step login' }).check();
+         await page.getByRole('button', { name: 'Save' }).click();
-        await page.getByRole('button', { name: 'Save' }).click();
+        await utils.checkNotification(page, 'Password reset success');
        await utils.checkNotification(page, 'Account recovery success');
        await mail2Buffer.expect((m) => m.subject.includes('Admin account recovery from Test organization'));
    });
    let user2 = {
@@ -152,9 +149,5 @@ test('Recover user password', async ({ page }) => {
        name: users.user2.name,
        password: newPassword,
    };
-    await logUser(test, page, user2, {
+    await logUser(test, page, user2, mail2Buffer);
        mailBuffer: mail2Buffer,
        mail2fa: true,
        notNewDevice: true,
    });
 });
@@ -1,110 +0,0 @@
 import { test, expect, type Page, type TestInfo } from '@playwright/test';
 import * as OTPAuth from "otpauth";
 import * as utils from "../global-utils";
 import { createAccount, logUser } from './setups/user';
 let users = utils.loadEnv();
 let totp;
 test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {});
    const context = await browser.newContext();
    const page = await context.newPage();
    await createAccount(test, page, users.user1);
    await context.close();
 });
 test.afterAll('Teardown', async ({}) => {
    utils.stopVault();
 });
 test('Password', async ({ context, page }, testInfo: TestInfo) => {
    const label = 'Test Password';
    await logUser(test, page, users.user1);
    await test.step('Create password entry', async () => {
        await page.getByRole('button', { name: 'New item' }).click();
        await page.getByRole('textbox', { name: 'Item name * (required)' }).fill(label);
        await page.getByRole('textbox', { name: 'Username' }).fill(users.user1.name);
        await page.getByRole('textbox', { name: 'Password' }).fill(users.user1.password);
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Item added');
        await page.getByRole('button', { name: 'Close' }).click();
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Check', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByRole('button', { name: label }).click();
        await page.getByTestId('copy-username').click();
        await utils.checkNotification(page, 'Username copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(users.user1.name)
        await page.getByTestId('copy-password').click();
        await utils.checkNotification(page, 'Password copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(users.user1.password)
        await page.getByRole('button', { name: 'Close' }).click();
    });
    await test.step('Delete', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Delete' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
        await utils.checkNotification(page, 'Item sent to bin');
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Deleted', async () => {
        await expect(page.getByRole('row').filter({ hasText: label })).toHaveCount(0)
    });
 });
 test('SSH Key', async ({ context, page }, testInfo: TestInfo) => {
    const label = 'Test SSH key';
    await logUser(test, page, users.user1);
    const privateKey = await test.step('Create key entry', async () => {
        await page.getByRole('button', { name: 'New', exact: true }).click();
        await page.getByRole('menuitem', { name: 'SSH key' }).click();
        await page.getByRole('textbox', { name: 'Item name * (required)' }).fill('Test SSH key');
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Item added');
        await page.getByRole('button', { name: 'Copy private key' }).click();
        await utils.checkNotification(page, 'Private key copied');
        return await page.evaluate(() => navigator.clipboard.readText());
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Check', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByRole('button', { name: label }).click();
        await page.getByRole('button', { name: 'Copy private key' }).click();
        await utils.checkNotification(page, 'Private key copied');
        expect(await page.evaluate(() => navigator.clipboard.readText())).toBe(privateKey)
        await page.getByRole('button', { name: 'Close' }).click();
    });
    await test.step('Delete', async () => {
        await page.getByRole('row').filter({ hasText: label }).getByLabel('Options').click();
        await page.getByRole('menuitem', { name: 'Delete' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
        await utils.checkNotification(page, 'Item sent to bin');
    });
    // Log again
    await logUser(test, page, users.user1);
    await test.step('Deleted', async () => {
        await expect(page.getByRole('row').filter({ hasText: label })).toHaveCount(0)
    })
 });
@@ -21,11 +21,11 @@ test('Send', async ({ browser, page }) => {
        await page.getByRole('link', { name: 'Send' }).click();
        await expect(page.locator('#main-content').getByText('Send', { exact: true })).toBeVisible();
-        await page.getByRole('button', { name: 'New Send', exact: true }).click();
+        await page.getByRole('button', { name: 'New', exact: true }).click();
        await page.getByRole('menuitem', { name: 'Text' }).click();
-        await page.getByRole('textbox', { name: 'Send name * (required)' }).fill('Test');
+        await page.getByRole('textbox', { name: 'Send name (required)' }).fill('Test');
-        await page.getByRole('textbox', { name: 'Text to share * (required)' }).fill('test');
+        await page.getByRole('textbox', { name: 'Text to share (required)' }).fill('test');
        await page.getByRole('button', { name: 'Save' }).click();
        await page.locator('footer').getByRole('button', { name: 'Copy link' }).click();
@@ -46,14 +46,14 @@ test('Send', async ({ browser, page }) => {
        await page.getByRole('link', { name: 'Send' }).click();
        await expect(page.locator('#main-content').getByText('Send', { exact: true })).toBeVisible();
-        await page.getByRole('button', { name: 'New' }).click();
+        await page.getByRole('button', { name: 'New', exact: true }).click();
        await page.getByRole('menuitem', { name: 'Text' }).click();
-        await page.getByRole('textbox', { name: 'Send name * (required)' }).fill('Password');
+        await page.getByRole('textbox', { name: 'Send name (required)' }).fill('Password');
-        await page.getByRole('textbox', { name: 'Text to share * (required)' }).fill('password');
+        await page.getByRole('textbox', { name: 'Text to share (required)' }).fill('password');
        await page.getByRole('combobox', { name: 'Who can view' }).click();
        await page.getByText('Anyone with a password set by you').click();
-        await page.getByRole('textbox', { name: 'Password * (required)', exact: true }).fill('password');
+        await page.getByRole('textbox', { name: 'Password (required)' }).fill('password');
        await page.getByRole('button', { name: 'Save' }).click();
        await page.locator('footer').getByRole('button', { name: 'Copy link' }).click();
@@ -64,7 +64,7 @@ test('Send', async ({ browser, page }) => {
    await test.step('View with password', async () => {
        await page2.goto(pwd_url, { waitUntil: 'domcontentloaded' });
        await expect(page2.getByRole('heading', { name: 'Enter the password to view' })).toBeVisible();
-        await page2.getByRole('textbox', { name: 'Password * (required)' }).fill('password');
+        await page2.getByRole('textbox', { name: 'Password (required)' }).fill('password');
        await page2.getByRole('button', { name: 'Continue' }).click();
        await expect(page2.getByRole('heading', { name: 'View Send' })).toBeVisible();
        await expect(await page2.getByRole('paragraph').filter({ hasText: 'Password' })).toBeVisible();
@@ -4,24 +4,6 @@ import * as OTPAuth from "otpauth";
 import * as utils from '../../global-utils';
 export async function recoveryCodes(test: Test, page: Page, user: { name: string, password: string }): string {
    return await test.step('Recovery code', async () => {
        await page.getByRole('button', { name: user.name }).click();
        await page.getByRole('menuitem', { name: 'Account settings' }).click();
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.getByRole('button', { name: 'View recovery code' }).click();
        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        const recovery = await page.getByRole('code').innerText();
        await page.getByLabel('Close').click();
        return recovery;
    })
 }
 export async function activateTOTP(test: Test, page: Page, user: { name: string, password: string }): OTPAuth.TOTP {
    return await test.step('Activate TOTP 2FA', async () => {
        await page.getByRole('button', { name: user.name }).click();
@@ -29,16 +11,16 @@ export async function activateTOTP(test: Test, page: Page, user: { name: string,
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
-        const secret = await page.getByLabel('Key', { exact: true }).innerText();
+        const secret = await page.getByLabel('Key').innerText();
        let totp = new OTPAuth.TOTP({ secret, period: 30 });
        await page.getByLabel(/Verification code/).fill(totp.generate());
        await page.getByRole('button', { name: 'Turn on' }).click();
        await page.getByRole('heading', { name: 'Turned on', exact: true });
        await page.getByLabel('Close').click();
        return totp;
    })
@@ -51,8 +33,8 @@ export async function disableTOTP(test: Test, page: Page, user: { password: stri
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: /Authenticator app/ }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).click()
+        await page.getByLabel('Master password (required)').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Turn off' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
@@ -67,7 +49,7 @@ export async function activateEmail(test: Test, page: Page, user: { name: string
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: 'Enter a code sent to your email' }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Send email' }).click();
    });
@@ -99,8 +81,8 @@ export async function disableEmail(test: Test, page: Page, user: { password: str
        await page.getByRole('link', { name: 'Security' }).click();
        await page.getByRole('link', { name: 'Two-step login' }).click();
        await page.locator('bit-item').filter({ hasText: 'Email' }).getByRole('button').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).click()
+        await page.getByLabel('Master password (required)').click();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)').fill(user.password);
        await page.getByRole('button', { name: 'Continue' }).click();
        await page.getByRole('button', { name: 'Turn off' }).click();
        await page.getByRole('button', { name: 'Yes' }).click();
@@ -1,21 +0,0 @@
 import { expect, type Browser, Page } from '@playwright/test';
 import * as utils from '../../global-utils';
 utils.loadEnv();
 export async function login(test, page: Page) {
    await test.step(`Admin login`, async () => {
        await page.goto('/admin');
        await page.getByRole('textbox', { name: 'Enter admin token' }).fill(process.env.ADMIN_TOKEN);
        await page.getByRole('button', { name: 'Enter' }).click();
    });
 }
 export async function invite(test, page: Page, email: string) {
    await test.step(`Invite user with ${email}`, async () => {
        await page.getByRole('link', { name: 'Users' }).click();
        await page.getByRole('textbox', { name: 'Enter email' }).fill(email);
        await page.getByRole('button', { name: 'Invite' }).click();
        await expect(page.getByRole('row', { name: email })).toHaveText(/Invited/);
    });
 }
@@ -5,7 +5,7 @@ const utils = require('../../global-utils');
 utils.loadEnv();
 test('DB teardown ?', async ({ serviceName }) => {
-    if( process.env.PW_KEEP_SERVICE_RUNNING !== "true" ) {
+    if( process.env.PW_KEEP_SERVICE_RUNNNING !== "true" ) {
        utils.stopComposeService(serviceName);
    }
 });
@@ -3,14 +3,11 @@ import { expect, type Browser,Page } from '@playwright/test';
 import * as utils from '../../global-utils';
 export async function create(test, page: Page, name: string) {
-    await test.step(`Create Org ${name}`, async () => {
+    await test.step('Create Org', async () => {
-        let pm_locator = page.locator('a').filter({ hasText: 'Password Manager' });
+        await page.locator('a').filter({ hasText: 'Password Manager' }).first().click();
        if( await pm_locator.count() > 0 ){
            pm_locator.first().click();
        }
        await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        await page.getByRole('link', { name: 'New organisation' }).click();
-        await page.getByRole('textbox', { name: 'Organisation name * (required)', exact: true }).fill(name);
+        await page.getByLabel('Organisation name (required)').fill(name);
        await page.getByRole('button', { name: 'Submit' }).click();
        await utils.checkNotification(page, 'Organisation created');
@@ -21,7 +18,7 @@ export async function policies(test, page: Page, name: string) {
    await test.step(`Navigate to ${name} policies`, async () => {
        await page.locator('a').filter({ hasText: 'Admin Console' }).first().click();
