Implement V2 registration support

Signed-off-by: BlackDex <black.dex@gmail.com>
2026-10-25 10:46:47 +02:00 · 2026-09-08 12:54:05 +02:00
62 changed files with 3184 additions and 3977 deletions
@@ -1,7 +1,7 @@
-# Ignore everything
+// Ignore everything
 *

-# Allow what is needed
+// Allow what is needed
 !.git
 !docker/healthcheck.sh
 !docker/start.sh
@@ -402,13 +402,10 @@
 ## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
 ## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
 ## - "pm-30529-webauthn-related-origins":
-## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
-## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
 ## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
 ## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=

 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -58,13 +58,13 @@ jobs:

    steps:
      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
        with:
          platforms: "arm64,arm"

      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -185,7 +185,7 @@ jobs:

      - name: Bake ${{ matrix.base_image }} containers
        id: bake_vw
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        env:
          BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          sarif_file: 'trivy-results.sarif'
@@ -23,4 +23,4 @@ jobs:

      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
+        uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3 # v1.50.0
@@ -24,7 +24,7 @@ jobs:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
        with:
          # intentionally not scanning the entire repository,
          # since it contains integration tests.
@@ -18,7 +18,7 @@ repos:

  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
  - repo: https://github.com/crate-ci/typos
-    rev: 512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
+    rev: 4d9c206a77c041268485162b8e2579ad7a5cb9a3 # v1.50.0
    hooks:
      - id: typos
        always_run: true
@@ -18,7 +18,6 @@ extend-ignore-re = [
    "COSE",
    "COSEKey",
    "COSEAlgorithm",
-    "CoseEncrypt0",
    # Ignore this specific string as it's valid
    "Ensure they are valid OTPs",
    # This word is misspelled upstream
@@ -12,6 +12,7 @@ members = ["macros"]
 name = "vaultwarden"
 version = "1.0.0"
 authors = ["Daniel García <dani-garcia@users.noreply.github.com>"]
+readme = "README.md"
 build = "build.rs"
 repository.workspace = true
 edition.workspace = true
@@ -40,7 +41,6 @@ vendored_openssl = ["openssl/vendored"]
 enable_mimalloc = ["dep:mimalloc"]
 s3 = [
    "opendal/services-s3",
-    "dep:opendal-http-transport-reqwest",
    "dep:aws-config",
    "dep:aws-credential-types",
    "dep:aws-smithy-runtime-api",
@@ -107,7 +107,7 @@ serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"

 # A safe, extensible ORM and Query builder
-diesel = { version = "2.3.13", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
+diesel = { version = "2.3.12", features = ["chrono", "r2d2", "numeric", "64-column-tables"] }
 diesel_migrations = "2.3.2"

 derive_more = { version = "2.1.1", features = [
@@ -125,11 +125,11 @@ libsqlite3-sys = { version = "0.38.2", optional = true }
 # Crypto-related libraries
 rand = "0.10.2"
 ring = "0.17.14"
-rustls = { version = "0.23.45", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.43", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"

 # UUID generation
-uuid = { version = "1.26.1", features = ["v4"] }
+uuid = { version = "1.26.0", features = ["v4"] }

 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
@@ -143,7 +143,7 @@ job_scheduler_ng = "2.5.0"
 data-encoding = "2.11.1"

 # JWT library
-jsonwebtoken = { version = "11.1.0", default-features = false, features = ["rust_crypto", "use_pem"] }
+jsonwebtoken = { version = "11.0.0", default-features = false, features = ["rust_crypto", "use_pem"] }

 # TOTP library
 totp-lite = "2.0.1"
@@ -183,7 +183,7 @@ email_address = "0.2.9"
 handlebars = { version = "6.4.4", features = ["dir_source"] }

 # HTTP client (Used for favicons, version check, DUO and HIBP API)
-reqwest = { version = "0.13.5", default-features = false, features = [
+reqwest = { version = "0.13.4", default-features = false, features = [
    # Misc
    "charset",
    "cookies",
@@ -201,7 +201,7 @@ reqwest = { version = "0.13.5", default-features = false, features = [
    "socks",
    "system-proxy",
 ] }
-hickory-resolver = "0.26.3"
+hickory-resolver = "0.26.1"

 # Favicon extraction libraries
 html5gum = "0.8.4"
@@ -215,7 +215,7 @@ bytes = "1.12.1"
 svg-hush = "0.9.7"

 # Cache function results (Used for version check and favicon fetching)
-cached = { version = "4.0.0", features = ["async"] }
+cached = { version = "3.1.1", features = ["async"] }

 # Used for custom short lived cookie jar during favicon extraction
 cookie = "0.18.2"
@@ -232,7 +232,7 @@ pastey = "0.2.3"
 governor = "0.10.4"

 # CIDR parsing for the trusted proxies of the client IP header
-ipnet = "2.12.2"
+ipnet = "2.12.1"

 # OIDC for SSO
 openidconnect = { version = "4.0.1", default-features = false }
@@ -257,18 +257,17 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }

 # File are accessed through Apache OpenDAL
-opendal = { version = "0.59.2", default-features = false, features = ["services-fs"] }
-opendal-http-transport-reqwest = { version = "0.59.2", default-features = false, features = ["rustls-no-provider"], optional = true }
+opendal = { version = "0.58.2", default-features = false, features = ["services-fs"] }

 # For retrieving AWS credentials, including temporary SSO credentials
-aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
+aws-config = { version = "1.11.0", optional = true, default-features = false, features = [
    "behavior-version-latest",
    "credentials-process",
    "rt-tokio",
    "sso",
 ] }
 aws-credential-types = { version = "1.3.0", optional = true }
-aws-smithy-runtime-api = { version = "1.16.2", optional = true }
+aws-smithy-runtime-api = { version = "1.15.0", optional = true }
 http = { version = "1.5.0", optional = true }
 reqsign-aws-v4 = { version = "3.3.0", optional = true }
 reqsign-core = { version = "3.3.1", optional = true }
@@ -5,8 +5,7 @@ vault_image_digest: "sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10
 # We use the linux/amd64 platform shell scripts since there is no difference between the different platform scripts
 # https://github.com/tonistiigi/xx | https://hub.docker.com/r/tonistiigi/xx/tags
 xx_image_digest: "sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707"
-# The `rust_version` variable is extracted from `rust-toolchain.toml`
-# rust_version: x.yy.z # Rust version to be used
+rust_version: 1.98.0 # Rust version to be used
 debian_version: trixie # Debian release name to be used
 alpine_version: "3.24" # Alpine version to be used
 # For which platforms/architectures will we try to build images
@@ -32,10 +32,10 @@ FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330
 ########################## ALPINE BUILD IMAGES ##########################
 ## NOTE: The Alpine Base Images do not support other platforms then linux/amd64 and linux/arm64
 ## And for Alpine we define all build images here, they will only be loaded when actually used
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.98.1 AS build_amd64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.98.1 AS build_arm64
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.98.1 AS build_armv7
-FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.98.1 AS build_armv6
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:x86_64-musl-stable-1.98.0 AS build_amd64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:aarch64-musl-stable-1.98.0 AS build_arm64
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:armv7-musleabihf-stable-1.98.0 AS build_armv7
+FROM --platform=$BUILDPLATFORM ghcr.io/blackdex/rust-musl:arm-musleabi-stable-1.98.0 AS build_armv6

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
@@ -36,7 +36,7 @@ FROM --platform=linux/amd64 docker.io/tonistiigi/xx@sha256:c64defb9ed5a91eacb37f

 ########################## BUILD IMAGE ##########################
 # hadolint ignore=DL3006
-FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.1-slim-trixie AS build
+FROM --platform=$BUILDPLATFORM docker.io/library/rust:1.98.0-slim-trixie AS build
 # hadolint ignore=DL3067
 COPY --from=xx / /
 ARG TARGETARCH
@@ -3,23 +3,17 @@
 import os
 import argparse
 import json
-import tomllib
 import yaml
 import jinja2

 # Load settings file
-with open('DockerSettings.yaml', 'r', encoding='utf-8') as yaml_file:
+with open("DockerSettings.yaml", 'r') as yaml_file:
 	yaml_data = yaml.safe_load(yaml_file)

-# Extract the rust_version from the rust-toolchain.toml file
-script_dir = os.path.dirname(os.path.abspath(__file__))
-with open(os.path.join(script_dir, '..', 'rust-toolchain.toml'), 'rb') as toolchain_file:
-    yaml_data["rust_version"] = tomllib.load(toolchain_file)["toolchain"]["channel"]
-
 settings_env = jinja2.Environment(
 	loader=jinja2.FileSystemLoader(os.getcwd()),
 )
-settings_yaml = yaml.safe_load(settings_env.get_template('DockerSettings.yaml').render(yaml_data))
+settings_yaml = yaml.safe_load(settings_env.get_template("DockerSettings.yaml").render(yaml_data))

 args_parser = argparse.ArgumentParser()
 args_parser.add_argument('template_file', help='Jinja2 template file to render.')
@@ -14,7 +14,7 @@ proc-macro = true

 [dependencies]
 quote = "1.0.47"
-syn = "3.0.6"
+syn = "3.0.4"

 [lints]
 workspace = true
@@ -1 +0,0 @@
-ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -4,4 +4,3 @@ ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
-ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -2,7 +2,8 @@ ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
+
+DROP TABLE IF EXISTS user_signature_key_pairs;

 CREATE TABLE user_signature_key_pairs (
    uuid                CHAR(36) NOT NULL PRIMARY KEY,
@@ -1 +0,0 @@
-ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -4,4 +4,3 @@ ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
-ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -2,7 +2,8 @@ ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
+
+DROP TABLE IF EXISTS user_signature_key_pairs;

 CREATE TABLE user_signature_key_pairs (
    uuid                CHAR(36) NOT NULL PRIMARY KEY,
@@ -1 +0,0 @@
-ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -4,4 +4,3 @@ ALTER TABLE users DROP COLUMN signed_public_key;
 ALTER TABLE users DROP COLUMN security_state;
 ALTER TABLE users DROP COLUMN security_version;
 ALTER TABLE users DROP COLUMN v2_upgrade_token;
-ALTER TABLE users_organizations DROP COLUMN v2_upgrade_token;
@@ -2,7 +2,8 @@ ALTER TABLE users ADD COLUMN signed_public_key TEXT;
 ALTER TABLE users ADD COLUMN security_state TEXT;
 ALTER TABLE users ADD COLUMN security_version INTEGER;
 ALTER TABLE users ADD COLUMN v2_upgrade_token TEXT;
-ALTER TABLE users_organizations ADD COLUMN v2_upgrade_token TEXT;
+
+DROP TABLE IF EXISTS user_signature_key_pairs;

 CREATE TABLE user_signature_key_pairs (
    uuid                TEXT     NOT NULL PRIMARY KEY,
@@ -1 +0,0 @@
-ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.98.1"
+channel = "1.98.0"
 components = [ "rustfmt", "clippy" ]
 profile = "minimal"
@@ -1,7 +1,6 @@
 use std::collections::HashSet;

 use chrono::Utc;
-use num_traits::FromPrimitive;
 use rocket::{
    http::Status,
    request::{FromRequest, Outcome, Request},
@@ -12,7 +11,7 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::{
-        AnonymousNotify, ApiResult, EmptyResult, JsonResult, LogOutReason, Notify, PasswordOrOtpData, UpdateType,
+        AnonymousNotify, ApiResult, EmptyResult, JsonResult, Notify, PasswordOrOtpData, UpdateType,
        core::{accept_org_invite, log_user_event, two_factor::email},
        master_password_policy, register_push_device, unregister_push_device,
    },
@@ -22,9 +21,9 @@ use crate::{
        DbConn, DbPool,
        models::{
            AuthRequest, AuthRequestId, Cipher, CipherId, Device, DeviceId, DeviceType, DeviceWithAuthRequest,
-            EmergencyAccess, EmergencyAccessId, EventType, Folder, FolderId, Invitation, KeyId, Membership,
-            MembershipId, OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, SignatureAlgorithm,
-            User, UserId, UserKdfType, UserSignatureKeyPair,
+            EmergencyAccess, EmergencyAccessId, EventType, Folder, FolderId, Invitation, Membership, MembershipId,
+            OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, SignatureAlgorithm, User, UserId,
+            UserKdfType, UserSignatureKeyPair,
        },
    },
    mail,
@@ -49,10 +48,7 @@ pub fn routes() -> Vec<rocket::Route> {
        post_password,
        post_set_password,
        post_kdf,
-        get_key_rotation_data,
        post_rotatekey,
-        post_user_key,
-        post_rotate_user_keys,
        post_sstamp,
        post_email_token,
        post_email,
@@ -176,14 +172,6 @@ impl RegisterDataCompat {
        self.fold(|rdc| &rdc.key, |rdcu| &rdcu.master_password_unlock.key).to_owned()
    }

-    /// The id of the user key, which only the current format carries.
-    fn key_id(&self) -> Option<KeyId> {
-        match self {
-            RegisterDataCompat::RegisterDataOld(_) => None,
-            RegisterDataCompat::RegisterDataCur(rdcu) => rdcu.master_password_unlock.contained_key_id.clone(),
-        }
-    }
-
    // When comparing with salt, email need to be normalized:
    //  - https://github.com/bitwarden/clients/blob/web-v2026.5.0/libs/common/src/key-management/master-password/services/master-password.service.ts#L171
    fn unprocessable(&self, email: &str) -> bool {
@@ -285,7 +273,7 @@ impl AccountKeysData {

        let v2 = match (signed_public_key, self.signature_key_pair, self.security_state) {
            (Some(signed_public_key), Some(signature_key_pair), Some(security_state)) => {
-                let Some(signature_algorithm) = SignatureAlgorithm::parse(&signature_key_pair.signature_algorithm)
+                let Some(signature_algorithm) = SignatureAlgorithm::from_str(&signature_key_pair.signature_algorithm)
                else {
                    err!(format!("Unsupported signature algorithm: {}", signature_key_pair.signature_algorithm))
                };
@@ -313,23 +301,6 @@ impl AccountKeysData {
    }
 }

-impl WrappedAccountCryptographicState {
-    /// This shape is v2-only: the key pairs and security state were already required by the
-    /// deserializer, so a missing signed public key fails the all-or-nothing check in
-    /// [`AccountKeysData::validate`] rather than falling back to v1, which would silently turn a
-    /// rotation into a downgrade.
-    fn validate(self) -> ApiResult<ValidatedAccountKeys> {
-        AccountKeysData {
-            user_key_encrypted_account_private_key: None,
-            account_public_key: None,
-            public_key_encryption_key_pair: Some(self.public_key_encryption_key_pair),
-            signature_key_pair: Some(self.signature_key_pair),
-            security_state: Some(self.security_state),
-        }
-        .validate()
-    }
-}
-
 impl From<KeysData> for ValidatedAccountKeys {
    fn from(keys: KeysData) -> Self {
        Self {
@@ -341,19 +312,6 @@ impl From<KeysData> for ValidatedAccountKeys {
 }

 impl ValidatedAccountKeys {
-    /// The keys of a request that may carry either shape. `accountKeys` supersedes the flat `keys`
-    /// object when both are sent.
-    fn from_request(account_keys: Option<AccountKeysData>, keys: Option<KeysData>) -> ApiResult<Option<Self>> {
-        match (account_keys, keys) {
-            (Some(account_keys), _) => account_keys.validate().map(Some),
-            (None, keys) => Ok(keys.map(Self::from)),
-        }
-    }
-
-    fn is_v2(&self) -> bool {
-        self.v2.is_some()
-    }
-
    /// Writes the parts of the state that live on the user itself. The user still needs saving, and
    /// [`Self::save_signature_key_pair`] still needs calling once it has been.
    ///
@@ -381,7 +339,7 @@ impl ValidatedAccountKeys {
            return Ok(());
        };