        await page.locator('org-switcher').getByLabel(/Toggle collapse/).click();
-        await page.locator('org-switcher > bit-nav-group > div > bit-nav-item').filter({ hasText: `${name}` }).first().click();
+        await page.locator('org-switcher').getByRole('link', { name: `${name}` }).first().click();
        await expect(page.getByRole('heading', { name: `${name} collections` })).toBeVisible();
        await page.getByRole('button', { name: 'Toggle collapse Settings' }).click();
        await page.getByRole('link', { name: 'Policies' }).click();
@@ -33,11 +30,11 @@ export async function members(test, page: Page, name: string) {
    await test.step(`Navigate to ${name} members`, async () => {
        await page.locator('a').filter({ hasText: 'Admin Console' }).first().click();
        await page.locator('org-switcher').getByLabel(/Toggle collapse/).click();
-        await page.locator('org-switcher > bit-nav-group > div > bit-nav-item').filter({ hasText: `${name}` }).first().click();
+        await page.locator('org-switcher').getByRole('link', { name: `${name}` }).first().click();
        await expect(page.getByRole('heading', { name: `${name} collections` })).toBeVisible();
-        await page.getByRole('link', { name: 'Members' }).click();
+        await page.locator('div').filter({ hasText: 'Members' }).nth(2).click();
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
-        await expect(page.getByRole('columnheader', { name: 'Select all' })).toBeVisible();
+        await expect(page.getByRole('cell', { name: 'All' })).toBeVisible();
    });
 }
@@ -45,13 +42,13 @@ export async function invite(test, page: Page, name: string, email: string) {
    await test.step(`Invite ${email}`, async () => {
        await expect(page.getByRole('heading', { name: 'Members' })).toBeVisible();
        await page.getByRole('button', { name: 'Invite member' }).click();
-        await page.getByRole('textbox', { name: 'Email * (required)', exact: true }).fill(email);
+        await page.getByLabel('Email (required)').fill(email);
        await page.getByRole('tab', { name: 'Collections' }).click();
        await page.getByRole('combobox', { name: 'Permission' }).click();
        await page.getByText('Edit items', { exact: true }).click();
-        await page.getByRole('combobox', { name: 'Select collections' }).click();
+        await page.getByLabel('Select collections').click();
-        await page.getByLabel('Options List').getByText('Default collection').click();
+        await page.getByText('Default collection').click();
-        await page.getByRole('columnheader', { name: 'Collection', exact: true }).click();
+        await page.getByRole('cell', { name: 'Collection', exact: true }).click();
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'User(s) invited');
    });
@@ -6,7 +6,7 @@ const utils = require('../../global-utils');
 utils.loadEnv();
 test('Keycloak teardown', async () => {
-    if( process.env.PW_KEEP_SERVICE_RUNNING === "true" ) {
+    if( process.env.PW_KEEP_SERVICE_RUNNNING === "true" ) {
        console.log("Keep Keycloak running");
    } else {
        console.log("Keycloak stopping");
@@ -15,8 +15,11 @@ export async function logNewUser(
    options: { mailBuffer?: MailBuffer } = {}
 ) {
    await test.step(`Create user ${user.name}`, async () => {
        await page.context().clearCookies();
        await test.step('Landing page', async () => {
            await utils.cleanLanding(page);
            await page.locator("input[type=email].vw-email-sso").fill(user.email);
            await page.getByRole('button', { name: /Use single sign-on/ }).click();
        });
@@ -30,24 +33,26 @@ export async function logNewUser(
        await test.step('Create Vault account', async () => {
            await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-            await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+            await page.getByLabel('Master password (required)', { exact: true }).fill(user.password);
-            await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(user.password);
+            await page.getByLabel('Confirm master password (').fill(user.password);
            await page.getByRole('button', { name: 'Create account' }).click();
        });
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
        await test.step('Default vault page', async () => {
            await expect(page).toHaveTitle(/Vaultwarden Web/);
            await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        });
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        if( options.mailBuffer ){
            let mailBuffer = options.mailBuffer;
            await test.step('Check emails', async () => {
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
                await mailBuffer.expect((m) => m.subject === "Welcome");
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
            });
        }
    });
@@ -64,14 +69,16 @@ export async function logUser(
        mailBuffer ?: MailBuffer,
        totp?: OTPAuth.TOTP,
        mail2fa?: boolean,
        notNewDevice?: boolean,
    } = {}
 ) {
    let mailBuffer = options.mailBuffer;
    await test.step(`Log user ${user.email}`, async () => {
        await page.context().clearCookies();
        await test.step('Landing page', async () => {
            await utils.cleanLanding(page);
            await page.locator("input[type=email].vw-email-sso").fill(user.email);
            await page.getByRole('button', { name: /Use single sign-on/ }).click();
        });
@@ -110,12 +117,14 @@ export async function logUser(
            await page.getByRole('button', { name: 'Unlock' }).click();
        });
        await utils.ignoreExtension(page);
        await test.step('Default vault page', async () => {
            await expect(page).toHaveTitle(/Vaultwarden Web/);
            await expect(page.getByTitle('All vaults', { exact: true })).toBeVisible();
        });
-        if( mailBuffer && !options.notNewDevice ){
+        if( mailBuffer ){
            await test.step('Check email', async () => {
                await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
            });
@@ -2,9 +2,7 @@ import { expect, type Browser, Page } from '@playwright/test';
 import { type MailBuffer } from 'maildev';
 import * as OTPAuth from "otpauth";
 import * as utils from '../../global-utils';
 import { retrieveEmailCode } from './2fa';
 export async function createAccount(test, page: Page, user: { email: string, name: string, password: string }, mailBuffer?: MailBuffer) {
    await test.step(`Create user ${user.name}`, async () => {
@@ -19,11 +17,12 @@ export async function createAccount(test, page: Page, user: { email: string, nam
        await page.getByRole('button', { name: 'Continue' }).click();
        // Vault finish Creation
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(user.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(user.password);
+        await page.getByLabel('Confirm master password (').fill(user.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Your new account has been created')
        await utils.ignoreExtension(page);
        // We are now in the default vault page
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
@@ -36,17 +35,7 @@ export async function createAccount(test, page: Page, user: { email: string, nam
    });
 }
-export async function logUser(
+export async function logUser(test, page: Page, user: { email: string, password: string }, mailBuffer?: MailBuffer) {
    test,
    page: Page,
    user: { email: string, password: string },
    options: {
        mailBuffer ?: MailBuffer,
        mail2fa?: boolean,
        notNewDevice?: boolean,
        totp?: OTPAuth.TOTP,
    } = {}
 ) {
    await test.step(`Log user ${user.email}`, async () => {
        await utils.cleanLanding(page);
@@ -54,35 +43,16 @@ export async function logUser(
        await page.getByRole('button', { name: 'Continue' }).click();
        // Unlock page
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(user.password);
+        await page.getByLabel('Master password').fill(user.password);
-        await page.getByRole('button', { name: 'Log in', exact: true }).click();
+        await page.getByRole('button', { name: 'Log in with master password' }).click();
-        if( options.mail2fa || options.totp ){
+        await utils.ignoreExtension(page);
            let code;
            await test.step('2FA check', async () => {
                await expect(page.getByRole('heading', { name: 'Verify your Identity' })).toBeVisible();
                if( options.totp ) {
                    const totp = options.totp;
                    let timestamp = Date.now(); // Needed to use the next token
                    timestamp = timestamp + (totp.period - (Math.floor(timestamp / 1000) % totp.period) + 1) * 1000;
                    code = totp.generate({timestamp});
                } else if( options.mail2fa ){
                    code = await retrieveEmailCode(test, page, options.mailBuffer);
                }
                await page.getByLabel(/Verification code/).fill(code);
                await page.getByRole('button', { name: 'Continue' }).click();
            });
        }
        // We are now in the default vault page
        await expect(page).toHaveTitle(/Vaultwarden Web/);
-        if( options.mailBuffer && !options.notNewDevice ){
+        if( mailBuffer ){
-            await options.mailBuffer.expect((m) => m.subject === "New Device Logged In From Firefox");
+            await mailBuffer.expect((m) => m.subject === "New Device Logged In From Firefox");
        }
    });
 }
@@ -1,7 +1,6 @@
 import { test, expect, type TestInfo } from '@playwright/test';
 import { MailDev } from 'maildev';
 import * as admin from "./setups/admin";
 import { logNewUser, logUser } from './setups/sso';
 import { activateEmail, disableEmail } from './setups/2fa';
 import * as utils from "../global-utils";
@@ -20,7 +19,7 @@ test.beforeAll('Setup', async ({ browser }, testInfo: TestInfo) => {
    await utils.startVault(browser, testInfo, {
        SSO_ENABLED: true,
-        SSO_ONLY: true,
+        SSO_ONLY: false,
        SMTP_HOST: process.env.MAILDEV_HOST,
        SMTP_FROM: process.env.PW_SMTP_FROM,
    });
@@ -33,64 +32,22 @@ test.afterAll('Teardown', async ({}) => {
    }
 });
-test('2FA email', async ({ page }) => {
+test('Create and activate 2FA', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
    await logNewUser(test, page, users.user1, {mailBuffer: mailBuffer});
    await activateEmail(test, page, users.user1, mailBuffer);
-    await logUser(test, page, users.user1, {mailBuffer: mailBuffer, mail2fa: true, notNewDevice: true});
+    mailBuffer.close();
 });
 test('Log and disable', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user1.email);
    await logUser(test, page, users.user1, {mailBuffer: mailBuffer, mail2fa: true});
    await disableEmail(test, page, users.user1);
    mailBuffer.close();
 });
 test('Admin invite', async ({ page }) => {
    const mailBuffer = mailserver.buffer(users.user2.email);
    await admin.login(test, page);
    await admin.invite(test, page, users.user2.email);
    const link = await test.step('Extract email link', async () => {
        const invited = await mailBuffer.expect((m) => m.subject === "Join Vaultwarden");
        await page.setContent(invited.html);
        return await page.getByTestId("invite").getAttribute("href");
    });
    await test.step('Redirect to Keycloak', async () => {
        await page.goto(link);
    });
    await test.step('Keycloak login', async () => {
        await expect(page.getByRole('heading', { name: 'Sign in to your account' })).toBeVisible();
        await page.getByLabel(/Username/).fill(users.user2.name);
        await page.getByLabel('Password', { exact: true }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Sign In' }).click();
    });
    await test.step('Create Vault account', async () => {
        await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle('Vaults | Vaultwarden Web');
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
    });
    await test.step('Check mails', async () => {
        await mailBuffer.expect((m) => m.subject.includes("New Device Logged"));
        await mailBuffer.expect((m) => m.subject === "Welcome");
    });
    mailBuffer.close();
 });
@@ -33,8 +33,8 @@ test('Non SSO login', async ({ page }) => {
    await page.getByRole('button', { name: 'Other' }).click();
    // Unlock page
-    await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user1.password);
+    await page.getByLabel('Master password').fill(users.user1.password);
-    await page.getByRole('button', { name: 'Log in', exact: true }).click();
+    await page.getByRole('button', { name: 'Log in with master password' }).click();
    // We are now in the default vault page
    await expect(page).toHaveTitle(/Vaultwarden Web/);
@@ -58,7 +58,6 @@ test('Non SSO login impossible', async ({ page, browser }, testInfo: TestInfo) =
    // Landing page
    await page.goto('/');
    await page.locator("input[type=email].vw-email-sso").fill(users.user1.email);
    // Check that SSO login is available
    await expect(page.getByRole('button', { name: /Use single sign-on/ })).toHaveCount(1);
@@ -67,6 +66,7 @@ test('Non SSO login impossible', async ({ page, browser }, testInfo: TestInfo) =
    await expect(page.getByRole('button', { name: 'Other' })).toHaveCount(0);
 });
 test('No SSO login', async ({ page }, testInfo: TestInfo) => {
    await utils.restartVault(page, testInfo, {
        SSO_ENABLED: false
@@ -74,14 +74,12 @@ test('No SSO login', async ({ page }, testInfo: TestInfo) => {
    // Landing page
    await page.goto('/');
    await page.getByLabel(/Email address/).fill(users.user1.email);
    // No SSO button (rely on a correct selector checked in previous test)
    await page.getByLabel('Master password');
    await expect(page.getByRole('button', { name: /Use single sign-on/ })).toHaveCount(0);
    // Can continue to Master password
    await page.getByLabel(/Email address/).fill(users.user1.email);
    await page.getByRole('button', { name: 'Continue' }).click();
-    await expect(page.getByRole('button', { name: 'Log in' })).toHaveCount(1);
+    await expect(page.getByRole('button', { name: 'Log in with master password' })).toHaveCount(1);
 });
@@ -67,16 +67,17 @@ test('invited with new account', async ({ page }) => {
    await test.step('Create Vault account', async () => {
        await expect(page.getByRole('heading', { name: 'Join organisation' })).toBeVisible();
-        await page.getByRole('textbox', { name: 'Master password * (required)', exact: true }).fill(users.user2.password);
+        await page.getByLabel('Master password (required)', { exact: true }).fill(users.user2.password);
-        await page.getByRole('textbox', { name: 'Confirm master password * (' }).fill(users.user2.password);
+        await page.getByLabel('Confirm master password (').fill(users.user2.password);
        await page.getByRole('button', { name: 'Create account' }).click();
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle(/Vaultwarden Web/);
        await utils.checkNotification(page, 'Account successfully created!');
        await utils.checkNotification(page, 'Invitation accepted');
    });
    await test.step('Check mails', async () => {
@@ -94,7 +95,6 @@ test('invited with existing account', async ({ page }) => {
    await test.step('Redirect to Keycloak', async () => {
        await page.goto(link);
        await page.getByRole('button', { name: /Use single sign-on/ }).click();
    });
    await test.step('Keycloak login', async () => {
@@ -108,11 +108,13 @@ test('invited with existing account', async ({ page }) => {
        await expect(page).toHaveTitle('Vaultwarden Web');
        await page.getByLabel('Master password').fill(users.user3.password);
        await page.getByRole('button', { name: 'Unlock' }).click();
        await utils.checkNotification(page, 'Invitation accepted');
        await utils.ignoreExtension(page);
    });
    await test.step('Default vault page', async () => {
        await expect(page).toHaveTitle(/Vaultwarden Web/);
        await utils.checkNotification(page, 'Successfully accepted your invitation');
    });
    await test.step('Check mails', async () => {
@@ -49,7 +49,7 @@ test('Organization is visible', async ({ page }) => {
    await expect(page.getByLabel('Filter: Default collection')).toBeVisible();
 });
-test('Activate password policy', async ({ page }) => {
+test('Enforce password policy', async ({ page }) => {
    await logUser(test, page, users.user1);
    await orgs.policies(test, page, '/Test');
@@ -61,27 +61,16 @@ test('Activate password policy', async ({ page }) => {
        await page.getByRole('button', { name: 'Save' }).click();
        await utils.checkNotification(page, 'Edited policy Master password requirements.');
    });
 });
-test('Unlock trigger policyy', async ({ page }) => {
+    await utils.logout(test, page, users.user1);
    await page.goto('/', { waitUntil: 'domcontentloaded' });
-    await page.locator("input[type=email].vw-email-sso").fill(users.user2.email);
+    await test.step(`Unlock trigger policy`, async () => {
-    await page.getByRole('button', { name: /Use single sign-on/ }).click();
+        await page.locator("input[type=email].vw-email-sso").fill(users.user1.email);
        await page.getByRole('button', { name: 'Use single sign-on' }).click();
-    await test.step('Keycloak login', async () => {
+        await page.getByRole('textbox', { name: 'Master password (required)' }).fill(users.user1.password);
        await expect(page.getByRole('heading', { name: 'Sign in to your account' })).toBeVisible();
        await page.getByLabel(/Username/).fill(users.user2.name);
        await page.getByLabel('Password', { exact: true }).fill(users.user2.password);
        await page.getByRole('button', { name: 'Sign In' }).click();
    });
    await test.step('Unlock vault', async () => {
        await expect(page).toHaveTitle('Vaultwarden Web');
        await expect(page.getByRole('heading', { name: 'Your vault is locked' })).toBeVisible();
        await page.getByLabel('Master password').fill(users.user2.password);
        await page.getByRole('button', { name: 'Unlock' }).click();
    });
-    await expect(page.getByRole('heading', { name: 'Update master password' })).toBeVisible();
+        await expect(page.getByRole('heading', { name: 'Update master password' })).toBeVisible();
    });
 });
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.99.1"
+channel = "1.96.1"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, env, sync::LazyLock};
+use std::{env, sync::LazyLock};
 use reqwest::Method;
 use rocket::{
@@ -17,7 +17,7 @@ use crate::{
    api::{
        ApiResult, EmptyResult, JsonResult, Notify,
        core::{log_event, two_factor},
-        push_logout_to_relay, unregister_push_device,
+        unregister_push_device,
    },
    auth::{ClientIp, Secure, decode_admin, encode_jwt, generate_admin_claims},
    config::ConfigBuilder,
@@ -26,7 +26,6 @@ use crate::{
        models::{
            Attachment, Cipher, Collection, Device, Event, EventType, Group, Invitation, Membership, MembershipId,
            MembershipType, OrgPolicy, Organization, OrganizationId, SsoUser, TwoFactor, User, UserId,
            custom_roles_enabled,
        },
    },
    error::{Error, MapResult},
@@ -202,15 +201,12 @@ fn post_admin_login(
    // If the token is invalid, redirect to login page
    if validate_token(&data.token) {
        // If the token received is valid, generate JWT and save it as a cookie
-        let claims = match generate_admin_claims() {
+        let claims = generate_admin_claims();
            Ok(claims) => claims,
            Err(e) => return Err(AdminResponse::Ok(render_admin_login(Some(e.message()), redirect.as_deref()))),
        };
        let jwt = encode_jwt(&claims);
        let cookie = Cookie::build((COOKIE_NAME, jwt))
            .path(admin_path())
-            .max_age(time::Duration::minutes(i64::from(CONFIG.admin_session_lifetime())))
+            .max_age(time::Duration::minutes(CONFIG.admin_session_lifetime()))
            .same_site(SameSite::Strict)
            .http_only(true)
            .secure(secure.https);
@@ -235,7 +231,7 @@ fn validate_token(token: &str) -> bool {
        None => false,
        Some(t) if t.starts_with("$argon2") => {
            use argon2::password_hash::PasswordVerifier;
-            match argon2::password_hash::phc::PasswordHash::new(t) {
+            match argon2::password_hash::PasswordHash::new(t) {
                Ok(h) => {
                    // NOTE: hash params from `ADMIN_TOKEN` are used instead of what is configured in the `Argon2` instance.
                    argon2::Argon2::default().verify_password(token.trim().as_ref(), &h).is_ok()
@@ -257,7 +253,6 @@ struct AdminTemplateData {
    logged_in: bool,
    urlpath: String,
    sso_enabled: bool,
    custom_roles_enabled: bool,
 }
 impl AdminTemplateData {
@@ -268,7 +263,6 @@ impl AdminTemplateData {
            logged_in: true,
            urlpath: CONFIG.domain_path(),
            sso_enabled: CONFIG.sso_enabled(),
            custom_roles_enabled: custom_roles_enabled(),
        }
    }
@@ -393,18 +387,6 @@ async fn users_overview(_token: AdminToken, conn: DbConn) -> ApiResult<Html<Stri
        usr["sso_identifier"] = json!(sso_u.map_or(String::new(), |u| u.identifier.to_string()));
        // The clients are shown a Manager as a Custom member, but the admin panel tells the two roles apart
        let roles: HashMap<String, i32> = Membership::find_confirmed_by_user(&u.uuid, &conn)
            .await
            .into_iter()
            .map(|member| (member.org_uuid.to_string(), member.atype))
            .collect();
        for org in usr["organizations"].as_array_mut().into_iter().flatten() {
            if let Some(atype) = org["id"].as_str().and_then(|org_id| roles.get(org_id)) {
                org["type"] = json!(atype);
            }
        }
        users_json.push(usr);
    }
@@ -434,24 +416,16 @@ async fn get_user_json(user_id: UserId, _token: AdminToken, conn: DbConn) -> Jso
 }
 #[post("/users/<user_id>/delete", format = "application/json")]
-async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+async fn delete_user(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
    let user = get_user_or_404(&user_id, &conn).await?;
-    // Get the membership records and push devices before deleting the actual user
+    // Get the membership records before deleting the actual user
    let memberships = Membership::find_any_state_by_user(&user_id, &conn).await;
    let has_push_device = CONFIG.push_enabled() && Device::check_user_has_push_device(&user_id, &conn).await;
    let res = user.delete(&conn).await;
    if res.is_ok() {
        nt.send_logout(&user, None, &conn).await;
        if has_push_device {
            push_logout_to_relay(&user, None);
        }
    }
    for membership in memberships {
        log_event(
-            EventType::OrganizationUserDeleted,
+            EventType::OrganizationUserDeleted as i32,
            &membership.uuid,
            &membership.org_uuid,
            &ACTING_ADMIN_USER.into(),
@@ -472,7 +446,7 @@ async fn delete_sso_user(user_id: UserId, token: AdminToken, conn: DbConn) -> Em
    for membership in memberships {
        log_event(
-            EventType::OrganizationUserUnlinkedSso,
+            EventType::OrganizationUserUnlinkedSso as i32,
            &membership.uuid,
            &membership.org_uuid,
            &ACTING_ADMIN_USER.into(),
@@ -534,7 +508,6 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty
 async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
    let mut user = get_user_or_404(&user_id, &conn).await?;
    TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
    Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
    two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?;
    user.totp_recover = None;
    user.save(&conn).await
@@ -580,14 +553,10 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
        err!("The specified user isn't member of the organization")
    };
-    let new_type = match MembershipType::from_str(&data.user_type.into_string()) {
+    let new_type = if let Some(new_type) = MembershipType::from_str(&data.user_type.into_string()) {
-        // Unlike the clients, the admin panel tells the Custom and the legacy Manager role apart. Unless Custom roles
+        new_type as i32
-        // are enabled, a Custom role is a Manager here as well, but an existing Custom member is kept as one.
+    } else {
-        Some(MembershipType::Custom) if !custom_roles_enabled() && !member_to_edit.has_type(MembershipType::Custom) => {
+        err!("Invalid type")
            MembershipType::Manager
        }
        Some(new_type) => new_type,
        None => err!("Invalid type"),
    };
    if member_to_edit.atype == MembershipType::Owner && new_type != MembershipType::Owner {
@@ -597,19 +566,12 @@ async fn update_membership_type(data: Json<MembershipTypeData>, token: AdminToke
        }
    }
-    // A Manager only becomes a Custom member if that changes nothing they may do
+    member_to_edit.atype = new_type;
    if new_type == MembershipType::Custom
        && let Some(loss) = member_to_edit.custom_role_conversion_loss(&conn).await
    {
        err!(loss)
    }
    member_to_edit.set_type(new_type);
    // This check is also done at api::organizations::{accept_invite, _confirm_invite, _activate_member, edit_member}, update_membership_type
    OrgPolicy::check_user_allowed(&member_to_edit, "modify", &conn).await?;
    log_event(
-        EventType::OrganizationUserUpdated,
+        EventType::OrganizationUserUpdated as i32,
        &member_to_edit.uuid,
        &data.org_uuid,
        &ACTING_ADMIN_USER.into(),
@@ -685,7 +647,7 @@ use cached::macros::cached;
 /// Cache this function to prevent API call rate limit. Github only allows 60 requests per hour, and we use 3 here already
 /// It will cache this function for 600 seconds (10 minutes) which should prevent the exhaustion of the rate limit
 /// Any cache will be lost if Vaultwarden is restarted
-#[cached(ttl_secs = 600, sync_writes = "default")]
+#[cached(ttl = 600, sync_writes = "default")]
 async fn get_release_info(has_http_access: bool) -> (String, String, String) {
    // If the HTTP Check failed, do not even attempt to check for new versions since we were not able to connect with github.com anyway.