-        let mut key_pair = match UserSignatureKeyPair::find_by_user(user_id, conn).await {
+        let mut key_pair = match UserSignatureKeyPair::find_active_by_user(user_id, conn).await {
            Some(mut key_pair) => {
                key_pair.signature_algorithm = v2.signature_algorithm as i32;
                key_pair.signing_key.clone_from(&v2.signing_key);
@@ -417,7 +375,6 @@ pub struct MasterPasswordUnlock {

    #[serde(alias = "masterKeyWrappedUserKey")]
    key: String,
-    contained_key_id: Option<KeyId>,
 }

 #[derive(Debug, Deserialize)]
@@ -545,11 +502,10 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
        err!("The field Name must be a string with a maximum length of 50.");
    }

-    // Check against the password hint setting and the keys here so if they fail,
-    // the user can retry without losing their invitation below.
+    // Check against the password hint setting here so if it fails, the user
+    // can retry without losing their invitation below.
    let password_hint = clean_password_hint(data.master_password_hint.as_ref());
    enforce_password_hint_setting(password_hint.as_ref())?;
-    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;

    let mut user = match User::find_by_mail(&email, &conn).await {
        Some(user) => {
@@ -606,13 +562,13 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
        user.name = name;
    }

+    let account_keys = match (data.account_keys, data.keys) {
+        (Some(account_keys), _) => Some(account_keys.validate()?),
+        (None, Some(keys)) => Some(keys.into()),
+        (None, None) => None,
+    };
    if let Some(ref account_keys) = account_keys {
        account_keys.apply(&mut user)?;
-        // Like upstream, only a v2 registration records the user key id. A v1 account reports it
-        // later, through `user-key-id`.
-        if account_keys.is_v2() {
-            user.key_id = data.compat.key_id();
-        }
    }

    if email_verified {
@@ -671,7 +627,11 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
    let password_hint = clean_password_hint(data.master_password_hint.as_ref());
    enforce_password_hint_setting(password_hint.as_ref())?;

-    let account_keys = ValidatedAccountKeys::from_request(data.account_keys, data.keys)?;
+    let account_keys = match (data.account_keys, data.keys) {
+        (Some(account_keys), _) => Some(account_keys.validate()?),
+        (None, Some(keys)) => Some(keys.into()),
+        (None, None) => None,
+    };

    set_kdf_data(&mut user, data.compat.kdf())?;

@@ -687,10 +647,6 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:

    if let Some(ref account_keys) = account_keys {
        account_keys.apply(&mut user)?;
-        // As in `register`, only a v2 account records the user key id here
-        if account_keys.is_v2() {
-            user.key_id = data.compat.key_id();
-        }
    }

    if let Some(identifier) = data.org_identifier
@@ -834,8 +790,6 @@ struct PostKeysData {
    #[serde(flatten)]
    keys: Option<KeysData>,
    account_keys: Option<AccountKeysData>,
-    // The id of the user key these account keys belong to, only honored for v2 `accountKeys`
-    user_key_id: Option<KeyId>,
 }

 #[post("/accounts/keys", data = "<data>")]
@@ -844,25 +798,9 @@ async fn post_keys(data: Json<PostKeysData>, headers: Headers, conn: DbConn) ->

    let mut user = headers.user;

-    // This only sets the keys of an account that has none yet. Replacing existing ones is what a key
-    // rotation does, with the checks that go with it.
-    if user.private_key.is_some() || user.public_key.is_some() {
-        err!("User has existing keypair")
-    }
-
    // `accountKeys` supersedes the flat `keys` object when both are sent.
    let account_keys = match (data.account_keys, data.keys) {
-        (Some(account_keys), _) => {
-            let account_keys = account_keys.validate()?;
-            if !account_keys.is_v2() {
-                err!("AccountKeys are only supported for V2 encryption.")
-            }
-            // A client that predates key ids sends none, and reports it later through `user-key-id`
-            if data.user_key_id.is_some() {
-                user.key_id = data.user_key_id;
-            }
-            account_keys
-        }
+        (Some(account_keys), _) => account_keys.validate()?,
        (None, Some(keys)) => keys.into(),
        (None, None) => err!("No account keys provided"),
    };
@@ -915,8 +853,6 @@ async fn post_password(data: Json<ChangePassData>, headers: Headers, conn: DbCon
                err!("Invalid master password salt")
            }

-            validate_key_id_unchanged(&user, &unlock_data)?;
-
            (authentication_data.master_password_authentication_hash, unlock_data.master_key_wrapped_user_key)
        } else if let (Some(new_master_password_hash), Some(new_key)) = (data.new_master_password_hash, data.key) {
            (new_master_password_hash, new_key)
@@ -1002,21 +938,6 @@ struct UnlockData {
    salt: String,
    kdf: KDFData,
    master_key_wrapped_user_key: String,
-    contained_key_id: Option<KeyId>,
-}
-
-/// A password or KDF change re-wraps the same user key, so a key id sent with it has to be the
-/// current one. Either may be missing: from a client that predates key ids, or a user whose key id
-/// isn't known yet. There is nothing to compare in those cases.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
-fn validate_key_id_unchanged(user: &User, unlock_data: &UnlockData) -> EmptyResult {
-    if let (Some(current), Some(contained)) = (&user.key_id, &unlock_data.contained_key_id)
-        && current != contained
-    {
-        err!("Invalid user key sent in master-password unlock data.")
-    }
-    Ok(())
 }

 #[derive(Deserialize)]
@@ -1043,8 +964,6 @@ async fn post_kdf(data: Json<ChangeKdfData>, headers: Headers, conn: DbConn, nt:
        err!("Invalid master password salt")
    }

-    validate_key_id_unchanged(&headers.user, &data.unlock_data)?;
-
    let mut user = headers.user;

    set_kdf_data(&mut user, &data.unlock_data.kdf)?;
@@ -1086,62 +1005,43 @@ struct UpdateEmergencyAccessData {
 #[serde(rename_all = "camelCase")]
 struct UpdateResetPasswordData {
    organization_id: OrganizationId,
-    // Absent in a v1 -> v2 upgrade, which keeps the key the organization already holds
-    reset_password_key: Option<String>,
+    reset_password_key: String,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct KeyData {
    account_unlock_data: RotateAccountUnlockData,
-    account_keys: AccountKeysData,
+    account_keys: RotateAccountKeys,
    account_data: RotateAccountData,
    old_master_key_authentication_hash: String,
-    new_user_key_id: Option<KeyId>,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RotateAccountUnlockData {
+    emergency_access_unlock_data: Vec<UpdateEmergencyAccessData>,
    master_password_unlock_data: MasterPasswordUnlockData,
-    #[serde(flatten)]
-    common: CommonUnlockData,
+    organization_account_recovery_unlock_data: Vec<UpdateResetPasswordData>,
 }

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct MasterPasswordUnlockData {
-    #[serde(flatten)]
-    kdf: KDFData,
+    kdf_type: i32,
+    kdf_iterations: i32,
+    kdf_parallelism: Option<i32>,
+    kdf_memory: Option<i32>,
    email: String,
    master_key_authentication_hash: String,
    master_key_encrypted_user_key: String,
-    contained_key_id: Option<KeyId>,
 }

-/// The unlock data both rotation endpoints share. Vaultwarden has neither trusted device encryption
-/// nor passkey login, so `key-rotation-data` reports none of either and these must arrive empty.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Models/Requests/CommonUnlockDataRequestModel.cs>
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
-struct CommonUnlockData {
-    emergency_access_unlock_data: Vec<UpdateEmergencyAccessData>,
-    organization_account_recovery_unlock_data: Vec<UpdateResetPasswordData>,
-    #[serde(default)]
-    passkey_unlock_data: Vec<Value>,
-    #[serde(default)]
-    device_key_unlock_data: Vec<Value>,
-    v2_upgrade_token: Option<V2UpgradeTokenData>,
-}
-
-/// Lets clients that still hold the v1 user key derive the v2 one after another client upgraded the
-/// account, so a v1 -> v2 upgrade doesn't have to log every other session out. Opaque to us.
-#[derive(Deserialize, Serialize)]
-#[serde(rename_all = "camelCase")]
-struct V2UpgradeTokenData {
-    wrapped_user_key1: String,
-    wrapped_user_key2: String,
+struct RotateAccountKeys {
+    user_key_encrypted_account_private_key: String,
+    account_public_key: String,
 }

 #[derive(Deserialize)]
@@ -1152,148 +1052,31 @@ struct RotateAccountData {
    sends: Vec<SendData>,
 }

-/// Body of `rotate-user-keys`, which rotates the keys without touching the master password.
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct RotateUserKeysData {
-    wrapped_account_cryptographic_state: WrappedAccountCryptographicState,
-    unlock_data: CommonUnlockData,
-    account_data: RotateAccountData,
-    unlock_method_data: UnlockMethodData,
-    new_user_key_id: Option<KeyId>,
-}
-
-/// The v2-only account cryptographic state, where all three parts are mandatory.
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct WrappedAccountCryptographicState {
-    public_key_encryption_key_pair: PublicKeyEncryptionKeyPairData,
-    signature_key_pair: SignatureKeyPairData,
-    security_state: SecurityStateData,
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct UnlockMethodData {
-    unlock_method: i32,
-    master_password_unlock_data: Option<RotateMasterPasswordUnlockData>,
-    // `keyConnectorKeyWrappedUserKey` is deliberately not read: that unlock method is rejected.
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct RotateMasterPasswordUnlockData {
-    kdf: KDFData,
-    salt: String,
-    master_key_wrapped_user_key: String,
-    contained_key_id: Option<KeyId>,
-}
-
-/// The user key wrapped in the master password unlock data has to be the new one.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/MasterPasswordUnlockData.cs>
-fn validate_contained_key_id(contained_key_id: Option<&KeyId>, new_user_key_id: Option<&KeyId>) -> EmptyResult {
-    match (contained_key_id, new_user_key_id) {
-        // Neither is sent by clients that predate key ids
-        (None, None) => Ok(()),
-        (Some(contained), Some(new)) if contained == new => Ok(()),
-        _ => err!("Invalid user key sent in master-password unlock data."),
-    }
-}
-
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Enums/UnlockMethod.cs>
-#[derive(num_derive::FromPrimitive)]
-enum UnlockMethod {
-    Tde = 0,
-    MasterPassword = 1,
-    KeyConnector = 2,
-}
-
-/// The rotation-specific checks on the new account keys.
-///
-/// A rotation re-wraps the existing keys under a new user key; it must not swap the identity the
-/// account presents to others. So the public key never changes, and for an account that is already
-/// v2 the verifying key doesn't either — only the *wrapped* signing key does. A v1 account may gain
-/// a signature key pair, which is the v1 -> v2 upgrade.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/UserKey/Implementations/RotateUserAccountKeysCommand.cs>
-async fn validate_rotation_account_keys(keys: &ValidatedAccountKeys, user: &User, conn: &DbConn) -> EmptyResult {
-    if user.public_key.as_ref() != Some(&keys.public_key) {
-        err!("Changing the asymmetric keypair is not possible during key rotation")
-    }
-
-    let Some(v2) = &keys.v2 else {
-        if user.is_v2() {
-            err!("Cannot downgrade an account from v2 to v1 encryption during key rotation")
-        }
-        // A v1 rotation: the private key stays wrapped by an AES-CBC-HMAC user key
-        if enc_string_type(&keys.private_key) != Some(ENC_TYPE_AES_CBC_256_HMAC_SHA256) {
-            err!("The provided account private key was not wrapped with AES-256-CBC-HMAC")
-        }
-        return Ok(());
-    };
-
-    // Both a v2 rotation and the v1 -> v2 upgrade end up with a COSE user key wrapping the private keys
-    if enc_string_type(&v2.signing_key) != Some(ENC_TYPE_COSE_ENCRYPT0) {
-        err!("The provided signing key data is not wrapped with XChaCha20-Poly1305.")
-    }
-    if enc_string_type(&keys.private_key) != Some(ENC_TYPE_COSE_ENCRYPT0) {
-        err!("The provided private key encryption key is not wrapped with XChaCha20-Poly1305.")
-    }
-    if v2.verifying_key.is_empty() || v2.signed_public_key.is_empty() || v2.security_state.is_empty() {
-        err!("The v2 account keys are missing the verifying key, signed public key or security state")
-    }
-
-    if !user.is_v2() {
-        // The v1 -> v2 upgrade, which is where the signature key pair comes from
-        return Ok(());
-    }
-
-    let Some(key_pair) = UserSignatureKeyPair::find_by_user(&user.uuid, conn).await else {
-        err!("The account is missing its signature key pair")
-    };
-    if key_pair.verifying_key != v2.verifying_key {
-        err!("Changing the verifying key is not possible during key rotation")
-    }
-
-    Ok(())
-}
-
-/// `AesCbc256_HmacSha256_B64`, the v1 user key
-const ENC_TYPE_AES_CBC_256_HMAC_SHA256: &str = "2";
-/// `CoseEncrypt0B64`, the v2 user key
-const ENC_TYPE_COSE_ENCRYPT0: &str = "7";
-
-/// The encryption type of an EncString, the number before the first `.`.
-fn enc_string_type(enc_string: &str) -> Option<&str> {
-    enc_string.split_once('.').map(|(enc_type, _)| enc_type)
-}
-
-impl KDFData {
-    /// Whether these are the settings the user already has, which a key rotation can't change.
-    fn is_unchanged_for(&self, user: &User) -> bool {
-        user.client_kdf_type == self.kdf
-            && user.client_kdf_iter == self.kdf_iterations
-            && user.client_kdf_memory == self.kdf_memory
-            && user.client_kdf_parallelism == self.kdf_parallelism
-    }
-}
-
-/// A rotation re-encrypts everything under the new user key, so anything left out would be
-/// unreadable afterwards. Both rotation endpoints require the client to send the complete set.
-fn validate_rotation_data(
-    data: &RotateData,
+fn validate_keydata(
+    data: &KeyData,
    existing_ciphers: &[Cipher],
    existing_folders: &[Folder],
    existing_emergency_access: &[EmergencyAccess],
    existing_memberships: &[Membership],
    existing_sends: &[Send],
+    user: &User,
 ) -> EmptyResult {
-    let account_data = &data.account_data;
+    if user.client_kdf_type != data.account_unlock_data.master_password_unlock_data.kdf_type
+        || user.client_kdf_iter != data.account_unlock_data.master_password_unlock_data.kdf_iterations
+        || user.client_kdf_memory != data.account_unlock_data.master_password_unlock_data.kdf_memory
+        || user.client_kdf_parallelism != data.account_unlock_data.master_password_unlock_data.kdf_parallelism
+        || user.email != data.account_unlock_data.master_password_unlock_data.email
+    {
+        err!("Changing the kdf variant or email is not supported during key rotation");
+    }
+    if user.public_key.as_ref() != Some(&data.account_keys.account_public_key) {
+        err!("Changing the asymmetric keypair is not possible during key rotation")
+    }

    // Check that we're correctly rotating all the user's ciphers
    let existing_cipher_ids = existing_ciphers.iter().map(|c| &c.uuid).collect::<HashSet<&CipherId>>();
-    let provided_cipher_ids = account_data
+    let provided_cipher_ids = data
+        .account_data
        .ciphers
        .iter()
        .filter(|c| c.organization_id.is_none())
@@ -1305,7 +1088,8 @@ fn validate_rotation_data(