    if has_http_access {
@@ -754,36 +716,6 @@ fn web_vault_compare(active: &str, latest: &str) -> i8 {
    }
 }
 fn check_template_overrides() -> Vec<&'static str> {
    let template_folder = std::path::PathBuf::from(CONFIG.templates_folder());
    let mut overrides = Vec::new();
    for folder in ["admin", "email", "scss"] {
        if folder_has_hbs_files(&template_folder.join(folder)) {
            overrides.push(folder);
        }
    }
    if folder_has_hbs_files(&template_folder) {
        overrides.push("other");
    }
    overrides
 }
 fn folder_has_hbs_files(dir: &std::path::Path) -> bool {
    let Ok(files) = std::fs::read_dir(dir) else {
        // No files in this directory at all, so we can return false
        return false;
    };
    files.flatten().any(|f| {
        // Validate if it is a file and if it has the `.hbs` extension and starts with a-z or 0-9
        f.file_type().is_ok_and(|t| t.is_file())
            && f.path().extension().is_some_and(|e| e.eq_ignore_ascii_case("hbs"))
            && f.file_name().to_str().is_some_and(|n| n.starts_with(|c: char| c.is_ascii_alphanumeric()))
    })
 }
 #[get("/diagnostics")]
 async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> ApiResult<Html<String>> {
    use chrono::prelude::*;
@@ -816,8 +748,6 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
    .into_keys()
    .collect();
    let invalid_env_vars = crate::util::INVALID_ENV_VARS.lock().unwrap().join(", ");
    let diagnostics_json = json!({
        "dns_resolved": dns_resolved,
        "current_release": VERSION,
@@ -840,9 +770,6 @@ async fn diagnostics(_token: AdminToken, ip_header: IpHeader, conn: DbConn) -> A
        "db_version": get_sql_server_version(&conn).await,
        "admin_url": format!("{}/diagnostics", admin_url()),
        "overrides": &CONFIG.get_overrides().join(", "),
        "config_file_status": &CONFIG.get_config_file_status(),
        "template_overrides": check_template_overrides().join(", "),
        "invalid_env_vars": invalid_env_vars,
        "invalid_feature_flags": invalid_feature_flags,
        "host_arch": env::consts::ARCH,
        "host_os":  env::consts::OS,
@@ -947,23 +874,23 @@ mod tests {
    fn validate_web_vault_compare() {
        // web_vault_compare(active, latest)
        // Test normal versions
-        assert_eq!(web_vault_compare("2025.12.0", "2025.12.1"), -1);
+        assert!(web_vault_compare("2025.12.0", "2025.12.1") == -1);
-        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1"), 0);
+        assert!(web_vault_compare("2025.12.1", "2025.12.1") == 0);
-        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1"), 1);
+        assert!(web_vault_compare("2025.12.2", "2025.12.1") == 1);
        // Test patched/+build.n versions
        // Newer latest version
-        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1"), -1);
+        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1") == -1);
-        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1+build.1"), -1);
+        assert!(web_vault_compare("2025.12.1", "2025.12.1+build.1") == -1);
-        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1"), -1);
+        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1") == -1);
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2"), -1);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2") == -1);
        // Equal versions
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1"), 0);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1") == 0);
-        assert_eq!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2"), 0);
+        assert!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2") == 0);
        // Newer active version
-        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1"), 1);
+        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1") == 1);
-        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1+build.1"), 1);
+        assert!(web_vault_compare("2025.12.2", "2025.12.1+build.1") == 1);
-        assert_eq!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1"), 1);
+        assert!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1") == 1);
-        assert_eq!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2"), 1);
+        assert!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2") == 1);
    }
 }
@@ -1,4 +1,4 @@
-use chrono::Utc;
+use chrono::{TimeDelta, Utc};
 use rocket::{Route, serde::json::Json};
 use serde_json::Value;
@@ -6,17 +6,14 @@ use crate::{
    CONFIG,
    api::{
        EmptyResult, JsonResult,
-        core::{
+        core::{CipherSyncData, CipherSyncType},
            CipherSyncData, CipherSyncType,
            accounts::{AuthenticationData, UnlockData},
        },
    },
    auth::{Headers, decode_emergency_access_invite},
    db::{
        DbConn, DbPool,
        models::{
-            Cipher, EMERGENCY_ACCESS_TIMEOUT_RANGE, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus,
+            Cipher, EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType, Invitation,
-            EmergencyAccessType, Invitation, Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
+            Membership, MembershipType, OrgPolicy, TwoFactor, User, UserId,
        },
    },
    mail,
@@ -136,21 +133,19 @@ async fn post_emergency_access(
    let data: EmergencyAccessUpdateData = data.into_inner();
    let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
        err!("Invalid emergency access type.")
    };
    if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&data.wait_time_days) {
        err!("Emergency access wait time is out-of-bounds!")
    }
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
    else {
        err!("Emergency access not valid.")
    };
-    emergency_access.atype = new_type as i32;
+    let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
        new_type as i32
    } else {
        err!("Invalid emergency access type.")
    };
    emergency_access.atype = new_type;
    emergency_access.wait_time_days = data.wait_time_days;
    if data.key_encrypted.is_some() {
        emergency_access.key_encrypted = data.key_encrypted;
@@ -212,11 +207,11 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
    let email = data.email.to_lowercase();
    let wait_time_days = data.wait_time_days;
-    if !(EMERGENCY_ACCESS_TIMEOUT_RANGE).contains(&wait_time_days) {
+    let emergency_access_status = EmergencyAccessStatus::Invited as i32;
        err!("Emergency access wait time is out-of-bounds!")
    }
-    let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) else {
+    let new_type = if let Some(new_type) = EmergencyAccessType::from_str(&data.r#type.into_string()) {
        new_type as i32
    } else {
        err!("Invalid emergency access type.")
    };
@@ -230,7 +225,7 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
    let (grantee_user, new_user) = match User::find_by_mail(&email, &conn).await {
        None => {
            if !CONFIG.invitations_allowed() {
-                err!(format!("Grantee user does not exist: {}", email.escape_debug()))
+                err!(format!("Grantee user does not exist: {email}"))
            }
            if !CONFIG.is_email_domain_allowed(&email) {
@@ -262,8 +257,6 @@ async fn send_invite(data: Json<EmergencyAccessInviteData>, headers: Headers, co
        err!(format!("Grantee user already invited: {}", &grantee_user.email))
    }
    let new_type = new_type as i32;
    let emergency_access_status = EmergencyAccessStatus::Invited as i32;
    let mut new_emergency_access =
        EmergencyAccess::new(grantor_user.uuid, grantee_user.email, emergency_access_status, new_type, wait_time_days);
    new_emergency_access.save(&conn).await?;
@@ -296,7 +289,7 @@ async fn resend_invite(emer_id: EmergencyAccessId, headers: Headers, conn: DbCon
    };
    if emergency_access.status != EmergencyAccessStatus::Invited as i32 {
-        err!("The grantee user is already accepted or confirmed for emergency access");
+        err!("The grantee user is already accepted or confirmed to the organization");
    }
    let Some(email) = emergency_access.email.clone() else {
@@ -457,24 +450,11 @@ async fn initiate_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantee_uuid(&emer_id, &initiating_user.uuid, &conn).await
    else {
-        err!(
+        err!("Emergency access not valid.")
            "Emergency access not valid.",
            format!("Emergency access '{emer_id}', not found for user '{}'.", initiating_user.email)
        )
    };
    if emergency_access.status != EmergencyAccessStatus::Confirmed as i32 {
-        err!(
+        err!("Emergency access not valid.")
            "Emergency access not valid.",
            format!("Emergency access '{emer_id}', not confirmed for user '{}'.", initiating_user.email)
        )
    }
    if !EMERGENCY_ACCESS_TIMEOUT_RANGE.contains(&emergency_access.wait_time_days) {
        err!(
            "Emergency access not valid.",
            format!("Emergency access '{emer_id}' timeout range '{}' is invalid", emergency_access.wait_time_days)
        )
    }
    let Some(grantor_user) = User::find_by_uuid(&emergency_access.grantor_uuid, &conn).await else {
@@ -507,17 +487,11 @@ async fn approve_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
    let Some(mut emergency_access) =
        EmergencyAccess::find_by_uuid_and_grantor_uuid(&emer_id, &headers.user.uuid, &conn).await
    else {
-        err!(
+        err!("Emergency access not valid.")
            "Emergency access not valid.",
            format!("Emergency access '{emer_id}', not found for user '{}'.", headers.user.email)
        )
    };
    if emergency_access.status != EmergencyAccessStatus::RecoveryInitiated as i32 {
-        err!(
+        err!("Emergency access not valid.")
            "Emergency access not valid.",
            format!("Emergency access '{emer_id}', not initiated for user '{}'.", headers.user.email)
        )
    }
    let Some(grantor_user) = User::find_by_uuid(&headers.user.uuid, &conn).await else {
@@ -641,7 +615,6 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
        "kdfMemory": grantor_user.client_kdf_memory,
        "kdfParallelism": grantor_user.client_kdf_parallelism,
        "keyEncrypted": &emergency_access.key_encrypted,
        "salt": grantor_user.master_password_salt(),
        "object": "emergencyAccessTakeover",
    });
@@ -651,13 +624,8 @@ async fn takeover_emergency_access(emer_id: EmergencyAccessId, headers: Headers,
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct EmergencyAccessPasswordData {
-    // Legacy payload
+    new_master_password_hash: String,
-    new_master_password_hash: Option<String>,
+    key: String,
    key: Option<String>,
    // Current payload
    authentication_data: Option<AuthenticationData>,
    unlock_data: Option<UnlockData>,
 }
 #[post("/emergency-access/<emer_id>/password", data = "<data>")]
@@ -670,6 +638,8 @@ async fn password_emergency_access(
    check_emergency_access_enabled()?;
    let data: EmergencyAccessPasswordData = data.into_inner();
    let new_master_password_hash = &data.new_master_password_hash;
    //let key = &data.Key;
    let requesting_user = headers.user;
    let Some(emergency_access) =
@@ -686,23 +656,8 @@ async fn password_emergency_access(
        err!("Grantor user not found.")
    };
    let (new_master_password_hash, new_key) =
        if let (Some(authentication_data), Some(unlock_data)) = (data.authentication_data, data.unlock_data) {
            authentication_data.check(&grantor_user, &unlock_data)?;
            if !authentication_data.kdf.matches_user(&grantor_user) {
                err!("KDF settings do not match the grantor account")
            }
            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
            (new_master_password_hash, new_key)
        } else {
            err!("Invalid request!")
        };
    // change grantor_user password
-    grantor_user.set_password(&new_master_password_hash, Some(new_key), true, None, &conn).await?;
+    grantor_user.set_password(new_master_password_hash, Some(data.key), true, None, &conn).await?;
    grantor_user.save(&conn).await?;
    // Disable TwoFactor providers since they will otherwise block logins
@@ -770,71 +725,52 @@ pub async fn emergency_request_timeout_job(pool: DbPool) {
        return;
    }
-    let Ok(conn) = pool.get().await else {
+    if let Ok(conn) = pool.get().await {
-        error!("Failed to get DB connection for emergency time-outs!");
+        let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
        return;
    };
-    let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
+        if emergency_access_list.is_empty() {
-
+            debug!("No emergency request timeout to approve");
    if emergency_access_list.is_empty() {
        debug!("No emergency request timeout to approve");
        return;
    }
    let now = Utc::now().naive_utc();
    for mut emer in emergency_access_list {
        match emer.is_recovery_allowed(&now) {
            Ok(true) => {} // Recovery is allowed
            Ok(false) => continue,
            Err(e) => {
                error!("Failed to check if recovery is allowed for '{}': {e}", emer.uuid);
                continue;
            }
        }
-        // Get grantor user to send Accepted email
+        let now = Utc::now().naive_utc();
-        let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
+        for mut emer in emergency_access_list {
-            error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
+            // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
-            continue;
+            let recovery_allowed_at =
-        };
+                emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days)).unwrap();
            if recovery_allowed_at.le(&now) {
                // Only update the access status
                // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
                emer.update_access_status_and_save(EmergencyAccessStatus::RecoveryApproved as i32, &now, &conn)
                    .await
                    .expect("Unable to update emergency access status");
-        let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
+                if CONFIG.mail_enabled() {
-            error!("Missing grantee for emergency access '{}'", emer.uuid);
+                    // get grantor user to send Accepted email
-            continue;
+                    let grantor_user =
-        };
+                        User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
-        // Get grantee user to send Accepted email
+                    // get grantee user to send Accepted email
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
+                    let grantee_user =
-            error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
+                        User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
-            continue;
+                            .await
-        };
+                            .expect("Grantee user not found");
-        // Only update the access status
+                    mail::send_emergency_access_recovery_timed_out(
-        // Updating the whole record could cause issues when the emergency_notification_reminder_job is also active
+                        &grantor_user.email,
-        let status_initiated = EmergencyAccessStatus::RecoveryInitiated as i32;
+                        &grantee_user.name,
-        let status_approved = EmergencyAccessStatus::RecoveryApproved as i32;
+                        emer.get_type_as_str(),
-        if let Err(e) = emer.update_access_status_and_save(status_initiated, status_approved, &now, &conn).await {
+                    )
-            error!("Unable to update emergency access status for '{}': {e}", emer.uuid);
+                    .await
-            continue;
+                    .expect("Error on sending email");
        }
-        if CONFIG.mail_enabled() {
+                    mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name)
-            if let Err(e) = mail::send_emergency_access_recovery_timed_out(
+                        .await
-                &grantor_user.email,
+                        .expect("Error on sending email");
-                &grantee_user.name,
+                }
                emer.get_type_as_str(),
            )
            .await
            {
                error!("Failed to send emergency access recovery time-out email for '{}': {e}", emer.uuid);
            }
            if let Err(e) = mail::send_emergency_access_recovery_approved(&grantee_user.email, &grantor_user.name).await
            {
                error!("Failed to send emergency access recovery approved email for '{}': {e}", emer.uuid);
            }
        }
    } else {
        error!("Failed to get DB connection while searching emergency request timed out");
    }
 }
@@ -844,85 +780,55 @@ pub async fn emergency_notification_reminder_job(pool: DbPool) {
        return;
    }
-    let Ok(conn) = pool.get().await else {
+    if let Ok(conn) = pool.get().await {
-        error!("Failed to get DB connection for emergency reminders!");
+        let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
        return;
    };
-    let emergency_access_list = EmergencyAccess::find_all_recoveries_initiated(&conn).await;
+        if emergency_access_list.is_empty() {
-
+            debug!("No emergency request reminder notification to send");
    if emergency_access_list.is_empty() {
        debug!("No emergency request reminder notification to send");
        return;
    }
    let now = Utc::now().naive_utc();
    for mut emer in emergency_access_list {
        let Ok(deadline_at) = emer.deadline_at() else {
            error!("Invalid deadline for emergency access '{}'", emer.uuid);
            continue;
        };
        let Some(final_reminder_at) = deadline_at.checked_sub_days(chrono::Days::new(1)) else {
            error!("Cannot calculate reminder date for emergency access '{}'", emer.uuid);
            continue;
        };
        // Only send reminders during the last 24 hours, else continue
        if now < final_reminder_at || now >= deadline_at {
            continue;
        }
-        // Check if we did not sent a recovery mail in the past 24h already, else skip it.
+        let now = Utc::now().naive_utc();
-        // In case something goes wrong with the date calculation or `last_notification_at` is None we use now.
+        for mut emer in emergency_access_list {
-        // This is to prevent possible missed reminders, this might cause an extra reminder,
+            // The find_all_recoveries_initiated already checks if the recovery_initiated_at is not null (None)
-        // but that is better then no reminder at all.
+            // Calculate the day before the recovery will become active
-        let next_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
+            let final_recovery_reminder_at =
-            last_notification_at.checked_add_days(chrono::Days::new(1)).unwrap_or(now)
+                emer.recovery_initiated_at.unwrap() + TimeDelta::try_days(i64::from(emer.wait_time_days - 1)).unwrap();
-        } else {
+            // Calculate if a day has passed since the previous notification, else no notification has been sent before
-            now
+            let next_recovery_reminder_at = if let Some(last_notification_at) = emer.last_notification_at {
-        };
+                last_notification_at + TimeDelta::try_days(1).unwrap()
            } else {
                now
            };
            if final_recovery_reminder_at.le(&now) && next_recovery_reminder_at.le(&now) {
                // Only update the last notification date
                // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
                emer.update_last_notification_date_and_save(&now, &conn)
                    .await
                    .expect("Unable to update emergency access notification date");
-        // Only send a reminder if the `next_reminder_at` is less then or equal to `now`
+                if CONFIG.mail_enabled() {
-        // Else we can skip the current emergency access this run.
+                    // get grantor user to send Accepted email
-        if next_reminder_at.gt(&now) {
+                    let grantor_user =
-            continue;
+                        User::find_by_uuid(&emer.grantor_uuid, &conn).await.expect("Grantor user not found");
-        }
+
-
+                    // get grantee user to send Accepted email
-        // Get grantor user to send Reminder email
+                    let grantee_user =
-        let Some(grantor_user) = User::find_by_uuid(&emer.grantor_uuid, &conn).await else {
+                        User::find_by_uuid(&emer.grantee_uuid.clone().expect("Grantee user invalid"), &conn)
-            error!("Grantor user '{}' not found for emergency access '{}'", emer.grantor_uuid, emer.uuid);
+                            .await
-            continue;
+                            .expect("Grantee user not found");
-        };
+
-
+                    mail::send_emergency_access_recovery_reminder(
-        let Some(grantee_uuid) = emer.grantee_uuid.as_ref() else {
+                        &grantor_user.email,
-            error!("Missing grantee for emergency access '{}'", emer.uuid);
+                        &grantee_user.name,
-            continue;
+                        emer.get_type_as_str(),
-        };
+                        "1", // This notification is only triggered one day before the activation
-
+                    )
-        // Get grantee user to send Reminder email
+                    .await
-        let Some(grantee_user) = User::find_by_uuid(grantee_uuid, &conn).await else {
+                    .expect("Error on sending email");
-            error!("Grantee user '{grantee_uuid}' not found for emergency access '{}'", emer.uuid);
+                }
-            continue;
+            }
        };
        // Only update the last notification date
        // Updating the whole record could cause issues when the emergency_request_timeout_job is also active
        if let Err(e) = emer.update_last_notification_date_and_save(&now, &conn).await {
            error!("Unable to update emergency access reminder date for '{}': {e}", emer.uuid);
            continue;
        }
        if CONFIG.mail_enabled()
            && let Err(e) = mail::send_emergency_access_recovery_reminder(
                &grantor_user.email,
                &grantee_user.name,
                emer.get_type_as_str(),
                "1", // This notification is only triggered one day before the activation
            )
            .await
        {
            error!("Failed to send emergency access reminder email for '{}': {e}", emer.uuid);
        }
    } else {
        error!("Failed to get DB connection while searching emergency notification reminder");
    }
 }
@@ -6,13 +6,12 @@ use serde_json::Value;
 use crate::{
    CONFIG,
-    api::{ApiResult, EmptyResult, JsonResult},
+    api::{EmptyResult, JsonResult},
    auth::{AdminHeaders, Headers},
    db::{
        DbConn, DbPool,
-        models::{Cipher, CipherId, Event, EventType, Membership, MembershipId, OrganizationId, UserId},
+        models::{Cipher, CipherId, Event, Membership, MembershipId, OrganizationId, UserId},
    },
    error::MapResult,
    util::parse_date,
 };
@@ -30,14 +29,6 @@ struct EventRange {
    continuation_token: Option<String>,
 }
 impl EventRange {
    fn date_range(&self) -> ApiResult<(NaiveDateTime, NaiveDateTime)> {
        let start_date = parse_date(&self.start).map_res("Invalid start date")?;
        let end_date = parse_date(self.continuation_token.as_ref().unwrap_or(&self.end)).map_res("Invalid end date")?;
        Ok((start_date, end_date))
    }
 }
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/AdminConsole/Controllers/EventsController.cs#L87
 #[get("/organizations/<org_id>/events?<data..>")]
 async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: AdminHeaders, conn: DbConn) -> JsonResult {
@@ -48,7 +39,12 @@ async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: Admin
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
        let end_date = if let Some(before_date) = &data.continuation_token {
            parse_date(before_date)
        } else {
            parse_date(&data.end)
        };
        Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &conn)
            .await
@@ -73,7 +69,12 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade
    let events_json: Vec<Value> = if CONFIG.org_events_enabled()
        && Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await
    {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
        let end_date = if let Some(before_date) = &data.continuation_token {
            parse_date(before_date)
        } else {
            parse_date(&data.end)
        };
        Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn).await.iter().map(Event::to_json).collect()
    } else {
@@ -101,7 +102,12 @@ async fn get_user_events(
    // Return an empty vec when we org events are disabled.
    // This prevents client errors
    let events_json: Vec<Value> = if CONFIG.org_events_enabled() {
-        let (start_date, end_date) = data.date_range()?;
+        let start_date = parse_date(&data.start);
        let end_date = if let Some(before_date) = &data.continuation_token {
            parse_date(before_date)
        } else {
            parse_date(&data.end)
        };
        Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &conn)
            .await
@@ -162,10 +168,9 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
    }
    for event in data.iter() {
-        let event_date = parse_date(&event.date).map_res("Invalid event date")?;
+        let event_date = parse_date(&event.date);
        // Only the event types upstream accepts from clients, the rest are written server-side.
        match event.r#type {
-            t if t == EventType::UserClientExportedVault as i32 => {
+            1000..=1099 => {
                log_user_event_impl(
                    event.r#type,
                    &headers.user.uuid,
@@ -176,7 +181,7 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                )
                .await;
            }
-            t if t == EventType::OrganizationClientExportedVault as i32 => {
+            1600..=1699 => {
                // Only allow logging events for an organization the user is actually a member of.
                if let Some(org_id) = &event.organization_id
                    && Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await.is_some()
@@ -194,28 +199,7 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
-            // Only the vault notification banner click is accepted from clients. The rest of
+            _ => {
            // the 1500..=1599 range is written server-side and must not be forgeable by a client.
            t if t == EventType::OrganizationUserNotificationBannerActionClicked as i32 => {
                if let Some(org_id) = &event.organization_id
                    && let Some(membership) =
                        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await
                {
                    log_event_impl(
                        event.r#type,
                        &membership.uuid,
                        org_id,
                        &headers.user.uuid,
                        headers.device.atype,
                        Some(event_date),
                        &headers.ip.ip,
                        &conn,
                    )
                    .await;
                }
            }
            // Client-side cipher events (viewed, copied, toggled, autofilled, HTTP auth).
            1107..=1114 | 1117 | 1119..=1133 => {
                // The cipher determines the organization the event is logged to, so make sure the
                // user can actually access it instead of trusting the provided cipher uuid.
                if let Some(cipher_uuid) = &event.cipher_id
@@ -236,17 +220,16 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
            _ => {}
        }
    }
    Ok(())
 }
-pub async fn log_user_event(event_type: EventType, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
+pub async fn log_user_event(event_type: i32, user_id: &UserId, device_type: i32, ip: &IpAddr, conn: &DbConn) {
    if !CONFIG.org_events_enabled() {
        return;
    }
-    log_user_event_impl(event_type as i32, user_id, device_type, None, ip, conn).await;
+    log_user_event_impl(event_type, user_id, device_type, None, ip, conn).await;
 }
 async fn log_user_event_impl(
@@ -284,7 +267,7 @@ async fn log_user_event_impl(
 }
 pub async fn log_event(
-    event_type: EventType,
+    event_type: i32,
    source_uuid: &str,
    org_id: &OrganizationId,
    act_user_id: &UserId,
@@ -295,7 +278,7 @@ pub async fn log_event(
    if !CONFIG.org_events_enabled() {
        return;
    }
-    log_event_impl(event_type as i32, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
+    log_event_impl(event_type, source_uuid, org_id, act_user_id, device_type, None, ip, conn).await;
 }
 #[expect(clippy::too_many_arguments)]
@@ -347,17 +330,14 @@ async fn log_event_impl(
 pub async fn event_cleanup_job(pool: DbPool) {
    debug!("Start events cleanup job");
-    if CONFIG.events_days_retain().is_none_or(|d| d == 0) {
+    if CONFIG.events_days_retain().is_none() {
-        debug!("events_days_retain is not configured or set to 0, skipping");
+        debug!("events_days_retain is not configured, abort");
        return;
    }
-    let Ok(conn) = pool.get().await else {
+    if let Ok(conn) = pool.get().await {
        Event::clean_events(&conn).await.ok();
    } else {
        error!("Failed to get DB connection while trying to cleanup the events table");
        return;
    };
    if let Err(e) = Event::clean_events(&conn).await {
        error!("Failed to cleanup the events table: {e}");
    }
 }
@@ -228,17 +228,14 @@ fn config() -> Json<Value> {
        // Version history:
        // - Individual cipher key encryption: 2024.2.0
        // - Mobile app support for MasterPasswordUnlockData: 2025.8.0
-        "version": "2026.6.0",
+        "version": "2025.12.0",
        "gitHash": option_env!("GIT_REV"),
        "server": {
          "name": "Vaultwarden",
          "url": "https://github.com/dani-garcia/vaultwarden"
        },
        "settings": {
-            "disableUserRegistration": CONFIG.is_signup_disabled(),
+            "disableUserRegistration": CONFIG.is_signup_disabled()
            // When enabled, this setting signals to clients that onboarding interstitials
            // (post-login welcome dialogs, extension install prompts, setup extension redirects, and premium upsell modals) should be suppressed
            "suppressOnboardingInterstitials": CONFIG.client_suppress_onboarding(),
        },
        "environment": {
          "vault": domain,
@@ -247,7 +244,6 @@ fn config() -> Json<Value> {
          "notifications": format!("{domain}/notifications"),
          "sso": "",
          "cloudRegion": null,
          "fillAssistRules": CONFIG.fill_assist_rules_url(),
        },
        // Bitwarden uses this for the self-hosted servers to indicate the default push technology
        "push": {
@@ -255,10 +251,6 @@ fn config() -> Json<Value> {
          "vapidPublicKey": null
        },
        "featureStates": feature_states,
        // Not supported right now
        // Used for by clients to learn if the server requires extra work to establish a connection.