    // Check that we're correctly rotating all the user's folders
    let existing_folder_ids = existing_folders.iter().map(|f| &f.uuid).collect::<HashSet<&FolderId>>();
-    let provided_folder_ids = account_data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
+    let provided_folder_ids =
+        data.account_data.folders.iter().filter_map(|f| f.id.as_ref()).collect::<HashSet<&FolderId>>();
    if !provided_folder_ids.is_superset(&existing_folder_ids) {
        err!("All existing folders must be included in the rotation")
    }
@@ -1313,8 +1097,12 @@ fn validate_rotation_data(
    // Check that we're correctly rotating all the user's emergency access keys
    let existing_emergency_access_ids =
        existing_emergency_access.iter().map(|ea| &ea.uuid).collect::<HashSet<&EmergencyAccessId>>();
-    let provided_emergency_access_ids =
-        data.unlock_data.emergency_access_unlock_data.iter().map(|ea| &ea.id).collect::<HashSet<&EmergencyAccessId>>();
+    let provided_emergency_access_ids = data
+        .account_unlock_data
+        .emergency_access_unlock_data
+        .iter()
+        .map(|ea| &ea.id)
+        .collect::<HashSet<&EmergencyAccessId>>();
    if !provided_emergency_access_ids.is_superset(&existing_emergency_access_ids) {
        err!("All existing emergency access keys must be included in the rotation")
    }
@@ -1323,7 +1111,7 @@ fn validate_rotation_data(
    let existing_reset_password_ids =
        existing_memberships.iter().map(|m| &m.org_uuid).collect::<HashSet<&OrganizationId>>();
    let provided_reset_password_ids = data
-        .unlock_data
+        .account_unlock_data
        .organization_account_recovery_unlock_data
        .iter()
        .map(|rp| &rp.organization_id)
@@ -1334,7 +1122,7 @@ fn validate_rotation_data(

    // Check that we're correctly rotating all the user's sends
    let existing_send_ids = existing_sends.iter().map(|s| &s.uuid).collect::<HashSet<&SendId>>();
-    let provided_send_ids = account_data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
+    let provided_send_ids = data.account_data.sends.iter().filter_map(|s| s.id.as_ref()).collect::<HashSet<&SendId>>();
    if !provided_send_ids.is_superset(&existing_send_ids) {
        err!("All existing sends must be included in the rotation")
    }
@@ -1342,194 +1130,43 @@ fn validate_rotation_data(
    Ok(())
 }

-/// The public keys and encrypted keysets that participate in a key rotation, so the client can
-/// re-share the new user key without having to piece this together from several endpoints.
-///
-/// The four collections must always be present, even when empty: the SDK errors out if any of them
-/// is missing. `trustedDeviceKeyData` and `passkeyKeyData` are always empty here, since vaultwarden
-/// supports neither trusted device encryption nor passkey (PRF) login.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/UserKey/Queries/KeyRotationDataQuery.cs>
-#[get("/accounts/key-management/key-rotation-data")]
-async fn get_key_rotation_data(headers: Headers, conn: DbConn) -> JsonResult {
-    let user_id = &headers.user.uuid;
-
-    let mut organization_data = Vec::new();
-    for membership in Membership::find_by_user(user_id, &conn).await {
-        // Only memberships actually enrolled in account recovery take part in the rotation.
-        if membership.reset_password_key.is_none() {
-            continue;
-        }
-        let Some(org) = Organization::find_by_uuid(&membership.org_uuid, &conn).await else {
-            continue;
-        };
-        let Some(public_key) = org.public_key else {
-            continue;
-        };
-        organization_data.push(json!({
-            "organizationId": org.uuid,
-            "organizationName": org.name,
-            "organizationPublicKey": public_key,
-            "object": "organizationPasswordResetKeyData",
-        }));
-    }
-
-    let mut emergency_access_data = Vec::new();
-    for emergency_access in EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await {
-        // Without a stored key there is nothing to re-share.
-        if emergency_access.key_encrypted.is_none() {
-            continue;
-        }
-        let Some(grantee_id) = emergency_access.grantee_uuid.clone() else {
-            continue;
-        };
-        let Some(grantee) = User::find_by_uuid(&grantee_id, &conn).await else {
-            continue;
-        };
-        let Some(public_key) = grantee.public_key.clone() else {
-            continue;
-        };
-        emergency_access_data.push(json!({
-            "id": emergency_access.uuid,
-            "granteeId": grantee_id,
-            "granteeName": grantee.name,
-            "granteeEmail": grantee.email,
-            "publicKey": public_key,
-            "object": "emergencyAccessKeyData",
-        }));
-    }
-
-    Ok(Json(json!({
-        "organizationPasswordResetKeyData": organization_data,
-        "emergencyAccessKeyData": emergency_access_data,
-        "trustedDeviceKeyData": [],
-        "passkeyKeyData": [],
-        "object": "keyRotationData",
-    })))
-}
-
-/// Everything a rotation replaces, once each endpoint's wrapper has been peeled off.
-struct RotateData {
-    account_keys: ValidatedAccountKeys,
-    account_data: RotateAccountData,
-    unlock_data: CommonUnlockData,
-    /// Only v2 (COSE) user keys have an id, so this is `None` for a v1 -> v1 rotation.
-    new_user_key_id: Option<KeyId>,
-    /// The new user key, wrapped by the master key.
-    wrapped_user_key: String,
-    /// Only for `rotate-user-account-keys`, where the master password changes along with the keys.
-    new_password_hash: Option<String>,
-}
-
-impl CommonUnlockData {
-    /// We advertise no trusted devices or passkeys in `key-rotation-data`, so a client sending
-    /// either has produced keys for something that doesn't exist here. Silently dropping them would
-    /// leave the client believing an unlock method was rotated when it wasn't.
-    fn validate(&self) -> EmptyResult {
-        if !self.passkey_unlock_data.is_empty() {
-            err!("Passkey unlock is not supported")
-        }
-        if !self.device_key_unlock_data.is_empty() {
-            err!("Trusted device unlock is not supported")
-        }
-        Ok(())
-    }
-}
-
 #[post("/accounts/key-management/rotate-user-account-keys", data = "<data>")]
 async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
+    // TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
    let data: KeyData = data.into_inner();

    if !headers.user.check_valid_password(&data.old_master_key_authentication_hash) {
        err!("Invalid password")
    }

-    let unlock_data = data.account_unlock_data.master_password_unlock_data;
-    if !unlock_data.kdf.is_unchanged_for(&headers.user) || unlock_data.email != headers.user.email {
-        err!("Changing the kdf variant or email is not supported during key rotation");
-    }
-    validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
-
-    let mut common = data.account_unlock_data.common;
-    // This endpoint always logs every session out, so an upgrade token is never kept here. That
-    // also clears one left over from an earlier upgrade. Ref: upstream's AccountsKeyManagementController
-    common.v2_upgrade_token = None;
-
-    rotate_account(
-        RotateData {
-            account_keys: data.account_keys.validate()?,
-            account_data: data.account_data,
-            unlock_data: common,
-            new_user_key_id: data.new_user_key_id,
-            wrapped_user_key: unlock_data.master_key_encrypted_user_key,
-            new_password_hash: Some(unlock_data.master_key_authentication_hash),
-        },
-        headers,
-        conn,
-        nt,
-    )
-    .await
-}
-
-/// The body shared by both rotation endpoints: check that the client re-encrypted everything, re-save
-/// it, then swap the account keys and the wrapped user key.
-async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
-    // TODO: See if we can wrap everything within a SQL Transaction. If something fails it should revert everything.
-    data.unlock_data.validate()?;
-
-    let user_id = &headers.user.uuid;
-    let mut existing_ciphers = Cipher::find_owned_by_user(user_id, &conn).await;
-    let mut existing_folders = Folder::find_by_user(user_id, &conn).await;
-    let mut existing_emergency_access = EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await;
-    let mut existing_memberships = Membership::find_by_user(user_id, &conn).await;
-    // We only rotate the reset password key if it is set.
-    existing_memberships.retain(|m| m.reset_password_key.is_some());
-    let mut existing_sends = Send::find_by_user(user_id, &conn).await;
-
-    validate_rotation_data(
-        &data,
-        &existing_ciphers,
-        &existing_folders,
-        &existing_emergency_access,
-        &existing_memberships,
-        &existing_sends,
-    )?;
-
-    validate_rotation_account_keys(&data.account_keys, &headers.user, &conn).await?;
-
-    // The upgrade token only means anything for a v1 account moving to v2: it lets sessions still
-    // holding the v1 user key pick up the v2 one instead of being forced to re-authenticate. For an
-    // account that is already v2 it is meaningless, so it gets discarded and the security stamp is
-    // reset, as a rotation otherwise would. That ends the refresh tokens, while the access tokens in
-    // use run out on their own, as upstream.
-    let is_upgrade = data.unlock_data.v2_upgrade_token.is_some() && !headers.user.is_v2();
-    let upgrade_token = match &data.unlock_data.v2_upgrade_token {
-        Some(token) if is_upgrade => Some(serde_json::to_string(token)?),
-        _ => None,
-    };
-
-    // An upgrade can't re-wrap the account recovery keys: that needs the organization's public key
-    // to be trusted, and an upgrade shows the user no prompt. So the stored keys are kept, and each
-    // organization gets the upgrade token instead, to unwrap the v2 user key with.
-    // Ref: upstream's OrganizationUserRotationValidator
-    for reset_password_data in &data.unlock_data.organization_account_recovery_unlock_data {
-        let has_key = reset_password_data.reset_password_key.as_deref().is_some_and(|k| !k.is_empty());
-        if is_upgrade && has_key {
-            err!("Account recovery keys cannot be rotated during a V1 to V2 upgrade rotation.")
-        }
-        if !is_upgrade && !has_key {
-            err!("Account recovery keys cannot be null or empty during rotation.")
-        }
-    }
-
    // Validate the import before continuing
    // Bitwarden does not process the import if there is one item invalid.
    // Since we check for the size of the encrypted note length, we need to do that here to pre-validate it.
    // TODO: See if we can optimize the whole cipher adding/importing and prevent duplicate code and checks.
    Cipher::validate_cipher_data(&data.account_data.ciphers)?;

+    let user_id = &headers.user.uuid;
+
    // TODO: Ideally we'd do everything after this point in a single transaction.

+    let mut existing_ciphers = Cipher::find_owned_by_user(user_id, &conn).await;
+    let mut existing_folders = Folder::find_by_user(user_id, &conn).await;
+    let mut existing_emergency_access = EmergencyAccess::find_all_confirmed_by_grantor_uuid(user_id, &conn).await;
+    let mut existing_memberships = Membership::find_by_user(user_id, &conn).await;
+    // We only rotate the reset password key if it is set.
+    existing_memberships.retain(|m| m.reset_password_key.is_some());
+    let mut existing_sends = Send::find_by_user(user_id, &conn).await;
+
+    validate_keydata(
+        &data,
+        &existing_ciphers,
+        &existing_folders,
+        &existing_emergency_access,
+        &existing_memberships,
+        &existing_sends,
+        &headers.user,
+    )?;
+
    // Update folder data
    for folder_data in data.account_data.folders {
        // Skip `null` folder id entries.
@@ -1545,7 +1182,7 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
    }

    // Update emergency access data
-    for emergency_access_data in data.unlock_data.emergency_access_unlock_data {
+    for emergency_access_data in data.account_unlock_data.emergency_access_unlock_data {
        let Some(saved_emergency_access) =
            existing_emergency_access.iter_mut().find(|ea| ea.uuid == emergency_access_data.id)
        else {
@@ -1557,17 +1194,14 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
    }

    // Update reset password data
-    for reset_password_data in data.unlock_data.organization_account_recovery_unlock_data {
+    for reset_password_data in data.account_unlock_data.organization_account_recovery_unlock_data {
        let Some(membership) =
            existing_memberships.iter_mut().find(|m| m.org_uuid == reset_password_data.organization_id)
        else {
            err!("Reset password doesn't exist")
        };

-        if !is_upgrade {
-            membership.reset_password_key = reset_password_data.reset_password_key;
-        }
-        membership.v2_upgrade_token.clone_from(&upgrade_token);
+        membership.reset_password_key = Some(reset_password_data.reset_password_key);
        membership.save(&conn).await?;
    }

@@ -1589,113 +1223,33 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
            };

            // Prevent triggering cipher updates via WebSockets by settings UpdateType::None
-            // Other sessions still hold the old user key, so an update to a re-encrypted cipher could cause issues.
-            // After the user is saved they are logged out, or on an upgrade, told to sync the new key.
+            // The user sessions are invalidated because all the ciphers were re-encrypted and thus triggering an update could cause issues.
+            // We force the users to logout after the user has been saved to try and prevent these issues.
            update_cipher_from_data(saved_cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
        }
    }

    // Update user data
    let mut user = headers.user;
-    user.v2_upgrade_token = upgrade_token;

-    data.account_keys.apply(&mut user)?;
-    // The old id names a key that no longer exists, so it is replaced even when the new key has none.
-    user.key_id = data.new_user_key_id;
+    user.private_key = Some(data.account_keys.user_key_encrypted_account_private_key);
+    user.set_password(
+        &data.account_unlock_data.master_password_unlock_data.master_key_authentication_hash,
+        Some(data.account_unlock_data.master_password_unlock_data.master_key_encrypted_user_key),
+        true,
+        None,
+        &conn,
+    )
+    .await?;

-    user.akey = data.wrapped_user_key;
-    if let Some(new_password_hash) = data.new_password_hash {
-        user.set_password(&new_password_hash, None, false, None, &conn).await?;
-    }
-    // An upgrade keeps the sessions alive, see `is_upgrade` above
-    if !is_upgrade {
-        user.reset_security_stamp_after_key_rotation(&conn).await?;
-    }
-
-    // The key pair goes first: if saving the user then fails during an upgrade, the account is still
-    // v1 and the key pair unused, instead of a v2 account without one, which no client could unlock.
-    // A failure between the two writes of a v2 rotation still needs a transaction to undo.
-    data.account_keys.save_signature_key_pair(&user.uuid, &conn).await?;
-    user.save(&conn).await?;
+    let save_result = user.save(&conn).await;

    // Prevent logging out the client where the user requested this endpoint from.
    // If you do logout the user it will causes issues at the client side.
    // Adding the device uuid will prevent this.
-    // When the sessions were kept alive, the reason lets the other clients sync the new keys (through
-    // the upgrade token) instead of logging out, if they have `pm-31050-no-logout-key-upgrade-rotation`.
-    let reason = is_upgrade.then_some(LogOutReason::KeyRotation);
-    nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await;
+    nt.send_logout(&user, Some(&headers.device), &conn).await;

-    Ok(())
-}
-
-/// Rotates the account keys without changing the master password.
-///
-/// Unlike `rotate-user-account-keys` this carries no proof of the master password: the request is
-/// authorized by the session alone, which is how upstream defines it, and the client has to be
-/// unlocked to produce the payload in the first place.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs>
-#[post("/accounts/key-management/rotate-user-keys", data = "<data>")]
-async fn post_rotate_user_keys(
-    data: Json<RotateUserKeysData>,
-    headers: Headers,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> EmptyResult {
-    let data: RotateUserKeysData = data.into_inner();
-
-    let wrapped_user_key = match UnlockMethod::from_i32(data.unlock_method_data.unlock_method) {
-        Some(UnlockMethod::MasterPassword) => {
-            let Some(unlock_data) = data.unlock_method_data.master_password_unlock_data else {
-                err!("Missing master password unlock data")
-            };
-            if !unlock_data.kdf.is_unchanged_for(&headers.user) {
-                err!("Changing the kdf variant is not supported during key rotation")
-            }
-            if unlock_data.salt != headers.user.email {
-                err!("Invalid master password salt")
-            }
-            validate_contained_key_id(unlock_data.contained_key_id.as_ref(), data.new_user_key_id.as_ref())?;
-            unlock_data.master_key_wrapped_user_key
-        }
-        Some(UnlockMethod::Tde) => err!("Trusted device encryption is not supported"),
-        Some(UnlockMethod::KeyConnector) => err!("Key connector is not supported"),
-        None => err!("Unrecognized unlock method"),
-    };
-
-    rotate_account(
-        RotateData {
-            account_keys: data.wrapped_account_cryptographic_state.validate()?,
-            account_data: data.account_data,
-            unlock_data: data.unlock_data,
-            new_user_key_id: data.new_user_key_id,
-            wrapped_user_key,
-            new_password_hash: None,
-        },
-        headers,
-        conn,
-        nt,
-    )
-    .await
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct KeyIdData {
-    user_key_id: KeyId,
-}
-
-#[post("/accounts/key-management/user-key-id", data = "<data>")]
-async fn post_user_key(data: Json<KeyIdData>, headers: Headers, conn: DbConn) -> EmptyResult {
-    let mut user = headers.user;
-    // Only a backfill for accounts that have none. Afterwards the id changes with the key, in a rotation.
-    if user.key_id.is_some() {
-        err!("User key id is already set.")
-    }
-
-    user.key_id = Some(data.into_inner().user_key_id);
-    user.save(&conn).await
+    save_result
 }

 #[post("/accounts/security-stamp", data = "<data>")]
@@ -2284,7 +1838,7 @@ async fn post_auth_request(
        _ => err!("AuthRequest doesn't exist", "Device verification failed"),
    };

-    let auth_request = AuthRequest::new(
+    let mut auth_request = AuthRequest::new(
        user.uuid.clone(),
        data.device_identifier.clone(),
        client_headers.device_type,
@@ -6,7 +6,6 @@ use rocket::{
    Route,
    form::{Form, FromForm},
    fs::TempFile,
-    http::Status,
    serde::json::Json,
 };
 use serde_json::Value;
@@ -22,9 +21,8 @@ use crate::{
        DbConn, DbPool,
        models::{
            Archive, Attachment, AttachmentId, Cipher, CipherId, Collection, CollectionCipher, CollectionGroup,
-            CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, KeyId,
-            Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, User, UserId,
-            is_data_blob_encrypted,
+            CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, Membership,
+            MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, UserId,
        },
    },
    util::{NumberOrString, deser_opt_nonempty_str, save_temp_file},
@@ -163,12 +161,6 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
    let policies_json: Vec<Value> =
        OrgPolicy::find_confirmed_by_user(&headers.user.uuid, &conn).await.iter().map(OrgPolicy::to_json).collect();

-    let policies_new_json: Vec<Value> = OrgPolicy::find_accepted_and_confirmed_by_user(&headers.user.uuid, &conn)
-        .await
-        .iter()
-        .map(OrgPolicy::to_json)
-        .collect();
-
    let domains_json = if data.exclude_domains {
        Value::Null
    } else {
@@ -190,32 +182,24 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
            // https://github.com/bitwarden/android/blob/release/2025.12-rc41/network/src/main/kotlin/com/bitwarden/network/model/MasterPasswordUnlockDataJson.kt#L22-L26
            "masterKeyEncryptedUserKey": headers.user.akey,
            "masterKeyWrappedUserKey": headers.user.akey,
-            "salt": headers.user.email,
-            "containedKeyId": headers.user.key_id,
+            "salt": headers.user.email
        })
    } else {
        Value::Null
    };

-    // Upstream omits these two when unset rather than sending null.
-    let mut user_decryption = json!({ "masterPasswordUnlock": master_password_unlock });
-    if let Some(key_id) = &headers.user.key_id {
-        user_decryption["userKeyId"] = json!(key_id);
-    }
-    if let Some(v2_upgrade_token) = headers.user.v2_upgrade_token_json() {
-        user_decryption["v2UpgradeToken"] = v2_upgrade_token;
-    }
-
    Ok(Json(json!({
        "profile": user_json,
        "folders": folders_json,
        "collections": collections_json,
        "policies": policies_json,
-        "policiesNew": policies_new_json,
        "ciphers": ciphers_json,
        "domains": domains_json,
        "sends": sends_json,
-        "userDecryption": user_decryption,
+        "userDecryption": {
+            "masterPasswordUnlock": master_password_unlock,
+            "v2UpgradeToken": headers.user.v2_upgrade_token_json(),
+        },
        "object": "sync"
    })))
 }
@@ -277,23 +261,15 @@ pub struct CipherData {

    key: Option<String>,

-    pub encrypted_for: UserId, // Added in web-v2025.6.0
-    // Added in web-v2025.8.1, Optional for compat
-    pub encrypted_by_key_id: Option<KeyId>,
-
    /*
    Login = 1,
    SecureNote = 2,
    Card = 3,
    Identity = 4,
    SshKey = 5
-    BankAccount = 6
-    DriversLicense = 7
-    Passport = 8
    */
    pub r#type: i32,
-    // Absent on a blob-encrypted cipher, whose name is sealed inside `data`
-    pub name: Option<String>,
+    pub name: String,
    pub notes: Option<String>,
    fields: Option<Value>,

@@ -303,12 +279,6 @@ pub struct CipherData {
    card: Option<Value>,
    identity: Option<Value>,
    ssh_key: Option<Value>,
-    bank_account: Option<Value>,
-    drivers_license: Option<Value>,
-    passport: Option<Value>,
-
-    // The sealed blob of a v2 account's cipher, which replaces all of the fields above
-    data: Option<String>,

    favorite: Option<bool>,
    reprompt: Option<i32>,
@@ -331,70 +301,6 @@ pub struct CipherData {
    archived_date: Option<String>,
 }

-/// A field of a [`CipherData`] that fails upstream's model validation.
-#[derive(Debug)]
-pub struct CipherValidationError {
-    pub field: &'static str,
-    pub message: String,
-}
-
-impl From<CipherValidationError> for crate::Error {
-    fn from(e: CipherValidationError) -> Self {
-        Self::new_msg(e.message)
-    }
-}
-
-/// A user-owned cipher must be encrypted with the user's current key. Organization ciphers use the
-/// organization key, which has no id yet, and either id may be missing: from a client that predates
-/// the field, or a user whose key id isn't known yet. There is nothing to compare in those cases.
-///
-/// Ref: upstream's `CiphersController.ValidateCipherEncryptedByUser`
-fn validate_encrypted_by_user_key(data: &CipherData, user: &User, is_org_cipher: bool) -> EmptyResult {
-    if !is_org_cipher
-        && let (Some(cipher_key_id), Some(user_key_id)) = (&data.encrypted_by_key_id, &user.key_id)
-        && cipher_key_id != user_key_id
-    {
-        err!("Cipher was not encrypted with the current user key. Please try again.")
-    }
-    Ok(())
-}
-
-/// Upstream's `[StringLength(500000)]` on `CipherRequestModel.Data`
-const MAX_CIPHER_DATA_LENGTH: usize = 500_000;
-
-impl CipherData {
-    /// Whether the content is a single blob rather than the per-type fields. This parses `data`, so
-    /// callers that need the answer more than once should keep it.
-    pub fn is_blob(&self) -> bool {
-        self.data.as_deref().is_some_and(is_data_blob_encrypted)
-    }
-
-    /// Checks the content the way upstream's model validation does, before anything is saved.
-    /// `is_blob` is [`Self::is_blob`].
-    ///
-    /// Ref: <https://github.com/bitwarden/server/blob/main/src/Api/Vault/Models/Request/CipherRequestModel.cs>
-    pub fn validate_content(&self, is_blob: bool) -> Result<(), CipherValidationError> {
-        if let Some(data) = &self.data
-            && data.len() > MAX_CIPHER_DATA_LENGTH
-        {
-            return Err(CipherValidationError {
-                field: "Data",
-                message: format!("The field Data must be a string with a maximum length of {MAX_CIPHER_DATA_LENGTH}."),
-            });
-        }
-
-        // A blob carries the name inside it, so only the other formats need one
-        if !is_blob && self.name.as_deref().is_none_or(|n| n.trim().is_empty()) {
-            return Err(CipherValidationError {
-                field: "Name",
-                message: String::from("The Name field is required."),
-            });
-        }
-
-        Ok(())
-    }
-}
-
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PartialCipherData {
@@ -428,17 +334,12 @@ async fn post_ciphers_create(
 ) -> JsonResult {
    let mut data: ShareCipherData = data.into_inner();

-    if data.cipher.encrypted_for != headers.user.uuid {
-        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
-    }
-    validate_encrypted_by_user_key(&data.cipher, &headers.user, data.cipher.organization_id.is_some())?;
-
    // This check is usually only needed in update_cipher_from_data(), but we
    // need it here as well to avoid creating an empty cipher in the call to
    // cipher.save() below.
    enforce_personal_ownership_policy(Some(&data.cipher), &headers, &conn).await?;

-    let mut cipher = Cipher::new(data.cipher.r#type, String::new());
+    let mut cipher = Cipher::new(data.cipher.r#type, data.cipher.name.clone());
    cipher.user_uuid = Some(headers.user.uuid.clone());
    cipher.save(&conn).await?;

@@ -462,19 +363,13 @@ async fn post_ciphers_create(
 async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    let mut data: CipherData = data.into_inner();

-    if data.encrypted_for != headers.user.uuid {
-        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
-    }
-
-    validate_encrypted_by_user_key(&data, &headers.user, data.organization_id.is_some())?;
-
    // The web/browser clients set this field to null as expected, but the
    // mobile clients seem to set the invalid value `0001-01-01T00:00:00`,
    // which results in a warning message being logged. This field isn't
    // needed when creating a new cipher, so just ignore it unconditionally.
    data.last_known_revision_date = None;

-    let mut cipher = Cipher::new(data.r#type, String::new());
+    let mut cipher = Cipher::new(data.r#type, data.name.clone());
    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherCreate).await?;

    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -523,9 +418,6 @@ pub async fn update_cipher_from_data(

    enforce_personal_ownership_policy(Some(&data), headers, conn).await?;

-    let is_blob = data.is_blob();
-    data.validate_content(is_blob)?;
-
    // Check that the client isn't updating an existing cipher with stale data.
    // And only perform this check when not importing ciphers, else the date/time check will fail.
    if ut != UpdateType::None
@@ -619,53 +511,38 @@ pub async fn update_cipher_from_data(
        3 => data.card,
        4 => data.identity,
        5 => data.ssh_key,
-        6 => data.bank_account,
-        7 => data.drivers_license,
-        8 => data.passport,
        _ => err!("Invalid type"),
    };

-    if let Some(blob) = data.data.filter(|_| is_blob) {
-        // A blob holds all of the content, the name included, so nothing is kept outside it. The name
-        // column can't be null, so it's left empty; `to_json` reports it as null, as upstream does.
-        // TODO: Make `ciphers.name` nullable and store `None` here instead.
-        cipher.name = String::new();
-        cipher.notes = None;
-        cipher.fields = None;
-        cipher.password_history = None;
-        cipher.data = blob;
-    } else {
-        let Some(mut type_data) = type_data_opt else {
-            err!("Data missing")
-        };
+    let type_data = if let Some(mut data) = type_data_opt {
        // Remove the 'Response' key from the base object.
-        type_data.as_object_mut().unwrap().remove("response");
+        data.as_object_mut().unwrap().remove("response");
        // Remove the 'Response' key from every Uri.
-        if type_data["uris"].is_array() {
-            type_data["uris"] = clean_cipher_data(type_data["uris"].clone());
+        if data["uris"].is_array() {
+            data["uris"] = clean_cipher_data(data["uris"].clone());
        }
-
-        // `validate_content` made sure there is a name
-        cipher.name = data.name.unwrap_or_default();
-        cipher.notes = data.notes;
-        cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
-        cipher.password_history = data.password_history.map(|f| f.to_string());
-        cipher.data = type_data.to_string();
-    }
+        data
+    } else {
+        err!("Data missing")
+    };

    cipher.key = data.key;
+    cipher.name = data.name;
+    cipher.notes = data.notes;
+    cipher.fields = data.fields.map(|f| clean_cipher_data(f).to_string());
+    cipher.data = type_data.to_string();
+    cipher.password_history = data.password_history.map(|f| f.to_string());
    cipher.reprompt = data.reprompt.filter(|r| *r == RepromptType::None as i32 || *r == RepromptType::Password as i32);

    cipher.save(conn).await?;
    cipher.move_to_folder(data.folder_id, &headers.user.uuid, conn).await?;
    cipher.set_favorite(data.favorite, &headers.user.uuid, conn).await?;

-    match data.archived_date {
-        Some(dt_str) => match NaiveDateTime::parse_from_str(&dt_str, "%+") {
+    if let Some(dt_str) = data.archived_date {
+        match NaiveDateTime::parse_from_str(&dt_str, "%+") {
            Ok(dt) => cipher.set_archived_at(dt, &headers.user.uuid, conn).await?,
            Err(err) => warn!("Error parsing ArchivedDate '{dt_str}': {err}"),
-        },
-        None => cipher.unarchive(&headers.user.uuid, conn).await?,
+        }
    }

    if ut != UpdateType::None {
@@ -750,7 +627,7 @@ async fn post_ciphers_import(data: Json<ImportData>, headers: Headers, conn: DbC
        let folder_id = relations_map.get(&index).and_then(|i| folders.get(*i).cloned());
        cipher_data.folder_id = folder_id;

-        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
+        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
        update_cipher_from_data(&mut cipher, cipher_data, &headers, None, &conn, &nt, UpdateType::None).await?;
    }

@@ -818,8 +695,6 @@ async fn put_cipher(
        err!("Cipher is not write accessible")
    }

-    validate_encrypted_by_user_key(&data, &headers.user, cipher.organization_uuid.is_some())?;
-
    update_cipher_from_data(&mut cipher, data, &headers, None, &conn, &nt, UpdateType::SyncCipherUpdate).await?;

    Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?))
@@ -199,26 +199,6 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
-            // Only the vault notification banner click is accepted from clients. The rest of
-            // the 1500..=1599 range is written server-side and must not be forgeable by a client.
-            t if t == EventType::OrganizationUserNotificationBannerActionClicked as i32 => {
-                if let Some(org_id) = &event.organization_id
-                    && let Some(membership) =
-                        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await
-                {
-                    log_event_impl(
-                        event.r#type,
-                        &membership.uuid,
-                        org_id,
-                        &headers.user.uuid,
-                        headers.device.atype,
-                        Some(event_date),
-                        &headers.ip.ip,
-                        &conn,
-                    )
-                    .await;
-                }
-            }
            _ => {
                // The cipher determines the organization the event is logged to, so make sure the
                // user can actually access it instead of trusting the provided cipher uuid.
@@ -1075,7 +1075,7 @@ async fn send_invite(
            && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
            && data.permissions.get("createNewCollections") == Some(&json!(true)));

-    let mut user_created: bool;
+    let mut user_created: bool = false;
    for email in &data.emails {
        let mut member_status = MembershipStatus::Invited as i32;
        let user = match User::find_by_mail(email, &conn).await {
@@ -1110,7 +1110,6 @@ async fn send_invite(
                        member_status = MembershipStatus::Accepted as i32;
                    }
                }
-                user_created = false;
                user
            }
        };
@@ -1885,7 +1884,7 @@ async fn post_org_import(
        cipher_data.folder_id = None;
        // Replace the client-provided, unvalidated organizationId with the real target org
        cipher_data.organization_id = Some(org_id.clone());
-        let mut cipher = Cipher::new(cipher_data.r#type, String::new());
+        let mut cipher = Cipher::new(cipher_data.r#type, cipher_data.name.clone());
        update_cipher_from_data(
            &mut cipher,
            cipher_data,
@@ -3,7 +3,7 @@ use num_traits::FromPrimitive;
 use rocket::{
    Route,
    form::{Form, FromForm},
-    http::{Accept, Cookie, CookieJar, MediaType, SameSite},
+    http::{Cookie, CookieJar, SameSite},
    response::Redirect,
    serde::json::Json,
 };
@@ -1061,18 +1061,11 @@ enum RegisterVerificationResponse {
    #[response(status = 204)]
    NoContent(()),
    Token(Json<String>),
-    PlainToken(String),
-}
-
-// Return JSON only when the client explicitly requests it, otherwise return plain text.
-fn accepts_json(accept: Option<&Accept>) -> bool {
-    accept.is_some_and(|accept| accept.preferred().media_type() == &MediaType::JSON)
 }