        // See: https://github.com/bitwarden/server/pull/6892 | https://github.com/bitwarden/server/commit/52955d1860b4dfb905f67bbe39d9b10bbd61ded0
        "communication": null,
        "object": "config",
    }))
 }
@@ -58,13 +58,25 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
    let org_id = token.0;
    let data = data.into_inner();
    // Like upstream, the import never removes Owners, so it doesn't revoke or restore them either.
    for user_data in &data.members {
        let mut user_created: bool = false;
        if user_data.deleted {
            // If user is marked for deletion and it exists, revoke it
            if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &conn).await {
-                let revoked = member.atype != MembershipType::Owner && member.revoke();
+                // Only revoke a user if it is not the last confirmed owner
                let revoked = if member.atype == MembershipType::Owner
                    && member.status == MembershipStatus::Confirmed as i32
                {
                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &conn).await <= 1 {
                        warn!("Can't revoke the last owner");
                        false
                    } else {
                        member.revoke()
                    }
                } else {
                    member.revoke()
                };
                let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
                if revoked || ext_modified {
                    member.save(&conn).await?;
@@ -72,7 +84,7 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
            }
        // If user is part of the organization, restore it
        } else if let Some(mut member) = Membership::find_by_email_and_org(&user_data.email, &org_id, &conn).await {
-            let mut restored = member.atype != MembershipType::Owner && member.restore();
+            let mut restored = member.restore();
            let ext_modified = member.set_external_id(Some(user_data.external_id.clone()));
            // Enforce org policies as every other restore path does.
            // If the user is not allowed, we revoke again and continue so the external_id is still updated.
@@ -137,13 +149,9 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
    if CONFIG.org_groups_enabled() {
        for group_data in &data.groups {
-            let group_uuid = if let Some(mut group) =
+            let group_uuid = if let Some(group) =
                Group::find_by_external_id_and_org(&group_data.external_id, &org_id, &conn).await
            {
                if group.name != group_data.name {
                    group.name = group_data.name.clone();
                    group.save(&conn).await?;
                }
                group.uuid
            } else {
                let mut group =
@@ -172,8 +180,14 @@ async fn ldap_import(data: Json<OrgImportData>, token: PublicToken, conn: DbConn
        for member in Membership::find_by_org(&org_id, &conn).await {
            if let Some(ref user_external_id) = member.external_id
                && !sync_members.contains(user_external_id)
                && member.atype != MembershipType::Owner
            {
                if member.atype == MembershipType::Owner && member.status == MembershipStatus::Confirmed as i32 {
                    // Removing owner, check that there is at least one other confirmed owner
                    if Membership::count_confirmed_by_org_and_type(&org_id, MembershipType::Owner, &conn).await <= 1 {
                        warn!("Can't delete the last owner");
                        continue;
                    }
                }
                member.delete(&conn).await?;
            }
        }
@@ -12,7 +12,7 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::{ApiResult, EmptyResult, JsonResult, Notify, UpdateType},
-    auth::{Headers, Host, SendHeaders},
+    auth::{ClientIp, Headers, Host, SendHeaders},
    config::PathType,
    db::{
        DbConn, DbPool,
@@ -23,7 +23,7 @@ use crate::{
 const SEND_INACCESSIBLE_MSG: &str = "Send does not exist or is no longer available";
 static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
-    let dt = DateTime::UNIX_EPOCH.naive_utc();
+    let dt = crate::util::parse_date("1970-01-01T00:00:00.000000Z");
    Device {
        uuid: String::from("00000000-0000-0000-0000-000000000000").into(),
        created_at: dt,
@@ -39,15 +39,18 @@ static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
 });
 // The max file size allowed by Bitwarden clients and add an extra 5% to avoid issues
-pub(crate) const SIZE_525_MB: i64 = 550_502_400;
+const SIZE_525_MB: i64 = 550_502_400;
 pub fn routes() -> Vec<rocket::Route> {
    routes![
        get_sends,
        get_send,
        post_send,
        post_send_file,
        post_access,
        post_access_legacy,
        post_access_file,
        post_access_file_legacy,
        put_send,
        delete_send,
        put_remove_password,
@@ -70,7 +73,7 @@ pub async fn purge_sends(pool: DbPool) {
 #[serde(rename_all = "camelCase")]
 pub struct SendData {
    r#type: i32,
-    pub key: String,
+    key: String,
    password: Option<String>,
    max_access_count: Option<NumberOrString>,
    expiration_date: Option<DateTime<Utc>>,
@@ -198,7 +201,7 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
    enforce_disable_hide_email_policy(&data, &headers, &conn).await?;
    if data.r#type == SendType::File as i32 {
-        err!("File sends should use /api/sends/file/v2")
+        err!("File sends should use /api/sends/file")
    }
    let mut send = create_send(data, headers.user.uuid)?;
@@ -215,11 +218,93 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
    Ok(Json(send.to_json()))
 }
 #[derive(FromForm)]
 struct UploadData<'f> {
    model: Json<SendData>,
    data: TempFile<'f>,
 }
 #[derive(FromForm)]
 struct UploadDataV2<'f> {
    data: TempFile<'f>,
 }
 // @deprecated Mar 25 2021: This method has been deprecated in favor of direct uploads (v2).
 // This method still exists to support older clients, probably need to remove it sometime.
 // Upstream: https://github.com/bitwarden/server/blob/d0c793c95181dfb1b447eb450f85ba0bfd7ef643/src/Api/Controllers/SendsController.cs#L164-L167
 // 2025: This endpoint doesn't seem to exists anymore in the latest version
 // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs
 #[post("/sends/file", format = "multipart/form-data", data = "<data>")]
 async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    enforce_disable_send_policy(&headers, &conn).await?;
    let UploadData {
        model,
        data,
    } = data.into_inner();
    let model = model.into_inner();
    let Some(size) = data.len().to_i64() else {
        err!("Invalid send size");
    };
    if size < 0 {
        err!("Send size can't be negative")
    }
    enforce_disable_hide_email_policy(&model, &headers, &conn).await?;
    let size_limit = match CONFIG.user_send_limit() {
        Some(0) => err!("File uploads are disabled"),
        Some(limit_kb) => {
            let Some(already_used) = Send::size_by_user(&headers.user.uuid, &conn).await else {
                err!("Existing sends overflow")
            };
            let Some(left) = limit_kb.checked_mul(1024).and_then(|l| l.checked_sub(already_used)) else {
                err!("Send size overflow");
            };
            if left <= 0 {
                err!("Send storage limit reached! Delete some sends to free up space")
            }
            i64::clamp(left, 0, SIZE_525_MB)
        }
        None => SIZE_525_MB,
    };
    if size > size_limit {
        err!("Send storage limit exceeded with this file");
    }
    let mut send = create_send(model, headers.user.uuid)?;
    if send.atype != SendType::File as i32 {
        err!("Send content is not a file");
    }
    let file_id = crate::crypto::generate_send_file_id();
    save_temp_file(&PathType::Sends, &format!("{}/{file_id}", send.uuid), data, true).await?;
    let mut data_value: Value = serde_json::from_str(&send.data)?;
    if let Some(o) = data_value.as_object_mut() {
        o.insert(String::from("id"), Value::String(file_id));
        o.insert(String::from("size"), Value::Number(size.into()));
        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(size)));
    }
    send.data = serde_json::to_string(&data_value)?;
    // Save the changes in the database
    send.save(&conn).await?;
    nt.send_send_update(
        UpdateType::SyncSendCreate,
        &send,
        &send.update_users_revision(&conn).await,
        &headers.device,
        &conn,
    )
    .await;
    Ok(Json(send.to_json()))
 }
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L165
 #[post("/sends/file/v2", data = "<data>")]
 async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn) -> JsonResult {
@@ -268,12 +353,11 @@ async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn)
    let file_id = crate::crypto::generate_send_file_id();
    let mut data_value: Value = serde_json::from_str(&send.data)?;
-    let Some(o) = data_value.as_object_mut() else {
+    if let Some(o) = data_value.as_object_mut() {
-        err!("Invalid Send file data")
+        o.insert(String::from("id"), Value::String(file_id.clone()));
-    };
+        o.insert(String::from("size"), Value::Number(file_length.into()));
-    o.insert(String::from("id"), Value::String(file_id.clone()));
+        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
-    o.insert(String::from("size"), Value::Number(file_length.into()));
+    }
    o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(file_length)));
    send.data = serde_json::to_string(&data_value)?;
    send.save(&conn).await?;
@@ -329,8 +413,8 @@ async fn post_send_file_v2_data(
            "Send file name does not match.",
            format!(
                "Expected file name '{}' got '{}'",
-                send_data.fileName.escape_debug(),
+                send_data.fileName,
-                raw_file_name.dangerous_unsafe_unsanitized_raw().as_str().escape_debug()
+                raw_file_name.dangerous_unsafe_unsanitized_raw()
            )
        ),
        _ => err!("Send file name does not match or is not provided."),
@@ -366,16 +450,70 @@ async fn post_send_file_v2_data(
 #[post("/sends/access")]
 async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
+    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
-    if !send.is_accessible() {
+    process_access(send, conn, nt).await
 }
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SendAccessData {
    pub password: Option<String>,
 }
 // Legacy since web-2026.6.0
 #[post("/sends/access/<access_id>", data = "<data>")]
 async fn post_access_legacy(
    access_id: &str,
    data: Json<SendAccessData>,
    conn: DbConn,
    ip: ClientIp,
    nt: Notify<'_>,
 ) -> JsonResult {
    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
    let Some(mut send) = Send::find_by_access_id(access_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if let Some(max_access_count) = send.max_access_count
        && send.access_count >= max_access_count
    {
        err_code!(SEND_INACCESSIBLE_MSG, 404);
    }
    if let Some(expiration) = send.expiration_date
        && Utc::now().naive_utc() >= expiration
    {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if Utc::now().naive_utc() >= send.deletion_date {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.disabled {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.password_hash.is_some() {
        match data.into_inner().password {
            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
            Some(_) => err!("Invalid password", format!("IP: {}.", ip.ip)),
            None => err_code!("Password not provided", format!("IP: {}.", ip.ip), 401),
        }
    }
    // Files are incremented during the download
-    if send.atype == SendType::Text as i32 && !send.register_access(&conn).await? {
+    if send.atype == SendType::Text as i32 {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
+        if !send.register_access(&conn).await? {
            err_code!(SEND_INACCESSIBLE_MSG, 404)
        }
    } else {
        send.save(&conn).await?;
    }
    process_access(send, conn, nt).await
 }
@@ -400,27 +538,62 @@ async fn post_access_file(
    conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
+    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if !send.is_accessible() {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    check_send_file_id(&send, &file_id)?;
    if !send.register_access(&conn).await? {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    process_access_file(send, file_id, host, conn, nt).await
 }
-fn check_send_file_id(send: &Send, file_id: &SendFileId) -> EmptyResult {
+// Legacy since web-2026.6.0
-    if send.atype != SendType::File as i32 {
+#[post("/sends/<send_id>/access/file/<file_id>", data = "<data>")]
-        err!("Send is not a file type send.");
+async fn post_access_file_legacy(
    send_id: SendId,
    file_id: SendFileId,
    data: Json<SendAccessData>,
    host: Host,
    conn: DbConn,
    ip: ClientIp,
    nt: Notify<'_>,
 ) -> JsonResult {
    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
    let Some(mut send) = Send::find_by_uuid(&send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if let Some(max_access_count) = send.max_access_count
        && send.access_count >= max_access_count
    {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
-    match serde_json::from_str::<SendFileData>(&send.data) {
+
-        Ok(data) if &data.id == file_id => Ok(()),
+    if let Some(expiration) = send.expiration_date
-        _ => err_code!(SEND_INACCESSIBLE_MSG, 404),
+        && Utc::now().naive_utc() >= expiration
    {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if Utc::now().naive_utc() >= send.deletion_date {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.disabled {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    if send.password_hash.is_some() {
        match data.into_inner().password {
            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
            Some(_) => err!("Invalid password."),
            None => err_code!("Password not provided", 401),
        }
    }
    if !send.register_access(&conn).await? {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
    process_access_file(send, file_id, host, conn, nt).await
 }
 async fn process_access_file(send: Send, file_id: SendFileId, host: Host, conn: DbConn, nt: Notify<'_>) -> JsonResult {
@@ -483,7 +656,7 @@ async fn put_send(send_id: SendId, data: Json<SendData>, headers: Headers, conn:
    Ok(Json(send.to_json()))
 }
-async fn update_send_from_data(
+pub async fn update_send_from_data(
    send: &mut Send,
    data: SendData,
    headers: &Headers,
@@ -3,7 +3,7 @@ use rocket::{Route, serde::json::Json};
 use crate::{
    api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code},
-    auth::{ClientIp, Headers, two_factor},
+    auth::{ClientIp, Headers},
    crypto,
    db::{
        DbConn,
@@ -20,23 +20,27 @@ pub fn routes() -> Vec<Route> {
 #[post("/two-factor/get-authenticator", data = "<data>")]
 async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn) -> JsonResult {
    let data: PasswordOrOtpData = data.into_inner();
    let user = headers.user;
    data.validate(&user, false, &conn).await?;
-    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await;
+    let type_ = TwoFactorType::Authenticator as i32;
    let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await;
    let (enabled, key) = match twofactor {
        Some(tf) => (true, tf.data),
        _ => (false, crypto::encode_random_bytes::<20>(&BASE32)),
    };
    // Upstream seems to also return `userVerificationToken`, but doesn't seem to be used at all.