 #[post("/accounts/register/send-verification-email", data = "<data>")]
 async fn register_verification_email(
    data: Json<RegisterVerificationData>,
-    accept: Option<&Accept>,
    ip: ClientIp,
    conn: DbConn,
 ) -> ApiResult<RegisterVerificationResponse> {
@@ -1110,11 +1103,7 @@ async fn register_verification_email(
    } else {
        // If email verification is not required, return the token directly
        // the clients will use this token to finish the registration
-        Ok(if accepts_json(accept) {
-            RegisterVerificationResponse::Token(Json(token))
-        } else {
-            RegisterVerificationResponse::PlainToken(token)
-        })
+        Ok(RegisterVerificationResponse::Token(Json(token)))
    }
 }

@@ -23,7 +23,7 @@ pub use crate::api::{
    icons::routes as icons_routes,
    identity::routes as identity_routes,
    notifications::routes as notifications_routes,
-    notifications::{AnonymousNotify, LogOutReason, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
+    notifications::{AnonymousNotify, Notify, UpdateType, WS_ANONYMOUS_SUBSCRIPTIONS, WS_USERS},
    push::{
        push_cipher_update, push_folder_update, push_logout, push_send_update, push_user_update, register_push_device,
        unregister_push_device,
@@ -383,36 +383,23 @@ impl WebSocketUsers {
    }

    pub async fn send_logout(&self, user: &User, acting_device: Option<&Device>, conn: &DbConn) {
-        self.send_logout_with_reason(user, acting_device, None, conn).await;
-    }
-
-    /// A logout that clients may handle differently depending on `reason`, e.g. syncing instead of
-    /// logging out after a key rotation that kept the sessions alive.
-    pub async fn send_logout_with_reason(
-        &self,
-        user: &User,
-        acting_device: Option<&Device>,
-        reason: Option<LogOutReason>,
-        conn: &DbConn,
-    ) {
        // Skip any processing if both WebSockets and Push are not active
        if *NOTIFICATIONS_DISABLED {
            return;
        }
        let acting_device_id = acting_device.map(|d| d.uuid.clone());
-        let mut payload =
-            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))];
-        if let Some(reason) = reason {
-            payload.push(("Reason".into(), (reason as i32).into()));
-        }
-        let data = create_update(payload, UpdateType::LogOut, acting_device_id);
+        let data = create_update(
+            vec![("UserId".into(), user.uuid.to_string().into()), ("Date".into(), serialize_date(user.updated_at))],
+            UpdateType::LogOut,
+            acting_device_id,
+        );

        if CONFIG.enable_websocket() {
            self.send_update(&user.uuid, &data).await;
        }

        if CONFIG.push_enabled() {
-            push_logout(user, acting_device, reason, conn).await;
+            push_logout(user, acting_device, conn).await;
        }
    }

@@ -680,15 +667,6 @@ fn create_ping() -> Vec<u8> {
    serialize(&Value::Array(vec![6.into()]))
 }

-/// Why a logout was pushed. Absent for a plain logout.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Enums/PushNotificationLogOutReason.cs>
-/// (`KdfChange = 0` is not sent by vaultwarden yet.)
-#[derive(Copy, Clone, Eq, PartialEq)]
-pub enum LogOutReason {
-    KeyRotation = 1,
-}
-
 // https://github.com/bitwarden/server/blob/375af7c43b10d9da03525d41452f95de3f921541/src/Core/Enums/PushType.cs
 #[derive(Copy, Clone, Eq, PartialEq)]
 pub enum UpdateType {
@@ -12,7 +12,7 @@ use tokio::sync::RwLock;

 use crate::{
    CONFIG,
-    api::{ApiResult, EmptyResult, LogOutReason, UpdateType},
+    api::{ApiResult, EmptyResult, UpdateType},
    db::{
        DbConn,
        models::{AuthRequestId, Cipher, Device, Folder, PushId, Send, User, UserId},
@@ -188,7 +188,7 @@ pub async fn push_cipher_update(ut: UpdateType, cipher: &Cipher, device: &Device
    }
 }

-pub async fn push_logout(user: &User, acting_device: Option<&Device>, reason: Option<LogOutReason>, conn: &DbConn) {
+pub async fn push_logout(user: &User, acting_device: Option<&Device>, conn: &DbConn) {
    if Device::check_user_has_push_device(&user.uuid, conn).await {
        tokio::task::spawn(send_to_push_relay(json!({
            "userId": user.uuid,
@@ -198,8 +198,7 @@ pub async fn push_logout(user: &User, acting_device: Option<&Device>, reason: Op
            "type": UpdateType::LogOut as i32,
            "payload": {
                "userId": user.uuid,
-                "date": format_date(&user.updated_at),
-                "reason": reason.map(|r| r as i32),
+                "date": format_date(&user.updated_at)
            },
            "clientType": null,
            "installationId": null
@@ -30,7 +30,7 @@ use crate::{
        models::{
            AttachmentId, CipherId, Collection, CollectionId, Device, DeviceId, DeviceType, EmergencyAccessId,
            EventType, Membership, MembershipId, MembershipStatus, MembershipType, OrgApiKeyId, OrganizationId,
-            SendFileId, SendId, User, UserId,
+            SendFileId, SendId, User, UserId, UserStampException,
        },
    },
    error::Error,
@@ -667,13 +667,31 @@ impl<'r> FromRequest<'r> for Headers {
        };

        if user.security_stamp != claims.sstamp {
-            let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
-                err_handler!("Error getting current route for stamp exception")
-            };
+            if let Some(stamp_exception) =
+                user.stamp_exception.as_deref().and_then(|s| serde_json::from_str::<UserStampException>(s).ok())
+            {
+                let Some(current_route) = request.route().and_then(|r| r.name.as_deref()) else {
+                    err_handler!("Error getting current route for stamp exception")
+                };

-            // Expired exceptions are dropped the next time the stamp is reset, not here: writing them
-            // back from this request could undo a reset made since the user was read.
-            if !user.stamp_exceptions().iter().any(|e| e.allows(&claims.sstamp, current_route)) {
+                // Check if the stamp exception has expired first.
+                // Then, check if the current route matches any of the allowed routes.
+                // After that check the stamp in exception matches the one in the claims.
+                if Utc::now().timestamp() > stamp_exception.expire {
+                    // If the stamp exception has been expired remove it from the database.
+                    // This prevents checking this stamp exception for new requests.
+                    let mut user = user;
+                    user.reset_stamp_exception();
+                    if let Err(e) = user.save(&conn).await {
+                        error!("Error updating user: {e:#?}");
+                    }
+                    err_handler!("Stamp exception is expired")
+                } else if !stamp_exception.routes.contains(&current_route.to_owned()) {
+                    err_handler!("Invalid security stamp: Current route and exception route do not match")
+                } else if stamp_exception.security_stamp != claims.sstamp {
+                    err_handler!("Invalid security stamp for matched stamp exception")
+                }
+            } else {
                err_handler!("Invalid security stamp")
            }
        }
@@ -1427,29 +1427,20 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
    "pm-5594-safari-account-switching",
    "pm-32413-multi-client-password-management",
    // Autofill Team
-    "enable-basic-auth-response",
    "ssh-agent",
    "ssh-agent-v2",
    // Key Management Team
    "ssh-key-vault-item",
    "pm-25373-windows-biometrics-v2",
    "pm-26340-linux-biometrics-v2",
-    "pm-31050-no-logout-key-upgrade-rotation",
-    "pm-27278-v2-password-registration",
-    "enable-account-encryption-v2-jit-password-registration",
-    "pm-30144-sdk-key-rotation",
-    "force-upgrade-v2-encryption",
    // Mobile Team
    "anon-addy-self-host-alias",
    "simple-login-self-host-alias",
    "mutual-tls",
    "cxp-import-mobile",
    "cxp-export-mobile",
-    "pm-34171-card-scanner",
    // Platform Team
    "pm-30529-webauthn-related-origins",
-    // Vault Team
-    "pm-32009-new-item-types",
 ];

 impl Config {
@@ -41,20 +41,17 @@ impl Archive {
    ) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;
        db_run! { conn:
-            mysql {
-                diesel::insert_into(archives::table)
+            sqlite, mysql {
+                diesel::replace_into(archives::table)
                    .values((
                        archives::user_uuid.eq(user_uuid),
                        archives::cipher_uuid.eq(cipher_uuid),
                        archives::archived_at.eq(archived_at),
                    ))
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(archives::archived_at.eq(archived_at))
                    .execute(conn)
                    .map_res("Error saving archive")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(archives::table)
                    .values((
                        archives::user_uuid.eq(user_uuid),
@@ -82,16 +82,24 @@ impl Attachment {
 impl Attachment {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            mysql {
-                diesel::insert_into(attachments::table)
+            sqlite, mysql {
+                match diesel::replace_into(attachments::table)
                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                    .execute(conn)
-                    .map_res("Error saving attachment")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(attachments::table)
+                            .filter(attachments::id.eq(&self.id))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error saving attachment")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving attachment")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(attachments::table)
                    .values(self)
                    .on_conflict(attachments::id)
@@ -82,23 +82,31 @@ impl AuthRequest {
 }

 impl AuthRequest {
-    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
+    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            mysql {
-                diesel::insert_into(auth_requests::table)
-                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
+            sqlite, mysql {
+                match diesel::replace_into(auth_requests::table)
+                    .values(&*self)
                    .execute(conn)
-                    .map_res("Error saving auth_request")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(auth_requests::table)
+                            .filter(auth_requests::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error auth_request")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error auth_request")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(auth_requests::table)
-                    .values(self)
+                    .values(&*self)
                    .on_conflict(auth_requests::uuid)
                    .do_update()
-                    .set(self)
+                    .set(&*self)
                    .execute(conn)
                    .map_res("Error saving auth_request")
            }
@@ -63,22 +63,6 @@ pub struct Cipher {
    pub reprompt: Option<i32>,
 }

-/// Whether `data` is a sealed cipher blob rather than the legacy per-type JSON.
-///
-/// Ciphers of v2 accounts are encrypted as a single blob that carries everything, name included,
-/// and is opaque to us. It is recognized the same way upstream does, by a top-level
-/// `format_version` key that the legacy JSON never has.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/Vault/Entities/Cipher.cs>
-pub fn is_data_blob_encrypted(data: &str) -> bool {
-    serde_json::from_str::<Value>(data).is_ok_and(|d| is_blob_value(&d))
-}
-
-/// [`is_data_blob_encrypted`] for `data` that was already parsed.
-fn is_blob_value(data: &Value) -> bool {
-    data.get("format_version").is_some()
-}
-
 pub enum RepromptType {
    None = 0,
    Password = 1,
@@ -126,11 +110,6 @@ impl Cipher {
                    .insert(format!("Ciphers[{index}].Notes"), serde_json::to_value([&max_note_size_msg]).unwrap());
            }

-            if let Err(e) = cipher.validate_content(cipher.is_blob()) {
-                validation_errors
-                    .insert(format!("Ciphers[{index}].{}", e.field), serde_json::to_value([e.message]).unwrap());
-            }
-
            // Validate the password history if it contains `null` values and if so, return a warning
            if let Some(Value::Array(password_history)) = &cipher.password_history {
                for pwh in password_history {
@@ -175,11 +154,6 @@ impl Cipher {
    ) -> Result<Value, crate::Error> {
        use crate::util::{format_date, validate_and_format_date};

-        // Parsed once here, since `data` can be large and this runs for every cipher in a sync.
-        // `LowerCase` only lowercases the first letter of each key, so it keeps `format_version`.
-        let type_data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data);
-        let is_blob_encrypted = type_data.as_ref().is_ok_and(is_blob_value);
-
        let mut attachments_json: Value = Value::Null;
        if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(attachments) = cipher_sync_data.cipher_attachments.get(&self.uuid)
@@ -215,62 +189,124 @@ impl Cipher {
            (false, false, false)
        };

-        // Like upstream, a cipher that was stored without fields or password history reports them as
-        // null rather than as an empty list; clients keep the two apart.
-        let fields_json: Option<Vec<_>> = self.fields.as_ref().map(|s| {
-            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
-                .ok()
-                .map(|d| {
-                    d.into_iter()
-                        .map(|mut f| {
-                            // Check if the `type` key is a number, strings break some clients
-                            // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
-                            // If not try to convert the string value to a number and fallback to `1`
-                            // If it is both not a number and not a string, fallback to `1`
-                            match f.data.get("type") {
-                                Some(t) if t.is_number() => {}
-                                Some(t) if t.is_string() => {
-                                    let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
-                                    f.data["type"] = json!(type_num);
-                                }
-                                _ => {
-                                    f.data["type"] = json!(1);
-                                }
+        let fields_json: Vec<_> = self
+            .fields
+            .as_ref()
+            .and_then(|s| {
+                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                    .inspect_err(|e| warn!("Error parsing fields {e:?} for {}", self.uuid))
+                    .ok()
+            })
+            .map(|d| {
+                d.into_iter()
+                    .map(|mut f| {
+                        // Check if the `type` key is a number, strings break some clients
+                        // The fallback type is the hidden type `1`. this should prevent accidental data disclosure
+                        // If not try to convert the string value to a number and fallback to `1`
+                        // If it is both not a number and not a string, fallback to `1`
+                        match f.data.get("type") {
+                            Some(t) if t.is_number() => {}
+                            Some(t) if t.is_string() => {
+                                let type_num = &t.as_str().unwrap_or("1").parse::<u8>().unwrap_or(1);
+                                f.data["type"] = json!(type_num);
                            }
-                            f.data
-                        })
-                        .collect()
-                })
-                .unwrap_or_default()
-        });
+                            _ => {
+                                f.data["type"] = json!(1);
+                            }
+                        }
+                        f.data
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();

-        let password_history_json: Option<Vec<_>> = self.password_history.as_ref().map(|s| {
-            serde_json::from_str::<Vec<LowerCase<Value>>>(s)
-                .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
-                .ok()
-                .map(|d| {
-                    // Check every password history item if they are valid and return it.
-                    // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
-                    // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
-                    d.into_iter()
-                        .filter_map(|d| match d.data.get("password") {
-                            Some(p) if p.is_string() => Some(d.data),
-                            _ => None,
-                        })
-                        .map(|mut d| {
-                            let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
-                                validate_and_format_date(l)
-                            } else {
-                                "1970-01-01T00:00:00.000000Z".to_owned()
-                            };
-                            d["lastUsedDate"] = json!(lud);
-                            d
-                        })
-                        .collect()
-                })
-                .unwrap_or_default()
-        });
+        let password_history_json: Vec<_> = self
+            .password_history
+            .as_ref()
+            .and_then(|s| {
+                serde_json::from_str::<Vec<LowerCase<Value>>>(s)
+                    .inspect_err(|e| warn!("Error parsing password history {e:?} for {}", self.uuid))
+                    .ok()
+            })
+            .map(|d| {
+                // Check every password history item if they are valid and return it.
+                // If a password field has the type `null` skip it, it breaks newer Bitwarden clients
+                // A second check is done to verify the lastUsedDate exists and is a valid DateTime string, if not the epoch start time will be used
+                d.into_iter()
+                    .filter_map(|d| match d.data.get("password") {
+                        Some(p) if p.is_string() => Some(d.data),
+                        _ => None,
+                    })
+                    .map(|mut d| {
+                        let lud = if let Some(l) = d.get("lastUsedDate").and_then(|l| l.as_str()) {
+                            validate_and_format_date(l)
+                        } else {
+                            "1970-01-01T00:00:00.000000Z".to_owned()
+                        };
+                        d["lastUsedDate"] = json!(lud);
+                        d
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+
+        // Get the type_data or a default to an empty json object '{}'.
+        // If not passing an empty object, mobile clients will crash.
+        let mut type_data_json = serde_json::from_str::<LowerCase<Value>>(&self.data)
+            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
+            .map_or_else(|_| Value::Object(serde_json::Map::new()), |d| d.data);
+
+        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
+        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
+        if self.atype == 1 {
+            // Upstream always has an `uri` key/value
+            type_data_json["uri"] = Value::Null;
+            if let Some(uris) = type_data_json["uris"].as_array_mut()
+                && !uris.is_empty()
+            {
+                // Fix uri match values first, they are only allowed to be a number or null
+                // If it is a string, convert it to an int or null if that fails
+                for uri in &mut *uris {
+                    if uri["match"].is_string() {
+                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
+                            Ok(n) => json!(n),
+                            _ => Value::Null,
+                        };
+                        uri["match"] = match_value;
+                    }
+                }
+                type_data_json["uri"] = uris[0]["uri"].clone();
+            }
+
+            // Check if `passwordRevisionDate` is a valid date, else convert it
+            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
+                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
+            }
+        }
+
+        // Fix secure note issues when data is invalid
+        // This breaks at least the native mobile clients
+        if self.atype == 2 {
+            match type_data_json {
+                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
+                _ => {
+                    type_data_json = json!({"type": 0});
+                }
+            }
+        }
+
+        // Fix invalid SSH Entries
+        // This breaks at least the native mobile client if invalid
+        // The only way to fix this is by setting type_data_json to `null`
+        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
+        if self.atype == 5
+            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
+                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
+                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
+        {
+            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
+            type_data_json = Value::Null;
+        }

        let collection_ids = if let Some(cipher_sync_data) = cipher_sync_data {
            if let Some(cipher_collections) = cipher_sync_data.cipher_collections.get(&self.uuid) {
@@ -367,83 +403,10 @@ impl Cipher {
            _ => err!(format!("Cipher {} has an invalid type {}", self.uuid, self.atype)),
        };