    // It should help prevent TOTP disclosure if someone keeps their vault unlocked.
    // Since it doesn't seem to be used, and also does not cause any issues, lets leave it out of the response.
    // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Controllers/TwoFactorController.cs#L94
    Ok(Json(json!({
-        "authenticator": json!({
+        "enabled": enabled,
-            "enabled": enabled,
+        "key": key,
-            "key": key,
+        "object": "twoFactorAuthenticator"
        }),
        "userVerificationToken": two_factor::authenticator_token(user.uuid, key, enabled),
    })))
 }
@@ -45,7 +49,8 @@ async fn generate_authenticator(data: Json<PasswordOrOtpData>, headers: Headers,
 struct EnableAuthenticatorData {
    key: String,
    token: NumberOrString,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 #[post("/two-factor/authenticator", data = "<data>")]
@@ -56,7 +61,12 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
    let mut user = headers.user;
-    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &key, false)?;
+    PasswordOrOtpData {
        master_password_hash: data.master_password_hash,
        otp: data.otp,
    }
    .validate(&user, true, &conn)
    .await?;
    // Validate key as base32 and 20 bytes length
    let decoded_key: Vec<u8> = if let Ok(decoded) = BASE32.decode(key.as_bytes()) {
@@ -74,13 +84,12 @@ async fn activate_authenticator(data: Json<EnableAuthenticatorData>, headers: He
    generate_recover_code(&mut user, &conn).await;
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    Ok(Json(json!({
-        "authenticator": json!({
+        "enabled": true,
-            "enabled": true,
+        "key": key,
-            "key": key,
+        "object": "twoFactorAuthenticator"
        }),
    })))
 }
@@ -116,7 +125,8 @@ pub async fn validate_totp_code(
        err!("Invalid TOTP secret")
    };
-    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator, conn).await {
+    let mut twofactor = match TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Authenticator as i32, conn).await
    {
        Some(tf) => tf,
        _ => TwoFactor::new(user_id.clone(), TwoFactorType::Authenticator, secret.to_owned()),
    };
@@ -174,25 +184,36 @@ pub async fn validate_totp_code(
 #[serde(rename_all = "camelCase")]
 struct DisableAuthenticatorData {
    key: String,
-    user_verification_token: String,
+    master_password_hash: String,
    r#type: NumberOrString,
 }
 #[delete("/two-factor/authenticator", data = "<data>")]
-async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> EmptyResult {
+async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: Headers, conn: DbConn) -> JsonResult {
    let user = headers.user;
    let type_ = data.r#type.into_i32()?;
-    two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &data.key, true)?;
+    if !user.check_valid_password(&data.master_password_hash) {
        err!("Invalid password");
    }
-    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator, &conn).await {
+    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
        if twofactor.data == data.key {
            twofactor.delete(&conn).await?;
-            log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+            log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                .await;
        } else {
            err!(format!("TOTP key for user {} does not match recorded value, cannot deactivate", &user.email));
        }
    }
-    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
+    if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() {
        super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?;
    }
-    Ok(())
+    Ok(Json(json!({
        "enabled": false,
        "keys": type_,
        "object": "twoFactorProvider"
    })))
 }
@@ -1,13 +1,14 @@
 use chrono::Utc;
 use data_encoding::BASE64;
 use rocket::{Route, serde::json::Json};
 use crate::{
    CONFIG,
    api::{
-        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData,
+        ApiResult, EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event,
-        core::log_user_event,
+        core::two_factor::generate_recover_code,
        core::two_factor::{VerificationTokenData, generate_recover_code},
    },
-    auth::{Headers, two_factor, two_factor::DuoData},
+    auth::Headers,
    crypto,
    db::{
        DbConn,
@@ -18,7 +19,55 @@ use crate::{
 };
 pub fn routes() -> Vec<Route> {
-    routes![get_duo, activate_duo, activate_duo_put, disable_duo,]
+    routes![get_duo, activate_duo, activate_duo_put,]
 }
 #[derive(Serialize, Deserialize)]
 struct DuoData {
    host: String, // Duo API hostname
    ik: String,   // client id
    sk: String,   // client secret
 }
 impl DuoData {
    fn global() -> Option<Self> {
        match (CONFIG._enable_duo(), CONFIG.duo_host()) {
            (true, Some(host)) => Some(Self {
                host,
                ik: CONFIG.duo_ikey().unwrap(),
                sk: CONFIG.duo_skey().unwrap(),
            }),
            _ => None,
        }
    }
    fn msg(s: &str) -> Self {
        Self {
            host: s.into(),
            ik: s.into(),
            sk: s.into(),
        }
    }
    fn secret() -> Self {
        Self::msg("<global_secret>")
    }
    fn obscure(self) -> Self {
        let mut host = self.host;
        let mut ik = self.ik;
        let mut sk = self.sk;
        let digits = 4;
        let replaced = "************";
        host.replace_range(digits.., replaced);
        ik.replace_range(digits.., replaced);
        sk.replace_range(digits.., replaced);
        Self {
            host,
            ik,
            sk,
        }
    }
 }
 enum DuoStatus {
@@ -47,19 +96,22 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
    data.validate(&user, false, &conn).await?;
-    let (enabled, duo) = match get_user_duo_data(&user.uuid, &conn).await {
+    let data = get_user_duo_data(&user.uuid, &conn).await;
    let (enabled, data) = match data {
        DuoStatus::Global(_) => (true, Some(DuoData::secret())),
        DuoStatus::User(data) => (true, Some(data.obscure())),
        DuoStatus::Disabled(true) => (false, Some(DuoData::msg(DISABLED_MESSAGE_DEFAULT))),
        DuoStatus::Disabled(false) => (false, None),
    };
-    let duo_json = if let Some(data) = duo.as_ref() {
+    let json = if let Some(data) = data {
        json!({
            "enabled": enabled,
            "host": data.host,
            "clientSecret": data.sk,
            "clientId": data.ik,
            "object": "twoFactorDuo"
        })
    } else {
        json!({
@@ -67,13 +119,11 @@ async fn get_duo(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn)
            "host": null,
            "clientSecret": null,
            "clientId": null,
            "object": "twoFactorDuo"
        })
    };
-    Ok(Json(rocket::serde::json::json!({
+    Ok(Json(json))
        "duo": duo_json,
        "userVerificationToken": two_factor::duo_token(user.uuid, duo, enabled),
    })))
 }
 #[derive(Deserialize)]
@@ -82,7 +132,8 @@ struct EnableDuoData {
    host: String,
    client_secret: String,
    client_id: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 impl From<EnableDuoData> for DuoData {
@@ -109,7 +160,12 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
    let data: EnableDuoData = data.into_inner();
    let mut user = headers.user;
-    two_factor::validate_duo(&data.user_verification_token, &user.uuid, None, false)?;
+    PasswordOrOtpData {
        master_password_hash: data.master_password_hash.clone(),
        otp: data.otp.clone(),
    }
    .validate(&user, true, &conn)
    .await?;
    let (data, data_str) = if check_duo_fields_custom(&data) {
        let data_req: DuoData = data.into();
@@ -126,15 +182,14 @@ async fn activate_duo(data: Json<EnableDuoData>, headers: Headers, conn: DbConn)
    generate_recover_code(&mut user, &conn).await;
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    Ok(Json(json!({
-        "duo": json!({
+        "enabled": true,
-            "enabled": true,
+        "host": data.host,
-            "host": data.host,
+        "clientSecret": data.sk,
-            "clientSecret": data.sk,
+        "clientId": data.ik,
-            "clientId": data.ik,
+        "object": "twoFactorDuo"
        }),
    })))
 }
@@ -143,29 +198,6 @@ async fn activate_duo_put(data: Json<EnableDuoData>, headers: Headers, conn: DbC
    activate_duo(data, headers, conn).await
 }
 #[delete("/two-factor/duo", data = "<data>")]
 async fn disable_duo(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
    let user = headers.user;
    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Duo, &conn).await {
        // Apply the same transformation than in `get_duo` to check we are disabling the correct one
        let duo = match to_user_duo_data(&twofactor) {
            DuoStatus::Global(_) => Some(DuoData::secret()),
            DuoStatus::User(data) => Some(data.obscure()),
            DuoStatus::Disabled(_) => None,
        };
        two_factor::validate_duo(&data.user_verification_token, &user.uuid, duo.as_ref(), true)?;
        twofactor.delete(&conn).await?;
        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    }
    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
    Ok(())
 }
 async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) -> EmptyResult {
    use reqwest::{Method, header};
    use std::str::FromStr;
@@ -190,16 +222,21 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
    Ok(())
 }
 const DUO_EXPIRE: i64 = 300;
 const APP_EXPIRE: i64 = 3600;
 const AUTH_PREFIX: &str = "AUTH";
 const DUO_PREFIX: &str = "TX";
 const APP_PREFIX: &str = "APP";
 async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
    let type_ = TwoFactorType::Duo as i32;
    // If the user doesn't have an entry, disabled
-    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Duo, conn).await else {
+    let Some(twofactor) = TwoFactor::find_by_user_and_type(user_id, type_, conn).await else {
        return DuoStatus::Disabled(DuoData::global().is_some());
    };
    to_user_duo_data(&twofactor)
 }
 fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
    // If the user has the required values, we use those
    if let Ok(data) = serde_json::from_str(&twofactor.data) {
        return DuoStatus::User(data);
@@ -214,13 +251,118 @@ fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus {
    DuoStatus::Disabled(false)
 }
-// let (ik, sk, host) = get_duo_keys_email();
+// let (ik, sk, ak, host) = get_duo_keys();
-pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String)> {
+pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String, String)> {
    let data = match User::find_by_mail(email, conn).await {
        Some(u) => get_user_duo_data(&u.uuid, conn).await.data(),
        _ => DuoData::global(),
    }
    .map_res("Can't fetch Duo Keys")?;
-    Ok((data.ik, data.sk, data.host))
+    Ok((data.ik, data.sk, CONFIG.get_duo_akey().await, data.host))
 }
 pub async fn generate_duo_signature(email: &str, conn: &DbConn) -> ApiResult<(String, String)> {
    let now = Utc::now().timestamp();
    let (ik, sk, ak, host) = get_duo_keys_email(email, conn).await?;
    let duo_sign = sign_duo_values(&sk, email, &ik, DUO_PREFIX, now + DUO_EXPIRE);
    let app_sign = sign_duo_values(&ak, email, &ik, APP_PREFIX, now + APP_EXPIRE);
    Ok((format!("{duo_sign}:{app_sign}"), host))
 }
 fn sign_duo_values(key: &str, email: &str, ikey: &str, prefix: &str, expire: i64) -> String {
    let val = format!("{email}|{ikey}|{expire}");
    let cookie = format!("{prefix}|{}", BASE64.encode(val.as_bytes()));
    format!("{cookie}|{}", crypto::hmac_sign(key, &cookie))
 }
 pub async fn validate_duo_login(email: &str, response: &str, conn: &DbConn) -> EmptyResult {
    let split: Vec<&str> = response.split(':').collect();
    if split.len() != 2 {
        err!(
            "Invalid response length",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
        );
    }
    let auth_sig = split[0];
    let app_sig = split[1];
    let now = Utc::now().timestamp();
    let (ik, sk, ak, _host) = get_duo_keys_email(email, conn).await?;
    let auth_user = parse_duo_values(&sk, auth_sig, &ik, AUTH_PREFIX, now)?;
    let app_user = parse_duo_values(&ak, app_sig, &ik, APP_PREFIX, now)?;
    if !crypto::ct_eq(&auth_user, app_user) || !crypto::ct_eq(&auth_user, email) {
        err!(
            "Error validating duo authentication",
            ErrorEvent {
                event: EventType::UserFailedLogIn2fa
            }
        )
    }
    Ok(())
 }
 fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -> ApiResult<String> {
    let split: Vec<&str> = val.split('|').collect();
    if split.len() != 3 {
        err!("Invalid value length")
    }
    let u_prefix = split[0];
    let u_b64 = split[1];
    let u_sig = split[2];
    let sig = crypto::hmac_sign(key, &format!("{u_prefix}|{u_b64}"));
    if !crypto::ct_eq(crypto::hmac_sign(key, &sig), crypto::hmac_sign(key, u_sig)) {
        err!("Duo signatures don't match")
    }
    if u_prefix != prefix {
        err!("Prefixes don't match")
    }
    let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else {
        err!("Invalid Duo cookie encoding")
    };
    let Ok(cookie) = String::from_utf8(cookie_vec) else {
        err!("Invalid Duo cookie encoding")
    };
    let cookie_split: Vec<&str> = cookie.split('|').collect();
    if cookie_split.len() != 3 {
        err!("Invalid cookie length")
    }
    let username = cookie_split[0];
    let u_ikey = cookie_split[1];
    let expire = cookie_split[2];
    if !crypto::ct_eq(ikey, u_ikey) {
        err!("Invalid ikey")
    }
    let expire: i64 = if let Ok(e) = expire.parse() {
        e
    } else {
        err!("Invalid expire time")
    };
    if time >= expire {
        err!("Expired authorization")
    }
    Ok(username.into())
 }
@@ -383,7 +383,7 @@ pub async fn get_duo_auth_url(
    device_identifier: &DeviceId,
    conn: &DbConn,
 ) -> Result<String, Error> {
-    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
    let callback_url = match make_callback_url(client_id) {
        Ok(url) => url,
@@ -435,7 +435,7 @@ pub async fn validate_duo_login(
    let code = split[0];
    let state = split[1];
-    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
    // Get the context by the state reported by the client. If we don't have one,
    // it means the context is either missing or expired.