-        if is_blob_encrypted {
-            // The blob holds all of the content, so it is sent back as-is and the structured fields
-            // stay null, as upstream does. Only the name needs clearing, the others are never stored.
-            json_object["data"] = json!(self.data);
-            json_object["name"] = Value::Null;
-        } else {
-            json_object[key] = self.legacy_type_data_json(type_data);
-        }
+        json_object[key] = type_data_json;
        Ok(json_object)
    }

-    /// The per-type data (`login`, `card`, …) of a legacy cipher, from `type_data` as parsed from
-    /// `self.data`, with fixups for values that are known to break clients.
-    fn legacy_type_data_json(&self, type_data: Result<Value, serde_json::Error>) -> Value {
-        use crate::util::validate_and_format_date;
-
-        // Get the type_data or a default to an empty json object '{}'.
-        // If not passing an empty object, mobile clients will crash.
-        let mut type_data_json = type_data
-            .inspect_err(|_| warn!("Error parsing data field for {}", self.uuid))
-            .unwrap_or_else(|_| Value::Object(serde_json::Map::new()));
-
-        // NOTE: This was marked as *Backwards Compatibility Code*, but as of January 2021 this is still being used by upstream
-        // Set the first element of the Uris array as Uri, this is needed several (mobile) clients.
-        if self.atype == 1 {
-            // Upstream always has an `uri` key/value
-            type_data_json["uri"] = Value::Null;
-            if let Some(uris) = type_data_json["uris"].as_array_mut()
-                && !uris.is_empty()
-            {
-                // Fix uri match values first, they are only allowed to be a number or null
-                // If it is a string, convert it to an int or null if that fails
-                for uri in &mut *uris {
-                    if uri["match"].is_string() {
-                        let match_value = match uri["match"].as_str().unwrap_or_default().parse::<u8>() {
-                            Ok(n) => json!(n),
-                            _ => Value::Null,
-                        };
-                        uri["match"] = match_value;
-                    }
-                }
-                type_data_json["uri"] = uris[0]["uri"].clone();
-            }
-
-            // Check if `passwordRevisionDate` is a valid date, else convert it
-            if let Some(pw_revision) = type_data_json["passwordRevisionDate"].as_str() {
-                type_data_json["passwordRevisionDate"] = json!(validate_and_format_date(pw_revision));
-            }
-        }
-
-        // Fix secure note issues when data is invalid
-        // This breaks at least the native mobile clients
-        if self.atype == 2 {
-            match type_data_json {
-                Value::Object(ref t) if t.get("type").is_some_and(Value::is_number) => {}
-                _ => {
-                    type_data_json = json!({"type": 0});
-                }
-            }
-        }
-
-        // Fix invalid SSH Entries
-        // This breaks at least the native mobile client if invalid
-        // The only way to fix this is by setting type_data_json to `null`
-        // Opening this ssh-key in the mobile client will probably crash the client, but you can edit, save and afterwards delete it
-        if self.atype == 5
-            && (type_data_json["keyFingerprint"].as_str().is_none_or(str::is_empty)
-                || type_data_json["privateKey"].as_str().is_none_or(str::is_empty)
-                || type_data_json["publicKey"].as_str().is_none_or(str::is_empty))
-        {
-            warn!("Error parsing ssh-key, mandatory fields are invalid for {}", self.uuid);
-            type_data_json = Value::Null;
-        }
-
-        type_data_json
-    }
-
    pub async fn update_users_revision(&self, conn: &DbConn) -> Vec<UserId> {
        let mut user_uuids = Vec::new();
        match self.user_uuid {
@@ -477,16 +440,24 @@ impl Cipher {
        self.updated_at = Utc::now().naive_utc();

        db_run! { conn:
-            mysql {
-                diesel::insert_into(ciphers::table)
+            sqlite, mysql {
+                match diesel::replace_into(ciphers::table)
                    .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                    .execute(conn)
-                    .map_res("Error saving cipher")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(ciphers::table)
+                            .filter(ciphers::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error saving cipher")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving cipher")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(ciphers::table)
                    .values(&*self)
                    .on_conflict(ciphers::uuid)
@@ -694,27 +665,16 @@ impl Cipher {
    }

    async fn get_user_collections_access_flags(&self, user_uuid: &UserId, conn: &DbConn) -> Vec<(bool, bool, bool)> {
-        let user_uuid = user_uuid.to_string();
        conn.run(move |conn| {
            // Check whether this cipher is in any collections accessible to the
            // user. If so, retrieve the access flags for each collection.
-            // The user must have a confirmed membership in the cipher's
-            // organization, since users_collections rows are kept when a
-            // membership is revoked or not confirmed yet.
            ciphers::table
                .filter(ciphers::uuid.eq(&self.uuid))
                .inner_join(ciphers_collections::table.on(ciphers::uuid.eq(ciphers_collections::cipher_uuid)))
-                .inner_join(
-                    users_organizations::table.on(ciphers::organization_uuid
-                        .eq(users_organizations::org_uuid.nullable())
-                        .and(users_organizations::user_uuid.eq(user_uuid))
-                        .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
-                )
                .inner_join(
                    users_collections::table.on(ciphers_collections::collection_uuid
                        .eq(users_collections::collection_uuid)
-                        // Only allow collection access via the confirmed membership.
-                        .and(users_organizations::user_uuid.eq(users_collections::user_uuid))),
+                        .and(users_collections::user_uuid.eq(user_uuid))),
                )
                .select((users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
                .load::<(bool, bool, bool)>(conn)
@@ -745,9 +705,6 @@ impl Cipher {
                        .and(groups::organizations_uuid.eq(users_organizations::org_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
-                // Only allow group access via a confirmed membership, since
-                // groups_users rows are kept when a membership is revoked.
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage))
                .load::<(bool, bool, bool)>(conn)
                .expect("Error getting group access restrictions")
@@ -168,16 +168,24 @@ impl Collection {
        self.update_users_revision(conn).await;

        db_run! { conn:
-            mysql {
-                diesel::insert_into(collections::table)
+            sqlite, mysql {
+                match diesel::replace_into(collections::table)
                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                    .execute(conn)
-                    .map_res("Error saving collection")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(collections::table)
+                            .filter(collections::uuid.eq(&self.uuid))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error saving collection")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving collection")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(collections::table)
                    .values(self)
                    .on_conflict(collections::uuid)
@@ -720,30 +728,53 @@ impl CollectionUser {
    ) -> EmptyResult {
        User::update_uuid_revision(user_uuid, conn).await;

-        let values = (
-            users_collections::user_uuid.eq(user_uuid),
-            users_collections::collection_uuid.eq(collection_uuid),
-            users_collections::read_only.eq(read_only),
-            users_collections::hide_passwords.eq(hide_passwords),
-            users_collections::manage.eq(manage),
-        );
-
        db_run! { conn:
-            mysql {
-                diesel::insert_into(users_collections::table)
-                    .values(values)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(values)
+            sqlite, mysql {
+                match diesel::replace_into(users_collections::table)
+                    .values((
+                        users_collections::user_uuid.eq(user_uuid),
+                        users_collections::collection_uuid.eq(collection_uuid),
+                        users_collections::read_only.eq(read_only),
+                        users_collections::hide_passwords.eq(hide_passwords),
+                        users_collections::manage.eq(manage),
+                    ))
                    .execute(conn)
-                    .map_res("Error adding user to collection")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(users_collections::table)
+                            .filter(users_collections::user_uuid.eq(user_uuid))
+                            .filter(users_collections::collection_uuid.eq(collection_uuid))
+                            .set((
+                                users_collections::user_uuid.eq(user_uuid),
+                                users_collections::collection_uuid.eq(collection_uuid),
+                                users_collections::read_only.eq(read_only),
+                                users_collections::hide_passwords.eq(hide_passwords),
+                                users_collections::manage.eq(manage),
+                            ))
+                            .execute(conn)
+                            .map_res("Error adding user to collection")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error adding user to collection")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(users_collections::table)
-                    .values(values)
+                    .values((
+                        users_collections::user_uuid.eq(user_uuid),
+                        users_collections::collection_uuid.eq(collection_uuid),
+                        users_collections::read_only.eq(read_only),
+                        users_collections::hide_passwords.eq(hide_passwords),
+                        users_collections::manage.eq(manage),
+                    ))
                    .on_conflict((users_collections::user_uuid, users_collections::collection_uuid))
                    .do_update()
-                    .set(values)
+                    .set((
+                        users_collections::read_only.eq(read_only),
+                        users_collections::hide_passwords.eq(hide_passwords),
+                        users_collections::manage.eq(manage),
+                    ))
                    .execute(conn)
                    .map_res("Error adding user to collection")
            }
@@ -878,18 +909,19 @@ impl CollectionCipher {
        Self::update_users_revision(collection_uuid, conn).await;

        db_run! { conn:
-            mysql {
-                diesel::insert_into(ciphers_collections::table)
+            sqlite, mysql {
+                // Not checking for ForeignKey Constraints here.
+                // Table ciphers_collections does not have ForeignKey Constraints which would cause conflicts.
+                // This table has no constraints pointing to itself, but only to others.
+                diesel::replace_into(ciphers_collections::table)
                    .values((
                        ciphers_collections::cipher_uuid.eq(cipher_uuid),
                        ciphers_collections::collection_uuid.eq(collection_uuid),
                    ))
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_nothing()
                    .execute(conn)
                    .map_res("Error adding cipher to collection")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(ciphers_collections::table)
                    .values((
                        ciphers_collections::cipher_uuid.eq(cipher_uuid),
@@ -146,18 +146,15 @@ impl Device {
        }

        db_run! { conn:
-            mysql {
+            sqlite, mysql {
                crate::util::retry(||
-                    diesel::insert_into(devices::table)
+                    diesel::replace_into(devices::table)
                        .values(&*self)
-                        .on_conflict(diesel::dsl::DuplicatedKeys)
-                        .do_update()
-                        .set(&*self)
                        .execute(conn),
                    10,
                ).map_res("Error saving device")
            }
-            postgresql, sqlite {
+            postgresql {
                crate::util::retry(||
                    diesel::insert_into(devices::table)
                        .values(&*self)
@@ -146,16 +146,24 @@ impl EmergencyAccess {
        self.updated_at = Utc::now().naive_utc();

        db_run! { conn:
-            mysql {
-                diesel::insert_into(emergency_access::table)
+            sqlite, mysql {
+                match diesel::replace_into(emergency_access::table)
                    .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                    .execute(conn)
-                    .map_res("Error saving emergency access")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(emergency_access::table)
+                            .filter(emergency_access::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error updating emergency access")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving emergency access")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(emergency_access::table)
                    .values(&*self)
                    .on_conflict(emergency_access::uuid)
@@ -113,7 +113,7 @@ pub enum EventType {
    OrganizationUserAdminResetTwoFactor = 1519,
    // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
    // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
-    OrganizationUserNotificationBannerActionClicked = 1522,
+    // OrganizationUserNotificationBannerActionClicked = 1522,

    // Organization
    OrganizationUpdated = 1600,
@@ -208,23 +208,20 @@ impl Event {
    /// Basic Queries
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            mysql {
-                diesel::insert_into(event::table)
-                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
-                    .execute(conn)
-                    .map_res("Error saving event")
+            sqlite, mysql {
+                diesel::replace_into(event::table)
+                .values(self)
+                .execute(conn)
+                .map_res("Error saving event")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(event::table)
-                    .values(self)
-                    .on_conflict(event::uuid)
-                    .do_update()
-                    .set(self)
-                    .execute(conn)
-                    .map_res("Error saving event")
+                .values(self)
+                .on_conflict(event::uuid)
+                .do_update()
+                .set(self)
+                .execute(conn)
+                .map_res("Error saving event")
            }
        }
    }
@@ -77,16 +77,24 @@ impl Folder {
        self.updated_at = Utc::now().naive_utc();

        db_run! { conn:
-            mysql {
-                diesel::insert_into(folders::table)
+            sqlite, mysql {
+                match diesel::replace_into(folders::table)
                    .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                    .execute(conn)
-                    .map_res("Error saving folder")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(folders::table)
+                            .filter(folders::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error saving folder")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving folder")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(folders::table)
                    .values(&*self)
                    .on_conflict(folders::uuid)
@@ -139,15 +147,16 @@ impl Folder {
 impl FolderCipher {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            mysql {
-                diesel::insert_into(folders_ciphers::table)
+            sqlite, mysql {
+                // Not checking for ForeignKey Constraints here.
+                // Table folders_ciphers does not have ForeignKey Constraints which would cause conflicts.
+                // This table has no constraints pointing to itself, but only to others.
+                diesel::replace_into(folders_ciphers::table)
                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_nothing()
                    .execute(conn)
                    .map_res("Error adding cipher to folder")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(folders_ciphers::table)
                    .values(self)
                    .on_conflict((folders_ciphers::cipher_uuid, folders_ciphers::folder_uuid))
@@ -13,7 +13,7 @@ use crate::{
 };
 use macros::UuidFromParam;

-use super::{CollectionId, Membership, MembershipId, MembershipStatus, OrganizationId, User, UserId};
+use super::{CollectionId, Membership, MembershipId, OrganizationId, User, UserId};

 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
 #[diesel(table_name = groups)]
@@ -166,16 +166,24 @@ impl Group {
        self.revision_date = Utc::now().naive_utc();

        db_run! { conn:
-            mysql {
-                diesel::insert_into(groups::table)
+            sqlite, mysql {
+                match diesel::replace_into(groups::table)
                    .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                    .execute(conn)
-                    .map_res("Error saving group")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(groups::table)
+                            .filter(groups::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error saving group")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving group")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(groups::table)
                    .values(&*self)
                    .on_conflict(groups::uuid)
@@ -268,9 +276,6 @@ impl Group {
                        .and(users_organizations::org_uuid.eq(groups::organizations_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
-                // Only allow full access via a confirmed membership, since
-                // groups_users rows are kept when a membership is revoked.
-                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(groups::organizations_uuid.eq(org_uuid))
                .filter(groups::access_all.eq(true))
                .select(groups::access_all)
@@ -321,30 +326,53 @@ impl CollectionGroup {
            group_user.update_user_revision(conn).await;
        }

-        let values = (
-            collections_groups::collections_uuid.eq(&self.collections_uuid),
-            collections_groups::groups_uuid.eq(&self.groups_uuid),
-            collections_groups::read_only.eq(&self.read_only),
-            collections_groups::hide_passwords.eq(&self.hide_passwords),
-            collections_groups::manage.eq(&self.manage),
-        );
-
        db_run! { conn:
-            mysql {
-                diesel::insert_into(collections_groups::table)
-                    .values(values)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(values)
+            sqlite, mysql {
+                match diesel::replace_into(collections_groups::table)
+                    .values((
+                        collections_groups::collections_uuid.eq(&self.collections_uuid),
+                        collections_groups::groups_uuid.eq(&self.groups_uuid),
+                        collections_groups::read_only.eq(&self.read_only),
+                        collections_groups::hide_passwords.eq(&self.hide_passwords),
+                        collections_groups::manage.eq(&self.manage),
+                    ))
                    .execute(conn)
-                    .map_res("Error adding group to collection")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(collections_groups::table)
+                            .filter(collections_groups::collections_uuid.eq(&self.collections_uuid))
+                            .filter(collections_groups::groups_uuid.eq(&self.groups_uuid))
+                            .set((
+                                collections_groups::collections_uuid.eq(&self.collections_uuid),
+                                collections_groups::groups_uuid.eq(&self.groups_uuid),
+                                collections_groups::read_only.eq(&self.read_only),
+                                collections_groups::hide_passwords.eq(&self.hide_passwords),
+                                collections_groups::manage.eq(&self.manage),
+                            ))
+                            .execute(conn)
+                            .map_res("Error adding group to collection")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error adding group to collection")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(collections_groups::table)
-                    .values(values)
+                    .values((
+                        collections_groups::collections_uuid.eq(&self.collections_uuid),
+                        collections_groups::groups_uuid.eq(&self.groups_uuid),
+                        collections_groups::read_only.eq(self.read_only),
+                        collections_groups::hide_passwords.eq(self.hide_passwords),
+                        collections_groups::manage.eq(self.manage),
+                    ))
                    .on_conflict((collections_groups::collections_uuid, collections_groups::groups_uuid))
                    .do_update()
-                    .set(values)
+                    .set((
+                        collections_groups::read_only.eq(self.read_only),
+                        collections_groups::hide_passwords.eq(self.hide_passwords),
+                        collections_groups::manage.eq(self.manage),
+                    ))
                    .execute(conn)
                    .map_res("Error adding group to collection")
            }
@@ -469,25 +497,43 @@ impl GroupUser {
    pub async fn save(&mut self, conn: &DbConn) -> EmptyResult {
        self.update_user_revision(conn).await;

-        let values = (
-            groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
-            groups_users::groups_uuid.eq(&self.groups_uuid),
-        );
-
        db_run! { conn:
-            mysql {
-                diesel::insert_into(groups_users::table)
-                    .values(values)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_nothing()
+            sqlite, mysql {
+                match diesel::replace_into(groups_users::table)
+                    .values((
+                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+                        groups_users::groups_uuid.eq(&self.groups_uuid),
+                    ))
                    .execute(conn)
-                    .map_res("Error adding user to group")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(groups_users::table)
+                            .filter(groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid))
+                            .filter(groups_users::groups_uuid.eq(&self.groups_uuid))
+                            .set((
+                                groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+                                groups_users::groups_uuid.eq(&self.groups_uuid),
+                            ))
+                            .execute(conn)
+                            .map_res("Error adding user to group")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error adding user to group")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(groups_users::table)
-                    .values(values)
+                    .values((
+                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+                        groups_users::groups_uuid.eq(&self.groups_uuid),
+                    ))
                    .on_conflict((groups_users::users_organizations_uuid, groups_users::groups_uuid))
-                    .do_nothing()
+                    .do_update()
+                    .set((
+                        groups_users::users_organizations_uuid.eq(&self.users_organizations_uuid),
+                        groups_users::groups_uuid.eq(&self.groups_uuid),
+                    ))
                    .execute(conn)
                    .map_res("Error adding user to group")
            }
@@ -22,7 +22,7 @@ mod user_signature_key_pair;
 pub use self::archive::Archive;
 pub use self::attachment::{Attachment, AttachmentId};
 pub use self::auth_request::{AuthRequest, AuthRequestId};
-pub use self::cipher::{Cipher, CipherId, RepromptType, is_data_blob_encrypted};
+pub use self::cipher::{Cipher, CipherId, RepromptType};
 pub use self::collection::{Collection, CollectionCipher, CollectionId, CollectionUser};
 pub use self::device::{Device, DeviceId, DeviceType, DeviceWithAuthRequest, PushId};
 pub use self::emergency_access::{EmergencyAccess, EmergencyAccessId, EmergencyAccessStatus, EmergencyAccessType};
@@ -40,5 +40,5 @@ pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType};
+pub use self::user::{Invitation, SsoUser, User, UserId, UserKdfType, UserStampException};
 pub use self::user_signature_key_pair::{SignatureAlgorithm, UserSignatureKeyPair};
@@ -49,7 +49,6 @@ pub enum OrgPolicyType {
    // AutotypeDefaultSetting = 17, // Not supported yet
    // AutoConfirm = 18, // Not supported (not implemented yet)
    // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
-    OrganizationUserNotification = 20,
 }

 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs#L5
@@ -187,26 +186,6 @@ impl OrgPolicy {
        .await
    }

-    pub async fn find_accepted_and_confirmed_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
-        conn.run(move |conn| {
-            org_policies::table
-                .inner_join(
-                    users_organizations::table.on(users_organizations::org_uuid
-                        .eq(org_policies::org_uuid)
-                        .and(users_organizations::user_uuid.eq(user_uuid))),
-                )
-                .filter(
-                    users_organizations::status
-                        .eq(MembershipStatus::Accepted as i32)
-                        .or(users_organizations::status.eq(MembershipStatus::Confirmed as i32)),
-                )
-                .select(org_policies::all_columns)
-                .load::<Self>(conn)
-                .expect("Error loading org_policy")
-        })
-        .await
-    }
-
    pub async fn find_by_org_and_type(
        org_uuid: &OrganizationId,
        policy_type: OrgPolicyType,
@@ -57,10 +57,6 @@ pub struct Membership {
    pub atype: i32,
    pub reset_password_key: Option<String>,
    pub external_id: Option<String>,
-    /// A copy of the user's v2 upgrade token, kept when a v1 -> v2 upgrade leaves the account
-    /// recovery key (`reset_password_key`) wrapped by the v1 user key. It lets the organization
-    /// unwrap the v2 user key from it. Opaque to us, like `User::v2_upgrade_token`.
-    pub v2_upgrade_token: Option<String>,
 }

 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -278,7 +274,6 @@ impl Membership {
            atype: MembershipType::User as i32,
            reset_password_key: None,
            external_id: None,
-            v2_upgrade_token: None,
        }
    }

@@ -358,16 +353,25 @@ impl Organization {
        }

        db_run! { conn:
-            mysql {
-                diesel::insert_into(organizations::table)
+            sqlite, mysql {
+                match diesel::replace_into(organizations::table)
                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                    .execute(conn)
-                    .map_res("Error saving organization")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(organizations::table)
+                            .filter(organizations::uuid.eq(&self.uuid))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error saving organization")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving organization")
+
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(organizations::table)
                    .values(self)
                    .on_conflict(organizations::uuid)
@@ -749,16 +753,24 @@ impl Membership {
        User::update_uuid_revision(&self.user_uuid, conn).await;

        db_run! { conn:
-            mysql {
-                diesel::insert_into(users_organizations::table)
+            sqlite, mysql {
+                match diesel::replace_into(users_organizations::table)
                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                    .execute(conn)
-                    .map_res("Error adding user to organization")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(users_organizations::table)
+                            .filter(users_organizations::uuid.eq(&self.uuid))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error adding user to organization")
+                    },
+                    Err(e) => Err(e.into()),
+                }.map_res("Error adding user to organization")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(users_organizations::table)
                    .values(self)
                    .on_conflict(users_organizations::uuid)
@@ -849,21 +861,6 @@ impl Membership {
        .await
    }

-    pub async fn find_accepted_and_confirmed_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
-        conn.run(move |conn| {
-            users_organizations::table
-                .filter(users_organizations::user_uuid.eq(user_uuid))
-                .filter(
-                    users_organizations::status
-                        .eq(MembershipStatus::Accepted as i32)
-                        .or(users_organizations::status.eq(MembershipStatus::Confirmed as i32)),
-                )
-                .load::<Self>(conn)
-                .unwrap_or_default()
-        })
-        .await
-    }
-
    pub async fn find_invited_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            users_organizations::table
@@ -1189,16 +1186,25 @@ impl Membership {
 impl OrganizationApiKey {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            mysql {
-                diesel::insert_into(organization_api_key::table)
+            sqlite, mysql {
+                match diesel::replace_into(organization_api_key::table)
                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(self)
                    .execute(conn)
-                    .map_res("Error saving organization")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(organization_api_key::table)
+                            .filter(organization_api_key::uuid.eq(&self.uuid))
+                            .set(self)
+                            .execute(conn)
+                            .map_res("Error saving organization")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving organization")
+
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(organization_api_key::table)
                    .values(self)
                    .on_conflict((organization_api_key::uuid, organization_api_key::org_uuid))
@@ -202,16 +202,24 @@ impl Send {
        self.revision_date = Utc::now().naive_utc();

        db_run! { conn:
-            mysql {
-                diesel::insert_into(sends::table)
+            sqlite, mysql {
+                match diesel::replace_into(sends::table)
                    .values(&*self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_update()
-                    .set(&*self)
                    .execute(conn)
-                    .map_res("Error saving send")
+                {
+                    Ok(_) => Ok(()),
+                    // Record already exists and causes a Foreign Key Violation because replace_into() wants to delete the record first.
+                    Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => {
+                        diesel::update(sends::table)
+                            .filter(sends::uuid.eq(&self.uuid))
+                            .set(&*self)
+                            .execute(conn)
+                            .map_res("Error saving send")
+                    }
+                    Err(e) => Err(e.into()),
+                }.map_res("Error saving send")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(sends::table)
                    .values(&*self)
                    .on_conflict(sends::uuid)
@@ -6,7 +6,6 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::EmptyResult,
-    auth::DEFAULT_ACCESS_VALIDITY,
    crypto,
    db::{
        DbConn,
@@ -72,8 +71,6 @@ pub struct User {

    pub external_id: Option<String>, // Todo: Needs to be removed in the future, this is not used anymore.

-    pub key_id: Option<KeyId>,
-
    // "v2" account cryptographic state. Either all of these are set (together with a row in
    // `user_signature_key_pairs`) or none of them are; see `User::is_v2`.
    pub signed_public_key: Option<String>,
@@ -110,28 +107,13 @@ enum UserStatus {
    _Disabled = 2,
 }

-/// A previous security stamp that is still accepted, until `expire`.
 #[derive(Serialize, Deserialize)]
 pub struct UserStampException {
-    /// The routes the stamp is still accepted on, or `None` for any route.
-    pub routes: Option<Vec<String>>,
+    pub routes: Vec<String>,
    pub security_stamp: String,
    pub expire: i64,
 }

-impl UserStampException {
-    pub fn is_expired(&self) -> bool {
-        Utc::now().timestamp() > self.expire
-    }
-
-    /// Whether this exception lets a token carrying `security_stamp` through on `route`.
-    pub fn allows(&self, security_stamp: &str, route: &str) -> bool {
-        !self.is_expired()
-            && self.security_stamp == security_stamp
-            && self.routes.as_ref().is_none_or(|routes| routes.iter().any(|r| r == route))
-    }
-}
-
 /// Local methods
 impl User {
    pub const CLIENT_KDF_TYPE_DEFAULT: i32 = UserKdfType::Pbkdf2 as i32;
@@ -183,8 +165,6 @@ impl User {

            external_id: None, // Todo: Needs to be removed in the future, this is not used anymore.

-            key_id: None,
-
            signed_public_key: None,
            security_state: None,
            security_version: None,
@@ -255,41 +235,10 @@ impl User {

    pub async fn reset_security_stamp(&mut self, conn: &DbConn) -> EmptyResult {
        self.security_stamp = get_uuid();
-        // A reset is meant to end the other sessions, which a key rotation's grace would undo. The
-        // route exceptions stay, since they are set right before a reset, for the stamp it replaces.
-        // This is also where expired exceptions get dropped.
-        let mut exceptions = self.stamp_exceptions();
-        exceptions.retain(|e| e.routes.is_some() && !e.is_expired());
-        self.set_stamp_exceptions(&exceptions);
        Device::rotate_refresh_tokens_by_user(&self.uuid, conn).await?;
        Ok(())
    }

-    /// Resets the security stamp after a key rotation, while letting the access tokens already
-    /// issued keep working until they expire.
-    ///
-    /// This is what upstream does: there the stamp is only checked when a token is refreshed, so a
-    /// rotation invalidates refresh tokens but not the access tokens in use. Clients rely on it to
-    /// keep a session going across a rotation. Chained rotations keep every earlier stamp that is
-    /// still within its window.
-    pub async fn reset_security_stamp_after_key_rotation(&mut self, conn: &DbConn) -> EmptyResult {
-        let previous_stamp = self.security_stamp.clone();
-        let mut grace: Vec<UserStampException> =
-            self.stamp_exceptions().into_iter().filter(|e| e.routes.is_none() && !e.is_expired()).collect();
-
-        self.reset_security_stamp(conn).await?;
-
-        grace.push(UserStampException {
-            routes: None,
-            security_stamp: previous_stamp,
-            expire: (Utc::now() + *DEFAULT_ACCESS_VALIDITY).timestamp(),
-        });
-        let mut exceptions = self.stamp_exceptions();
-        exceptions.extend(grace);
-        self.set_stamp_exceptions(&exceptions);
-        Ok(())
-    }
-
    /// Set the stamp_exception to only allow a subsequent request matching a specific route using the current security-stamp.
    ///
    /// # Arguments
@@ -298,30 +247,17 @@ impl User {
    ///   After these 2 minutes this stamp will expire.
    ///
    pub fn set_stamp_exception(&mut self, route_exception: Vec<String>) {
-        self.set_stamp_exceptions(&[UserStampException {
-            routes: Some(route_exception),
+        let stamp_exception = UserStampException {
+            routes: route_exception,
            security_stamp: self.security_stamp.clone(),
            expire: (Utc::now() + TimeDelta::try_minutes(2).unwrap()).timestamp(),
-        }]);
+        };
+        self.stamp_exception = Some(serde_json::to_string(&stamp_exception).unwrap_or_default());
    }

-    /// The previous security stamps that are still accepted, expired ones included.
-    pub fn stamp_exceptions(&self) -> Vec<UserStampException> {
-        let Some(stored) = self.stamp_exception.as_deref() else {
-            return Vec::new();
-        };
-        // Before key rotations kept sessions alive, only a single route exception was stored.
-        serde_json::from_str::<Vec<UserStampException>>(stored)
-            .or_else(|_| serde_json::from_str::<UserStampException>(stored).map(|e| vec![e]))
-            .unwrap_or_default()
-    }
-
-    fn set_stamp_exceptions(&mut self, exceptions: &[UserStampException]) {
-        self.stamp_exception = if exceptions.is_empty() {
-            None
-        } else {
-            Some(serde_json::to_string(&exceptions).unwrap_or_default())
-        };
+    /// Resets the stamp_exception to prevent re-use of the previous security-stamp
+    pub fn reset_stamp_exception(&mut self) {
+        self.stamp_exception = None;
    }

    pub fn display_name(&self) -> &str {
@@ -340,7 +276,7 @@ impl User {
        if !self.is_v2() {
            return None;
        }
-        UserSignatureKeyPair::find_by_user(&self.uuid, conn).await
+        UserSignatureKeyPair::find_active_by_user(&self.uuid, conn).await
    }

    pub async fn account_keys_json(&self, conn: &DbConn) -> Value {
@@ -387,8 +323,8 @@ impl User {
        })
    }