@@ -5,26 +5,20 @@ use crate::{
    CONFIG,
    api::{
        EmptyResult, JsonResult, PasswordOrOtpData,
-        core::{
+        core::{log_user_event, two_factor::generate_recover_code},
            log_user_event,
            two_factor::{VerificationTokenData, generate_recover_code},
        },
    },
-    auth::{ClientHeaders, Headers, two_factor},
+    auth::{ClientHeaders, Headers},
    crypto,
    db::{
        DbConn,
-        models::{
+        models::{AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorType, User, UserId},
            AuthRequest, AuthRequestId, DeviceId, EventType, TwoFactor, TwoFactorIncomplete, TwoFactorType, User,
            UserId,
        },
    },
    error::{Error, MapResult},
    mail,
 };
 pub fn routes() -> Vec<Route> {
-    routes![get_email, send_email_login, send_email, email, disable_email]
+    routes![get_email, send_email_login, send_email, email,]
 }
 #[derive(Deserialize)]
@@ -69,56 +63,28 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
    let user = if let Some(email) = email {
        let Some(user) = User::find_by_mail(email, &conn).await else {
-            err!(
+            err!("Username or password is incorrect. Try again.")
                "Username or password is incorrect. Try again",
                format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
            )
        };
        if let Some(master_password_hash) = master_password_hash {
            // Check password
            if !user.check_valid_password(master_password_hash) {
-                err!(
+                err!("Username or password is incorrect. Try again.")
                    "Username or password is incorrect. Try again",
                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
                )
            }
        } else if let Some(auth_request_id) = auth_request_id {
            let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
                err!("AuthRequest doesn't exist", "User not found")
            };
            let Some(code) = &data.auth_request_access_code else {
                err!("no auth request access code")
            };
            let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, &conn).await
            else {
                err!("AuthRequest doesn't exist", "Invalid auth request or does not belong to user")
            };
-            let request_expired = Utc::now().naive_utc() >= auth_request.creation_date + TimeDelta::minutes(5);
+            if auth_request.device_type != client_headers.device_type
            if !auth_request.approved.unwrap_or(false)
                || auth_request.authentication_date.is_some()
                || request_expired
                || auth_request.device_type != client_headers.device_type
                || auth_request.request_ip != client_headers.ip.ip.to_string()
                || !auth_request.check_access_code(code)
            {
-                err!(
+                err!("AuthRequest doesn't exist", "Invalid device, IP or code")
                    "AuthRequest doesn't exist",
                    "Auth request not approved, already used or expired, or invalid device, IP or code"
                )
            }
        } else if let Some(device_identifier) = &data.device_identifier {
            // iOS/Android SSO logins send the email and device id but no password hash,
            // so accept a device that has a pending 2FA login for this user
            if TwoFactorIncomplete::find_by_user_and_device(&user.uuid, device_identifier, &conn).await.is_none() {
                err!(
                    "Username or password is incorrect. Try again",
                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
                )
            }
            debug!(
                "Email 2FA fallback: pending login. Username: {}. Device: {}.",
                user.email,
                device_identifier.to_string().escape_debug()
            );
        } else {
            err!("No password hash has been submitted.")
        }
@@ -130,10 +96,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
        };
        // SSO login only sends device id, so we get the user by the most recently used device
        let Some(user) = User::find_by_device_for_email2fa(device_identifier, &conn).await else {
-            err!(
+            err!("Username or password is incorrect. Try again.")
                "Username or password is incorrect. Try again",
                format!("IP: {}. Device: {}.", client_headers.ip.ip, device_identifier.to_string().escape_debug())
            )
        };
        user
@@ -144,8 +107,8 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
 /// Generate the token, save the data for later verification and send email to user
 pub async fn send_token(user_id: &UserId, conn: &DbConn) -> EmptyResult {
-    let mut twofactor =
+    let type_ = TwoFactorType::Email as i32;
-        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
+    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, type_, conn).await.map_res("Two factor not found")?;
    let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
@@ -168,19 +131,18 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
    data.validate(&user, false, &conn).await?;
    let (enabled, mfa_email) =
-        if let Some(x) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+        match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await {
-            let twofactor_data = EmailTokenData::from_json(&x.data)?;
+            Some(x) => {
-            (true, Some(twofactor_data.email))
+                let twofactor_data = EmailTokenData::from_json(&x.data)?;
-        } else {
+                (true, json!(twofactor_data.email))
-            (false, None)
+            }
            _ => (false, serde_json::value::Value::Null),
        };
-    Ok(Json(rocket::serde::json::json!({
+    Ok(Json(json!({
-        "email": rocket::serde::json::json!({
+        "email": mfa_email,
-            "enabled": enabled,
+        "enabled": enabled,
-            "email": mfa_email,
+        "object": "twoFactorEmail"
        }),
        "userVerificationToken": two_factor::email_token(user.uuid, mfa_email, enabled),
    })))
 }
@@ -189,36 +151,43 @@ async fn get_email(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn
 struct SendEmailData {
    /// Email where 2FA codes will be sent to, can be different than user email account.
    email: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 /// Send a verification email to the specified email address to check whether it exists/belongs to user.
 #[post("/two-factor/send-email", data = "<data>")]
-async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> JsonResult {
+async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -> EmptyResult {
    let data: SendEmailData = data.into_inner();
    let user = headers.user;
-    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email.clone(), false)?;
+    PasswordOrOtpData {
        master_password_hash: data.master_password_hash,
        otp: data.otp,
    }
    .validate(&user, false, &conn)
    .await?;
    if !CONFIG._enable_email_2fa() {
        err!("Email 2FA is disabled")
    }
-    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
+    let type_ = TwoFactorType::Email as i32;
    if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
        tf.delete(&conn).await?;
    }
    let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
-    let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));
+    let twofactor_data = EmailTokenData::new(data.email, generated_token);
    // Uses EmailVerificationChallenge as type to show that it's not verified yet.
-    let twofactor =
+    let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
        TwoFactor::new(user.uuid.clone(), TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
    twofactor.save(&conn).await?;
    mail::send_token(&twofactor_data.email, &twofactor_data.last_token.map_res("Token is empty")?).await?;
-    Ok(Json(json!({})))
+    Ok(())
 }
 #[derive(Deserialize, Serialize)]
@@ -226,7 +195,8 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
 struct EmailData {
    email: String,
    token: String,
-    user_verification_token: String,
+    master_password_hash: Option<String>,
    otp: Option<String>,
 }
 /// Verify email belongs to user and can be used for 2FA email codes.
@@ -235,11 +205,17 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
    let data: EmailData = data.into_inner();
    let mut user = headers.user;
-    two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email, false)?;
+    // This is the last step in the verification process, delete the otp directly afterwards
    PasswordOrOtpData {
        master_password_hash: data.master_password_hash,
        otp: data.otp,
    }
    .validate(&user, true, &conn)
    .await?;
-    let mut twofactor = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::EmailVerificationChallenge, &conn)
+    let type_ = TwoFactorType::EmailVerificationChallenge as i32;
-        .await
+    let mut twofactor =
-        .map_res("Two factor not found")?;
+        TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await.map_res("Two factor not found")?;
    let mut email_data = EmailTokenData::from_json(&twofactor.data)?;
@@ -258,26 +234,13 @@ async fn email(data: Json<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
    generate_recover_code(&mut user, &conn).await;
-    log_user_event(EventType::UserUpdated2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
+    log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
-    Ok(Json(json!({})))
+    Ok(Json(json!({
-}
+        "email": email_data.email,
-
+        "enabled": "true",
-#[delete("/two-factor/email", data = "<data>")]
+        "object": "twoFactorEmail"
-async fn disable_email(data: Json<VerificationTokenData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    })))
    let user = headers.user;
    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email, &conn).await {
        let twofactor_data = EmailTokenData::from_json(&twofactor.data)?;
        two_factor::validate_email(&data.user_verification_token, &user.uuid, twofactor_data.email, true)?;
        twofactor.delete(&conn).await?;
        log_user_event(EventType::UserDisabled2fa, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await;
    }
    super::check_2fa_state(&user, headers.device.atype, &headers.ip.ip, &conn).await?;
    Ok(())
 }
 /// Validate the email code when used as TwoFactor token mechanism
@@ -289,8 +252,9 @@ pub async fn validate_email_code_str(
    conn: &DbConn,
 ) -> EmptyResult {
    let mut email_data = EmailTokenData::from_json(data)?;
-    let mut twofactor =
+    let mut twofactor = TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email as i32, conn)
-        TwoFactor::find_by_user_and_type(user_id, TwoFactorType::Email, conn).await.map_res("Two factor not found")?;
+        .await
        .map_res("Two factor not found")?;
    let Some(issued_token) = &email_data.last_token else {
        err!(
            format!("No token available! IP: {ip}"),
@@ -302,7 +266,7 @@ pub async fn validate_email_code_str(
    if !crypto::ct_eq(issued_token, token) {
        email_data.add_attempt();
-        if email_data.attempts >= u64::from(CONFIG.email_attempts_limit()) {
+        if email_data.attempts >= CONFIG.email_attempts_limit() {
            email_data.reset_token();
        }
        twofactor.data = email_data.to_json();
@@ -321,7 +285,7 @@ pub async fn validate_email_code_str(
    twofactor.save(conn).await?;
    let dt = DateTime::from_timestamp(email_data.token_sent, 0).expect("Email token timestamp invalid.").naive_utc();
-    let max_time = i64::from(CONFIG.email_expiration_time());
+    let max_time = CONFIG.email_expiration_time().cast_signed();
    if dt + TimeDelta::try_seconds(max_time).unwrap() < Utc::now().naive_utc() {
        err!(
            "Token has expired",
@@ -349,10 +313,10 @@ pub struct EmailTokenData {
 }
 impl EmailTokenData {
-    pub fn new(email: String, token: Option<String>) -> EmailTokenData {
+    pub fn new(email: String, token: String) -> EmailTokenData {
        EmailTokenData {
            email,
-            last_token: token,
+            last_token: Some(token),
            token_sent: Utc::now().timestamp(),
            attempts: 0,
        }
@@ -390,8 +354,7 @@ pub async fn activate_email_2fa(user: &User, conn: &DbConn) -> EmptyResult {
    if user.verified_at.is_none() {
        err!("Auto-enabling of email 2FA failed because the users email address has not been verified!");
    }
-    // The token is set when the first code is sent
+    let twofactor_data = EmailTokenData::new(user.email.clone(), String::new());
    let twofactor_data = EmailTokenData::new(user.email.clone(), None);
    let twofactor = TwoFactor::new(user.uuid.clone(), TwoFactorType::Email, twofactor_data.to_json());
    twofactor.save(conn).await
 }
Author	SHA1	Message	Date
Daniel García	5f03e74feb	Fix get_groups_data when not using full_access	2026-07-24 16:20:34 +02:00
Daniel García	94a798e9dd	Fix get_groups_data	2026-07-24 15:47:51 +02:00
Daniel García	5a02e80a5a	Trusted proxies, unauthenticated rate limits and various fixes	2026-07-20 01:24:46 +02:00
		`@@ -1 +0,0 @@`
			`ALTER TABLE org_policies DROP COLUMN revision_date;`
		`@@ -1 +0,0 @@`
			`-- TEXT has no size limit here, only MySQL needed the change`