-    pub fn v2_upgrade_token_json(&self) -> Option<Value> {
-        self.v2_upgrade_token.as_ref().and_then(|token| serde_json::from_str(token).ok())
+    pub fn v2_upgrade_token_json(&self) -> Value {
+        self.v2_upgrade_token.as_ref().and_then(|token| serde_json::from_str(token).ok()).unwrap_or(Value::Null)
    }

    pub async fn to_json(&self, conn: &DbConn) -> Value {
@@ -397,11 +333,6 @@ impl User {
            orgs_json.push(c.to_json(conn).await);
        }

-        let mut orgs_new_json = Vec::new();
-        for c in Membership::find_accepted_and_confirmed_by_user(&self.uuid, conn).await {
-            orgs_new_json.push(c.to_json(conn).await);
-        }
-
        let twofactor_enabled = !TwoFactor::find_by_user(&self.uuid, conn).await.is_empty();

        // TODO: Might want to save the status field in the DB
@@ -428,7 +359,6 @@ impl User {
            "privateKey": self.private_key,
            "securityStamp": self.security_stamp,
            "organizations": orgs_json,
-            "organizationsNew": orgs_new_json,
            "providers": [],
            "providerOrganizations": [],
            "forcePasswordReset": false,
@@ -594,17 +524,15 @@ impl Invitation {
        }

        db_run! { conn:
-            // Not checking for ForeignKey Constraints here
-            // Table invitations does not have any ForeignKey Constraints.
-            mysql {
-                diesel::insert_into(invitations::table)
+            sqlite, mysql {
+                // Not checking for ForeignKey Constraints here
+                // Table invitations does not have any ForeignKey Constraints.
+                diesel::replace_into(invitations::table)
                    .values(self)
-                    .on_conflict(diesel::dsl::DuplicatedKeys)
-                    .do_nothing()
                    .execute(conn)
                    .map_res("Error saving invitation")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(invitations::table)
                    .values(self)
                    .on_conflict(invitations::email)
@@ -658,47 +586,16 @@ impl Invitation {
 #[from(forward)]
 pub struct UserId(String);

-#[derive(
-    Clone,
-    Debug,
-    DieselNewType,
-    FromForm,
-    PartialEq,
-    Eq,
-    Hash,
-    Serialize,
-    Deserialize,
-    AsRef,
-    Deref,
-    Display,
-    From,
-    UuidFromParam,
-)]
-#[deref(forward)]
-#[from(forward)]
-pub struct KeyId(#[serde(deserialize_with = "deserialize_key_id")] String);
-
-/// Rejects a key id from a request that isn't 16 bytes as lowercase hex, as upstream's `[KeyId]` does.
-///
-/// Ref: <https://github.com/bitwarden/server/blob/main/src/Core/KeyManagement/Models/Data/KeyId.cs>
-fn deserialize_key_id<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
-    let key_id = <String as serde::Deserialize>::deserialize(deserializer)?;
-    if key_id.len() != 32 || !key_id.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) {
-        return Err(serde::de::Error::custom("Key id must be a 32 character lowercase hex-encoded string."));
-    }
-    Ok(key_id)
-}
-
 impl SsoUser {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
-            mysql {
-                diesel::insert_into(sso_users::table)
+            sqlite, mysql {
+                diesel::replace_into(sso_users::table)
                    .values(self)
                    .execute(conn)
                    .map_res("Error saving SSO user")
            }
-            postgresql, sqlite {
+            postgresql {
                diesel::insert_into(sso_users::table)
                    .values(self)
                    .execute(conn)
@@ -9,6 +9,7 @@ use crate::{
    error::MapResult,
    util::get_uuid,
 };
+use macros::UuidFromParam;

 use super::UserId;

@@ -46,13 +47,28 @@ pub enum SignatureAlgorithm {
 }

 impl SignatureAlgorithm {
-    pub fn parse(algorithm: &str) -> Option<Self> {
+    pub fn from_str(algorithm: &str) -> Option<Self> {
        match algorithm {
            "ed25519" => Some(Self::Ed25519),
            "mldsa44" => Some(Self::MlDsa44),
            _ => None,
        }
    }
+
+    pub fn from_i32(algorithm: i32) -> Option<Self> {
+        match algorithm {
+            0 => Some(Self::Ed25519),
+            1 => Some(Self::MlDsa44),
+            _ => None,
+        }
+    }
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Ed25519 => "ed25519",
+            Self::MlDsa44 => "mldsa44",
+        }
+    }
 }

 /// Local methods
@@ -112,8 +128,9 @@ impl UserSignatureKeyPair {
        }
    }

-    /// The user's key pair. There is at most one, enforced by a unique index on `user_uuid`.
-    pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<Self> {
+    /// The key pair currently in use by the user. There is at most one today, enforced by a unique
+    /// index on `user_uuid`.
+    pub async fn find_active_by_user(user_uuid: &UserId, conn: &DbConn) -> Option<Self> {
        conn.run(move |conn| {
            user_signature_key_pairs::table
                .filter(user_signature_key_pairs::user_uuid.eq(user_uuid))
@@ -133,5 +150,20 @@ impl UserSignatureKeyPair {
    }
 }

-#[derive(Clone, Debug, AsRef, Deref, DieselNewType, Display, From, Hash, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(
+    Clone,
+    Debug,
+    AsRef,
+    Deref,
+    DieselNewType,
+    Display,
+    From,
+    FromForm,
+    Hash,
+    PartialEq,
+    Eq,
+    Serialize,
+    Deserialize,
+    UuidFromParam,
+)]
 pub struct UserSignatureKeyPairId(String);
@@ -217,7 +217,6 @@ table! {
        api_key -> Nullable<Text>,
        avatar_color -> Nullable<Text>,
        external_id -> Nullable<Text>,
-        key_id -> Nullable<Text>,
        signed_public_key -> Nullable<Text>,
        security_state -> Nullable<Text>,
        security_version -> Nullable<Integer>,
@@ -259,7 +258,6 @@ table! {
        atype -> Integer,
        reset_password_key -> Nullable<Text>,
        external_id -> Nullable<Text>,
-        v2_upgrade_token -> Nullable<Text>,
    }
 }

@@ -14,10 +14,7 @@ use reqwest::{
 };
 use url::Host;

-use crate::{
-    CONFIG,
-    util::{get_env_bool, is_global},
-};
+use crate::{CONFIG, util::is_global};

 pub fn make_http_request(method: reqwest::Method, url: &str) -> Result<reqwest::RequestBuilder, crate::Error> {
    static INSTANCE: LazyLock<Client> =
@@ -39,7 +36,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
    let mut headers = header::HeaderMap::new();
    headers.insert(header::USER_AGENT, header::HeaderValue::from_static("Vaultwarden"));

-    let redirect_policy = reqwest::redirect::Policy::custom(move |attempt| {
+    let redirect_policy = reqwest::redirect::Policy::custom(|attempt| {
        if attempt.previous().len() >= 5 {
            return attempt.error("Too many redirects");
        }
@@ -48,7 +45,7 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
            return attempt.error("Invalid host");
        };

-        if enforce_block && let Err(e) = should_block_host(&host) {
+        if let Err(e) = should_block_host(&host) {
            return attempt.error(e);
        }

@@ -62,14 +59,6 @@ pub fn get_reqwest_client_builder(enforce_block: bool) -> ClientBuilder {
        .timeout(Duration::from_secs(10))
 }

-fn dns_prefer_ipv6() -> bool {
-    // CONFIG may require DNS to initialize, so avoid forcing it during bootstrap.
-    match LazyLock::get(&CONFIG) {
-        Some(config) => config.dns_prefer_ipv6(),
-        None => get_env_bool("DNS_PREFER_IPV6").unwrap_or(false),
-    }
-}
-
 fn should_block_ip(ip: IpAddr) -> bool {
    if !CONFIG.http_request_block_non_global_ips() {
        return false;
@@ -269,8 +258,12 @@ impl CustomDnsResolver {
    fn new() -> Arc<Self> {
        TokioResolver::builder(TokioRuntimeProvider::default())
            .and_then(|mut builder| {
-                // Query both families; the preferred order is applied per lookup below.
-                builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
+                // Hickory's default since v0.26 is `Ipv6AndIpv4`, which sorts IPv6 first
+                // This might cause issues on IPv4 only systems or containers
+                // Unless someone enabled DNS_PREFER_IPV6, use Ipv4AndIpv6, which returns IPv4 first which was our previous default
+                if !CONFIG.dns_prefer_ipv6() {
+                    builder.options_mut().ip_strategy = hickory_resolver::config::LookupIpStrategy::Ipv4AndIpv6;
+                }
                builder.build()
            })
            .inspect_err(|e| warn!("Error creating Hickory resolver, falling back to default: {e:?}"))
@@ -296,17 +289,6 @@ impl CustomDnsResolver {
    }
 }

-fn sort_addresses(addresses: &mut [SocketAddr], prefer_ipv6: bool) {
-    // `sort_by_key` orders `false` before `true`.
-    // When IPv6 is preferred, IPv6 addresses return `false` for `is_ipv4()` and sort first.
-    // When IPv4 is preferred, IPv4 addresses return `false` for `is_ipv6()` and sort first.
-    if prefer_ipv6 {
-        addresses.sort_by_key(SocketAddr::is_ipv4);
-    } else {
-        addresses.sort_by_key(SocketAddr::is_ipv6);
-    }
-}
-
 fn pre_resolve(name: &str, enforce_block: bool) -> Result<(), CustomHttpClientError> {
    let Ok(host) = get_valid_host(name) else {
        return Err(CustomHttpClientError::Invalid {
@@ -338,9 +320,7 @@ impl Resolve for CustomDns {
        let this = Arc::clone(&self.resolver);
        Box::pin(async move {
            let name = name.as_str();
-            let mut results = this.resolve_domain(name, enforce_block).await?;
-            // Recheck after bootstrap so long-lived clients adopt the loaded config.
-            sort_addresses(&mut results, dns_prefer_ipv6());
+            let results = this.resolve_domain(name, enforce_block).await?;
            if results.is_empty() {
                warn!("Unable to resolve {name} to any valid IP address");
            }
@@ -359,29 +339,10 @@ pub(crate) mod aws {
    };
    use reqwest::Client;

-    use super::get_reqwest_client_builder;
-
    // Adapter that wraps reqwest to be compatible with the AWS SDK
    #[derive(Debug)]
    pub(crate) struct AwsReqwestConnector {
-        client: Client,
-    }
-
-    impl AwsReqwestConnector {
-        pub(crate) fn new() -> Self {
-            let client = get_reqwest_client_builder(false).build().expect("Failed to build AWS HTTP client");
-            Self {
-                client,
-            }
-        }
-    }
-
-    fn connector_error(error: reqwest::Error) -> ConnectorError {
-        if error.is_timeout() {
-            ConnectorError::timeout(Box::new(error))
-        } else {
-            ConnectorError::io(Box::new(error))
-        }
+        pub(crate) client: Client,
    }

    impl HttpConnector for AwsReqwestConnector {
@@ -401,10 +362,10 @@ pub(crate) mod aws {
                    req_builder = req_builder.body(body_bytes.to_vec());
                }

-                let response = req_builder.send().await.map_err(connector_error)?;
+                let response = req_builder.send().await.map_err(|e| ConnectorError::io(Box::new(e)))?;

                let status = response.status().into();
-                let bytes = response.bytes().await.map_err(connector_error)?;
+                let bytes = response.bytes().await.map_err(|e| ConnectorError::io(Box::new(e)))?;

                Ok(HttpResponse::new(status, bytes.into()))
            };
@@ -430,7 +391,7 @@ pub(crate) mod aws {
 mod tests {
    use super::*;
    use crate::util::is_global_hardcoded;
-    use std::net::{Ipv4Addr, Ipv6Addr};
+    use std::net::Ipv4Addr;
    use url::Host;

    // ===
@@ -443,26 +404,6 @@ mod tests {
        }
    }

-    #[test]
-    fn dns_setup_does_not_initialize_config() {
-        assert!(LazyLock::get(&CONFIG).is_none());
-        drop(CustomDns::instance(false));
-        assert!(LazyLock::get(&CONFIG).is_none());
-    }
-
-    #[test]
-    fn dns_preference_orders_addresses() {
-        let ipv4 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);
-        let ipv6 = SocketAddr::new(IpAddr::V6(Ipv6Addr::LOCALHOST), 0);
-        let mut addresses = [ipv6, ipv4];
-
-        sort_addresses(&mut addresses, false);
-        assert_eq!(addresses, [ipv4, ipv6]);
-
-        sort_addresses(&mut addresses, true);
-        assert_eq!(addresses, [ipv6, ipv4]);
-    }
-
    #[test]
    fn dotted_decimal_loopback_normalizes() {
        let ip = parse_to_ip("127.0.0.1").unwrap();
@@ -4,10 +4,10 @@
 *
 * To rebuild or modify this file with the latest versions of the included
 * software please visit:
- *   https://datatables.net/download/#bs5/dt-3.0.4
+ *   https://datatables.net/download/#bs5/dt-3.0.3
 *
 * Included libraries:
- *   DataTables 3.0.4
+ *   DataTables 3.0.3
 */

 /*! DataTables Bootstrap 5 integration
@@ -636,18 +636,6 @@ table.dataTable.table-sm > thead > tr td.dt-type-date .dt-column-order,
 table.dataTable.table-sm > thead > tr td.dt-type-numeric .dt-column-order {
  left: 0.25rem;
 }
-table.dataTable.table-sm > thead > tr th.dt-left .dt-column-order, table.dataTable.table-sm > thead > tr th.dt-head-left .dt-column-order,
-table.dataTable.table-sm > thead > tr td.dt-left .dt-column-order,
-table.dataTable.table-sm > thead > tr td.dt-head-left .dt-column-order {
-  left: auto;
-  right: 0.25rem;
-}
-table.dataTable.table-sm > thead > tr th.dt-right .dt-column-order, table.dataTable.table-sm > thead > tr th.dt-head-right .dt-column-order,
-table.dataTable.table-sm > thead > tr td.dt-right .dt-column-order,
-table.dataTable.table-sm > thead > tr td.dt-head-right .dt-column-order {
-  left: 0.25rem;
-  right: auto;
-}

 div.dt-scroll-head table.table-bordered {
  border-bottom-width: 0;
@@ -77,18 +77,10 @@ pub(crate) fn operator_for_path(path: &str) -> Result<opendal::Operator, crate::

 #[cfg(s3)]
 mod s3 {
-    use std::sync::LazyLock;
-
-    use opendal_http_transport_reqwest::ReqwestTransport;
    use reqwest::Url;

    use crate::error::Error;

-    static HTTP_CLIENT: LazyLock<reqwest::Client> = LazyLock::new(|| {
-        // Storage endpoints are administrator-configured and may be private.
-        crate::http_client::get_reqwest_client_builder(false).build().expect("Failed to build OpenDAL HTTP client")
-    });
-
    pub(super) fn is_uri(path: &str) -> bool {
        path.starts_with("s3://")
    }
@@ -185,7 +177,12 @@ mod s3 {

                let chain = DEFAULT_CREDENTIAL_CHAIN
                    .get_or_init(|| {
-                        let conf = ProviderConfig::default().with_http_client(AwsReqwestConnector::new());
+                        let reqwest_client = reqwest::Client::builder().build().unwrap();
+                        let connector = AwsReqwestConnector {
+                            client: reqwest_client,
+                        };
+
+                        let conf = ProviderConfig::default().with_http_client(connector);

                        DefaultCredentialsChain::builder().configure(conf).build()
                    })
@@ -239,9 +236,7 @@ mod s3 {
                builder.credential_provider_chain(ProvideCredentialChain::new().push(OpenDALS3CredentialProvider));
        }

-        let http_transport = opendal::HttpTransporter::new(ReqwestTransport::new(HTTP_CLIENT.clone()));
-        let context = opendal::OperationContext::new().with_http_transport(http_transport);
-        Ok(opendal::Operator::new(builder)?.with_context(context))
+        Ok(opendal::Operator::new(builder)?)
    }

    fn uri_has_option(uri: &opendal::OperatorUri, names: &[&str]) -> bool {